Charles River Labs (RV6) Risk Analysis
Risk Overview Q1, 2026
Source: the company's latest filing for the period ended Mar 28, 2026, filed May 07, 2026
Risk Change Over Time
- Cyber Security - Risk 1We have in the past experienced and in the future could experience unauthorized access into our information systems.
We operate large and complex information systems that contain significant amounts of client data. As a routine element of our business, we collect, analyze and retain substantial amounts of data pertaining to the non-clinical studies we conduct for our clients. Unauthorized third parties could attempt to gain entry to such information systems to steal data or disrupt the systems or for financial gain. Like other companies, we have on occasion experienced, and will continue to experience, threats and incursions to our data and systems, including malicious software and viruses, phishing, business email compromise and social engineering attacks, network intrusions, or other cyber-attacks. The number and complexity of these threats continue to increase over time. These threats also may be further enhanced in frequency or effectiveness through threat actors' use of artificial intelligence technologies, which are becoming more widely adopted and increasingly sophisticated. In response to past cybersecurity incidents, we have implemented additional security safeguards and continually work to enhance existing safeguards; however, such efforts may not be successful, in which case we could suffer significant harm. We are at risk of being targeted, and we have in the past been victim to, business email compromise fraud, which results in payments being made to illegitimate bank accounts. Although these instances have not resulted in our incurring material losses, if similar instances occur in the future, we may incur such losses. We have recently become aware of unauthorized access to certain information systems of the Company. The incident involved a social engineering attack in which a threat actor impersonated a trusted party and obtained employee access credentials from a small number of employees. We identified the incident and immediately activated our cyber incident response plan to contain the intrusion, assess and investigate the incident and implement remedial measures. Based on the information reviewed to date, we believe the unauthorized activity has been contained and did not result in any material disruption to our information systems. We are currently in the process of ascertaining what, if any, information was exfiltrated, including whether there was any compromise of sensitive and/or personal identifiable information contained within the accessed information systems. As of the date hereof, the Company believes that this cybersecurity incident has not had a material impact on the Company's financial systems, operations or financial condition due in part to the Company's previously implemented security safeguards. As a result of this or any cybersecurity incident, we may be subject to business disruptions or governmental investigations, private litigation or other claims, which could result in fines, other monetary relief, or injunctive relief that could materially increase our data security costs, adversely impact how we operate our systems and collect and use personal information. If, as a result of any such governmental investigation, other investigation or claim, we are found to be in violation of applicable laws and regulations including, without limitation, any applicable data privacy and information security laws or regulations, we could be subject to legal risk, including governmental enforcement action and civil litigation, which could adversely affect our business, reputation, financial condition or results of operations. Defending any such litigation claim or enforcement action, regardless of merit, and whether successful or unsuccessful, and cooperating with regulatory investigations, could be expensive and time-consuming and adversely affect our business, reputation, results of operations or financial condition. In addition, we may be adversely impacted by reputational harm or a loss of confidence in the security and integrity of our information systems among customers, employees and business partners. There can be no assurance, however, that this cybersecurity incident or any future cybersecurity incidents will not have a material impact on the Company's future operations, financial systems or financial condition. We leverage software and hardware solutions from technology and services providers, including software-as-a-service and public cloud infrastructure, who have been subject to cybersecurity incidents in the past and may have incidents or breaches in the future. As of the date of this filing, to our knowledge, no prior cybersecurity incident or breach at a third party has had a material impact on our business. However, future incidents or breaches could cause us to suffer significant harm. Our contracts with our clients typically contain provisions that require us to keep confidential the information generated from the studies we conduct. In the event the confidentiality of such information is compromised, whether by unauthorized access or other breaches, we could be exposed to significant harm, including termination of customer contracts, damage to our customer relationships, damage to our reputation and potential legal claims from customers, employees and other parties. In addition, we may face investigations by government regulators and agencies as a result of a breach. Additionally, the rapid ongoing evolution and increased adoption of emerging technologies such as artificial intelligence and machine learning may make it more difficult to anticipate and implement protective measures to recognize, detect, and prevent the occurrence of any of the cyber events described above. For information regarding our processes and practices related to information and cybersecurity, please see our Annual Report on Form 10-K for fiscal year 2025 as filed with the SEC on February 18, 2026, specifically Section 1C "Cybersecurity".
