Dynavax (DVAX) Risk Analysis

As we manage our production capabilities for HEPLISAV-B and CpG 1018 adjuvant to support recent market share gains and other initiatives, we have been, and in the future could be, required to make significant financial commitments at our contract manufacturing organizations ("CMOs"), including minimum purchase commitments and prepayments of purchase orders to facilitate the procurement of raw materials and the incurrence of various manufacturing costs. Because of minimum or advance purchase commitments and uncertainty about the expected demand for HEPLISAV-B or CpG 1018 adjuvant, the financial commitments we make to our CMOs to support manufacturing may not be recovered in their entirety, or at all, if our customers do not ultimately purchase from us at expected volumes, or other concessions are made by us. Capacity reservation fees are generally not recoverable if we do not use the capacity we have reserved as a result of lower than expected demand, or otherwise. Similarly, prepayments of purchase orders may not be recoverable if we do not ultimately require the entire volume subject to the applicable purchase order. As a result, we could end up making financial commitments that we never recover if demand for HEPLISAV-B or CpG 1018 adjuvant does not materialize in the volumes we are expecting or at all. This may require us to record certain charges or write-offs in one or more fiscal periods, which in turn could result in significant, unexpected fluctuations in our quarterly and annual operating results, and potentially have a material adverse effect on our results of operations, and financial condition. For example, in August and October 2022, we entered into amendments to the Clover Supply Agreement, which, among other things, modified the scope of the Clover Supply Agreement to reduce certain quantities of CpG 1018 adjuvant that we originally intended to deliver in accordance with a purchase order previously issued by Clover. As a result of the concessions made in the amendments to the Clover Supply Agreement, prior financial commitments made to certain CMOs to manufacture quantities of CpG 1018 adjuvant to fulfill the original Clover purchase order, and reduced demand for CpG 1018 adjuvant, we recorded write-offs of $13.9 million of CpG 1018 adjuvant raw materials inventory and $20.4 million of finished goods inventory during the year ended December 31, 2022. Relating to our Bio E Supply Agreement, we entered into an amendment and an assignment agreement in April 2023, pursuant to which (i) CEPI forgave the entirety of remaining amounts outstanding relating to the Bio E CEPI Advance Payments for CpG 1018 Materials allocated to Bio E and has assumed our previous rights to collect $47.4 million of Bio E accounts receivable, (ii) we collected $14.5 million from Bio E, resulting in no accounts receivable balance as of December 31, 2024 and June 30, 2025, and (iii) we derecognized a $47.4 million CEPI accrual in connection with the Bio E CEPI Advance Payments. It is possible we may have similar write-offs in the future. During the six months ended June 30, 2025, we recorded an allowance for doubtful accounts of approximately $11.0 million relating to the contract asset recognized for Clover. This determination was based on our evaluation of credit risk associated with Clover, driven by the formal termination by the GAVI of its advanced purchase agreement option with Clover on April 24, 2025, Clover's recent write-down of the carrying value of its CpG 1018 Materials, and Clover's liquidity position, as reflected by cash and cash equivalents reported in Clover's audited consolidated statement of financial position as of December 31, 2024.

Clinical trials, including post-marketing studies, to generate sufficient data to meet FDA and other regulatory authority requirements are expensive and time consuming, may take more time to complete than expected, may not be completed at all, and may not have favorable outcomes if they are completed. In addition, results from smaller, earlier stage clinical studies may not be representative of larger, controlled clinical trials that would be required in order to obtain regulatory approval of a product candidate. Each of our clinical trials requires the investment of substantial planning, expense and time and the timing of the commencement, continuation and completion of these clinical trials may be subject to significant delays relating to various causes, including scheduling conflicts with participating clinicians and clinical institutions, difficulties in identifying and enrolling participants who meet trial eligibility criteria, failure of participants to complete the clinical trial, delay or failure to obtain Institutional Review Board ("IRB"), Ethics Committee or regulatory approval to conduct a clinical trial at a prospective site, unexpected adverse events and shortages of available vaccine or component supply. Participant enrollment is a function of many factors, including the size of the relevant population, the proximity of participants to clinical sites, the eligibility criteria for the trial, the existence of competing clinical trials and the availability of alternative or new treatments. Failure of one or more product candidates to successfully advance through to approval and licensure could result in the loss of unrecoverable costs expended and impact our ability to generate future revenue from such products, either of which, or both of which, could have an adverse impact on our business.

