Pulmonx (4NI) Risk Analysis

We are required to file various reports with the FDA, national competent authorities of EU Member States and comparable foreign regulatory authorities, including reports required by the MDRs and the (EU) MDR that require that we report to the regulatory authorities if our solutions may have caused or contributed to a death or serious injury or malfunctioned in a way that would likely cause or contribute to a death or serious injury if the malfunction were to recur and we have filed such reports in the past. The timing of our obligation to report is triggered by the date we become aware of the adverse event as well as the nature of the event. We may fail to report adverse events of which we become aware within the prescribed timeframe. We may also fail to recognize that we have become aware of a reportable adverse event, especially if it is not reported to us as an adverse event or if it is an adverse event that is unexpected or removed in time from the use of the product. If these reports are not filed in a timely manner, regulators may impose sanctions and we may be subject to product liability or regulatory enforcement actions, all of which will negatively affect our business, financial condition and results of operations. If we initiate a correction or removal for the Zephyr Valve to reduce a risk to health posed by it, we would be required to submit a publicly available correction and removal report to the FDA and, in many cases, similar reports to other regulatory authorities. This report could be classified by the FDA or comparable foreign regulatory authorities as a device recall which could lead to increased scrutiny by the FDA, other foreign regulatory authorities and our customers regarding the quality and safety of our solutions. Furthermore, the submission of these reports could be used by competitors against us and cause physicians to delay or cancel prescriptions, which will harm our reputation. If we assess a potential quality issue or complaint as not requiring either field action or notification, respectively, regulators may review documentation of that decision during a subsequent audit. If regulators disagree with our decision, or take issue with either our investigation process or the resulting documentation, regulatory agencies may impose sanctions and we may be subject to regulatory enforcement actions, including warning letters, all of which will negatively affect our business, financial condition and results of operations.

Sales of our products outside of the United States are subject to foreign regulatory requirements that vary widely from country to country. In addition, the FDA regulates exports of medical devices from the United States. While the regulations of some countries may not impose barriers to marketing and selling our products or only require notification, others require that we obtain the approval of a specified regulatory body. Complying with foreign regulatory requirements, including obtaining registrations, certification or approvals, can be expensive and time-consuming, and we may not receive regulatory approvals or certification in each country in which we plan to market our products, or we may be unable to do so on a timely basis. The time required to obtain registrations, certification or approvals, if required by other countries, may be longer than that required for FDA approval, and requirements for such registrations, clearances, certification or approvals may significantly differ from FDA requirements. If we modify our products, we may need to apply for additional regulatory approvals or certification before we are permitted to sell the modified product. In addition, we may not continue to meet the quality and safety standards required to maintain the authorizations or certification that we have received. If we are unable to maintain our authorizations or certification in a particular country, we will no longer be able to sell the applicable product in that country. Regulatory approval by the FDA does not ensure registration, clearance, certification or approval by regulatory authorities in other countries, and registration, clearance, certification or approval by one or more foreign regulatory authorities does not ensure registration, clearance or approval by regulatory authorities in other foreign countries or by the FDA. However, a failure or delay in obtaining registration, certification or regulatory clearance or approval in one country may have a negative effect on the regulatory process in others.

