RIGEL PHARMACEUTICALS INC

Previous wording

Apart from our discovery efforts, we continue to seek to broaden and diversify our product portfolio through acquisition or in-licensing of a product. This strategy is dependent on our ability to successfully identify and acquire or in-license relevant product candidates. In July 2022, we entered into a license and transition services agreement with Forma for an exclusive license to develop, manufacture and commercialize olutasidenib, a proprietary inhibitor of mIDH1, for any uses worldwide, including for the treatment of AML and other malignancies. On December 1, 2022, the FDA approved REZLIDHIA capsules for the treatment of adult patients with R/R AML with a susceptible IDH1 mutations as detected by an FDA-approved test. REZLIDHIA is our second commercial product and we believe is highly synergistic with our existing hematology-oncology focused commercial and medical affairs infrastructure. Further, in February 2024, we entered into an Asset Purchase Agreement with Blueprint topurchase certain assets comprising the right to research, develop, manufacture and commercialize GAVRETO, Blueprint’s proprietary RET inhibitor of tyrosine kinase for the treatment of metastatic RET fusion-positive NSCLC and advanced thyroid cancer, in the US. Simultaneously and in connection with entering into the Asset Purchase Agreement, we also entered into certain supporting agreements with Blueprint, including a customary transition agreement, pursuant to which, during a transition period, Blueprint will transition regulatory and distribution responsibility for pralsetinib to us. On June 24, 2024, we announced the completion of the transfer of GAVRETO NDA to us, and GAVRETO became commercially available from us in the US by prescription beginning on June 27, 2024. The in-licensing and acquisition of a product is a highly competitive area, and many other companies are pursuing the same or similar product candidates to those that we may consider attractive. In particular, larger companies with more well-established and diverse revenue streams may have a competitive advantage over us due to their size, financial resources and more extensive clinical development and commercialization capabilities. Furthermore, companies that perceive us to be a competitor may be unwilling to assign or license rights to us. The success of this strategy depends partly upon our ability to identify, select and acquire or in-license promising product candidates and technologies. The process of proposing, negotiating and implementing a license or acquisition of a product candidate is lengthy and complex, and we may be unable to in-license or acquire the rights to any such products, product candidates or technologies from third parties for several reasons. We may also be unable to in-license or acquire additional relevant product candidates on acceptable terms. Further, even if we identify

Current wording

Apart from our discovery efforts, we continue to seek to broaden and diversify our product portfolio through acquisition or in-licensing of a product. This strategy is dependent on our ability to successfully identify and acquire or in-license relevant product candidates. In July 2022, we entered into a license and transition services agreement with Forma for an exclusive license to develop, manufacture and commercialize olutasidenib, a proprietary inhibitor of mIDH1, for any uses worldwide, including for the treatment of AML and other malignancies. In December 2022, the FDA approved REZLIDHIA capsules for the treatment of adult patients with R/R AML with a susceptible IDH1 mutations as detected by an FDA-approved test. REZLIDHIA is our second commercial product and we believe is highly synergistic with our existing hematology-oncology focused commercial and medical affairs infrastructure. Further, in February 2024, we entered into an Asset Purchase Agreement with Blueprint topurchase certain assets comprising the right to research, develop, manufacture and commercialize GAVRETO, Blueprint’s proprietary RET inhibitor of tyrosine kinase for the treatment of metastatic RET fusion-positive NSCLC and advanced thyroid cancer, in the US. Simultaneously and in connection with entering into the Asset Purchase Agreement, we also entered into certain supporting agreements with Blueprint, including a customary transition agreement, pursuant to which, during a transition period, Blueprint will transition regulatory and distribution responsibility for pralsetinib to us. In June 2024, we announced the completion of the transfer of GAVRETO NDA to us, and GAVRETO became commercially available from us in the US by prescription. The in-licensing and acquisition of a product is a highly competitive area, and many other companies are pursuing the same or similar product candidates to those that we may consider attractive. In particular, larger companies with more well-established and diverse revenue streams may have a competitive advantage over us due to their size, financial resources and more extensive clinical development and commercialization capabilities. Furthermore, companies that perceive us to be a competitor may be unwilling to assign or license rights to us. The success of this strategy depends partly upon our ability to identify, select and acquire or in-license promising product candidates and technologies. The process of proposing, negotiating and implementing a license or acquisition of a product candidate is lengthy and complex, and we may be unable to in-license or acquire the rights to any such

Previous wording

acquisition or in-licensing targets, we may not be able to complete the transactions or we may determine after due diligence investigation not to pursue identified targets. Even if we succeed in our efforts to obtain rights to suitable product candidates, the success of our investments in these areas, our investment strategy will remain subject to the inherent risks associated with the development and commercialization of the product, and with the competitive business environment in which we operate.

Current wording

products, product candidates or technologies from third parties for several reasons. We may also be unable to in-license or acquire additional relevant product candidates on acceptable terms. Further, even if we identify acquisition or in-licensing targets, we may not be able to complete the transactions or we may determine after due diligence investigation not to pursue identified targets. Even if we succeed in our efforts to obtain rights to suitable product candidates, the success of our investments in these areas, our investment strategy will remain subject to the inherent risks associated with the development and commercialization of the product, and with the competitive business environment in which we operate.

Previous wording

Our compounds in clinical trials and our future leads for potential drug compounds are subject to the risks and failures inherent in the development of pharmaceutical products. These risks include, but are not limited to, the inherent difficulty in selecting the right drug and drug target and avoiding unwanted side effects, as well as unanticipated problems relating to product development, testing, enrollment, obtaining regulatory approvals, obtaining and maintaining reimbursement in national markets and positive recommendation from HTA bodies, maintaining regulatory compliance, manufacturing, competition and costs and expenses that may exceed current estimates. In future clinical trials, we, our partners or others may discover additional side effects and/or a higher frequency of side effects than those observed in previously completed clinical trials. The results of preliminary and mid-stage clinical trials do not necessarily predict clinical or commercial success, and larger later-stage clinical trials may fail to confirm the results observed in the previous clinical trials. Similarly, a clinical trial may show that a product candidate is safe and effective for certain patient populations in a particular indication, but other clinical trials may fail to confirm those results in a subset of that population or in a different patient population, which may limit the potential market for that product

Current wording

Our compounds in clinical trials and our future leads for potential drug compounds are subject to the risks and failures inherent in the development of pharmaceutical products. These risks include, but are not limited to, the inherent difficulty in selecting the right drug and drug target and avoiding unwanted side effects, as well as unanticipated problems relating to product development, testing, enrollment, obtaining regulatory approvals, obtaining and maintaining reimbursement in national markets and positive recommendation from HTA bodies, maintaining regulatory compliance, manufacturing, competition and costs and expenses that may exceed current estimates. In future clinical

Previous wording

candidate. For example, in October 2024, we issued a Dear Healthcare Provider Letter for GAVRETO related to a new safety signal identified in an ongoing Phase 3 clinical trial of pralsetinib in first-line treatment of RET fusion-positive, metastatic NSCLC patients, being conducted by Roche. With respect to our own compounds in development, we have established anticipated timelines with respect to the initiation of clinical trials based on existing knowledge of the compounds. However, we cannot provide assurance that we will meet any of these timelines for clinical development. Additionally, the initial results of a completed earlier clinical trial of a product candidate do not necessarily predict final results and the results may not be repeated in later clinical trials.

Current wording

trials, we, our partners or others may discover additional side effects and/or a higher frequency of side effects than those observed in previously completed clinical trials. The results of preliminary and mid-stage clinical trials do not necessarily predict clinical or commercial success, and larger later-stage clinical trials may fail to confirm the results observed in the previous clinical trials. Similarly, a clinical trial may show that a product candidate is safe and effective for certain patient populations in a particular indication, but other clinical trials may fail to confirm those results in a subset of that population or in a different patient population, which may limit the potential market for that product candidate. For example, in October 2024, we issued a Dear Healthcare Provider Letter for GAVRETO related to a new safety signal identified in an ongoing Phase 3 clinical trial of pralsetinib in first-line treatment of RET fusion-positive, metastatic NSCLC patients, being conducted by Roche. The letter advises healthcare providers to apply certain measures to protect patient safety, including enhanced ongoing monitoring for signs and symptoms of infection as well as guidance for withholding treatment to patients in the presence of active infection. With respect to our own compounds in development, we have established anticipated timelines with respect to the initiation of clinical trials based on existing knowledge of the compounds. However, we cannot provide assurance that we will meet any of these timelines for clinical development. Additionally, the initial results of a completed earlier clinical trial of a product candidate do not necessarily predict final results and the results may not be repeated in later clinical trials.

