Xeris Biopharma Holdings Inc

In addition to the information set forth in this report, you should carefully consider the risks discussed under the heading "Risk Factors" in our Annual Report on Form 10-K for the year ended December 31, 2023, which could have a material adverse effect on our business or consolidated financial statements, results of operations, and cash flows. Additional risks not currently known, or risks that are currently believed to be not material, may also impair business operations. The material changes to our risk factors since the filing of our Annual Report on Form 10-K for the year ended December 31, 2023, are presented below.

Risks Related to Ongoing Regulatory Obligations

Even after approval of our products and product candidates, we may still face future development and regulatory difficulties. If we fail to comply with continuing United States and non-United States regulations or new adverse safety data arise, we could lose our marketing approvals and our business would be seriously harmed.

Our approved products and product candidates, if approved, will also be subject to ongoing regulatory requirements for manufacturing, distribution, sale, labeling, packaging, storage, advertising, promotion, record-keeping and submission of safety and other post-market information. Approved products, third-party suppliers and their facilities are required to comply with extensive FDA requirements and requirements of other regulatory authorities even after approval, including ensuring that quality control and manufacturing procedures conform to CGMPs and applicable QSRs and applicable product tracking and tracing requirements. As such, we and our third-party suppliers are subject to continual review and periodic inspections, both announced and unannounced, to assess compliance with CGMPs and the QSR. Accordingly, we and our third-party suppliers must continue to expend time, money and effort in all areas of regulatory compliance, including manufacturing, production and quality control. We will also be required to report certain adverse events and production problems, if any, to the FDA and other regulatory authorities and to comply with certain requirements concerning advertising and promotion of our products. Promotional communications with respect to prescription drugs are subject to a variety of legal and regulatory restrictions and must be consistent with the information in the product's approved label. Accordingly, we may not promote our approved products for indications or uses for which they are not approved.

If a regulatory agency discovers previously unknown problems with a product, such as adverse events of unanticipated severity or frequency, or problems with the facility where the product is manufactured, or disagrees with the promotion, marketing or labeling of a product, it may impose restrictions on that product or us, including requiring withdrawal of the product from the market. These unknown problems could be discovered as a result of any post-marketing follow-up studies, routine safety surveillance or other reporting required as a condition to approval.

Regulatory agencies may also impose requirements for costly post-marketing studies or clinical trials and surveillance to monitor the safety or efficacy of a product. Additionally, under FDORA, sponsors of approved drugs and biologics must provide 6 months' notice to the FDA of any changes in marketing status, such as the withdrawal of a drug, and failure to do so could result in the FDA placing the product on a list of discontinued products, which would revoke the product's ability to be marketed. The FDA, the Federal Trade Commission and other agencies and government entities, including the Department of Justice ("DOJ") and the Office of Inspector General of the United States Department of Health and Human Services, closely regulate and monitor the post-approval marketing and promotion of products to ensure that they are manufactured, marketed and distributed only for the approved indications and in accordance with the provisions of the approved labeling. The FDA imposes stringent restrictions on manufacturers' communications regarding off-label use, and if we, or any future collaborators, do not market any of our products for which we, or they, receive marketing approval for only their approved indications, we, or they, may be subject to warning or enforcement action for off-label marketing, government investigations, or litigation. Violation of the FDCA and other statutes, including the False Claims Act, relating to the promotion and advertising of prescription drugs may lead to investigations or allegations of violations of federal and state healthcare fraud and abuse laws and state consumer protection laws. On June 7, 2023, we received an untitled letter from FDA's Office of Prescription Drug Promotion ("OPDP") regarding specific sections of the Recorlev consumer website. The letter raised concerns that the webpages made false or misleading claims about the safety and efficacy of Recorlev that misbrand Recorlev within the meaning of the FDCA. We submitted a response to the FDA regarding our plan to revise those sections of the webpages at issue. The FDA completed evaluation of our response and issued a close-out letter in August 2023 stating that it appears that we have addressed all the concerns contained in the untitled letter.