The products and services we offer are highly regulated, and there can be no assurance that the regulatory environment in which we operate will not change significantly and adversely in the future. Our arrangements with physicians, hospitals and clinics may expose us to broadly applicable fraud and abuse and other laws and regulations that may restrict the financial arrangements and relationships through which we market, sell and distribute our products and services. Federal and state healthcare laws and regulations that may affect our ability to conduct business, include, without limitation: - federal and state laws and regulations regarding billing and claims payment applicable to our solution and regulatory agencies enforcing those laws and regulations;- the federal Anti-Kickback Statute, which prohibits, among other things, any person or entity from knowingly and willfully offering, soliciting, receiving or providing remuneration, directly or indirectly, in exchange for or to induce either the referral of an individual for, or the purchase, order or recommendation of, any good or service for which payment may be made under federal healthcare programs, such as Medicare and Medicaid;- the federal false claims laws, including the FCA, which prohibit, among other things, individuals or entities from knowingly presenting, or causing to be presented, false claims, or knowingly using false statements, to obtain payment from the federal government;- federal criminal laws that prohibit executing a scheme to defraud any healthcare benefit program or making false statements relating to healthcare matters;- the federal Physician Payments Sunshine Act, created under the Patient Protection and Affordable Care Act, as amended by the Health Care and Education Reconciliation Act of 2010 (collectively, the "Affordable Care Act") and its implementing regulations, which requires certain manufacturers of drugs, medical devices, biologicals and medical supplies for which payment is available under Medicare, Medicaid, or the Children's Health Insurance Program to report annually to CMS, information related to payments or other transfers of value made to physicians (defined to include doctors, dentists, optometrists, podiatrists and chiropractors), other health care professionals (such as physician assistants and nurse practitioners) and teaching hospitals, as well as information regarding ownership and investment interests held by physicians and their immediate family members;- federal consumer protection and unfair competition laws, which broadly regulate marketplace activities and activities that potentially harm consumers;- HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act ("HITECH"), and its implementing regulations, which impose certain requirements relating to the privacy, security and transmission of individually identifiable health information on covered entities, including certain healthcare providers, health plans and healthcare clearinghouses, and their respective Business Associates that create, receive, maintain or transmit individually identifiable health information for or on behalf of a Covered Entity as well as their covered subcontractors; HIPAA also created criminal liability for, among other things, knowingly and willfully falsifying or concealing a material fact or making a materially false statement in connection with the delivery of or payment for healthcare benefits, items or services;- the Federal Drug & Cosmetic Act, which prohibits, among other things, the adulteration or misbranding of drugs, biologics and medical devices;- the federal physician self-referral prohibition, commonly known as the Stark Law, which prohibits, among other things, physicians who have a financial relationship, including an investment, ownership or compensation relationship with an entity, from referring Medicare and Medicaid patients to that entity for designated health services, which include clinical laboratory services, unless an exception applies. Similarly, entities may not bill Medicare, Medicaid or any other party for services furnished pursuant to a prohibited referral;- state law equivalents of each of the above federal laws, such as anti-kickback and false claims laws which may apply to items or services reimbursed by any third-party payor, including commercial insurers, and state and foreign laws governing the privacy and security of health information in certain circumstances, many of which differ from each other in significant ways and often are not preempted by HIPAA, thus complicating compliance efforts; and - similar healthcare laws and regulations in the European Union, the UK and other jurisdictions, including national anti-bribery laws of European countries and national rules, regulations, industry self-regulation codes reporting requirements detailing interactions with and payments to healthcare providers and laws governing the privacy and security of certain protected information, such as personal data under the General Data Protection Regulation ("GDPR"). The Affordable Care Act was enacted in 2010. The Affordable Care Act, among other things, amended the intent requirement of the federal Anti-Kickback Statute and criminal healthcare fraud statutes, including those created under HIPAA. A person or entity no longer needs to have actual knowledge of this statute or specific intent to violate it. In addition, the Affordable Care Act provides that the government may assert that a claim including items or services resulting from a violation of the federal Anti-Kickback Statute constitutes a false or fraudulent claim for purposes of the FCA. To enforce compliance with the healthcare regulatory laws, certain enforcement bodies have continued their scrutiny of interactions between healthcare companies and healthcare providers, which has led to a number of investigations, prosecutions, convictions and settlements in the healthcare industry. Responding to investigations can be time and resource-consuming