Azenta (AZTA) Risk Analysis

Our success is dependent on our ability to respond to the technological changes present in the markets we serve. The success of our product development and introduction of products and services to market depends on our ability to: - identify and define new market opportunities, products and services in an accurate manner;- obtain market acceptance of our products and services;- innovate, develop, acquire and commercialize new technologies and applications in a timely and cost effective manner;- adjust to changing market conditions;- differentiate our offerings from our competitors' offerings;- obtain and maintain intellectual property rights where necessary;- continue to develop a comprehensive, integrated product and service strategy;- price our products and services appropriately; and - design our products to high standards of manufacturability so that they meet customer requirements. If we cannot succeed in responding in a timely and cost effective manner to technological and/or market changes or if the new products and services that we introduce do not achieve market acceptance, our competitive position would diminish which could materially harm our business and our prospects.

Our ability to compete is significantly affected by our ability to protect our intellectual property. We rely upon patents, trade secret laws, confidentiality agreements and procedures, copyrights, trademarks and licensing agreements to protect our technology. Existing trade secret, trademark and copyright laws offer only limited protection. Our success depends in part on our ability to obtain and enforce patent protection for our products and services both in the United States and in other countries. We own numerous U.S. and foreign patents, and we intend to file additional applications, as appropriate, for patents covering our products, services, and technology. Any issued patents owned by or licensed to us may be challenged, invalidated or circumvented, and the rights under these patents may not provide us with competitive advantages. In addition, the laws of some countries in which our products and services are or may be developed, manufactured, provided, or sold may not fully protect our products and services. Due to the rapid technological change that characterizes the life sciences and related process equipment industries, we believe that the improvement of existing technology, reliance upon trade secrets, unpatented proprietary know-how and the development of new products or services may be as important as patent protection in establishing and maintaining a competitive advantage. To protect trade secrets and know-how, it is our policy to require all technical and management personnel to enter into nondisclosure agreements. We cannot guarantee that the steps we have taken to protect our intellectual property will be adequate to prevent the misappropriation of our technology. Other companies could independently develop similar or superior technology without violating our intellectual property rights. In the future, it may be necessary to engage in litigation or like activities to enforce our intellectual property rights, to protect our trade secrets or to determine the validity and scope of proprietary rights of others, including our customers. This could require us to incur significant expenses and to divert the efforts and attention of our management and technical personnel from our business operations.

We are subject to domestic and international data protection laws and regulations that address privacy and data security and may affect our collection, use, storage, and transfer of personal information. The legislative and regulatory landscape for data protection continues to evolve, and in recent years there has been an increasing focus on privacy and data security issues with the potential to affect our business. In the U.S., numerous federal and state laws and regulations, including state data breach notification laws, state health information privacy laws and federal and state consumer protection laws govern the collection, use, disclosure and protection of health-related and other personal information. Failure to comply with data protection laws and regulations, where applicable, could result in government enforcement actions, which could include civil or criminal penalties, private litigation and/or adverse publicity and could negatively affect our operating results and business. For example, California has enacted the California Consumer Privacy Act, or CCPA, which went into effect in January of 2020. The CCPA gives California residents expanded rights to access and require deletion of their personal information, opt out of certain personal information sharing, and receive detailed information about how their personal information is used. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that may increase data breach litigation. Although the CCPA includes exemptions for certain categories of health information, the law may increase our compliance costs and potential liability with respect to other personal information we collect about California residents.  Additionally in 2020, California voters passed the California Privacy Rights Act, or the CPRA, which went into full effect on January 1, 2023. The CPRA significantly amended the CCPA, potentially resulting in further uncertainty, additional costs and expenses in an effort to comply and additional potential for harm and liability for failure to comply. Among other things, the CPRA established a new regulatory authority, the California Privacy Protection Agency, which is tasked with enacting new regulations under the CPRA and has expanded enforcement authority. In addition to California, more U.S. states are enacting similar legislation, increasing compliance complexity and increasing risks of failures to comply.  In 2023, comprehensive privacy laws in Virginia, Colorado, Connecticut, and Utah all took effect, and laws in Montana, Oregon, and Texas take effect during 2024. In addition, laws in other U.S. states are set to take effect beyond 2024, and additional U.S. states have proposals under consideration, all of which are likely to increase our regulatory compliance costs and risks, exposure to regulatory enforcement action, and other liabilities. Numerous other countries have, or are developing, laws governing the collection, use and transmission of personal information as well. For example, the European Parliament and the Council of the European Union adopted a comprehensive general data privacy framework called the General Data Protection Regulation ("GDPR") which took effect in May 2018 and governs the collection and use of personal data in the European Union, including by companies outside of the European Union. The GDPR, which is wide-ranging in scope, imposes several requirements relating to the consent of the individuals to whom the personal data relates, the information provided to the individuals, the security and confidentiality of the personal data, data breach notification, and the use of third-party processors in connection with the processing of the personal data. The GDPR also imposes strict rules on the transfer of personal data out of the European Union to the United States, enhances enforcement authority and imposes large penalties for noncompliance, including the potential for fines of up to €20 million or 4% of the annual global revenues of the infringer, whichever is greater.  The GDPR also confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies, and obtain compensation for damages resulting from violations of the GDPR. Compliance with the GDPR has been and will continue to be a rigorous and time-intensive process that has increased and will continue to increase our cost of doing business or require us to change our business practices, and despite those efforts, there is a risk that we may be subject to fines and penalties, litigation and reputational harm in connection with any European activities, which could adversely affect our business, prospects, financial condition and results of operations. Additionally, following the United Kingdom's withdrawal from the European Union (i.e., Brexit), and the expiry of the Brexit transition period, which ended on December 31, 2020, the GDPR has been implemented in the United Kingdom (as the UK GDPR). The UK GDPR sits alongside the UK Data Protection Act 2018 which implements certain derogations in the EU GDPR into UK law. Under the UK GDPR, companies not established in the UK but who process personal data in relation to the offering of goods or services to individuals in the UK, or to monitor their behavior will be subject to the UK GDPR – the requirements of which are (at this time) largely aligned with those under the EU GDPR and as such, may lead to similar compliance and operational costs with potential fines of up to £17.5 million or 4% of global turnover. Applicable data privacy and data protection laws may conflict with each other, and by complying with the laws or regulations of one jurisdiction, we may find that we are violating the laws or regulations of another jurisdiction. Despite our efforts, we may not have fully complied in the past and may not in the future. That could require us to incur significant expenses, which could significantly affect our business. Failure to comply with data protection laws may expose us to risk of enforcement actions taken by data protection authorities or other regulatory agencies, private rights of action in some jurisdictions, and potential significant penalties if we are found to be non-compliant. Furthermore, the number of government investigations related to data security incidents and privacy violations continue to increase and government investigations typically require significant resources and generate negative publicity, which could harm our business and reputation.

