BioMarin Pharmaceutical (BMRN) Risk Analysis

In the ordinary course of business, we collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, process) personal data and other sensitive information, including proprietary and confidential business data, trade secrets, intellectual property, data we collect about trial participants in connection with clinical trials, sensitive third-party data, business plans, transactions, financial information and medical information collected by our patient access management team (collectively, sensitive data). Our data processing activities subject us to certain data privacy and security obligations, such as various laws, regulations, guidance, industry standards, external and internal privacy and security policies, contractual requirements, and other obligations relating to data privacy and security. In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws). For example, HIPAA, as amended by HITECH, imposes specific requirements relating to the privacy, security, and transmission of individually identifiable health information. Additionally, numerous U.S. states have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights may include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the CCPA applies to personal data of consumers, business representatives, and employees who are California residents and requires businesses to provide specific disclosures in privacy notices and honor requests of California residents to exercise certain privacy rights. The CCPA provides for fines for intentional violations and allows private litigants affected by certain data breaches to recover significant statutory damages. Although some U.S. comprehensive privacy laws exempt some data processed in the context of clinical trials, these laws may increase compliance costs and potential liability with respect to other personal data we may maintain about California residents. Similar laws are being considered in several other states, as well as at the federal and local levels, and we expect more jurisdictions to pass similar laws in the future. Outside the United States, an increasing number of laws, regulations, and industry standards may govern data privacy and security. For example, the European Union's General Data Protection Regulation (EU GDPR), United Kingdom's GDPR (UK GDPR) (collectively, the GDPR), Brazil's General Data Protection Law (Lei Geral de Proteção de Dados Pessoais, or LGPD) (Law No. 13,709/2018), and China's Personal Information Protection Law (PIPL) impose strict requirements for processing personal data. For example, under the GDPR, companies may face temporary or definitive bans on data processing and other corrective actions; fines of up to 20 million Euros under the EU GDPR / 17.5 million pounds sterling under the UK GDPR or 4% of annual global revenue, whichever is greater; or private litigation related to processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests. In addition, we may be unable to transfer personal data from Europe and other jurisdictions to the United States or other countries due to data localization requirements or limitations on cross-border data flows. Europe and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal data to other countries. In particular, the European Economic Area (EEA) and the UK have significantly restricted the transfer of personal data to the United States and other countries whose privacy laws it believes are inadequate. Other jurisdictions have adopted may adopt similarly stringent data localization and cross-border data transfer laws. Although there are currently various mechanisms that may be used to transfer personal data from the EEA and UK to the United States in compliance with law, such as the EEA standard contractual clauses, the UK's International Data Transfer Agreement / Addendum, and the EU-U.S. Data Privacy Framework and the UK extension thereto (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the Framework), these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the United States. If there is no lawful manner for us to transfer personal data from the EEA, the UK, or other jurisdictions to the United States, or if the requirements for a legally-compliant transfer are too onerous, we could face significant adverse consequences, including by limiting our ability to conduct clinical trial activities in Europe and elsewhere, the interruption or degradation of our operations, the need to relocate part of or all of our business or data processing activities to other jurisdictions (such as Europe) at significant expense, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors and other third parties, and injunctions against our processing or transferring of personal data necessary to operate our business. Some European regulators have ordered certain companies to suspend or permanently cease certain transfers of personal data to recipients outside Europe for allegedly violating the GDPR's cross-border data transfer limitations. Additionally, companies that transfer personal data to recipients outside of the EEA and/or UK to other jurisdictions, particularly to the United States, are subject to increased scrutiny from regulators individual litigants and activist groups. Additionally, the U.S. Department of Justice issued a rule entitled the Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons, which places additional restriction on certain data transactions involving countries of concern (e.g., China, Russia, Iran) and covered persons that may impact certain business activities such as vendor engagements, sale or sharing of data, employment of certain individuals, and investor agreements. Violations of the rule could lead to significant civil and criminal fines and penalties. The rule applies regardless of whether data is anonymized, key-coded, pseudonymized, de-identified or encrypted, which presents particular challenges for companies like ours and may impact our ability to transfer data in connection with certain transactions or agreements. We are subject to new laws governing the privacy of consumer health data, including reproductive, sexual orientation, and gender identity privacy rights that provide consumers certain rights with respect to their health data and create a private right of action to allow individuals to sue for violations. Our employees and personnel, as well as third parties with whom we work, use, or may in the future use, generative AI technologies to perform their work, and the disclosure and use of personal data in generative AI technologies is subject to various privacy laws and other privacy obligations. Governments have passed and are likely to pass additional laws regulating generative AI. Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and lawsuits. If these factors limit or otherwise impair our effective use of generative AI, it could make our business less efficient and result in competitive disadvantages. In addition to data privacy and security laws, we are contractually subject to industry standards adopted by industry groups and may become subject to additional such obligations in the future. We are also bound by other contractual obligations related to data privacy and security, and our efforts to comply with such obligations may not be successful. We publish privacy policies, marketing materials, and other statements, such as statements related to compliance with certain certifications or self-regulatory principles, regarding data privacy and security. Regulators across the world are increasingly scrutinizing these statements, and if these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, misleading, or misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators, or other adverse consequences. Obligations related to data privacy and security (and consumers' data privacy expectations) are quickly changing, becoming increasingly stringent, and creating uncertainty. Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions. Preparing for and complying with these obligations requires us to devote significant resources and may necessitate changes to our services, information technologies, systems, and practices and to those of any third parties that process personal data on our behalf. We may at times fail (or be perceived to have failed) in our efforts to comply with our data privacy and security obligations. Moreover, despite our efforts, our personnel or third parties with whom we work may fail to comply with such obligations, which could negatively impact our business operations. If we or the third parties with whom we work fail, or are perceived to have failed, to address or comply with applicable data privacy and security obligations, we could face significant consequences, including but not limited to: government enforcement actions (e.g., investigations, fines, penalties, audits, inspections, and similar); litigation (including class-action claims) and mass arbitration demands; additional reporting requirements and/or oversight; bans or restrictions on processing personal data; and orders to destroy or not use personal data. In particular, plaintiffs have become increasingly more active in bringing privacy-related claims against companies, including class claims. Some of these claims allow for the recovery of statutory damages on a per violation basis, and, if viable, carry the potential for monumental statutory damages, depending on the volume of data and the number of violations. Any of these events could have a material adverse effect on our reputation, business, or financial condition, including but not limited to loss of customers; inability to process personal data or to operate in certain jurisdictions; interruptions or stoppages in our business operations (including clinical trials); limited ability to develop or commercialize our products; expenditure of time and resources to defend any claim or inquiry; adverse publicity; or substantial changes to our business model or operations.

