Cytek Biosciences (CTKB) Risk Analysis

Our current products include instruments, accessories, consumables and services to advance high-content and high-sensitivity cell analysis. We cannot assure you that the market for our current products will continue to generate significant or consistent demand. Demand for our current products could be significantly diminished by competitive technologies or products that replace them or render them obsolete or less desirable. Accordingly, we must continue to invest in research and development to develop competitive products and enabling services. Our future success depends on our ability to anticipate our customers' needs and develop new products and enhance current products and services to address those needs. Introduction of new products and product enhancements will require that we effectively transfer production processes from research and development to manufacturing and coordinate our efforts with those of our suppliers to achieve the desired level of production. If we fail to transfer production processes effectively, develop product enhancements or introduce new products or enabling services in sufficient quantities to meet the needs of our customers, or effectively coordinate with our suppliers, our net sales may be reduced and our business would be harmed. The commercial success of all of our products and services will depend upon their acceptance by the life sciences and biopharmaceutical industries. Some of the products and services that we are developing are based upon new technologies or approaches. As a result, there can be no assurance that these new products and services, even if successfully developed and introduced, will be accepted by customers. If customers do not adopt our new products, services and technologies, our results of operations may suffer and, as a result, the market price of our common stock may decline.

As with other flow cytometry companies, our success depends in large part on our ability to obtain, maintain and solidify a proprietary position for our current and any future products, which will depend upon our success in obtaining effective patent protection and other intellectual property protection in the United States and other countries that cover such products, their manufacturing processes and their intended methods of use and enforcing those patent claims against infringers once granted as well as our other intellectual property rights. In some cases, we may not be able to obtain issued patent claims or other intellectual property rights covering our technologies which are sufficient to prevent third parties, such as our competitors, from utilizing our products and negating any competitive advantage we may have. Any failure to obtain or maintain patent claims and other intellectual property rights with respect to our current and any future products or other aspects of our business could harm our business, financial condition and results of operations. Changes in either the patent laws or their interpretation in the United States and other countries may diminish our ability to protect our inventions and to obtain, maintain and enforce our intellectual property rights and, more generally, could affect the value of our intellectual property or narrow the scope of our patents. Additionally, we cannot predict whether the patent applications we are currently pursuing will issue as patents in any particular jurisdiction or whether the claims of any issued patents will provide sufficient protection from competitors or other third parties. The patent prosecution process is expensive, time-consuming and complex, and we may not be able to file, prosecute, maintain, enforce or license all necessary or desirable patent applications at a reasonable cost or in a timely manner. It is also possible that we will fail to identify patentable aspects of our research and development output in time to obtain patent protection. Although we enter into non-disclosure and confidentiality agreements with parties who have access to confidential or patentable aspects of our research and development output, such as our employees, corporate collaborators, outside scientific collaborators, suppliers, consultants, advisors and other third parties, any of these parties may breach the agreements and disclose such output before a patent application is filed, thereby jeopardizing our ability to seek and obtain patent protection. In addition, our ability to obtain and maintain valid and enforceable patents depends in part on whether the differences between our inventions and the prior art allow our inventions to be patentable over the prior art. Furthermore, the publication of discoveries in scientific literature often lags behind the actual discoveries, and patent applications in the United States and other jurisdictions are typically not published until 18 months after filing, or in some cases not at all. Therefore, we cannot be certain that we were the first to file for patent protection of such inventions. Including rights acquired in connection with the FCI Acquisition, as of March 31, 2026, we own 38 issued U.S. utility patents, 10 issued Japan utility patents, six issued European utility patents, six issued China utility patents, one Canada utility patent, one India utility patent, two Australian utility patents, and three Singapore utility patents. We have 68 pending utility patent applications, including 44 utility patent applications in the United States, two international utility patent applications, eight utility patent applications in the European Union, eight utility patent applications in China, and four utility patent applications in Japan. Assuming all maintenance fees are paid, the U.S. issued patents are expected to naturally expire between years 2026 and 2041. Additionally, patents covering intellectual property relating to design specific technologies invented by our researchers in Shanghai and Wuxi, China are filed in China and owned by our China subsidiaries, respectively. As of March 31, 2026, our Shanghai subsidiary owns 12 issued utility patents and eight issued invention patents and has two pending utility patent applications and three pending invention patent applications, and our Wuxi subsidiary owns 42 issued utility patents and one issued invention patent and has 12 pending utility patent applications and eight pending invention patent applications. It is possible that none of our pending patent applications will result in issued patents in a timely fashion or at all, and even if patents are granted, they may not provide a basis for intellectual property protection of commercially viable products or services, may not provide us with any competitive advantages, or may be challenged and invalidated by third parties. It is possible that others will design around our current or future patented technologies. It is possible that in the future the scope, validity and enforceability of our patents, licensed patents, patent applications, trademarks, and trademark applications may be challenged at the United States Patent and Trademark Office ("USPTO") or in proceedings before the patent offices of other jurisdictions. We may not be successful in defending any such challenges made against our patents, patent applications, trademarks or trademark applications. Any successful third-party challenge to our patents or trademarks could result in the unenforceability or invalidity of such patents or trademarks and increased competition to our business. We may have to challenge the patents, patent applications, trademarks, or trademark applications of third parties. The outcome of patent litigation or other proceedings can be uncertain, and any attempt by us to enforce our patent rights against others or to challenge the patent rights of others may not be successful, or, if successful, may take substantial time and result in substantial cost, and may divert our efforts and attention from other aspects of our business. Moreover, in some circumstances, we may not have the right to control the preparation, filing and prosecution of patent applications, or to maintain the patents, covering technology that we license from or license to third parties or that we may jointly-own with third parties in the future and are therefore reliant on our licensors or licensees, and may be reliant on future joint-owners, licensors or licensees, to protect certain of our intellectual property used in our business. If our joint-owners, licensors