PUMA BIOTECHNOLOGY, INC.

Previous wording

While we have reported net income in the years ended December 31, 2024, 2023 and 2022, we cannot assure that we will continue to do so and may not be able to maintain profitability.

Current wording

While we have reported net income in recent years, we cannot assure that we will continue to do so and may not be able to maintain profitability.

Previous wording

We have incurred significant cumulative operating losses since our inception. While we have reported net income in the years ended December 31, 2024, 2023 and 2022, we cannot assure that we will continue to do so and will need to continue to generate significant revenue to sustain operations and successfully commercialize neratinib and develop alisertib. As of December 31, 2024, we had an accumulated deficit of approximately $1,314.9 million, outstanding indebtedness of approximately $67.0 million and cash and cash equivalents and marketable securities of approximately $101.0 million.

Current wording

We have incurred significant cumulative operating losses since our inception. While we have reported net income in recent years, including the years ended December 31, 2025, 2024 and 2023, we cannot assure that we will continue to do so and will need to continue to generate significant revenue to sustain operations and successfully commercialize neratinib and develop alisertib. As of December 31, 2025, we had an accumulated deficit of approximately $1,283.8 million, outstanding indebtedness of approximately $22.5 million and cash and cash equivalents and marketable securities of approximately $97.5 million.

Previous wording

We are party to a Note Purchase Agreement with Athyrium Opportunities IV Co-Invest 1 LP (“Athyrium”), providing for potential issuance by us of notes of up to $125.0 million, which mature on July 23, 2026. The terms of our Note Purchase Agreement place restrictions on our ability to operate our business and on our financial flexibility. As of December 31, 2024, the aggregate principal amount outstanding under the notes sold pursuant to the Note Purchase Agreement (collectively, the “Athyrium Notes”) was $66.7 million. The Athyrium Notes are secured by collateral which consists of our equity interests in our domestic and foreign subsidiary (including up to 100% of the issued and outstanding equity interests in our subsidiary directly owned by us or the guarantors of the Athyrium Notes) and substantially all of our property. In addition to voluntary prepayments, we may also be required to make mandatory prepayments under the Athyrium Notes in varying amounts within three (3) business days of the occurrence of certain events, including in the event that we receive proceeds from a voluntary or involuntary disposition and such proceeds are not reinvested in eligible assets within 180 days of the date of such disposition, or in the event that we receive extraordinary receipt cash proceeds and such proceeds are not reinvested in eligible assets within 180 days of the date of such extraordinary receipt. The Note Purchase Agreement includes affirmative and negative covenants applicable to us and our subsidiary. The affirmative covenants include, but are not limited to, requirements to (i) maintain our legal existence and take all reasonable actions to maintain our rights, privileges and authorizations (including renewal of permits or licenses) necessary to conduct our business and maintain our intellectual property, (ii) deliver certain financial statements, certificates and other information to Athyrium on a regular basis, (iii) maintain adequate insurance coverage with respect to the properties and business and (iv) cause all of our deposit accounts (other than certain “excluded accounts”) to be subject to Deposit Account Control Agreements. The negative covenants include, but are not limited to, restrictions on (i) creating or incurring certain liens on our property, assets or revenues, (ii) making certain investments or incurring additional indebtedness, (iii) engaging in certain business or strategic activities (including transactions with affiliates or insiders) and (iv) paying certain dividends, distributions or other restricted payments. Additionally, pursuant to the Note Purchase Agreement, we must maintain a minimum cash balance in our accounts subject to a deposit account control agreement and must achieve certain levels of product revenue for any four (4) consecutive fiscal quarter periods. These affirmative and negative covenants may make it difficult for us to operate our business. In addition, we cannot assure you that we will be able to ac…

Excerpt shortened here; the source contains the full paragraph.

Current wording

We are party to a Note Purchase Agreement with Athyrium Opportunities IV Co-Invest 1 LP (“Athyrium”), providing for potential issuance by us of notes of up to $125.0 million, which mature on July 23, 2026. The terms of our Note Purchase Agreement place restrictions on our ability to operate our business and on our financial flexibility. As of December 31, 2025, the aggregate principal amount outstanding under the notes sold pursuant to the Note Purchase Agreement (collectively, the “Athyrium Notes”) was $22.5 million. The Athyrium Notes are secured by collateral which consists of our equity interests in our domestic and foreign subsidiary (including up to 100% of the issued and outstanding equity interests in our subsidiary directly owned by us or the guarantors of the Athyrium Notes) and substantially all of our property. In addition to voluntary prepayments, we may also be required to make mandatory prepayments under the Athyrium Notes in varying amounts within three (3) business days of the occurrence of certain events, including in the event that we receive proceeds from a voluntary or involuntary disposition and such proceeds are not reinvested in eligible assets within 180 days of the date of such disposition, or in the event that we receive extraordinary receipt cash proceeds and such proceeds are not reinvested in eligible assets within 180 days of the date of such extraordinary receipt. The Note Purchase Agreement includes affirmative and negative covenants applicable to us and our subsidiary. The affirmative covenants include, but are not limited to, requirements to (i) maintain our legal existence and take all reasonable actions to maintain our rights, privileges and authorizations (including renewal of permits or licenses) necessary to conduct our business and maintain our intellectual property, (ii) deliver certain financial statements, certificates and other information to Athyrium on a regular basis, (iii) maintain adequate insurance coverage with respect to the properties and business and (iv) cause all of our deposit accounts (other than certain “excluded accounts”) to be subject to Deposit Account Control Agreements. The negative covenants include, but are not limited to, restrictions on (i) creating or incurring certain liens on our property, assets or revenues, (ii) making certain investments or incurring additional indebtedness, (iii) engaging in certain business or strategic activities (including transactions with affiliates or insiders) and (iv) paying certain dividends, distributions or other restricted payments. Additionally, pursuant to the Note Purchase Agreement, we must maintain a minimum cash balance in our accounts subject to a deposit account control agreement and must achieve certain levels of product revenue for any four (4) consecutive fiscal quarter periods. These affirmative and negative covenants may make it difficult for us to operate our business. In addition, we cannot assure you that we will be able to ac…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

In September 2022, we in-licensed alisertib from Takeda. Pursuant to our exclusive license agreement with Takeda, we are responsible for global development and commercialization of alisertib. Clinical development of alisertib will be expensive, lengthy and unpredictable. Failure or delay can occur at any time during the development process. There are numerous risks associated with our planned development alisertib, including, among others:

Current wording

In September 2022, we in-licensed alisertib from Takeda. Pursuant to our exclusive license agreement with Takeda, we are responsible for global development and commercialization of alisertib. Clinical development of alisertib will be expensive, lengthy and unpredictable. Failure or delay can occur at any time during the development process. There are numerous risks associated with our planned development alisertib, including the following:

Previous wording

In addition, FDA and foreign regulatory authorities may change their approval policies and new regulations may be enacted. For instance, the EU pharmaceutical legislation is currently undergoing a complete review process, in the context of the Pharmaceutical Strategy for Europe initiative, launched by the European Commission in November 2020. The European Commission’s proposal for revision of several legislative instruments related to medicinal products (potentially reducing the duration of regulatory data protection, revising the eligibility for expedited pathways, etc.) was published on April 26, 2023. The proposed revisions remain to be agreed and adopted by the European Parliament and European Council and the proposals may therefore be substantially revised before adoption, which is not expected before early 2026. The revisions may however have a significant impact on the biopharmaceutical industry in the long term.