We are required to comply with anti-corruption and anti-bribery laws in the jurisdictions in which we operate, including the FCPA in the U.S. and other similar laws in other countries in which we do business. We operate in a number of countries that are recognized to have a reputation for corruption and pose an increased risk of corrupt practices. We also regularly interact with government regulators in many countries, including those that are considered higher risk for corruption, in order to secure regulatory approval to manufacture and distribute our products. The anti-corruption and anti-bribery laws to which we are subject generally prohibit individuals, entities, and their intermediaries from directly or indirectly making, offering, providing, promising, or authorizing provision of improper payments to non-U.S. government officials or other persons for the purposes of influencing official decisions or obtaining or retaining business and/or other benefits. These laws also require us to make and keep books and records that accurately and fairly reflect our transactions and to devise and maintain an adequate system of internal accounting controls. As part of our business, we deal with state-owned business enterprises, the employees and representatives of which may be considered non-U.S. government officials for purposes of applicable anti-corruption laws. Although we have adopted policies and procedures designed to ensure that we, our employees and third-party agents will comply with such laws, there can be no assurance that such policies or procedures will work effectively at all times or protect us against liability under these or other laws for actions taken by our employees, partners and other third parties with respect to our business. If we are not in compliance with anti-corruption laws and other laws governing the conduct of business with government entities and/or officials (including local laws), we may be subject to criminal and civil penalties and other remedial measures, which could harm our business, financial condition, results of operations, cash flows and prospects. Investigations of any actual or alleged violations of such laws or policies related to us could harm our business, financial condition, results of operations, cash flows and prospects. Moreover, there has been enhanced scrutiny of company-sponsored patient assistance programs, including insurance premium and co-pay assistance programs and donations to third-party independent charities that provide such assistance. There has also been enhanced scrutiny by governments on reimbursement support offerings, clinical education programs and promotional speaker programs. If we, our third-party agents or donation recipients are deemed to have failed to comply with laws, regulations or government guidance in any of these areas, we could be subject to criminal or civil sanctions. Any similar violations by our competitors could also negatively impact our industry reputation and increase scrutiny over our business and our products.

Disruptions at regulatory authorities and government agencies due to changes in funding levels, government shutdowns, reorganization, reduction in force or statutory, regulatory and policy changes can affect their ability to hire and retain key personnel and carry out their normal functions that support our business. For example, the current U.S. administration previously implemented or proposed policies, including substantial reductions to the FDA's workforce, that may affect the FDA's review process and hinder the ability of the FDA to timely review and approve regulatory submissions for our product candidates. In addition, funding of other regulatory authorities and government agencies on which our operations rely, including those that fund research and development activities, is subject to the political budget process, which is inherently fluid and unpredictable. Government shutdowns could also impact the ability of regulatory authorities and government agencies to function normally and support our operations. For example, the U.S. federal government has shut down repeatedly since 1980, including the recent shut down that began on October 1, 2025 and lasted until November 12, 2025. During a shutdown, certain regulatory authorities and agencies, such as the FDA, have had to furlough key personnel and stop critical activities. If a prolonged government shutdown occurs, it could significantly impact the ability of the FDA to timely review and process our regulatory submissions, which could have a material adverse effect on our business.

Prior to commercialization of our products, regulatory authorities must approve marketing applications that identify authorized manufacturing facilities operated by us or our contract manufacturers that are in compliance with cGMP requirements. In addition, our pharmaceutical manufacturing facilities are continuously subject to scheduled and unannounced regulatory inspections by the FDA, and other comparable EU and other national and international regulatory authorities, before and after product approval, to monitor and ensure compliance with cGMP and other regulations. Our manufacturing facilities in the U.S. are licensed for the manufacture of PALYNZIQ, ALDURAZYME, BRINEURA, NAGLAZYME, VIMIZIM, and VOXZOGO. Our manufacturing facility in Shanbally, Cork, Ireland is licensed for the manufacture of VIMIZIM and BRINEURA and packaging operations for VOXZOGO and PALYNZIQ. In addition, our third-party manufacturers' facilities involved with the manufacture of our products have also been inspected and approved by various regulatory authorities. Although we are not involved in the day-to-day operations of our contract manufacturers, we are ultimately responsible for ensuring that our products are manufactured in accordance with cGMP regulations. Due to the complexity of the processes used to manufacture our products and product candidates, we may be unable to continue to pass or initially pass federal, national or international regulatory inspections in a cost-effective manner. For the same reason, any potential third-party manufacturer of our products or our product candidates may be unable to comply with cGMP regulations in a cost-effective manner and may be unable to initially or continue to pass a federal, national or international regulatory inspection. We have in the past and may in the future face difficulty in expanding our manufacturing capabilities, which has and may contribute to increased costs and reduced margins. If we, or third-party manufacturers with whom we contract, are unable to comply with manufacturing regulations, we may be subject to delay of approval of our product candidates, warning or untitled letters, fines, unanticipated compliance expenses, recall or seizure of our products, total or partial suspension of production and/or enforcement actions, including injunctions, and criminal or civil prosecution. These possible sanctions would adversely affect our financial results and financial condition.