Previous wording

Because of the uncertainty of whether the accumulated preclinical evidence (PK, pharmacodynamic, safety and/or other factors) or early clinical results will be observed in later clinical trials, we can make no assurances regarding the likely results from our future clinical trials or the impact of those results on our business. For example, we conducted a Phase 3 pivotal trial of fostamatinib in patients with wAIHA initiated in March 2019 and completed in April 2022. In June 2022, we announced top-line efficacy and safety data results of the trial, and theresults did not demonstrate statistical significance in the primary efficacy endpoint of durable hemoglobin response in the overall study population. We conducted an in-depth analysis of these data to better understand differences in patient characteristics and outcomes and submitted these findings to the FDA. In October 2022, we announced that we received guidance from the FDA’s review of these findings. Based on the result of the trial and the guidance from the FDA, we did not file an sNDA for this indication. Further, we may experience errors in the analysis of our clinical trial results. For example, we conducted our Phase 3 clinical trial to evaluate safety and efficacy of fostamatinib in hospitalized COVID-19 patients launched in November 2020 and completed enrollment in July 2022. We previously announced in November 2022 the top-line results did not meet statistical significance in the primary efficacy endpoint. Upon further analysis, we discovered an error by the biostatistical CRO in the application of a statistical stratification factor. After correcting for this statistical error, the primary endpoint of the study was met. However, given the end of the federal COVID-19 PHE in May 2023, and based on feedback from the FDA, DOD and other advisors regarding the program’s regulatory requirements, costs, timeline and potential for success, we decided not to submit an Emergency Use Authorization (EUA) or sNDA.

Current wording

Because of the uncertainty of whether the accumulated preclinical evidence (pharmacokinetic, pharmacodynamic, safety and/or other factors) or early clinical results will be observed in later clinical trials, we can make no assurances regarding the likely results from our future clinical trials or the impact of those results on our business. For example, we conducted a Phase 3 pivotal trial of fostamatinib in patients with warm auto immune hemolytic anemia (wAIHA) initiated in March 2019 and completed in April 2022. In June 2022, we announced top-line efficacy and safety data results of the trial, and theresults did not demonstrate statistical significance in the primary efficacy endpoint of durable hemoglobin response in the overall study population. We conducted an in-depth analysis of these data to better understand differences in patient characteristics and outcomes and submitted these findings to the FDA. In October 2022, we announced that we received guidance from the FDA’s review of these findings. Based on the result of the trial and the guidance from the FDA, we did not file an sNDA for this indication. Further, we may experience errors in the analysis of our clinical trial results. For example, we conducted our Phase 3 clinical trial to evaluate safety and efficacy of fostamatinib in hospitalized COVID-19 patients launched in November 2020 and completed enrollment in July 2022. We previously announced in November 2022 the top-line results did not meet statistical significance in the primary efficacy endpoint. Upon further analysis, we discovered an error by the biostatistical contract research organization in the application of a statistical stratification factor. After correcting for this statistical error, the primary endpoint of the study was met. However, given the end of the federal COVID-19 PHE in May 2023, and based on feedback from the FDA, DOD and other advisors regarding the program’s regulatory requirements, costs, timeline and potential for success, we decided not to submit an Emergency Use Authorization (EUA) or sNDA.

Previous wording

misconduct, bribery kickbacks, self-dealing and other abusive or inappropriate practices. These laws and regulations may restrict or prohibit a wide range of pricing, discounting, marketing and promotion, including promoting off-label uses of our products, certain commission compensation, certain customer incentive programs, certain patient support offerings, and other business arrangements generally. Activities subject to these laws also involve the improper use or misrepresentation of information obtained in the course of patient recruitment for clinical trials, creating fraudulent data in our preclinical studies or clinical trials or illegal misappropriation of drug product, which could result in regulatory sanctions and cause serious harm to our reputation. See “Business – Government Regulation – Healthcare and Privacy Law and Regulation and Healthcare Reform” contained in Part I, Item 1 of our Annual Report on Form 10-K for the year ended December 31, 2023, for more information on the healthcare laws and regulations that may affect our ability to operate.

Current wording

Our business operations and current and future arrangements with investigators, healthcare professionals, consultants, third-party payors and customers, may expose us to broadly applicable federal, state and foreign fraud and abuse and other healthcare laws and regulations including anti-kickback and false claims laws, data privacy and security laws, and transparency reporting laws. These laws may constrain the business or financial arrangements and relationships through which we conduct our operations, including how we research, market, sell and distribute any product for which we have obtained regulatory approval, or for which we may obtain regulatory approval in the future. In particular, the promotion, sales and marketing of healthcare items and services, as well as certain business arrangements in the healthcare industry, are subject to extensive laws and regulations intended to prevent fraud, misconduct, bribery kickbacks, self-dealing and other abusive or inappropriate practices. These laws and regulations may restrict or prohibit a wide range of pricing, discounting, marketing and promotion, including promoting off-label uses of our products, certain commission compensation, certain customer incentive programs, certain patient support offerings, and other business arrangements generally. Activities subject to these laws also involve the improper use or misrepresentation of information obtained in the course of patient recruitment for clinical trials, creating fraudulent data in our preclinical studies or clinical trials or illegal misappropriation of drug product, which could result in regulatory sanctions and cause serious harm to our reputation. See “Business – Government Regulation – Healthcare and Privacy Law and Regulation and Healthcare Reform” contained in Part I, Item 1 of our Annual Report on Form 10-K for the year ended December 31, 2024, for more information on the healthcare laws and regulations that may affect our ability to operate.

Previous wording

We are subject to, or affected by, various federal, state and foreign laws, rules, directives, and regulations, as well as regulatory guidance, policies and contractual obligations relating to privacy and information security, governing the acquisition, collection, access, use, disclosure, processing, modification, retention, storage, transfer, destruction, protection, and security (collectively, “processing”) of personal information and other sensitive information about individuals. The global privacy and information security landscape is evolving rapidly, and implementation standards and enforcement practices are likely to continue to develop for the foreseeable future and may result in conflicting or inconsistent compliance obligations. Legislators and regulators are increasingly adopting or amending privacy and information security laws, rules, directives, and regulations that may create uncertainty in our business, affect our or our collaborators’, service providers’ and contractors’ ability to operate in certain jurisdictions or to process personal information, transfer data internationally, necessitate the acceptance of more onerous obligations in our contracts, result in enforcement actions, litigation or other liability or impose additional costs on us. The cost of compliance with these laws, regulations and standards is high and is likely to increase in the future. Any failure or perceived failure by us or our collaborators, service providers and contractors to comply with federal, state or foreign laws or regulations, our internal policies and procedures or our contracts governing the processing of personal information could result in negative

Current wording

We are subject to, or affected by, various federal, state and foreign laws, rules, directives, and regulations, as well as regulatory guidance, policies and contractual obligations relating to privacy and information security, governing the acquisition, collection, access, use, disclosure, processing, modification, retention, storage, transfer, destruction, protection, and security (collectively, “processing”) of personal information and other sensitive information about individuals. The global privacy and information security landscape is evolving rapidly, and implementation standards and enforcement practices are likely to continue to develop for the foreseeable future and may result in conflicting or inconsistent compliance obligations. Legislators and regulators are increasingly adopting or amending privacy and information security laws, rules, directives, and regulations that may create uncertainty in our business, affect our or our collaborators’, service providers’ and contractors’ ability to operate in certain jurisdictions or to process personal information, transfer data internationally, necessitate the acceptance of more onerous obligations in our contracts, result in enforcement actions, litigation or other liability or impose additional costs on us. The cost of compliance with these laws, regulations and standards is high and is likely to increase in the future. Any failure or perceived failure by us or our collaborators, service providers and contractors to comply with federal, state or foreign laws or regulations, our internal policies and procedures or our contracts governing the processing of personal information could result in negative publicity, diversion of management time and effort and proceedings against us by governmental entities or others. In many jurisdictions, enforcement actions, litigation, and other consequences for noncompliance with privacy and information security laws and regulations are rising. Compliance with applicable privacy and information security laws and regulations, as well as regulatory guidance, policies and contractual obligations, is a rigorous and time-intensive process, and we may be required to put in place additional mechanisms to ensure compliance with the new privacy and information security requirements. If we fail to comply with any such obligations, we may face significant investigations, fines, penalties and claims that could materially and adversely affect our business, financial condition, results of operations, ability to process personal information and income from certain business initiatives.