or licensees fail to adequately protect this intellectual property or if we do not have exclusivity for the marketing of our products, whether because our joint-owners or licensors do not grant us exclusivity or they do not enforce the intellectual property against our competitors, our ability to commercialize products could suffer. Therefore, these and any of our patents and applications may not be prosecuted and enforced in a manner consistent with the best interests of our business. Defects of form in the preparation or filing of our patents or patent applications may exist, or may arise in the future, for example, with respect to proper priority claims, inventorship and the like. If we or any of our current or future joint-owners, licensors or licensees fail to establish, maintain, protect or enforce such patents and other intellectual property rights, such rights may be reduced or eliminated. If any current or future joint-owners, licensors or licensees are not fully cooperative or disagree with us as to the prosecution, maintenance or enforcement of any patent rights, such patent rights could be compromised. If there are material defects in the form, preparation or prosecution of our patents or patent applications, such patents or applications may be invalid and/or unenforceable. Any of these outcomes could impair our ability to prevent competition from third parties, which may impact our ability to commercialize our products and materially harm our business. The strength of patent rights generally, and particularly the patent position of life sciences companies, involves complex legal and scientific questions and can be uncertain, and has been the subject of much litigation in recent years. This uncertainty includes changes to the patent laws through either legislative action to changes to statutory patent law or court action that may reinterpret existing law or rules in ways affecting the scope or validity of issued patents or the chances that patent applications will result in issued claims and the scope of any such claims. Our current or future patent applications may fail to result in issued patents in the United States or foreign countries with claims that cover our current and any future products. Even if patents are successfully issued from our patent applications, third parties may challenge the validity, enforceability or scope of such patents, which may result in such patents being narrowed, invalidated or held unenforceable. Any successful challenge to our patents could deprive us of the exclusive rights necessary for the successful commercialization of our current and any future products, which may materially harm our business. Furthermore, even if they are unchallenged, our patents may not adequately protect our current and any future products, provide exclusivity for such products or prevent others from designing around the claims of our patents. If the scope of any patent protection we obtain is not sufficiently broad, or if we lose any of our patent protection, our ability to prevent our competitors from commercializing similar or identical technology and products would be adversely affected and would materially harm our business. If the breadth or strength of protection provided by the patents we hold or pursue with respect to our current and any future products is challenged, it could dissuade companies from collaborating with us to develop, or threaten our ability to commercialize, our current and any future products. Patents have a limited lifespan. In the United States, the natural expiration of a utility patent is generally 20 years after its effective filing date and the natural expiration of a design patent is generally 14 years after its issue date, unless the filing date occurred on or after May 13, 2015, in which case the natural expiration of a design patent is generally 15 years after its issue date. However, the actual protection afforded by a patent varies from country to country, and depends upon many factors, including the type of patent, the scope of its coverage, the availability of regulatory-related extensions, the availability of legal remedies in a particular country and the validity and enforceability of the patent. The laws of some foreign countries do not protect our proprietary rights to the same extent as the laws of the United States, and we may encounter significant problems in protecting our proprietary rights in these countries. Various extensions may be available; however, the life of a patent, and the protection it affords, is limited. Without patent protection for our current and any future products and services, we may be open to competition, which may harm our business prospects. Further, if we encounter delays in our development efforts, the period of time during which we could market our current and any future products and services under patent protection would be reduced and, given the amount of time required for the development, testing and regulatory review of planned or future products, patents protecting our current and any future products might expire before or shortly after such products are commercialized. As our patents expire, the scope of our patent protection will be reduced, which may reduce or eliminate any competitive advantage afforded by our patent portfolio. As a result, our patent portfolio may not provide us with sufficient rights to exclude others from commercializing products similar or identical to ours. Moreover, the coverage claimed in a patent application can be significantly reduced before the patent is issued, and its scope can be reinterpreted after issuance. Even if patent applications we license or own, currently or in the future, issue as patents, they may not issue in a form that will provide us with any meaningful protection, prevent competitors or other third parties from competing with us, or otherwise provide us with any competitive advantage. Any patents that we own now or in the future may be challenged, narrowed, circumvented or invalidated by third parties. Consequently, we do not know whether our current and any future products or other technologies will be protectable or remain protected by valid and enforceable patents. Our competitors or other third parties may be able to circumvent our patents by developing similar or alternative technologies or products in a non-infringing manner which could harm our business, financial condition and results of operations. Some of our patents and patent applications may in the future be jointly owned with third parties, including certain universities and public institutions in the United States and China. If we are unable to obtain an exclusive license to any such third-party joint-owners' interest in such patents or patent applications, such co-owners may be able to license their rights to other third parties, including our competitors, and our competitors could market competing products and technology. In addition, we may need the cooperation of any such joint-owners patents to enforce such patents against third parties, and such cooperation may not be provided to us. Any of the foregoing could harm our business, financial condition and results of operations. Additionally, we may find it necessary or prudent to acquire or obtain licenses from third-party intellectual property holders. However, we may be unable to acquire or secure such licenses to any intellectual property rights from third parties that we identify as necessary for our current and any future products. The acquisition or licensing of third-party intellectual property rights is a competitive area, and our competitors may pursue strategies to acquire or license third-party intellectual property rights that we may consider attractive or necessary. Our competitors may have a competitive advantage over us due to their size, capital resources and greater development and commercialization capabilities. In addition, companies that perceive us to be a competitor may be unwilling to assign or license rights to us. We also may be unable to acquire or license third-party intellectual property rights on terms that would allow us to make an appropriate return on our investment or at all. If we are unable to successfully obtain rights to required third-party intellectual property rights or maintain the existing intellectual property rights we have, we may have to abandon development of the relevant products, which could harm our business, financial condition and results of operations.

