CODEXIS, INC.

Previous wording

•If we are unable to develop and commercialize new products for the pharmaceutical, biotherapeutics, diagnostics and life science tools markets, our business and prospects will be harmed.

Current wording

•If we are unable to develop and commercialize new technologies and products for the pharmaceutical and life science tools markets, our business and prospects will be harmed.

Previous wording

•We are dependent on a limited number of third-party contract manufacturers for large scale production of substantially all of our enzymes. We are working to qualify new contract manufacturers to produce certain of our enzymes, however those efforts may not be successful and therefore, we may experience limitations on our ability to supply our enzymes to customers.

Current wording

•We are dependent on a limited number of third-party contract manufacturers for large scale production of substantially all of our enzymes.

Previous wording

•As a result of our strategic shift and our refined focus on certain programs and business lines, we may fail to capitalize on other opportunities that may be more profitable or for which there is a greater likelihood of success.

Current wording

•As a result of our refined focus on certain programs and business lines, we may fail to capitalize on other opportunities that may be more profitable or for which there is a greater likelihood of success.

Previous wording

•Given our change in strategic direction, we may receive limited revenue or no future value from certain of our existing license agreements.

Current wording

•We may receive limited revenue or no future value from certain of our existing license agreements.

Previous wording

We have incurred net losses since our inception, including losses of $65.3 million, $76.2 million, and $33.6 million for the years ended December 31, 2024, 2023, and 2022, respectively, and $53.6 million and $54.9 million for the nine months ended September 30, 2025 and 2024, respectively. As of September 30, 2025 and December 31, 2024, we had an accumulated deficit of $616.4 million and $562.8 million, respectively. If we are unable to continue to successfully develop and commercialize products in our pharma biocatalysis business, increase sales of existing products and services, develop and commercialize our ECO Synthesis manufacturing platform, develop new products or services, or otherwise expand our business, whether through new or expanded collaborations or other products and services, our net losses may increase and we may never achieve profitability. In addition, some of our agreements, including the agreements with GlaxoSmithKline plc (“GSK”), Merck Sharp & Dohme (“Merck”), Novartis Pharma AG (“Novartis”), Nestlé Health Science (“Nestlé”), Aldevron LLC, Roche Sequencing Solutions, Inc., Crosswalk Therapeutics and Alphazyme LLC, provide for milestone payments, usage payments, and/or future royalty or other payments, which we will only receive if we and/or our collaborators develop and commercialize products or achieve technical milestones. We also intend to continue to fund the development of additional proprietary performance enzyme products and advance new technologies like our ECO Synthesis manufacturing platform. There can be no assurance that any of these products or services will become commercially viable or that we will ever achieve profitability on a quarterly or annual basis. If we fail to achieve profitability, or if the time required to achieve profitability is longer than we anticipate, we may not be able to continue our business. Even if we do achieve profitability, we may not be able to sustain or increase profitability on a quarterly or annual basis.

Current wording

We have incurred net losses since our inception, including losses of $44.0 million, $65.3 million, and $76.2 million, for the years ended December 31, 2025, 2024, and 2023, respectively, and $8.7 million and $20.7 million for the three months ended March 31, 2026 and 2025, respectively. As of March 31, 2026 and December 31, 2025, we had an accumulated deficit of $615.5 million and $606.8 million, respectively. If we are unable to continue to successfully develop and commercialize products in our pharma biocatalysis business, increase sales of existing products and services, develop and commercialize our ECO Synthesis manufacturing platform, develop new products or services, or otherwise expand our business, whether through new or expanded collaborations or other products and services, our net losses may increase and we may never achieve profitability. In addition, some of our agreements, including the agreements with GlaxoSmithKline plc (“GSK”), Merck Sharp & Dohme (“Merck”), Novartis Pharma AG (“Novartis”), Nestlé Health Science (“Nestlé”), Aldevron LLC, Roche Sequencing Solutions, Inc., Crosswalk Therapeutics and Alphazyme LLC, provide for milestone payments, usage payments, and/or future royalty or other payments, which we will only receive if we and/or our collaborators develop and commercialize products or achieve technical milestones. We also intend to continue to fund the development of additional proprietary performance enzyme products and advance new technologies like our ECO Synthesis manufacturing platform. There can be no assurance that any of these products or services will become commercially viable or that we will ever achieve profitability on a quarterly or annual basis. If we fail to achieve profitability, or if the time required to achieve profitability is longer than we anticipate, we may not be able to continue our business. Even if we do achieve profitability, we may not be able to sustain or increase profitability on a quarterly or annual basis.

Previous wording

Although we are no longer developing our own portfolio of biotherapeutics product candidates, we continue to develop enzyme products, including our ECO Synthesis manufacturing platform, that may be used by our customers, future customers or collaborators in connection with their biotherapeutic product candidates. The successful development of biotherapeutic candidates involves many risks and uncertainties, requires long timelines and may lead to uncertain results.

Current wording

We develop enzyme products, including our ECO Synthesis manufacturing platform, that are used by our customers, and that may be used by our future customers or collaborators in connection with their biotherapeutic product candidates. The successful development of biotherapeutic candidates involves many risks and uncertainties, requires long timelines and may lead to uncertain results.

Previous wording

In order to market a biologic or drug product in the United States, our customers, future customers or collaborators generally must undergo the following process required by the FDA:

Current wording

To market a biologic or drug product in the United States, our customers, future customers or collaborators must undergo the following process required by the FDA:

Previous wording

•completion of extensive preclinical laboratory tests and preclinical animal studies, certain of which must performed in accordance with the FDA's Good Laboratory Practice requirements;

Current wording

•completion of extensive preclinical laboratory tests and preclinical animal studies, certain of which must be performed in accordance with the FDA's Good Laboratory Practice requirements;

Previous wording

•preparation of and submission to the FDA of an New Drug Application (“NDA”) or Biologics License Application (“BLA”) after completion of all clinical studies;

Current wording

•preparation of and submission to the FDA of a New Drug Application (“NDA”) or Biologics License Application (“BLA”) after completion of all clinical studies;

Previous wording

We believe our enzyme products are exempt from compliance with the FDCA and the implementing GMP regulations of the FDA, as our products are further processed and incorporated into final drug or biologic products by our customers and as we do not make claims related to our products’ safety or effectiveness. Our products are currently manufactured following the voluntary quality standards of ISO 9001:2015, and we anticipate signing and announcing a partnership with a CDMO to provide enzymatically synthesized, GMP-grade siRNA to customers in the near term. Our planned collaboration with a CDMO may not come to fruition and, even if it does, may not scale up as anticipated. Even if the scale up plans succeed, we or the CDMO may incur delays in production or have insufficient product for consumers. And, in the event we, or our suppliers, produce products that fail to comply with voluntary quality standards or GMP standards imposed by customers, we may incur delays in fulfilling orders, write-downs or other losses, damages resulting from product liability claims and harm to our reputation.

