Netlist (NLST) Risk Analysis

Our industry is characterized by rapid technological change, evolving industry standards and rapid product obsolescence. As a result, continuous development of new technology, processes and product innovations is necessary in order to be successful. For example, the emergence of new tools such as machine learning and AI that capitalize on the availability of large data sets is leading semiconductor manufacturers to pursue new products and approaches that exploit those tools to advance technology development. We believe the continued and timely development of new products and technologies and improvement of existing products and technologies are critical to our business and prospects for growth. In the face of uncertainty about which new technology solutions will become successful, we endeavor to focus our efforts on developing the technology changes that are ultimately successful in supporting our customers' requirements. In order to continue to develop and introduce new or enhanced products and technologies, we need to: - retain and continue to attract new engineers with expertise in memory subsystems and our other key technology competencies;- identify and adjust to the changing requirements and preferences of our existing and potential future customers and markets;- identify and adapt to emerging technological trends and evolving industry standards in our markets;- continue to develop and enhance our design tools, manufacturing processes and other technologies on which we rely to produce new products or product enhancements;- design and introduce cost-effective, innovative and performance-enhancing features that differentiate our products and technologies from those of our competitors;- secure licenses as needed to enable us to use any technologies, processes or other rights needed for the manufacture or use of any new products or product enhancements we may develop, which licenses may not be available when needed, on acceptable terms or at all;- maintain or develop new relationships with suppliers of components required for any new or enhanced products and technologies;- qualify any new or enhanced products for use in our customers' products; and - develop and maintain effective commercialization and marketing strategies. We may not be successful at any of these activities. As a result, we may not be able to successfully develop new or enhanced products or technology or we may experience delays in this process. Our failure to develop and offer the correct technology solutions in a timely manner with productive and cost-effective products could adversely affect our business in a material way. Failures or delays in product development and introduction could result in the loss of, or delays in generating, net products sales or other revenues and the loss of key customer relationships. Even if we develop new or enhanced products or technologies, they may not meet our customers' requirements, gain market acceptance or attract monetization opportunities, as our product and technology development efforts are inherently risky due to the challenges of foreseeing changes or developments in technology, predicting changes in customer requirements or preferences or anticipating the adoption of new industry standards. Moreover, we have invested significant resources in our product and technology development efforts, which would be lost if we fail to generate revenues from these efforts. If any of these risks occur, our revenues, prospects and reputation could be materially adversely affected.

There is a limited pool of experienced technical personnel that we can draw on to meet our hiring needs. As a result, a number of our existing employees, consultants or agents have worked for our existing or potential competitors at some point during their careers, and we anticipate this trend will continue. We have, and may again, be subject to claims that these persons have violated the intellectual property rights of others. Lawsuits of this type may be brought, even if there is no merit to the claim, as a strategy to prevent us from hiring qualified candidates, drain our financial resources and divert management's attention away from our business. These claims may materially and adversely affect our business, prospects and results of operations.

Our target markets are characterized by a limited number of large companies, and consolidation in one or more of these markets may further increase this concentration. As a result, sales to small numbers of customers have historically represented and currently represent a substantial portion of our net product sales, and we expect this concentration to continue. For example, for the year ended December 27, 2025, two customers represented approximately 30% and 13% of our net product sales, respectively. Additionally, the composition of major customers and their respective contributions to our net product sales have fluctuated and will likely continue to fluctuate from period to period as our existing and prospective customers progress through the life cycle of the products they produce and sell and experience resulting fluctuations in their product demand. We believe our performance depends in significant part on our ability to establish and maintain relationships with and effect substantial sales to our large customers. We generally do not have long-term agreements with our customers and, as result, any or all of them could decide at any time to decrease, delay or discontinue their purchase of our products or the component products we resell. In addition, the prices customers pay for products are subject to fluctuations, and large or key customers exert pressure on us to make concessions in the prices at which we sell products to them. Further, we may not be able to sell some of our products developed for one customer to a different customer because our products are often customized to address specific customer requirements, and even if we are able to sell these products to another customer, our margin on these products may be reduced. Additionally, although customers are generally allowed only limited rights of return after purchasing our products or the component products we resell, we may determine that it is in our best interest to accept returns from certain large or key customers even if we are not contractually obligated to accept them in order to maintain good relations with these customers. Any returns beyond our expectations could negatively impact our operating results. Moreover, because a few customers often account for a substantial portion of our net product sales, the failure of any one of these customers to pay on a timely basis would negatively impact our cash flows. Our net product sales and operating results could be materially and adversely affected by the loss of any of our customers, particularly our large or key customers. A decrease in product sales to any of our customers, including as a result of normal fluctuations in demand or other factors, reductions in the prices at which we sell products to any of our customers, including as a result of price concessions or general declines in average sale prices, or difficulties collecting payments from any of our customers could materially and adversely harm our business and results of operations. In periods of tight supply, customers may adjust ordering behavior and pricing expectations; as supply improves, concentrated customers may seek price reductions or other concessions, which could adversely affect revenue and margins. Our ability to maintain or increase our product sales to our large or key customers also depends on a variety of factors, many of which are beyond our control. These factors include our customers' sales of servers and other computing systems that incorporate our memory subsystems, our customers' continued incorporation of our products or the component products we resell into their systems, and our customers' sales activity and business results. Because of these and other factors, sales to these customers may not continue and the amount of such sales may not reach or exceed historical levels in any future period. The loss of a major customer or a reduction in sales to or difficulties in collecting payments from these customers could significantly reduce our net sales and adversely affect our operating results.

