Xeris Biopharma Holdings Inc

Current report

Risks Related to Third-Parties Actions and Market Acceptance

Current report

Our reliance on third-party suppliers, including single-source suppliers, together with a limited number of possible suppliers and long development lead times to establish alternative sources for our products, product candidates, components and other key materials has in the past and may in the future impact our ability to develop our product candidates or to continue to commercialize Gvoke, Recorlev, Keveyis, or any product candidates that are approved.

Current report

We do not currently own or operate any manufacturing facilities for the production of Gvoke, Recorlev, or Keveyis for commercial supply or our product candidates for use in clinical trials. We rely on third-party suppliers to manufacture and supply our products and our product candidates. For Gvoke, we currently rely on a number of single-source suppliers, such as Bachem Americas, Inc. and certain of its affiliates ("Bachem") for active pharmaceutical ingredient ("API"), Pyramid Laboratories Inc. ("Pyramid") for drug product, and SHL Pharma, LLC ("SHL Pharma") for auto-injector and final product assembly, and we have entered into several supply agreements including with Bachem, Pyramid and SHL Pharma.

Current report

Taro produces all of our requirements for Keveyis pursuant to a supply agreement. If the agreement were to be terminated by Taro prior to the next renewal in March of 2027, we will need to find a new third party to manufacture Keveyis or manufacture the product ourselves. Similarly, for Recorlev, we rely on a number of single-source suppliers, such as Regis Technologies, Inc. for API and Xcelience, LLC ("Lonza") for finished drug product. In addition, we rely on other third parties to manufacture our product candidates for use in clinical trials. If any of these vendors are unable or unwilling to meet our future requirements, we may not be able to manufacture and/or supply our products in a timely manner.

Current report

Although we often have contracts with our third-party suppliers, our current arrangements with these manufacturers are terminable by such manufacturers, subject to certain notice provisions. In addition, Taro maintains certain reversion rights in the purchased assets, including the regulatory approval for Keveyis, enabling Taro to elect to have the purchased assets returned to it and to terminate its agreement with us should we be materially in non-compliance with any reversion condition such as breaching certain of the assignment restrictions or failing to meet our marketing commitments after receiving notice thereof and failing to cure such material non-compliance. In the event one of our third-party suppliers breaches, terminates or refuses to renew their agreement with us or otherwise refuses to supply us with product, product candidates, components or other key materials, we may be unable to find an adequate alternative vendor, or an affordable alternative or other acceptable solution in time and our product development and commercial activities could be harmed.

Current report

Our third-party suppliers may not be required to provide us with any guaranteed minimum production levels or have dedicated capacity for our products. As a result, we may not obtain sufficient quantities of products, product candidates, components or other key materials in the future, which could have a material adverse effect on our business as a whole. In addition, even if we have agreed with our third-party suppliers to receive certain quantities of products, product candidates, components or other key materials, our third-party suppliers have in the past and may in the future not produce sufficient inventory to meet commercial demand in a timely manner, or at all. We continue to experience long lead times for certain components and materials used in the production of our products and product candidates. In addition, we have experienced in the past and may experience in the future delays or supply constraints due to manufacturing defects by our third-party suppliers, a lack of raw materials supply and other risks that we have limited ability to prevent. A supply shortage or longer lead times for delivery than expected in the supply of products, product candidates, components or other key materials supplied to us by our third-party suppliers has in the past and could in the future impair our ability to generate revenues from the sale of our products. Growth in the costs and expenses of raw materials may also impair our ability to cost effectively manufacture our products.

Current report

Any disruption to the facilities or operations of our third-party suppliers resulting from weather-related events, epidemics, global health concerns, fire, acts of terrorism, political instability, war, labor or geopolitical issues, or any other cause could materially impair our ability to manufacture our products and to distribute our products to customers. We have a global supply chain and manufacture some components of our products outside the United States, including without limitation, in Taiwan and Israel. The current war between Israel and Hamas has in the past and could in the future directly and indirectly affect our operations. For example, the Israel-Hamas war could result in damage, destruction or disruptions to the facilities or operations of our third-party suppliers, including, but not limited to, our supplier of Keveyis, longer lead times for our products or product candidates, export delays or restrictions or other adverse events which adverse events we cannot predict with any certainty. Any interruption or other delay in the production or delivery of our supplies could reduce sales of our products and increase our costs and any negative impact of such matters on our third-party suppliers and manufacturers may also have an adverse impact on our results of operations or financial condition. In addition, further attacks by Hamas, Hezbollah or other groups on Israel could further impact our third-party supplier's operations in

Current report

Israel. Furthermore, a widening of the conflict in the Middle East or further escalation could lead to broader geopolitical destabilization and macro-economic impacts.

