Steris (STE) Risk Analysis

The long-term effects of climate change are difficult to assess and predict. The impacts may include social and human effects (such as population dislocations or harm to health and well-being), compliance costs and transition risks (such as regulatory or technology changes) and others. The effects could impair, for example, the availability and cost of energy (including utilities), and we may bear losses as a result. The regulations surrounding greenhouse gas emissions disclosures and sustainability reporting have also continued to evolve, with compliance and other requirements varying by jurisdiction, which subjects us to transition risks. Governments, regulatory bodies and other stakeholders vary in their support of or opposition to sustainability and environmental matters in different jurisdictions in which we operate, which can lead to rapid shifts in reporting obligations and differing obligations across these jurisdictions. Both the standard setting and regulatory landscapes are also extremely complex and present significant compliance and communication challenges in light of these uncertain and varied approaches to greenhouse gas emissions disclosures and sustainability reporting. If our greenhouse gas emissions-related data, processes or reporting are incomplete or inaccurate, we fail to comply with relevant reporting frameworks or efficiency standards from existing or newly emerging regulations, or we become subject to expanded carbon pricing mechanisms, we may incur enhanced costs, monetary penalties and reputational harm, investor demand for our securities could decrease, or we could become subject to litigation or governmental investigations, any of which may have a material adverse effect on our financial condition and results of operations. The introduction and evolution of climate- and sustainability-related laws, regulations and reporting requirements-many of which are not uniform across jurisdictions-can increase the complexity and cost of compliance and heighten our exposure to enforcement actions, litigation and reputational harm. For example, the European Union adopted the CSRD in 2023, and in 2025 the European Commission proposed amendments to the CSRD aimed at simplifying sustainability reporting in Europe. Such amendments entered into force in March 2026, with transposition into national law by EU member states required in 2027, while changes to the ESRS are expected to be finalized later in calendar year 2026. While the EU has adopted extensive requirements through CSRD and ESRS, which continue to evolve, other jurisdictions, including, for example, the United Kingdom and California, have their own sustainability reporting frameworks. Managing compliance across these inconsistent regimes is complex and costly, and may result in disclosures that emphasize different metrics, use different methodologies or reach different conclusions depending on the applicable frameworks. We may also face challenges in presenting consistent and comparable sustainability information to global stakeholders. These changes, and any other new or pending legal or regulatory matters, may result in the expenditure of additional resources or costs to comply with such requirements, which could affect our financial condition, results of operations or cash flows.

Our continued success depends, in large part, on our ability to hire and retain highly qualified people, and if we are unable to do so, our business and operations may be impaired or disrupted. There is no assurance that we will be successful in attracting replacements to fill vacant positions, retaining successors to fill retirements or employees moving to new positions, or otherwise retaining qualified personnel. In addition, the increasing complexity of legal, regulatory and compliance matters have created additional responsibilities for our management and other personnel and can create significant distraction or diversion of their attention, which could have a material adverse effect on our ability to attract and retain such personnel.

We purchase raw materials, fabricated and other components, and energy supplies from a variety of suppliers. Key raw materials include stainless steel, organic and inorganic chemicals, fuel, cobalt-60 and EO, and key components include plastic components, as well as various electronics including control boards and computer chips. The availability and prices of raw materials and energy supplies are subject to volatility and are influenced by worldwide economic conditions, speculative action, world supply and demand balances, inventory levels, availability of substitute materials, currency exchange rates, anticipated or perceived shortages, and other factors. In addition, administrations in the U.S. and other countries continue to announce plans to implement or increase tariffs and other trade barriers, and it remains unclear what the ultimate outcome of these policy changes will be on our supply chains. Also, certain of our key materials and components have a limited number of suppliers, and some are single-sourced in certain regions of the world, such as cobalt-60 and EO, which are necessary for our AST operations. Given the limited number of suppliers for such materials, they may become subject to supply shortages or unavailability or increasing prices which could have a negative impact on our operations. Further, changes in regulatory requirements regarding the use of these materials might disrupt or cause shutdowns of portions of our AST operations or have other adverse consequences. Shortages in supply, increased regulatory or security requirements, or increases in the price of any of the raw materials, components and energy supplies used in our operations may adversely affect us.