Current wording

In addition, FDA and foreign regulatory authorities may change their approval policies and new regulations may be enacted. For instance, the EU pharmaceutical legislation has been undergoing a complete review process, in the context of the Pharmaceutical Strategy for Europe initiative, launched by the European Commission in November 2020. On April 26, 2023, the European Commission published a proposal for a new Directive and Regulation to revise the existing pharmaceutical legislation. The proposed changes were since discussed and negotiated by the European Parliament and the Council of the EU as part of the EU ordinary legislative process. A provisional agreement has been reached by the European Parliament and Council of the EU on the proposed revisions on December 11, 2025. The proposed revisions (affecting the duration of regulatory data protection and market protection, including for orphan medicinal products, revising the eligibility for expedited pathways, etc.) remain to be formally adopted by the two institutions, which is not anticipated before early 2026. The proposed changes are not expected to enter into application before 2028, and may however have a significant impact on the biopharmaceutical industry in the long term.

Previous wording

If a prolonged government shutdown occurs, or if global health concerns continue to prevent the FDA or other regulatory authorities from conducting their regular inspections, reviews, or other regulatory activities, it could significantly impact the ability of the FDA or other regulatory authorities to timely review and process our regulatory submissions, which could have a material adverse effect on our business.

Current wording

In addition, the current U.S. Presidential administration has issued certain policies and Executive Orders directed towards reducing the employee headcount and costs associated with U.S. administrative agencies, including the FDA, and it remains unclear the degree to which these efforts may limit or otherwise adversely affect the FDA’s ability to conduct routine activities. If a prolonged government shutdown occurs, or if funding shortages, staffing limitations or similar factors hinder or prevent the FDA or other regulatory authorities from conducting their regular inspections, reviews, or other regulatory activities, such events could significantly impact the ability of the FDA or other such regulatory authorities to timely review and process our regulatory submissions, which could have a material adverse effect on our business.

Previous wording

The accelerated approval pathway may be used in cases in which the advantage of a new drug over available therapy may not be a direct therapeutic advantage but is a clinically important improvement from a patient and public health perspective. If granted, accelerated approval is usually contingent on the sponsor’s agreement to conduct, in a diligent manner, additional confirmatory studies to verify and describe the drug’s clinical benefit. If such post-approval studies fail to confirm the drug’s clinical benefit or are not completed in a timely manner, the FDA may withdraw its approval of the drug on an expedited basis. In addition, in December 2022, former President Biden signed an omnibus appropriations bill to fund the U.S. government through fiscal year 2023. Included in the omnibus bill is the Food and Drug Omnibus Reform Act of 2022, which among other things, provided FDA statutory authority to mitigate potential risks to patients from continued marketing of ineffective drugs previously granted accelerated approval. Under these provisions, the FDA may require a sponsor of a product seeking accelerated approval to have a confirmatory trial underway prior to such approval being granted.

Current wording

The accelerated approval pathway may be used in cases in which the advantage of a new drug over available therapy may not be a direct therapeutic advantage but is a clinically important improvement from a patient and public health perspective. If granted, accelerated approval is usually contingent on the sponsor’s agreement to conduct, in a diligent manner, additional confirmatory studies to verify and describe the drug’s clinical benefit. If such post-approval studies fail to confirm the drug’s clinical benefit or are not completed in a timely manner, the FDA may withdraw its approval of the drug on an expedited basis. In addition, the Food and Drug Omnibus Reform Act of 2022, among other things, provided the FDA with additional statutory authority to mitigate potential risks to patients from continued marketing of ineffective drugs previously granted accelerated approval. Under these provisions, the FDA may require a sponsor of a product seeking accelerated approval to have a confirmatory trial underway prior to such approval being granted.

Previous wording

NERLYNX was approved by the FDA in 2017. We had total revenue for NERLYNX of $230.5 million, $235.6 million and $228.0 million for the years ended December 31, 2024, 2023 and 2022, respectively. We cannot assure you that the sales of NERLYNX will continue at these levels or grow. We may encounter delays or hurdles related to our sales efforts that affect amount of revenue generated and the timing of such revenue. There is no guarantee that the infrastructure, systems, processes, policies, personnel, relationships and materials we have built to commercialize NERLYNX in the United States will be sufficient for us to achieve success at the levels we expect.

Current wording

NERLYNX was approved by the FDA in 2017. We had total revenue for NERLYNX of $228.4 million, $230.5 million and $235.6 million for the years ended December 31, 2025, 2024 and 2023, respectively. We cannot assure you that the sales of NERLYNX will continue at these levels or grow. We may encounter delays or hurdles related to our sales efforts that affect amount of revenue generated and the timing of such revenue. There is no guarantee that the infrastructure, systems, processes, policies, personnel, relationships and materials we have built to commercialize NERLYNX in the United States will be sufficient for us to achieve success at the levels we expect.

Previous wording

The majority of our revenue comes from a limited number of customers. In 2024, four customers individually comprised approximately 28.4%, 18.8%, 14.1% and 12.3% respectively, of our total product revenue. We expect that revenue from a limited number of customers will continue to account for a large portion of our revenue in the future. The loss by us of any of these customers, or a material reduction in their purchases or their market pricing, could harm our business, results of operations, financial condition and prospects. In addition, if any of these customers were to fail to pay us in a timely manner, it could harm our cash flow.

Current wording

The majority of our revenue comes from a limited number of customers. In 2025, five customers individually comprised approximately 27.3%, 17.0%, 16.4%, 13.1% and 10.6%, respect ively, of our total product revenue. We expect that revenue from a limited number of customers will continue to account for a large portion of our revenue in the future. The loss by us of any of these customers, or a material reduction in their purchases or their market pricing, could harm our business, results of operations, financial condition and prospects. In addition, if any of these customers were to fail to pay us in a timely manner, it could harm our cash flow.

Previous wording

Outside the United States, we seek to enter into exclusive sub-license agreements with third parties to pursue regulatory approval, if necessary, and commercialize NERLYNX, if approved. As of December 31, 2024, NERLYNX has received approval for the treatment of certain patients with extended adjuvant and/or metastatic HER2-positive breast cancer in more than 40 count ries outside the United States, including the EU, Australia, Canada, and Hong Kong. We are currently party to several sub-licenses in various regions outside the United States, including Europe (excluding Russia and Ukraine), Australia, Canada, China, Southeast Asia, Israel, South Korea, and various countries and territories in Central America, South America, the Middle East and Africa. We depend on these third parties for a significant portion of our total revenue. Royalty revenue obtained pursuant to these sub-license agreements was 15%,14% and 12% of total revenue for the years ended December 31, 2024, 2023 and 2022, respectively. We have very little control over these third-parties and any of our existing or future licensees may fail to devote the necessary resources and attention to obtain regulatory approval, where needed, and to market and distribute NERLYNX effectively. If these licensees are unsuccessful in receiving regulatory approvals or in commercializing NERLYNX, our business, results of operations and financial condition will be materially adversely affected. Moreover, we intend to seek additional third parties to sub-license NERLYNX in additional geographies, and may pursue a similar strategy for any future drug candidates that we develop. We cannot assure you that we will be able to enter these agreements on commercial terms, or at all, and our failure to do so would have an adverse effect on our continued commercialization efforts for NERLYNX or any future drug candidates.

