Keros Therapeutics (KROS) Risk Analysis

We are a "smaller reporting company," as defined in the Securities Exchange Act of 1934, as amended, or the Exchange Act, and we intend to take advantage of certain exemptions from various reporting requirements that are applicable to other public companies that are not "smaller reporting companies," including reduced disclosure obligations regarding executive compensation in our periodic reports and proxy statements. We are also a non-accelerated filer and are not required to comply with the auditor attestation requirements of Section 404(b) of the Sarbanes-Oxley Act of 2002. Our internal controls over financial reporting will not receive the level of review provided by the process relating to the auditor attestation included in annual reports of issuers that are subject to these requirements. We cannot predict if investors will find our common stock less attractive because we may rely on these exemptions. If some investors find our common stock less attractive as a result, there may be a less active trading market for our common stock and our stock price may be more volatile. We may take advantage of these reporting exemptions until we are no longer a "smaller reporting company." We will remain a "smaller reporting company" until (a) the aggregate market value of our outstanding common stock held by non-affiliates as of the last business day of our most recently completed second fiscal quarter is $250 million or more and we reported annual net revenues as of our most recently completed fiscal year of $100 million or more, or (b) the aggregate market value of our outstanding common stock held by non-affiliates as of the last business day of our most recently completed second fiscal quarter is $700 million or more, regardless of annual revenue.

We are required, pursuant to Section 404 of the Sarbanes-Oxley Act, to assess the effectiveness of our internal control over financial reporting annually and disclosure controls and procedures quarterly. In particular, we must perform system and process evaluation and testing of our internal control over financial reporting to allow management to report on the effectiveness of our internal control over financial reporting, as required by Section 404 of the Sarbanes-Oxley Act. When we become an accelerated filer or large accelerated filer, our independent registered public accounting firm will be required to attest to the effectiveness of our internal control over financial reporting. The rules governing the standards that must be met for management to assess our internal control over financial reporting are complex and require significant documentation, testing and possible remediation. To comply with the requirements of being a reporting company under the Exchange Act, we will need to implement additional financial and management controls, reporting systems and procedures and hire additional accounting and finance staff. We cannot assure you that there will not be material weaknesses or significant deficiencies in our internal control over financial reporting in the future. Any failure to maintain internal control over financial reporting could severely inhibit our ability to accurately report our financial condition, results of operations or cash flows. If we are unable to conclude that our internal control over financial reporting is effective, or if our independent registered public accounting firm determines we have a material weakness or significant deficiency in our internal control over financial reporting, investors may lose confidence in the accuracy and completeness of our financial reports, the market price of our common stock could decline, and we could be subject to sanctions or investigations by the Nasdaq Stock Market, the SEC or other regulatory authorities. Failure to remedy any material weakness in our internal control over financial reporting, or to implement or maintain other effective control systems required of public companies, could also restrict our future access to the capital markets.

As a public company, we will incur significant legal, accounting and other expenses that we did not incur as a private company. The Sarbanes-Oxley Act of 2002, as amended, or the Sarbanes-Oxley Act, the Dodd-Frank Wall Street Reform and Consumer Protection Act, the listing requirements of the Nasdaq Stock Market and other applicable securities rules and regulations impose various requirements on public companies, including establishment and maintenance of effective disclosure and financial controls and corporate governance practices. Our management and other personnel will need to devote a substantial amount of time to these compliance initiatives. Moreover, we expect these rules and regulations to substantially increase our legal and financial compliance costs and to make some activities more time-consuming and costly. For example, we expect that these rules and regulations may make it more difficult and more expensive for us to obtain director and officer liability insurance and we may be required to incur substantial costs to maintain sufficient coverage. We are evaluating these rules and regulations, and cannot predict or estimate the amount or timing of additional costs we may incur or the timing of such costs. The impact of these requirements could also make it more difficult for us to attract and retain qualified persons to serve on our board of directors, our board committees or as executive officers. The increased costs may require us to reduce costs in other areas of our business or increase the prices of our services. Moreover, these rules and regulations are often subject to varying interpretations, in many cases due to their lack of specificity, and, as a result, their application in practice may evolve over time as new guidance is provided by regulatory and governing bodies. This could result in continuing uncertainty regarding compliance matters and higher costs necessitated by ongoing revisions to disclosure and governance practices.