There can be no assurances that our measures to protect the health and wellbeing of our employees in the event of future health crises will be sufficient to protect our employees or that they may not otherwise be exposed to an illness outside of our workplace. If a large or otherwise impactful number of our employees, including key employees, become ill, incapacitated or are otherwise unable or unwilling to continue working during any future health crises, our operations may be adversely impacted. Furthermore, restrictive measures implemented by us or governmental entities in response to a future pandemic or similar public health crisis could adversely impact our ability to hire and retain employees. Any failure to staff our operations resulting from an emergent public health crisis could adversely impact our financial condition and results of operations.

From time to time, we may invest in technology, business infrastructure, new businesses, product offerings and manufacturing innovations and expansion of existing businesses, each of which may require substantial cash investments and management attention. We believe cost-effective investments are essential to business growth and profitability; however, significant investments are subject to typical risks and uncertainties inherent in developing a new business or expanding an existing business. The failure of any significant investment to provide expected returns or profitability could have a material adverse effect on our financial results and divert management attention from more profitable business operations.

To maintain our competitive position for our products, we need to obtain patent or other proprietary rights for new and improved products and to maintain and enforce our existing patents and other proprietary rights. We typically apply for patents in the U.S. and in strategic other countries. We may also acquire patents through acquisitions. We may encounter difficulties in obtaining or protecting patents. We rely on a combination of patents, trademarks, trade secrets, know-how, and confidentiality agreements to protect the proprietary aspects of our technology. These measures afford only limited protection, and competitors may gain access to our intellectual property and proprietary information. Litigation may be necessary to enforce or defend our intellectual property rights, to protect our trade secrets, and to determine the validity and scope of our proprietary rights. Litigation may also be brought against us claiming that we have violated the intellectual property rights of others. Litigation may be costly and may divert management's attention from other matters. Additionally, in some foreign countries with weaker intellectual property rights, it may be difficult to maintain and enforce patents and other proprietary rights or defend against claims of infringement.