We must obtain regulatory approval to market and sell our product candidates. For example, in the U.S., we must obtain approval from the U.S. Food and Drug Administration (FDA) for each product candidate that we intend to commercialize, and in the EU, we must obtain approval from the European Commission (EC), based on the opinion of the Committee for Medicinal Products for Human Use (CHMP) of the European Medicines Agency (EMA). The FDA and EC approval processes are typically lengthy and expensive, and approval is never certain. To obtain regulatory approval, we must first show that our product candidates are safe and effective for target indications through preclinical studies and clinical trials. Preclinical studies and clinical development are long, expensive and uncertain processes. Completion of clinical trials may take several years, and failure may occur at any stage of development. The length of time required varies substantially according to the type, complexity, novelty and intended use of a product candidate. Interim results of a preclinical test or clinical trial do not necessarily predict final results, and acceptable results in early clinical trials may not be repeated in later clinical trials. Accordingly, there are no assurances that we will obtain regulatory approval for any of our product candidates. Furthermore, there can be no assurance that approval of one of our product candidates by one regulatory authority will mean that other authorities will also approve the same product candidate. Similarly, in the EU, a positive CHMP opinion for approval of a product candidate does not guarantee that the EC will approve the product candidate. Moreover, regulatory authorities may approve a product candidate for fewer or more limited indications than requested. In addition, regulatory authorities may not approve the labeling claims that are necessary or desirable for the successful commercialization of our product candidates. We have had fewer interactions with regulatory authorities outside the U.S. and the EU as compared to our interactions with the FDA, the EC and the EMA. The approval procedures vary among countries and can involve additional clinical testing, and the time required to obtain approval may differ from that required to obtain FDA or EC approval. Moreover, clinical trials conducted in one country may not be accepted by regulatory authorities in other countries. Approval by the FDA or EC does not ensure approval by regulatory authorities in other countries, and approval by one or more non-U.S. regulatory authorities does not ensure approval by regulatory authorities in other non-U.S. countries or by the FDA or EC. However, a failure or delay in obtaining regulatory approval in one country may have a negative effect on the regulatory process in others. The non-U.S. regulatory approval process may include all of the risks associated with obtaining FDA or EC approval. We may not obtain non-U.S. regulatory approvals on a timely basis, if at all. We may not be able to file for regulatory approvals and even if we file, we may not receive necessary approvals to commercialize our product candidates in any market. We also rely on independent third-party Contract Research Organizations (CROs) to file some of our non-U.S. marketing applications, and while we keep a close oversight on the activities we delegate to CROs, important aspects of the services performed for us by the CROs are out of our direct control. If we fail to adequately manage our CROs, if the CRO elects to prioritize work on our projects below other projects or if there is any dispute or disruption in our relationship with our CROs, the filing of our applications may be delayed. Although the FDA, the EC and the EMA have programs to facilitate expedited development and accelerated approval processes, the timelines agreed under legislative goals or mandated by regulations are subject to the possibility of substantial delays. Accordingly, even if any of our applications receives a designation to facilitate expedited development and accelerated approval processes, these designations may not result in faster review or approval for our product candidates compared to product candidates considered for approval under conventional procedures and, in any event, do not assure ultimate approval of our product candidates by regulatory authorities. In addition, the FDA, the EC, the EMA and other comparable international regulatory authorities have substantial discretion over the approval process for pharmaceutical products. These regulatory authorities may not agree that we have demonstrated the requisite level of product safety and efficacy to warrant approval and may require, and in the past have required, additional data. If we fail to obtain regulatory approval for our product candidates, we will be unable to market and sell those product candidates, which would have a negative effect on our business and financial condition. Regulatory authorities and the new requirements and guidelines they promulgate may lengthen the regulatory review process, require us to perform additional or larger studies, increase our development costs, lead to changes in regulatory positions and interpretations, delay or prevent approval and commercialization of our product candidates or lead to significant post-approval studies, limitations or restrictions. For example, the EU pharmaceutical reform will generally result in a decrease in data and market exclusivity in the EU. In addition, some of our product candidates are intended to be used in combination with a medical device, such as an injector or other delivery system. Some of these products intended to be used with a medical device may be regulated as "combination products" in the U.S. and the EU, which are generally defined as products consisting of components from two or more regulatory categories (e.g., drug/device, device/biologic, drug/biologic). In the U.S., each component of a combination product is subject to the requirements established by the FDA for that type of component, whether a new drug, biologic or device. In order to facilitate pre-market review of combination products, the FDA designates one of its centers to have primary jurisdiction for the pre-market review and regulation of the overall product based upon a determination by the FDA of the primary mode of action of the combination product. The determination whether a product is a combination product or two separately regulated products