Current wording

We believe our enzyme products are exempt from compliance with the FDCA and the FDA’s GMP implementing regulations, as our products are further processed and not incorporated into final drug or biologic products by our customers and as we do not make claims related to our products’ safety or effectiveness. Our products are currently manufactured following the voluntary quality standards of ISO 9001:2015, and we have collaborations with a number of CDMOs, and anticipate signing and announcing additional partnerships to provide enzymatically synthesized, GMP-grade siRNA to customers in the near term. Our collaboration with CDMOs may not come to fruition and, even if it does, may not scale up as anticipated. Even if the scale up plans succeed, we or the CDMO may incur delays in production or have insufficient product for customers. And, in the event we, or our suppliers, produce products that fail to comply with voluntary quality standards or GMP standards imposed by customers, we may incur delays in fulfilling orders, write-downs or other losses, damages resulting from product liability claims and harm to our reputation.

Previous wording

Although we continue to expand our customer base, our current revenues are derived from a limited number of key customers. For the nine months ended September 30, 2025 and 2024, customers that each individually contributed 10% or more of our total revenue accounted for 55% and 43% of our total revenues, respectively. We expect a limited number of customers to continue to account for a significant portion of our revenues for the foreseeable future. This customer concentration increases the risk of quarterly fluctuations in our revenues and operating results. The loss or reduction of business from one or a combination of our significant customers could materially adversely affect our revenues, financial condition and results of operations.

Current wording

Although we continue to expand our customer base, our current revenues are derived from a limited number of key customers. For the three months ended March 31, 2026 and 2025, customers that each individually contributed 10% or more of our total revenue accounted for 64% and 66% of our total revenues, respectively. We expect a limited number of customers to continue to account for a significant portion of our revenues for the foreseeable future. This customer concentration increases the risk of quarterly fluctuations in our revenues and operating results. The loss or reduction of business from one or a combination of our significant customers could materially adversely affect our revenues, financial condition and results of operations.

Previous wording

Our product supply agreements with customers generally have a finite duration, may not be extended or renewed and generally do not require the customer to purchase any particular quantity or quantities of our products. Additionally, some customers order our products on a quote and purchase order basis under standard terms and conditions, with no guarantee of future orders. While our products are not considered commodities and may not be easily substituted for by our customers, particularly when our products are used in the manufacture of active pharmaceutical ingredients, our customers may nevertheless terminate or fail to renew their product supply agreements with us or significantly curtail their purchases thereunder under certain circumstances. We are working to develop new relationships with existing or new customers, but despite these efforts we may not, at the time that any of our existing product supply agreements expire or are terminated, or purchases thereunder curtailed, have other contracts in place generating similar or material revenue. Any such expiration, termination or reduction could materially adversely affect our revenues, financial condition and results of operations. For the three and nine months ended September 30, 2025, we derived a majority of our product revenue from these product supply agreements.

Current wording

Our product supply agreements with customers generally have a finite duration, may not be extended or renewed and generally do not require the customer to purchase any particular quantity or quantities of our products. Additionally, some customers order our products on a quote and purchase order basis under standard terms and conditions, with no guarantee of future orders. While our products are not considered commodities and may not be easily substituted for by our customers, particularly when our products are used in the manufacture of active pharmaceutical ingredients, our customers may nevertheless terminate or fail to renew their product supply agreements with us or significantly curtail their purchases thereunder under certain circumstances. We are working to develop new relationships with existing or new customers, but despite these efforts we may not, at the time that any of our existing product supply agreements expire or are terminated, or purchases thereunder curtailed, have other contracts in place generating similar or material revenue. Any such expiration, termination or reduction could materially adversely affect our revenues, financial condition and results of operations. For the three months ended March 31, 2026, we derived a majority of our product revenue from these product supply agreements.

Previous wording

If we are unable to develop and commercialize new products for the pharmaceutical, biotherapeutics, diagnostics and life science tools markets, our business and prospects will be harmed.

Current wording

If we are unable to develop and commercialize new technologies and products for the pharmaceutical and life science tools markets, our business and prospects will be harmed.

Previous wording

We plan to launch new products for the pharmaceutical, biotherapeutics, diagnostics and other life science tools markets such as our ECO Synthesis manufacturing platform. These efforts are subject to numerous risks, including the following:

Current wording

We plan to continue to innovate new technologies for use in the pharmaceutical and life science tools markets. These efforts are subject to numerous risks, including the following:

Previous wording

As we continue to scale up our manufacturing processes in connection with the completed build-out of our Innovation Lab and our anticipated partnership with a CDMO to provide enzymatically synthesized, GMP-grade siRNA to customers, we may face manufacturing capacity constraints or higher-than-expected costs at our facilities, including our Innovation Lab. There can be no assurance that revenue lost due to productivity issues or capacity constraints will be recovered on expected timeframes or at all. If we are unsuccessful in remedying any productivity issues at our facilities or those of our CDMO, if we are unable to recover revenue from unproduced batches when expected or at all, or if costs at our facilities are higher than expected, we may experience material and adverse impacts on our financial condition and results of operations.

Current wording

As we continue to scale up our manufacturing processes to provide enzymatically synthesized, GMP-grade siRNA to customers, either directly or through a third-party CDMO partner, we may face manufacturing capacity constraints or higher-than-expected costs at our facilities. We currently do not manufacture GMP-grade products at any of our own facilities and are reliant on third-party CDMOs. Any delays in bringing our own facility online and meeting customer expectations may have an adverse impact on our relationship with such customer. Any failure of our third-party CDMO to meet expected delivery timelines would adversely affect our relationships with our customers, and potentially our financial condition and results of operations. There can be no assurance that revenue lost due to productivity issues or capacity constraints will be recovered on expected timeframes or at all. If we are unsuccessful in remedying any productivity issues at our facilities or those of our CDMO, if we are unable to recover revenue from unproduced batches when expected or at all, or if costs at our facilities are higher than expected, we may experience material and adverse impacts on our financial condition and results of operations.

Previous wording

We manufacture our enzymes primarily in four locations: our in-house facility in Redwood City, California, and at three third-party contract manufacturing organizations (“CMOs”): Lactosan in Kapfenberg, Austria, ACS Dobfar S.p.A. (“ACSD”) (formerly known as DPhar S.p.A) in Anagni, Italy, and Sekisui Diagnostics in Maidstone, United Kingdom. Generally, we perform smaller scale manufacturing in-house and outsource the larger scale manufacturing to these contract manufacturers. We have limited internal capacity to manufacture enzymes. As a result, we are dependent upon the performance and capacity of third-party manufacturers for the larger scale manufacturing of the enzymes used in our pharmaceutical and life sciences businesses.

Current wording

We manufacture our enzymes primarily in three locations: our in-house facility in Redwood City, California, and at two third-party contract manufacturing organizations (“CMOs”): Lactosan in Kapfenberg, Austria and ACS Dobfar S.p.A. (“ACSD”) (formerly known as DPhar S.p.A.) in Anagni, Italy. Generally, we perform smaller scale manufacturing in-house and outsource the larger scale manufacturing to these contract manufacturers. We have limited internal capacity to manufacture enzymes. As a result, we are dependent upon the performance and capacity of third-party manufacturers for the larger scale manufacturing of the enzymes used in our pharmaceutical and life sciences businesses.