Current report

Gvoke and some of our product candidates are drug-device combination products that are regulated under the drug regulations of the Federal Food, Drug, & Cosmetic Act ("FDCA") based on their primary mode of action as a drug. Third-party manufacturers may fail to comply with the current Good Manufacturing Practice ("CGMP") regulatory requirements applicable to drug-device combination products, including applicable provisions of the FDA’s drug CGMP regulations, device CGMP requirements embodied in the Quality System Regulation (the "QSR") or similar regulatory requirements outside the United States. Our failure, or the failure of our third-party manufacturers, to comply with applicable regulations could result in sanctions being imposed on us, including clinical holds, fines, injunctions, civil penalties, delays, suspension or withdrawal of approvals, license revocation, seizures or recalls of our products and product candidates, re-labeling or re-packaging of our products, operating restrictions and criminal prosecutions, any of which could significantly affect the supply of our products and product candidates. The facilities used by our contract manufacturers to manufacture our products and product candidates must be registered with the FDA and are subject to inspections conducted by the FDA to ensure compliance with CGMPs. Other foreign regulatory authorities may also require manufacturers to register manufacturing facilities. We do not control the manufacturing process of, and are completely dependent on, our contract manufacturing partners for compliance with CGMPs and the QSR. Contract manufacturers have in the past and may in the future face manufacturing or quality control problems causing drug substance or device component production and shipment delays, supply shortages or circumstances where the contractor may not be able to maintain compliance with the applicable CGMP or the QSR. If our contract manufacturers cannot successfully manufacture material that conforms to our specifications, CGMP and/or the QSR and the strict regulatory requirements of the FDA or others, they will not be able to secure and/or maintain regulatory approval for their manufacturing facilities. In addition, we have no control over the ability of our contract manufacturers to maintain adequate quality control, quality assurance and qualified personnel. If the FDA or such foreign regulatory authorities do not approve these facilities for the manufacture of our products or product candidates or if they withdraw any such approval in the future, we may need to find alternative manufacturing facilities, which would significantly impact our ability to market our products or develop, obtain regulatory approval for or market our product candidates, if approved.

Current report

Further, as part of their manufacture of our products, product candidates, components and other key materials, our third-party suppliers are expected to comply with and respect the rights of others. From time to time, our third-party suppliers have in the past and may in the future not properly maintain or defend intellectual property rights that they license to us or act in such a way as to invite complaints and litigation that could jeopardize or invalidate our intellectual property or other rights or expose us to potential litigation. If a third-party supplier has failed or fails to maintain or acquire the proper licenses, otherwise infringes the proprietary rights of others or otherwise breaches an agreement with any of their partners in the course of providing services to us, we may have to find alternative third-party suppliers or defend against litigation claims, either of which would significantly impact our ability to develop, obtain or maintain regulatory approval for or commercialize our products and our product candidates, if approved. There are a limited number of third-party suppliers that are compliant with CGMP and/or the QSR, as required by the FDA, the EU, and other regulatory authorities, and that also have the necessary expertise and capacity to manufacture our materials and products. As a result, it may be difficult for us to locate third-party suppliers for our anticipated future needs, and our anticipated growth could strain the ability of our current third-party suppliers to deliver products, raw materials, and components to us. In addition, there is typically a transition period when a new third-party supplier commences work. Legislative proposals are pending that, if enacted, could negatively impact U.S. funding for certain biotechnology providers, including some of our vendors, that have relationships with certain foreign governments or which pose a threat to national security. The potential downstream adverse impacts on entities having only commercial relationships with any impacted biotechnology providers is unknown but may include supply chain disruptions or delays. If we are unable to arrange for third-party suppliers for our materials and products, or to do so on commercially reasonable terms, we may not be able to complete development of or market our products.

