RIGEL PHARMACEUTICALS INC

Previous wording

While we have substantially increased the size of our organization particularly in our sales force in the third quarter of 2021, we also implemented two separate reductions in workforce in November 2021 and October 2022, and may need to add additional qualified personnel and resources to support our commercial activities and expected growth. Our current infrastructure may be inadequate to support our development and commercialization efforts and expected growth. Future growth will impose significant added responsibilities on members of management, including the need to identify, recruit, maintain and integrate additional employees, and may take time away from running other aspects of our business, including commercialization of our products and development of our other product candidates.

Current wording

While we have substantially increased the size of our organization particularly in our sales force in 2021, we also implemented reductions in workforce particularly in our research and development group in 2021 and 2022. We may need to add additional qualified personnel and resources to support our commercial activities and expected growth. Our current infrastructure may be inadequate to support our development and commercialization efforts and expected growth. Future growth will impose significant added responsibilities on members of management, including the need to identify, recruit, maintain and integrate additional employees, and may take time away from running other aspects of our business, including commercialization of our products and development of our other product candidates.

Previous wording

Apart from our discovery efforts, we continue to seek to broaden and diversify our product portfolio through acquisition or in-licensing of a product. This strategy is dependent on our ability to successfully identify and acquire or in-license relevant product candidates. In July 2022, we entered into a license and transition services agreement with Forma for an exclusive license to develop, manufacture and commercialize olutasidenib, a proprietary inhibitor of mIDH1, for any uses worldwide, including for the treatment of AML and other malignancies. On December 1, 2022, the FDA approved REZLIDHIA capsules for the treatment of adult patients with R/R AML with a susceptible IDH1 mutations as detected by an FDA-approved test. REZLIDHIA is our second commercial product and we believe is highly synergistic with our existing hematology-oncology focused commercial and medical affairs infrastructure. Further, in February 2024, we entered into an Asset Purchase Agreement with Blueprint topurchase certain assets comprising the right to research, develop, manufacture and commercialize GAVRETO (pralsetinib), Blueprint’s proprietary RET inhibitor of tyrosine kinase for the treatment of metastatic RET fusion-positive NSCLC and advanced thyroid cancer, in the US. Simultaneously and in connection with entering into the Asset Purchase Agreement, we also entered into certain supporting agreements with Blueprint, including a customary transition agreement, pursuant to which, during a transition period, Blueprint will transition regulatory and distribution responsibility for pralsetinib to us. We expect to complete the transition of the asset and to start recognizing product sales in the third quarter of 2024. The in-licensing and acquisition of a product is a highly competitive area, and many other companies are pursuing the same or similar product candidates to those that we may consider attractive. In particular, larger companies with more well-established and diverse revenue streams may have a competitive advantage over us due to their size, financial resources and more extensive clinical development and commercialization capabilities. Furthermore, companies that perceive us to be a competitor may be unwilling to assign or license rights to us. The success of this strategy depends partly upon our ability to identify, select and acquire or in-license promising product candidates and technologies. The process of proposing, negotiating and implementing a license or acquisition of a product candidate is lengthy and complex, and we may be unable to in-license or acquire the rights to any such products, product candidates or technologies from third parties for several reasons. We may also be unable to in-license or acquire additional relevant product candidates on acceptable terms. Further, even if we identify acquisition or in-licensing targets, we may not be able to complete the transactions or we may determine after due diligence investigation not to pursue identif…

Excerpt shortened here; the source contains the full paragraph.

Current wording

Apart from our discovery efforts, we continue to seek to broaden and diversify our product portfolio through acquisition or in-licensing of a product. This strategy is dependent on our ability to successfully identify and acquire or in-license relevant product candidates. In July 2022, we entered into a license and transition services agreement with Forma for an exclusive license to develop, manufacture and commercialize olutasidenib, a proprietary inhibitor of mIDH1, for any uses worldwide, including for the treatment of AML and other malignancies. On December 1, 2022, the FDA approved REZLIDHIA capsules for the treatment of adult patients with R/R AML with a susceptible IDH1 mutations as detected by an FDA-approved test. REZLIDHIA is our second commercial product and we believe is highly synergistic with our existing hematology-oncology focused commercial and medical affairs infrastructure. Further, in February 2024, we entered into an Asset Purchase Agreement with Blueprint topurchase certain assets comprising the right to research, develop, manufacture and commercialize GAVRETO, Blueprint’s proprietary RET inhibitor of tyrosine kinase for the treatment of metastatic RET fusion-positive NSCLC and advanced thyroid cancer, in the US. Simultaneously and in connection with entering into the Asset Purchase Agreement, we also entered into certain supporting agreements with Blueprint, including a customary transition agreement, pursuant to which, during a transition period, Blueprint will transition regulatory and distribution responsibility for pralsetinib to us. On June 24, 2024, we announced the completion of the transfer of GAVRETO NDA to us, and GAVRETO became commercially available from us in the US by prescription beginning on June 27, 2024. The in-licensing and acquisition of a product is a highly competitive area, and many other companies are pursuing the same or similar product candidates to those that we may consider attractive. In particular, larger companies with more well-established and diverse revenue streams may have a competitive advantage over us due to their size, financial resources and more extensive clinical development and commercialization capabilities. Furthermore, companies that perceive us to be a competitor may be unwilling to assign or license rights to us. The success of this strategy depends partly upon our ability to identify, select and acquire or in-license promising product candidates and technologies. The process of proposing, negotiating and implementing a license or acquisition of a product candidate is lengthy and complex, and we may be unable to in-license or acquire the rights to any such products, product candidates or technologies from third parties for several reasons. We may also be unable to in-license or acquire additional relevant product candidates on acceptable terms. Further, even if we identify acquisition or in-licensing targets, we may not be able to complete the transactions or we may determine …

Excerpt shortened here; the source contains the full paragraph.

Previous wording

Our compounds in clinical trials and our future leads for potential drug compounds are subject to the risks and failures inherent in the development of pharmaceutical products. These risks include, but are not limited to, the inherent difficulty in selecting the right drug and drug target and avoiding unwanted side effects, as well as unanticipated problems relating to product development, testing, enrollment, obtaining regulatory approvals, obtaining and maintaining reimbursement in national markets and positive recommendation from HTA bodies, maintaining regulatory compliance, manufacturing, competition and costs and expenses that may exceed current estimates. In future clinical trials, we or our partners may discover additional side effects and/or a higher frequency of side effects than those observed in previously completed clinical trials. The results of preliminary and mid-stage clinical trials do not necessarily predict clinical or commercial success, and larger later-stage clinical trials may fail to confirm the results observed in the previous clinical trials. Similarly, a clinical trial may show that a product candidate is safe and effective for certain patient populations in a particular indication, but other clinical trials may fail to confirm those results in a subset of that population or in a different patient population, which may limit the potential market for that product candidate. With respect to our own compounds in development, we have established anticipated timelines with respect to the initiation of clinical trials based on existing knowledge of the compounds. However, we cannot provide assurance that we will meet any of these timelines for clinical development. Additionally, the initial results of a completed earlier clinical trial of a product candidate do not necessarily predict final results and the results may not be repeated in later clinical trials.

Current wording

Our compounds in clinical trials and our future leads for potential drug compounds are subject to the risks and failures inherent in the development of pharmaceutical products. These risks include, but are not limited to, the inherent difficulty in selecting the right drug and drug target and avoiding unwanted side effects, as well as unanticipated problems relating to product development, testing, enrollment, obtaining regulatory approvals, obtaining and maintaining reimbursement in national markets and positive recommendation from HTA bodies, maintaining regulatory compliance, manufacturing, competition and costs and expenses that may exceed current estimates. In future clinical trials, we, our partners or others may discover additional side effects and/or a higher frequency of side effects than those observed in previously completed clinical trials. The results of preliminary and mid-stage clinical trials do not necessarily predict clinical or commercial success, and larger later-stage clinical trials may fail to confirm the results observed in the previous clinical trials. Similarly, a clinical trial may show that a product candidate is safe and effective for certain patient populations in a particular indication, but other clinical trials may fail to confirm those results in a subset of that population or in a different patient population, which may limit the potential market for that product candidate. For example, in October 2024, we issued a Dear Healthcare Provider Letter for GAVRETO related to a new safety signal identified in an ongoing Phase 3 clinical trial of pralsetinib in first-line treatment of RET fusion-positive, metastatic NSCLC patients, being conducted by Roche. The letter advises healthcare providers to apply certain measures to protect patient safety, including enhanced ongoing monitoring for signs and symptoms of infection as well as guidance for withholding treatment to patients in the presence of active infection. With respect to our own compounds in development, we have established anticipated timelines with respect to the initiation of clinical trials based on existing knowledge of the compounds. However, we cannot provide assurance that we will meet any of these timelines for clinical development. Additionally, the initial results of a completed earlier clinical trial of a product candidate do not necessarily predict final results and the results may not be repeated in later clinical trials.