Current wording

Outside the United States, we seek to enter into exclusive sub-license agreements with third parties to pursue regulatory approval, if necessary, and commercialize NERLYNX, if approved. As of December 31, 2025, NERLYNX has received approval for the treatment of certain patients with extended adjuvant and/or metastatic HER2-positive breast cancer in more than 40 count ries outside the United States, including the EU, Australia, Canada, and Hong Kong. We are currently party to several sub-licenses in various regions outside the United States, including Europe (excluding Ukraine), Australia, Canada, China, Southeast Asia, Israel, South Korea, Russia and various countries and territories in Central America, South America, Africa and the Middle East. We depend on these third parties for a significant portion of our total revenue. Royalty revenue obtained pursuant to these sub-license agreements was 11% and 15% of total revenue for the years ended December 31, 2025 and 2024, respectively. We have very little control over these third-parties and any of our existing or future licensees may fail to devote the necessary resources and attention to obtain regulatory approval, where needed, and to market and distribute NERLYNX effectively. If these licensees are unsuccessful in receiving regulatory approvals or in commercializing NERLYNX, our business, results of operations and financial condition will be materially adversely affected. Moreover, we intend to seek additional third parties to sub-license NERLYNX in additional geographies, and may pursue a similar strategy for any future drug candidates that we develop. We cannot assure you that we will be able to enter these agreements on commercial terms, or at all, and our failure to do so would have an adverse effect on our continued commercialization efforts for NERLYNX or any future drug candidates.

Previous wording

While physicians in the United States and outside the United States may choose, and are generally permitted, to prescribe drugs for uses that are not described in the product’s labeling and for uses that differ from those tested in clinical trials and approved by the regulatory authorities, our ability to promote the products is narrowly limited to those indications that are specifically approved by the FDA or foreign regulatory authorities. These “off-label” uses are common across medical specialties and may constitute an appropriate treatment for some patients in varied circumstances. For example, in April 2018, we announced that NERLYNX (neratinib) has been included as a recommended treatment option in the latest NCCN Clinical Practice Guidelines in Oncology Central Nervous System Cancers for Breast Cancer patients with brain metastases. The NCCN designated NERLYNX in combination with capecitabine as a category 2A treatment option and NERLYNX in combination with paclitaxel as a category 2B treatment option. In addition, in December 2024, we announced that NCCN Clinical Practice Guidelines in Oncology (NCCN Guidelines®) for Cervical Cancer were updated to include an addition involving neratinib. The updated NCCN Practice Guidelines for Cervical Cancer include neratinib monotherapy for use as second-line or subsequent therapy for recurrent or metastatic disease as an option for patients with HER2-mutated tumors with a designation of Category 2A. The NCCN Guidelines Category of Preference is designated as “useful in certain circumstances” as a treatment option for patients with HER2-mutated tumors. Use, as designated for breast cancer patients with brain metastases and in Cervical Cancer, is outside the FDA approved indication for NERLYNX and considered investigational, and we do not market or promote NERLYNX for these uses.

Current wording

While physicians in the United States and outside the United States may choose, and are generally permitted, to prescribe drugs for uses that are not described in the product’s labeling and for uses that differ from those tested in clinical trials and approved by the regulatory authorities, our ability to promote the products is narrowly limited to those indications that are specifically approved by the FDA or foreign regulatory authorities. These “off-label” uses are common across medical specialties and may constitute an appropriate treatment for some patients in varied circumstances. For example, in April 2018, we announced that NERLYNX (neratinib) has been included as a recommended treatment option in the latest NCCN Clinical Practice Guidelines in Oncology Central Nervous System Cancers for Breast Cancer patients with brain metastases. The NCCN designated NERLYNX in combination with capecitabine as a category 2A treatment option and NERLYNX in combination with paclitaxel as a category 2B treatment option. In addition, in December 2024, we announced that NCCN Clinical Practice Guidelines in Oncology for Cervical Cancer were updated to include an addition involving neratinib. The updated NCCN Practice Guidelines for Cervical Cancer include neratinib monotherapy for use as second-line or subsequent therapy for recurrent or metastatic disease as an option for patients with HER2-mutated tumors with a designation of category 2A. The NCCN Guidelines Category of Preference is designated as “useful in certain circumstances” as a treatment option for patients with HER2-mutated tumors. Use, as designated for breast cancer patients with brain metastases and in Cervical Cancer, is outside the FDA approved indication for NERLYNX and considered investigational, and we do not market or promote NERLYNX for these uses.

Previous wording

Regulatory authorities in some jurisdictions, including the U.S., may designate drugs designed to address relatively small patient populations as “orphan drugs.” Under the Orphan Drug Act, the FDA may grant orphan drug designation to a drug intended to treat a rare disease or condition, which is defined as one occurring in a patient population of fewer than 200,000 in the United States, or a patient population greater than 200,000 in the United States, where there is no reasonable expectation that the cost of developing the drug or biologic will be recovered from sales in the United States. In the U.S., orphan designation entitles a party to financial incentives such as opportunities for grant funding for clinical trial costs, tax advantages and user-fee waivers. In addition, if a drug candidate that has orphan designation subsequently receives the first FDA approval for the disease or condition for which it has such designation, the product is entitled to orphan drug exclusivity, which means that the FDA may not approve any other applications, including an NDA, to market the same drug for the same disease or condition for seven years, except in limited circumstances, such as a showing of clinical superiority to the product with orphan drug exclusivity or where the manufacturer is unable to assure sufficient product quantity.

Current wording

Regulatory authorities in some jurisdictions, including the U.S., may designate drugs designed to address relatively small patient populations as “orphan drugs.” Under the Orphan Drug Act, the FDA may grant orphan drug designation to a drug intended to treat a rare disease or condition, which is defined as one occurring in a patient population of fewer than 200,000 in the United States, or a patient population greater than 200,000 in the United States, where there is no reasonable expectation that the cost of developing the drug or biologic will be recovered from sales in the United States. In the U.S., orphan designation entitles a party to financial incentives such as opportunities for grant funding for clinical trial costs, tax advantages and user-fee waivers. In addition, if a drug candidate that has orphan designation subsequently receives the first FDA approval for the disease or condition for which it has such designation, the product is entitled to orphan drug exclusivity, which means that the FDA may not approve any other applications, including an NDA, to market the same drug for the same approved indication or use within the same rare disease or condition for seven years, except in limited circumstances, such as a showing of clinical superiority to the product with orphan drug exclusivity in the relevant indication or use or where the manufacturer is unable to assure sufficient product quantity.