Previous wording

We currently have supply agreements in place with Lactosan, ACSD and Sekisui. In the absence of a supply agreement, a contract manufacturer will be under no obligation to manufacture our enzymes and could elect to discontinue their manufacture at any time. If we require additional manufacturing capacity and are unable to obtain it in sufficient quantity, we may not be able to increase our product sales, or we may be required to make substantial capital investments to build that capacity or to contract with other manufacturers on terms that may be less favorable than the terms we currently have with our suppliers. If we choose to build our own additional manufacturing facility, it could take several years or longer before our facility is able to produce commercial volumes of our enzymes. Any resources we expend on acquiring or building internal manufacturing capabilities could be at the expense of other potentially more profitable opportunities. In addition, if we contract with other manufacturers, we may experience delays of several months in qualifying them, which could harm our relationships with our customers or collaborators and could negatively affect our revenues or operating results.

Current wording

We currently have supply agreements in place with Lactosan and ACSD. In the absence of a supply agreement, a contract manufacturer will be under no obligation to manufacture our enzymes and could elect to discontinue their manufacture at any time. If we require additional manufacturing capacity and are unable to obtain it in sufficient quantity, we may not be able to increase our product sales, or we may be required to make substantial capital investments to build that capacity or to contract with other manufacturers on terms that may be less favorable than the terms we currently have with our suppliers. If we choose to build our own additional manufacturing facility, it could take several years or longer before our facility is able to produce commercial volumes of our enzymes. Any resources we expend on acquiring or building internal manufacturing capabilities could be at the expense of other potentially more profitable opportunities. In addition, if we contract with other manufacturers, we may experience delays of several months in qualifying them, which could harm our relationships with our customers or collaborators and could negatively affect our revenues or operating results.

Previous wording

We are aware that other companies, including Ginkgo Bioworks, BRAIN Biotech AG, and Enzymicals AG, have alternative methods for obtaining and generating genetic diversity or use mutagenesis techniques to produce genetic diversity. Some companies, including Biomatter Designs, Arzeda Corp., and Enzymaster, leverage predictive computational algorithms to guide enzyme engineering efforts. In addition, academic institutions such as the California Institute of Technology, University of Washington, University of Manchester, and the Austrian Centre of Industrial Biotechnology are also working in this field. Technological development by others may result in ourtechnology, products and services, as well as products developed by our customers using our biocatalysts, becoming obsolete.

Current wording

We are aware that other companies, including Ginkgo Bioworks, BRAIN Biotech AG, and Enzymicals AG, have alternative methods for obtaining and generating genetic diversity or use mutagenesis techniques to produce genetic diversity. Some companies, including Biomatter Designs, Arzeda Corp., and Enzymaster, leverage predictive computational algorithms to guide enzyme engineering efforts. In addition, academic institutions such as the California Institute of Technology, University of Washington, University of Manchester, and the Austrian Centre of Industrial Biotechnology are also working in this field. Technological development by others may result in our technology, products and services, as well as products developed by our customers using our biocatalysts, becoming obsolete.

Previous wording

The market for supplying enzymes for use in pharma biocatalysis is fragmented. There is competition from large industrial enzyme companies, such as Novozymes and DuPont, as well as subsidiaries of larger contract research/CMOs, such as DSM-Firmenich AG, Cambrex Corporation, Lonza Group, WuXi STA and Almac Group Ltd. Some fermentation pathway design companies, like Ginkgo Bioworks, whose traditional focus has been to design microorganisms that express small molecule chemicals, could extend into designing organisms that express enzymes. There is also competition in the enzyme customization and optimization area from several smaller companies, such as BRAIN Biotech AG, Arzeda Corp., and c-LEcta GmbH.

Current wording

The market for supplying enzymes is fragmented. There is competition from large industrial enzyme companies, such as Novozymes and DuPont, as well as subsidiaries of larger contract research/CMOs, such as DSM-Firmenich AG, Cambrex Corporation, Lonza Group, WuXi STA and Almac Group Ltd. Some fermentation pathway design companies, like Ginkgo Bioworks, whose traditional focus has been to design microorganisms that express small molecule chemicals, could extend into designing organisms that express enzymes. There is also competition in the enzyme customization and optimization area from several smaller companies, such as BRAIN Biotech AG, Arzeda Corp., and c-LEcta GmbH.

Previous wording

As a result of our strategic shift and our refined focus on certain programs and business lines, we may fail to capitalize on other opportunities that may be more profitable or for which there is a greater likelihood of success.

Current wording

As a result of our refined focus on certain programs and business lines, we may fail to capitalize on other opportunities that may be more profitable or for which there is a greater likelihood of success.

Previous wording

Because we have limited financial and managerial resources, we have recently focused our efforts on developing certain programs and business lines. As a result, we may forego or delay pursuit of business opportunities that later prove to have greater commercial potential. Further our resource allocation decisions may cause us to fail to capitalize on viable commercial products or profitable market opportunities. In addition, our spending on current and future research and development programs, such as our ECO Synthesis manufacturing platform that is in development, may not yield any commercially viable products. If we do not accurately evaluate the commercial potential or target market for a particular program or business line, our business and results of operations could be harmed.

Current wording

Because we have limited financial and managerial resources, we have recently focused our efforts on developing certain programs and business lines. As a result, we may forego or delay pursuit of business opportunities that later prove to have greater commercial potential. Further our resource allocation decisions may cause us to fail to capitalize on viable commercial products or profitable market opportunities. In addition, our spending on current and future research and development programs, such as our ECO Synthesis manufacturing platform, may not yield any commercially viable products. If we do not accurately evaluate the commercial potential or target market for a particular program or business line, our business and results of operations could be harmed.

Previous wording

Given our change in strategic direction, we may receive limited revenue or no future value from certain of our existing license agreements.

Current wording

We may receive limited revenue or no future value from certain of our existing license agreements.

Previous wording

While we have historically invested significant time and financial resources in the development of biotherapeutics assets, we have terminated investment in our biotherapeutics business and in other programs. As a result, we are renegotiating some of these, along with other license agreements for product candidates in our biotherapeutics, food and feed, and non-core life science assets. For example, we entered into the Acquisition Agreement with Nestlé under which they acquired rights to our co-developed lipase enzyme CDX-7108 and we received an upfront payment and the right to downstream milestones and royalties, terminating our prior Strategic Collaboration Agreement and development agreement with Nestlé. While we are working to amend or terminate some of our agreements and enter into new agreements in such a way that we may be able to receive future revenue or other benefits, we may be unsuccessful in doing so. As a result, it remains uncertain as to whether we will receive any value or benefit from these license agreements going forward. Further, renegotiating these agreements may be costly and could divert management attention, which could have an adverse impact on our business and results of operations.