Previous wording

Because of the uncertainty of whether the accumulated preclinical evidence (PK, pharmacodynamic, safety and/or other factors) or early clinical results will be observed in later clinical trials, we can make no assurances regarding the likely results from our future clinical trials or the impact of those results on our business. For example, we initiated our FORWARD study, a Phase 3 pivotal trial of fostamatinib in patients with wAIHA in March 2019, completed the enrollment in November 2021 and completed the treatment period for the last patient under the trial in April 2022. In June 2022, we announced top-line efficacy and safety data results of our FORWARD study, and theresults of the trial did not demonstrate statistical significance in the primary efficacy endpoint of durable hemoglobin response in the overall study population. We conducted an in-depth analysis of these data to better understand differences in patient characteristics and outcomes and submitted these findings to the FDA. In October 2022, we announced that we received guidance from the FDA’s review of these findings. Based on the result of the trial and the guidance from the FDA, we

Current wording

Because of the uncertainty of whether the accumulated preclinical evidence (pharmacokinetic, pharmacodynamic, safety and/or other factors) or early clinical results will be observed in later clinical trials, we can make no assurances regarding the likely results from our future clinical trials or the impact of those results on our business. For example, we conducted a Phase 3 pivotal trial of fostamatinib in patients with warm auto immune hemolytic anemia (wAIHA) initiated in March 2019 and completed in April 2022. In June 2022, we announced top-line

Previous wording

did not file an sNDA for this indication. Further, we may experience errors in the analysis of our clinical trial results. For example, we conducted our Phase 3 clinical trial to evaluate safety and efficacy of fostamatinib in hospitalized COVID-19 patients, which we launched in November 2020 and completed the enrollment on this trial in July 2022. We previously announced in November 2022 the top-line results did not meet statistical significance in the primary efficacy endpoint. Upon further analysis, we discovered an error by the biostatistical CRO in the application of a statistical stratification factor. After correcting for this statistical error, the primary endpoint of the study was met. However, given the end of the federal COVID-19 PHE in May 2023, and based on feedback from the FDA, DOD and other advisors regarding the program’s regulatory requirements, costs, timeline and potential for success, we decided not to submit an EUA or sNDA.

Current wording

efficacy and safety data results of the trial, and theresults did not demonstrate statistical significance in the primary efficacy endpoint of durable hemoglobin response in the overall study population. We conducted an in-depth analysis of these data to better understand differences in patient characteristics and outcomes and submitted these findings to the FDA. In October 2022, we announced that we received guidance from the FDA’s review of these findings. Based on the result of the trial and the guidance from the FDA, we did not file an sNDA for this indication. Further, we may experience errors in the analysis of our clinical trial results. For example, we conducted our Phase 3 clinical trial to evaluate safety and efficacy of fostamatinib in hospitalized COVID-19 patients launched in November 2020 and completed enrollment in July 2022. We previously announced in November 2022 the top-line results did not meet statistical significance in the primary efficacy endpoint. Upon further analysis, we discovered an error by the biostatistical contract research organization (CRO) in the application of a statistical stratification factor. After correcting for this statistical error, the primary endpoint of the study was met. However, given the end of the federal COVID-19 PHE in May 2023, and based on feedback from the FDA, DOD and other advisors regarding the program’s regulatory requirements, costs, timeline and potential for success, we decided not to submit an Emergency Use Authorization (EUA) or sNDA.

Previous wording

Our business operations and current and future arrangements with investigators, healthcare professionals, consultants, third-party payors and customers, may expose us to broadly applicable federal, state and foreign fraud and abuse and other healthcare laws and regulations including anti-kickback and false claims laws, data privacy and security laws, and transparency reporting laws. These laws may constrain the business or financial arrangements and relationships through which we conduct our operations, including how we research, market, sell and distribute any product for which we have obtained regulatory approval, or for which we obtain regulatory approval in the future. In particular, the promotion, sales and marketing of healthcare items and services, as well as certain business arrangements in the healthcare industry, are subject to extensive laws and regulations intended to prevent fraud, misconduct, bribery kickbacks, self-dealing and other abusive or inappropriate practices. These laws and regulations may restrict or prohibit a wide range of pricing, discounting, marketing and promotion, including promoting off-label uses of our products, certain commission compensation, certain customer incentive programs, certain patient support offerings, and other business arrangements generally. Activities subject to these laws also involve the improper use or misrepresentation of information obtained in the course of patient recruitment for clinical trials, creating fraudulent data in our preclinical studies or clinical trials or illegal misappropriation of drug product, which could result in regulatory sanctions and cause serious harm to our reputation. See “Part I, Item 1, Business – Government Regulation – Healthcare and Privacy Law and Regulation and Healthcare Reform” of this Annual Report on Form 10-K, for more information on the healthcare laws and regulations that may affect our ability to operate.

Current wording

Our business operations and current and future arrangements with investigators, healthcare professionals, consultants, third-party payors and customers, may expose us to broadly applicable federal, state and foreign fraud and abuse and other healthcare laws and regulations including anti-kickback and false claims laws, data privacy and security laws, and transparency reporting laws. These laws may constrain the business or financial arrangements and relationships through which we conduct our operations, including how we research, market, sell and distribute any product for which we have obtained regulatory approval, or for which we may obtain regulatory approval in the future. In particular, the promotion, sales and marketing of healthcare items and services, as well as certain business arrangements in the healthcare industry, are subject to extensive laws and regulations intended to prevent fraud, misconduct, bribery kickbacks, self-dealing and other abusive or inappropriate practices. These laws and regulations may restrict or prohibit a wide range of pricing, discounting, marketing and promotion, including promoting off-label uses of our products, certain commission compensation, certain customer incentive programs, certain patient support offerings, and other business arrangements generally. Activities subject to these laws also involve the improper use or misrepresentation of information obtained in the course of patient recruitment for clinical trials, creating fraudulent data in our preclinical studies or clinical trials or illegal misappropriation of drug product, which could result in regulatory sanctions and cause serious harm to our reputation. See “Business – Government Regulation – Healthcare and Privacy Law and Regulation and Healthcare Reform” contained in Part I, Item 1 of this Annual Report on Form 10-K, for more information on the healthcare laws and regulations that may affect our ability to operate.

Previous wording

In the US, these obligations include various federal, state, and local statutes, rules, and regulations relating to privacy and data security. The Federal Trade Commission (FTC) has authority under Section 5 of the FTC Act to regulate unfair or deceptive or practices, and has used this authority to initiate enforcement actions against companies that implement inadequate controls around privacy and information security in violation of their externally facing policies. The FTC has recently brought several cases alleging violations of Section 5 of the FTC Act with respect to health information, and has proposed rulemaking on privacy and data security, including with respect to the Health Breach Notification Rule. The US federal government has also enacted statutes to address privacy and information security issues impacting particular industries or activities, including the following laws and regulations: the Electronic Communications Privacy Act, the Computer Fraud and Abuse Act, the Health Insurance Portability and Accountability Act, the Health Information Technology for Economic and Clinical Health Act, the Telephone Consumer Protection Act, the CAN-SPAM Act, and other laws and regulations. In addition, state legislatures have enacted statutes to address privacy and information security issues, including the California Consumer Privacy Act of 2018 (the CCPA), and similar state laws such as Virginia’s Consumer Data Protection Act and the Colorado Privacy Act. For example, the CCPA, as

Current wording

In the US, these obligations include various federal, state, and local statutes, rules, and regulations relating to privacy and data security. The Federal Trade Commission (FTC) has authority under Section 5 of the FTC Act to regulate unfair or deceptive or practices, and has used this authority to initiate enforcement actions against companies that implement inadequate controls around privacy and information security in violation of their externally facing policies. The FTC has brought several cases alleging violations of Section 5 of the FTC Act with respect to health information, and has proposed rulemaking on a variety of privacy and data security topics. Additionally, the FTC published an advance notice of proposed rulemaking in 2022 on commercial surveillance and data security, and may propose regulation concerning the ways in which companies collect, aggregate, protect, use, analyze, and retain consumer data, as well as transfer, share, sell, or otherwise monetize that data in the coming years. The FTC has also been active with respect to enforcement of its Health Breach Notification Rule and in scrutinizing the use and disclosure of sensitive personal information. The FTC finalized changes to the Health Breach Notification Rule in April 2024. Moreover, the US federal government has also enacted statutes to address privacy and information security issues impacting particular industries or activities, including the following laws and regulations, including, but not limited to: the Electronic Communications Privacy Act, the Computer Fraud and Abuse Act, the Health Insurance Portability and Accountability Act (HIPAA), the Health Information Technology for Economic and Clinical Health Act, the Telephone Consumer Protection Act, the CAN-SPAM Act, and other laws and regulations, and continues to consider comprehensive federal privacy legislation.