We rely extensively on information technology systems to conduct our business. These systems affect, among other things, ordering and managing materials from suppliers, shipping products, processing transactions, complying with regulatory, legal or tax requirements, data security and other processes necessary to manage our business. Our systems and the data contained on them are and have been subject to computer viruses, ransomware or other malware, attacks by computer hackers, social engineering (including phishing), supply chain attacks, credential stuffing, efforts by individuals or groups of hackers and sophisticated organizations, including state-sponsored organizations, errors or malfeasance of our personnel, and security vulnerabilities in the software or systems on which we rely, and failures during the process of upgrading or replacing software, databases or components thereof. If the confidentiality, integrity, or availability of our systems or our data is compromised due to these, or any number of, causes ranging from catastrophic events and power outages to security breaches, and our business continuity plans do not effectively compensate on a timely basis, we may experience interruptions in our operations, including corruption of our data or release of our confidential information, which could have an adverse effect on our business. Furthermore, any breach in our information technology systems could lead to the unauthorized access, disclosure and use of non-public information, which may be protected by applicable laws. Any such access, disclosure, or other loss of information could require substantial expenditures to remedy and could result in legal claims or proceedings, liability under laws that protect the privacy of personal information and damage to our reputation.

We are exposed to broadly applicable anti-fraud and abuse, anti-kickback, false claims and other healthcare laws and regulations that may constrain our business, our arrangements and relationships with customers, and how we market, sell and distribute our products. We have a compliance program, code of conduct and associated policies and procedures, but it is not always possible to identify and deter misconduct by our employees and other third parties, and the precautions we take to detect and prevent noncompliance may not be effective in protecting us from governmental investigations for failure to comply with applicable fraud and abuse or other healthcare laws and regulations. The laws that may affect our ability to operate include, among others: - the Anti-Kickback Statute, which prohibits, among other things, knowingly and willingly soliciting, offering, receiving or paying remuneration, directly or indirectly, overtly or covertly, in cash or in kind, to induce or reward either the referral of a person, or the purchase, order or recommendation of, items or services for which payment may be made, in whole or in part, under a federal healthcare program such as the Medicare and Medicaid programs. The term "remuneration" has been broadly interpreted to include anything of value, and the government can establish a violation of the Anti-Kickback Statute without proving that a person or entity had actual knowledge of the law or a specific intent to violate. In addition, the government may assert that a claim, including items or services resulting from a violation of the Anti-Kickback Statute, constitutes a false or fraudulent claim for purposes of the federal civil False Claims Act (the "FCA"). There are a number of statutory exceptions and regulatory safe harbors protecting certain business arrangements from prosecution under the Anti-Kickback Statute; however, those exceptions and safe harbors are drawn narrowly, and there may be limited or no exception or safe harbor for many common business activities. Certain common business activities, including certain reimbursement support programs, educational and research grants or charitable donations, and practices that involve remuneration to those who prescribe, purchase or recommend medical devices, including discounts, providing items or services for free or engaging such people as consultants, advisors or speakers, may be subject to scrutiny if they do not fit squarely within any available exception or safe harbor and would be subject to a facts and circumstances analysis to determine compliance with the Anti-Kickback Statute. Our business may not in all cases meet all of the criteria for statutory exception or regulatory safe harbor protection from anti-kickback liability;- the FCA, which prohibits, among other things, persons or entities from knowingly presenting, or causing to be presented, a false or fraudulent claim for payment of government funds and knowingly making, using or causing to be made or used, a false record or statement to get a false claim paid or to avoid, decrease or conceal an obligation to pay money to the federal government. A claim including items or services resulting from a violation of the Anti-Kickback Statute constitutes a false or fraudulent claim for purposes of the FCA. Actions under the FCA may be brought by the government or as a qui tam action by a private person in the name of the government. These people, sometimes known as "relators" or, more commonly, as "whistleblowers," may share in any monetary recovery. Many medical device manufacturers have been investigated and have reached substantial financial settlements with the federal government under the FCA for a variety of alleged improper activities, including causing false claims to be submitted as a result of the marketing of their products for unapproved and thus non-reimbursable uses and interactions with prescribers and other customers, including those that may have affected their billing or coding practices and submission of claims to the federal government. FCA liability is potentially significant in the healthcare industry because the statute provides for treble damages and mandatory monetary penalties for each false or fraudulent claim or statement. Because of the potential for large monetary exposure, life sciences companies often resolve allegations without admissions of liability for significant and material amounts to avoid the uncertainty of treble damages and per claim penalties that may be awarded in litigation proceedings. Settlements may require companies to enter into corporate integrity agreements with the government, which may impose substantial costs on companies to ensure compliance. Medical device manufacturers and other healthcare companies also are subject to other federal false claims laws, including, among others, federal criminal healthcare