Current report

The introduction of new CGMP or QSR regulations or product specific requirements by a regulatory body may require that we source alternative materials, modify existing manufacturing processes, or implement design changes to our products that are subject to prior approval by the FDA or other regulatory authorities. We may also be required to reassess a third-party supplier’s compliance with all applicable new regulations and guidelines, which could further impede our ability to manufacture and supply products in a timely manner. As a result, we could incur increased production costs, experience supply interruptions, suffer damage to our reputation and experience an adverse effect on our business and financial results. For example, on January 31, 2024, the FDA issued a final rule which will be effective in 2026 to amend its Quality System Regulation (“QSR”) requirements to align more closely with the international consensus standards for medical devices. Specifically, the FDA amended the requirements primarily by incorporating by reference the 2016 edition of the International Organization of Standardization (“ISO”), ISO 13485 standard. While the ISO 13485 standard and the FDA’s QSR requirements are similar in certain aspects, we are evaluating whether we need to revise our compliance system and processes to be in line with the final rule. In addition, our reliance on third-party suppliers involves a number of additional risks, including, among other things:

Current report

In addition, we could be forced to secure new materials or develop alternative third-party suppliers, which can be difficult given our product complexity, long development lead-times and global regulatory review processes.

Current report

If any CMO with whom we contract fails to perform its obligations, we may be forced to enter into an agreement with a different CMO, which we may not be able to do on reasonable terms, if at all. In either scenario, our clinical trials or commercial distribution could be delayed significantly as we establish alternative supply sources. In some cases, the technical skills required to manufacture our products or product candidates may be unique or proprietary to the original CMO and we may have difficulty, or there may be contractual restrictions prohibiting us from, transferring such skills to a back-up or alternate supplier, or we may be unable to transfer such skills at all. In addition, if we are required to change CMOs for any reason, we will be required to verify that the new CMO maintains facilities and procedures that comply with quality standards and with all applicable regulations. We will also need to verify, such as through a manufacturing comparability study, that any new manufacturing process will produce our product according to the specifications previously submitted to or approved by the FDA or another regulatory authority. The delays associated with the verification of a new CMO could negatively affect our ability to develop product candidates or commercialize our products in a timely manner or within budget. Furthermore, a CMO may possess technology related to the manufacture of our product candidate that such CMO owns independently. This would increase our reliance on such CMO or require us to obtain a license from such CMO in order to have another CMO manufacture our products or product candidates which license we may not be able to obtain on favorable terms or at all. In addition, in the case of the CMOs that supply our products or product candidates, changes in manufacturers often involve changes in manufacturing procedures and processes, which could require that we conduct bridging studies between our prior clinical supply used in our clinical trials and that of any new manufacturer. We may be unsuccessful in demonstrating the comparability of clinical supplies which could require the conduct of additional clinical trials. Additionally, under the CARES Act, we must have in place a risk management plan that identifies and evaluates the risks to the supply of approved drugs for certain serious diseases or conditions for each establishment where the drug or API is manufactured. The risk management plan is subject to FDA review during an inspection. If we experience significant shortages in the supply of our marketed products, our results could be materially impacted.

Current report

We are party to a number of material agreements which contain complex commercial terms that could result in litigation or liability that could adversely affect our business, results of operations and financial condition.

Current report

We are currently party to various material agreements, including (i) collaboration and license agreements for the use of certain of our intellectual property by third parties, (ii) supply agreements for the supply of materials and components used in our products and product candidates, (iii) distribution agreements for the commercialization of our existing or future products by third parties, and (iv) transaction agreements. These agreements contain complex commercial terms, including:

Current report

From time to time, we have had and may in the future have informal dispute resolution discussions with third parties regarding the appropriate interpretation of the complex commercial terms contained in our agreements. One or more of these informal dispute resolution discussions may ultimately result in costly litigation, require us to make payments or incur liabilities, result in the unfavorable interpretation of contract terms and/or result in the inability for us to commercialize one or more of our products or manufacture one or more of our product candidates, which would have a material adverse impact on our business, results of operations or financial condition. In addition, many of the rights we have received related to our products or product candidates were received from parties who in turn received those rights from other parties to which we are not in privity of contract. Our counterparties have in the past and may in the future be subject to disputes that they have breached the terms of the agreements from which our rights are derived but to which we are not a party or act in such a way as to invite complaints and litigation that could jeopardize or invalidate our intellectual property or other rights or expose us to potential litigation. If one of our partners breached an agreement with any of their partners in the course of providing services or rights to us, we may have to defend against litigation claims, which would significantly impact our ability to develop, obtain or maintain regulatory approval for or commercialize our products and our product candidates, if approved.

Previous report

Risks Related to Ongoing Regulatory Obligations

Previous report

Even after approval of our products and product candidates, we may still face future development and regulatory difficulties. If we fail to comply with continuing United States and non-United States regulations or new adverse safety data arise, we could lose our marketing approvals and our business would be seriously harmed.

Previous report

Our approved products and product candidates, if approved, will also be subject to ongoing regulatory requirements for manufacturing, distribution, sale, labeling, packaging, storage, advertising, promotion, record-keeping and submission of safety and other post-market information. Approved products, third-party suppliers and their facilities are required to comply with extensive FDA requirements and requirements of other regulatory authorities even after approval, including ensuring that quality control and manufacturing procedures conform to CGMPs and applicable QSRs and applicable product tracking and tracing requirements. As such, we and our third-party suppliers are subject to continual review and periodic inspections, both announced and unannounced, to assess compliance with CGMPs and the QSR. Accordingly, we and our third-party suppliers must continue to expend time, money and effort in all areas of regulatory compliance, including manufacturing, production and quality control. We will also be required to report certain adverse events and production problems, if any, to the FDA and other regulatory authorities and to comply with certain requirements concerning advertising and promotion of our products. Promotional communications with respect to prescription drugs are subject to a variety of legal and regulatory restrictions and must be consistent with the information in the product's approved label. Accordingly, we may not promote our approved products for indications or uses for which they are not approved.

Previous report

If a regulatory agency discovers previously unknown problems with a product, such as adverse events of unanticipated severity or frequency, or problems with the facility where the product is manufactured, or disagrees with the promotion, marketing or labeling of a product, it may impose restrictions on that product or us, including requiring withdrawal of the product from the market. These unknown problems could be discovered as a result of any post-marketing follow-up studies, routine safety surveillance or other reporting required as a condition to approval.

Previous report

Regulatory agencies may also impose requirements for costly post-marketing studies or clinical trials and surveillance to monitor the safety or efficacy of a product. Additionally, under FDORA, sponsors of approved drugs and biologics must provide 6 months' notice to the FDA of any changes in marketing status, such as the withdrawal of a drug, and failure to do so could result in the FDA placing the product on a list of discontinued products, which would revoke the product's ability to be marketed. The FDA, the Federal Trade Commission and other agencies and government entities, including the Department of Justice ("DOJ") and the Office of Inspector General of the United States Department of Health and Human Services, closely regulate and monitor the post-approval marketing and promotion of products to ensure that they are manufactured, marketed and distributed only for the approved indications and in accordance with the provisions of the approved labeling. The FDA imposes stringent restrictions on manufacturers' communications regarding off-label use, and if we, or any future collaborators, do not market any of our products for which we, or they, receive marketing approval for only their approved indications, we, or they, may be subject to warning or enforcement action for off-label marketing, government investigations, or litigation. Violation of the FDCA and other statutes, including the False Claims Act, relating to the promotion and advertising of prescription drugs may lead to investigations or allegations of violations of federal and state healthcare fraud and abuse laws and state consumer protection laws. On June 7, 2023, we received an untitled letter from FDA's Office of Prescription Drug Promotion ("OPDP") regarding specific sections of the Recorlev consumer website. The letter raised concerns that the webpages made false or misleading claims about the safety and efficacy of Recorlev that misbrand Recorlev within the meaning of the FDCA. We submitted a response to the FDA regarding our plan to revise those sections of the webpages at issue. The FDA completed evaluation of our response and issued a close-out letter in August 2023 stating that it appears that we have addressed all the concerns contained in the untitled letter.