The biopharmaceutical patent environment outside the U.S. is also uncertain. We may be particularly affected by this uncertainty since several of our product candidates or our collaborators' vaccine candidates may initially address market opportunities outside the U.S., where we may only be able to obtain limited patent protection, if any at all. For example, while many countries such as the U.S. permit method of use patents or patent claims relating to the use of drug products, in some countries the law relating to patentability of such use claims is evolving, or may prohibit certain activities, and may be unfavorably interpreted to prevent us from successfully prosecuting some or all of our pending patent applications. There are some countries that currently do not allow such method of use patents or patent claims, or that significantly limit the types of uses, claims or subject matter that are patentable. Patents are of national or regional effect. Filing, prosecuting and defending patents on all of our products and product candidates in all countries throughout the world would be prohibitively expensive, and our intellectual property rights in some countries outside the U.S. can be less extensive than those in the U.S. In addition, the laws of some foreign countries do not protect intellectual property rights to the same extent as federal and state laws in the U.S. Consequently, we may not be able to prevent third parties from practicing our inventions in all countries outside the U.S. or from selling or importing products made using our inventions in and into the U.S. or other jurisdictions. Competitors may use our technologies in jurisdictions where we have not obtained patent protection to develop their own products and, further, may export otherwise infringing products to territories where we have patent protection, but enforcement is not as strong as that in the U.S. These competitor products may compete with our products and product candidates, and our patents or other intellectual property rights may not be effective or sufficient to prevent them from competing. Geo-political actions in the U.S. and in foreign countries could increase the uncertainties and costs surrounding the prosecution or maintenance of our patent applications or those of any current or future licensors and the maintenance, enforcement or defense of our issued patents or those of any current or future licensors. Various companies have encountered significant problems in protecting and defending intellectual property rights in foreign jurisdictions. The legal systems of many countries do not favor the enforcement of patents and other intellectual property protection, particularly those relating to pharmaceuticals, which could make it difficult for us to stop the infringement of our patents or marketing of competing products in violation of our proprietary rights. Various countries outside the U.S. have compulsory licensing laws under which a patent owner may be compelled to grant licenses to third parties. In addition, many countries limit the enforceability of patents against government agencies or government contractors. As a result, a patent owner may have limited remedies in certain circumstances, which could materially diminish the value of such patent. If we are forced to grant a license to third parties with respect to any patents relevant to our business, our competitive position may be impaired, and our business, financial condition, results of operations and prospects may be adversely affected. Accordingly, our efforts to enforce our intellectual property rights around the world may be inadequate to obtain a significant commercial advantage from the intellectual property that we develop or license. Further, the standards applied by the USPTO, foreign patent offices and other adjudicating bodies in granting and/or adjudicating patents are not always applied uniformly or predictably. As such, we do not know the degree of future protection that we will have on our products and product candidates.

Periodic maintenance fees, renewal fees, annuity fees and various other governmental fees on patents and/or applications are due to be paid to the U.S. Patent and Trademark Office and various governmental patent agencies outside of the U.S. in several stages over the lifetime of the patents and/or applications. We employ reputable law firms and other professionals to help us comply, and in many cases an inadvertent lapse can be cured by payment of a late fee or by other means in accordance with the applicable rules. However, there are situations in which non-compliance can result in abandonment or lapse of the patent or patent application, resulting in partial or complete loss of patent rights in the relevant jurisdictions, and in such an event, our competitors might be able to enter the market.

