Desktop Metal (DM) Risk Analysis

The Desktop Labs platform and our Desktop Health products aim to leverage our proprietary additive manufacturing technologies and materials to grow the market for existing applications in the dental market and identify, develop and/or commercialize future solutions in the healthcare and dental markets for personalized patient care spanning dentistry, orthodontics, dermatology, orthopedics, cardiology, plastic surgery and printed regenerative tissues and grafts. These businesses operate in a highly competitive space which may make it difficult for us to implement business plans and expectations and identify and realize opportunities. In addition, their technology, products, materials, and applications may be subject to strict regulatory requirements in the United States and other countries. The regulatory approval or clearance process may be lengthy and costly, and regulatory requirements may impact the timing of, or our ability to, commercialize the regulated technology, products, materials and applications. The success of these parts of our business will also depend on our ability to attract, hire and retain qualified personnel, establish sales, marketing and distribution infrastructure, and establish and maintain supply and manufacturing relationships.

Third parties may own issued patents and pending patent applications that exist in fields relevant to additive manufacturing. Some of these third parties may assert that we are employing their proprietary technology without authorization. There may be third-party patents or patent applications with claims related to additive manufacturing. Because patent applications can take many years to issue, there may be currently pending patent applications which may later result in issued patents that our additive technologies may infringe. In addition, third parties may obtain patents in the future and claim that our technologies infringe upon these patents. Any third-party lawsuits or other assertion to which we are subject alleging our infringement of patents, trade secrets or other intellectual property rights may have a significant adverse effect on our financial condition.

We rely on our information technology systems to manage numerous aspects of our business, including to efficiently purchase products from our suppliers, provide procurement and logistic services, ship products to our customers, manage our accounting and financial functions, including our internal controls, and maintain our research and development data. Our information technology systems are an essential component of our business and any failure, disruption, or breach of such systems could significantly limit our ability to manage and operate our business efficiently. Any actual or perceived failure of our information technology systems to perform properly could disrupt our supply chain, product development and customer experience, which may lead to increased overhead costs and decreased sales and have an adverse effect on our reputation and our financial condition. In addition, following the COVID-19 pandemic, a substantial portion of our employees have continued to work remotely, making us more dependent on potentially vulnerable communications systems and making us more vulnerable to cyberattacks. Although we take steps and incur significant costs to secure our information technology systems, including our computer systems, intranet and internet sites, email and other telecommunications and data networks, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with, or effective, and our systems may be vulnerable to attack, damage or interruption. Disruption to our information technology systems could result from power outages, computer and telecommunications and electrical failures, computer viruses and malware, malicious code, hacking, cyberattacks (including ransomware attack), phishing attacks and other social engineering schemes, human error, fraud, denial or degradation of service attacks and sophisticated nation-state and nation-state supported actors or other security breaches, catastrophic events such as fires, floods, earthquakes, tornadoes, hurricanes, acts of war, terrorism and theft or usage errors by our employees. Attacks upon information technology systems are increasing in their frequency, levels of persistence, sophistication and intensity, and are being conducted by sophisticated and organized groups and individuals with a wide range of motives and expertise. Furthermore, because the techniques used to obtain unauthorized access to, or to sabotage, systems change frequently and often are not recognized until launched against a target, we may be unable to anticipate these techniques or implement adequate preventative measures. We may also experience security breaches that may remain undetected for an extended period. Even if identified, we may be unable to adequately investigate or remediate incidents or breaches due to attackers increasingly using tools and techniques that are designed to circumvent controls, to avoid detection, and to remove or obfuscate forensic evidence. We and certain of our service providers are from time to time subject to cyberattacks and security incidents. While we do not believe that we have experienced any significant system failure, accident or security breach to date, our reputation, results of operations, business and financial condition could be adversely affected if, as a result of a significant cyber-event or otherwise: - our operations are disrupted or shut down;- our confidential, proprietary information is stolen, lost or disclosed;- we are subject to regulatory investigation, we incur costs with respect to the investigation, remediation and potential notification to counterparties or data subjects, or we are required to pay penalties or fines in connection with stolen customer, employee or other personal information;- we must dedicate significant resources to system repairs or increase cyber security protection; or - we otherwise incur significant litigation or other costs. Further, if our information technology systems are damaged or cease to function properly, or, if we do not replace or upgrade certain systems, we may incur substantial costs to repair or replace them and may experience an interruption of our normal business activities or loss of critical data. Any such disruption could adversely affect our reputation, results of operations, business and financial condition. Additionally, some of the companies we acquire may not have made the same level of investment in security measures for their information technology systems which may require that we invest significant resources to get those systems to the level of security we require. Additionally, some of the companies we acquire may not have the same level of information technology systems which may require that we invest significant resources to get those systems to the level of security we require. We also rely on information technology systems maintained by third parties, including third-party cloud computing services and the information technology systems of our suppliers for both our internal operations and our customer-facing infrastructure related to our additive manufacturing solutions. These systems are also vulnerable to the types of interruption and damage described above, but we have less ability to take measures to protect against such disruptions or to resolve them if they were to occur. Information technology problems faced by third parties on which we rely could adversely impact our results of operations, business and financial condition as well as negatively impact our brand reputation.