We primarily market and sell our products and the component products we resell through a direct sales force and a network of independent sales representatives. We have expended significant resources to build our internal sales and marketing function, but compared to many of our competitors, we have relatively little experience creating a sales and marketing platform and developing a team to implement it. We may be unsuccessful in these efforts. Our sales representatives generally may terminate their relationships with us at any time. As a result, our performance depends in part on our ability to retain existing and attract additional sales representatives that will be able to effectively market and support our products or the component products we resell, especially in markets in which we have not previously distributed these products. Our efforts to attract, train and retain these sales representatives to be knowledgeable about our industry, products and technologies are costly and time-consuming. If these efforts fail, our investments in these sales representatives may not produce the expected or any benefits and our ability to market and sell our products or the component products we resell may be limited, which could materially harm our financial condition and operating results. Further, our reliance on independent sales representatives subjects us to risks, as we have very little control over their activities and they are generally free to market and sell other, potentially competing, products. As a result, these independent sales representatives could devote insufficient time or resources to marketing our products or the component products we resell, could market them in an ineffective manner or could otherwise be unsuccessful in selling adequate quantities of these products.

We rely on third parties to manufacture our products, the products we resell and, in some instances, to design or manufacture, the products we sell or resell. The ability and willingness of third parties to enter into these engagements with us and perform in accordance with these engagements is largely outside our control. One or more of our design or manufacturing partners may experience a manufacturing or supply disruption for any number of factors including labor disruptions, catastrophic weather events, political instability, acts of terror or war, pandemics and health crisis, labor or supply shortages and military hostilities. These third parties can also fail to dedicate adequate resources to the production of our products, the components we resell, or otherwise fail to perform their obligations to us in a timely manner or at satisfactory quality levels. In these circumstances, our ability to bring products to market or to deliver products to our customers, as well as our reputation, our business and prospects could be materially harmed. There are a limited number of third parties that manufacture and supply the products and product components that we sell or resell. In the event of a failure by our manufacturers, we may have no readily available alternative source of supply for these components, since, in our experience, the lead time needed to establish a relationship with a new design or manufacturing partner is substantial, and the time for our OEM customers to re-qualify our products with components from a new vendor is also significant. Additionally, even if an alternative manufacturer is available, we may not be able to engage the manufacturer on acceptable terms, which could result in increased costs, timing requirements or other adverse changes. Further, we may not be able to redesign the customized components used in our products to be manufactured by a new manufacturer, in which case we could infringe on the intellectual property of our current design or manufacturing partner when we manufacture the products with a new design or manufacturing partner. Such an occurrence could force us to stop selling certain of our products or could expose us to lawsuits, license payments or other liabilities. Our dependence on third-party manufacturers exposes us to many other risks, including, among others: reduced control over delivery schedules, quality, manufacturing yields and costs; the potential lack of adequate capacity during periods of excess demand; limited warranties on products supplied to us; and potential infringement or misappropriation of our intellectual property or the intellectual property of others. We are dependent on our manufacturing partners to manufacture with acceptable quality and manufacturing yields, to deliver these components to us on a timely basis and at an acceptable cost and to allocate a portion of their manufacturing capacity sufficient to meet our needs. However, these manufacturers may not be able to achieve these tasks. Any of these risks or such failures could limit our ability to meet customer demand which could in turn materially and adversely affect our business and operating results.