is made by the FDA on a case-by-case basis. In the EU, medical devices and medicinal products are regulated separately, through different legislative instruments. The related applicable requirements will vary depending on the type of drug-device combination product. If, for example, a device intended to administer a medicinal product is sold together with such medicinal product in such a way that they form a single integral product which is intended exclusively for use in the given combination and which is not reusable, that single integral product is regulated as a medicinal product. In addition, the relevant general safety and performance requirements (GSPRs) established for medical devices by EU medical devices legislation apply to the device component of such combination products. In addition, some of our products require use with an in vitro companion diagnostic. Our product candidates may also require use with an in vitro companion diagnostic if the FDA determines that the companion diagnostic is essential for safe and effective use of the product candidate. The FDA generally will require approval or clearance of the diagnostic, known as a companion diagnostic, at the same time that the FDA approves the therapeutic product. Most companion diagnostics require approval of a premarket approval application. In the EU, companion diagnostics are deemed to be in vitro diagnostic medical devices and must conform with the applicable GSPRs. To demonstrate compliance with the GSPRs, companion diagnostics must undergo a conformity assessment by a Notified Body. If the related medicinal product has been, or is in the process of being,authorized through the centralized procedure for the authorization of medicinal products, the Notified Body will, before it can issue the relevant EU technical documentation assessment certificate, be required to seek a scientific opinion from the EMA on the suitability of the companion diagnostic for use in relation to the medicinal product concerned. For medicinal products that have been or are in the process of authorization through any other route provided in EU legislation, the Notified Body must seek the opinion of the national competent authority of an EU Member State. Our product candidates intended for use with separately regulated devices, such as companion diagnostics, or expanded indications that we may seek for our products used with such devices, may not be approved or may be substantially delayed in receiving approval if the devices do not gain and/or maintain their own regulatory approvals, clearances, or certifications. Where approval of the drug or biologic product and device is sought under a single application, such as a drug with an injector or delivery system, the increased complexity of the review process may delay approval. The FDA and EU review processes and related criteria are complex, which could also lead to delays in the approval process. In addition, because these devices are provided by unaffiliated third-party companies, we are dependent on the sustained cooperation and effort of those third-party companies both to obtain regulatory approval and to maintain their own regulatory compliance. Failure of third-party companies to assist in the approval process or to maintain their own regulatory compliance could delay or prevent approval of our product candidates, or limit our ability to sell a product once it is approved. From time to time during the development and regulatory approval process for our products and product candidates, we engage in discussions with the FDA, the EC, the EMA and other comparable international regulatory authorities regarding our development programs, including discussions about the regulatory requirements for approval. As part of these discussions, we sometimes seek advice in the design of our clinical programs from various regulatory authorities globally, but we do not always follow such guidance. This increases the chance of adverse regulatory actions, but we try to always provide appropriate scientific evidence to support approval. Moreover, sometimes different regulatory authorities provide different or conflicting advice. While we attempt to harmonize the advice we receive from multiple regulatory authorities, it is not always practical to do so. Also, we may choose not to harmonize conflicting advice when harmonization would significantly delay clinical trial data or is otherwise inappropriate. If we are unable to effectively and efficiently resolve and comply with the inquiries and requests of the FDA, the EC, the EMA and other comparable international regulatory authorities, the approval of our product candidates may be delayed and their value may be reduced.

Our marketed products have received regulatory approval to be commercially marketed and sold in the U.S., the EU, and certain other countries. Any product for which we have obtained regulatory approval, including the products acquired in the Amicus Acquisition, or for which we obtain regulatory approval in the future, along with the manufacturing processes and practices, post-approval clinical research, product labeling, advertising and promotional activities for such product, are subject to continual requirements of, and review by, the FDA, the EC, the EMA and/or other comparable international and national regulatory authorities. These requirements include submissions of safety and other post-marketing information and reports, registration and listing requirements, current Good Manufacturing Practices (cGMP) requirements relating to manufacturing, quality control, quality assurance and corresponding maintenance of records and documents, import and export requirements and record keeping. An example of the ongoing regulatory requirements our products are subject to is the PALYNZIQ Risk Evaluation and Mitigation Strategy (REMS) program. In the U.S., PALYNZIQ is only available through the REMS program, which is required by the FDA to mitigate the risk of anaphylaxis while using the product. Notable requirements of our REMS program include the following: - prescribers must be certified by enrolling in the REMS program and completing training;- prescribers must prescribe auto-injectable epinephrine with PALYNZIQ;- pharmacies must be certified with the REMS program and must dispense PALYNZIQ only to patients who are authorized to receive it;- patients must enroll in the REMS program and be educated about the risk of anaphylaxis by a certified prescriber to ensure they