Previous wording

amended by the California Privacy Rights Act (CPRA) in 2020, establishes a privacy framework applicable to for-profit entities that are doing business in California, including an expansive definition of personal information and data privacy rights for California residents, and authorizes potentially severe statutory damages and creates a private right of action for certain data security breaches. The CCPA also requires businesses subject to the law to provide disclosures to California residents and to provide them with rights with respect to their personal information, including the right to opt out of the sale of such information. Moreover the CPRA, among other things, impose new requirements relating to data minimization and correction, and gives California residents additional rights over their personal information, including the right to opt-out of the use of their personal information in online behavioral advertising and to opt-out of certain types of consumer. The CPRA also provides for penalties for CPRA violations concerning California residents under the age of 16, and establishes a new California Privacy Protection Agency to implement and enforce the law. Although there are limited exemptions for clinical trial and other research-related data under the CCPA, the CCPA and other similar laws could impact our business depending on how it will be interpreted by the new California Privacy Protection Agency. As we expand our operations, the CCPA may increase our compliance costs and potential liability. Additionally, Colorado, Connecticut, Utah and Virginia passed comprehensive state privacy laws, which became effective on July 1, 2023, July 1, 2023, December 31, 2023, and January 1, 2023, respectively. Several states have also passed similar privacy laws that will become effective in 2024 or later, including Delaware, Indiana, Iowa, Montana, New Jersey, Oregon, Tennessee and Texas. Multiple other states and the federal government are considering enacting similar legislation. Other states have passed state privacy laws to impose enhanced privacy and cybersecurity obligations for consumer health data, such as, the Washington My Health My Data Act and Nevada’s Consumer Health Data Privacy Law. Many states also have in place data security laws requiring companies to maintain certain safeguards with respect to the processing of personal information, and all states require companies to notify individuals or government regulators in the event of a data breach impacting such information. New privacy laws add additional complexity, requirements, restrictions and potential legal risk. Accordingly, compliance programs may require additional investment in resources, and could impact availability of previously useful data.

Current wording

In addition, state legislatures have enacted statutes to address privacy and information security issues, including the California Consumer Privacy Act of 2018 (the CCPA). For example, the CCPA, as amended by the California Privacy Rights Act (CPRA), establishes a privacy framework applicable to for-profit entities that are doing business in California, including an expansive definition of personal information and data privacy rights for California residents (as consumers, business contacts and employees), and authorizes potentially severe statutory damages and creates a private right of action for certain data security breaches. The CCPA also requires businesses subject to the law to provide disclosures to California residents and to provide them with rights with respect to their personal information, including the right to opt out of the sale of such information. Moreover, the CPRA, among other things, imposes requirements relating to data minimization and correction, and gives California residents additional rights over their personal information, including the right to opt-out of the use of their personal information in online behavioral advertising and to opt-out of certain types of consumer profiling. The CPRA also provides for penalties for CPRA violations concerning California residents under the age of 16, and established the California Privacy Protection Agency to implement and enforce the law. Although there are exemptions for PHI, clinical trial and other research-related data under the CCPA, the CCPA could impact our business depending on how it is interpreted by the California Privacy Protection Agency, as well from new regulations issued by the Agency to further implement the law. Compliance with the CCPA may increase our compliance costs and potential liability.

Previous wording

Internationally, our operations abroad may also be subject to increased scrutiny or attention from foreign data protection authorities. For example, our clinical trial programs and research collaborations outside the US may implicate foreign data protection laws, including those in the European Economic Area, Switzerland, and/or the UK (collectively, Europe). Many jurisdictions have established or are in the process of establishing privacy and data security legal frameworks with which we, our collaborators, service providers, including our CROs, and contractors must comply. For example, in the EU, the collection, use, disclosure, transfer and other processing of personal data (i.e., data which identifies an individual or from which an individual is identifiable) is governed by the EU General Data Protection Regulation 2016/679 (the EU GDPR), which came into direct effect in all EU Member States on and from May 25, 2018. The UK has implemented the EU GDPR as the UK GDPR which sits alongside the UK Data Protection Act 2018 (the UK GDPR, together with the EU GDPR, the GDPR). The GDPR has direct effect where an entity is established in the European Economic Area (EEA) or the UK (as applicable) and has extraterritorial effect, including where an entity established outside of the EEA or the UK processes personal data in relation to offering goods or services to individuals in the EEA and/or the UK or monitoring their behavior.

Current wording

Internationally, our operations abroad may also be subject to increased scrutiny or attention from foreign data protection authorities. For example, our clinical trial programs and research collaborations outside the US may implicate foreign data protection laws, including those in the European Economic Area, Switzerland, and/or the UK (collectively, Europe). Many jurisdictions have established or are in the process of establishing privacy and data security legal frameworks with which we, our collaborators, service providers, including our CROs, and contractors must comply. For example, in the EU, the collection, use, disclosure, transfer and other processing of personal data (i.e., data which identifies an individual or from which an individual is identifiable) is governed by the EU General Data Protection Regulation 2016/679 (the EU GDPR), which came into direct effect in all EU Member States on and from May 25, 2018. The UK has implemented the EU GDPR as the UK GDPR which sits alongside the UK Data Protection Act 2018 (the UK GDPR, and together with the EU GDPR, the GDPR). In October 2024, the UK government introduced to Parliament the Data (Use and Access) Bill (the DUA Bill) which is set to introduce reforms to the UK GDPR. The DUA Bill is currently progressing through the legislative process and is expected to be finalized during 2025. The GDPR has direct effect where an entity is established in the European Economic Area (EEA) or the UK (as applicable) and has extraterritorial effect, including where an entity established outside of the EEA or the UK processes personal data in relation to the offering of goods or services to individuals in the EEA and/or the UK or the monitoring of their behavior.

Previous wording

In addition, the EU GDPR prohibits the international transfer of personal data from the EEA to jurisdictions that the European Commission does not recognize as having ‘adequate’ data protection laws unless a data transfer mechanism has been put in place or a derogation under the EU GDPR can be relied on. In July 2020, the Court of Justice of the EU (CJEU) in its Schrems II judgement limited how organizations could lawfully transfer personal data from the EEA to the US by invalidating the EU-US Privacy Shield for purposes of international transfers and imposing further restrictions on the use of standard contractual clauses (EU SCCs), including a requirement for companies to carry out a transfer privacy impact assessment (TIAs). A TIA, among other things, assesses laws governing access to personal data in the recipient country and considers whether supplementary measures that provide privacy protections additional to those provided under EU SCCs will need to be implemented to ensure an ‘essentially equivalent’ level of data protection to that afforded in the EEA.

Current wording

In addition, the EU GDPR prohibits the international transfer of personal data from the EEA to jurisdictions that the European Commission does not recognize as having an ‘adequate’ level of data protection unless a data transfer mechanism has been put in place or a derogation under the EU GDPR can be relied on. In certain cases (e.g., where transfers are made in reliance on EU SCCs) a company must also carry out a so-called transfer privacy impact assessment (TIA). A TIA, among other things, assesses laws governing access to personal data in the recipient country and considers whether supplementary measures that provide privacy protections additional to those provided under EU SCCs will need to be implemented to ensure an ‘essentially equivalent’ level of data protection to that afforded in the EEA.

Previous wording

On October 7, 2022, US President Biden introduced an Executive Order to facilitate a new Trans-Atlantic Data Privacy Framework (DPF) and on July 10, 2023, the European Commission adopted its Final Implementing Decision granting the U.S. adequacy (Adequacy Decision) for EU-US transfers of personal data for entities self-certified to the DPF. Entities relying on EU SCCs for transfers to the U.S. are also able to rely on the analysis in the Adequacy Decision as support for their TIA regarding the equivalence of U.S. national security safeguards and redress. This may have implications for our cross-border data flows and has and may in the future result in increased compliance costs.

Current wording

On July 10, 2023, the European Commission adopted its Final Implementing Decision granting the US adequacy (Adequacy Decision) for EU-US transfers of personal data for entities self-certified to the EU-US Data Privacy Framework (DPF). Entities relying on EU SCCs for transfers to the US. are also able to rely on the analysis in the Adequacy Decision as support for their TIA regarding the equivalence of US national security safeguards and redress.

Previous wording

The UK GDPR also imposes similar restrictions on transfers of personal data from the UK to jurisdictions that the UK Government does not consider adequate, including the US. The UK Government has published its own form of the EU SCCs, known as the International Data Transfer Agreement and an International Data Transfer Addendum to the new EU SCCs. The UK Information Commissioner’s Office has also published its version of the TIA and guidance on international transfers, although entities may choose to adopt either the EU or UK style TIA. Further, on September 21, 2023, the UK Secretary of State for Science, Innovation and Technology established a UK-US data bridge (i.e., a UK adequacy decision) and adopted UK regulations to implement the UK-U.S. data bridge (“UK Adequacy Regulations”). The UK Adequacy Regulations have now been passed in the UK Parliament, and personal data may be transferred from the UK under the UK-U.S. data bridge through the UK extension to the DPF, from October 12, 2023 to organizations self-certified under the DPF.