Unexpected events, including fires or explosions at our facilities, natural disasters, such as tornadoes, hurricanes and earthquakes, war or terrorist activities, unplanned power outages, supply disruptions and failure of equipment or systems, could adversely affect our reputation and results of operations. Our customers rely on us to securely store and timely retrieve and transport their critical samples, and these events could result in service disruptions, physical damage to one or more key storage facilities and the customer samples stored in those facilities, the temporary closure of one or more key operating facilities or the temporary disruption of service, each of which could negatively impact our reputation and results of operations. Our primary storage facility is located in Indianapolis, Indiana, an area of the United States that can be prone to tornadoes and other severe weather events.

Currency exchange rate fluctuations could have an adverse effect on our sales, cost of sales and results of operations, and we could experience losses with respect to forward exchange contracts into which we may enter. Unfavorable currency fluctuations could require us to increase prices for our products and services to customers, which could result in lower net sales. Alternatively, if we do not adjust the prices for our products and services in response to unfavorable currency fluctuations, our results of operations, including our margins, could be materially and adversely affected. In addition, most sales made by our foreign subsidiaries are denominated in the currency of the country in which these products are sold or these services are provided and the currency received in payment for such sales could be less valuable as compared to the U.S. dollar at the time of receipt as a result of exchange rate fluctuations. From time to time, we enter into forward exchange contracts and cross-currency swap agreements to reduce currency exposure. However, we cannot be certain that our efforts will be adequate to protect us against significant currency fluctuations or that such efforts will not expose us to additional exchange rate risks, which could materially and adversely affect our results of operations. As of September 30, 2024, we held approximately $124 million of cash and cash equivalents that is denominated in foreign currency, which represents a substantial portion of our current cash and cash equivalents balance. As a result of our significant foreign currency holdings, our financial results and capital ratios may be impacted by the movements in exchange rates, and a significant portion of our assets must be translated into U.S. dollars for external reporting purposes or converted into U.S. dollars to meet our strategic needs, and service obligations such as any future U.S. dollar-denominated indebtedness or dividends. We may seek to mitigate our exposure to currency exchange rate fluctuations, but our efforts may not be successful.

We currently obtain many of our key components on an as-needed, purchase order basis from numerous suppliers. In some cases, we have only a single source of supply for key components and materials used in the manufacturing of our products. Further, a portion of our supply is sourced from Asia, including China, and we do not always have a previous history of dealing with these suppliers. Our inability to obtain components or materials in required quantities or of acceptable cost and quality and with the necessary continuity of supply could result in delays or reductions in product shipments to our customers. In addition, if a supplier or sub-supplier suffers a production stoppage or delay for any reason, including natural disasters or health-related threats, this could result in a delay or reduction in our product shipments to our customers. Any of these contingencies could cause us to lose customers, result in delayed or lost revenue and otherwise materially harm our business.