understand the risks and benefits of treatment with PALYNZIQ; and - patients must have auto-injectable epinephrine available at all times while taking PALYNZIQ. Failure of prescribers, pharmacies or patients to enroll in our REMS program or to successfully complete and comply with its requirements may result in regulatory action from the FDA or decreased sales of PALYNZIQ. The restrictions and requirements under our REMS program, as well as potential changes to these restrictions and requirements in the future, subject us to increased risks and uncertainties, any of which could harm our business. The requirement for a REMS program can materially affect the potential market for and profitability of a drug. We cannot predict whether the FDA will request, seek to require or ultimately require modifications to, or impose additional requirements on, the PALYNZIQ REMS program, or whether the FDA will permit modifications to the PALYNZIQ REMS program that we consider warranted. Any modifications required or rejected by the FDA could make it more difficult or expensive for us to distribute PALYNZIQ in the U.S., impair the safety profile of PALYNZIQ, disrupt continuity of care for PALYNZIQ patients and/or negatively affect sales of PALYNZIQ. In addition, in the EU, the marketing authorization for BRINEURA was granted under "exceptional circumstances". As a result, the risk-benefit balance of BRINEURA is reviewed annually and the marketing authorization may be withdrawn if the risk-benefit ratio is no longer favorable. Failure to continue to show favorable risk-benefit balance for BRINEURA could result in the withdrawal of the marketing approval. Moreover, promotional communications with respect to drugs, including biologics, are subject to a variety of legal and regulatory restrictions and must be consistent with the information in the product's approved labeling and Summary of Product Characteristics. In particular, a product may not be promoted for uses that are not approved by the FDA or the EC as reflected in the product's approved labeling. Although the FDA and other comparable international and national regulatory authorities do not regulate a physician's choice of drug treatment made in the physician's independent medical judgment, they do restrict promotional communications from companies or their sales force with respect to off-label uses of products for which marketing clearance has not been issued. The FDA and other national competent authorities or international regulatory authorities actively enforce the laws and regulations prohibiting the promotion of off-label uses, and a company that is found to have improperly promoted off-label uses may be subject to significant civil, criminal and administrative penalties. Thus, we are not able to promote any products we develop for indications or uses for which they are not approved. Additionally, in the EU, it is prohibited to promote prescription drugs to the general public and we are therefore limited to promote our products exclusively to healthcare professionals, which is also subject to restrictions. Public prosecutors, industry associations, healthcare professionals and other authorities and members of the public, including competitors, closely scrutinize advertising and promotion of any product in the EU. Moreover, if original FDA approval for one of our product candidates is granted via the accelerated approval pathway, we will be required to conduct a post-marketing confirmatory trial to verify and describe the clinical benefit in support of full approval. An unsuccessful post-marketing study or failure to complete such a study with due diligence could result in the withdrawal of the FDA's marketing approval for a product candidate. For example, GALAFOLD and VOXZOGO are approved in the U.S. under accelerated approval and are subject to post-marketing requirements to obtain full approval. Continued approval may be contingent upon verification and description of clinical benefit in confirmatory studies. To fulfill this post-marketing requirement, we intend to use our ongoing open-label extension studies compared to available natural history. In addition, the FDA and the EC often require post-marketing testing and surveillance to monitor the effects of products. The FDA, the EC and other comparable international regulatory authorities may condition approval of our product candidates on the completion of such post-marketing clinical studies. These post-marketing studies may suggest that a product causes undesirable side effects or may present a risk to the patient. Discovery after approval of previously unknown problems with any of our products, manufacturers or manufacturing processes, or failure to comply with regulatory requirements, may result in actions such as: - the issuance of safety alerts, press releases or other communications containing warnings about related products;- modifications to promotional materials or corrective information to healthcare professionals;- restrictions on our ability to conduct clinical trials, including full or partial clinical holds on ongoing or planned trials;- suspensions or restrictions on our operations, including product manufacturing processes;- restrictions on the marketing of a product;- restrictions on product distribution;- requirements to conduct post-marketing clinical trials;- untitled or warning letters or other adverse publicity;- withdrawal of the products from the market;- suspended or withdrawn regulatory approvals;- refusal or delays to approve pending applications or supplements to approved applications that we submit;- recall of products;- refusal to permit the import or export of our products;- product seizure;- fines, restitution or disgorgement of profits or revenue;- injunctions; or - imposition of civil or criminal penalties. If such regulatory actions are taken, our value and our operating results will be adversely affected. Additionally, if the FDA, the EC or any other comparable international regulatory authorities withdraws its approval of a product, we will be unable to generate revenues from the sale of that product in the relevant jurisdiction, our potential for generating positive cash flow will be diminished and the capital necessary to fund our operations will be increased. Accordingly, we continue to expend significant time, money and effort in all areas of regulatory compliance, including manufacturing, production, product surveillance, post-marketing studies and quality control.