In the ordinary course of business, we process personal data and other sensitive information. Our data processing activities subject us to numerous data privacy and security obligations, such as various laws, regulations, guidance, industry standards, external and internal privacy and security policies, contractual requirements and other obligations relating to data privacy and security. In the United States, numerous federal and state laws and regulations, including federal and state health information privacy laws, state data breach notification laws, and federal and state consumer protection laws (including Section 5 of the Federal Trade Commission Act) and other similar laws (e.g., wiretapping laws), that govern the collection, use, disclosure and protection of health information and other personal information could apply to our operations or the operations of our collaborators. In addition, we obtain health information from third parties, including research institutions from which we obtain clinical trial data, that are subject to privacy and security requirements under HIPAA, as amended by HITECH, which imposes specific requirements relating to the privacy, security, and transmission of individually identifiable protected health information. Depending on the facts and circumstances, we could be subject to civil, criminal and administrative penalties and fines if we violate HIPAA. In addition, certain state and foreign laws govern the privacy and security of health information in certain circumstances, some of which are more stringent than U.S. federal law and many of which differ from each other in significant ways and may not have the same effect, thus complicating compliance efforts. Numerous U.S. states have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018, or the CCPA, applies to personal data of consumers, business representatives, and employees who are California residents, and requires businesses to provide specific disclosures in privacy notices and honor requests of such individuals to exercise certain privacy rights. The CCPA provides for fines and allows private litigants affected by certain data breaches to recover significant statutory damages. The CCPA and other comprehensive U.S. state privacy laws exempt some data processed in the context of clinical trials, but these developments may further complicate compliance efforts, and increase legal risk and compliance costs for us and the third parties with whom we work. Similar laws are being considered in several other states, as well as at the federal and local levels, and we expect more states to pass similar laws in the future. Other laws and regulations also apply to our business model. We are subject to new laws governing the privacy of consumer health data. For example, Washington's My Health My Data Act, or MHMD, broadly defines consumer health data, places restrictions on processing consumer health data (including imposing stringent requirements for consents), provides consumers certain rights with respect to their health data, and creates a private right of action to allow individuals to sue for violations of the law. Other states have passed, are considering and may adopt similar laws. Additionally, under various privacy laws and other obligations, we may be required to obtain certain consents to process personal data. For example, some of our data processing practices may be challenged under wiretapping laws, if we obtain consumer information from third parties through various methods, including cookies, chatbot and session replay providers, or via third-party marketing pixels. These practices may be subject to increased challenges by class action plaintiffs. Our inability or failure to obtain consent for these practices could result in adverse consequences, including class action litigation and mass arbitration demands. Outside the United States, an increasing number of laws, regulations, and industry standards govern data privacy and security. For example, the EU's General Data Protection Regulation, or EU GDPR, the United Kingdom's GDPR, or UK GDPR (collectively referred to as the GDPR), and China's Personal Information Protection Law impose strict requirements for processing personal data. For example, under the GDPR, companies may face temporary or definitive bans on data processing and other corrective actions; fines of up to €20 million under the EU GDPR, 17.5 million pounds sterling under the UK GDPR, or in each case, 4% of annual global revenue, whichever is greater; or private litigation related to processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests. In the ordinary course of business, we transfer personal data from Europe and other jurisdictions to the United States or other countries. Europe and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal data to other countries. In particular, the European Economic Area, or the EEA, and the UK have significantly restricted the transfer of personal data to countries whose privacy laws it believes are inadequate. Other jurisdictions may adopt or have already adopted similarly stringent data localization and cross-border data transfer laws. Although there are currently various mechanisms that may be used to transfer personal data from the EEA and UK to the United