Risk Highlights Q1, 2026
Risk Word Cloud
Risk Factors Full Breakdown - Total Risks 41
- Regulation - Risk 1Any failure by us to comply with applicable regulations and related guidance could harm our reputation and operating results, and compliance with new regulations and guidance may result in additional costs.
Any failure on our part to comply with applicable regulations could result in the termination of ongoing research or the disqualification of data for submission on behalf of our clients to regulatory authorities. This could harm our reputation, our prospects for future work and our operating results. For example, the issuance of a notice of objectionable observations or a warning letter from the FDA based on a finding of a material violation affecting data integrity by us for GLP or cGMP requirements that are not addressed to the regulatory monitoring authorities' satisfaction could materially and adversely affect us. If our operations are found to violate any applicable law or other governmental regulations, we might be subject to civil and criminal penalties, damages and fines or the temporary closure of our facilities. Any action against us for violation of these laws or regulations, even if we successfully defend against it, could cause us to incur significant legal expenses, divert our management's attention from the operation of our business and damage our reputation. Where applicable, our clients expect us to timely deliver their non-clinical data compliant with the FDA's SEND (Standardization for Exchange of Nonclinical Data) standards. Notwithstanding, some of these standards require additional operating and capital expenses that will impact not only us and our industry competitors, but clients in the biomedical research community. Non-compliance with any of these expectations could lead to official action by a government authority, damage to our reputation and a potential loss of business. In addition, regulations and guidance worldwide concerning the production and use of research animals for research purposes continue to evolve. Similarly, guidance has been and continues to be developed for other areas that impact the biomedical research community on both a national and international basis including transportation, mandated contingency planning, euthanasia guidance, import and export requirements of biological materials, health monitoring requirements and the use of disinfectants. Our Cell Solutions business is subject to complex regulation by federal, state and local governments in the U.S. This business requires us to obtain many licenses, permits, authorizations, accreditations, approvals, and certificates to fully comply with appropriate regulations. Federal, state and local regulations do change, requiring prompt adoption to remain in a constant state of compliance. Changes in the regulations could require us to alter how we operate our business, potentially resulting in a significantly increased cost of compliance. Our donor collection center is registered with the FDA and the FDA periodically conducts inspections of those facilities and operations. At the conclusion of each inspection, the FDA provides us with a list of objectionable conditions and practices observed during the inspection that could result in additional enforcement actions. Failure to comply with the regulations enforced by the FDA could result in sanctions and/or remedies and have a material adverse effect on us.
- Regulation - Risk 2We are required to comply with stringent, complex and evolving laws, rules, regulations and standards in many jurisdictions, as well as contractual obligations, relating to data privacy and security. Any actual or perceived failure to comply with these requirements could have a material adverse effect on our business.
We are required to comply with stringent, complex and frequently evolving laws, rules, regulations and standards in many jurisdictions, as well as contractual obligations, relating to data privacy and security. Ensuring that our collection, use, transfer, storage and other processing of personal information complies with such requirements can increase operating costs, impact the development of new products or services, and reduce operational efficiency. Internationally, virtually every jurisdiction in which we operate has established its own data privacy and security legal framework with which we must comply. For example, we are required to comply with the European Union (EU) General Data Protection Regulation (GDPR), which imposes stringent obligations regarding the collection, control, use, sharing, disclosure and other processing of personal data of individuals within the EU and European Economic Area (EEA). EU member states may also impose additional requirements in relation to personal data through their national implementing legislation. The EU GDPR also imposes specific restrictions on the transfer of personal data to countries outside of the EU and EEA, including the use of appropriate safeguards to enable such transfers, such as Standard Contractual Clauses (SCCs) and the EU- US Data Privacy Framework (DPF). Although these mechanisms are currently valid for purposes of transferring personal data, they could be subject to legal challenges and there is no assurance that we could satisfy or rely on these measures to lawfully transfer personal data. If we are otherwise unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we provide our services, the geographical location or segregation of our relevant systems and operations, and could adversely affect our financial results. While we have implemented controls and procedures to comply with the requirements of the EU GDPR, such procedures and controls may not be effective in ensuring compliance or preventing unauthorized transfers of personal data. Additionally, we are subject to the privacy and data protection laws of the UK, including the UK Data Protection Act of 2018 (UK GDPR). Similar to the EU GDPR, the UK GDPR imposes restrictions on the processing of personal data, as well as transfers of personal data from the UK to other countries. Failure to comply with the EU and/or the UK GDPR can result in significant fines and other liability. Similarly, we are subject to the privacy and data protection laws of China, including the Personal Information