As part of the drug development process, we must conduct, at our own expense, preclinical studies in the laboratory, including studies in animals, and clinical trials on humans for each product candidate. The number of preclinical studies and clinical trials that regulatory authorities require varies depending on the product candidate, the disease or condition the drug is being developed to address and regulations applicable to the particular drug. Generally, new drugs for diseases or conditions that affect larger patient populations, are less severe, or are treatable by alternative strategies must be validated through additional preclinical and clinical trials and/or clinical trials with higher enrollments. With respect to our early-stage product candidates, we may need to perform multiple preclinical studies using various doses and formulations before we can begin clinical trials, which could result in delays to our development timeline. Furthermore, even if we obtain favorable results in preclinical studies, the results in humans may be significantly different. After we have conducted preclinical studies, we must demonstrate that our product candidates are safe and efficacious for the intended indication and for use in the targeted human patients in order to receive regulatory approval for commercial sale. Clinical testing is expensive and can take many years to complete, and its outcome is inherently uncertain. Failure can occur at any time during the clinical trial process. The results of preclinical studies and early clinical trials of our product candidates may not be predictive of the results of later-stage clinical trials, and favorable data from interim analyses do not ensure the final results of a trial will be favorable. From time to time, we have published and may in the future publish or report preliminary, initial or interim data from our clinical trials. Preliminary, initial or interim data from our clinical trials may not be indicative of the final results of the trial and are subject to the risk that one or more of the clinical outcomes may materially change as patient enrollment continues and/or more patient data become available. In this regard, such data may show initial evidence of clinical benefit, but as patients continue to be followed and more patient data become available, there is a risk that any therapeutic effects will not be durable in patients and/or will decrease over time or cease entirely. Preliminary, initial or interim data also remain subject to audit and verification procedures that may result in the final data being materially different from such preliminary, initial or interim data. As a result, preliminary, initial or interim data should be considered carefully and with caution until the final data are available. Product candidates may fail to show the desired safety and efficacy traits despite having progressed through preclinical studies and initial clinical trials, or despite having favorable data in connection with an interim analysis. A number of companies in the biopharmaceutical industry have suffered significant setbacks in advanced clinical trials due to lack of efficacy or adverse safety profiles, notwithstanding promising results in earlier trials. Also, as noted above, we do not always follow the advice of regulatory authorities or comply with all of their requests regarding the design of our clinical programs. In those cases, we may choose a development program that is inconsistent with the advice of regulatory authorities, which may limit the jurisdictions where we conduct clinical trials and/or adversely affect our ability to obtain approval in those jurisdictions where we do not follow the regulatory advice. Adverse or inconclusive clinical results could stop us from obtaining regulatory approval of our product candidates. Additional factors that can cause delay or termination of our clinical trials include: - slow or insufficient patient enrollment;- slow recruitment of, and completion of necessary institutional approvals at, clinical sites;- budgetary constraints or prohibitively high clinical trial costs;- longer treatment time required to demonstrate efficacy;- lack of sufficient supplies of the product candidate;- adverse medical events or side effects in treated patients, including immune reactions;- lack of effectiveness of the product candidate being tested;- availability of competitive therapies to treat the same indication as our product candidates;- regulatory requests for additional clinical trials or preclinical studies;- deviations in standards for Good Clinical Practice (GCP); and - disputes with or disruptions in our relationships with clinical trial partners, including CROs, clinical laboratories, clinical sites, and principal investigators.

As part of our business strategy, we have developed and may in the future develop some drugs that may be eligible for FDA and EU orphan drug designation. Under the Orphan Drug Act, the FDA may designate a product as an orphan drug if it is intended to treat a rare disease or condition, defined as a patient population of fewer than 200,000 in the U.S. or as a condition that affects more than 200,000 individuals in the U.S. and for which there is no reasonable expectation that the costs of development of said drug will be recovered from sales in the U.S. In the EU, pursuant to the Regulation (EC) No. 141/2000 (the Orphan Regulation), as implemented by Regulation (EC) No. 847/2000, orphan drug designation is available if a sponsor can establish that: (1) the medicine is intended for the diagnosis, prevention or treatment of a life-threatening or chronically debilitating condition affecting no more than five in 10,000 people in the EU at the time the application is made, or, (2) that it is intended for the diagnosis, prevention or treatment of a life-threatening, seriously debilitating or serious and chronic condition in the EU and that without incentives derived from the orphan status, it is unlikely that the marketing of the medicine in the EU would generate sufficient return to justify the necessary investment. In both cases, the applicant must demonstrate that there exists no satisfactory method of diagnosis, prevention or treatment of the condition in question that has been authorized in the EU or, if such method exists, the medicine will be of significant benefit to those affected by that condition. In the U.S., the company that first obtains FDA approval for a designated orphan drug for a given rare disease receives marketing exclusivity for use of that drug for the designated condition for a period of seven years. Orphan drug exclusive marketing rights may be lost if the FDA later determines that the request for designation was materially defective or if the manufacturer is unable to assure sufficient quantity of the drug. In addition, the FDA may approve another drug during a period of orphan drug exclusivity if the second drug is found to be clinically superior to the first drug. Under the current rules in the EU, a ten-year period of market exclusivity for the approved therapeutic indication (extendable to twelve years for orphan drugs that have complied with an agreed Pediatric Investigation Plan (PIP) pursuant to Regulation 1901/2006), during which the EC and EU Member States cannot accept another marketing authorization (MA) application or accept an application to extend existing authorizations for similar medicinal products for the