fraud and false statement statutes that extend to non-government health benefit programs;- HIPAA, which imposes criminal and civil liability for, among other actions, knowingly and willfully executing, or attempting to execute, a scheme to defraud any healthcare benefit program, including private third-party payors, or knowingly and willfully falsifying, concealing or covering up a material fact or making a materially false, fictitious or fraudulent statement or representation, or making or using any false writing or document knowing the same to contain any materially false, fictitious or fraudulent statement or entry in connection with the delivery of or payment for healthcare benefits, items or services. Similar to the federal healthcare Anti-Kickback Statute, a person or entity does not need to have actual knowledge of the statute or specific intent to violate it to have committed a violation;- HIPAA, as amended by HITECH, and their implementing regulations, also impose obligations, including mandatory contractual terms, on covered entities subject to the rule, such as health plans, healthcare clearinghouses and certain healthcare providers, as well as their business associates that perform certain services for them or on their behalf involving the use or disclosure of individually identifiable health information with respect to safeguarding the privacy, security and transmission of individually identifiable health information;- various state laws govern the privacy and security of personal information, including the CCPA, which became effective January 1, 2020, and gives California residents expanded rights to access and delete their personal information, opt out of certain personal information sharing and receive detailed information about how their personal information is used by requiring covered companies to provide new disclosures to California consumers (as that term is broadly defined) and provide such consumers new ways to opt-out of certain sales of personal information. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches;- the federal Physician Payments Sunshine Act, implemented as Open Payments, requires manufacturers of drugs, devices, biologics and medical supplies for which payment is available under Medicare, Medicaid or the Children's Health Insurance Program to report annually, with certain exceptions to CMS, information related to payments or other "transfers of value" made to physicians, as defined by such law, and teaching hospitals, and requires applicable manufacturers and group purchasing organizations to report annually to CMS ownership and investment interests held by physicians and their immediate family members, physician assistants, nurse practitioners, clinical nurse specialists, certified nurse anesthetists and certified nurse-midwives; and - analogous state and foreign law equivalents of each of the above federal laws, such as anti-kickback and false claims laws which may apply to items or services reimbursed by any third-party payor, including commercial insurers; state laws that require medical device companies to comply with the industry's voluntary compliance guidelines and the applicable compliance guidance promulgated by the federal government or otherwise restrict payments that may be made to healthcare providers and other potential referral sources; state beneficiary inducement laws, which are state laws that require medical device manufacturers to report information related to payments and other transfers of value to physicians and other healthcare providers or marketing expenditures; and state and foreign laws governing the privacy and security of health information in certain circumstances, many of which differ from each other in significant ways and may not have the same effect, thus complicating compliance efforts. State and federal regulatory and enforcement agencies continue to actively investigate violations of healthcare laws and regulations, and the U.S. Congress continues to strengthen the arsenal of enforcement tools. Enforcement agencies also continue to pursue novel theories of liability under these laws. In particular, government agencies have increased regulatory scrutiny and enforcement activity with respect to manufacturer reimbursement support activities, including bringing criminal charges or civil enforcement actions under the Anti-Kickback Statute, FCA and HIPAA's healthcare fraud and privacy provisions. Because of the breadth of these laws and the narrowness of the statutory exceptions and regulatory safe harbors available under such laws, it is possible that some of our business activities, including certain sales and marketing practices of our products, could be subject to challenge under one or more such laws. If an arrangement were deemed to violate the Anti-Kickback Statute, it may also subject us to violations under other fraud and abuse laws such as the federal civil FCA and civil monetary penalties laws. Moreover, such arrangements could be found to violate comparable state fraud and abuse laws. Achieving and sustaining compliance with applicable federal and state anti-fraud and abuse laws may prove costly. If we or our employees are found to have violated any of the above laws we may be subjected to substantial criminal, civil and administrative penalties, including imprisonment, exclusion from participation in federal healthcare programs, such as Medicare and Medicaid, and significant fines, monetary penalties, forfeiture, disgorgement and damages, contractual damages, reputational harm, administrative burdens, diminished profits and future earnings and the curtailment or restructuring of our operations, any of which could adversely affect our ability to operate our business and our financial results. Any action or investigation against us for the violation of these healthcare fraud and abuse laws, even if successfully defended, could result in significant legal expenses and could divert our management's attention from the operation of our business. Companies settling FCA, Anti-Kickback Statute or civil monetary penalties law cases also may enter into a Corporate Integrity Agreement with the U.S. Department of Health and Human Services Office of Inspector General, or the OIG, to avoid exclusion from participation (such as loss of coverage for their products) in federal healthcare programs such as Medicare and Medicaid. Corporate Integrity Agreements typically impose substantial costs on companies to ensure compliance. Defending against any such actions can be costly, time-consuming and may require significant personnel resources, and may harm our business, financial condition and results of operations.