Protection Law (PIPL) and Data Security Law (DSL), which promulgated requirements relating to the collection, processing, transfer and security of personal information in or from China. Violations of the PIPL or DSL could result in fines and penalties, suspension of data transfers, cancellation of business authorizations, personal liability for responsible company officers, as well as criminal and civil liability. In the event that the PIPL requires us to store data in China, or limits our ability to transfer data across borders, we may experience increased costs and business inefficiencies. Fines, corrective actions, or other penalties asserted due to alleged noncompliance may impose additional financial or operational costs, limit our ability to attract and retain local talent, or limit our ability to do business in China. In the US, there are numerous federal and state data privacy and security laws, rules, and regulations governing the collection, use, disclosure, retention, security, transfer, storage and other processing of personal information, including federal and state data privacy laws, data breach notification laws, and data disposal laws. For example, at the federal level, we are subject the regulations of the Federal Trade Commission, which has the authority to regulate and enforce against unfair or deceptive acts or practices in or affecting commerce, including acts and practices with respect to data privacy and security. If our public statements about our use, collection, disclosure and other processing of personal information are alleged to be deceptive, unfair or misrepresentative of our actual practices, we may be subject to potential government or legal investigation or action. If we are found to have violated applicable laws or regulations, we may also be subject to penalties, fines, damages, injunctions or other outcomes that may adversely affect our operations and financial results. The United States Congress also has considered, and may in the future consider, various proposals from time to time for comprehensive federal data privacy legislation to which we may become subject if passed and which may adversely affect our operations and financial results. At the state level, we are subject to laws and regulations like the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). The CCPA and CPRA create transparency requirements for companies, grant California residents various rights with regard to their personal information, and impose additional data protection obligations on companies doing business in California. Failure to comply with the CCPA and CPRA may result in, among other things, significant civil penalties and injunctive relief, or potential statutory or actual damages. The CCPA and CPRA also provide a private right of action for data breaches that result in the loss of personal information. The CCPA and CPRA may impact our business activities and require compliance costs that adversely affect business, operating results, prospects and financial condition. These state statutes, and other similar state or federal laws that may be enacted in the future may require us to modify our data processing practices and policies, incur substantial compliance-related costs and expenses, and otherwise suffer adverse impacts on our business. Additionally, while collecting research products from donors, we may collect, use, disclose, maintain and transmit donor information in ways that will be subject to many of the numerous state, federal and international laws and regulations governing the collection, use, disclosure, storage, transmission or confidentiality of patient-identifiable health information. We have made changes to, and investments in, our business practices and will continue to monitor developments and make appropriate changes to help attain compliance with these evolving and complex laws, rules, regulations and standards. Any actual or perceived failure to comply with any such laws, rules, regulations, standards or contractual obligations could subject us to denial of the right to conduct business, significant fines, civil or criminal penalties, costly litigation (including class actions), government investigation or inquiries, enforcement actions, claims, proceedings, judgements, awards, penalties, sanctions or other adverse impacts that could have a material adverse effect on our business.
- Regulation - Risk 3Significant developments or changes in national laws or policies to protect or promote domestic interests and/or address foreign competition can have an adverse effect on our business and financial statements.
Significant developments or changes in national laws or policies to protect or promote domestic interests and/or address foreign competition, including laws and policies in areas such as trade, manufacturing, government purchasing, healthcare, intellectual property, regulatory enforcement and investment/development, can adversely affect our business and financial statements. The U.S. has experienced a rapid increase in new government regulations, including tariffs and proposed tariffs on imports from a wide range of markets and geographies, including some in which we operate. These tariffs/proposed tariffs have prompted retaliatory tariffs by a number of countries and a cycle of retaliatory tariffs by both the U.S. and other countries. We continue to monitor the global tariff environment and potential trade conflicts, sanctions and impediments that could impact our business. As of the date of this report a number of tariffs remain in effect, including significant tariffs between the U.S. and countries from which we obtain significant supply, such as Vietnam, Mauritius, Cambodia, and China. Collectively, this may adversely impact our operating margin and results of operations, for example, our costs and expenses related to our business activities and those of our customers and suppliers; demand for our products and our competitive positioning; the availability to us of certain products in certain countries; and our supply chain operations. Though the risks identified above in certain cases have already adversely impacted part of our business, the full impact of these tariffs and other actions on the Company and on our business partners remains highly uncertain and subject to rapid change.