Previous wording

In the US, these obligations include various federal, state, and local statutes, rules, and regulations relating to privacy and data security. The Federal Trade Commission (FTC) has authority under Section 5 of the FTC Act to regulate unfair or deceptive or practices, and has used this authority to initiate enforcement actions against companies that implement inadequate controls around privacy and information security in violation of their externally facing policies. The FTC has recently brought several cases alleging violations of Section 5 of the FTC Act with respect to health information, and has proposed rulemaking on a variety of privacy and data security topics. The FTC published an advance notice of proposed rulemaking in 2022 on commercial surveillance and data security, and may propose regulation concerning the ways in which companies collect, aggregate, protect, use, analyze, and retain consumer data, as well as transfer, share, sell, or otherwise monetize that data in the coming years. The FTC also finalized changes to the Health Breach Notification Rule in April 2024. Moreover, the US federal government has also enacted statutes to address privacy and information security issues impacting particular industries or activities, including the following laws and regulations: the Electronic Communications Privacy Act, the Computer Fraud and Abuse Act, the Health Insurance Portability and Accountability Act (HIPAA), the Health Information Technology for Economic and Clinical Health Act, the Telephone Consumer Protection Act, the CAN-SPAM Act, and other laws and regulations, and continues to consider comprehensive federal privacy legislation.

Current wording

In the US, these obligations include various federal, state, and local statutes, rules, and regulations relating to privacy and data security. The Federal Trade Commission (FTC) has authority under Section 5 of the FTC Act to regulate unfair or deceptive or practices, and has used this authority to initiate enforcement actions against companies that implement inadequate controls around privacy and information security in violation of their externally facing policies. The FTC has brought several cases alleging violations of Section 5 of the FTC Act with respect to health information, and has proposed rulemaking on a variety of privacy and data security topics. Additionally, the FTC published an advance notice of proposed rulemaking in 2022 on commercial surveillance and data security, and may propose regulation concerning the ways in which companies collect, aggregate, protect, use, analyze, and retain consumer data, as well as transfer, share, sell, or otherwise monetize that data in the coming years. The FTC has also been active with respect to enforcement of its Health Breach Notification Rule and in scrutinizing the use and disclosure of sensitive personal information. The FTC finalized changes to the Health Breach Notification Rule in April 2024. Moreover, the US federal government has also enacted statutes to address privacy and information security issues impacting particular industries or activities, including the following laws and regulations, including, but not limited to: the Electronic Communications Privacy Act, the Computer Fraud and Abuse Act, the Health Insurance Portability and Accountability Act (HIPAA), the Health Information Technology for Economic and Clinical Health Act, the Telephone Consumer Protection Act, the CAN-SPAM Act, and other laws and regulations, and continues to consider comprehensive federal privacy legislation.

Previous wording

In addition, state legislatures have enacted statutes to address privacy and information security issues, including the California Consumer Privacy Act of 2018 (the CCPA). For example, the CCPA, as amended by the California Privacy Rights Act (CPRA), establishes a privacy framework applicable to for-profit entities that are doing business in California, including an expansive definition of personal information and data privacy rights for California residents (as consumers, business contacts and employees), and authorizes potentially severe statutory damages and creates a private right of action for certain data security breaches. The CCPA also requires businesses subject to the law to provide disclosures to California residents and to provide them with rights with respect to their personal information, including the right to opt out of the sale of such information. Moreover, the CPRA, among other things, impose requirements relating to data minimization and correction, and gives California residents additional rights over their personal information, including the right to opt-out of the use of their personal information in online behavioral advertising and to opt-out of certain types of consumer profiling. The CPRA also provides for penalties for CPRA violations concerning California residents under the age of 16, and establishes a new California Privacy Protection Agency to implement and enforce the law. Although there are limited exemptions for clinical trial and other research-related data under the CCPA, the CCPA could impact our business depending on how it will be interpreted by the new California Privacy Protection Agency. As we expand our operations, the CCPA may increase our compliance costs and potential liability.

Current wording

In addition, state legislatures have enacted statutes to address privacy and information security issues, including the California Consumer Privacy Act of 2018 (the CCPA). For example, the CCPA, as amended by the California Privacy Rights Act (CPRA), establishes a privacy framework applicable to for-profit entities that are doing business in California, including an expansive definition of personal information and data privacy rights for California residents (as consumers, business contacts and employees), and authorizes potentially severe statutory damages and creates a private right of action for certain data security breaches. The CCPA also requires businesses subject to the law to provide disclosures to California residents and to provide them with rights with respect to their personal information, including the right to opt out of the sale of such information. Moreover, the CPRA, among other things, imposes requirements

Previous wording

Multiple other states have followed California and enacted comprehensive privacy laws, or are considering similar legislation. While these new laws and proposals generally include exemptions for HIPAA-covered protected health information and clinical trial data, they add layers of complexity to compliance in the US market, and could increase our compliance costs and adversely affect our business. Moreover, some states have enacted laws specific to health data privacy, which may cause additional compliance costs such as the Washington My Health My Data Act and Nevada’s Consumer Health Data Privacy Law. States, such as Colorado, Utah and California, have passed or are considering legislation or regulation governing the development or use of artificial intelligence technologies, supplementing the existing consumer protection, FDA and other regulatory guidance that may apply to the use of AI technologies in our business, and which may impact our use of technology. Moreover, many states also have in place data security laws requiring companies to maintain certain safeguards with respect to the processing of personal information, and all states require companies to notify individuals or government regulators in the event of a data breach impacting such information.

Current wording

Multiple other states have followed California and enacted comprehensive privacy laws, or are considering similar legislation. While these new laws and proposals generally include exemptions for HIPAA-covered protected health information and clinical trial data, they add layers of complexity to compliance in the US market, and could increase our compliance costs and adversely affect our business. Moreover, some states have enacted laws specific to health data privacy, which may cause additional compliance costs such as the Washington My Health My Data Act and Nevada’s Consumer Health Data Privacy Law. For example, the Washington My Health My Data Act regulates “consumer health data” which is defined as “personal information that is linked or reasonably linkable to a consumer and that identifies a consumer’s past, present, or future physical or mental health.” However, the My Health My Data Act provides exemptions for personal data used or shared in research, including data subject to 45 C.F.R. Parts 46, 50, and 56. States, such as Colorado, Utah and California, have passed or are considering legislation or regulation governing the development or use of artificial intelligence technologies, supplementing the existing consumer protection, FDA and other regulatory guidance that may apply to the use of AI technologies in our business, and which may impact our use of technology. Moreover, many states also have in place data security laws requiring companies to maintain certain safeguards with respect to the processing of personal information, and all states require companies to notify individuals or government regulators in the event of a data breach impacting such information.

Previous wording

Internationally, our operations abroad may also be subject to increased scrutiny or attention from foreign data protection authorities. For example, our clinical trial programs and research collaborations outside the US may implicate foreign data protection laws, including those in the European Economic Area, Switzerland, and/or the UK (collectively, Europe). Many jurisdictions have established or are in the process of establishing privacy and data security legal frameworks with which we, our collaborators, service providers, including our CROs, and contractors must comply. For example, in the EU, the collection, use, disclosure, transfer and other processing of personal data (i.e., data which identifies an individual or from which an individual is identifiable) is governed by the EU General Data Protection Regulation 2016/679 (the EU GDPR), which came into direct effect in all EU Member States on and from May 25, 2018. The UK has implemented the EU GDPR as the UK GDPR which sits alongside the UK Data Protection Act 2018 (the UK GDPR, together with the EU GDPR, the GDPR). The GDPR has direct effect where an entity is established in the European Economic Area (EEA) or the UK (as applicable) and has extraterritorial effect, including where an entity established outside of the EEA or the UK processes personal data in relation to offering goods or services to individuals in the EEA and/or the UK or monitoring their behavior.