States in compliance with law, such as the EU-U.S. Data Privacy Framework and the UK Extension to the EU-U.S. Data Privacy Framework, under which we have self-certified to allow for transfers from the EEA and/or UK to the United States, these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the United States. If there is no lawful manner for us to transfer personal data from the EEA, the UK or other jurisdictions to the United States, or if the requirements for a legally-compliant transfer are too onerous, we could face significant adverse consequences, including the interruption or degradation of our operations, the need to relocate part of or all of our business or data processing activities to other jurisdictions (such as Europe) at significant expense, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors and other third parties, and injunctions against our processing or transferring of personal data necessary to operate our business. Additionally, companies that transfer personal data out of the EEA and UK to other jurisdictions, particularly to the United States, are subject to increased scrutiny from regulators, individual litigants, and activist groups. Some European regulators have ordered certain companies to suspend or permanently cease certain transfers out of Europe for allegedly violating the GDPR's cross-border data transfer limitations. Regulators in the United States, such as the Department of Justice, are also increasingly scrutinizing certain personal data transfers and have proposed and may enact certain data localization requirements, for example, the Biden Administration's executive order Preventing Access to Americans' Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern. Additionally, the U.S. Department of Justice issued a rule entitled the Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons, which places additional restriction on certain data transactions involving countries of concern (e.g., China, Russia, Iran) and covered persons (i.e., individuals and entities who are designated as such by the U.S. Attorney General or considered "foreign persons" and are majority owned by, organized under the laws of, a primary resident in, or a contractor of, a covered person or country of concern, as applicable) that may impact certain business activities such as vendor engagements, sale or sharing of data, employment of certain individuals and investor agreements. Violations of the rule could lead to significant civil and criminal fines and penalties. The rule applies regardless of whether data is anonymized, key-coded, pseudonymized, de-identified or encrypted, which presents particular challenges for companies like ours and may impact our ability to enter into certain transactions or agreements. Laws such as these give rise to an increasingly complex set of compliance obligations on us. These data protection rules continue to evolve and may result in ever-increasing regulatory and public scrutiny and escalating levels of enforcement and sanctions and increased costs of compliance. We strive to comply with these rules and obligations to the extent possible. Such compliance is a rigorous and time-consuming process. We are also bound by contractual obligations related to data privacy and security, and our efforts to comply with such obligations may not be successful. We publish privacy policies, marketing materials, whitepapers and other statements, such as statements related to compliance with certain certifications or self-regulatory principles, concerning data privacy and security. Although we endeavor to comply with our policies and other documentation, we may at times fail to do so or may be perceived to have failed to do so. Regulators in the United States are increasingly scrutinizing these statements, and if these policies, materials, statements or documentation are found to be deficient, lacking in transparency, deceptive, unfair, misleading or misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators or other adverse consequences. Obligations related to data privacy and security (and individuals' data privacy expectations) are quickly changing, becoming increasingly stringent and creating uncertainty. Additionally, these obligations are subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions. Preparing for and complying with these obligations requires us to devote significant resources. These obligations may necessitate changes to our services, information technologies, systems, and practices and to those of any third parties that process personal data on our behalf. In addition, these obligations may require us to change our business model. We may at times fail (or be perceived to have failed) in our efforts to comply with our data privacy and security obligations. Moreover, despite our efforts, our personnel or third parties with whom we work on may fail to comply with such obligations, which could negatively impact our business operations. If we or the third parties with whom we work fail, or are perceived to have failed, to address or comply with applicable data privacy and security obligations, we could face significant consequences, including but not limited to: government enforcement actions (e.g., investigations, fines, penalties, audits and inspections); litigation (including class action claims) and mass arbitration demands; additional reporting requirements and/or oversight; bans or restrictions on processing personal data; orders to destroy or not use personal data; and imprisonment of company officials. In particular, plaintiffs have become increasingly more active in bringing privacy-related claims against companies, including class claims and mass arbitration demands. Some of these claims allow for the recovery of statutory damages on a per violation basis, and, if viable, carry the potential for monumental statutory damages, depending on the volume of data and the number of violations. Any of these events could have a material adverse effect on our reputation, business, or financial condition, including but not limited to: interruptions or stoppages in our business operations (including clinical trials); inability to process personal data or to operate in certain jurisdictions; limited ability to develop or commercialize our products; expenditure of time and resources to defend any claim or inquiry; adverse publicity; or substantial changes to our business model or operations. Our employees and personnel use generative AI technologies to perform their work, and the disclosure and use of personal information in AI technologies is subject to various privacy laws and other privacy obligations. Governments have passed and are likely to pass additional laws regulating AI. Our use of this technology could result in additional compliance costs, regulatory investigations and actions and lawsuits. If we are unable to use AI, it could make our business less efficient and result in competitive disadvantages. Compliance with U.S. and foreign data protection laws and regulations could require us to take on more onerous obligations in our contracts, increase our costs of legal compliance, restrict our ability to collect, use and disclose data, or in some cases, impact our or our partners' or suppliers' ability to operate in certain jurisdictions. Failure to comply with these laws and regulations could result in government investigations and/or enforcement actions (which could include civil, criminal and administrative penalties), private litigation and/or adverse publicity and could negatively affect our operating results and business. Moreover, clinical trial subjects, employees and other individuals about whom we or our potential collaborators obtain personal information, as well as the providers who share this information with us, may limit our ability to collect, use and disclose the information. Claims that we have violated individuals' privacy rights, failed to comply with data protection laws, or breached our contractual obligations, even if we are not found liable, could be expensive and time-consuming to defend and could result in adverse publicity that could harm our business.

We are exposed to potential product liability and professional indemnity risks that are inherent in the research, development, manufacturing, marketing and use of biopharmaceutical products. Currently, we have no products that have been approved for commercial sale; however, the current and future use of product candidates by us and our collaborators in clinical trials, and the potential sale of any approved products in the future, may expose us to liability claims. These claims might be made by patients who use the product, healthcare providers, pharmaceutical companies, our collaborators or others selling such products. Any claims against us, regardless of their merit, could be difficult and costly to defend and could materially adversely affect the market for our product candidates or any prospects for commercialization of our product candidates. Regardless of the merits or eventual outcome, liability claims may result in: ¦decreased demand for our products, if approved, due to negative public perception;¦injury to our reputation;¦withdrawal of clinical trial participants or difficulties in recruiting new trial participants;¦initiation of investigations by regulators;¦costs to defend or settle the related litigation;¦a diversion of management's time and our resources;¦substantial monetary awards to trial participants or patients;¦product recalls, withdrawals or labeling, marketing or promotional restrictions;¦loss of revenues from product sales; and ¦the inability to commercialize any of our product candidates, if approved. Although we believe we maintain adequate product liability insurance for our product candidates, it is possible that our liabilities could exceed our insurance coverage. We intend to expand our insurance coverage to include the sale of commercial products if we obtain marketing approval for any of our product candidates. However, we may not be able to maintain insurance coverage at a reasonable cost or obtain insurance coverage that will be adequate to satisfy any liability that may arise. If a successful product liability claim or series of claims is brought against us for uninsured liabilities or in excess of insured liabilities, our assets may not be sufficient to cover such claims and our business operations could be impaired. Should any of the events described above occur, this could have a material adverse effect on our business, financial condition and results of operations.