We are subject to domestic and international data protection laws and regulations that address privacy and data security and may affect our collection, use, storage, and transfer of personal information. The legislative and regulatory landscape for data protection continues to evolve, and in recent years there has been an increasing focus on privacy and data security issues with the potential to affect our business. In the U.S., numerous federal and state laws and regulations, including state data breach notification laws, state health information privacy laws and federal and state consumer protection laws govern the collection, use, disclosure and protection of health-related and other personal information. Failure to comply with data protection laws and regulations, where applicable, could result in government enforcement actions, which could include civil or criminal penalties, private litigation and/or adverse publicity and could negatively affect our operating results and business. For example, California has enacted the California Consumer Privacy Act, or CCPA, which gives California residents expanded privacy rights. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches. Although the CCPA includes exemptions for certain categories of health information, the law may increase our compliance costs and potential liability with respect to other personal information we collect about California residents. Additionally, the CCPA was significantly amended by the California Privacy Rights Act, or the CPRA, which, among other things, established the California Privacy Protection Agency, a new regulatory authority tasked with enacting new regulations under the CPRA and expanded enforcement authority. In addition to California, more U.S. states have enacted, and are continuing to enact similar legislation, all of which are likely to increase our regulatory compliance costs and risks, exposure to regulatory enforcement action, and other liabilities. Numerous other countries have, or are developing, laws governing the collection, use and transmission of personal information as well. For example, the General Data Protection Regulation ("GDPR") governs the collection and use of personal data in the European Union, including by companies outside of the European Union. The GDPR, which is wide-ranging in scope, imposes several requirements relating to the consent of the individuals to whom the personal data relates, the information provided to the individuals, the security and confidentiality of the personal data, data breach notification, and the use of third-party processors in connection with the processing of the personal data. The GDPR also imposes strict rules on the transfer of personal data out of the European Union to the United States, enhances enforcement authority and imposes large penalties for noncompliance, including the potential for fines of up to €20 million or 4% of the annual global revenues of the infringer, whichever is greater. The GDPR also confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies, and obtain compensation for damages resulting from violations of the GDPR. Compliance with the GDPR has been and will continue to be a rigorous and time-intensive process that has increased and will continue to increase our cost of doing business or require us to change our business practices, and despite those efforts, there is a risk that we may be subject to fines and penalties, litigation and reputational harm in connection with any European activities, which could adversely affect our business, prospects, financial condition and results of operations. Additionally, following the United Kingdom's withdrawal from the European Union (i.e., Brexit), and the expiry of the Brexit transition period, which ended on December 31, 2020, the GDPR has been implemented in the United Kingdom (as the UK GDPR). The UK GDPR sits alongside the UK Data Protection Act 2018 which implements certain derogations in the EU GDPR into UK law. Under the UK GDPR, companies not established in the UK but who process personal data in relation to the offering of goods or services to individuals in the UK, or to monitor their behavior will be subject to the UK GDPR – the requirements of which are (at this time) largely aligned with those under the EU GDPR and as such, may lead to similar compliance and operational costs with potential fines of up to £17.5 million or 4% of global turnover. Our operations in the PRC could also be subject to recent significant developments concerning privacy and data security. The Data Security Law of the PRC ("Data Security Law"), which took effect on September 1, 2021, requires data processing (which includes the collection, storage, use, processing, transmission, provision and publication of data), to be conducted in a legitimate and proper manner. The Data Security Law imposes data security and privacy obligations on entities and individuals carrying out data processing activities and also introduces a data classification and hierarchical protection system based on the importance of data in economic and social development and the degree of harm it may cause to national security, public interests, or legitimate rights and interests of individuals or organizations if such data are tampered with, destroyed, leaked, illegally acquired or illegally used. The appropriate level of protection measures is required to be taken for each respective category of data. Also in the PRC, the Personal Information Protection Law, which took effect on November 1, 2021, introduced stringent protection measures for processing personal information. We may be required to make further adjustments to our business practices to comply with the data security and data protection laws in the PRC, and such regulations may interfere with intended business activities, or cause us to incur additional costs. Further, the U.S. Department of Justice's Data Transfer Rule took effect on April 8, 2025, and additional compliance obligations took effect as of October 6, 2025; it prohibits or restricts the flow of bulk sensitive U.S. personal data to "countries of concern" and "covered persons" to protect national security. It mandates U.S. companies to take proactive steps, such as data mapping, partner vetting and due diligence, and the implementation of robust compliance programs to detect, control, and document such data flows. In addition to other countries, the Bulk Transfer Rule includes China as a country of concern and may have impact on our business activities, or cause us to incur additional costs associated with compliance. Applicable data privacy and data protection laws may conflict with each other, and by complying with the laws or regulations of one jurisdiction, we may find that we are violating the laws or regulations of another jurisdiction. Despite our efforts, we may not have fully complied in the past and may not in the future. Such compliance failures could require us to incur significant expenses, which could significantly affect our business. Failure to comply with data protection laws may expose us to risk of enforcement actions taken by data protection authorities or other regulatory agencies, private rights of action in some jurisdictions, and potential significant penalties if we are found to be non-compliant. Furthermore, the number of government investigations related to data security incidents and privacy violations continue to increase and government investigations typically require significant resources and generate negative publicity, which could harm our business and reputation.