Previous wording

We may decide to seek Orphan Drug Designations for alisertib. There can be no assurances that we will be able to obtain such designations. Even if we, or any future collaborators, obtain orphan drug designation for a drug candidate, we, or they, may not be able to obtain or maintain orphan drug exclusivity for that drug candidate. Further, even if we, or any future collaborators, obtain orphan drug exclusivity for a product, that exclusivity may not effectively protect the product from competition because different drugs with different active ingredients may be approved for the same disease or condition. Even after an orphan drug is approved, the FDA can subsequently approve the same drug for the same disease or condition if the FDA concludes that the later drug is clinically superior in that it is shown to be safer, more effective or makes a major contribution to patient care, or the manufacturer of the product with orphan exclusivity is unable to maintain sufficient product quantity. Orphan drug designation neither shortens the development or regulatory review time of a drug nor gives the drug any advantage in the regulatory review or approval process.

Current wording

We may decide to seek Orphan Drug Designations for alisertib. There can be no assurances that we will be able to obtain such designations. Even if we, or any future collaborators, obtain orphan drug designation for a drug candidate, we, or they, may not be able to obtain or maintain orphan drug exclusivity for that drug candidate. Further, even if we, or any future collaborators, obtain orphan drug exclusivity for a product, that exclusivity may not effectively protect the product from competition because different drugs with different active ingredients may be approved for the same indication or use within the same rare disease or condition. Even after an orphan drug is approved, the FDA can subsequently approve the same drug for the same disease or condition if the FDA concludes that the later drug is clinically superior in the relevant indication, in that it is shown to be safer, more effective or makes a major contribution to patient care, or the manufacturer of the product with orphan exclusivity is unable to maintain sufficient product quantity to meet the needs of the approved indication or use for the patients with the relevant disease or condition. Orphan drug designation neither shortens the development or regulatory review time of a drug nor gives the drug any advantage in the regulatory review or approval process.

Previous wording

In March 2010, the Affordable Care Act (“ACA”) became law in the United States. The ACA substantially changed the way healthcare is financed by both governmental and private insurers and significantly affects the pharmaceutical industry. Among other provisions, the ACA included an annual, nondeductible fee on any entity that manufactures or imports certain branded prescription drugs and biologic agents and a new formula that increases the rebates a manufacturer must pay under the Medicaid Drug Rebate Program. Since its enactment, there have been judicial, executive and Congressional challenges to certain aspects of the ACA. On June 17, 2021, the U.S. Supreme Court dismissed the most recent judicial challenge to the ACA brought by several states without specifically ruling on the constitutionality of the ACA. Thus, the ACA will remain in effect in its current form.

Current wording

In March 2010, the ACA became law in the United States. The ACA substantially changed the way healthcare is financed by both governmental and private insurers and significantly affects the pharmaceutical industry. Among other provisions, the ACA included an annual, nondeductible fee on any entity that manufactures or imports certain branded prescription drugs and biologic agents and a new formula that increases the rebates a manufacturer must pay under the Medicaid Drug Rebate Program. Since its enactment, there have been judicial, executive and Congressional challenges to certain aspects of the ACA. On June 17, 2021, the U.S. Supreme Court dismissed the most recent judicial challenge to the ACA brought by several states without specifically ruling on the constitutionality of the ACA. Thus, the ACA will remain in effect in its current form.

Previous wording

In addition, other legislative changes have been proposed and adopted in the United States since the ACA was enacted. For example, the Budget Control Act of 2011, among other things, led to reductions to Medicare payments to providers that will remain in effect through 2032. On January 2, 2013, the American Taxpayer Relief Act of 2012, among other things, also reduced Medicare payments to several providers, including hospitals, imaging centers and cancer treatment centers, and increased the statute of limitations period for the government to recover overpayments to providers from three to five years. More recently, on March 11, 2021, President Biden signed the American Rescue Plan Act of 2021 into law, which eliminated the statutory Medicaid drug rebate cap, beginning January 1, 2024. The rebate was previously capped at 100% of a drug’s average manufacturer price,

Current wording

In addition, other legislative changes have been proposed and adopted in the United States since the ACA was enacted. For example, the Budget Control Act of 2011, among other things, led to reductions to Medicare payments to providers that will remain in effect through 2032. The American Taxpayer Relief Act of 2012, among other things, also reduced Medicare payments to several providers, including hospitals, imaging centers and cancer treatment centers, and increased the statute of limitations period for the government to recover overpayments to providers from three to five years. The American Rescue Plan Act of 2021 eliminated the statutory Medicaid drug rebate cap, beginning January 1, 2024. The rebate was previously capped at 100% of a drug’s average manufacturer price,

Previous wording

Most significantly, in August 2022, President Biden signed the Inflation Reduction Act of 2022 (“IRA”) into law. This statute marks the most significant action by Congress with respect to the pharmaceutical industry since adoption of the ACA in 2010. Among other things, the IRA requires manufacturers of certain drugs to engage in price negotiations with Medicare, with prices that can be negotiated subject to a cap; imposes rebates under Medicare Part B and Medicare Part D to penalize price increases that outpace inflation (first due in 2023); redesigns the Medicare Part D benefit (beginning in 2024); and replaces the Part D coverage gap discount program with a new manufacturer discount program (beginning in 2025). U.S. Centers for Medicare & Medicaid Services (“CMS”) has published the negotiated prices for the initial 10 drugs, which will first be effective in 2026, and has published the list of the subsequent 15 drugs that will be subject to negotiation. The IRA permits the Secretary of the Department of Health and Human Services (“HHS”) to implement many of these provisions through guidance, as opposed to regulation, for the initial years. HHS has and will continue to issue and update guidance as these programs are implemented, although the Medicare drug price negotiation program is currently subject to legal challenges. The impact of the IRA on us and the pharmaceutical industry cannot yet be fully determined but is likely to be significant.

Current wording

The IRA was enacted in 2022. This statute marks the most significant action by Congress with respect to the pharmaceutical industry since adoption of the ACA in 2010. Among other things, the IRA requires manufacturers of certain drugs to engage in price negotiations with Medicare, with prices that can be negotiated subject to a cap; imposes rebates under Medicare Part B and Medicare Part D to penalize price increases that outpace inflation (first due in 2023); redesigns the Medicare Part D benefit (beginning in 2024); and replaces the Part D coverage gap discount program with a new manufacturer discount program (which began in 2025). The Centers for Medicare & Medicaid Services has published the negotiated prices for the initial ten drugs, which went into effect in January 2026, and the subsequent 15 drugs, which will first be effective in 2027. CMS has also published the next set of 15 drugs that will be subject to negotiation. The IRA permits the Secretary of the HHS to implement many of these provisions through guidance, as opposed to regulation, for the initial years. HHS has and will continue to issue and update guidance as these programs are implemented, although the Medicare drug price negotiation program is currently subject to legal challenges. The impact of the IRA on us and the pharmaceutical industry cannot yet be fully determined but is likely to be significant.

Previous wording

Under the IRA manufacturer discount program that replaced the coverage gap discount program as of January 1, 2025, manufacturers must give a 10 percent discount on Part D drugs in the initial coverage phase, and a 20 percent discount on Part D drugs in the so-called “catastrophic phase” (the phase after the patient incurs costs above the initial phase out-of-pocket threshold, which will be $2,000 beginning in 2025). The IRA allows the 10 and 20 percent discounts to be phased in over time for certain drugs for “specified manufacturers.” In April 2024, CMS informed us that we are deemed a specified small manufacturer and the discount will be phased in over several years and will increase over time. We are continuing to evaluate the potential impact of this status on our future revenues.