Many of our employees or consultants may have been previously employed in other biopharmaceutical companies, including our competitors or potential competitors. Some of these individuals executed proprietary rights, non-disclosure and non-competition agreements in connection with such previous employment or engagements. Although no claims against us are currently pending, we may be subject to claims that these employees or consultants or we have inadvertently or otherwise used or disclosed trade secrets or other proprietary information of their former employers or clients. Litigation may be necessary to defend against these claims. If we fail in defending such claims, in addition to paying monetary damages, we may lose valuable intellectual property rights or personnel. A loss of key research personnel or their work product could hamper our ability to develop and ultimately commercialize, or prevent us from developing and commercializing, our product candidates, which could severely harm our business. Even if we are successful in defending against these claims, litigation could result in substantial costs and be a distraction to management. We may rely, in some circumstances, on trade secrets and confidentiality agreements to protect our technology. Although trade secrets are difficult to protect, wherever possible, we use confidential disclosure agreements to protect the proprietary nature of our technology. Our standard practice is to require each of our collaborators, commercial partners, employees, consultants, contractors and advisors to enter into an agreement before beginning their employment, consulting or advisory relationship with us that in general provides that the individuals must keep confidential and not disclose to other parties any of our confidential information developed or learned by the individuals during the course of their relationship with us except in limited circumstances. These agreements with employees, consultants and contractors also generally provide that we own all inventions conceived by the individuals in the course of rendering their employment or services to us. However, there can be no assurance that these agreements will not be breached, that we will have adequate remedies for any breach, or that our trade secrets and/or proprietary information will not otherwise become known or be independently discovered by competitors. To the extent that our employees, consultants or contractors use intellectual property owned by others in their work for us, disputes may also arise as to the rights in related or resulting know-how and inventions, which could result in substantial costs which could severely harm our business.

Our current or future research and development efforts may depend in part upon our license arrangements for certain intellectual property owned by or co-owned with third parties. Our dependence on these licenses could subject us to numerous risks, such as disputes regarding the use of the licensed intellectual property and the creation and ownership of new discoveries under such license agreements. In addition, these license arrangements could require us to make timely payments to maintain our licenses and typically contain diligence or milestone-based termination provisions. Our failure to meet any obligations pursuant to such agreements could allow licensors to terminate our agreements or undertake other remedies such as converting exclusive to non-exclusive licenses if we are unable to cure or obtain waivers for such failures or amend such agreements on terms acceptable to us or at all. In addition, license agreements may be terminated or may expire by their terms, and we may not be able to maintain the exclusivity of these licenses or any rights to the underlying intellectual property. If we cannot obtain and maintain licenses that are advantageous or necessary to the development or the commercialization of our products or product candidates, we may be required to expend significant time and resources to develop or license similar technology or to find other alternatives to maintaining the competitive position of our products or product candidates. If such alternatives are not available to us in a timely manner or on acceptable terms, we may be unable to develop or commercialize certain of our products or product candidates. In the absence of a current license, we may be required to redesign our technology so it does not infringe a third-party's intellectual property (including patents), which may not be possible or could require substantial funds and time.

We have applied for, and in some cases have received, grants from various charitable, philanthropic and other organizations that, if and when received, may come with certain pricing requirements, global access requirements, reporting requirements or other covenants that require us to make the funded product available worldwide and on a nondiscriminatory basis. For example, we received such an initial grant from the Bill and Melinda Gates Foundation in 2020 to help fund the potential scale-up of production of our CpG 1018 adjuvant that may be required in the event the CpG 1018 adjuvant is included in any approved and commercially available vaccine, whether a COVID-19 vaccine or otherwise. Covenants in these types of grants may limit the price we can charge for any funded product and may involve a license to use technology we own that is included in the funded products if we do not comply. Such price limitations or licenses, if invoked, could serve to limit the prices we charge, or our control over the manufacturing and distribution of grant-funded products. Failure to agree to such requirements, may result in us not receiving some or all of the grant.