If our products or product candidates fail to comply with applicable regulatory requirements, or if a problem with one of our products or third-party suppliers is discovered, a regulatory agency may:

The FDA's and foreign regulatory agencies' policies are subject to change, and additional federal, state, local or non-United States governmental regulations may be enacted that could affect our ability to maintain compliance. We cannot predict the likelihood, nature or extent of adverse governmental regulation that may arise from future legislation or administrative action, either in the United States or abroad. Moreover, the U.S. Supreme Court's July 2024 decision to overturn prior established case law giving deference to regulatory agencies' interpretations of ambiguous statutory language has introduced uncertainty regarding the extent to which FDA's regulations, policies, and decisions may become subject to increasing legal challenges, delays, and/or changes.

Risk Related to Employment Matters

Our business could suffer if we lose the services of key members of our senior management or if we are not able to attract and retain other key employees and consultants.

We are dependent upon the continued services of key members of our executive management and a limited number of key advisors and personnel. In particular, we are highly dependent on the skills and leadership of our executive management team, including John Shannon, our Chief Executive Officer, Steven Pieper, our Chief Financial Officer, Kevin McCulloch, our President and Chief Operating Officer, Ken Johnson, our Senior Vice President, Global Development and Medical Affairs, and Beth Hecht, our Chief Legal Officer and Corporate Secretary. The loss of any one of these individuals could disrupt our operations or our strategic plans. Our industry has experienced a high rate of turnover of management personnel in recent years. Any of our personnel may terminate their employment at will. If we lose one or more of our executive officers or other key employees, our ability to implement our business strategy successfully could be seriously harmed. Furthermore, replacing executive officers or other key employees may be difficult and may take an extended period of time because of the limited number of individuals in our industry with the breadth of skills and experience required to develop, gain marketing approval of and commercialize products successfully.

Additionally, our future success will depend on, among other things, our ability to continue to hire and retain the necessary qualified scientific, technical, and managerial personnel, for whom we compete with numerous other companies, academic institutions, and organizations. Competition to hire from this limited pool is intense, and we may be unable to hire, train, retain or motivate these additional key employees on acceptable terms given the competition among numerous pharmaceutical and biotechnology companies for similar personnel. We also experience competition for the hiring of scientific and clinical personnel from universities and research institutions.

We rely on consultants and advisors, including scientific and clinical advisors, to assist us in formulating our research and development and commercialization strategy. Our consultants and advisors may be employed by other entities and may have commitments under consulting or advisory contracts with those entities that may limit their availability to us. If we are unable to continue to attract and retain highly qualified personnel, our ability to commercialize our products and to develop and commercialize our product candidates will be limited.

General Risk Factors

Our data collection and processing activities are governed by restrictive regulations governing the use, processing and, in certain jurisdictions, cross-border transfer of personal information.

We may be subject to the United States federal and state, European, UK and other foreign data protection laws and regulations (i.e., laws and regulations that address privacy and data security). We have personnel located in Ireland and have conducted and may in the future conduct clinical trials in the European Economic Area ("EEA") and/or the UK subjecting us to additional privacy restrictions and data protection requirements. The collection and use of personal data (including health data) in the EEA and the UK are governed by the provisions of the EU General Data Protection Regulation ("EU GDPR") as well as other national data protection legislation in force in relevant Member States, with respect to the EEA, and the UK General Data Protection Regulation (the "UK GDPR," together with the EU GDPR the "GDPR") and the UK Data Protection Act 2018 with respect to the UK. These laws impose a broad range of strict requirements on companies subject to the GDPR, such as including requirements relating to having legal bases for processing personal data relating to identifiable individuals and transferring such information outside the EEA or the UK, providing details to those individuals regarding the processing of their personal data, implementing safeguards to keep personal data secure, having data processing agreements with third parties who process personal data, providing information to individuals regarding data processing activities, responding to individuals' requests to exercise their rights in respect of their personal data, obtaining consent of the individuals to whom the personal data relates, reporting security and privacy breaches involving personal data to the competent national data protection authority and affected individuals, appointing data protection officers, conducting data protection impact assessments, and record-keeping. The GDPR may impose additional responsibility and liability in relation to personal data that we process and we may be required to put in place additional mechanisms ensuring compliance with the EEA and UK data protection regimes. This may be onerous and adversely affect our business, financial condition, results of operations and prospects.