Current wording

Under the IRA manufacturer discount program that replaced the coverage gap discount program as of January 1, 2025, manufacturers must give a 10 percent discount on Part D drugs in the initial coverage phase, and a 20 percent discount on Part D drugs in the so-called “catastrophic phase” (the phase after the patient incurs costs above the initial phase out-of-pocket threshold, which will be $2,000 beginning in 2025). The IRA allows the 10 and 20 percent discounts to be phased in over time for certain drugs for manufacturers that CMS deems to meet specific criteria. In April 2024, CMS informed us that we are deemed a specified small manufacturer, and as a result, the discounts will be phased in over several years and will increase over time. We are continuing to evaluate the potential impact of this status on our future revenues.

Previous wording

NERLYNX is reimbursed under Medicare Part D, and the reimbursement amount will be impacted by the 10 and 20 percent discounts under the IRA’s new discounting program (as noted above). We anticipate that these increased discounts will impact NERLYNX revenues over time, while also having an industry-wide impact on the patient out-of-pocket costs of Part D drugs. The impact on NERLYNX revenues could be offset because the IRA’s redesign of certain Part D components, some of which went into effect in 2024, resulted in an increase in the number of patients able to afford this therapy. The amount of the offset, if any, is inherently uncertain and difficult to predict.

Current wording

NERLYNX is reimbursed under Medicare Part D, and the reimbursement amount will be impacted by the 10 and 20 percent discounts under the IRA’s new discounting program (as noted above). We anticipate that these increased discounts will impact NERLYNX revenues over time, while also having an industry-wide impact on the cost of Part D drugs. The impact on NERLYNX revenues could be offset because the IRA’s redesign of certain Part D components, some of which went into effect in 2024, resulted in an increase in the number of patients able to afford this therapy. The amount of the offset, if any, is inherently uncertain and difficult to predict.

Previous wording

The cost of prescription pharmaceuticals in the United States has also been the subject of considerable discussion. There have been several Congressional inquiries, as well as legislative and regulatory initiatives and executive orders designed to, among other things, bring more transparency to product pricing, review the relationship between pricing and manufacturer patient programs, and reform government program reimbursement methodologies for drug products. We cannot predict with certainty what impact any federal or state health reforms will have on us, but such changes could impose new or more stringent regulatory requirements on our activities or result in reduced reimbursement for our products, any of which could adversely affect our business, results of operations and financial condition.

Current wording

In addition, the cost of prescription pharmaceuticals in the United States has also been the subject of considerable discussion. There have been several Congressional inquiries, as well as legislative and regulatory initiatives and executive orders designed to, among other things, bring more transparency to product pricing, review the relationship between pricing and manufacturer patient programs, and reform government program reimbursement methodologies for drug products. We cannot predict with certainty what impact any federal or state health reforms will have on us, but such changes could impose new or more stringent regulatory requirements on our activities or result in reduced reimbursement for our products, any of which could adversely affect our business, results of operations and financial condition.

Previous wording

Individual states in the United States have also become increasingly active in passing legislation and implementing regulations designed to control pharmaceutical and biological product pricing, including price or patient reimbursement constraints, discounts, restrictions on certain product access and marketing cost disclosure and transparency measures, and, in some cases, designed to encourage importation from other countries and bulk purchasing. Some states have enacted legislation creating so-called prescription drug affordability boards, which ultimately may attempt to impose price limits on certain drugs in these states. In addition, regional healthcare authorities and individual hospitals are increasingly using bidding procedures to determine what pharmaceutical products and which suppliers will be included in their prescription drug and other healthcare programs.

Current wording

Moreover, individual states in the United States have also become increasingly active in passing legislation and implementing regulations designed to control pharmaceutical and biological product pricing, including price or patient reimbursement constraints, discounts, restrictions on certain product access, marketing cost disclosure, drug price reporting and other transparency measures, and, in some cases, designed to encourage importation from other countries and bulk purchasing. Some states have enacted legislation creating so-called prescription drug affordability boards, which ultimately may attempt to impose price limits on certain drugs in these states, and at least one state board is imposing an upper payment limit. States are also seeking to implement general, across the board price caps for pharmaceuticals, or are seeking to regulate drug distribution. In addition, regional healthcare authorities and individual hospitals are increasingly using bidding procedures to determine what pharmaceutical products and which suppliers will be included in their prescription drug and other healthcare programs.

Previous wording

We have entered into exclusive sub-license agreements with several third parties that provide these sub-licensees exclusive rights to the development and commercialization of NERLYNX in Europe (excluding Russia and Ukraine), Australia, Canada, China, Southeast Asia, Israel, South Korea, and various countries and territories in Central America, South America, the Middle East and Africa. As a result, we are entirely dependent on these parties to achieve regulatory approval of NERLYNX for marketing in these countries and for the commercialization of NERLYNX, if approved. For the years ended December 31, 2024, 2023 and 2022, royalty revenue from these sub-licensees was$35.3 million,$32.5 million and $28.0 million, respectively, and represented 15%,14% and 12% of total revenue, respectively. The timing and amount of any milestone and royalty payments we may receive under these agreements, as well as the commercial success of NERLYNX in those regions outside of the United States, will depend on, among other things, the efforts, allocation of resources and successful commercialization of NERLYNX by the licensees. We also depend on these third parties to comply with all applicable laws relative to the development and commercialization of our products in those countries. We do not control the individual efforts of these licensees and have limited ability to terminate these agreements if the licensees do not perform as anticipated. The failure of these licensees to devote sufficient time and effort to the development and commercialization of NERLYNX; to meet their obligations to us, including for future royalty and milestone payments; to adequately deploy business continuity plans in the event of a crisis; and/or to satisfactorily resolve significant disagreements with us or address other factors could have an adverse impact on our financial results and operations. In addition, if these third parties violate, or are alleged to have violated, any laws or regulations during the performance of their obligations for us, it is possible that we could suffer financial and reputational harm or other negative outcomes, including possible legal consequences.

Current wording

We have entered into exclusive sub-license agreements with several third parties that provide these sub-licensees exclusive rights to the development and commercialization of NERLYNX in Europe (excluding Ukraine), Australia, Canada, China, Southeast Asia, Israel, South Korea, Russia and various countries and territories in Central America, South America, Africa and the Middle East. As a result, we are entirely dependent on these parties to achieve regulatory approval of NERLYNX for marketing in these countries and for the commercialization of NERLYNX, if approved. For the years ended December 31, 2025, 2024 and 2023, royalty revenue from these sub-licensees was$24.3 million,$35.3 million and $32.5 million, respectively, and represented 11%,15% and 14% of total revenue, respectively. The timing and amount of any milestone and royalty payments we may receive under these agreements, as well as the commercial success of NERLYNX in those regions outside of the United States, will depend on, among other things, the efforts, allocation of resources and successful commercialization of NERLYNX by the licensees. We also depend on these third parties to comply with all applicable laws relative to the development and commercialization of our products in those countries. We do not control the individual efforts of these licensees and have limited ability to terminate these agreements if the licensees do not perform as anticipated. The failure of these licensees to devote sufficient time and effort to the development and commercialization of NERLYNX; to meet their obligations to us, including for future royalty and milestone payments; to adequately deploy business continuity plans in the event of a crisis; and/or to satisfactorily resolve significant disagreements with us or address other factors could have an adverse impact on our financial results and operations. In addition, if these third parties violate, or are alleged to have violated, any laws or regulations during the performance of their obligations for us, it is possible that we could suffer financial and reputational harm or other negative outcomes, including possible legal consequences.