Our activities, and the activities of our agents, including some contracted third parties, are subject to extensive government regulation and oversight both in the U.S. and in foreign jurisdictions. Our interactions with physicians and others in a position to prescribe or purchase our products are subject to a legal regime designed to prevent healthcare fraud and abuse and off-label promotion. We also are subject to laws pertaining to transparency of transfers of value to healthcare providers; privacy and data protection; compliance with industry voluntary compliance guidelines; and prohibiting the payment of bribes. Relevant U.S. laws include: - the federal Anti-Kickback Statute, which prohibits persons from, among other things, knowingly and willfully soliciting, receiving, offering or paying remuneration, directly or indirectly, in exchange for or to induce either the referral of an individual for, or the purchase, order or recommendation of, any good or service for which payment may be made under federal health care programs, such as the Medicare and Medicaid programs;- federal false claims laws, including the False Claims Act and Civil Monetary Penalties Law, which prohibit individuals or entities from, among other things, knowingly presenting, or causing to be presented, claims for payment to the government or its agents that are false or fraudulent;- the Federal Food, Drug and Cosmetic Act and governing regulations which, among other things, prohibit off-label promotion of prescription drugs;- the federal Physician Payments Sunshine Act created under the Patient Protection and Affordable Care Act of 2010, as amended by the Health Care and Education and Reconciliation Act of 2010 (collectively, "ACA") which requires certain manufacturers of drugs, devices, biologics and medical supplies to report annually to the Centers for Medicare & Medicaid Services, information related to payments and other transfers of value to physicians (defined to include doctors, dentists, optometrists, podiatrists and chiropractors), other health care professionals (such as physician assistants and nurse practitioners), and teaching hospitals, and ownership and investment interests held by such physicians and their immediate family members;- the federal Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), which created, among other things, new federal criminal statutes that prohibit knowingly and willfully executing, or attempting to execute, a scheme to defraud any healthcare benefit program, or knowingly and willfully falsifying, concealing or covering up a material fact or making any materially false statement, in connection with the delivery of, or payment for, healthcare benefits, items or services;- HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act, and their implementing regulations, which imposes certain requirements on "covered entities," including certain healthcare providers, health plans, and healthcare clearinghouses, and their respective "business associates" that create, receive, maintain or transmit individually identifiable health information for or on behalf of a covered entity as well as their covered subcontractors relating to the privacy, security, and transmission of individually identifiable health information;- the Foreign Corrupt Practices Act, which prohibits the payment of bribes to foreign government officials and requires that a company's books and records accurately reflect our transactions; and - foreign and state law equivalents of each of the federal laws described above, such as anti-kickback and false claims laws which may apply to items or services reimbursed by state health insurance programs or any third-party payor, including commercial insurers; state laws that require pharmaceutical companies to comply with the pharmaceutical industry's voluntary compliance guidelines and the applicable compliance guidance promulgated by the federal government; state laws that require drug manufacturers to report information on the pricing of certain drugs; state and local laws that require the registration of pharmaceutical sales representatives; and state and foreign laws governing the privacy and security of health information, many of which differ from each other in significant ways and often are not preempted by HIPAA. In the U.S., the Office of Inspector General for the Department of Health and Human Services, the Department of Justice, states' Attorneys General and other governmental authorities actively enforce the laws and regulations discussed above. These entities also coordinate extensively with the FDA, using legal theories that connect violations of the Federal Food, Drug and Cosmetic Act (such as off-label promotion) to the eventual submission of false claims to government healthcare programs. Prosecution of such promotion cases under the False Claims Act provides the potential for private parties (qui tam relators, or "whistleblowers") to initiate cases on behalf of the government and provides for significantly higher penalties upon conviction. In the U.S., pharmaceutical and biotechnology companies have been the target of numerous government prosecutions and investigations alleging violations of law, including claims asserting impermissible off-label promotion of pharmaceutical products, payments intended to influence the referral of federal or state health care business, submission of false claims for government reimbursement, or submission of incorrect pricing information. Violations of any of the laws described above or any other applicable governmental regulations and other similar foreign laws may subject us, our employees or our agents to significant criminal, civil and administrative penalties, including fines, civil monetary penalties, exclusion from participation in government health care programs (including, in the U.S., Medicare and Medicaid), disgorgement, imprisonment, additional reporting requirements and oversight if we become subject to a corporate integrity agreement or similar agreement to resolve allegations of non-compliance with these laws and the restriction or restructuring of our operations, any of which could adversely affect our ability to operate our business and our financial results. Additionally, whether or not we have complied with the law, an investigation into alleged unlawful conduct may cause us to incur significant expense, cause reputational damage, divert management time and attention, and otherwise adversely affect our business. While we have developed and instituted a corporate compliance program, we cannot guarantee that we, our employees, our consultants, contractors, or other agents are or will be in compliance with all applicable U.S. or foreign laws.