and can divert management's attention from the business. Additionally, as a result of these investigations, healthcare providers and entities may have to agree to additional compliance and reporting requirements as part of a consent decree or corporate integrity agreement. Any such investigation or settlement could increase our costs or otherwise negatively affect our business, financial condition and results of operations. Even an unsuccessful challenge or investigation into our practices could cause adverse publicity and be costly to respond to. In December 2022, we received a civil investigative demand ("CID") from the U.S. Department of Justice, Civil Division ("US DOJ") in connection with an investigation under the False Claims Act. The CID requested information and documents regarding our relationships with certain health care providers, medical practices, and hospitals in connection with the sales and marketing of the Zephyr Valves and related products and services. Subsequently, on or about January 27, 2025 the US DOJ filed on behalf of itself and certain states attorneys general, a Notice of Election to Decline Intervention in and to unseal the underlying action filed by an individual (the "Relator") in U.S. District Court for the Northern District of California (the "Qui Tam Action"). In December 2025, the Company entered into a settlement agreement with the Relator with approval by the US DOJ and the various states' attorneys general who were parties to the Qui Tam Action. The Qui Tam Action was dismissed on December 22, 2025. Although we have adopted policies and procedures designed to comply with these laws and regulations and conduct internal reviews of our compliance with these laws, our activities, including those relating to the reporting of discount and rebate information and other information affecting federal, state and third-party reimbursement of our products (such as our patient reimbursement support program) and the sale and marketing of our products, may be subject to scrutiny under these laws. Because of the breadth of these laws and the narrowness of available statutory exceptions and regulatory safe harbors, it is possible that some of our activities could be subject to challenge under one or more such laws. The growth of our business and sales organization and our expansion outside of the United States may increase the potential of violating these laws or our internal policies and procedures. Any action brought against us for violation of these or other laws or regulations, even if we successfully defend against it, could cause us to incur significant legal expenses and divert our management's attention from the operation of our business. If our operations are found to be in violation of any of the federal, state and foreign laws described above or any other current or future fraud and abuse or other healthcare laws and regulations that apply to us, we may be subject to significant penalties, including significant criminal, civil, and administrative penalties, damages, fines, imprisonment for individuals, additional oversight and reporting obligations, exclusion from participation in government programs,such as Medicare and Medicaid, or comparable foreign programs, imprisonment, contractual damages, reputation harm and disgorgement and we could be required to curtail or cease our operations. Any of the foregoing consequences will negatively affect our business, financial condition and results of operations.

In the United States, the Zephyr Valve is marketed pursuant to a PMA order issued by the FDA. Any modifications to a PMA-approved device that could significantly affect its safety or effectiveness, including significant design and manufacturing changes, or that would constitute a major change in its intended use, manufacture, design, components, or technology requires approval of a new PMA application or PMA supplement. However, certain changes to a PMA-approved device do not require submission and approval of a new PMA or PMA supplement and may only require notice to FDA in a PMA 30-Day Notice, Special PMA Supplement-Changes Being Effected or PMA Annual Report. The FDA requires every manufacturer to make this determination in the first instance, but the FDA may review any manufacturer's decision. The FDA may not agree with our decisions regarding whether new approvals are necessary. If the FDA disagrees with our determination and requires us to seek new PMA approvals for modifications to our previously approved products for which we have concluded that new approvals are unnecessary, we may be required to cease marketing or to recall the modified product until we obtain clearance or approval, and we may be subject to significant regulatory fines or penalties. Furthermore, our products could be subject to recall if the FDA determines, for any reason, that our products are not safe or effective or that appropriate regulatory submissions were not made. For those medical devices sold in the EU and for which we have obtained a CE Certificate of Conformity by a Notified Body, we must notify our Notified Body if significant changes are made to the devices or if there are substantial changes to our quality assurance systems affecting those products. In addition, if we make any substantial changes to medical devices for which we have obtained a CE Certificate of Conformity on the basis of the MDD and which we continue to place on the EU market on the basis of the transitional provisions of the MDR, we will no longer be able to benefit from the transitional provisions of the MDR. Substantial changes to such devices will trigger immediate compliance with the full regulatory framework of the MDR. Delays in receipt or failure to receive approvals or certifications, the loss of previously received approvals or certifications, or the failure to comply with any other existing or future regulatory requirements, could reduce our sales, profitability and future growth prospects.