Our ability to compete in the highly competitive biotechnology and pharmaceutical industries depends upon our ability to attract, motivate and retain highly qualified managerial, scientific and medical personnel. We are highly dependent on our management and particularly on the services of our scientific personnel including Jasbir Seehra, Ph.D., our Chief Executive Officer, and Lorena Lerner, Ph.D., our Chief Scientific Officer. We believe that their drug discovery and development experience and overall biopharmaceutical company management experience would be difficult to replace. Any of our executive officers could leave our employment at any time, as all of our employees are "at-will" employees. The loss of the services of our key personnel and any of our other executive officers, key employees, and scientific and medical advisors, and our inability to find suitable replacements, could result in delays in our research and development objectives and harm our business. Recruiting and retaining qualified employees, consultants and advisors for our business, including scientific and technical personnel, also will be critical to our success. Competition for skilled personnel is intense and the turnover rate can be high. We may not be able to attract and retain personnel on acceptable terms given the competition among numerous pharmaceutical and biotechnology companies and academic institutions for skilled individuals. In addition, failure to succeed in preclinical studies, clinical trials or applications for marketing approval may make it more challenging to recruit and retain qualified personnel. The inability to recruit, or the loss of services of certain executives, key employees, consultants or advisors, may impede the progress of our research, development and commercialization objectives and have a material adverse effect on our business, financial condition, results of operations and prospects.

We have relied upon and plan to continue to rely upon third parties, including independent clinical investigators, contracted laboratories and third-party CROs, to conduct our preclinical studies and clinical trials in accordance with applicable regulatory requirements and to monitor and manage data for our ongoing preclinical and clinical programs. We rely on these parties for execution of our preclinical studies and clinical trials, and control only certain aspects of their activities. Nevertheless, we are responsible for ensuring that each of our studies and trials is conducted in accordance with the applicable protocol, legal and regulatory requirements and scientific standards, and our reliance on these third parties does not relieve us of our regulatory responsibilities. We and our third-party contractors and CROs are required to comply with good laboratory practices, or GLPs, as applicable, and GCP requirements, which are regulations and guidelines enforced by the FDA and comparable foreign regulatory authorities for conducting, recording and reporting the results of clinical trials to assure that data and reported results are credible, reproducible and accurate and that the rights, integrity, and confidentiality of trial participants are protected. Regulatory authorities enforce these GLPs and GCPs through periodic inspections of laboratories conducting GLP studies, trial sponsors, principal investigators and trial sites. If we, our investigators or any of our CROs or contracted laboratories fail to comply with applicable GLPs and GCPs, the clinical data generated in our clinical trials may be deemed unreliable and the FDA or comparable foreign regulatory authorities may require us to perform additional preclinical studies or clinical trials before approving our marketing applications. We cannot assure you that upon inspection by a given regulatory authority, such regulatory authority will determine that any of our preclinical studies or clinical trials comply with applicable GLP or GCP regulations. In addition, our clinical trials must be conducted with product, including biologic product, produced in compliance with applicable cGMP regulations. Our failure to comply with these regulations may require us to repeat preclinical studies or clinical trials, which would delay the regulatory approval process. Further, these laboratories, investigators and CROs are not our employees and we will not be able to control, other than by contract, the amount of resources, including time, which they devote to our product candidates and clinical trials. If independent laboratories, investigators or CROs fail to devote sufficient resources to the development of our product candidates, or if their performance is substandard, it may delay or compromise the prospects for approval and commercialization of any product candidates that we develop. In addition, the use of third-party service providers requires us to disclose our proprietary information to these parties, which could increase the risk that this information will be misappropriated. Our CROs have the right to terminate their agreements with us in the event of an uncured material breach. In addition, some of our CROs have an ability to terminate their respective agreements with us if it can be reasonably demonstrated that the safety of the subjects participating in our clinical trials warrants such termination, if we make a general assignment for the benefit of our creditors or if we are liquidated. Public health crises and government measures taken in response also impact our CROs, and may affect our ability to initiate and complete our preclinical studies and clinical trials. There is a limited number of third-party service providers that specialize or have the expertise required to achieve our business