Current wording

The UK GDPR also imposes similar restrictions on transfers of personal data from the UK to jurisdictions that the UK Government does not consider adequate, including the US. The UK Government has published its own form of the EU SCCs, known as the International Data Transfer Agreement and an International Data Transfer Addendum to the EU SCCs. The UK Information Commissioner’s Office (ICO) has also published its version of the TIA and guidance on international transfers, although entities may choose to adopt either the EU or UK style TIA. Further, on September 21, 2023, the UK Secretary of State for Science, Innovation and Technology established a UK-US data bridge (i.e., a UK adequacy decision) and adopted UK regulations to implement the UK-US data bridge (UK Adequacy Regulations). Personal data may be transferred from the UK under the UK-US data bridge through the UK extension to the DPF, from October 12, 2023, to organizations self-certified under the UK extension to the DPF.

Previous wording

The GDPR imposes fines for serious breaches of up to the higher of 4% of the organization’s annual worldwide turnover or €20m (under the EU GDPR) or £17.5m (under the UK GDPR). The GDPR identifies a list of points to consider when determining the level of fines for data supervisory authorities to impose (including the nature, gravity and duration of the infringement). Data subjects also have a right to compensation, as a result of an organization’s breach of the GDPR which has affected them, for financial or non-financial losses (e.g., distress).

Current wording

Data protection supervisory authorities have the power under the GDPR to (amongst other thing) impose fines for serious breaches of up to the higher of 4% of the organization’s annual worldwide turnover or €20 million (under the EU GDPR) or £17.5 million (under the UK GDPR). The GDPR identifies a list of points to consider when determining the level of fines for data supervisory authorities to impose (including the nature, gravity and duration of the infringement). Data subjects also have a right to compensation, as a result of an organization’s breach of the GDPR which has affected them, for financial or non-financial losses (e.g., distress).

Previous wording

Additionally, other countries outside of Europe have enacted or are considering enacting similar cross-border data transfer restrictions and laws requiring local data residency, with strict requirements and limitations for processing personal information, which could increase the cost and complexity of delivering our services and operating our business. For example, Brazil enacted the General Data Protection Law, New Zealand enacted the New Zealand Privacy Act, China released its Personal Information Protection Law, which went into effect November 1, 2021, and Canada

Current wording

Additionally, other countries outside of Europe have enacted or are considering enacting similar cross-border data transfer restrictions and laws requiring local data residency, with strict requirements and limitations for processing personal information, which could increase the cost and complexity of delivering our services and operating our business. For example, Brazil enacted the General Data Protection Law, New Zealand enacted the New Zealand Privacy Act, China released its Personal Information Protection Law, which went into effect November 1, 2021, and Canada introduced the Digital Charter Implementation Act. As with the EU GDPR, these laws are broad and may increase our compliance burdens, including by mandating potentially burdensome documentation requirements and granting certain rights to individuals to control how we collect, use, disclose, retain, and process personal information about them.

Previous wording

In addition to data privacy requirements, cybersecurity requirements are laid down in various laws in the EU and the UK, the key ones being: (i) the GDPR (as discussed in detail above), which requires controllers and processors to implement appropriate technical and organizational measures to safeguard personal data to a level of security appropriate to the data protection risk; and (ii) the UK Network and Information Systems Regulation 2018 (NIS Regulations), and the the EU Network and Information Systems Security 1 Directive (“NISD1”) as implemented into EU Member State law (and as updated by the EU Network and Information Systems Security 2 Directive (NISD2)).

Current wording

In addition to data privacy requirements, cybersecurity requirements are laid down in various laws in the EU and the UK, the key ones being: (i) the GDPR (as discussed above), which requires controllers and processors to implement appropriate technical and organizational measures to safeguard personal data to a level of security appropriate to the data protection risk; (ii) the UK Network and Information Systems Regulation 2018 (NIS Regulations), and (iii) the EU Network and Information Systems Security 2 Directive (NISD2).

Previous wording

The GDPR does not provide for a specific set of cybersecurity requirements or measures to be implemented, but rather requires a controller or processor to implement appropriate cyber and data security measures in accordance with the then-current risk, the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing. The GDPR however does explicitly require that controllers notify personal data breaches, within the meaning of the GDPR, without undue delay and in any event within 72 hours after becoming aware of it, to the relevant data protection supervisory authority, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals. In addition, controllers are required to notify the individuals concerned of any personal data breach, without undue delay, when the personal data breach is likely to result in a high risk to the rights and freedoms of individuals. Processors are required to notify the controller without undue delay after becoming aware of a personal data breach.

Current wording

The GDPR does not provide for a specific set of cybersecurity requirements or measures to be implemented, but rather requires a controller or processor to implement appropriate cyber and data security measures in accordance with the then-current risk, the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing. The GDPR however does explicitly require that controllers notify personal data breaches, within the meaning of the GDPR as described above.

Previous wording

In the UK, the NIS Regulations apply to ‘operators of essential services’ (OES) and ‘relevant digital service providers’ (RDSP) and it was announced in January 2022, that the NIS Regulations will be updated to also cover ‘managed service providers’ (MSP) and potentially other digital service providers. The NIS Regulations require that appropriate and proportionate technical and organizational measures are implemented to manage the risk of network and information systems, and impose requirements related to incident handling and notification in relation to incidents with significant disruptive effect. Under the NIS Regulations, the UK’s data protection supervisory authority, the Information Commissioner’s Office, may issue fines of up to £17 million and take other action following non-compliance.

Current wording

In the UK, the NIS Regulations apply to ‘operators of essential services’ (OES) and ‘relevant digital service providers’ (RDSP) and following the UK General Election in July 2024, the new UK Government has announced it intends to introduce a Cyber Security and Resilience Bill to the UK Parliament. The NIS Regulations require that appropriate and proportionate technical and organizational measures are implemented to manage the risk of network and information systems, and impose requirements related to incident handling and notification in relation to incidents with significant disruptive effect. Under the NIS Regulations, the ICO may issue fines of up to £17 million and take other action following non-compliance.

Previous wording

In the EU, the NISD1 applies to ‘operators of essential services’ (OES) and ‘digital service providers’ (DSP) and an updated version of NISD1 has been adopted and entered into force on January 17, 2023, called NISD2. The NISD2 will take full effect following implementation into national EU Member State law (i.e., by October 17, 2024). Under the NISD1, OESs and DSPs are required to implement appropriate and proportionate technical and organizational measures to manage the risk of network and information systems, and adhere to incident handling and notification requirements regarding incidents with significant disruptive effect. Importantly, under the NISD2, more stringent cybersecurity and incident reporting requirements are imposed on ‘essential’ and ‘important’ entities, which include ICT managed service providers (MSP), cloud service providers as well as entities carrying out research and development activities of medicinal products, and certain specific medical device manufacturers. Our entities may be in scope of the NISD2 where they qualify as a MSP, cloud provider, R&D entity and/or medical device manufacturer within the meaning of NISD2 and offer those services in the EU.

Current wording

In the EU, the NISD2 (and the implementing laws at a national EU Member State level) impose stringent cybersecurity and incident reporting requirements on ‘essential’ and ‘important’ entities, which include ICT managed service providers (MSP), cloud service providers as well as entities carrying out research and development activities of medicinal products, and certain specific medical device manufacturers. Our entities may be in scope of the NISD2 where they qualify as a MSP, cloud provider, R&D entity and/or medical device manufacturer within the meaning of NISD2 and offer those services in the EU.

Previous wording

The NISD2 empowers the EU Member States to define all rules regarding penalties applicable to infringements, provided that they are effective, proportionate, and dissuasive. NISD2 states that any maximum fine which national implementing law provides for should at least be set at €10 million or 2% of total worldwide turnover, whichever is higher, where essential entities are concerned. Other sanctions may include (i) a temporary suspension to provide services in the EU (by suspending relevant authorizations/certifications); (ii) an order to make public certain elements of the infringement and/or inform customers; and (iii) injunctions to immediately cease infringing conduct. Importantly, NISD2 also provides that senior members of staff can be held personally liable, and face administrative fines or be temporarily suspended from exercising managerial functions at the legal representative or chief executive officer level.