The GDPR prohibits the international transfer of personal data to countries outside of the EEA or the UK ("third countries") which are not deemed as adequate for the transfers of personal data by competent authorities, unless a derogation exists or adequate safeguards (for example, the European Commission approved Standard Contractual Clauses ("EU SCCs") and the UK International Data Transfer Agreement/Addendum ("UK IDTA")) are implemented in compliance with EEA and UK data protection laws. Where relying on the EU SCCs or UK IDTA for data transfers, we may also be required to carry out transfer impact assessments on transfers made pursuant to the EU SCCs and the UK IDTA, on a case-by-case basis to ensure the law in the data importer's country and the data importer can ensure sufficient guarantees for safeguarding the personal data under GDPR. This assessment includes assessing whether third party vendors can also ensure these guarantees. The international transfer obligations under the EEA and UK data protection regimes will require significant effort and cost and may result in us needing to make strategic considerations around where EEA and UK personal data is located and which service providers we can utilize for the processing of EEA and UK personal data. Any inability to transfer personal data from the EEA and UK to the United States in compliance with data protection laws may impede our ability to conduct trials and may adversely affect our business and financial position.

The EU commission has adopted its adequacy decision for the EU-U.S. Data Privacy Framework ("Framework") agreed with the U.S., which entered into force on July 11, 2023. This Framework provides that the protection of personal data transferred between the EEA and the U.S. is comparable to that offered in the EEA. This Framework provides a further avenue to ensure transfers to the U.S. are carried out in line with GDPR. Where we rely on the Framework as a transfer mechanism for international transfers of personal data to the U.S., the Framework's validity could be challenged and the Framework subsequently invalidated as a mechanism for transferring personal data to the U.S. like its predecessor Privacy Shield and Safe Harbor frameworks.

Although the UK is regarded as a third country under the EU's GDPR, the European Commission has issued an adequacy decision recognizing the UK as providing adequate protection under the EU GDPR and, therefore, transfers of personal data originating in the EEA to the UK remain unrestricted. Likewise, the UK government has confirmed that personal data transfers from the UK to the EEA remain free flowing. The UK government has introduced a Data Protection and Digital Information Bill ("UK Bill") into the UK legislative process. The UK Bill failed in the UK legislative process but may be reintroduced at some point in the future. If a further bill is introduced, it may have the effect of further altering the similarities between the UK and EEA data protection regime and threaten the UK adequacy decision from the European Commission.

In addition, EEA Member States have adopted national laws to implement the EU GDPR that may partially deviate from the EU GDPR and competent authorities in the EEA Member States may interpret the EU GDPR obligations slightly differently from country to country. Therefore, we do not expect to operate in a uniform legal landscape in the EEA.

If we are investigated by a European or UK data protection authority, we may face fines and other penalties, including bans on processing and transferring personal data. EEA and UK data protection authorities have the power to impose administrative fines for violations of the GDPR of up to a maximum of €20 (£17.5 under the UK GDPR) million or 4% of our total worldwide global turnover for the preceding fiscal year, whichever is higher, and violations of the GDPR may also lead to damages claims by data controllers and data subjects. Such penalties are in addition to any civil litigation claims by data controllers, clients, and data subjects. As such, we will need to take steps to cause our processes to continue to be compliant with the applicable portions of the GDPR, but we cannot assure you that we will be able to implement changes in a timely manner or without significant disruption to our business, or that such steps will be effective, and we may face the risk of liability under the GDPR.