objectives. If any of our relationships with these third-party laboratories, CROs or clinical investigators terminate, we may not be able to enter into arrangements with alternative laboratories, CROs or investigators or to do so in a timely manner or on commercially reasonable terms. If laboratories, CROs or clinical investigators do not successfully carry out their contractual duties or obligations or meet expected deadlines, if they need to be replaced or if the quality or accuracy of the clinical data they obtain is compromised due to the failure to adhere to our preclinical or clinical protocols, regulatory requirements or for other reasons, our preclinical or clinical trials may be extended, delayed or terminated and we may not be able to obtain regulatory approval for or successfully commercialize our product candidates. As a result, our results of operations and the commercial prospects for our product candidates would be harmed, our costs could increase and our ability to generate revenues could be delayed. Switching or adding additional laboratories or CROs (or investigators) involves additional cost and requires management time and focus. In addition, there is a natural transition period when a new laboratory or CRO commences work. As a result, delays occur, which can materially impact our ability to meet our desired clinical development timelines. Though we carefully manage our relationships with our contracted laboratories and CROs, there can be no assurance that we will not encounter similar challenges or delays in the future or that these delays or challenges will not have a material adverse impact on our business, financial condition and results of operations. In addition, clinical investigators may serve as scientific advisors or consultants to us from time to time and may receive cash or equity compensation in connection with such services. If these relationships and any related compensation result in perceived or actual conflicts of interest, or the FDA or comparable foreign regulatory authorities conclude that the financial relationship may have affected the interpretation of the preclinical study or clinical trial, the integrity of the data generated at the applicable preclinical study or clinical trial site may be questioned and the utility of the preclinical study or clinical trial itself may be jeopardized, which could result in the delay or rejection by the FDA or comparable foreign regulatory authorities. Any such delay or rejection could prevent us from commercializing our clinical-stage product candidate or any future product candidates.

We may decide to establish our own sales and marketing capabilities and promote our product candidates if and when regulatory approval has been obtained in the United States or in other jurisdictions. There are risks involved if we decide to establish our own sales and marketing capabilities or enter into arrangements with third parties to perform these services. Even if we establish sales and marketing capabilities, we may fail to launch our products, if approved, effectively or to market our products effectively since we have no experience in the sales and marketing of biopharmaceutical products. In addition, recruiting and training a sales force is expensive and time-consuming and could delay any product launch. In the event that any such launch is delayed or does not occur for any reason, we would have prematurely or unnecessarily incurred these commercialization expenses, and our investment would be lost if we cannot retain or reposition our sales and marketing personnel. Factors that may inhibit our efforts to commercialize our products, if approved, on our own include: ¦our inability to recruit, train and retain adequate numbers of effective sales and marketing personnel;¦the inability of sales personnel to obtain access to or educate adequate numbers of physicians on the benefits of our products, if approved;¦the lack of complementary products to be offered by sales personnel, which may put us at a competitive disadvantage relative to companies with more extensive product lines;¦unforeseen costs and expenses associated with creating an independent sales and marketing organization; and ¦costs of marketing and promotion above those anticipated by us. If we enter into arrangements with third parties to perform sales and marketing services, our product revenues or the profitability of these product revenues to us could be lower than if we were to market and sell any products that we develop ourselves. Such collaborative arrangements with partners may place the commercialization of our products, if approved, outside of our control and would make us subject to a number of risks including that we may not be able to control the amount or timing of resources that our collaborative partner devotes to our products, if any, or that our collaborator's willingness or ability to complete its obligations, and our obligations under our arrangements may be adversely affected by business combinations or significant changes in our collaborator's business strategy. In addition, we may not be successful in entering into arrangements with third parties to sell and market our products, if approved, or may be unable to do so on terms that are favorable to us. Acceptable third parties may fail to devote the necessary resources and attention to sell and market our products, if any, effectively. If we do not establish sales and marketing capabilities successfully, either on our own or in collaboration with third parties, we may not be successful in commercializing our products, if any, which in turn would have a material adverse effect on our business, financial condition and results of operations.