Current wording

The NISD2 empowers the EU Member States to define all rules regarding penalties applicable to infringements, provided that they are effective, proportionate, and dissuasive. NISD2 states that any maximum fine which national implementing law provides for should at least be set at €10 million or 2% of total worldwide turnover, whichever is higher, where essential entities are concerned. Other sanctions may include (i) a temporary suspension to provide services in the EU (by suspending relevant authorizations/certifications); (ii) an order to make public certain elements of the infringement and/or inform customers; and (iii) injunctions to immediately cease infringing conduct. Importantly, NISD2 also provides that senior members of staff can be held personally liable, and face administrative fines or be temporarily suspended from exercising managerial functions at the legal representative or chief executive officer level. The NISD2 has not to date been transposed by all EU Member States despite the deadline for doing so having passed.

Previous wording

In addition, the EU Critical Entities Resilience Directive (CER) entered into force on January 17, 2023 and will take full effect following implementation into national EU Member State law (i.e., by October 17, 2024 – coinciding with the NISD2). The CER is aimed at strengthening the resilience of ‘critical infrastructure’ against specific threats including cyber incidents, natural hazards, terrorist attacks, insider threats, and sabotage. The scope of CER includes entities designated as ‘critical’ under CER and includes (among other things) the health sector and the manufacturers of medical devices as ‘essential services.’ The CER imposes cybersecurity and resilience requirements in particular in relation to incidents with so-called ‘significant disruptive effects’ – which are incidents that are able to significantly impact the continuation of the critical infrastructure service offering in the EU. Requirements include to: (i) identify relevant risks that may significantly disrupt the provision of essential services (i.e., pursuant to a risk assessment); (ii) take appropriate and proportionate technical, security and organizational measures to ensure resilience (i.e., based on the outcome of the risk assessment); and (iii) notify disruptive incidents to the competent authorities within 24 hours after becoming aware of an incident. The CER is enforceable on a national EU Member State level by the competent authorities, and allows EU Member States to set penalties as long as they are effective, proportionate, and dissuasive. Our entities may be in scope of the CER where they qualify as critical entities within the meaning of CER.

Current wording

In addition, the EU Critical Entities Resilience Directive (CER) is aimed at strengthening the resilience of ‘critical infrastructure’ against specific threats including cyber incidents, natural hazards, terrorist attacks, insider threats, and sabotage. The scope of CER includes entities designated as ‘critical’ under CER and includes (among other things) the health sector and the manufacturers of medical devices as ‘essential services.’ The CER imposes cybersecurity and resilience requirements in particular in relation to incidents with so-called ‘significant disruptive effects’ – which are incidents that are able to significantly impact the continuation of the critical infrastructure service offering in the EU. Requirements include to: (i) identify relevant risks that may significantly disrupt the provision of essential services (i.e., pursuant to a risk assessment); (ii) take appropriate and proportionate technical, security and organizational measures to ensure resilience (i.e., based on the outcome of the risk assessment); and (iii) notify disruptive incidents to the competent authorities within 24 hours after becoming aware of an incident. The CER is enforceable on a national EU Member State level by the competent authorities, and allows EU Member States to set penalties as long as they are effective, proportionate, and dissuasive. Our entities may be in scope of the CER where they qualify as critical entities within the meaning of CER. The CER has not to date been transposed by all EU Member States despite the deadline for doing so having passed.

Previous wording

In the EU, a number of new laws related to digital data and AI have also recently entered into force, are expected to enter into force in the foreseeable future, or have been proposed and are being considered. We are still assessing the scope of application, impact, and risk of these recent EU laws on our business, and will continue to assess this moving forward, including for example: (i) the EU’s Data Act– expected to come into force in the first quarter to second quarter of 2024 – which seeks to, among other things regulate the use of, and access to, data generated through connected (or Internet-of-Things) devices and introduces a new means for public sector bodies to access, use and re-use private sector data; and (ii) the proposed European Health Data Space Regulation (EHDS) – expected to be agreed in the third quarter of 2024 – which seeks to , among other things, provide individuals with more control over their electronic health data (EHD), enable cross-border sharing of EHD between national EU healthcare systems and facilitate the sharing of EHD for secondary research purposes.

Current wording

In the EU, a number of new laws related to digital data and AI have recently entered into force, are expected to enter into force in the foreseeable future, or have been proposed and are being considered. We are still assessing the scope of application, impact, and risk of these recent EU laws on our business, and will continue to assess this moving forward, including for example: (i) the EU’s Data Act, which – came into force on January 11, 2024 and which seeks to, among other things regulate the use of, and access to, data generated through connected (or Internet-of-Things) devices and introduces a new means for public sector bodies to access, use and re-use private sector data. EU Member State competent authorities are empowered to enforce the Data Act and determine the appropriate sanction provided penalties are “effective, proportionate and dissuasive”; and (ii) the European Health Data Space Regulation (EHDS), which was

Previous wording

The EU has also developed a standalone law to govern the offering and use of AI systems in the EU (the AI Act) which reached political agreement on December 8, 2023 and is expected to be adopted and enter into force during the first quarter to second quarter of 2024. The AI Act imposes regulatory requirements onto AI system providers, importers, distributors, and users of AI systems, in accordance with the level of risk involved with the AI system (“unacceptable”, “high”, “limited”, and “minimal” risk). Unacceptable-risk AI systems are banned from being offered and used in the EU, and high-risk AI systems (which include AI used as part of medical devices in certain instances) are subject to a set of regulatory requirements under the AI Act including to establish quality and post-marketing monitoring and risk assessment systems, requirements related to the training of AI systems and training data, and requirements related to human oversight. Limited-risk AI systems are subject mainly to transparency requirements only and minimal-risk AI systems are not subject to obligations under the AI Act. In the most recent iteration of the AI Act’s text, general-purpose AI systems have also been made subject to a number of requirements – mostly akin to the requirements that apply to high-risk AI systems under the AI Act.

Current wording

The EU has developed a standalone law to govern the offering and use of AI systems in the EU (the “AI Act”) which entered into force on August 1, 2024 and will become applicable in a gradual manner between 2025-2027 depending on the requirement. The AI Act imposes regulatory requirements onto AI system providers, importers, distributors, and deployers, in accordance with the level of risk involved with the AI system (“unacceptable”, “high”, “limited”, and “minimal” risk). Unacceptable-risk AI systems are banned from being offered and used in the EU, and high-risk AI systems (which include AI used as part of medical devices in certain instances) are subject to a set of regulatory requirements under the AI Act including to establish quality and post-marketing monitoring and risk assessment systems, requirements related to the training of AI systems and training data, and requirements related to human oversight. Limited-risk AI systems are subject mainly to transparency requirements only and minimal-risk AI systems are not subject to obligations under the AI Act. General-purpose AI systems are subject to a number of requirements – mostly akin to the requirements that apply to high-risk AI systems under the AI Act.

Previous wording

Currently, the AI Act is expected to enter into application (i.e. be enforceable) in a gradual manner – depending on the regulatory requirement in question, and ranging anywhere from 6 to 36 months following adoption and entry into force of the AI Act (i.e., between fourth quarter of 2024 to first quarter of 2027). Non-compliance with the AI Act may be subject to regulatory fines of up to 7% of annual worldwide turnover. In parallel, the EU has proposed revisions to the EU Product Liability Directive and has introduced a new EU AI Liability Directive to facilitate claims for damages brought by EU users of AI systems.

Current wording

Non-compliance with the AI Act may be subject to regulatory fines of up to 7% of annual worldwide turnover. In parallel, on October 10, 2024, the EU adopted the EU Product Liability Directive to regulate non-contractual and non-fault based liability for defective products, including digital products and AI, and has introduced a new EU AI Liability Directive to facilitate claims for damages brought by EU users of AI systems.

Previous wording

Further, many jurisdictions impose mandatory clinical trial information obligations on sponsors. In the EU, such obligations arise under the Transparency Regulation No 1049/ 2001, EMA Policy 0043, EMA Policy 0070 and the Clinical Trials Regulation No 536/2014, all of which impose on sponsors the obligation to make publicly available certain information stemming from clinical studies. In the EU, the transparency framework provides EU-based parties the right to submit an access to documents request to the EMA for information included in the MAA dossier for approved medicinal products. Only very limited information is exempted from disclosure, i.e., commercially confidential information (which is construed increasingly narrowly) and protected personal data. It is possible for competitors to access and use this data in their own research and development programs anywhere in the world, once this data is in the public domain.

Current wording

Further, many jurisdictions impose mandatory clinical trial information obligations on sponsors. In the EU, such obligations arise under the Transparency Regulation No 1049/ 2001, EMA Policy 0043, EMA Policy 0070 and the Clinical Trials Regulation No 536/2014 (which the UK has not implemented, as the law entered into force following the UK’s exit from the EU), all of which impose on sponsors the obligation to make publicly available certain information stemming from clinical studies. In the EU, the transparency framework provides EU-based parties the right to submit an access to documents request to the EMA for information included in the MAA dossier for approved medicinal products. Only very limited information is exempted from disclosure, i.e., commercially confidential information (which is construed increasingly narrowly) and protected personal data. It is possible for competitors to access and use this data in their own research and development programs anywhere in the world, once this data is in the public domain.