same indication and no MA can be granted. MAs may also be granted to a similar medicinal product with the same orphan indication if: (i) the applicant can establish that the second medicinal product, although similar to the orphan medicinal product already authorized is safer, more effective or otherwise clinically superior to the orphan medicinal product already authorized; (ii) the MA holder for the first orphan medicinal product grants its consent; or (iii) if the MA holder of the orphan medicinal product is unable to supply sufficient quantities. MAs may also be granted for the same therapeutic indication in relation to products that are not similar. The period of market exclusivity may, in addition, be reduced to six years if, at the end of the fifth year, it can be demonstrated on the basis of available evidence that the criteria for its designation as an orphan medicine are no longer satisfied, for example if the original orphan medicinal product has become sufficiently profitable not to justify maintenance of market exclusivity. Furthermore, it is expected that these periods will be shortened as a result of a reform of the EU pharmaceutical legislative package. On December 11, 2025, the European Parliament and the European Council reached a political agreement on the proposed revision of several European legislative instruments related to medicinal products, including orphan products. Among other things, the revision will amend the duration of the regulatory exclusivity. In particular, the regulatory data protection period (during which other companies cannot access product data) would amount to eight years, with one additional year of market protection (during which generic or biosimilar products cannot be sold), following an MA. Pharmaceutical companies would be eligible for additional periods of market protection under certain conditions, with a cap of eleven years on the combined regulatory protection period. Orphan medicinal products addressing a disease with no current available medicinal treatment ("breakthrough orphan medicinal products") would benefit from up to eleven years of market exclusivity. These rules, if formally approved by the European Parliament and the European Council to become law, could adversely affect our products. In addition, because the extent and scope of patent protection for some of our products is limited, orphan drug designation and resulting regulatory exclusivity is especially important for our products that are eligible for orphan drug designation. For eligible products, we plan to rely on the exclusivity period under the Orphan Drug Act and/or the Orphan Regulation, as applicable, to maintain a competitive position. If we do not obtain orphan drug designation and related regulatory exclusivity for our products that do not have broad patent protection or if a competing product is determined to be, for example, "clinically superior" to any of our products that has secured orphan drug exclusivity, our competitors may then sell the same drug to treat the same condition and our revenues will be reduced. Even though we have obtained orphan drug designation for certain of our product candidates and even if we obtain orphan drug designation for our future product candidates, due to the uncertainties associated with developing biopharmaceutical products, we may not be the first to obtain marketing approval for any particular orphan indication, which means that we may not obtain orphan drug regulatory exclusivity and could also potentially be blocked from approval of certain product candidates until the competitor product's orphan drug exclusivity period expires. Moreover, with respect to certain biologics, there may be some uncertainty regarding how similarity between product candidates designed to treat the same rare disease or condition may affect such product candidates' orphan drug regulatory exclusivities. For biologics, the FDA's determination of whether a drug is the same drug or a different drug will be based on the principal molecular structural features of the products. Further, even if we obtain orphan drug exclusivity for a product, that exclusivity may not effectively protect the product from competition because different drugs can be approved for the same condition and the same drug can be approved for different conditions and potentially used off-label in the orphan indication. The FDA could also interpret the term "condition" narrowly, which could allow for indirect competition during the period of exclusivity. Even after an orphan drug is approved and granted orphan drug exclusivity, the FDA can subsequently approve the same drug for the same condition if the FDA concludes that the later drug is clinically superior by means of greater safety or effectiveness by making a major contribution to patient care. Further, orphan drug designation neither shortens the development time or regulatory review time of a drug, nor gives the drug any advantage in the regulatory review or approval process.

We make a significant portion of our initial international sales of newly launched products through early access, special access or "named patient sales" programs in markets where we are not required to obtain regulatory approval before establishing these programs. For example, a significant portion of our international sales of VOXZOGO since the product's launch have been made through such programs but have, or are in the process, of being officially approved for national reimbursement in countries where patient numbers are sufficient for it to apply. The specifics of the programs vary from country to country. Generally, special approval must be obtained to initiate such programs, and in some cases, special approval must be obtained for each patient. The approval normally requires an application to national competent authorities in which the product is intended to be supplied or a lawsuit accompanied by evidence of medical need. These programs are not well defined in some countries and are subject to changes in requirements, funding levels, unmet medical need and classification of the disease treated by our product. Any change to these programs could adversely affect our ability to sell our products in those countries and delay sales. If the programs are not funded by the respective government, there could be insufficient funds to pay for all patients. Further, governments have and may continue to undertake unofficial measures to limit purchases of our products, including initially denying coverage for purchasers, delaying orders, requiring additional in-country testing and denying or taking excessively long to approve customs clearance. Any such actions could materially delay or reduce our revenues from such countries. Without the special access programs, we would need to seek full product approval or official reimbursement to commercially market and sell our products in certain jurisdictions. This can be an expensive and time-consuming process and may subject our products to additional price controls. Because the number of patients is so small in some countries, it may not be economically feasible to seek, obtain and maintain a full product approval or official reimbursement, and therefore the sales in such country would be permanently reduced or eliminated. For all of these reasons, if the special access programs that we are currently using are eliminated or restricted, our revenues could be adversely affected.