Even though we have obtained approval for the Zephyr Valve, we are subject to ongoing and pervasive regulatory requirements governing, among other things, the manufacture, marketing, advertising, medical device reporting, sale, promotion, registration, and listing of devices. For example, we must submit periodic reports to the FDA as a condition of PMA approval. These reports include safety and effectiveness information about the device after its approval. Failure to submit such reports, or failure to submit the reports in a timely manner, could result in enforcement action by the FDA. Following its review of the periodic reports, the FDA might ask for additional information or initiate further investigation. In the EU, the MDR imposes strict post-market regulatory requirements which are also applicable to those devices for which we have obtained a CE Certificate of Conformity on the basis of the MDD and which we continue to place on the EU market on the basis of the transitional provisions of the MDR. The regulations to which we are subject are complex and have become more stringent over time. Regulatory changes could result in restrictions on our ability to continue or expand our operations, higher than anticipated costs, or lower than anticipated sales. Even after we have obtained the proper regulatory approval or certification to market a device, we have ongoing responsibilities under FDA regulations and applicable foreign laws and regulations. Our failure to comply with applicable regulatory requirements could result in enforcement action by the FDA, state or foreign regulatory authorities, which will negatively affect our business, financial condition and results of operations.

If treatment guidelines for severe emphysema changes or the standard of care for this condition evolves, we may need to redesign the applicable product and seek new approvals from the FDA or comparable foreign regulatory authorities, or certification from Notified Bodies. Our PMA approvals from the FDA are based on current treatment guidelines. If treatment guidelines change so that different treatments become desirable, the clinical utility of one or more of our products could be diminished and will negatively affect our business, financial condition and results of operations.

As we grow our international presence and global operations, we will be increasingly exposed to trade and economic sanctions and other restrictions imposed by the United States, the European Union and other governments and organizations. The U.S. Departments of Justice, Commerce, State and Treasury and other federal agencies and authorities have a broad range of civil and criminal penalties they may seek to impose against corporations and individuals for violations of economic sanctions laws, export control laws, the U.S. Foreign Corrupt Practices Act ("FCPA"), and other federal statutes and regulations, including those established by the Office of Foreign Assets Control ("OFAC"). In addition, the U.K. Bribery Act of 2010 ("Bribery Act") prohibits both domestic and international bribery, as well as bribery across both private and public sectors. An organization that fails to prevent bribery by anyone associated with the organization can be charged under the Bribery Act unless the organization can establish the defense of having implemented adequate procedures to prevent bribery. Under these laws and regulations, as well as other anti-corruption laws, anti-money laundering laws, export control laws, customs laws, sanctions laws and other laws governing our operations, various government agencies may require export licenses, may seek to impose modifications to business practices, including cessation of business activities in sanctioned countries or with sanctioned persons or entities and modifications to compliance programs, which may increase compliance costs, and may subject us to fines, penalties and other sanctions. A violation of these laws or regulations would negatively affect our business, financial condition and results of operations. We have various policies and procedures designed to ensure compliance by us and our directors, officers, employees, representatives, consultants and agents with the FCPA, OFAC restrictions, the Bribery Act and other export control, anti-corruption, anti-money-laundering and anti-terrorism laws and regulations. We cannot assure you, however, that our policies and procedures are or will be sufficient or that directors, officers, employees, representatives, consultants and agents have not engaged and will not engage in conduct for which we may be held responsible, nor can we assure you that our business partners have not engaged and will not engage in conduct that could materially affect their ability to perform their contractual obligations to us or even result in our being held liable for such conduct. Violations of the FCPA, OFAC restrictions, the Bribery Act or other export control, anti-corruption, anti-money laundering and anti-terrorism laws or regulations may result in severe criminal or civil sanctions, and we may be subject to other liabilities, which could negatively affect our business, financial condition and results of operations.