Current wording

Internationally, our operations abroad may also be subject to increased scrutiny or attention from foreign data protection authorities. For example, our clinical trial programs and research collaborations outside the US may implicate foreign data protection laws, including those in the European Economic Area, Switzerland, and/or the UK (collectively, Europe). Many jurisdictions have established or are in the process of establishing privacy and data security legal frameworks with which we, our collaborators, service providers, including our CROs, and contractors must comply. For example, in the EU, the collection, use, disclosure, transfer and other processing of personal data (i.e., data which identifies an individual or from which an individual is identifiable) is governed by the EU General Data Protection Regulation 2016/679 (the EU GDPR), which came into direct effect in all EU Member States on and from May 25, 2018. The UK has implemented the EU GDPR as the UK GDPR which sits alongside the UK Data Protection Act 2018 (the UK GDPR, and together with the EU GDPR, the GDPR). In October 2024, the UK government introduced to Parliament the Data (Use and Access) Bill (the DUA Bill) which is set to introduce reforms to the UK GDPR. The DUA Bill is currently progressing through the legislative process and is expected to be finalized during 2025. The GDPR has direct effect where an entity is established in the European Economic Area (EEA) or the UK (as applicable) and has extraterritorial effect, including where an entity established outside of the EEA or the UK processes personal data in relation to the offering of goods or services to individuals in the EEA and/or the UK or the monitoring of their behavior.

Previous wording

In addition, the EU GDPR prohibits the international transfer of personal data from the EEA to jurisdictions that the European Commission does not recognize as having ‘adequate’ data protection laws unless a data transfer mechanism has been put in place or a derogation under the EU GDPR can be relied on. In July 2020, the Court of Justice of the EU (CJEU) in its Schrems II judgement limited how organizations could lawfully transfer personal data from the EEA to the US by invalidating the EU-US Privacy Shield for purposes of international transfers and imposing further restrictions on the use of standard contractual clauses (EU SCCs), including a requirement for companies to carry out a transfer privacy impact assessment (TIAs). A TIA, among other things, assesses laws governing access to personal data in the recipient country and considers whether supplementary measures that provide privacy protections additional to those provided under EU SCCs will need to be implemented to ensure an ‘essentially equivalent’ level of data protection to that afforded in the EEA.

Current wording

In addition, the EU GDPR prohibits the international transfer of personal data from the EEA to jurisdictions that the European Commission does not recognize as having an ‘adequate’ level of data protection unless a data transfer mechanism has been put in place or a derogation under the EU GDPR can be relied on. In certain cases (e.g., where transfers are made in reliance on EU SCCs) a company must also carry out a so-called transfer privacy impact assessment (TIA). A TIA, among other things, assesses laws governing access to personal data in the recipient country and considers whether supplementary measures that provide privacy protections additional to those provided under EU SCCs will need to be implemented to ensure an ‘essentially equivalent’ level of data protection to that afforded in the EEA.

Previous wording

DPF. Entities relying on EU SCCs for transfers to the US. are also able to rely on the analysis in the Adequacy Decision as support for their TIA regarding the equivalence of US national security safeguards and redress. This may have implications for our cross-border data flows and has and may in the future result in increased compliance costs.

Current wording

On July 10, 2023, the European Commission adopted its Final Implementing Decision granting the US adequacy (Adequacy Decision) for EU-US transfers of personal data for entities self-certified to the EU-US Data Privacy Framework (DPF). Entities relying on EU SCCs for transfers to the US. are also able to rely on the analysis in the Adequacy Decision as support for their TIA regarding the equivalence of US national security safeguards and redress.

Previous wording

The UK GDPR also imposes similar restrictions on transfers of personal data from the UK to jurisdictions that the UK Government does not consider adequate, including the US. The UK Government has published its own form of the EU SCCs, known as the International Data Transfer Agreement and an International Data Transfer Addendum to the new EU SCCs. The UK Information Commissioner’s Office has also published its version of the TIA and guidance on international transfers, although entities may choose to adopt either the EU or UK style TIA. Further, on September 21, 2023, the UK Secretary of State for Science, Innovation and Technology established a UK-US data bridge (i.e., a UK adequacy decision) and adopted UK regulations to implement the UK-US data bridge (UK Adequacy Regulations). The UK Adequacy Regulations have now been passed in the UK Parliament, and personal data may be transferred from the UK under the UK-US data bridge through the UK extension to the DPF, from October 12, 2023, to organizations self-certified under the DPF.

Current wording

The UK GDPR also imposes similar restrictions on transfers of personal data from the UK to jurisdictions that the UK Government does not consider adequate, including the US. The UK Government has published its own form of the EU SCCs, known as the International Data Transfer Agreement and an International Data Transfer Addendum to the EU SCCs. The UK Information Commissioner’s Office (ICO) has also published its version of the TIA and guidance on international transfers, although entities may choose to adopt either the EU or UK style TIA. Further, on September 21, 2023, the UK Secretary of State for Science, Innovation and Technology established a UK-US data bridge (i.e., a UK adequacy decision) and adopted UK regulations to implement the UK-US data bridge (UK Adequacy Regulations). Personal data may be transferred from the UK under the UK-US data bridge through the UK extension to the DPF, from October 12, 2023, to organizations self-certified under the UK extension to the DPF.

Previous wording

The GDPR imposes fines for serious breaches of up to the higher of 4% of the organization’s annual worldwide turnover or €20 million (under the EU GDPR) or £17.5 million (under the UK GDPR). The GDPR identifies a list of points to consider when determining the level of fines for data supervisory authorities to impose (including the nature, gravity and duration of the infringement). Data subjects also have a right to compensation, as a result of an organization’s breach of the GDPR which has affected them, for financial or non-financial losses (e.g., distress).

Current wording

Data protection supervisory authorities have the power under the GDPR to (amongst other thing) impose fines for serious breaches of up to the higher of 4% of the organization’s annual worldwide turnover or €20 million (under the EU GDPR) or £17.5 million (under the UK GDPR). The GDPR identifies a list of points to consider when determining the level of fines for data supervisory authorities to impose (including the nature, gravity and duration of the infringement). Data subjects also have a right to compensation, as a result of an organization’s breach of the GDPR which has affected them, for financial or non-financial losses (e.g., distress).

Previous wording

In addition to data privacy requirements, cybersecurity requirements are laid down in various laws in the EU and the UK, the key ones being: (i) the GDPR (as discussed in detail above), which requires controllers and processors to implement appropriate technical and organizational measures to safeguard personal data to a level of security appropriate to the data protection risk; and (ii) the UK Network and Information Systems Regulation 2018 (NIS

Current wording

In addition to data privacy requirements, cybersecurity requirements are laid down in various laws in the EU and the UK, the key ones being: (i) the GDPR (as discussed above), which requires controllers and processors to implement appropriate technical and organizational measures to safeguard personal data to a level of security appropriate to the data protection risk; (ii) the UK Network and Information Systems Regulation 2018 (NIS Regulations), and (iii) the EU Network and Information Systems Security 2 Directive (NISD2).

Previous wording

The GDPR does not provide for a specific set of cybersecurity requirements or measures to be implemented, but rather requires a controller or processor to implement appropriate cyber and data security measures in accordance with the then-current risk, the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing. The GDPR however does explicitly require that controllers notify personal data breaches, within the meaning of the GDPR, without undue delay and in any event within 72 hours after becoming aware of it, to the relevant data protection supervisory authority, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals. In addition, controllers are required to notify the individuals concerned of any personal data breach, without undue delay, when the personal data breach is likely to result in a high risk to the rights and freedoms of individuals. Processors are required to notify the controller without undue delay after becoming aware of a personal data breach.

Current wording

The GDPR does not provide for a specific set of cybersecurity requirements or measures to be implemented, but rather requires a controller or processor to implement appropriate cyber and data security measures in accordance with the then-current risk, the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing. The GDPR however does explicitly require that controllers notify personal data breaches, within the meaning of the GDPR as described above.