In the ordinary course of business, we process personal data and other sensitive information, including our proprietary and confidential business data, trade secrets, intellectual property, data we may collect about trial participants in connection with clinical trials, and other sensitive data. Our data processing activities subject us to numerous data privacy and security obligations, such as various laws, regulations, guidance, industry standards, external and internal privacy and security policies, contracts, and other obligations that govern the processing of personal data by us and on our behalf. In the U.S., federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws). In the past few years, numerous U.S. states-including California, Virginia, Colorado, Connecticut, and Utah-have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights may include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 ("CPRA") (collectively, "CCPA") requires businesses to provide specific disclosures in privacy notices and honor requests of California residents to exercise certain privacy rights. The CCPA provides for civil penalties of up to $7,500 per intentional violation and allows private litigants affected by certain data breaches to recover significant statutory damages. Similar laws are being considered in several other states, as well as at the federal and local levels. These developments may further complicate compliance efforts and may increase legal risk and compliance costs for us and the third parties upon whom we rely. We may be subject to new laws governing the privacy of consumer health data, including reproductive, sexual orientation, and gender identity privacy rights. For example, Washington's My Health My Data Act ("MHMD") broadly defines consumer health data, places restrictions on processing consumer health data (including imposing stringent requirements for consents), provides consumers certain rights with respect to their health data, and creates a private right of action to allow individuals to sue for violations of the law. Other states are considering and may adopt similar laws. California also recently passed a law protecting privacy of abortion-related records and other reproductive healthcare services. These laws would also apply to our employees in the respective states. Outside the U.S., an increasing number of laws, regulations, and industry standards may govern data privacy and security. For example, the EU's General Data Protection Regulation ("EU GDPR"), the UK's General Data Protection Regulation ("UK GDPR"), Brazil's General Data Protection Law (Lei Geral de Proteção de Dados Pessoais, or "LGPD") (Law No. 13,709/2018), and China's Personal Information Protection Law ("PIPL") impose strict requirements for processing personal data. For example, under the EU GDPR, companies may face temporary or definitive bans on data processing and other corrective actions; fines of up to 20 million Euros or 4% of annual global revenue, whichever is greater; or private litigation related to processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests. Regulators in the U.S. are also increasingly scrutinizing certain personal data transfers and may impose data localization requirements, for example, the Biden Administration's executive order Preventing Access to Americans' Bulk Sensitive Personal Data and U.S. Government-Related Data by Countries of Concern. Outside the U.S., certain jurisdictions have enacted data localization and cross-border data transfer laws, which could make it more difficult to transfer information across jurisdictions. In particular, the European Economic Area ("EEA") and the UK have significantly restricted the transfer of personal data to the U.S. and other countries whose privacy and data security laws they believe not to offer an adequate level of protection. Although there are currently various mechanisms that may be used to transfer personal data from the EEA and the UK to the U.S. in compliance with law, such as the EU and UK's standard contractual clauses, the U.K.'s International Data Transfer Agreement/Addendum and the EU-U.S. Data Privacy Framework and the U.K. extension thereto (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the Framework), these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the U.S. If we are unable to implement a legal mechanism to ensure that our transfers of personal data from the EEA or the U.K. are lawful, we could face adverse consequences, including increased exposure to regulatory actions, substantial fines and penalties and injunctions against processing or transferring personal data, and could be required to increase our data processing capabilities in the EEA, the U.K. or