Previous report

If our products or product candidates fail to comply with applicable regulatory requirements, or if a problem with one of our products or third-party suppliers is discovered, a regulatory agency may:

Previous report

The FDA's and foreign regulatory agencies' policies are subject to change, and additional federal, state, local or non-United States governmental regulations may be enacted that could affect our ability to maintain compliance. We cannot predict the likelihood, nature or extent of adverse governmental regulation that may arise from future legislation or administrative action, either in the United States or abroad. Moreover, the U.S. Supreme Court's July 2024 decision to overturn prior established case law giving deference to regulatory agencies' interpretations of ambiguous statutory language has introduced uncertainty regarding the extent to which FDA's regulations, policies, and decisions may become subject to increasing legal challenges, delays, and/or changes.

Previous report

Risk Related to Employment Matters

Previous report

Our business could suffer if we lose the services of key members of our senior management or if we are not able to attract and retain other key employees and consultants.

Previous report

We are dependent upon the continued services of key members of our executive management and a limited number of key advisors and personnel. In particular, we are highly dependent on the skills and leadership of our executive management team, including John Shannon, our Chief Executive Officer, Steven Pieper, our Chief Financial Officer, Kevin McCulloch, our President and Chief Operating Officer, Ken Johnson, our Senior Vice President, Global Development and Medical Affairs, and Beth Hecht, our Chief Legal Officer and Corporate Secretary. The loss of any one of these individuals could disrupt our operations or our strategic plans. Our industry has experienced a high rate of turnover of management personnel in recent years. Any of our personnel may terminate their employment at will. If we lose one or more of our executive officers or other key employees, our ability to implement our business strategy successfully could be seriously harmed. Furthermore, replacing executive officers or other key employees may be difficult and may take an extended period of time because of the limited number of individuals in our industry with the breadth of skills and experience required to develop, gain marketing approval of and commercialize products successfully.

Previous report

Additionally, our future success will depend on, among other things, our ability to continue to hire and retain the necessary qualified scientific, technical, and managerial personnel, for whom we compete with numerous other companies, academic institutions, and organizations. Competition to hire from this limited pool is intense, and we may be unable to hire, train, retain or motivate these additional key employees on acceptable terms given the competition among numerous pharmaceutical and biotechnology companies for similar personnel. We also experience competition for the hiring of scientific and clinical personnel from universities and research institutions.

Previous report

We rely on consultants and advisors, including scientific and clinical advisors, to assist us in formulating our research and development and commercialization strategy. Our consultants and advisors may be employed by other entities and may have commitments under consulting or advisory contracts with those entities that may limit their availability to us. If we are unable to continue to attract and retain highly qualified personnel, our ability to commercialize our products and to develop and commercialize our product candidates will be limited.

Previous report

General Risk Factors

Previous report

Our data collection and processing activities are governed by restrictive regulations governing the use, processing and, in certain jurisdictions, cross-border transfer of personal information.

Previous report

We may be subject to the United States federal and state, European, UK and other foreign data protection laws and regulations (i.e., laws and regulations that address privacy and data security). We have personnel located in Ireland and have conducted and may in the future conduct clinical trials in the European Economic Area ("EEA") and/or the UK subjecting us to additional privacy restrictions and data protection requirements. The collection and use of personal data (including health data) in the EEA and the UK are governed by the provisions of the EU General Data Protection Regulation ("EU GDPR") as well as other national data protection legislation in force in relevant Member States, with respect to the EEA, and the UK General Data Protection Regulation (the "UK GDPR," together with the EU GDPR the "GDPR") and the UK Data Protection Act 2018 with respect to the UK. These laws impose a broad range of strict requirements on companies subject to the GDPR, such as including requirements relating to having legal bases for processing personal data relating to identifiable individuals and transferring such information outside the EEA or the UK, providing details to those individuals regarding the processing of their personal data, implementing safeguards to keep personal data secure, having data processing agreements with third parties who process personal data, providing information to individuals regarding data processing activities, responding to individuals' requests to exercise their rights in respect of their personal data, obtaining consent of the individuals to whom the personal data relates, reporting security and privacy breaches involving personal data to the competent national data protection authority and affected individuals, appointing data protection officers, conducting data protection impact assessments, and record-keeping. The GDPR may impose additional responsibility and liability in relation to personal data that we process and we may be required to put in place additional mechanisms ensuring compliance with the EEA and UK data protection regimes. This may be onerous and adversely affect our business, financial condition, results of operations and prospects.

