Zura Bio Ltd

Below we are providing, in supplemental form, updates to our risk factors from those previously disclosed in Part I, Item 1A of our 2024 Annual Report. Our risk factors disclosed in Part I, Item 1A of our 2024 Annual Report provide additional discussion regarding these supplemental risks and we encourage you to read and carefully consider all of the risk factors disclosed in Part I, Item 1A of our 2024 Annual Report, together with the below, for a more complete understanding of the risks and uncertainties material to our business.

Disruptions at the FDA, EMA, the European Commission applicable foreign regulatory authorities, the SEC, and other government agencies and regulatory authorities caused by funding shortages, furloughs or other concerns could hinder their ability to hire and retain key leadership and other personnel, or otherwise prevent new or modified products from being developed, approved or commercialized in a timely manner or at all, or otherwise prevent those authorities from performing normal business functions on which the operation of our business may rely, which could significantly harm our business, financial condition, results of operations and prospects.

The ability of the FDA, EMA, the European Commission or any applicable foreign regulatory authority to review and approve new products can be affected by a variety of factors, including, as applicable government budget and funding levels, ability to hire and retain key personnel and accept the payment of user fees, and statutory, regulatory, and policy changes, and other events that may otherwise affect the FDA, EMA, the European Commission, or any applicable foreign regulatory authority’s ability to perform routine functions. Average review times at the authorities have fluctuated in recent years as a result and could be delayed. Furloughs and reductions in force in early 2025 may adversely impact federal agency responsiveness. In addition, government funding of the SEC and other government authorities on which our operations may rely, including those that fund research and development activities is subject to the political process, which is inherently fluid and unpredictable.

Disruptions at the FDA and other authorities may also slow the time necessary for new drugs to be reviewed and/or approved by necessary government authorities, which would adversely affect our business. If the FDA or other regulatory authorities are unable to timely conduct their regular inspections, reviews, or other regulatory activities, it could significantly impact the ability of the FDA to timely review and process our regulatory submissions, which could have a material adverse effect on our business.

International trade policies, including tariffs, sanctions and trade barriers may adversely affect our business, financial condition,results of operations and prospects.

We do not own or operate, and currently have no plans to establish, any manufacturing facilities. We currently rely, and expect to continue to rely, on third parties for the manufacture of our product candidates for clinical testing, as well as for manufacture of any products that we may commercialize, if approved. Currently, several of our manufacturers and suppliers, including drug substances and drug products for tibulizumab, torudokimab, and crebankitug, are located outside of the United States, and our principal suppliers of critical raw materials are located in Italy, the Netherlands, and the United Kingdom. We also rely on specialized laboratory equipment, supplies, materials, and precursor compounds, all or part of which we believe may be ultimately sourced from multiple countries outside the United States, to advance our research and development efforts.

Additionally, we are party to a cell line license agreement (the “Cell Line License Agreement”) with WuXi Biologics, a manufacturer located in China, and its affiliates (“WuXi Biologics”), which provides us with a non-exclusive, worldwide, sublicensable license to certain of WuXi Biologics’ know-how, cell line and biological materials to manufacture, have manufactured, use, sell and import certain products produced through the use of the cell line licensed by WuXi Biologics under the Cell Line License Agreement. If we have product manufactured at WuXi Biologics in the future, we may face additional manufacturing and supply-chain risks due to the regulatory and political structure of the PRC, or as a result of the international relationship with the PRC, including but not limited to sanctions, tariffs and other restrictions that have been or may be imposed.

Trade disputes, tariffs, restrictions and other political tensions between the United States and other countries may also exacerbate unfavorable macroeconomic conditions including inflationary pressures, foreign exchange volatility, financial market instability, and economic recessions or downturns. The ultimate impact of current or future tariffs and trade restrictions remains uncertain and could materially and adversely affect our business, financial condition, and prospects. While we actively monitor these risks, any prolonged economic downturn, escalation in trade tensions, or deterioration in international perception of U.S.-based companies could materially and adversely affect our business, ability to access the capital markets or other financing sources, results of operations, financial condition and prospects. In addition, tariffs and other trade developments have and may continue to heighten the risks related to the other risk factors described in our 2024 Annual Report, as supplemented by the risk factors described in this Quarterly Report.

We are subject to laws and regulations related to privacy, data protection, information security and consumer protection across different markets where we conduct our business. Our actual or perceived failure to comply with such obligations could harm our business.