The marketing, sale and use of our products could lead to the filing of product liability claims where someone may allege that our products identified inaccurate or incomplete information or otherwise failed to perform as designed. We may also be subject to liability for errors in, a misunderstanding of or inappropriate reliance upon, the information we provide in the ordinary course of our business activities. A product liability claim could result in substantial damages and be costly and time-consuming for us to defend. If we cannot successfully defend ourselves against product liability claims, we will incur substantial liabilities and reputational harm. In addition, regardless of merit or eventual outcome, product liability claims may result in: - substantial litigation costs;- distraction of management's attention from our primary business;- the inability to commercialize our products or new products;- decreased demand for our products;- damage to our business reputation;- product recalls or withdrawals from the market;- loss of sales; or - termination of existing agreements by our partners and potential partners failing to partner with us. We maintain product liability insurance, but this insurance may not fully protect us from the financial impact of defending against product liability claims. Any product liability claim brought against us, with or without merit, could increase our insurance rates or prevent us from securing insurance coverage in the future. While we may attempt to manage our product liability exposure by proactively recalling or withdrawing from the market any defective products, any recall or market withdrawal of our products may delay the supply of those products to our customers and may impact our reputation. We may not be successful in initiating appropriate market recall or market withdrawal efforts that may be required in the future and these efforts may not have the intended effect of preventing product malfunctions and the accompanying product liability that may result. Such recalls and withdrawals may also harm our reputation with customers, which could negatively affect our business, financial condition and results of operations.

Our effective tax rate could increase due to several factors, including: - changes in the relative amounts of income before taxes in the various jurisdictions in which we operate that have differing statutory tax rates;- changes in tax laws, tax treaties, and regulations or the interpretation of them;- changes to our assessment about our ability to realize our deferred tax assets that are based on estimates of our future results, the prudence and feasibility of possible tax planning strategies, and the economic and political environments in which we do business;- the outcome of current and future tax audits, examinations, or administrative appeals; and - limitations or adverse findings regarding our ability to do business in some jurisdictions. Additionally, a tax authority may disagree with tax positions that we have taken, which could result in increased tax liabilities. For example, a tax authority could assert that we are subject to tax in a jurisdiction where we believe we have not established a taxable connection, often referred to as a "permanent establishment" under international tax treaties, and such an assertion, if successful, could increase our expected tax liability in one or more jurisdictions.

In the ordinary course of our operations, we collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share sensitive, confidential, and proprietary information, including personal information, business data, trade secrets, intellectual property, and sensitive third-party data. Accordingly, we are, and may increasingly become, subject to various data privacy and security laws, the number and scope of which are changing, subject to differing applications and interpretations, may be inconsistent among jurisdictions, and may conflict with each other. In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal information privacy and security laws, and consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws). For example, the federal Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), as amended by the Health Information Technology for Economic and Clinical Health Act ("HITECH"), imposes specific requirements relating to the privacy, security, and transmission of individually identifiable health information. Numerous U.S. states have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal information. As applicable, such rights may include the right to access, correct, or delete certain personal information, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal information, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018 (the "CCPA") applies to personal information of consumers, business representatives, and employees, and requires businesses to provide specific disclosures in privacy notices and honor requests of California residents to exercise certain rights related to their personal information. The CCPA provides for fines for noncompliance and allows private litigants affected by certain data breaches to recover significant statutory damages. The CCPA and other U.S. comprehensive privacy laws exempt some data processed in the context of clinical trials, but these developments increase compliance costs and potential liability with respect to other personal information we maintain about residents in these states. Similar laws are being considered in several other states, as well as at the federal and local levels, and we expect more jurisdictions to pass similar laws in the future. If we become subject to new data privacy and security laws, the risk of enforcement action against us could increase because we may become subject to additional obligations, and the number of individuals or entities that can initiate actions against us may increase (including individuals via a private right of action and state actors), increasing legal risk and compliance costs for us and the third parties with whom we work. Outside the United States, an increasing number of laws, regulations, and industry standards apply to data privacy and security. For example, the European Union's General Data Protection Regulation ("EU GDPR") and the United Kingdom's General Data Protection Regulation ("UK GDPR") (collectively, "GDPR") impose strict requirements for processing the personal information of individuals located, respectively, within the European Economic Area ("EEA") and the United Kingdom ("UK"). For example, violations of the GDPR can result in temporary or definitive bans on data processing and other corrective actions; fines of up to 20 million Euros (£17.5 million for the UK GDPR) or 4% of annual global revenue, whichever is greater; or private litigation related to processing of personal information brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests. In Europe, the Network and Information Security Directive ("NIS2") regulates resilience and incident response capabilities of entities operating in a number of sectors, including the health sector. Non-compliance with NIS2 may lead up to administrative fines of a maximum of 10 million Euros or up to 2% of the total worldwide revenue of the preceding fiscal year. Other countries outside of Europe have enacted or are considering enacting similar comprehensive data privacy and security laws and regulations, which could increase the cost and complexity of delivering our services and operating our business. For example, China's Personal Information Protection Law ("PIPL") broadly regulates data privacy and security practices and imposes strict requirements for processing personal information. As another example, Canada has enacted the Personal Information Protection and Electronic Documents Act and Canada's Anti-Spam Legislation, which broadly regulate the processing of personal information and impose compliance obligations and penalties comparable to those of European data privacy and security laws. Complying with these and other similar laws and regulations (to the extent applicable) causes us to incur substantial operational costs and may require us to change our business practices, and could lead to material fines, penalties and liability. In addition, many jurisdictions have enacted data localization laws and cross-border data transfer restrictions. These laws may make it more difficult