Previous wording

In the UK, the NIS Regulations apply to ‘operators of essential services’ (OES) and ‘relevant digital service providers’ (RDSP) and following the UK General Election in July 2024, the new UK Government has announced it intends to introduce a Cyber Security and Resilience Bill to the UK Parliament. The NIS Regulations require that appropriate and proportionate technical and organizational measures are implemented to manage the risk of network and information systems, and impose requirements related to incident handling and notification in relation to incidents with significant disruptive effect. Under the NIS Regulations, the UK’s data protection supervisory authority, the Information Commissioner’s Office, may issue fines of up to £17 million and take other action following non-compliance.

Current wording

In the UK, the NIS Regulations apply to ‘operators of essential services’ (OES) and ‘relevant digital service providers’ (RDSP) and following the UK General Election in July 2024, the new UK Government has announced it intends to introduce a Cyber Security and Resilience Bill to the UK Parliament. The NIS Regulations require that appropriate and proportionate technical and organizational measures are implemented to manage the risk of network and information systems, and impose requirements related to incident handling and notification in relation to incidents with significant disruptive effect. Under the NIS Regulations, the ICO may issue fines of up to £17 million and take other action following non-compliance.

Previous wording

In the EU, more stringent cybersecurity and incident reporting requirements are imposed on ‘essential’ and ‘important’ entities, which include ICT managed service providers (MSP), cloud service providers as well as entities carrying out research and development activities of medicinal products, and certain specific medical device manufacturers. Our entities may be in scope of the NISD2 where they qualify as a MSP, cloud provider, R&D entity and/or medical device manufacturer within the meaning of NISD2 and offer those services in the EU.

Current wording

In the EU, the NISD2 (and the implementing laws at a national EU Member State level) impose stringent cybersecurity and incident reporting requirements on ‘essential’ and ‘important’ entities, which include ICT managed service providers (MSP), cloud service providers as well as entities carrying out research and development activities of medicinal products, and certain specific medical device manufacturers. Our entities may be in scope of the NISD2 where they qualify as a MSP, cloud provider, R&D entity and/or medical device manufacturer within the meaning of NISD2 and offer those services in the EU.

Previous wording

The NISD2 empowers the EU Member States to define all rules regarding penalties applicable to infringements, provided that they are effective, proportionate, and dissuasive. NISD2 states that any maximum fine which national implementing law provides for should at least be set at €10 million or 2% of total worldwide turnover, whichever is higher, where essential entities are concerned. Other sanctions may include (i) a temporary suspension to provide services in the EU (by suspending relevant authorizations/certifications); (ii) an order to make public certain elements of the infringement and/or inform customers; and (iii) injunctions to immediately cease infringing conduct. Importantly, NISD2 also provides that senior members of staff can be held personally liable, and face administrative fines or be temporarily suspended from exercising managerial functions at the legal representative or chief executive officer level.

Current wording

The NISD2 empowers the EU Member States to define all rules regarding penalties applicable to infringements, provided that they are effective, proportionate, and dissuasive. NISD2 states that any maximum fine which national implementing law provides for should at least be set at €10 million or 2% of total worldwide turnover, whichever is higher, where essential entities are concerned. Other sanctions may include (i) a temporary suspension to provide services in the EU (by suspending relevant authorizations/certifications); (ii) an order to make public certain elements of the infringement and/or inform customers; and (iii) injunctions to immediately cease infringing conduct. Importantly,

Previous wording

In addition, the EU Critical Entities Resilience Directive (CER) is aimed at strengthening the resilience of ‘critical infrastructure’ against specific threats including cyber incidents, natural hazards, terrorist attacks, insider threats, and sabotage. The scope of CER includes entities designated as ‘critical’ under CER and includes (among other things) the health sector and the manufacturers of medical devices as ‘essential services.’ The CER imposes cybersecurity and resilience requirements in particular in relation to incidents with so-called ‘significant disruptive effects’ – which are incidents that are able to significantly impact the continuation of the critical infrastructure service offering in the EU. Requirements include to: (i) identify relevant risks that may significantly disrupt the provision of essential services (i.e., pursuant to a risk assessment); (ii) take appropriate and proportionate technical, security and organizational measures to ensure resilience (i.e., based on the outcome of the risk assessment); and (iii) notify disruptive incidents to the competent authorities within 24 hours after becoming aware of an incident. The CER is enforceable on a national EU Member State level by the competent authorities, and allows EU Member States to set penalties as long as they are effective, proportionate, and dissuasive. Our entities may be in scope of the CER where they qualify as critical entities within the meaning of CER.

Current wording

In addition, the EU Critical Entities Resilience Directive (CER) is aimed at strengthening the resilience of ‘critical infrastructure’ against specific threats including cyber incidents, natural hazards, terrorist attacks, insider threats, and sabotage. The scope of CER includes entities designated as ‘critical’ under CER and includes (among other things) the health sector and the manufacturers of medical devices as ‘essential services.’ The CER imposes cybersecurity and resilience requirements in particular in relation to incidents with so-called ‘significant disruptive effects’ – which are incidents that are able to significantly impact the continuation of the critical infrastructure service offering in the EU. Requirements include to: (i) identify relevant risks that may significantly disrupt the provision of essential services (i.e., pursuant to a risk assessment); (ii) take appropriate and proportionate technical, security and organizational measures to ensure resilience (i.e., based on the outcome of the risk assessment); and (iii) notify disruptive incidents to the competent authorities within 24 hours after becoming aware of an incident. The CER is enforceable on a national EU Member State level by the competent authorities, and allows EU Member States to set penalties as long as they are effective, proportionate, and dissuasive. Our entities may be in scope of the CER where they qualify as critical entities within the meaning of CER. The CER has not to date been transposed by all EU Member States despite the deadline for doing so having passed.

Previous wording

In the EU, a number of new laws related to digital data and AI have also recently entered into force, are expected to enter into force in the foreseeable future, or have been proposed and are being considered. We are still assessing the scope of application, impact, and risk of these recent EU laws on our business, and will continue to assess this moving forward, including for example: (i) the EU’s Data Act– came into force as of December 13, 2023 which seeks to, among other things regulate the use of, and access to, data generated through connected (or Internet-of-Things)

Current wording

In the EU, a number of new laws related to digital data and AI have recently entered into force, are expected to enter into force in the foreseeable future, or have been proposed and are being considered. We are still assessing the scope of application, impact, and risk of these recent EU laws on our business, and will continue to assess this moving forward, including for example: (i) the EU’s Data Act, which – came into force on January 11, 2024 and which seeks to, among other things regulate the use of, and access to, data generated through connected (or Internet-of-Things) devices and introduces a new means for public sector bodies to access, use and re-use private sector data. EU Member State competent authorities are empowered to enforce the Data Act and determine the appropriate sanction provided penalties are “effective, proportionate and dissuasive”; and (ii) the European Health Data Space Regulation (EHDS), which was formally adopted on January 8, 2025 and is expected to enter into force during 2025 and which seeks to, among other things, provide individuals with more control over their electronic health data (EHD), enable cross-border sharing of EHD between national EU healthcare systems and facilitate the sharing of EHD for secondary research purposes.

Previous wording

The EU has also developed a standalone law to govern the offering and use of AI systems in the EU (the AI Act) which was published in the Official Journal of the European Union on July 12, 2024 and entered into force on August 1, 2024. The AI Act imposes regulatory requirements on AI system providers, deployers, importers, distributors, and users of AI systems, in accordance with the level of risk involved with the AI system (“unacceptable”, “high”, “limited”, and “minimal” risk). Unacceptable-risk AI systems are banned from being offered and used in the EU, and high-risk AI systems (which include AI used as part of medical devices in certain instances) are subject to a set of regulatory requirements under the AI Act including to establish quality and post-marketing monitoring and risk assessment systems, requirements related to the training of AI systems and training data, and requirements related to human oversight. Limited-risk AI systems are subject mainly to transparency requirements only and minimal-risk AI systems are not subject to obligations under the AI Act. General-purpose AI systems have also been made subject to a number of requirements – mostly akin to the requirements that apply to high-risk AI systems under the AI Act.