Previous wording

To help patients afford our products, we have a manufacturer-sponsored patient assistance program that helps financially needy patients in the US access our therapies. This type of program has become the subject of enforcement scrutiny in recent years. For example, some pharmaceutical manufacturers have been named in lawsuits challenging the legality of their patient assistance programs under a variety of federal and state laws. In addition, certain state and federal enforcement authorities have pursued investigations and settlements and members of Congress have initiated inquiries about manufacturer-sponsored patient support programs, including, for example, manufacturer-sponsored patient assistance programs, co-payment assistance programs, and manufacturer contributions to independent charitable patient assistance programs. Moreover, the DHHS, Office of the Inspector General continues to publish advisory opinions and other agency guidance on the topic of patient assistance, which reflects the government’s continued scrutiny of manufacturer sponsored or supported patient assistance programs. Numerous organizations, including pharmaceutical manufacturers, have been subject to ongoing litigation, enforcement activities and settlements related to their patient support programs and certain of these organizations have entered into, or have otherwise agreed to, significant civil settlements with applicable enforcement authorities. It is possible that future legislation may be proposed that would establish requirements or restrictions with respect to these programs and/or support that would affect pharmaceutical manufacturers.

Current wording

To help patients afford our products, we have a manufacturer-sponsored patient assistance program that helps financially needy patients in the US access our therapies. This type of program has become the subject of enforcement scrutiny in recent years. For example, some pharmaceutical manufacturers have been named in lawsuits challenging the legality of their patient assistance programs under a variety of federal and state laws. In addition, certain state and federal enforcement authorities continue to pursue investigations and enter into settlements related to manufacturers’ support of patient assistance programs, and members of Congress have also initiated inquiries on topics that include, for example, manufacturer-sponsored patient assistance programs, co-payment assistance programs, and manufacturer contributions to independent charitable patient assistance programs. Moreover, the DHHS, Office of the Inspector General continues to publish advisory opinions and other agency guidance on the topic of patient assistance, which reflects the government’s continued scrutiny of manufacturer sponsored or supported patient assistance programs. Numerous organizations, including pharmaceutical manufacturers, have been subject to ongoing litigation, enforcement activities and settlements related to their patient support programs and certain of these organizations have entered into, or have otherwise agreed to, significant civil settlements with applicable enforcement authorities. It is possible that future legislation may be proposed that would establish requirements or restrictions with respect to these programs and/or support that would affect pharmaceutical manufacturers.

Previous wording

Under the FDCA, the FDA can approve an ANDA for a generic version of a branded drug without the ANDA applicant undertaking the clinical testing necessary to obtain approval to market a new drug. Generally, in place of such clinical studies, an ANDA applicant usually needs only to submit data demonstrating that its product has the same active ingredient(s), strength, dosage form and route of administration and that it is bioequivalent to the branded product. In September 2019, the FDA published product-specific bioequivalence guidance on fostamatinib disodium to let potential ANDA applicants understand the data FDA would expect to see for approval of a generic version of our products.

Current wording

clinical studies, an ANDA applicant usually needs only to submit data demonstrating that its product has the same active ingredient(s), strength, dosage form and route of administration and that it is bioequivalent to the branded product. In September 2019, the FDA published product-specific bioequivalence guidance on fostamatinib disodium to let potential ANDA applicants understand the data FDA would expect to see for approval of a generic version of our products.

Previous wording

owner has 45 days to bring a patent infringement suit in federal district court against the company seeking ANDA approval of a product covered by one of the owner’s patents. If this type of suit is commenced, the FDCA provides a 30-month stay on the FDA’s approval of the competitor’s application. If the litigation is resolved in favor of the ANDA applicant or the challenged patent expires during the 30-month stay period, the stay is lifted, and the FDA may thereafter approve the application based on the standards for approval of ANDAs. Once an ANDA is approved by the FDA, the generic manufacturer may market and sell the generic form of the branded drug in competition with the branded medicine.

Current wording

The FDCA requires that an applicant for approval of a generic form of a branded drug certify either that its generic product does not infringe any of the patents listed by the owner of the branded drug in the FDA’s Orange Book or that those patents are not enforceable. This process is known as a paragraph IV challenge. Upon notice of a paragraph IV challenge, a patent owner has 45 days to bring a patent infringement suit in federal district court against the company seeking ANDA approval of a product covered by one of the owner’s patents. If this type of suit is commenced, the FDCA provides a 30-month stay on the FDA’s approval of the competitor’s application. If the litigation is resolved in favor of the ANDA applicant or the challenged patent expires during the 30-month stay period, the stay is lifted, and the FDA may thereafter approve the application based on the standards for approval of ANDAs. Once an ANDA is approved by the FDA, the generic manufacturer may market and sell the generic form of the branded drug in competition with the branded medicine.

Previous wording

Any of these events could prevent us from achieving or maintaining market acceptance of our products and could substantially increase our operating costs and expenses, which in turn could delay or prevent us from generating significant revenue from sale of our products.

Current wording

Any of these events could prevent us from achieving or maintaining market acceptance of our products and could substantially increase our operating costs and expenses, which in turn could delay or prevent us from generating significant revenue from sale of our products. For example, in October 2024, we issued a Dear Healthcare Provider letter related to a new safety signal for GAVRETO. The letter advises healthcare providers to apply certain measures to protect patient safety, including enhanced ongoing monitoring for signs and symptoms of infection as well as guidance for withholding treatment to patients in the presence of active infection. This and other communications containing warnings or other safety information to physicians and pharmacies, or required updates to labeling statements, including specific warnings or contradictions, could limit the commercial success of GAVRETO or any of our other drug products.

Previous wording

with a practice that does not prescribe our products. Additionally, a pandemic, including COVID-19 or any resurgence thereof, may impact commercial-related activities, such as our marketing programs, speaker bureaus, and market access initiatives which may be required to be conducted virtually, delayed or cancelled, all of which occurred as a result of the COVID-19 pandemic. During the COVID-19 pandemic, we had to deploy resources to enable our field-based employees to continue to engage with health care providers in hybrid virtual and in-person interactions, which may be required in the event a pandemic occurs in the future.

Current wording

For example, during the COVID-19 pandemic, we observed reduced patient-doctor interactions and our representatives had fewer visits with health care providers, which negatively affected our product sales. Physicians with practices severely impacted by the COVID-19 pandemic, or a pandemic occurring in the future, and who currently prescribe our products, may eventually decide to close their independent practices and join a larger medical organization with a practice that does not prescribe our products. Additionally, a pandemic, including COVID-19 or any resurgence thereof, may impact commercial-related activities, such as our marketing programs, speaker bureaus, and market access initiatives which may be required to be conducted virtually, delayed or cancelled, all of which occurred as a result of the COVID-19 pandemic. During the COVID-19 pandemic, we had to deploy resources to enable our field-based employees to continue to engage with health care providers in hybrid virtual and in-person interactions, which may be required in the event a pandemic occurs in the future.

Previous wording

Health regulatory agencies globally may experience prolonged disruptions in their operations as a result of pandemics. For example, in response to the COVID-19 pandemic, the FDA delayed inspections and evaluations of certain drug manufacturing facilities and clinical research sites We cannot predict whether, and when, health regulatory agencies will decide to pause or resume inspections due to pandemics. Any de-prioritization of our clinical trials or delay in regulatory review resulting from such disruptions could materially affect the completion of our clinical trials.

Current wording

Health regulatory agencies globally may experience prolonged disruptions in their operations as a result of pandemics. For example, in response to the COVID-19 pandemic, the FDA delayed inspections and evaluations of certain drug manufacturing facilities and clinical research sites We cannot predict whether, and when, health regulatory agencies will decide to pause or resume inspections due to pandemics. Any de-prioritization of our clinical trials or delay

Previous wording

In addition, as seen in the COVID-19 pandemic, pandemics could result in a significant disruption of global financial markets. We could experience an inability to access additional capital oran impact on liquidity, which could in the future negatively affect our capacity for certain corporate development transactions or our ability to make other important, opportunistic investments, orwe may not be able to meet the requirements under our Credit and Security Agreement (Credit Agreement) with MidCap Financial Trust (MidCap). While we expect pandemics toadversely affect ourbusiness, financial condition, results of operations and growth prospects in the future periods, the extent of the impact on our ability to generate sales of and revenues from our approved products, our ability to continue to secure new collaborations and support existing collaboration efforts with our partners, our clinical development and regulatory efforts, our corporate development objectives and the value of and market for our common stock, will depend on future circumstances that are highly uncertain and cannot be predicted with confidence at this time, such as the ultimate duration and severity of pandemics, travel restrictions, quarantines, social distancing and business closure requirements in the US and other countries, and the effectiveness of actions taken globally to contain and treat diseases. To the extent

Current wording

In addition, as seen in the COVID-19 pandemic, pandemics could result in a significant disruption of global financial markets. We could experience an inability to access additional capital oran impact on liquidity, which could in the future negatively affect our capacity for certain corporate development transactions or our ability to make other important, opportunistic investments, orwe may not be able to meet the requirements under our Credit and Security Agreement (Credit Agreement) with MidCap Financial Trust (MidCap). While we expect pandemics toadversely affect ourbusiness, financial condition, results of operations and growth prospects in the future periods, the extent of the impact on our ability to generate sales of and revenues from our approved products, our ability to continue to secure new collaborations and support existing collaboration efforts with our partners, our clinical development and regulatory efforts, our corporate development objectives and the value of and market for our common stock, will depend on future circumstances that are highly uncertain and cannot be predicted with confidence at this time, such as the ultimate duration and severity of pandemics, travel restrictions, quarantines, social distancing and business closure requirements in the US and other countries, and the effectiveness of actions taken globally to contain and treat diseases. To the extent pandemics adversely affect our business and results of operations, it may also have the effect of heightening many of the other risks and uncertainties described elsewhere in this “Risk Factors” section.