Our industry is highly regulated and changes in law may adversely impact our business, operations or financial results. In the U.S., there have been and continue to be a number of legislative initiatives to contain healthcare costs. In the U.S., there have been several congressional inquiries, proposed and enacted federal and state legislation and executive action designed to, among other things, bring more transparency to drug pricing, review the relationship between pricing and manufacturer patient programs, reduce the cost of drugs under Medicare, and reform government program reimbursement methodologies for drug products. Any reduction in reimbursement from Medicare and other government programs may result in a similar reduction in payments from private payers. For example, the Patient Protection and Affordable Care Act of 2010, as amended by the Health Care and Education Reconciliation Act of 2010 (collectively, the PPACA), expanded healthcare coverage within the U.S., primarily through the imposition of health insurance mandates on employers and individuals and expansion of the Medicaid program. Several provisions of the law have affected us and increased certain of our costs. Since its enactment, there have been executive, judicial and congressional challenges to certain aspects of the PPACA. Although the PPACA has generally been upheld thus far, it is unclear how continued challenges to the law may impact the PPACA and our business. In addition, other legislative changes have been adopted since the PPACA was enacted. Some of these changes have resulted in additional reductions in Medicare and other healthcare funding, which could have a material adverse effect on our customers and, accordingly, our financial operations. Several healthcare reform initiatives culminated in the enactment of the Inflation Reduction Act (IRA) in August 2022, which, among other things, eliminated, beginning in 2025, the coverage gap under Medicare Part D by significantly lowering the enrollee maximum out-of-pocket costs and requiring manufacturers to subsidize, through a newly established manufacturer discount program, 10% of Part D enrollees' prescription costs for brand drugs below the out-of-pocket limit, and 20% once the out-of-pocket limit has been reached. The IRA also requires the U.S. Department of Health and Human Services (HHS) to negotiate the selling price of a statutorily specified number of drugs and biologics each year that the CMS reimburses under Medicare Part B and Part D. The negotiated price may not exceed a statutory ceiling price. Only high-expenditure single-source drugs that have been approved for at least seven years (11 years for biologics) can be selected by CMS for negotiation, with the negotiated price taking effect two years after the selection year. For 2026, the first year in which negotiated prices become effective, CMS selected 10 high-cost Medicare Part D products in 2023, negotiations began in 2024, and the negotiated maximum fair price for each product has been announced. In addition, CMS has selected and announced the negotiated maximum fair price for 15 additional Medicare Part D drugs which will become effective in 2027. For 2028, CMS has selected an additional 15 drugs, comprised of drugs covered under Medicare Part D and, for the first time, drugs payable under Medicare Part B. For 2029 and subsequent years, 20 Part B or Part D drugs will be selected. The IRA also imposes rebates on Medicare Part B and Part D drugs whose prices have increased at a rate greater than the rate of inflation, and in 2024, CMS finalized regulations for the Medicare Part B and Part D inflation rebates. The IRA permits the Secretary of HHS to implement many of these provisions through guidance, as opposed to regulation, for the initial years. HHS has and will continue to issue and update guidance as these programs are implemented. Manufacturers that fail to comply with the IRA may be subject to various penalties, including civil monetary penalties. The IRA's provisions began taking effect progressively starting in 2023, although they may be subject to legal challenges. Thus, while it is unclear how the IRA will be implemented, it will likely have a significant impact on the pharmaceutical industry. In addition, the current U.S. Presidential Administration is pursuing policies to reduce regulations and expenditures across government including at HHS, which include the FDA and CMS, and related agencies. For example, on May 12, 2025, President Trump issued an executive order that, among other things, required HHS, within 30 days, to establish and communicate to drug manufacturers most favored nation (MFN) price targets designed to bring drug prices for American patients in line with those in comparably developed nations. If significant progress towards MFN pricing is not achieved, the executive order requires HHS to propose a rulemaking to implement MFN pricing. On December 23, 2025, CMS issued proposed regulations to establish, under the Center for Medicare and Medicaid Innovation, two mandatory MFN demonstration models under Medicare Parts B and D, respectively. If these rules or other MFN pricing rules are finalized, they are likely to reduce prices of at least some drugs in the United States, if they are also sold in comparator countries. Even if we do not market drugs in such countries, we will be indirectly affected if our drugs competed with drugs whose prices were reduced as a result of MFN pricing initiatives. At the U.S. state level, legislatures have also increasingly enacted laws and implemented regulations designed to control pharmaceutical product pricing, including price or patient reimbursement constraints, price and price increase disclosure and reporting requirements, discounts, restrictions on certain product access and marketing cost disclosure and transparency measures, and, in some cases, designed to encourage importation from other countries and bulk purchasing. Moreover, regional healthcare authorities and individual hospitals are increasingly using bidding procedures to determine what pharmaceutical products and which suppliers will be included in their prescription drug and other healthcare programs. Likewise, in many EU Member States, legislators and other policymakers continue to propose and implement healthcare cost-containing measures in response to the increased attention being paid to healthcare costs in the EU. Certain of these changes could impose limitations on the prices we will be able to charge for our commercial products and any product candidates or the amounts of reimbursement available for these products from governmental and private third-party payers, may increase the tax obligations on pharmaceutical companies or may facilitate the introduction of generic competition with respect to our products. Further, an increasing number of EU Member States and other non-U.S. countries use prices for medicinal products established in other countries as "reference prices" to help determine the price of the product in their own territory. If the price of one of our products decreases substantially in a reference price country, it could impact the price for that product in other countries. Consequently, a downward trend in prices of our products in some countries could contribute to similar downward trends elsewhere, which would have a material adverse effect on our revenues and results of operations. Moreover, some EU Member States may require the completion of additional studies that compare the cost-effectiveness of a particular medicinal product candidate to currently available therapies. This Health Technology Assessment (HTA) process, which is currently governed by the national laws of the individual EU Member States, is the procedure according to which the assessment of the public health impact, therapeutic impact and the economic and societal impact of use of a given medicinal product in the national healthcare systems of the individual country is conducted. The outcome of HTA regarding specific medicinal products will often influence the pricing and reimbursement status granted to these medicinal products by the competent authorities of individual EU Member States. In 2022, the EC adopted the HTA regulation, which is intended to boost cooperation among EU Member States in evaluating new medicinal products. The HTA regulation entered into force in January 2025 and has resulted in increased downward pricing pressure in the EU. We anticipate that the IRA, PPACA and other healthcare reform measures that may be adopted in the future in the U.S. or abroad, may result in more rigorous coverage criteria and an additional downward pressure on the reimbursement our customers may receive for our products. Legally mandated price controls on payment amounts by governmental and private third-party payers or other restrictions could harm our business, results of operations, financial condition and prospects. The implementation of cost containment measures or other healthcare reforms may prevent us from being able to generate revenue, attain profitability or commercialize our products.