Current wording

While we have historically invested significant time and financial resources in the development of biotherapeutics assets, we have terminated investment in our biotherapeutics business and in other programs. As a result, it remains uncertain as to whether we will receive any value or benefit from these license agreements going forward.

Previous wording

•The timing of customer orders and related product revenue recognition is unpredictable and may cause our operating results to vary significantly from quarter to quarter, which could adversely affect our stock price.

Current wording

The timing of our customer orders and related product revenue recognition is unpredictable and may cause our operating results to vary significantly from quarter to quarter, which could adversely affect our stock price.

Previous wording

Reporting obligations as a public company place a considerable strain on our financial and management systems, processes and controls, as well as on our personnel. In addition, as a public company we are required to document and test our internal controls over financial reporting pursuant to Section 404 of the Sarbanes-Oxley Act so that our management can certify as to the effectiveness of our internal controls over financial reporting. Likewise, while we currently qualify as a “smaller reporting company” under the SEC rules, for any fiscal years in which we are not considered a smaller reporting company, our independent registered public accounting firm is required to provide an attestation report on the effectiveness of our internal controls over financial reporting in our Annual Reports on Form 10-K. If our management is unable to certify the effectiveness of our internal controls or if our independent registered public accounting firm cannot deliver a report attesting to the effectiveness of our internal controls over financial reporting, or if we identify or fail to remediate material weaknesses in our internal controls, we could be subject to regulatory scrutiny and a loss of public confidence, which could seriously harm our reputation and the market price of our common stock. In addition, if we do not maintain adequate financial and management personnel, processes and controls, we may not be able to manage our business effectively or accurately report our financial performance on a timely basis, which could cause a decline in our common stock price and may seriously harm our business.

Current wording

Reporting obligations as a public company place a considerable strain on our financial and management systems, processes and controls, as well as on our personnel. In addition, as a public company we are required to document and test our internal controls over financial reporting pursuant to Section 404 of the Sarbanes-Oxley Act so that our management can certify as to the effectiveness of our internal controls over financial reporting. While we currently qualify as a non-accelerated filer and smaller reporting company under the SEC rules, we are not required to include an attestation report on the effectiveness of our internal control over financial reporting from our independent registered public accounting firm. For any fiscal year in which we become an accelerated filer or large accelerated filer, our independent registered public accounting firm would be required to provide such an attestation report in our Annual Report on Form 10-K. If our management is unable to certify the effectiveness of our internal controls or if our independent registered public accounting firm cannot deliver a report attesting to the effectiveness of our internal controls over financial reporting, or if we identify or fail to remediate material weaknesses in our internal controls, we could be subject to regulatory scrutiny and a loss of public confidence, which could seriously harm our reputation and the market price of our common stock. In addition, if we do not maintain adequate financial and management personnel, processes and controls, we may not be able to manage our business effectively or accurately report our financial performance on a timely basis, which could cause a decline in our common stock price and may seriously harm our business.

Previous wording

We have made acquisitions in the past, and if appropriate opportunities become available, we expect to acquire additional businesses, assets, technologies, or products to enhance our business in the future. For example, in October 2010, we acquired substantially all of the patents and other intellectual property rights associated with Maxygen’s directed evolution technology.

Current wording

We have made acquisitions in the past, and if appropriate opportunities become available, we may acquire additional businesses, assets, technologies, or products to enhance our business in the future.

Previous wording

We expect that our future revenues will depend, in part, on the ability of our customers to obtain and maintain regulatory approvals for therapeutic products utilizing our biocatalysts and other products. Any product that receives FDA approval will remain subject to ongoing regulatory requirements for manufacturing, labeling, packaging, distribution, storage, advertising, promotion, sampling, record-keeping and submission of safety and other post-market information, among other things. Any regulatory approvals received for such products may also be subject to limitations on the approved indicated uses for which they may be marketed or to the conditions of approval, or contain requirements for potentially costly post-marketing testing and surveillance studies. For example, the holder of an approved NDA or BLA in the United States is obligated to monitor and report adverse events and any failure of a product to meet the specifications in the NDA or BLA. In the United States, the holder of an approved NDA or BLA must also submit new or supplemental applications and obtain FDA approval for certain changes to the approved product, product labeling or manufacturing process. Similar provisions apply in the European Union (the “EU”). Advertising and promotional materials must comply with FDA rules and are subject to FDA review, in addition to other potentially applicable federal and state laws. Similarly, in the EU any promotion of medicinal products is highly regulated and, depending on the specific jurisdiction involved, may require prior vetting by the competent national regulatory authority. In addition, product manufacturers and their facilities are subject to payment of user fees and continual review and periodic inspections by the FDA and other regulatory authorities for compliance with cGMP requirements and adherence to commitments made in the NDA, BLA or foreign marketing application.

Current wording

Our future revenues will depend, in part, on the ability of our customers to obtain and maintain regulatory approvals for therapeutic products utilizing our biocatalysts and other products. Any product that receives FDA approval will remain subject to ongoing regulatory requirements for manufacturing, labeling, packaging, distribution, storage, advertising, promotion, sampling, record-keeping and submission of safety and other post-market information, among other things. Any regulatory approvals received for such products may also be subject to limitations on the approved indicated uses for which they may be marketed or to the conditions of approval, or contain requirements for potentially costly post-marketing testing and surveillance studies. For example, the holder of an approved NDA or BLA in the United States is obligated to monitor and report adverse events and any failure of a product to meet the specifications in the NDA or BLA. In the United States, the holder of an approved NDA or BLA must also submit new or supplemental applications and obtain FDA approval for certain changes to the approved product, product labeling or manufacturing process. Similar provisions apply in the European Union (the “EU”). Advertising and promotional materials must comply with FDA rules and are subject to FDA review, in addition to other potentially applicable federal and state laws. Similarly, in the EU any promotion of medicinal products is highly regulated and, depending on the specific jurisdiction involved, may require prior vetting by the competent national regulatory authority. In addition, product manufacturers and their facilities are subject to payment of user fees and continual review and periodic inspections by the FDA and other regulatory authorities for compliance with cGMP requirements and adherence to commitments made in the NDA, BLA or foreign marketing application.

Previous wording

In the United States, there have been, and we expect there will continue to be, a number of legislative, regulatory, and administrative initiatives to contain healthcare costs. Some of these initiatives, such as ongoing healthcare reform, including with respect to reforming drug pricing, adverse changes in governmental or private funding of healthcare products and services, legislation or regulations governing patient access to care, and the delivery, coverage, pricing, and reimbursement of pharmaceuticals and healthcare services may cause our customers to change the amount of our offerings that they purchase from us or the price they are willing to pay us for these offerings. The timing of legislative, regulatory or executive action related to future healthcare reforms, if any, remains uncertain. Results of the 2024 U.S. Presidential and Congressional elections, and subsequent developments, have increased and may continue to increase the uncertainty related to healthcare regulatory environment. If cost-containment efforts or other healthcare reform measures limit our customers’ profitability, they may decrease research and development spending, which could decrease the demand for our products and services and materially adversely affect our growth prospects. Any of these factors could harm our customers’ businesses, which, in turn, could materially adversely affect our business, financial condition, results of operations, cash flows, and prospects.