Previous wording

We participate in the Medicaid Drug Rebate Program, as administered by the CMS, the 340B Drug Pricing Program, as administered by the Health Resources and Services Administration, and other federal and state government drug pricing programs in the US, and we may participate in additional government pricing programs in the future. These programs generally require us to pay rebates or otherwise provide discounts to government payors in connection with drugs that are dispensed to beneficiaries/recipients of these programs. In some cases, such as with the Medicaid Drug Rebate Program, the rebates are based on pricing metrics that we report on a monthly and quarterly basis to the government agencies that administer the programs. Pricing requirements and rebate/discount calculations are complex, vary among products and programs, and are often subject to interpretation by governmental or regulatory agencies and the courts. The requirements of these programs, including, by way of example, their respective terms and scope, change frequently. Responding to current and future changes may increase our costs, and the complexity of compliance will be time consuming. Invoicing for rebates is provided in arrears, and there is frequently a time lag of up to several months between the sales to which rebate notices relate and our receipt of those notices, which further complicates our ability to accurately estimate and accrue for rebates related to the Medicaid program as implemented by individual states. Thus, there can be no assurance that we will be able to identify all factors that may cause our discount and rebate payment obligations to vary from period to period, and our actual results may differ significantly from our estimated allowances for discounts and rebates. Changes in estimates and assumptions may have an adverse effect on our business, results of operations and financial condition.

Current wording

We participate in the Medicaid Drug Rebate Program, as administered by CMS, the 340B Drug Pricing Program, as administered by the Health Resources and Services Administration, and other federal and state government drug pricing programs in the US, and we may participate in additional government pricing programs in the future. These programs generally require us to pay rebates or otherwise provide discounts to government payors and/or required covered entities in connection with drugs that are dispensed to beneficiaries/recipients of these programs. In some cases, such as with the Medicaid Drug Rebate Program, the rebates are based on pricing metrics that we report on a monthly and quarterly basis to the government agencies that administer the programs. Pricing requirements and rebate/discount calculations are complex, vary among products and programs, and are often subject to interpretation by governmental or regulatory agencies and the courts. The requirements of these programs, including, by way of example, their respective terms and scope, change frequently. For example, in September 2024, CMS published a final rule that included significant revisions to certain Medicaid Drug Rebate Program provisions, including, but not limited to: (i) new definitions for key terms under the Medicaid Drug Rebate Program, such as “covered outpatient drug” and “market date”; (ii) revised processes for identifying drug misclassifications, as well as additional penalties that can be imposed against manufacturers in connection with such misclassifications; and (iii) a new 12-quarter time limit for manufacturers to initiate disputes, hearing requests, and audits for state-invoiced rebate amounts. Responding to current and future changes may increase our costs, and the complexity of compliance will be time consuming. Invoicing for rebates is provided in arrears, and there is frequently a time lag of up to several months between the sales to which rebate notices relate and our receipt of those notices, which further complicates our ability to accurately estimate and accrue for rebates related to the Medicaid program as implemented by individual states. Thus, there can be no assurance that we will be able to identify all factors that may cause our discount and rebate payment obligations to vary from period to period, and our actual results may differ significantly from our estimated allowances for discounts and rebates. Changes in estimates and assumptions may have an adverse effect on our business, results of operations and financial condition.

Previous wording

In addition, the DHHS, Office of Inspector General and other governmental enforcement and administrative bodies have increased their focus on pricing requirements for products, including, but not limited to the methodologies used by manufacturers to calculate average manufacturer price and best price for compliance with reporting requirements under the Medicaid Drug Rebate Program. We are liable for errors associated with our submission of pricing data and for any overcharging of government payors. Failure to make necessary disclosures and/or to identify overpayments could result in allegations against us under the federal False Claims Act and other laws and regulations. Any required refunds to the US government or response to a government investigation or enforcement action would be expensive and time consuming and could have an adverse effect on our business, results of operations and financial condition. In addition, in the event that CMS were to terminate our rebate agreement, no federal payments would be available under Medicaid for our covered outpatient drugs or under Medicare Part B for any of our products that may be reimbursed under Part B.

Current wording

In addition, the DHHS, Office of Inspector General and other governmental enforcement and administrative bodies have increased their focus, including through recent enforcement actions against manufacturers, on pricing requirements for products, including, but not limited to the methodologies used by manufacturers to calculate average manufacturer price and best price for compliance with reporting requirements under the Medicaid Drug Rebate Program. We are liable for errors associated with our submission of pricing data and for any overcharging of government payors. Failure to make necessary disclosures and/or to identify overpayments could result in allegations against us under the federal False Claims Act and other laws and regulations. Any required refunds to the US government or response to a government investigation or enforcement action would be expensive and time consuming and could have an adverse effect on our business, results of operations and financial condition. In addition, in the event that CMS were to terminate

Previous wording

Finally, we may be affected by developments relating to the 340B Drug Pricing Program. Recently, multiple manufacturers have implemented policies to reduce diversion and inappropriate claims for discounts and rebates by contract pharmacies affiliated with 340B-eligible entities. The DHHS has sent several of these manufacturers letters claiming that the policies violate the 340B statue and referring the manufacturers for potential enforcement action. Manufacturers have challenged these letters in federal court, and the U.S. Court of Appeals for the Third Circuit has ruled in favor of several manufacturers; other challenges are still pending. Further, Arkansas and Louisiana recently enacted laws requiring manufacturers to ship 340B drugs to certain contract pharmacies and imposing penalties on manufacturers that do not comply. Both laws have been challenged in federal court. Other states are considering similar laws. It is unclear how this pending litigation, recent and proposed legislation, or future administrative action relating to the 340B program will impact our business.

Current wording

Finally, we may be affected by developments relating to the 340B Drug Pricing Program (340B Program). For example, since 2021, multiple manufacturers have implemented policies to reduce diversion and inappropriate claims for discounts by placing restrictions on 340B pricing for drugs dispensed through contract pharmacies. The DHHS sent several of these manufacturers’ letters claiming that the policies violate the 340B statute and referring the manufacturers for potential enforcement action. Manufacturers challenged these letters in federal court, and the US Court of Appeals for the Third Circuit and the District of Columbia Circuit have ruled in favor of several manufacturers, finding that the policies were consistent with the 340B statute. Multiple states have recently enacted laws that require manufacturers to ship 340B drugs to certain contract pharmacies and impose various civil and criminal penalties on manufacturers that do not comply. These laws have been challenged in federal court and many of the cases are pending. In March 2024, the US Court of Appeals for the Eight Circuit upheld the Arkansas law prohibiting drug makers for restricting 340B drug discounts for providers using contract pharmacies. DHHS also issued a final rule on procedures for the 340B Program’s administrative dispute resolution process in April 2024. It is unclear how the other pending litigation, proposed legislation, or future administrative action relating to the 340B Program will impact our business.