Current wording

The EU has developed a standalone law to govern the offering and use of AI systems in the EU (the “AI Act”) which entered into force on August 1, 2024 and will become applicable in a gradual manner between 2025-2027 depending on the requirement. The AI Act imposes regulatory requirements onto AI system providers, importers, distributors, and deployers, in accordance with the level of risk involved with the AI system (“unacceptable”, “high”, “limited”, and “minimal” risk). Unacceptable-risk AI systems are banned from being offered and used in the EU, and high-risk AI systems (which include AI used as part of medical devices in certain instances) are subject to a set of regulatory requirements under the AI Act including to establish quality and post-marketing monitoring and risk assessment systems, requirements related to the training of AI systems and training data, and requirements related to human oversight. Limited-risk AI systems are subject mainly to transparency requirements only and minimal-risk AI systems are not subject to obligations under the AI Act. General-purpose AI systems are subject to a number of requirements – mostly akin to the requirements that apply to high-risk AI systems under the AI Act.

Previous wording

The AI Act will enter into application (i.e., be enforceable) in a gradual manner – depending on the regulatory requirement in question, and ranging anywhere from 6 to 36 months following adoption. Non-compliance with the AI Act may be subject to regulatory fines of up to 7% of annual worldwide turnover. In parallel, the EU has proposed revisions to the EU Product Liability Directive and has introduced a new EU AI Liability Directive to facilitate claims for damages brought by EU users of AI systems.

Current wording

Non-compliance with the AI Act may be subject to regulatory fines of up to 7% of annual worldwide turnover. In parallel, on October 10, 2024, the EU adopted the EU Product Liability Directive to regulate non-contractual and non-fault based liability for defective products, including digital products and AI, and has introduced a new EU AI Liability Directive to facilitate claims for damages brought by EU users of AI systems.

Previous wording

Further, many jurisdictions impose mandatory clinical trial information obligations on sponsors. In the EU, such obligations arise under the Transparency Regulation No 1049/ 2001, EMA Policy 0043, EMA Policy 0070 and the Clinical Trials Regulation No 536/2014 (which the UK has not implemented, as the law entered into force following the UK’s exist from the EU), all of which impose on sponsors the obligation to make publicly available certain information stemming from clinical studies. In the EU, the transparency framework provides EU-based parties the right to submit an access to documents request to the EMA for information included in the MAA dossier for approved medicinal products. Only very limited information is exempted from disclosure, i.e., commercially confidential information (which is construed increasingly narrowly) and protected personal data. It is possible for competitors to access and use this data in their own research and development programs anywhere in the world, once this data is in the public domain.

Current wording

UK’s exit from the EU), all of which impose on sponsors the obligation to make publicly available certain information stemming from clinical studies. In the EU, the transparency framework provides EU-based parties the right to submit an access to documents request to the EMA for information included in the MAA dossier for approved medicinal products. Only very limited information is exempted from disclosure, i.e., commercially confidential information (which is construed increasingly narrowly) and protected personal data. It is possible for competitors to access and use this data in their own research and development programs anywhere in the world, once this data is in the public domain.

Previous wording

The biopharmaceutical industry is subject to extensive regulatory obligations and policies that are subject to change, including due to judicial challenges.*

Current wording

The biopharmaceutical industry is subject to extensive regulatory obligations and policies that may be subject to change, including due to judicial challenges, election cycles, and resulting regulatory updates and changes in policy priorities.

Previous wording

On June 28, 2024, the US Supreme Court issued an opinion holding that courts reviewing agency action pursuant to the Administrative Procedure Act “must exercise their independent judgment” and “may not defer to an agency interpretation of the law simply because a statute is ambiguous.” The decision will have a significant impact on how lower courts evaluate challenges to agency interpretations of law, including those by the FDA and other agencies with significant oversight of the biopharmaceutical industry. The new framework is likely to increase both the frequency of such challenges and their odds of success by eliminating one way in which the government previously prevailed in such cases. As a result, significant regulatory policies will be subject to increased litigation judicial scrutiny. Any resulting changes in regulation may result in unexpected delays, increased costs, or other negative impacts on our business that are difficult to predict.

Current wording

On June 28, 2024, the US Supreme Court issued an opinion holding that courts reviewing agency action pursuant to the Administrative Procedure Act “must exercise their independent judgment” and “may not defer to an agency interpretation of the law simply because a statute is ambiguous.” The decision will have a significant impact on how lower courts evaluate challenges to agency interpretations of law, including those by the FDA, DHHS, CMS and other agencies with significant oversight of the biopharmaceutical industry. The new framework is likely to increase both the frequency of such challenges and their odds of success by eliminating one way in which the government previously prevailed in such cases. As a result, significant regulatory policies will be subject to increased litigation and judicial scrutiny.

Previous wording

To help patients afford our products, we have a manufacturer-sponsored patient assistance program that helps financially needy patients in the US access our therapies. This type of program has become the subject of enforcement scrutiny in recent years. For example, some pharmaceutical manufacturers have been named in lawsuits challenging the legality of their patient assistance programs under a variety of federal and state laws. In addition, certain state and federal enforcement authorities continue to pursue investigations and enter into settlements related to manufacturers’ support of patient assistance programs, and members of Congress have also initiated inquiries on topics that include, for example, manufacturer-sponsored patient assistance programs, co-payment assistance programs, and manufacturer contributions to independent charitable patient assistance programs. Moreover, the DHHS, Office of the Inspector General continues to publish advisory opinions and other agency guidance on the topic of patient assistance, which reflects the government’s continued scrutiny of manufacturer sponsored or supported patient assistance programs. Numerous organizations, including pharmaceutical manufacturers, have been subject to ongoing litigation, enforcement activities and settlements related to their patient support programs and certain of these organizations have entered into, or have otherwise agreed to, significant civil settlements with applicable enforcement authorities. It is possible that future

Current wording

To help patients afford our products, we have a manufacturer-sponsored patient assistance program that helps financially needy patients in the US access our therapies. This type of program has become the subject of enforcement scrutiny in recent years. For example, some pharmaceutical manufacturers have been named in lawsuits challenging the legality of their patient assistance programs under a variety of federal and state laws. In addition, certain state and federal enforcement authorities continue to pursue investigations and enter into settlements related to manufacturers’ support of patient assistance programs, and members of Congress have also initiated inquiries on topics that include, for example, manufacturer-sponsored patient assistance programs, co-payment assistance programs, and manufacturer contributions to independent charitable patient assistance programs. Moreover, the DHHS, Office of the Inspector General continues

Previous wording

The FDCA requires that an applicant for approval of a generic form of a branded drug certify either that its generic product does not infringe any of the patents listed by the owner of the branded drug in the FDA’s Approved Drug Products with Therapeutic Equivalence Evaluations (referred to as the “Orange Book”) or that those patents are not enforceable. This process is known as a paragraph IV challenge. Upon notice of a paragraph IV challenge, a patent owner has 45 days to bring a patent infringement suit in federal district court against the company seeking ANDA approval of a product covered by one of the owner’s patents. If this type of suit is commenced, the FDCA provides a 30-month stay on the FDA’s approval of the competitor’s application. If the litigation is resolved in favor of the ANDA applicant or the challenged patent expires during the 30-month stay period, the stay is lifted, and the FDA may thereafter approve the application based on the standards for approval of ANDAs. Once an ANDA is approved by the FDA, the generic manufacturer may market and sell the generic form of the branded drug in competition with the branded medicine.

Current wording

The FDCA requires that an applicant for approval of a generic form of a branded drug certify either that its generic product does not infringe any of the patents listed by the owner of the branded drug in the FDA’s Orange Book or that those patents are not enforceable. This process is known as a paragraph IV challenge. Upon notice of a paragraph IV challenge, a patent owner has 45 days to bring a patent infringement suit in federal district court against the company seeking ANDA approval of a product covered by one of the owner’s patents. If this type of suit is commenced, the FDCA provides a 30-month stay on the FDA’s approval of the competitor’s application. If the litigation is resolved in favor of the ANDA applicant or the challenged patent expires during the 30-month stay period, the stay is lifted, and the FDA may thereafter approve the application based on the standards for approval of ANDAs. Once an ANDA is approved by the FDA, the generic manufacturer may market and sell the generic form of the branded drug in competition with the branded medicine.