for us to transfer personal information across jurisdictions, which could impede our business. For example, absent appropriate safeguards or other circumstances, the GDPR generally restricts the transfer of personal information to the United States and other countries that are viewed by some regulators to not generally provide an adequate level of data privacy and security. Although there are currently various mechanisms that can be used to transfer personal information from the EEA and UK to the United States in compliance with law, such as the EU standard contractual clauses, the UK's International Data Transfer Agreement / Addendum, and the EU-U.S. Data Privacy Framework (the "Framework") and the UK extension thereto (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the Framework), these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal information to the United States or other countries. In addition to European restrictions on cross-border transfers of personal information, other jurisdictions have enacted or are considering similar cross-border data transfer restrictions and data residency requirements, any of which could increase the cost and complexity of doing business. If we cannot implement a valid compliance mechanism for cross-border data transfers, we may face increased exposure to regulatory actions, substantial fines, and injunctions against processing or transferring personal information from Europe or elsewhere. The inability to import personal information to the United States could significantly and negatively impact our business operations, including by limiting our ability to collaborate with parties that are subject to European and other data privacy and security laws, requiring us to increase our personal information processing capabilities in Europe and/or elsewhere at significant expense; increased exposure to regulatory actions; and substantial fines and penalties. Additionally, companies that transfer personal information out of the EEA and UK to other jurisdictions, particularly to the United States, are subject to increased scrutiny from regulators, individual litigants, and activist groups. Some European regulators have ordered certain companies to suspend or permanently cease certain transfers out of Europe for allegedly violating the GDPR's cross-border data transfer limitations. The U.S. Department of Justice has issued a rule titled "Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons," which places additional restrictions on certain data transactions involving countries of concern (e.g., China, Russia, Iran) and covered persons that may impact certain business activities such as vendor engagements, sale or sharing of data, employment of certain individuals, and investor agreements. Violations of the rule could lead to significant civil and criminal fines and penalties. The rule applies regardless of whether data is anonymized, key-coded, pseudonymized, de-identified or encrypted, which presents particular challenges for companies like ours and may impact our ability to transfer data in connection with certain transactions or agreements. Our employees and personnel use generative AI and/or automated decision-making technologies to perform their work, and the disclosure and use of personal information in AI technologies is subject to various privacy laws and other privacy obligations. Governments have passed and are likely to pass additional laws regulating AI and/or automated decision-making technologies. Our use of such technologies could result in additional compliance costs, regulatory investigations and actions, and consumer lawsuits. If we are unable to use AI and/or automated decision-making technologies, it could make our business less efficient and result in competitive disadvantages. We also use AI and machine learning ("ML") to assist us in making certain decisions, which is regulated by certain privacy laws. Due to inaccuracies or flaws in the inputs, outputs, or logic of the AI/ML, the model could be biased and could lead us to make decisions that could bias certain individuals (or classes of individuals), and adversely impact their rights, employment, and ability to obtain certain pricing, products, services, or benefits. In addition to data privacy and security laws, privacy advocates and industry groups have proposed, and may propose in the future, standards with which we are legally or contractually bound to comply. For example, we may also be subject to the Payment Card Industry Data Security Standard ("PCI DSS"). The PCI DSS requires companies to adopt certain measures to ensure the security of cardholder information, including using and maintaining firewalls, adopting proper password protections for certain devices and software, and restricting data access. Noncompliance with PCI DSS can result in penalties ranging from $5,000 to $100,000 per month by credit card companies, litigation, damage to our reputation, and revenue losses. We may also rely on vendors to process payment card data, who may be subject to PCI DSS, and our business may be negatively affected if our vendors are fined or suffer other consequences as a result of PCI DSS noncompliance. We are also bound by contractual obligations related to data privacy and security, and our efforts to comply with such obligations may not be successful. For example, certain data privacy and security laws, such as the EU/UK GDPR and the CCPA, require us to impose specific contractual restrictions on our service providers. We also publish privacy policies, marketing materials and other statements, such as compliance with certain certifications or self-regulatory principles, regarding data privacy and security. If these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, or misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators or other adverse consequences. Obligations related to data privacy and security (and consumers' data privacy and security expectations) are quickly changing in an increasingly stringent fashion and creating regulatory uncertainty. These obligations may be subject to differing applications and interpretations, which may be inconsistent or in conflict among jurisdictions. Preparing for and complying with these obligations requires us to devote significant resources (including, without limitation, financial and time-related resources), which may necessitate changes to our information technologies, systems, and practices and to those of any third parties with whom we work. In addition, these obligations may require us to change our business model. Although we endeavor to comply with all applicable data privacy and security obligations, we may at times fail (or be perceived to have failed) to do so. Moreover, despite our efforts, our personnel or third parties with whom we work may fail to comply with such obligations, which could impact our compliance posture and business operations. If we or the third parties with whom we work fail, or are perceived to have failed, to address or comply with applicable data privacy and security obligations, we could face significant consequences. These consequences may include, but are not limited to, government enforcement actions (e.g., investigations, fines, penalties, audits, inspections, and similar); litigation (including class-related claims) and mass arbitration demands; additional reporting requirements and/or oversight, bans on processing personal information; orders to destroy or not use personal information; and imprisonment of company officials. In particular, plaintiffs have become increasingly active in bringing privacy-related claims against companies, including class claims and mass arbitration demands. Some of these claims allow for the recovery of statutory damages on a per violation basis, and, if viable, carry the potential for monumental statutory damages, depending on the volume of data and the number of violations. Any of these events could have a material adverse effect on our reputation, business, or financial condition, including but not limited to: loss of customers, interruptions or stoppages in our business operations, inability to process personal information or to operate in certain jurisdictions, limited ability to develop or commercialize our products, expenditure of time and resources to defend any claim or inquiry, adverse publicity, or revision or restructuring of our business model or operations.