Many jurisdictions outside of Europe where we may do business or conduct trials in the future are also considering and/or have enacted comprehensive data protection legislation. In addition, we also continue to see jurisdictions imposing data localization laws. These and similar regulations may interfere with our intended business activities, inhibit our ability to expand into those markets, require modifications to our products or services or prohibit us from continuing to offer services or conduct trials in those markets without significant additional costs. In the US state laws govern the privacy and security of health information in some circumstances, many of which differ from each other in significant ways and often are not preempted by HIPAA, thus complicating compliance efforts. For example, in California, the California Consumer Protection Act, or CCPA, which went into effect on January 1, 2020, established a comprehensive privacy framework for covered businesses by creating an expanded definition of personal information, establishing new data privacy rights for consumers in the State of California, imposing special rules on the collection of consumer data from minors, and creating a new and potentially severe statutory damages framework for violations of the CCPA and for businesses that fail to implement reasonable security procedures and practices to prevent data breaches. While clinical trial data and information governed by HIPAA are currently exempt from the current version of the CCPA, other personal information may be applicable and possible changes to the CCPA may broaden its scope. In addition, a ballot initiative, the California Privacy Rights Act, or CPRA, was passed in November 2020 and as of January 1, 2023 has imposed additional obligations on companies covered by the legislation. The

CPRA significantly modified the CCPA, including by expanding consumers' rights with respect to certain sensitive personal information.

Similar laws have been passed and proposed in numerous other states. Such proposed legislation, if enacted, may add additional complexity, variation in requirements, restrictions and potential legal risk, require additional investment of resources in compliance programs, impact strategies and the availability of previously useful data and could result in increased compliance costs and/or changes in business practices and policies. The existence of comprehensive privacy laws in different states in the country would make our compliance obligations more complex and costly and may increase the likelihood that we may be subject to enforcement actions or otherwise incur liability for noncompliance. There are also states that are specifically regulating health information. For example, Washington state recently passed a health privacy law which, as of March 31, 2024, regulates the collection and sharing of health information. The Washington law also has a private right of action, which further increases the relevant compliance risk. Connecticut and Nevada have also passed similar laws regulating consumer health data. In addition, other states have proposed and/or passed legislation that regulates the privacy and/or security of certain specific types of information. For example, a small number of states have passed laws that regulate biometric data specifically. These various privacy and security laws may impact our business activities, including our identification of research subjects, relationships with business partners and ultimately the marketing and distribution of our products. State laws are changing rapidly and there is discussion in the U.S. Congress of a new comprehensive federal data privacy law to which we may likely become subject, if enacted.

Issues in the use of artificial intelligence, combined with an uncertain regulatory environment, may result in reputational harm, liability, or other adverse consequences to our business operations. As with many technological innovations, artificial intelligence presents risks and challenges that could impact our business. We or our vendors may incorporate generative artificial intelligence tools into their offerings without disclosing this use to us, and the providers of these generative artificial intelligence tools may not meet existing or rapidly evolving regulatory or industry standards with respect to privacy and data protection and may inhibit our or our vendors' ability to maintain an adequate level of service and experience. Additionally, we expect to see increasing government and supranational regulation related to artificial intelligence use and ethics, which may also significantly increase the burden and cost of research, development and compliance in this area. For example, the EU's Artificial Intelligence Act ("AI Act") — the world's first comprehensive AI law entered into force on August 1, 2024 and, with some exceptions, shall become effective 24 months thereafter. This legislation imposes significant obligations on providers and deployers of high risk artificial intelligence systems, and encourages providers and deployers of artificial intelligence systems to account for EU ethical principles in their development and use of these systems. If we develop or use AI systems that are governed by the AI Act, it may necessitate ensuring higher standards of data quality, transparency, and human oversight, as well as adhering to specific and potentially burdensome and costly ethical, accountability, and administrative requirements. If our vendors, or our third-party partners experience an actual or perceived breach or privacy or a cybersecurity incident because of the use of generative artificial intelligence, we may lose valuable intellectual property and confidential information and our reputation and the public perception of the effectiveness of our security measures could be harmed. Further, bad actors around the world use increasingly sophisticated methods, including the use of artificial intelligence, to engage in illegal activities involving the theft and misuse of personal information, confidential information, and intellectual property. Any of these outcomes could damage our reputation, result in the loss of valuable property and information, and adversely impact our business.