Previous wording

equity offerings or debt financings, we do not know whether additional financing will be available when needed, or that, if available, we will obtain financing on reasonable terms. Our ability to raise additional capital, including our ability to secure new collaborations and continue to support existing collaboration efforts with our partners, may also be adversely impacted by potential worsening global economic conditions and the recent disruptions to, and volatility in, the credit and financial markets in the US and worldwide resulting from the COVID-19 pandemic and the global tensions arising from the Russia-Ukraine war and the Hamas-Israel war. Unless and until we are able to generate a sufficient amount of product, royalty or milestone revenue, which may never occur, we expect to finance future cash needs through public and/or private offerings of equity securities, debt financings or collaboration and licensing arrangements, as well as through proceeds from the exercise of stock options and interest income earned on the investment of our cash balances and short-term investments. To the extent we raise additional capital by issuing equity securities in the future, our stockholders could at that time experience substantial dilution. In addition, we have a significant number of stock options outstanding. To the extent that outstanding stock options have been or may be exercised or other shares issued, our stockholders may experience further dilution. Further, we may choose to raise additional capital due to market conditions or strategic considerations even if we believe we have sufficient funds for our current or future operating plans. Our credit facility with MidCap includes certain covenants that may restrict our business, and any other debt financing that we are able to obtain in the future may involve operating covenants that restrict our business. To the extent that we raise additional funds through any new collaboration and licensing arrangements, we may be required to refund certain payments made to us, relinquish some rights to our technologies or product candidates or grant licenses on terms that are not favorable to us.

Current wording

We will continue to need additional capital and the amount of future capital needed will depend largely on the success of our commercialization of our products, and the success of our internally developed programs as they proceed in later and more expensive clinical trials, including any additional clinical trials that we may decide to conduct with respect to our products. While we intend to opportunistically seek access to additional funds through public or private equity offerings or debt financings, we do not know whether additional financing will be available when needed, or that, if available, we will obtain financing on reasonable terms. Our ability to raise additional capital, including our ability to secure new collaborations and continue to support existing collaboration efforts with our partners, may also be adversely impacted by potential worsening global economic conditions and the recent disruptions to, and volatility in, the credit and financial markets in the US and worldwide resulting from a global pandemic and the global tensions arising from the Russia-Ukraine war and the Hamas-Israel war. Unless and until we are able to generate a sufficient amount of product, royalty or milestone revenue, which may never occur, we expect to finance future cash needs through public and/or private offerings of equity securities, debt financings or collaboration and licensing arrangements, as well as through proceeds from the exercise of stock options and interest income earned on the investment of our cash balances and short-term investments. To the extent we raise additional capital by issuing equity securities in the future, our stockholders could at that time experience substantial dilution. In addition, we have a significant number of stock options outstanding. To the extent that outstanding stock options have been or may be exercised or other shares issued, our stockholders may experience further dilution. Further, we may choose to raise additional capital due to market conditions or strategic considerations even if we believe we have sufficient funds for our current or future operating plans. Our credit facility with MidCap includes certain covenants that may restrict our business, and any other debt financing that we are able to obtain in the future may involve operating covenants that restrict our business. To the extent that we raise additional funds through any new collaboration and licensing arrangements, we may be required to refund certain payments made to us, relinquish some rights to our technologies or product candidates or grant licenses on terms that are not favorable to us.

Previous wording

We entered into a Credit Agreement with MidCap on September 27, 2019, amended on March 29, 2021, February 11, 2022, and July 27, 2022. The Credit Agreement provides for a $60.0 million term loan credit facility. As of December 31, 2023, the outstanding principal balance of the loan was $60.0 million, and no remaining funds were available under the term loan credit facility. Under the Credit Agreement, we are required to repay amounts due when there is an event of default for the term loans that results in the principal, premium, if any, and interest, if any, becoming due prior to the maturity date for the term loans. The Credit Agreement also contains a number of other affirmative and restrictive covenants. See “Note 10 – Debt” to our “Notes to Financial Statements”contained in “Part II, Item 8, Financial Statements and Supplementary Data” of this Annual Report on Form 10-Kfor additional details of the Credit Agreement. These and other terms in the Credit Agreement have to be monitored closely for compliance and could restrict our ability to grow our business or enter into transactions that we believe would be beneficial to our business. Our business may not generate cash flow from operations in the future sufficient to service our debt and support our growth strategies. If we are unable to generate such cash flow, we may be required to adopt one or more alternatives, such as restructuring our debt or obtaining additional equity capital on terms that may be onerous or highly dilutive. Our ability to refinance our indebtedness will depend on the capital markets and our financial condition at such time. We may not be able to engage in any of these activities or engage in these activities on desirable terms, which could result in a default on our current debt obligations. In addition, we cannot be sure that additional financing will be available when required or, if available, will be on terms satisfactory to us. Further, even if we are able to obtain additional financing, we may be required to use such proceeds to repay a portion of our debt.

Current wording

We entered into a Credit Agreement with MidCap on September 27, 2019, amended on March 29, 2021, February 11, 2022, July 27, 2022, and April 11, 2024. The Credit Agreement provides for a $60.0 million term loan credit facility. As of December 31, 2024, the outstanding principal balance of the loan was $60.0 million, and no remaining funds were available under the term loan credit facility. Under the Credit Agreement, we are required to repay amounts due when there is an event of default for the term loans that results in the principal, premium, if any, and interest, if any, becoming due prior to the maturity date for the term loans. The Credit Agreement also contains a number of other affirmative and restrictive covenants. See “Note 11 – Debt” to our “Notes to Financial Statements” contained in “Part II, Item 8, Financial Statements and Supplementary Data” of this Annual Report on Form 10-K” for additional details of the Credit Agreement. These and other terms in the Credit Agreement have to be monitored closely for compliance and could restrict our ability to grow our business or enter into transactions that we believe would be beneficial to our business. Our business may not generate cash flow from operations in the future sufficient to service our

Previous wording

agent the right to demand payment of the outstanding principal and additional interest and fees in the event of default. We may not have enough available cash or be able to obtain financing at the time we are required to repay the term loan with additional interest and fees prior to maturity.

Current wording

Our Credit Agreement with MidCap contains a mandatory prepayment provision that gives MidCap and/or its agent the right to demand payment of the outstanding principal and additional interest and fees in the event of default. We may not have enough available cash or be able to obtain financing at the time we are required to repay the term loan with additional interest and fees prior to maturity.

Previous wording

part, our estimates are dependent on our distribution channel and payor mix. If actual results in the future vary from our estimates, we adjust these estimates, which would affect our net product revenue and earnings in the period such variances become known. Expected and actual product sales and quarterly and other results may greatly fluctuate, including in the near-term, and such fluctuations can adversely affect the price of our common stock, perceptions of our ability to forecast demand and revenues, and our ability to maintain and fund our operations.

Current wording

We expect that our revenues from sales of any of our products will continue to be based in part on estimates, judgment and accounting policies. Any incorrect estimates or disagreements with regulators or others regarding such estimates or accounting policies may result in changes to our guidance, projections or previously reported results. We make estimates for provisions for sales discounts, returns and allowances. Our estimates are based on available customer and payor data received from the specialty pharmacies and distributors, as well as third party market research data. In part, our estimates are dependent on our distribution channel and payor mix. If actual results in the future vary from our estimates, we adjust these estimates, which would affect our net product revenue and earnings in the period such variances become known. Expected and actual product sales and quarterly and other results may greatly fluctuate, including in the near-term, and such fluctuations can adversely affect the price of our common stock, perceptions of our ability to forecast demand and revenues, and our ability to maintain and fund our operations.

Previous wording

We do not and will not have access to all information regarding fostamatinib and product candidates we licensed to Lilly, Kissei, Grifols, Medison and Knight.

Current wording

We do not and will not have access to all information regarding our products and product candidates we licensed to our collaboration partners.

Previous wording

We do not and will not have access to all information regarding fostamatinib and other product candidates, including potentially material information about commercialization plans, medical information strategies, clinical trial design and execution, safety reports from clinical trials, safety reports, regulatory affairs, process development, manufacturing and other areas known by Lilly, Kissei, Grifols, Medison and Knight. In addition, we have confidentiality obligations under our respective agreements with Lilly, Kissei, Grifols, Medison and Knight. Thus, our ability to keep our shareholders informed about the status of fostamatinib and other product candidates will be limited by the degree to which Lilly, Kissei, Grifols, Medison and/or Knight keep us informed and allows us to disclose such information to the public. If Lilly, Kissei, Grifols, Medison and/or Knight fail to keep us informed about commercialization efforts related to fostamatinib, or the status of the clinical development or regulatory approval pathway of other product candidates licensed to them, we may make operational and/or investment decisions that we would not have made had we been fully informed, which may adversely affect our business and operations.

Current wording

We do not and will not have access to all information regarding our products and other product candidates, including potentially material information about commercialization plans, medical information strategies, clinical trial design and execution, safety reports from clinical trials, safety reports, regulatory affairs, process development, manufacturing and other areas known by our collaboration partners. In addition, we have confidentiality obligations under our respective agreements with our collaboration partners. Thus, our ability to keep our shareholders informed about the status of our products and other product candidates will be limited by the degree to which our collaboration partners keep us informed and allows us to disclose such information to the public. If our collaboration partners fail to keep us informed about commercialization efforts related to our products, or the status of the clinical development or regulatory approval pathway of other product candidates licensed to them, we may make operational and/or investment decisions that we would not have made had we been fully informed, which may adversely affect our business and operations.