Current wording

In the United States, there have been, and we expect there will continue to be, a number of legislative, regulatory, and administrative initiatives to contain healthcare costs. Some of these initiatives, such as ongoing healthcare reform, including with respect to reforming drug pricing, adverse changes in governmental or private funding of healthcare products and services, legislation or regulations governing patient access to care, and the delivery, coverage, pricing, and reimbursement of pharmaceuticals and healthcare services may cause our customers to change the amount of our offerings that they purchase from us or the price they are willing to pay us for these offerings. The timing of legislative, regulatory or executive action related to future healthcare reforms, if any, remains uncertain. If cost-containment efforts or other healthcare reform measures limit our customers’ profitability, they may decrease research and development spending, which could decrease the demand for our products and services and materially adversely affect our growth prospects. Any of these factors could harm our customers’ businesses, which, in turn, could materially adversely affect our business, financial condition, results of operations, cash flows, and prospects.

Previous wording

Our means of protecting our proprietary rights may not be adequate and our competitors may independently develop technologies, products or services that are identical or similar to ours or that compete with ours. Patent, trademark, copyright and trade secret laws afford only limited protection for our technology, products and services. The laws of many countries do not protect our proprietary rights to as great of an extent as do the laws of the United States. Despite our efforts to protect our proprietary rights, unauthorized parties have in the past attempted, and may in the future attempt, to operate under the aspects of our intellectual property rights, or proprietary technology, products or services or products, or to obtain and use information that we regard as proprietary. Third parties may also design around our proprietary rights, which may render our protected technology, services and products less valuable, if the design around is favorably received in the marketplace. In addition, if any of our technology, products and services are covered by third-party patents or other intellectual property rights, we could be subject to various legal actions. For example, we are aware of certain third-party intellectual property that does or may overlap with aspects of the Company’s technology. We cannot assure that our technology products and/or services do not infringe, violate or misappropriate any patents or other intellectual property rights owned or controlled by others or that they will not in the future.

Current wording

Our means of protecting our proprietary rights may not be adequate and our competitors may independently develop technologies, products or services that are identical or similar to ours or that compete with ours. Patent, trademark, copyright and trade secret laws afford only limited protection for our technology, products and services. The laws of many countries do not protect our proprietary rights to as great an extent as do the laws of the United States. Despite our efforts to protect our proprietary rights, unauthorized parties have in the past attempted, and may in the future attempt, to operate under the auspices of our intellectual property rights, or proprietary technology, products or services, or to obtain and use information that we regard as proprietary. Third parties may also design around our proprietary rights, which may render our protected technology, services and products less valuable, if the design around is favorably received in the marketplace. In addition, if any of our technology, products and services are covered by third-party patents or other intellectual property rights, we could be subject to various legal actions. For example, we are aware of certain third-party intellectual property that does or may overlap with aspects of the Company’s technology. We cannot assure that our technology, products and/or services do not infringe, violate or misappropriate any patents or other intellectual property rights owned or controlled by others or that they will not in the future.

Previous wording

Our success depends in part on our ability to obtain patents and maintain adequate protection of our intellectual property rights directed to our technology, products and services in the United States and other countries. We have adopted a strategy of seeking patent protection in the United States and in foreign countries with respect to certain of the technology used in orrelating to our products, services, and processes. As such, as of September 30, 2025, we owned or controlled approximately 1,650 active issued patents and pending patent applications in the United States and in various foreign jurisdictions. As of September 30, 2025, our patents and patent applications, if issued, have terms that expire between 2025 and approximately 2045. We also have license rights to a number of issued patents and pending patent applications in the United States and in various foreign jurisdictions. Our owned and licensed patents and patent applications include those directed to our enabling technology and to the methods and products that support our business in the pharmaceutical manufacturing, life sciences, oligonucleotide synthesis, and other markets. We intend to continue to apply for patents relating to our technology, methods, services and products as we deem appropriate.

Current wording

Our success depends in part on our ability to obtain patents and maintain adequate protection of our intellectual property rights directed to our technology, products and services in the United States and other countries. We have adopted a strategy of seeking patent protection in the United States and in foreign countries with respect to certain of the technology used in orrelating to our products, services, and processes. As such, as of March 31, 2026, we owned or controlled approximately 1,400 active issued patents and pending patent applications in the United States and in various foreign jurisdictions. As of March 31, 2026, our patents and patent applications, if issued, have terms that expire between 2026 and approximately 2046. We also have license rights to a number of issued patents and pending patent applications in the United States and in various foreign jurisdictions. Our owned and licensed patents and patent applications include those directed to our enabling technology and to the methods and products that support our business in the pharmaceutical manufacturing, life sciences, oligonucleotide synthesis, and other markets. We intend to continue to apply for patents relating to our technology, methods, services and products as we deem appropriate.

Previous wording

Issuance of claims in patent applications and enforceability of such claims once issued involve complex legal and factual questions and, therefore, we cannot predict with any certainty whether any of our issued patents will survive invalidity claims asserted by third parties. Issued patents and patents issuing from pending applications may be challenged, invalidated, circumvented, rendered unenforceable or substantially narrowed in scope. In addition, the inventorship and ownership of the patents and patent applications may be challenged by others. Moreover, the United States Leahy-Smith America Invents Act (“AIA”), enacted in September 2011, brought significant changes to the United States patent system, which include a change to a “first to file” system from a “first to invent” system and changes to the procedures for challenging issued patents and disputing patent applications during the examination process, among other things. While interference proceedings are possible for patent claims filed prior to March 16, 2013, many of our filings will be subject to the post- and pre-grant proceedings set forth in the AIA, including citation of prior art and written statements by third parties, third party pre-issuance submissions, ex parte reexamination, inter partes review, post-grant review, and derivation proceedings. We may need to utilize the processes provided by the AIA for supplemental examination or patent reissuance. These proceedings could result in substantial cost to us even if the outcome is favorable. Even if successful, any proceeding may result in loss of certain claims. Any litigation or proceedings could divert our management's time and efforts. Even unsuccessful claims brought by third parties could result in significant legal fees and other expenses, diversion of management time, and disruption in our business. Uncertainties resulting from initiation and continuation of any patent or related litigation could harm our ability to compete.