elsewhere at significant expense. Restrictions on our ability to transfer personal data from the EEA, the U.K. or elsewhere could impact our clinical trial activities in the EEA or the U.K. and limit our ability to collaborate with CROs and other third parties. We are also bound by contractual obligations related to data privacy and security, and our efforts to comply with such obligations may not be successful. For example, certain privacy laws, such as the GDPR and the CCPA, require our customers to impose specific contractual restrictions on their service providers. We publish privacy policies, marketing materials and other statements, such as compliance with certain certifications or self-regulatory principles, regarding data privacy and security. If these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair or misrepresentative of our practices, we may face adverse consequences, which may include but are not limited to, governmental enforcement actions (e.g., investigations, fines, penalties, audits, inspections, and similar), litigation (including class-related claims) and mass arbitration demands, additional reporting requirements and/or oversight, bans on processing personal data, orders to destroy or not use personal data, civil and criminal liability and imprisonment of company officials. In particular, plaintiffs have become increasingly more active in bringing privacy-related claims against companies, including class claims and mass arbitration demands. Some of these claims allow for the recovery of statutory damages on a per violation basis, and, if viable, carry the potential for monumental statutory damages, depending on the volume of data and the number of violations. Any of these events could have a material adverse effect on our reputation, business or financial condition, including but not limited to interruptions or stoppages in business operations (including our clinical trials), inability to process personal data or to operate in certain jurisdictions, limited ability to develop or commercialize our products, expenditure of time and resources to defend any claim or inquiry, or revision or restructuring of our operations. In addition, privacy advocates and industry groups have proposed, and may propose, standards with which we are legally or contractually bound to comply or may become subject to in the future. Our obligations related to privacy and data security are quickly changing and becoming increasingly stringent, creating uncertainty. These obligations may be subject to differing applications and interpretations, which may be inconsistent or in conflict among jurisdictions. Preparing for and complying with these obligations requires us to devote significant resources. These obligations may also necessitate changes to our information technologies, systems and practices and those of third parties upon which we rely. Moreover, despite our efforts, our personnel or third parties upon which we rely may fail to comply with such obligations, which could negatively impact our business operations and compliance posture. For instance, in the EU, the second Network and Information Security Directive (Directive (EU) 2022/2555, "NIS2") entered into force on 17 January 2023 and had to be transposed into the national law of each Member State by 17 October 2024. NIS2 creates a specific legal framework for the resilience and incident response capabilities of entities operating in 18 sectors, including the health sector. As a result, companies in scope are obligated to maintain robust network and information systems security measures and report any significant incidents that might impact their operations. Companies that fail to comply with NIS2 may face significant operational disruptions, legal liabilities, and regulatory penalties of a maximum of €10 million or up to 2% of the total worldwide turnover of the preceding financial year. Our employees and other personnel can use generative artificial intelligence ("AI") technologies, from time to time, in certain circumstances to perform portions of their work, and the disclosure and use of personal data in generative AI technologies is subject to various privacy laws and other privacy obligations. Governments have passed and are likely to pass additional laws regulating generative AI. Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and lawsuits. Our use of generative AI could make it more difficult to comply with various privacy laws and other privacy obligations in the U.S. and Europe and could negatively affect our ability to protect or own certain intellectual property, any or all of which may cause us to incur significant expense, cause reputational damage, and otherwise adversely affect our business.