We operate in a global economy, which includes utilizing third-party suppliers in several countries outside the U.S. There is inherent risk, based on the complex relationships among the U.S. and the countries in which we conduct our business, that political, diplomatic, and national security factors can lead to global trade restrictions and changes in trade policies and export regulations that may adversely affect our business and operations. The current international trade and regulatory environment is subject to significant ongoing uncertainty. The U.S. government has announced substantial new tariffs affecting a wide range of products and jurisdictions and has indicated an intention to continue developing new trade policies. In response, certain foreign governments have announced or implemented retaliatory tariffs and other protectionist measures. Because we rely on a global sourcing strategy and significant international sales, significant changes or developments in U.S. and international laws and policies, such as laws and policies surrounding international trade, foreign affairs, manufacturing and development and investment in the territories and countries where we or our customers operate, could increase our costs, increase our customers' costs and adversely impact our customers' business and financial condition, make our products less competitive in the U.S. and other markets affected by such actions, and materially adversely affect our business and financial condition. Current or future tariffs or other retaliatory trade measures may raise the costs of raw materials, components or finished goods, which may impact our product sales, manufacturing costs, and operational expenses. Such cost increases may reduce our margins or require us to increase prices. Any price increases could harm our competitive position, reduce customer demand and damage customer relationships. We may also experience supply chain disruptions as a result of increased costs and uncertainty. Unlike many industries, our ability to pass increased costs to customers is limited by the structure of medical device pricing and reimbursement systems. Many of our products' pricing are established through annual or multi-year contracts with commercial, third-party payors, customers, and group purchasing organizations, and reimbursement methodologies established by government programs, such as Medicare. These arrangements typically include fixed pricing terms that were negotiated prior to the implementation of the recently announced tariffs. As a result, and depending on the timing and scope of the implementation of these tariffs, cost increases due to tariffs may be difficult or impossible to pass through to customers until the next negotiation cycle, which could be up to 36 months away. Current or future tariffs will also result in increased research and development expenses, including with respect to increased costs associated with raw materials, laboratory equipment and research materials and components. Trade restrictions affecting the import of materials necessary for clinical trials could result in delays to our development timelines. Increased development costs and extended development timelines could place us at a competitive disadvantage compared to companies operating in regions with more favorable trade relationships and could reduce investor confidence and negatively impact our business, results of operations, financial condition and growth prospects. The evolving trade environment may also contribute to broader macroeconomic and financial market weakness, including overall decreased spending, inflationary pressures affecting interest rates, exchange rate volatility, financial market instability, and economic recessions or downturns, which may result in decreased demand for our products, increased operational costs, difficulties raising capital, and limit expansion opportunities with existing customers. Ongoing tariff uncertainty and related legal challenges, as well as trade restrictions and macroeconomic uncertainty has and may continue to contribute to volatility in the price of our common stock. The complexity of the announced or future tariffs may also increase the risk that we or our customers or suppliers may be subject to civil or criminal enforcement actions in the U.S. or foreign jurisdictions related to compliance with trade regulations. Foreign governments may also adopt non-tariff measures, such as informal disincentives to engage with, purchase from or invest in U.S. entities, or may take other retaliatory actions against U.S. entities, such as decreased intellectual property protection, increased enforcement actions, or delays in regulatory approvals, which may result in heightened international legal and operational risks. In addition, the U.S. and other governments have imposed and may continue to impose additional sanctions, such as trade restrictions or trade barriers, which could restrict us from doing business directly or indirectly in or with certain countries or parties and may impose additional costs and complexity to our business. We cannot predict how current or future developments in tariff and other trade policies will evolve and the extent to which they will affect our business, operations and financial condition. Additionally, the Bureau of Industry and Security, U.S. Department of Commerce, has recently initiated an investigation to determine whether medical devices, including their components and accessories, manufactured outside the United States pose a national security risk and should be subject to additional tariffs. While we continue to monitor this investigation and the other developments described above, the full impact of these risks remains uncertain and any prolonged economic downturn, escalation in trade tensions, or deterioration in international perception of U.S.-based companies could materially and adversely affect our business, results of operations, financial condition and prospects. In addition, trade developments have and may continue to heighten the risks related to the other risk factors described elsewhere in this Quarterly Report on Form 10-Q.

Our products may be subject to U.S. export controls. Governmental regulation of the import or export of our products, or our failure to obtain any required import or export authorization for our products, when applicable, will harm our international sales and adversely affect our revenue. Compliance with applicable regulatory requirements regarding the export of our products may create delays in the introduction of our products in international markets or, in some cases, prevent the export of our products to some countries altogether. Furthermore, U.S. export control laws and economic sanctions prohibit the shipment of certain products and services to countries, governments and persons targeted by U.S. sanctions. If we fail to comply with export and import regulations and such economic sanctions, we may be fined or other penalties could be imposed, including a denial of certain export privileges. Moreover, any new export or import restrictions, new legislation or shifting approaches in the enforcement or scope of existing regulations, or in the countries, persons or technologies targeted by such regulations, could result in decreased use of our products by, or in our decreased ability to export our products to existing or potential customers with international operations. Any decreased use of our products or limitation on our ability to export or sell access to our products would likely negatively affect our business, financial condition and results of operations.