Current wording

Issuance of claims in patent applications and enforceability of such claims once issued involve complex legal and factual questions and, therefore, we cannot predict with any certainty whether any of our issued patents will survive invalidity claims asserted by third parties. Issued patents and patents issuing from pending applications may be challenged, invalidated, circumvented, rendered unenforceable or substantially narrowed in scope. In addition, the inventorship and ownership of the patents and patent applications may be challenged by others. Moreover, the United States Leahy-Smith America Invents Act (“AIA”), enacted in September 2011, brought significant changes to the United States patent system, which include a change to a “first to file” system from a “first to invent” system and changes to the procedures for challenging issued patents and disputing patent applications during the examination process, among other things. While interference proceedings are possible for patent claims filed prior to March 16, 2013, many of our filings will be subject to the pre- and post-grant proceedings set forth in the AIA, including citation of prior art and written statements by third parties, third party pre-issuance submissions, ex parte reexamination, inter partes review, post-grant review, and derivation proceedings. We may need to utilize the processes provided by the AIA for supplemental examination or patent reissuance. These proceedings could result in substantial cost to us even if the outcome is favorable. Even if successful, any proceeding may result in loss of certain claims. Any litigation or proceedings could divert our management's time and efforts. Even unsuccessful claims brought by third parties could result in significant legal fees and other expenses, diversion of management time, and disruption in our business. Uncertainties resulting from initiation and continuation of any patent or related litigation could harm our ability to compete.

Previous wording

Provisions in our amended and restated certificate of incorporation and our bylaws may delay or prevent an acquisition of the Company. Among other things, our amended and restated certificate of incorporation and bylaws provide for a board of directors which is divided into three classes, with staggered three-year terms and provide that all stockholder action must be effected at a duly called meeting of the stockholders and not by a consent in writing, and further provide that only our Board of Directors (our “Board”), the chairman of our Board, our chief executive officer or president may call a special meeting of the stockholders. In addition, our amended and restated certificate of incorporation allows our Board, without further action by our stockholders, to issue up to 5,000,000 shares of preferred stock in one or more series and to fix the rights, preferences, privileges and restrictions thereof. These provisions may also frustrate or prevent any attempts by our stockholders to replace or remove our current management by making it more difficult for stockholders to replace members of our Board, who are responsible for appointing the members of our management team. Furthermore, because we are incorporated in Delaware, we are governed by the provisions of Section 203 of the Delaware General Corporation Law (“DGCL”) which prohibits, with some exceptions, stockholders owning in excess of 15% of our outstanding voting stock from merging or combining with us. Finally, our charter documents establish advanced notice requirements for nominations for election to our Board and for proposing matters that can be acted upon at stockholder meetings. Although we believe these provisions together provide for an opportunity to receive higher bids by requiring potential acquirers to negotiate with our Board, they would apply even if an offer to acquire our company may be considered beneficial by some stockholders.

Current wording

Provisions in our amended and restated certificate of incorporation and our bylaws may delay or prevent an acquisition of the Company. Among other things, our amended and restated certificate of incorporation and bylaws provide for a board of directors which is divided into three classes, with staggered three-year terms and provide that all stockholder action must be effected at a duly called meeting of the stockholders and not by a consent in writing, and further provide that only our Board of Directors (our “Board”), the chairman of our Board, our chief executive officer or president may call a special meeting of the stockholders. In addition, our amended and restated certificate of incorporation allows our Board, without further action by our stockholders, to issue up to 5,000,000 shares of preferred stock in one or more series and to fix the rights, preferences, privileges and restrictions thereof. These provisions may also frustrate or prevent any attempts by our stockholders to replace or remove our current management by making it more difficult for stockholders to replace members of our Board, who are responsible for appointing the members of our management team. Furthermore, because we are incorporated in Delaware, we are governed by the provisions of Section 203 of the Delaware General Corporation Law (“DGCL”) which prohibits, with some exceptions, stockholders owning in excess of 15% of our outstanding voting stock from merging or combining with us. Finally, our charter documents establish advance notice requirements for nominations for election to our Board and for proposing matters that can be acted upon at stockholder meetings. Although we believe these provisions together provide for an opportunity to receive higher bids by requiring potential acquirers to negotiate with our Board, they would apply even if an offer to acquire our company may be considered beneficial by some stockholders.

Previous wording

Our bylaws designate a state or federal court located within the State of Delaware as the sole and exclusive forum for substantially all disputes between us and our stockholders, which could limit our stockholders' ability to obtain a favorable judicial forum for disputes with us our current or former directors, officers, stockholders, or other employees.

Current wording

Our bylaws designate a state or federal court located within the State of Delaware as the sole and exclusive forum for substantially all disputes between us and our stockholders, which could limit our stockholders' ability to obtain a favorable judicial forum for disputes with us or our current or former directors, officers, stockholders, or other employees.

Previous wording

Concerns about inflation, energy costs, geopolitical issues, the United States mortgage market and a declining real estate market, unstable global credit markets and financial conditions, and volatile oil prices have led to periods of significant economic instability, diminished liquidity and credit availability, declines in consumer confidence and discretionary spending, diminished expectations for the global economy and expectations of slower global economic growth going forward, increased unemployment rates, and increased credit defaults in recent years. Our general business strategy may be adversely affected by any such economic downturns, volatile business environments and continued unstable or unpredictable economic and market conditions.

Current wording

Concerns about inflation, energy costs, geopolitical issues, the United States mortgage market and a declining real estate market, unstable global credit markets and financial conditions, and volatile oil prices have led to periods of significant economic instability, diminished liquidity and credit availability, declines in consumers confidence and discretionary spending, diminished expectations for the global economy and expectations of slower global economic growth going forward, increased unemployment rates, and increased credit defaults in recent years. Our general business strategy may be adversely affected by any such economic downturns, volatile business environments and continued unstable or unpredictable economic and market conditions.

Previous wording

Information technology helps us operate efficiently, interface with customers, maintain financial accuracy and efficiency and accurately produce our financial statements. If we do not allocate and effectively manage the resources necessary to build and sustain the proper technology infrastructure, we could be subject to transaction errors, processing inefficiencies, the loss of customers, business disruptions or the loss of or damage to intellectual property or data through security breach. If our information technology systems do not effectively collect, store, process and report relevant data for the operation of our business, whether due to equipment malfunction or constraints, software deficiencies, or human error, our ability to effectively plan, forecast and execute our business plan and comply with applicable laws and regulations will be impaired, perhaps materially. Our information technology systems and those of our external vendors, strategic partners and other contractors or consultants are vulnerable to attack and damage or interruption from computer viruses and malware (e.g. ransomware), malicious code, natural disasters, terrorism, war, telecommunication and electrical failures, hacking, cyberattacks, phishing attacks and other social engineering schemes, employee theft or misuse, human error, fraud, denial or degradation of service attacks, sophisticated nation-state and nation-state-supported actors or unauthorized access or use by persons inside our organization, or persons with access to systems inside our organization. The prevalence of artificial intelligences (“AI”) tools in the global marketplace and rapid changes thereto raise the risk to our systems by making more sophisticated tools available to bad actors, and by making our data more vulnerable to inadvertent leaks or corruption by employees and others. Any such issues could materially and adversely affect our financial condition, results of operations, cash flows and the timeliness with which we report our internal and external operating results. The accessibility of AI intensifies these risks.