We are subject to laws and regulations related to, among other things, privacy, data protection, information security and consumer protection across different markets where we conduct our business. Such laws and regulations are constantly evolving and changing and are likely to remain uncertain for the foreseeable future. Our actual or perceived failure to comply with such obligations could have an adverse effect on our business, operating results and financial operations. Complying with these numerous, complex, and often changing regulations is expensive and difficult, and failure to comply with any privacy laws or data security laws or any security incident or breach involving the potential or actual misappropriation, loss or other unauthorized processing, use or disclosure of sensitive or confidential patient, consumer or other personal information, whether by us, one of our collaborators or another third party, could adversely affect our business, financial condition, and results of operations, including but not limited to investigation costs, material fines and penalties, compensatory, special, punitive, and statutory damages, litigation, consent orders regarding our privacy and security practices, requirements that we provide notices, credit monitoring services, and/or credit restoration services or relief.

European data collection is also governed by restrictive regulations governing the use, processing and cross-border transfer of personal information. The collection, use, storage, disclosure, transfer, or other processing of personal data regarding individuals in Europe, including personal health data, is subject to the E.U. General Data Protection Regulation (“GDPR”) and similar requirements in the United Kingdom (“UK GDPR”) (hereinafter the GDPR and UK GDPR are collectively referred to as “GDPR”), which impose strict requirements for processing the personal data of individuals within the EEA, such as Norway, Iceland, Liechtenstein and the United Kingdom. The GDPR is directly applicable in each E.U. member state and is extended to the EEA, while the UK GDPR applies to the United Kingdom of Great Britain and Northern Ireland. The GDPR is wide-ranging in scope and imposes numerous requirements on companies that process personal data, including requirements relating to processing health and other sensitive data, obtaining consent of the individuals to whom the personal data relates, providing information to individuals regarding data processing activities, implementing safeguards to protect the security and confidentiality of personal data, providing notification of data breaches, and taking certain measures when engaging third-party processors. The GDPR implements more stringent operational requirements than its predecessor legislation. Compliance with the GDPR is a rigorous and time-intensive process that may increase our cost of doing business or require us to change our business practices, and despite those efforts, there is a risk that we may be subject to fines and penalties, litigation, and reputational harm in connection with our European activities. For example, the GDPR applies extraterritorially, requires us to make more detailed disclosures to data subjects, requires disclosure of the legal basis on which we can process personal data, makes it harder for us to obtain valid consent for collecting and processing personal data (including data from clinical trials), requires the appointment of data protection officers, such as when sensitive personal data, such as health data, is processed on a large scale, provides more robust rights for data subjects, including far reaching information rights and the right to erasure, introduces mandatory data breach notification through the E.U., imposes additional obligations on us when contracting with service providers and requires us to adopt appropriate privacy governance, including policies, procedures, training, and audits. The GDPR provides that E.U. member states and EEA countries may establish their own laws and regulations that go beyond the GDPR in certain areas, such as regarding the mandatory appointment of data protection officers or further limiting the processing of personal data, including genetic, biometric, or health data, which could limit our ability to use and share personal data or could cause our costs to increase. Among other requirements, the GDPR regulates transfers of personal data subject to the GDPR to third countries that have not been found to provide adequate protection to such personal data, including the United States. In particular, the EEA and the UK have significantly restricted the transfer of personal data to the United States and other countries whose privacy laws it generally believes are inadequate. Other jurisdictions may adopt or have already adopted similarly stringent data localization and cross-border data transfer laws. In the ordinary course of business, we transfer personal data from Europe and other jurisdictions to the United States or other countries. Europe and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal data to other countries. Although there are currently various mechanisms that may be used to transfer personal data from the EEA and UK to the United States in compliance with law, such as the EEA standard contractual clauses, the UK’s International Data Transfer Agreement / Addendum, and the EU-U.S. Data Privacy Framework and the UK extension thereto (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the Framework), these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the United States. If there is no lawful manner for us to transfer personal data from the EEA, the UK or other jurisdictions to the United States, or if the requirements for a legally-compliant transfer are too onerous, we could face significant adverse consequences, including the interruption or degradation of our operations, the need to relocate part of or all of our business or data processing activities to other jurisdictions (such as Europe) at significant expense, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors and other third parties, and injunctions against our processing or transferring of personal data necessary to operate our business. Additionally, companies that transfer personal data out of the EEA and UK to other jurisdictions, particularly to the United States, are subject to increased scrutiny from regulators, individual litigants, and activist groups.

We cannot assure you that our third-party service providers with access to our or our customers’, suppliers’, trial patients’ and employees’ personally identifiable and other sensitive or confidential information will not breach contractual obligations imposed by us, or that they will not experience data security breaches or attempts thereof, which could have a corresponding effect on our business, including putting us in breach of our obligations under privacy laws and regulations and/or which could in turn adversely affect our business, results of operations, and financial condition. We cannot assure you that our contractual measures and our own privacy and security-related safeguards will protect us from the risks associated with the third-party processing, use, storage, and transmission of such information. Any of the foregoing could have a material adverse effect on our business, financial condition, results of operations, and prospects.