Previous wording

In June 2022, we received a notice letter regarding an ANDA submitted to the FDA by Annora, requesting approval to market a generic version of TAVALISSE. The notice letter included a Paragraph IV certification with respect to our US Patent Nos. 7,449,458; 8,263,122; 8,652,492; 8,771,648 and 8,951,504, which are listed in the Orange Book. The notice letter asserts that these patents will not be infringed by Annora’s proposed product, are invalid and/or are unenforceable. Annora’s notice letter does not provide a Paragraph IV certification against our other patents listed in the Orange Book. On July 25, 2022, we filed a lawsuit in the US District Court for the District of New Jersey against Annora and its affiliates, Hetero Labs Ltd., and Hetero USA, Inc., for infringement of our US patents identified in Annora’s Paragraph IV certification. On September 21, 2022, Annora and its affiliates answered and counterclaimed for declaratory judgment of non-infringement and invalidity of the ’458, ’122, ’492, ’648, and ’504 patents. We filed an answer to Annora’s counterclaims on October 12, 2022. Annora served invalidity and non-infringement contentions on December 31, 2022. We filed an answer to Annora’s invalidity and non-infringement contentions in March 2023. Litigation continues, and no trial date is currently set. We intend to vigorously enforce and defend our intellectual property related to TAVALISSE. We cannot be assured that such lawsuit will prevent the introduction of a generic version of TAVALISSE for any particular length of time, or at all. If an ANDA from Annora or any other generic manufacturer is approved, and a generic version of TAVALISSE is introduced, whether following the expiration of our patents, the invalidation of our patents as a result of any litigation, or the determination that the proposed generic product does not infringe on our patents, our sales of TAVALISSE would be adversely affected. In addition, we cannot predict

Current wording

We intend to vigorously enforce and defend our intellectual property related to our products. We cannot be assured that we will prevent the introduction of a generic version of our product for any particular length of time, or at all. If an ANDA from generic manufacturers is approved, and generic versions of our products are introduced, whether following the expiration of our patents, the invalidation of our patents as a result of any litigation, or the determination that the proposed generic product does not infringe on our patents, our sales of our products would be adversely affected. In addition, we cannot predict what additional ANDAs could be filed by potential generic competitors requesting approval to market generic forms of our products, which would require us to incur significant additional expense and result in distraction for our management team, and if approved, result in significant decreases in the revenue derived

Previous wording

what additional ANDAs could be filed by Annora or other potential generic competitors requesting approval to market generic forms of our products, which would require us to incur significant additional expense and result in distraction for our management team, and if approved, result in significant decreases in the revenue derived from sales of our marketed products and thereby materially harm our business and financial condition.

Current wording

from sales of our marketed products and thereby materially harm our business and financial condition.

Previous wording

Pandemics may cause significant disruption in the supply chain for our commercial products. We rely on third parties to, among other things, manufacture and ship our commercial product, raw materials and product supply for our clinical trials, perform quality testing and supply other goods and services to help manage our commercial activities, our clinical trials and our operations in the ordinary course of business. While we have engaged actively with various

Current wording

Pandemics may cause significant disruption in the supply chain for our commercial products. We rely on third parties to, among other things, manufacture and ship our commercial product, raw materials and product supply for our

Previous wording

elements of our supply chain and distribution channel, including our customers, contract manufacturers, and logistics and transportation provider to meet demand for our products and to remain informed of any challenges within our supply chain, we may face disruptions to our supply chain and operations, and associated delays in the manufacturing and supply of our products. Such supply disruptions would adversely impact our ability to generate sales of and revenues from our products and our business, financial condition, results of operations and growth prospects could be adversely affected.

Current wording

clinical trials, perform quality testing and supply other goods and services to help manage our commercial activities, our clinical trials and our operations in the ordinary course of business. While we have engaged actively with various elements of our supply chain and distribution channel, including our customers, contract manufacturers, and logistics and transportation provider to meet demand for our products and to remain informed of any challenges within our supply chain, we may face disruptions to our supply chain and operations, and associated delays in the manufacturing and supply of our products. Such supply disruptions would adversely impact our ability to generate sales of and revenues from our products and our business, financial condition, results of operations and growth prospects could be adversely affected.

Previous wording

We participate in the Medicaid Drug Rebate Program, as administered by CMS, the 340B Drug Pricing Program, as administered by the Health Resources and Services Administration, and other federal and state government drug pricing programs in the US, and we may participate in additional government pricing programs in the future. These programs generally require us to pay rebates or otherwise provide discounts to government payors and/or required covered entities in connection with drugs that are dispensed to beneficiaries/recipients of these programs. In some cases, such as with the Medicaid Drug Rebate Program, the rebates are based on pricing metrics that we report on a monthly and quarterly basis to the government agencies that administer the programs. Pricing requirements and rebate/discount calculations are complex, vary among products and programs, and are often subject to interpretation by governmental or regulatory agencies and the courts. The requirements of these programs, including, by way of example, their respective terms and scope, change frequently. Most recently, in September 2024, CMS published a final rule that included significant revisions to certain Medicaid Drug Rebate Program provisions, including, but not limited to: (i) new definitions for key terms under the Medicaid Drug Rebate Program, such as “covered outpatient drug” and “market date”; (ii) revised processes for identifying drug misclassifications, as well as additional penalties that can be imposed against manufacturers in connection with such misclassifications; and (iii) a new 12-quarter time limit for manufacturers to initiate disputes, hearing requests, and audits for state-invoiced rebate amounts. Responding to current and future changes may increase our costs, and the complexity of compliance will be time consuming. Invoicing for rebates is provided in arrears, and there is frequently a time lag of up to several months between the sales to which rebate notices relate and our receipt of those notices, which further complicates our ability to accurately estimate and accrue for rebates

Current wording

We participate in the Medicaid Drug Rebate Program, as administered by CMS, the 340B Drug Pricing Program, as administered by the Health Resources and Services Administration, and other federal and state government drug pricing programs in the US, and we may participate in additional government pricing programs in the future. These programs generally require us to pay rebates or otherwise provide discounts to government payors and/or required covered entities in connection with drugs that are dispensed to beneficiaries/recipients of these programs. In some cases, such as with the Medicaid Drug Rebate Program, the rebates are based on pricing metrics that we report on a monthly and quarterly basis to the government agencies that administer the programs. Pricing requirements and rebate/discount calculations are complex, vary among products and programs, and are often subject to interpretation by governmental or regulatory agencies and the courts. The requirements of these programs, including, by way of example, their respective terms and scope, change frequently. For example, in September 2024, CMS published a final rule that included significant revisions to certain Medicaid Drug Rebate Program provisions, including, but not limited to: (i) new definitions for key terms under the Medicaid Drug Rebate Program, such as “covered outpatient drug” and “market date”; (ii) revised processes for identifying drug misclassifications, as well as additional penalties that can be imposed against manufacturers in connection with such misclassifications; and (iii) a new 12-quarter time limit for manufacturers to initiate disputes, hearing requests, and audits for state-invoiced rebate amounts. Responding to current and future

Previous wording

related to the Medicaid program as implemented by individual states. Thus, there can be no assurance that we will be able to identify all factors that may cause our discount and rebate payment obligations to vary from period to period, and our actual results may differ significantly from our estimated allowances for discounts and rebates. Changes in estimates and assumptions may have an adverse effect on our business, results of operations and financial condition.

Current wording

changes may increase our costs, and the complexity of compliance will be time consuming. Invoicing for rebates is provided in arrears, and there is frequently a time lag of up to several months between the sales to which rebate notices relate and our receipt of those notices, which further complicates our ability to accurately estimate and accrue for rebates related to the Medicaid program as implemented by individual states. Thus, there can be no assurance that we will be able to identify all factors that may cause our discount and rebate payment obligations to vary from period to period, and our actual results may differ significantly from our estimated allowances for discounts and rebates. Changes in estimates and assumptions may have an adverse effect on our business, results of operations and financial condition.