Current wording

Information technology helps us operate efficiently, interface with customers, maintain financial accuracy and efficiency and accurately produce our financial statements. If we do not allocate and effectively manage the resources necessary to build and sustain the proper technology infrastructure, we could be subject to transaction errors, processing inefficiencies, the loss of customers, business disruptions or the loss of or damage to intellectual property or data through security breach. If our information technology systems do not effectively collect, store, process and report relevant data for the operation of our business, whether due to equipment malfunction or constraints, software deficiencies, or human error, our ability to effectively plan, forecast and execute our business plan and comply with applicable laws and regulations will be impaired, perhaps materially. Our information technology systems and those of our external vendors, strategic partners and other contractors or consultants are vulnerable to attack and damage or interruption from computer viruses and malware (e.g. ransomware), malicious code, natural disasters, terrorism, war, telecommunication and electrical failures, hacking, cyberattacks, phishing attacks and other social engineering schemes, employee theft or misuse, human error, software or hardware errors, misconfigurations, bugs, fraud, denial or degradation of service attacks, sophisticated nation-state and nation-state-supported actors or unauthorized access or use by persons inside our organization, or persons with access to systems inside our organization. The prevalence of artificial intelligence (“AI”) tools in the global marketplace and rapid changes thereto raise the risk to our systems by making more sophisticated tools available to bad actors, and by making our data more vulnerable to inadvertent leaks or corruption by employees and others. Any such issues could materially and adversely affect our financial condition, results of operations, cash flows and the timeliness with which we report our internal and external operating results.

Previous wording

Our business may require us to use and store personal information of our customers, employees, and business partners. This may include names, addresses, phone numbers, email addresses, contact preferences, tax identification numbers and payment account information. We require usernames and passwords in order to access our information technology systems. We also use encryption and authentication technologies to secure the transmission and storage of data. However, these security measures may be compromised as a result of security breaches by unauthorized persons, employee error, malfeasance, faulty password management or other irregularity, and result in persons obtaining unauthorized access to our data or accounts. Third parties may attempt to fraudulently induce employees or customers into disclosing usernames, passwords or other sensitive information, which may in turn be used to access our information technology systems. For example, our employees have received “phishing” emails and phone calls attempting to induce them to divulge passwords and other sensitive information. The accessibility of AI intensifies these risks.

Current wording

Our business may require us to use and store proprietary information of our customers and business partners as well as personal information of our customers, employees, and business partners on our information technology systems. This may include names, addresses, phone numbers, email addresses, contact preferences, tax identification numbers and payment account information. We require usernames and passwords in order to access our information technology systems. We also use encryption and authentication technologies to secure the transmission and storage of data. However, these security measures may be compromised as a result of security breaches by unauthorized persons, employee error, malfeasance, faulty password management or other irregularity, and result in persons obtaining unauthorized access to our data or accounts. Third parties may attempt to fraudulently induce employees or customers into disclosing usernames, passwords or other sensitive information, which may in turn be used to access our information technology systems. For example, our employees have received “phishing” emails and phone calls attempting to induce them to divulge passwords and other sensitive information.

Previous wording

In addition, unauthorized persons may attempt to hack into our products or systems to obtain personal data relating to employees and other individuals, our confidential or proprietary information or confidential information we hold on behalf of third parties. We also rely on external vendors to supply and/or support certain aspects of our information technology systems. The systems of these external vendors may contain defects in design or manufacture or other problems that could unexpectedly compromise information security of our own systems, and we are dependent on these third parties to deploy appropriate security programs to protect their systems. If we or our third-party vendors were to experience a significant cybersecurity breach of our or their information systems or data, the costs associated with the investigation, remediation and potential notification of the breach to counterparties and data subjects could be material. Our remediation efforts may not be successful. Further, if such an event were to occur and cause interruptions in our operations, it could result in a material disruption of our development programs and our business operations, whether due to a loss, corruption or unauthorized disclosure of our trade secrets, personal information or other proprietary or sensitive information or other similar disruptions. Attacks upon information technology systems are also increasing in their frequency, levels of persistence, sophistication and intensity, and are being conducted by sophisticated and organized groups and individuals with a wide range of motives and expertise. As a result of the remote work policies we initiated in response to the COVID-19 pandemic, and our continued hybrid working environment, we may also face increased cybersecurity risks due to our reliance on internet technology and the number of our employees who are working remotely, which may create additional opportunities for cybercriminals to exploit vulnerabilities. The accessibility of AI intensifies these risks. We have programs in place to detect, contain and respond to data security incidents, and we make ongoing improvements to our information-sharing products in order to minimize vulnerabilities, in accordance with industry and regulatory standards. However, because the techniques used to obtain unauthorized access to or sabotage systems change frequently and may be difficult to detect, we may not be able to anticipate and prevent these intrusions or mitigate them when and if they occur. Even if identified, we may be unable to adequately and timely investigate or remediate incidents or breaches due to attackers increasingly using tools and techniques that are designed to circumvent controls, to avoid detection and to remove or obfuscate forensic evidence.

Current wording

In addition, unauthorized persons may attempt to hack into our products or systems to obtain personal data relating to employees and other individuals, our confidential or proprietary information or confidential information we hold on behalf of third parties. We also rely on external vendors to supply and/or support certain aspects of our information technology systems. The systems of these external vendors may contain defects in design or manufacture or other problems that could unexpectedly compromise information security of our own systems, and we are dependent on these third parties to deploy appropriate security programs to protect their systems. If we or our third-party vendors were to experience a significant cybersecurity breach of our or their information systems or data, the costs associated with the investigation, remediation and potential notification of the breach to counterparties and data subjects could be material. Our remediation efforts may not be successful. Further, if such an event were to occur and cause interruptions in our operations, it could result in a material disruption of our development programs and our business operations, whether due to a loss, corruption or unauthorized disclosure of our trade secrets, personal information or other proprietary or sensitive information or other similar disruptions. Attacks upon information technology systems are also increasing in their frequency, levels of persistence, sophistication and intensity, and are being conducted by sophisticated and organized groups and individuals with a wide range of motives and expertise. As a result of the remote work policies we initiated in response to the COVID-19 pandemic, and our continued hybrid working environment, we may also face increased cybersecurity risks due to our reliance on internet technology and the number of our employees who are working remotely, which may create additional opportunities for cybercriminals to exploit vulnerabilities. Additionally, any integration of AI in our or any third party’s operations, products or services is expected to pose new or unknown cybersecurity risks and challenges. We have programs in place to detect, contain and respond to data security incidents, and we make ongoing improvements to our information-sharing products in order to minimize vulnerabilities, in accordance with industry and regulatory standards. However, because the techniques used to obtain unauthorized access to or sabotage systems change frequently and may be difficult to detect, we may not be able to anticipate and prevent these intrusions or mitigate them when and if they occur. Even if identified, we may be unable to adequately and timely investigate or remediate incidents or breaches due to attackers increasingly using tools and techniques (such as AI) that are designed to circumvent controls, to avoid detection and to remove or obfuscate forensic evidence.