Our primary strategy to grow our revenue is to take a stepwise approach to market our products across key stakeholders in flow cytometry and cell analysis, such as academic and government institutions, CROs, pharmaceutical companies and clinical laboratories. While the number of customers using our products has increased in recent years, many academic and government institutions, CROs, pharmaceutical companies and clinical laboratories have not yet adopted our products, and such institutions and companies may choose not to adopt our products for a number of reasons, including: - inadequate recruiting or training of talented sales force in existing and new markets to facilitate outreach and further adoption and awareness of our products;- lack of experience with our products for cell analysis;- perceived inadequacy of evidence supporting benefits or cost-effectiveness of our products over existing alternatives;- liability risks generally associated with the use of new products and processes;- the training required to use new products;- a decrease or delay in the research and development activities using our products;- competing products and alternatives; and - introduction of other novel alternative products for cell analysis. We believe that educating notable industry key opinion leaders, representatives of academic and government institutions, CROs, pharmaceutical companies and clinical laboratories about the merits and benefits of our products for flow cytometry and cell analysis is one of the key elements to increasing the adoption of our products. If these institutions and companies do not adopt our products for any reason, including those listed above, our ability to execute our growth strategy will be impaired, and it will negatively affect our business, financial condition, prospects and results of operations.

We currently rely on third-party vendors for our shipping. If we are not able to negotiate acceptable pricing and other terms with these entities or they experience performance problems or other difficulties, it could negatively impact our operating results and our customers' experience. Additionally, our manufacturing operations in Fremont and San Diego, California; Seattle, Washington; Wuxi, China; and Singapore require global shipping services which are subject to certain factors outside of our control, such as increased costs due to fuel surcharges or otherwise, delays passing through customs, disruptions to global shipping routes and fuel scarcity. Geopolitical conflicts and/or regional instability may impact any of the foregoing; for example, fuel surcharges have been announced and, in some cases implemented, by logistics vendors globally, in response to the ongoing and escalating conflicts in the Middle East, and such conflicts may also lead to delays or logistics difficulties in the future. We experienced shipping delays and difficulties due to the COVID-19 pandemic and may again experience such delays or difficulties due to future pandemics, other infectious disease outbreaks or natural disasters. Moreover, there is no guarantee that our systems will not become damaged or lost in transit, and we have experienced, and expect to continue to experience, delivery difficulties. If a system is damaged in transit, it may result in a substantial delay in the fulfillment of the customer's order, and depending on the type and extent of the damage and whether the incident is covered by insurance, it may result in customer dissatisfaction and a substantial financial loss for us. If our products are not delivered in a timely fashion or are lost during the delivery process, our customers could also become dissatisfied and cease using our products or services, which would adversely affect our business, financial condition, results of operations and prospects. Additionally, delays in shipping could have an adverse impact on our ability to recognize revenue in a timely manner, which could have an adverse impact on our quarterly results of operations.