Previous wording

Finally, we may be affected by developments relating to the 340B Drug Pricing Program (340B Program). Recently, multiple manufacturers have implemented policies to reduce diversion and inappropriate claims for discounts and rebates by in-house and contract pharmacies affiliated with 340B-eligible entities. The DHHS sent several of these manufacturers’ letters claiming that the policies violate the 340B statute and referring the manufacturers for potential enforcement action. Manufacturers challenged these letters in federal court, and the US Court of Appeals for the Third Circuit and the District of Columbia Circuit have ruled in favor of several manufacturers, finding that the policies were consistent with the 340B statute. Multiple states have recently enacted laws that require manufacturers to ship 340B drugs to certain contract pharmacies and impose various civil and criminal penalties on manufacturers that do not comply. These laws have been challenged in federal court and many of the cases are pending. In March 2024, the US Court of Appeals for the Eight Circuit upheld the Arkansas law prohibiting drug makers for restricting 340B drug discounts for providers using contract pharmacies, and plaintiffs have filed a writ of certiorari with the Supreme Court, which is pending. DHHS also issued a final rule on procedures for the 340B program’s administrative dispute resolution process in April 2024. It is unclear how the other pending litigation, recent and proposed legislation, or future administrative action relating to the 340B program will impact our business.

Current wording

Finally, we may be affected by developments relating to the 340B Drug Pricing Program (340B Program). For example, since 2021, multiple manufacturers have implemented policies to reduce diversion and inappropriate claims for discounts by placing restrictions on 340B pricing for drugs dispensed through contract pharmacies. The DHHS sent several of these manufacturers’ letters claiming that the policies violate the 340B statute and referring the manufacturers for potential enforcement action. Manufacturers challenged these letters in federal court, and the US Court of Appeals for the Third Circuit and the District of Columbia Circuit have ruled in favor of several manufacturers, finding that the policies were consistent with the 340B statute. Multiple states have recently enacted laws that require manufacturers to ship 340B drugs to certain contract pharmacies and impose various civil and criminal penalties on manufacturers that do not comply. These laws have been challenged in federal court and many of the cases are pending. In March 2024, the US Court of Appeals for the Eight Circuit upheld the Arkansas law prohibiting drug makers for restricting 340B drug discounts for providers using contract pharmacies. DHHS also issued a final rule on procedures for the 340B Program’s administrative dispute resolution process in April 2024. It is unclear how the other pending litigation, proposed legislation, or future administrative action relating to the 340B Program will impact our business.

Previous wording

Our distribution operations for the sale of our products are currently concentrated in two distribution centers owned by a third-party logistics provider. Additionally, our distribution operations, if and when we launch any of our product candidates in the future, may also be concentrated in such distribution centers owned by a third-party logistics provider. Any errors in inventory level management and unforeseen inventory shortage could adversely affect our business. In addition, any significant disruption in the operation of the facility due to natural disaster or severe weather, or events such as fire, accidents, power outages, system failures, or other unforeseen causes, could devalue or damage a significant portion of our inventories and could adversely affect our product distribution and sales until such time as we could secure an alternative facility. Further, climate change may increase both the frequency and severity of extreme weather conditions and natural disasters, which may affect our business operations. If we encounter difficulties with any of our distribution facilities, whether due to the potential future impacts of a global pandemic (including as a result of disruptions of global shipping and the transport of products) or otherwise, or other problems or disasters arise, we cannot ensure that critical systems and operations will be restored in a timely manner or at all, and this would have an adverse effect on our business. In addition, growth could require us to further expand our current facility, which could affect us adversely in ways that we cannot predict.

Current wording

Our distribution operations for the sale of our products are currently concentrated in two distribution centers owned by a third-party logistics provider. Additionally, our distribution operations, if and when we launch any of our product candidates in the future, may also be concentrated in such distribution centers owned by a third-party logistics provider. Any errors in inventory level management and unforeseen inventory shortage could adversely affect our business. In addition, any significant disruption in the operation of the facility due to natural disaster or severe weather, or events such as fire, accidents, power outages, system failures, or other unforeseen causes, could devalue or damage a significant portion of our inventories and could adversely affect our product distribution and sales until such time as we could secure an alternative facility. Further, climate change may increase both the frequency and severity of extreme weather conditions and natural disasters, which may affect our business operations. If we encounter difficulties with any of our distribution facilities, whether due to the potential future impacts of a global pandemic (including as a result of disruptions of global shipping and the transport of products) or otherwise, or other problems or disasters arise, we cannot ensure that critical systems and operations will be restored in a timely manner or at all, and this would have an adverse

Previous wording

We do not and will not have access to all information regarding our product and other product candidates, including potentially material information about commercialization plans, medical information strategies, clinical trial design and execution, safety reports from clinical trials, safety reports, regulatory affairs, process development, manufacturing and other areas known by our collaboration partners. In addition, we have confidentiality obligations under our respective agreements with our collaboration partners. Thus, our ability to keep our shareholders informed about the status of our products and other product candidates will be limited by the degree to which our collaboration partners keep us informed and allows us to disclose such information to the public. If our collaboration partners fail to keep us informed about commercialization efforts related to our products, or the status of the clinical development or regulatory approval pathway of other product candidates licensed to them, we may make operational and/or investment decisions that we would not have made had we been fully informed, which may adversely affect our business and operations.

Current wording

We do not and will not have access to all information regarding our products and other product candidates, including potentially material information about commercialization plans, medical information strategies, clinical trial design and execution, safety reports from clinical trials, safety reports, regulatory affairs, process development, manufacturing and other areas known by our collaboration partners. In addition, we have confidentiality obligations under our respective agreements with our collaboration partners. Thus, our ability to keep our shareholders informed about the status of our products and other product candidates will be limited by the degree to which our collaboration partners keep us informed and allows us to disclose such information to the public. If our collaboration partners fail to

Previous wording

For the nine months ended September 30, 2024, we recognized income from operations of $7.5 million primarily due to higher net product sales and collaboration revenues, partially offset by our operating expenses. Historically, we have incurred losses from operations each year since we were incorporated in June 1996 other than in fiscal year 2010, due in large part to the significant research and development expenditures and costs of our ongoing commercial efforts. Although we recognized income from operations for the current period, there can be no assurance that we will generate annual operating income in the foreseeable future. Currently, our potential sources of revenues include sales of our products, and upfront payments as well as milestone and royalty payments pursuant to our collaboration arrangements, all of which may never materialize if sales of our products decline or if our collaboration partners do not achieve certain events or generate net sales to which these contingent payments are dependent on. If our future drug candidates fail or do not gain regulatory approval, or if our drugs do not achieve sustainable market acceptance, we may not be profitable. As of September 30, 2024, we had an accumulated deficit of approximately $1.4 billion. The extent of our future losses or profitability, if any, is highly uncertain.

Current wording

than in fiscal year 2010, due in large part to the significant research and development expenditures and costs of our ongoing commercial efforts. Although we recognized income from operations in 2024 and in the current period, there can be no assurance that we will generate annual operating income in the foreseeable future. Currently, our potential sources of revenues include sales of our products, as well as upfront, milestones and royalty payments pursuant to our collaboration arrangements, all of which may never materialize if sales of our products decline or if our collaboration partners do not achieve certain events or generate net sales to which these contingent payments are dependent on. If our future drug candidates fail or do not gain regulatory approval, or if our drugs do not achieve sustainable market acceptance, we may not be profitable. As of March 31, 2025, we had an accumulated deficit of approximately $1.4 billion. The extent of our future losses or profitability, if any, is highly uncertain.

Previous wording

If conflicts arise between us and our corporate collaborators or scientific advisors, the other party may act in its self-interest and not in the interest of our stockholders. Some of our corporate collaborators are conducting multiple product development efforts within each disease area that is the subject of the collaboration with us or may be acquired or merged with a company having a competing program. In some of our collaborations, we have agreed not to conduct,

Current wording

If conflicts arise between us and our corporate collaborators or scientific advisors, the other party may act in its self-interest and not in the interest of our stockholders. Some of our corporate collaborators are conducting multiple product development efforts within each disease area that is the subject of the collaboration with us or may be acquired or merged with a company having a competing program. In some of our collaborations, we have agreed not to conduct, independently or with any third party, any research that is competitive with the research conducted under our collaborations. Our collaborators, however, may develop, either alone or with others, products in related fields that are competitive with the products or potential products that are the subject of these collaborations. Competing products, either developed by our collaborators or to which our collaborators have rights, may result in their withdrawal of support for our product candidates.