Previous wording

We and certain of our external vendors are from time to time subject to cyberattacks and security incidents. While we do not believe that we have experienced any significant system failure, accident, or security breach to date, if such an event were to occur, it could result in the unauthorized access to or unauthorized use, disclosure, release or other processing of personal information, it may be necessary to notify individuals, governmental authorities, supervisory bodies, the media and other parties pursuant to privacy and security laws. Any security compromise affecting us, our service providers, vendors, strategic partners, other contractors, consultants or our industry, whether real or perceived, could harm our reputation, erode confidence in the effectiveness of our security measures and lead to regulatory scrutiny. To the extent that any disruption or security breach were to result in a loss of, or damage to, our data or systems, or inappropriate disclosure of confidential or proprietary or personal information, we could incur liability, including litigation exposure, penalties and fines, which may not be covered by insurance or may be in excess of our insurance coverage. Additionally, we could become the subject of regulatory action or investigation, litigation, including class actions, or other claims and our competitive position could be harmed and the further development of our products could be delayed. If such an event were to occur and cause interruptions in our operations, it could result in a material disruption of our business and could materially and adversely affect our business, results of operations and financial condition.

Current wording

We and certain of our external vendors are from time to time subject to cyberattacks and security incidents. While we do not believe that we have experienced any significant system failure, accident, or security breach to date, if such an event were to occur, it could result in the unauthorized access to or unauthorized use, disclosure, release or other processing of personal information, it may be necessary to notify individuals, governmental authorities, supervisory bodies, the media and other parties pursuant to privacy and security laws. Any security compromise affecting us, our service providers, vendors, strategic partners, other contractors, consultants or our industry, whether real or perceived, could harm our reputation, erode confidence in the effectiveness of our security measures and lead to regulatory scrutiny. There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our information technology systems and confidential information. To the extent that any disruption or security breach were to result in a loss of, or damage to, our data or systems, or inappropriate disclosure of confidential or proprietary or personal information, we could incur liability, including litigation exposure, penalties and fines, which may not be covered by insurance or may be in excess of our insurance coverage. Additionally, we could become the subject of regulatory action or investigation, litigation, including class actions, or other claims and our competitive position could be harmed and the further development of our products could be delayed. If such an event were to occur and cause interruptions in our operations, it could result in a material disruption of our business and could materially and adversely affect our business, results of operations and financial condition.

Previous wording

In the United States, Health Insurance Portability and Accountability Act (“HIPAA”) imposes, among other things, certain standards relating to the privacy, security, transmission and breach reporting of certain individually identifiable health information. Certain states have also adopted and continue to adopt new privacy and security laws and regulations, which govern the privacy, processing and protection of health-related and other personal information. Such laws and regulations will be subject to interpretation by various courts and other governmental authorities, thus creating potentially complex compliance issues for us and our future customers and strategic partners. For example, the California Consumer Privacy Act (“CCPA”) went into effect on January 1, 2020. The CCPA creates individual privacy rights for California consumers and increases the privacy and security obligations of entities handling certain personal information. The CCPA also provides for civil penalties for violations, as well as a private right of action for data breaches (which has increased the likelihood of, and risks associated with, data breach litigation). Further, the California Privacy Rights Act (“CPRA”) significantly amended the CCPA, which went into effect in January 2023. It imposes additional data privacy obligations on covered businesses, including additional consumer rights processes, limitations on data uses, new audit requirements for higher risk data and opt outs for certain uses of sensitive data. It also created a new California privacy protection agency authorized to issue substantive regulations and could result in increased privacy and information security enforcement. Additional compliance investment and potential business process changes may also be required as these laws continue to evolve. Similar laws regulating personal information generally or health information in particular have passed in more than a dozen states and have been proposed in other states and at the federal level, reflecting a trend toward more stringent privacy legislation in the United States. The same is true for emerging laws and regulations related to AI. These developments increase our compliance burden and our risk, including risks of regulatory fines, litigation and associated reputational harm. Any liability from failure to comply with the requirements of these laws could adversely affect our financial condition.

Current wording

In the United States, Health Insurance Portability and Accountability Act (“HIPAA”) imposes, among other things, certain standards relating to the privacy, security, transmission and breach reporting of certain individually identifiable health information. We may obtain health information from third parties, such as research institutions with which we collaborate, that are subject to privacy and security requirements under HIPAA. Although we do not believe that we are directly subject to HIPAA, other than potentially with respect to providing certain employee benefits, we could be subject to criminal penalties if we knowingly obtain or disclose individually identifiable health information maintained by a HIPAA covered entity in a manner that is not authorized or permitted by HIPAA. Certain states have also adopted and continue to adopt new privacy and security laws and regulations, which govern the privacy, processing and protection of health-related and other personal information. Such laws and regulations will be subject to interpretation by various courts and other governmental authorities, thus creating potentially complex compliance issues for us and our future customers and strategic partners. For example, the California Consumer Privacy Act (“CCPA”) requires in-scope businesses to, among other things: provide certain disclosures to California residents regarding the business’s collection, use, and disclosure of their personal information; receive and respond to requests from California residents to access, delete, and correct their personal information, or to opt-out of certain disclosures of their personal information; and enter into specific contractual provisions with service providers that process California resident personal information on the business’s behalf. The CCPA also provides for civil penalties for violations, as well as a private right of action for certain data breaches (which has increased the likelihood of, and risks associated with, data breach litigation). Similar laws regulating personal information generally or health information in particular have passed in other states and have been proposed in additional states and at the federal level, reflecting a trend toward more stringent privacy legislation in the United States. The same is true for emerging laws and regulations related to AI. These developments increase our compliance burden and our risk, including risks of regulatory fines, litigation and associated reputational harm. Any liability from failure to comply with the requirements of these laws could adversely affect our financial condition.

Previous wording

The UK GDPR also imposes similar restrictions on transfers of personal data from the UK to jurisdictions that the UK Government does not consider adequate, including the United States. The UK Government has published its own form of the EU SCCs, known as the International Data Transfer Agreement and an International Data Transfer Addendum to the EU SCCs. The UK Information Commissioner’s Office has also published its own version of the TIA, although entities may choose to adopt either the EU or UK-style TIA. Further, on September 21, 2023, the UK Secretary of State for Science, Innovation and Technology established a UK-U.S. data bridge (i.e., a UK equivalent of the Adequacy Decision) and adopted UK regulations to implement the UK-U.S. data. Personal data may now be transferred from the UK under the UK-U.S. data bridge through the UK extension to the DPF to organizations self-certified under the UK extension to the DPF.

Current wording

The UK GDPR also imposes similar restrictions on transfers of personal data from the UK to jurisdictions that the UK Government does not consider adequate, including the United States. The UK Government has published its own form of the EU SCCs, known as the International Data Transfer Agreement and an International Data Transfer Addendum to the EU SCCs. The UK Information Commissioner’s Office has also published its own version of the TIA, although entities may choose to adopt either the EU or UK-style TIA. Further, on September 21, 2023, the UK Secretary of State for Science, Innovation and Technology established a UK-U.S. data bridge (i.e., a UK equivalent of the Adequacy Decision) and adopted UK regulations to implement the UK-U.S. data bridge. Personal data may now be transferred from the UK under the UK-U.S. data bridge through the UK extension to the DPF to organizations self-certified under the UK extension to the DPF.