Previous report

The GDPR prohibits the international transfer of personal data to countries outside of the EEA or the UK ("third countries") which are not deemed as adequate for the transfers of personal data by competent authorities, unless a derogation exists or adequate safeguards (for example, the European Commission approved Standard Contractual Clauses ("EU SCCs") and the UK International Data Transfer Agreement/Addendum ("UK IDTA")) are implemented in compliance with EEA and UK data protection laws. Where relying on the EU SCCs or UK IDTA for data transfers, we may also be required to carry out transfer impact assessments on transfers made pursuant to the EU SCCs and the UK IDTA, on a case-by-case basis to ensure the law in the data importer's country and the data importer can ensure sufficient guarantees for safeguarding the personal data under GDPR. This assessment includes assessing whether third party vendors can also ensure these guarantees. The international transfer obligations under the EEA and UK data protection regimes will require significant effort and cost and may result in us needing to make strategic considerations around where EEA and UK personal data is located and which service providers we can utilize for the processing of EEA and UK personal data. Any inability to transfer personal data from the EEA and UK to the United States in compliance with data protection laws may impede our ability to conduct trials and may adversely affect our business and financial position.

Previous report

The EU commission has adopted its adequacy decision for the EU-U.S. Data Privacy Framework ("Framework") agreed with the U.S., which entered into force on July 11, 2023. This Framework provides that the protection of personal data transferred between the EEA and the U.S. is comparable to that offered in the EEA. This Framework provides a further avenue to ensure transfers to the U.S. are carried out in line with GDPR. Where we rely on the Framework as a transfer mechanism for international transfers of personal data to the U.S., the Framework's validity could be challenged and the Framework subsequently invalidated as a mechanism for transferring personal data to the U.S. like its predecessor Privacy Shield and Safe Harbor frameworks.

Previous report

Although the UK is regarded as a third country under the EU's GDPR, the European Commission has issued an adequacy decision recognizing the UK as providing adequate protection under the EU GDPR and, therefore, transfers of personal data originating in the EEA to the UK remain unrestricted. Likewise, the UK government has confirmed that personal data transfers from the UK to the EEA remain free flowing. The UK government has introduced a Data Protection and Digital Information Bill ("UK Bill") into the UK legislative process. The UK Bill failed in the UK legislative process but may be reintroduced at some point in the future. If a further bill is introduced, it may have the effect of further altering the similarities between the UK and EEA data protection regime and threaten the UK adequacy decision from the European Commission.

Previous report

In addition, EEA Member States have adopted national laws to implement the EU GDPR that may partially deviate from the EU GDPR and competent authorities in the EEA Member States may interpret the EU GDPR obligations slightly differently from country to country. Therefore, we do not expect to operate in a uniform legal landscape in the EEA.

Previous report

If we are investigated by a European or UK data protection authority, we may face fines and other penalties, including bans on processing and transferring personal data. EEA and UK data protection authorities have the power to impose administrative fines for violations of the GDPR of up to a maximum of €20 (£17.5 under the UK GDPR) million or 4% of our total worldwide global turnover for the preceding fiscal year, whichever is higher, and violations of the GDPR may also lead to damages claims by data controllers and data subjects. Such penalties are in addition to any civil litigation claims by data controllers, clients, and data subjects. As such, we will need to take steps to cause our processes to continue to be compliant with the applicable portions of the GDPR, but we cannot assure you that we will be able to implement changes in a timely manner or without significant disruption to our business, or that such steps will be effective, and we may face the risk of liability under the GDPR.