Our success depends on our ability to provide reliable, high-quality products that enable high-content and high-sensitivity cell analysis through flexible, efficient and cost-effective solutions. Our instruments are complex in design and involve a highly complex and precise manufacturing process. As a result of the technological complexity of our systems, changes in our or our suppliers' manufacturing processes or the inadvertent use of defective materials by us or our suppliers could result in an adverse effect on our ability to achieve acceptable manufacturing yields and product reliability. To the extent that we do not achieve and maintain our projected yields or product reliability, our business, operating results, financial condition and customer relationships would be adversely affected. We provide warranties on a majority of our product sales, and reserves for estimated warranty costs are recorded during the period of sale. The determination of such reserves requires us to make estimates of failure rates and expected costs to repair or replace the products under warranty. We typically establish warranty reserves based on historical warranty costs for each product line. If actual repair and replacement costs differ significantly from our estimates, adjustments to cost of sales may be required in future periods which could have an adverse effect on our results of operations. Our customers may discover defects in our products after the products have been fully installed and operated. In addition, some of our products include components from other vendors, which may contain latent defects. As a result, should problems occur, it may be difficult to identify the source of the problem. If we are unable to identify and fix defects or other problems, we could experience, among other things: - loss of customers or orders;- increased costs of warranty expenses;- damage to our brand reputation;- failure to attract new customers;- diversion of development, engineering and manufacturing resources;- regulatory actions by governmental authorities; and - legal actions by our customers. We believe that customers in our target markets are likely to be particularly sensitive to product defects and errors. Our reputation and the public image of our products, services and technologies may be impaired if our products or services fail to perform as expected. If our products do not perform, or are perceived to not have performed, as expected or favorably in comparison to competitive products, our operating results, reputation, and business will suffer, and we may also be subject to legal claims arising from product limitations, errors, or inaccuracies. Any of the foregoing could have an adverse effect on our business, financial condition and results of operations. Although our products are tested prior to shipment, defects or errors could nonetheless occur. Our operating results depend on our ability to execute and, when necessary, improve our quality management strategy and systems and our ability to effectively train and maintain our employee base with respect to quality management. A failure of our quality control systems could result in problems with facility operations or preparation or provision of products. In each case, such problems could arise for a variety of reasons, including equipment malfunction, failure to follow specific protocols and procedures, problems with raw materials or environmental factors and damage to, or loss of, manufacturing operations. We provide a one-year assurance-type warranty on our instruments. Existing and future warranties place us at the risk of incurring future repair and/or replacement costs. At the time revenue is recognized, we establish an accrual for estimated warranty expenses based on historical data and trends of product reliability and costs of repairing and replacing defective products. We exercise judgment in estimating the expected product warranty costs, using data such as the actual and projected product failure rates, estimated repair costs, freight, material, labor and overhead costs. While we believe that historical experience provides a reliable basis for estimating such warranty cost, unforeseen quality issues or component failure rates could result in future costs in excess of such estimates, or alternatively, improved quality and reliability in our products and consumables could result in actual expenses that are below those currently estimated. As of March 31, 2026, we had accrued approximately $1.4 million in expenses relating to product warranty accruals. Substantial amounts of warranty claims could have an adverse effect on our business, financial condition and results of operations. Even after any underlying concerns or problems are resolved, any lingering concerns in our target markets regarding our technology or any manufacturing defects or performance errors in our products or services could continue to result in lost revenue, delayed market acceptance, damage to our reputation and claims against us.

We are exposed to the risk that our employees, independent contractors, consultants, commercial partners, distributors and vendors may engage in fraudulent or illegal activity. Misconduct by these parties could include intentional, reckless or negligent conduct or disclosure of unauthorized activities to us that violates: (1) the laws of the FDA and other similar regulatory bodies, including those laws requiring the reporting of true, complete and accurate information to such regulators, (2) manufacturing standards, (3) healthcare fraud and abuse laws in the United States and similar foreign fraudulent misconduct laws, or (4) laws that require the true, complete and accurate reporting of financial information or data. These laws may impact, among other things, future sales, marketing and education programs. In particular, the promotion, sales and marketing of healthcare items and services, as well as certain business arrangements in the healthcare industry, are subject to extensive laws designed to prevent fraud, kickbacks, self-dealing and other abusive practices. These laws and regulations may restrict or prohibit a wide range of pricing, discounting, marketing and promotion, structuring and commissions, certain customer incentive programs and other business arrangements generally. We have adopted a code of business conduct and ethics that applies to our directors, officers and employees, but it is not always possible to identify and deter misconduct by our employees and other third parties, and the precautions we take to detect and prevent these activities may not be effective in controlling unknown or unmanaged risks or losses or in protecting us from governmental investigations or other actions or lawsuits stemming from a failure to be in compliance with such laws or regulations. If any such actions are instituted against us and we are not successful in defending ourselves or asserting our rights, those actions could result in the imposition of significant fines or other sanctions, including the imposition of civil, criminal and administrative penalties, damages, monetary fines, disgorgement, imprisonment, additional integrity reporting and oversight obligations, possible exclusion from participation in Medicare, Medicaid and other federal healthcare programs, contractual damages, reputational harm, diminished profits and future earnings and curtailment of operations, any of which could adversely affect our ability to operate our business and our results of operations. Whether or not we are successful in defending against any such actions or investigations, we could incur substantial costs, including legal fees and reputational harm, and divert the attention of management in defending ourselves against any of these claims or investigations, which could harm our business, financial condition and results of operations.

A substantial amount of our revenues is derived from international operations, and we anticipate that a significant portion of our sales will continue to come from outside the United States in the future. The revenues we report with respect to our operations outside the United States may be adversely affected by fluctuations in foreign currency exchange rates. See the section titled "Management's Discussion and Analysis of Financial Condition and Results of Operations" for additional information on the financial impact of exchange rate fluctuations and the ways and extent to which we may attempt to address any impact. Any hedging activities we engage in may only offset a portion of the adverse financial impact resulting from unfavorable changes in foreign currency exchange rates. We cannot predict with any certainty changes in foreign currency exchange rates or the degree to which we can mitigate these risks.