Previous wording

Our internal computer systems and those of third parties with which we contract may be vulnerable to damage from cyberattacks, “phishing” attacks and other social engineering schemes, employee theft or misuse, human error, fraud, denial or degradation of service attacks, computer viruses, malware (e.g. ransomware), sophisticated nation-state and nation-state-supported actors, unauthorized access or use by persons inside our organization or persons with access to systems inside our organization, hacking, natural disasters, terrorism, war and telecommunication and electrical failures despite the implementation of security measures. Attacks upon information technology systems are increasing in their frequency, levels of persistence, sophistication and intensity, and are being conducted by sophisticated and organized groups and individuals with a wide range of motives and expertise. We may also face increased cybersecurity risks due to our reliance on internet technology and the number of our employees who are working remotely, which may create additional opportunities for cybercriminals to exploit vulnerabilities. Furthermore, because the techniques used to obtain unauthorized access to, or to sabotage, systems change frequently and often are not recognized until launched against a target, we may be unable to anticipate these techniques or implement adequate preventative measures. We may also experience security breaches that may remain undetected for an extended period. Even if identified, we may be unable to adequately investigate or remediate incidents or breaches due to attackers increasingly using tools and techniques that are designed to circumvent controls, to avoid detection, and to remove or obfuscate forensic evidence. System failures, accidents or security breaches could cause interruptions in our operations and could result in a material disruption of our clinical activities and business operations, in addition to possibly requiring substantial expenditures of resources to remedy. The loss of clinical trial data could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data. To the extent that any disruption or security breach were to result in a loss of, or damage to, our data or applications, or inappropriate disclosure of confidential or proprietary information, we could incur liability and our research and development programs, and the development of our drug candidates could be delayed.

Current wording

We rely on computer systems, hardware, software, technology infrastructure and online sites and networks for both internal and external operations that are critical to our business. We own and manage some of these information technology systems but also rely on third parties for a range of information technology systems and related products and services. We and certain of our third-party providers collect, maintain and process data about customers, employees, business partners and others, including personally identifiable information, as well as proprietary information belonging to our business such as trade secrets. Our information technology systems and those of third parties with which we contract may be vulnerable to damage from diverse threat vectors, including cyberattacks, “phishing” attacks and other social engineering schemes, employee theft or misuse, human error, fraud, denial or degradation of service attacks, computer viruses, malware (e.g. ransomware), sophisticated nation-state and nation-state-supported actors, unauthorized access or use by persons inside our organization or persons with access to systems inside our organization, hacking, natural disasters, terrorism, war and telecommunication and electrical failures despite the implementation of security measures. We are also vulnerable to other cybersecurity risks and threats, including malicious code embedded in open-source software, or misconfigurations, “bugs” or other vulnerabilities in commercial software that is integrated into our (or our suppliers’ or service providers’) information technology systems, products or services. Attacks upon information technology systems are increasing in their frequency, levels of persistence, sophistication and intensity, and are being conducted by sophisticated and organized groups and individuals with a wide range of motives and expertise. We may also face increased cybersecurity risks due to our reliance on internet technology and the number of our employees who are working remotely, which may create additional opportunities for cybercriminals to exploit vulnerabilities. Furthermore, because the techniques used to obtain unauthorized access to, or to sabotage, systems change frequently and often are not recognized until launched against a target, we may be unable to anticipate these techniques or implement adequate preventative measures. We may also experience security breaches that may remain undetected for an extended period. Even if identified, we may be unable to adequately investigate or remediate incidents or breaches due to attackers increasingly using tools and techniques – including artificial intelligence – that are designed to circumvent controls, to avoid detection, and to remove or obfuscate forensic evidence. System failures, accidents or security breaches could cause interruptions in our operations and could result in a material disruption of our clinical activities and business operations, in addition to possibly requiri…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

The risk of a security breach or disruption, particularly through cyberattacks or cyber intrusion, including by computer hackers, foreign governments and cyber terrorists, has generally increased as the number, intensity and sophistication of attempted attacks and intrusions from around the world have increased and evolved. If we or our third-party vendors were to experience a significant cybersecurity breach of our or their information systems or data, the costs associated with the investigation, remediation and potential notification of the breach to counterparties and data subjects could be material. In addition, our remediation efforts may not be successful. If we do not allocate and effectively manage the resources necessary to build and sustain the proper technology and cybersecurity infrastructure, we could suffer significant business disruption, including transaction errors, supply chain or manufacturing interruptions, processing inefficiencies, data loss or the loss of or damage to intellectual property or other proprietary information.

Current wording

If we or our third-party vendors were to experience a significant cybersecurity breach of our or their information systems or data, the costs associated with the investigation, remediation and potential notification of the breach to counterparties and data subjects could be material. In addition, our remediation efforts may not be successful. There can also be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our information technology systems and confidential information. If we do not allocate and effectively manage the resources necessary to build and sustain the proper technology and cybersecurity infrastructure, we could suffer significant business disruption, including transaction errors, supply chain or manufacturing interruptions, processing inefficiencies, data loss or the loss of or damage to intellectual property or other proprietary information.

Previous wording

We and certain of our service providers are from time to time subject to cyberattacks and security incidents. While we do not believe that we have experienced any significant system failure, accident or security breach to date, if such an event were to occur and cause interruptions in our operations, it could result in a material disruption of our development programs and our business operations, whether due to a loss, corruption or unauthorized disclosure of our trade secrets, personal information or other proprietary or sensitive information or other similar disruptions. It could also expose us to risks, including an inability to provide our services and fulfill contractual demands, and could cause management distraction and the obligation to devote significant financial and other resources to mitigate such problems, which would increase our future information security costs, including through organizational changes, deploying additional personnel, reinforcing administrative, physical and technical safeguards, further training of employees, changing third-party vendor control practices and engaging third-party subject matter experts and consultants and reduce the demand for our technology and services.

Current wording

We and certain of our service providers are from time to time subject to cyberattacks and security incidents that threaten the confidentiality, integrity and availability of our information technology systems and confidential information. While we do not believe that we have experienced any significant system failure, accident or security breach to date, if such an event were to occur and cause interruptions in our operations, it could result in a material disruption of our development programs and our business operations, whether due to a loss, corruption or unauthorized disclosure of our trade secrets, personal information or other proprietary or sensitive information or other similar disruptions. It could also expose us to risks, including an inability to provide our services and fulfill contractual demands, and could cause management distraction and the obligation to devote significant financial and other resources to mitigate such problems, which would increase our future information security costs, including through organizational changes, deploying additional personnel, reinforcing administrative, physical and technical safeguards, further training of employees, changing third-party vendor control practices and engaging third-party subject matter experts and consultants and reduce the demand for our technology and services.