- Regulation - Risk 4Changes in government regulation or in practices relating to the pharmaceutical or biotechnology industries, including potential healthcare reform, could decrease the need for the services we provide.
Governmental agencies throughout the world strictly regulate the drug development process. Our business involves helping our customers navigate these regulatory processes. Accordingly, many regulations, and often new regulations, are expected to result in higher regulatory standards and often additional revenues for companies that service these industries. Some changes in regulations, including the relaxation of certain requirements or the use of streamlined or expedited approval procedures, may reduce the scope of preclinical testing needed. Other changes that increase regulatory obligations or affect the competitiveness of our services may lessen the demand for certain offerings. For example, in December 2022, the FDA Modernization Act 2.0 was passed, which clarified the methods manufacturers and sponsors may use to investigate the safety and efficacy of a drug. In April 2025, the FDA announced its intention to expand the use of scientifically supported cell-based approaches and other new approach methodologies (NAMs), such as organ-on-chip systems, computational modeling, and advanced in vitro assays, in preclinical safety studies; in October 2025, the FDA announced its intention to streamline the approval process for biosimilar drug development and indicated further announcements related to reducing animal testing requirements may be forthcoming; and in November 2025, the U.K. government announced a roadmap to phasing out animal testing in favor of alternative methods. Eliminating the use of animals in research may have material adverse effects on our business, results of operations, or financial condition. While there have been significant advancements in the development of alternative methods, the complete elimination of animals in research will be a gradual process that may take many years to achieve. While we are committed to working with the industry to support development and to provide the best translational models to supplement or replace traditional models as part of our Replacement, Reduction, and Refinement (3Rs) initiative, the use of animals in research is highly regulated and proposed changes to current regulations will need to be carefully evaluated to ensure that they do not compromise the safety and efficacy of new drugs and medical treatments. Although we believe we are currently in compliance in all material respects with applicable national, regional and local laws, as well as other accepted guidance used by oversight bodies (including the USDA, the standards set by the International Air Transport Association, the Convention on International Trade in Endangered Species of Wild Fauna and Flora, USFWS, The Centers for Disease Control, the Department of Transportation, the Department of State, the office of Laboratory Animal Welfare of NIH, the Drug Enforcement Agency, as well as numerous other oversight agencies in the jurisdictions in which we operate), failure to comply could subject us to denial of the right to conduct business, fines, criminal penalties and other enforcement actions. For additional discussion of the factors specifically affecting our non-human primates including related oversight trade compliance agencies, please see the sections entitled "Item 1A. Risk Factors – Industry Risk Factors - Several of our product and service offerings, including our non-human primate supply, are dependent on a limited source of supply that, when interrupted, adversely affects our business", and "Item 3. Legal Proceedings" included elsewhere in this Form 10-K. In addition, if regulatory authorities were to mandate a significant reduction in safety assessment procedures that utilize research animals (as has been advocated by certain groups), certain segments of our business could be materially adversely affected. Implementation of healthcare reform legislation, including certain provisions of the Inflation Reduction Act, may offer some benefits, but may also introduce costs or changes that affect the potential financial returns associated with developing new drugs. This could adversely affect R&D expenditures by pharmaceutical and biotechnology companies, which could in turn decrease the business opportunities available to us both in the U.S. and abroad. In addition, new laws or regulations may create a risk of liability, increase our costs or limit our service offerings. Furthermore, if health insurers were to change their practices with respect to reimbursements for pharmaceutical products, our clients may spend less or reduce their growth in spending on R&D. While it is not possible to predict whether and when any such changes will occur, updates at the local, state or federal level, or to laws and regulations in foreign jurisdictions where we operate or maintain business relationships, may materially affect our domestic and/or international operations. Furthermore, modifications to international trade policy, public company reporting requirements, environmental regulation and antitrust enforcement may have a materially adverse impact on us, our suppliers or our clients.
See a full breakdown of risk according to category and subcategory. The list starts with the category with the most risk. Click on subcategories to read relevant extracts from the most recent report.