We rely extensively on information technology ("IT") systems to conduct business, including but not limited to interacting with Customers and suppliers, fulfilling orders, generating invoices, collecting and making payments, manufacturing and shipping products, providing Customer support, and fulfilling contractual obligations. In addition, we rely on networks and services, including internet sites, cloud and software-as-a-service solutions, data hosting, electronic payment systems, and processing facilities and tools and other hardware, software and technical applications and platforms, including some that employ artificial intelligence ("AI"), some of which are managed, hosted, provided and/or used by third-parties or their vendors, to assist in conducting our business. While we have been the previous target of cyberattacks and security breaches, none of these attacks or breaches to date have had a material adverse effect on the Company. We cannot guarantee that future cyberattacks, if successful, will not have a material effect on our business or financial results. Numerous and evolving cybersecurity threats continue to pose potential risks to the security of our IT systems, networks and services, as well as the confidentiality, availability and integrity of our data, and we may fail to sufficiently adapt to them. For instance, generative AI and other artificial intelligence technologies may be used by malicious actors to create more targeted phishing narratives, develop sophisticated malware, spread false information about us or our products, or otherwise enhance the social engineering and attack capabilities of such malicious actors. Some of our products, services, and information technology systems contain or use open-source software, which poses additional risks, including potential security vulnerabilities, licensing compliance issues, and quality issues. A security breach, whether of our products, of our Customers' network security and systems or of third-party hosting services, could impact the use of such products and the security of information stored therein. While we have made investments seeking to address these threats, including monitoring of networks and systems, hiring of experts, employee training and security policies for employees and third-party providers, the techniques used in these attacks change frequently and may be difficult to detect for periods of time and we may face difficulties in anticipating and implementing adequate preventative measures. When cybersecurity incidents occur, we expect to follow our incident response policy and address them in accordance with applicable governmental regulations and other legal requirements. Our response to these incidents and our investments to protect our information technology infrastructure and data may not shield us from significant losses and potential liability or prevent any future interruption or breach of our systems. We maintain cyber liability insurance with terms, conditions, and limits believed to be adequate. However, cybersecurity-related liability or other claims may exceed insurance coverage limits, fines, penalties and regulatory sanctions may not be covered by insurance, or insurance may not continue to be available or available on commercially reasonable terms. Additionally, our insurers might deny claim coverage for valid or other reasons or may become insolvent. If our IT systems are damaged or cease to function properly, the networks or service providers we rely upon fail to function properly, or we or one of our third-party providers suffer a loss or disclosure of our business or stakeholder information due to any number of causes ranging from catastrophic events or power outages to improper data handling or security breaches or other cyber incidents, and our business continuity plans do not effectively address these failures on a timely basis, we may be exposed to reputational, competitive and business harm as well as litigation and regulatory action. In the past, our Customers and resellers of our products have experienced cybersecurity attacks and incidents that have impacted their ability to do business, process payments and sell products, and there can be no assurance that future cybersecurity attacks and incidents affecting our Customers and resellers will not impact our business if and when they occur. In addition, a large number of our employees, as well as those of our Customers and suppliers, work remotely part of the time, which may increase the risk of IT systems vulnerabilities and attacks and unauthorized access of information. Furthermore, future geopolitical conflicts could result in increases in cybersecurity incidents. The General Data Protection Regulation ("GDPR") is focused on the protection of personal data, not merely the privacy of personal data. The GDPR has created a range of compliance obligations and can impose significant financial penalties for noncompliance (including possible fines of up to 4% of global annual revenues for the preceding financial year or €20 million (whichever is higher) for the most serious infringements). Other legislative or governmental regulatory requirements may come into effect that may similarly increase our compliance obligations or significantly increase our exposure to financial penalties for noncompliance. Likewise, governments and regulatory bodies worldwide are actively developing new laws, regulations and ethical guidelines governing AI use, including the European Union's Artificial Intelligence Act. Compliance with evolving and potentially inconsistent AI regulations across jurisdictions may be costly and complex. Failure to comply could result in significant penalties, restrictions on our use of AI, or reputational harm. The use of AI may also raise data privacy concerns, particularly if AI systems process sensitive health information subject to GDPR, HIPAA or other privacy regulations. If our competitors deploy AI technologies more effectively than we do, we may lose market share or be unable to maintain our competitive position. Failure to adequately manage AI-related risks could have a material adverse effect on our business, reputation, financial condition, and results of operations.

We operate in a highly competitive environment. Our businesses compete with other broad-line manufacturers, as well as many smaller businesses specializing in particular products or services, primarily on the basis of brand, design, quality, safety, ease of use, serviceability, price, product features, warranty, delivery, service, and technical support. We also continue to work with our suppliers to implement plans to improve our competitive position by reducing material costs and manufacturing inefficiencies and realize productivity gains and distribution and supply chain efficiencies. Maintaining and improving our competitive position will require continued investment by us in manufacturing, engineering, quality standards, marketing, Customer service and support of our distribution networks. We also face increased competition from new infection prevention, sterile processing, contamination control, surgical support, cleaning consumables, gastrointestinal endoscopy accessories, contract sterilization, and other products and services entering the market. Competitors and potential competitors also are attempting to develop alternate technologies and sterilizing agents, as well as disposable medical instruments and other devices designed to address the risk of contamination. In addition, we also face competition within our AST segment from our Customers who may insource their sterilization needs by utilizing their own technology and systems. If we cannot successfully implement our strategies to compete, our revenues and results of operations may be negatively impacted, which could adversely affect our business, financial condition and results of operations or our long-term prospects.