Previous wording

If a security breach or other incident were to result in the unauthorized access to or unauthorized use, disclosure, release or other processing of personal information, it may be necessary to notify individuals, governmental authorities, supervisory bodies, the media and other parties pursuant to privacy and security laws. Any security compromise affecting us, our service providers, strategic partners, other contractors, consultants, or our industry, whether real or perceived, could harm our reputation, erode confidence in the effectiveness of our security measures and lead to regulatory scrutiny. To the extent that any disruption or security breach were to result in a loss of, or damage to, our data or systems, or inappropriate disclosure of confidential or proprietary or personal information, we could incur liability, including litigation exposure, penalties and fines, we could become the subject of regulatory action or investigation, our competitive position could be harmed and the further development and commercialization of our products and services could be delayed. If such an event were to occur and cause interruptions in our operations, it could result in a material disruption of our business. Furthermore, federal, state and international laws and regulations can expose us to enforcement actions and investigations by regulatory authorities, and potentially result in regulatory penalties, fines and significant legal liability, if our information technology security efforts fail. We may also be exposed to a risk of loss or litigation and potential liability, which could materially and adversely affect our business, results of operations or financial condition. We maintain cyber liability insurance; however, this insurance may not be sufficient to cover the financial, legal, business or reputational losses that may result from an interruption or breach of our systems.

Current wording

If a security breach or other incident were to result in the unauthorized access to or unauthorized use, disclosure, release or other processing of personal information, it may be necessary to notify individuals, governmental authorities, supervisory bodies, the media and other parties pursuant to privacy and security laws. Any security compromise affecting us, our service providers, strategic partners, other contractors, consultants, or our industry, whether real or perceived, could harm our reputation, erode confidence in the effectiveness of our security measures and lead to regulatory scrutiny. To the extent that any disruption or security breach were to result in a loss of, or damage to, our data or systems, or inappropriate disclosure of confidential or proprietary or personal information, we could incur liability, such as litigation exposure (including class actions), penalties and fines, we could become the subject of regulatory action or investigation, our competitive position could be harmed and the further development and commercialization of our products and services could be delayed. If such an event were to occur and cause interruptions in our operations, it could result in a material disruption of our business. Furthermore, federal, state and international laws and regulations can expose us to enforcement actions and investigations by regulatory authorities, and potentially result in regulatory penalties, fines and significant legal liability, if our information technology security efforts fail. We may also be exposed to a risk of loss or litigation and potential liability, which could materially and adversely affect our business, results of operations or financial condition. We maintain cyber liability insurance; however, this insurance may not be sufficient to cover the financial, legal, business or reputational losses that may result from an interruption or breach of our systems.

Previous wording

Certain states have also enacted data privacy and security laws and regulations, which govern the privacy, processing and protection of health-related and other personal information. Such laws and regulations will be subject to interpretation by various courts and other governmental authorities, thus creating potentially complex compliance issues for us and our future customers and strategic partners. For example, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (collectively, the CCPA) requires covered businesses that process the personal information of California residents to, among other things: (i) provide certain disclosures to California residents regarding the business’s collection, use, and disclosure of their personal information; (ii) receive and respond to requests from California residents to access, delete, and correct their personal information, or to opt out of certain disclosures of their personal information; and (iii) enter into specific contractual provisions with service providers that process California residents` personal information on the business’s behalf. Further, Washington State enacted a broadly applicable law to protect the privacy of personal health information known as the “My Health My Data Act,” which generally requires affirmative consent for the collection, use, or sharing of any “consumer health data.” Consumer health data is defined to include personal information that is linked or reasonably linkable to a consumer and that identifies a consumer’s past, present, or future physical or mental health status; consumer health data also includes information that is derived or extrapolated from non-health information, such as algorithms and machine learning. Other states, including Connecticut and Nevada, have also passed consumer health data laws, and given the increased focus on the use of health data by entities that are not subject to HIPAA, additional states are expected to pass consumer health privacy laws. Additional compliance investment and potential business process changes may also be required. Similar laws have been passed in other states and are continuing to be proposed at the state and federal level, reflecting a trend toward more stringent privacy legislation in the United States. The enactment of such laws could have potentially conflicting requirements that would make compliance challenging. Compliance with these privacy and data security requirements is rigorous and time-intensive and may increase our cost of doing business; despite those efforts, there is a risk that we may be subject to fines and penalties, litigation and reputational harm, which could materially and adversely affect our business, financial condition and results of operations.

Current wording

A number of U.S. states have also enacted data privacy and security laws and regulations, which govern the privacy, processing and protection of health-related and other personal information. Such laws and regulations will be subject to interpretation by various courts and other governmental authorities, thus creating potentially complex compliance issues for us and our future customers and strategic partners. For example, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (collectively, the "CCPA") requires covered businesses that process the personal information of California residents to, among other things: (i) provide certain disclosures to California residents regarding the business’s collection, use, and disclosure of their personal information; (ii) receive and respond to requests from California residents to access, delete, and correct their personal information, or to opt out of certain disclosures of their personal information; and (iii) enter into specific contractual provisions with service providers that process California residents` personal information on the business’s behalf. Further, Washington State enacted a broadly applicable law to protect the privacy of personal health information known as the “My Health My Data Act,” which generally requires affirmative consent for the collection, use, or sharing of any “consumer health data.” Consumer health data is defined to include personal information that is linked or reasonably linkable to a consumer and that identifies a consumer’s past, present, or future physical or mental health status; consumer health data also includes information that is derived or extrapolated from non-health information, such as algorithms and machine learning. Other states, including Connecticut and Nevada, have also passed consumer health data laws and given the increased focus on the use of health data by entities that are not subject to HIPAA, additional states are expected to pass consumer health privacy laws. Additional compliance investment and potential business process changes may also be required. Similar laws have been passed in other states, reflecting a trend toward more stringent privacy legislation in the United States. The enactment of such laws could have potentially conflicting requirements that would make compliance challenging. Compliance with these privacy and data security requirements is rigorous and time-intensive and may increase our cost of doing business; despite those efforts, there is a risk that we may be subject to fines and penalties, litigation and reputational harm, which could materially and adversely affect our business, financial condition and results of operations.

Previous wording

In addition, the regulatory framework for the receipt, collection, processing, use, safeguarding, sharing and transfer of personal and confidential data is rapidly evolving and is likely to remain uncertain for the foreseeable future as new global privacy rules are being enacted and existing ones are being updated and strengthened. For example, on May 25, 2018, the European Union General Data Protection Regulation (“GDPR”) took effect in Europe. The GDPR is directly applicable in each European Union and EEA member state and applies to companies established in the European Union and the EEA as well as companies that collect and use personal data to offer goods or services to, or monitor the behavior of, individuals in the European Union and the EEA. GDPR imposes stringent data protection obligations for processors and controllers of personal data, and penalties and fines for failure to comply with GDPR are significant, including fines of up to €20 million or 4% of total worldwide annual turnover, whichever is greater. Among other requirements, the GDPR regulates transfers of personal data subject to the GDPR to third countries that have not been found to provide adequate protection to such personal data, including the United States, and the efficacy and longevity of current transfer mechanisms between the EEA and the United States remains uncertain. Case law from the Court of Justice of the European Union (“CJEU”) states that reliance on the standard contractual clauses – a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism alone may not necessarily be sufficient in all circumstances and that transfers must be assessed on a case-by-case basis The European Commission adopted its Adequacy Decision in relation to the DPF on July 10, 2023, rendering the DPF effective as a GDPR transfer mechanism to U.S. entities self-certified under the DPF. The DPF also introduced a new redress mechanism for EU citizens which addresses a key concern in the previous CJEU judgments and may mean transfers under standard contractual clauses are less likely to be challenged in future. We currently rely on the EU standard contractual clauses to transfer personal data outside the EEA and the UK, including to the United States, with respect to both intragroup and third-party transfers. We expect the existing legal complexity and uncertainty regarding international personal data transfers to continue. In particular, we expect the DPF Adequacy Decision to be challenged and international transfers to the United States and to other jurisdictions more generally to continue to be subject to enhanced scrutiny by regulators. As a result, we may have to make certain operational changes and we will have to implement revised standard contractual clauses and other relevant documentation for existing data transfers within required time frames.