Previous report

Many jurisdictions outside of Europe where we may do business or conduct trials in the future are also considering and/or have enacted comprehensive data protection legislation. In addition, we also continue to see jurisdictions imposing data localization laws. These and similar regulations may interfere with our intended business activities, inhibit our ability to expand into those markets, require modifications to our products or services or prohibit us from continuing to offer services or conduct trials in those markets without significant additional costs. In the US state laws govern the privacy and security of health information in some circumstances, many of which differ from each other in significant ways and often are not preempted by HIPAA, thus complicating compliance efforts. For example, in California, the California Consumer Protection Act, or CCPA, which went into effect on January 1, 2020, established a comprehensive privacy framework for covered businesses by creating an expanded definition of personal information, establishing new data privacy rights for consumers in the State of California, imposing special rules on the collection of consumer data from minors, and creating a new and potentially severe statutory damages framework for violations of the CCPA and for businesses that fail to implement reasonable security procedures and practices to prevent data breaches. While clinical trial data and information governed by HIPAA are currently exempt from the current version of the CCPA, other personal information may be applicable and possible changes to the CCPA may broaden its scope. In addition, a ballot initiative, the California Privacy Rights Act, or CPRA, was passed in November 2020 and as of January 1, 2023 has imposed additional obligations on companies covered by the legislation. The

Previous report

CPRA significantly modified the CCPA, including by expanding consumers' rights with respect to certain sensitive personal information.

Previous report

Similar laws have been passed and proposed in numerous other states. Such proposed legislation, if enacted, may add additional complexity, variation in requirements, restrictions and potential legal risk, require additional investment of resources in compliance programs, impact strategies and the availability of previously useful data and could result in increased compliance costs and/or changes in business practices and policies. The existence of comprehensive privacy laws in different states in the country would make our compliance obligations more complex and costly and may increase the likelihood that we may be subject to enforcement actions or otherwise incur liability for noncompliance. There are also states that are specifically regulating health information. For example, Washington state recently passed a health privacy law which, as of March 31, 2024, regulates the collection and sharing of health information. The Washington law also has a private right of action, which further increases the relevant compliance risk. Connecticut and Nevada have also passed similar laws regulating consumer health data. In addition, other states have proposed and/or passed legislation that regulates the privacy and/or security of certain specific types of information. For example, a small number of states have passed laws that regulate biometric data specifically. These various privacy and security laws may impact our business activities, including our identification of research subjects, relationships with business partners and ultimately the marketing and distribution of our products. State laws are changing rapidly and there is discussion in the U.S. Congress of a new comprehensive federal data privacy law to which we may likely become subject, if enacted.

Previous report

Issues in the use of artificial intelligence, combined with an uncertain regulatory environment, may result in reputational harm, liability, or other adverse consequences to our business operations. As with many technological innovations, artificial intelligence presents risks and challenges that could impact our business. We or our vendors may incorporate generative artificial intelligence tools into their offerings without disclosing this use to us, and the providers of these generative artificial intelligence tools may not meet existing or rapidly evolving regulatory or industry standards with respect to privacy and data protection and may inhibit our or our vendors' ability to maintain an adequate level of service and experience. Additionally, we expect to see increasing government and supranational regulation related to artificial intelligence use and ethics, which may also significantly increase the burden and cost of research, development and compliance in this area. For example, the EU's Artificial Intelligence Act ("AI Act") — the world's first comprehensive AI law entered into force on August 1, 2024 and, with some exceptions, shall become effective 24 months thereafter. This legislation imposes significant obligations on providers and deployers of high risk artificial intelligence systems, and encourages providers and deployers of artificial intelligence systems to account for EU ethical principles in their development and use of these systems. If we develop or use AI systems that are governed by the AI Act, it may necessitate ensuring higher standards of data quality, transparency, and human oversight, as well as adhering to specific and potentially burdensome and costly ethical, accountability, and administrative requirements. If our vendors, or our third-party partners experience an actual or perceived breach or privacy or a cybersecurity incident because of the use of generative artificial intelligence, we may lose valuable intellectual property and confidential information and our reputation and the public perception of the effectiveness of our security measures could be harmed. Further, bad actors around the world use increasingly sophisticated methods, including the use of artificial intelligence, to engage in illegal activities involving the theft and misuse of personal information, confidential information, and intellectual property. Any of these outcomes could damage our reputation, result in the loss of valuable property and information, and adversely impact our business.