Healthcare laws and regulations change frequently and may change significantly in the future. We may not be able to adapt our operations to address every new regulation, and new regulations may negatively affect our business, financial condition and results of operations. We cannot assure you that a review of our business by courts or regulatory authorities would not result in a determination that adversely affects our revenue and operating results, or that the healthcare regulatory environment will not change in a way that restricts our operations. In addition, there is risk that the U.S. Congress may implement changes in laws and regulations governing healthcare service providers, including measures to control costs, or reductions in reimbursement levels, which may negatively affect our business, financial condition and results of operations. The federal government is considering ways to change, and has changed, the manner in which healthcare services are paid for in the United States. CMS establishes Medicare payment levels for hospitals and physicians on an annual basis, which can increase or decrease payment to such entities. CMS, as well as insurers, have increased their efforts to control the cost, utilization and delivery of healthcare services. From time to time, the U.S. Congress has considered and implemented changes in the CMS fee schedules in conjunction with budgetary legislation. Further reductions of reimbursement by CMS for services or changes in policy regarding coverage of tests or other services provided or other requirements for payment, such as prior authorization or a physician's or qualified practitioner's signature on test/service requisitions, may be implemented from time to time. Individual states may also enact legislation that impacts Medicaid payments to hospitals and physicians. Reductions in the reimbursement rates and changes in payment policies of other third-party payors may occur as well. Similar changes in the past have resulted in reduced payments as well as added costs and have added more complex regulatory and administrative requirements. Further changes in federal, state, local and third-party payor regulations or policies may negatively affect our business, financial condition and results of operations. Actions by agencies regulating insurance or changes in other laws, regulations, or policies may also negatively affect our business, financial condition and results of operations. In addition to changes to the regulatory environment in the United States, there have been changes to the regulatory environment in certain foreign jurisdiction in which we operate. For example, the European Union Medical Device Regulation (Regulation (EU) 2017/745) ("MDR") became applicable in 2021 and includes transitional provisions that have been subject to multiple amendments. We are currently placing our medical devices on the market in accordance with the requirements of the MDR, including the stringent requirements of the transitional provisions of the MDR which, among other conditions require continuous compliance with the requirements of the European Union Medical Devices Directive (Council Directive 93/42/EEC) ("MDD") and the guidance of the European Commission's Medical Devices Coordination Group. For those devices that we place on the market in the EU on the basis of the transitional provisions of the MDR, we intend to complete conformity assessment procedures for such medical devices in accordance with the MDR prior to the expiration of our existing CE Certificate(s) of Conformity issued by our Notified Body, BSI, issued on the basis of the MDD, in accordance with the transitional provisions of the MDR. The changes to the regulatory system implemented in the EU by the MDR include stricter requirements for clinical evidence and pre-market assessment of safety and performance, new classifications to indicate risk levels, requirements for third party testing by Notified Bodies, tightened and streamlined quality management system assessment procedures and additional requirements for the quality management system, additional requirements for traceability of products and transparency as well a refined responsibility of economic operators. We are also required to provide clinical data in the form of a clinical evaluation report. Fulfilment of the obligations imposed by the MDR may cause us to incur substantial costs. We may be unable to fulfil these obligations for medical devices we intend to place on the EU market, or our Notified Body, where they are involved, may consider that we have not adequately demonstrated compliance with our related obligations to merit a CE Certificate of Conformity on the basis of the MDR. We must obtain the appropriate CE Certificate(s) of Conformity in accordance with the MDR to continue to place our products on the EU market, or other countries that relate their medical device regulations to a CE mark, once we can no longer benefit from the transitional provisions of the MDR. The modifications of the MDR may have an effect on the way we conduct our business in the EEA. Additional regulatory changes may negatively affect our business, financial condition and results of operations.