Current wording

In addition, the regulatory framework for the receipt, collection, processing, use, safeguarding, sharing and transfer of personal and confidential data is rapidly evolving and is likely to remain uncertain for the foreseeable future as new global privacy rules are being enacted and existing ones are being updated and strengthened. For example, we may be subject to the EU General Data Protection Regulation (“EU GDPR”) and to the United Kingdom General Data Protection Regulation and Data Protection Act 2018 (collectively, the “UK GDPR”) (the EU GDPR and UK GDPR together referred to as the “GDPR”). The GDPR is directly applicable in each EU and EEA member state and the UK and applies to companies established in the EU and the EEA or UK as well as companies that collect and use personal data to offer goods or services to, or monitor the behavior of, individuals in the EU and the EEA or UK. The GDPR imposes stringent data protection obligations for processors and controllers of personal data, and penalties and fines for failure to comply with GDPR are significant, including fines of up to €20 million / £17.5 million or 4% of total worldwide annual turnover, whichever is greater. Among other requirements, the GDPR regulates transfers of personal data subject to the GDPR to third countries that have not been found to provide adequate protection to such personal data, including the United States, and the efficacy and longevity of current transfer mechanisms between the EEA and the United States remains uncertain. Case law from the Court of Justice of the European Union (“CJEU”) states that reliance on the standard contractual clauses – a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism alone may not necessarily be sufficient in all circumstances and that transfers must be assessed on a case-by-case basis We expect the existing legal complexity and uncertainty regarding international personal data transfers to continue and international transfers to the United States and to other jurisdictions more generally to continue to be subject to enhanced scrutiny by regulators. As the regulatory guidance and enforcement landscape in relation to data transfers continue to develop, we could suffer additional costs, complaints and/or regulatory investigations or fines, and/or if we are otherwise unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we operate our business, the geographical location or segregation of our relevant systems and operations, and could adversely affect our financial results.

Previous wording

As of December 31, 2024, we had 172 employees. Our future success depends on our ability to identify, attract, hire, train, retain and motivate other highly skilled scientific, technical, marketing, managerial and financial personnel. Although we will seek to hire and retain qualified personnel with experience and abilities commensurate with our needs, there is no assurance that we will succeed despite their collective efforts. Competition for personnel is intense, and any failure to attract and retain the necessary technical, marketing, managerial and financial personnel would have a material adverse effect on our business, prospects, financial condition and results of operations.

Current wording

As of December 31, 2025, we had 179 emplo yees. Our future success depends on our ability to identify, attract, hire, train, retain and motivate other highly skilled scientific, technical, marketing, managerial and financial personnel. Although we will seek to hire and retain qualified personnel with experience and abilities commensurate with our needs, there is no assurance that we will succeed despite their collective efforts. Competition for personnel is intense, and any failure to attract and retain the necessary technical, marketing, managerial and financial personnel would have a material adverse effect on our business, prospects, financial condition and results of operations.

Previous wording

In the past, securities class action litigation has often been brought against a company following periods of volatility in the market price of its securities. This risk is especially relevant for us because pharmaceutical companies have experienced significant stock price volatility in recent years. These types of lawsuits are subject to inherent uncertainties, and are expensive and time-consuming to investigate, defend and resolve. For instance, inHsu v. Puma Biotechnology, Inc., the plaintiff alleged that we and certain of our executive officers made false or misleading statements and failed to disclose material adverse facts about our business, operations, prospects and performance in violation of the Exchange Act. In February 2019, a jury found that three of the four challenged statements were not false and misleading, and thus found in the defendants' favor on those claims. In December 2021, the Court issued an order preliminarily approving the parties’ settlement which provides for two installment payments by us of approximately $27.1 million each, which were paid in January and June 2022. On August 3, 2022, the Court ordered final approval of the parties’ settlement and dismissed the case, and the matter is now concluded. Any other litigation to which we are a party may similarly divert our management’s attention and financial and other resources or result in an onerous or unfavorable judgment that may not be reversed upon appeal or in payments of substantial monetary damages or fines. Additionally, we may decide to settle such lawsuits on similarly unfavorable terms, which could adversely affect our business, financial condition, results of operations or stock price.

Current wording

In the past, securities class action litigation has often been brought against a company following periods of volatility in the market price of its securities. This risk is especially relevant for us because pharmaceutical companies have experienced significant stock price volatility in recent years. These types of lawsuits are subject to inherent uncertainties, and are expensive and time-consuming to investigate, defend and resolve, and in the past, we have been a defendant in such lawsuits. Any other litigation to which we are a party may similarly divert our management’s attention and financial and other resources or result in an onerous or unfavorable judgment that may not be reversed upon appeal or in payments of substantial monetary damages or fines. Additionally, we may decide to settle such lawsuits on similarly unfavorable terms, which could adversely affect our business, financial condition, results of operations or stock price.

Previous wording

Additionally, valuation allowances needed for deferred tax assets that we estimate are more likely than not to be unusable, based on available evidence at the time the estimate is made. For the year ended December 31, 2024, we released $7.1 million of our valuation allowance related to deferred tax assets, and recorded a valuation allowance of $343.5 million as of December 31, 2024. See Note 12–Income Taxes in the notes to the financial statements included in this Annual Report for further information. The recording of any future increase in or release of all or any portion of our valuation allowance could have a material impact on our reported results and could cause fluctuations in our quarterly and annual results of operations. Moreover, potential changes in the tax law or in our projections could impact our assessment and valuation allowance estimates, which could have a material adverse effect on our business, financial condition and results of operations.

Current wording

Additionally, valuation allowances needed for deferred tax assets that we estimate are more likely than not to be unusable, based on available evidence at the time the estimate is made. For the year ended December 31, 2025, we recorded a partial release of $3.8 million of our valuation allowance related to deferred tax assets, resulting in a total valuation allowance of $324.8 million as of December 31, 2025. See Note 12–Income Taxes in the notes to the financial statements included in this Annual Report for further information. The recording of any future increase in or release of all or any portion of our valuation allowance could have a material impact on our reported results and could cause fluctuations in our quarterly and annual results of operations. Moreover, potential changes in the tax law or in our projections could impact our assessment and valuation allowance estimates, which could have a material adverse effect on our business, financial condition and results of operations.