Our Desktop Labs and Desktop Health products and services, and healthcare provider customers and distributors, are and will be subject to extensive federal, state, local and foreign regulations, including, without limitation, regulations with respect to approvals and clearances for products, design, manufacturing and testing, labeling, marketing, sales, quality control, and data privacy and security. Unless an exemption applies, we must obtain clearance or approval from the Food and Drug Administration (or comparable foreign regulatory body) before a medical device or solution can be marketed or sold; this process involves significant time, effort and expense. The healthcare market overall is highly regulated and subject to frequent and sudden change. Our failure to secure clearances or approvals or comply with regulations could have an adverse impact on our business and reputation and subject us to lost research and development costs, withdrawal of clearance/approval, operating restrictions, liabilities, fines, penalties and/or litigation.

Customers may use our additive manufacturing systems to print parts that could be used in a harmful way or could otherwise be dangerous. For example, there have been news reports that 3D printers were used to print guns or other weapons. We have little, if any, control over what objects our customers print using our products, and it may be difficult, if not impossible, for us to monitor and prevent customers from printing weapons with our products. There can be no assurance that we will not be held liable if someone were injured or killed by a weapon printed by a customer using one of our products.

The global data protection landscape is rapidly evolving, and we are or may become subject to numerous state, federal and foreign laws, requirements and regulations governing the collection, use, disclosure, retention, and security of personally identifiable information we collect from our employees, prospects, and our customers. Data privacy and security laws and regulations may limit the use and disclosure of certain personal information and require us to adopt certain cybersecurity and data handling practices that may affect our ability to effectively market our services to current, past, or prospective customers. We must comply with data privacy and security laws in the United States, Europe and other countries and jurisdictions where we conduct business. For example,in Europe the GDPR became effective May 25, 2018 and imposes strict requirements for processing the personal data of individuals within the European Economic Area, or EEA, or in the context of our activities within the EEA. Companies that must comply with the GDPR face increased compliance obligations and risk, including more robust regulatory enforcement of data protection requirements and potential fines for noncompliance of up to €20 million or 4% of the annual global revenues of the noncompliant undertaking, whichever is greater. In addition to fines, a breach of the GDPR may result in regulatory investigations, reputational damage, orders to cease/ change our data processing activities, enforcement notices, assessment notices (for a compulsory audit) and/ or civil claims (including class actions). Among other requirements, the GDPR regulates transfers of personal data subject to the GDPR to third countries that have not been found to provide adequate protection to such personal data, including the United States, and the efficacy and longevity of current transfer mechanisms between the EEA, and the United States remains uncertain. Case law from the Court of Justice of the European Union states that reliance on the standard contractual clauses, or SCCs, - a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism - alone may not necessarily be sufficient in all circumstances and that transfers must be assessed on a case-by-case basis. On July 10, 2023, the European Commission adopted its Adequacy Decision in relation to the new EU-US Data Privacy Framework, or DPF, rendering the DPF effective as a GDPR transfer mechanism to U.S. entities self-certified under the DPF. We expect the existing legal complexity and uncertainty regarding international personal data transfers to continue. As supervisory authorities issue further guidance on personal data export mechanisms, including circumstances where the SCCs cannot be used, and/or start taking enforcement action, we could suffer additional costs, complaints and/or regulatory investigations or fines, and/or if we are otherwise unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we provide our services, the geographical location or segregation of our relevant systems and operations, and could adversely affect our financial results. We are also subject to the retained version of the GDPR as it forms part of the law of England and Wales, Scotland and Northern Ireland, the UK General Data Protection Data Protection Regulation and Data Protection Act 2018, or collectively, the UK GDPR, which imposes separate but similar obligations to those under the GDPR and comparable penalties, including fines of up to £17.5 million or 4% of a noncompliant undertaking's global annual revenue for the preceding financial year, whichever is greater. On October 12, 2023, the UK Extension to the DPF came into effect (as approved by the UK Government), as a data transfer mechanism from the UK to U.S. entities self-certified under the DPF. In the U.S., certain states have also adopted data privacy and security laws and regulations, which govern the privacy, processing and protection of personal information. For example, the California Consumer Privacy Act of 2018, or CCPA, became effective on January 1, 2020. Similar laws have been passed in other states and are continuing to be proposed at the state and federal level. These laws create new individual privacy rights and impose increased obligations, including disclosure obligations, on companies handling personal data. In many jurisdictions, consumers must be notified in the event of a data security breach, and such notification requirements continue to increase in scope and cost. Data privacy and security laws and regulations may limit the use and disclosure of certain information and require us to adopt certain cybersecurity and data handling practices that may affect our ability to effectively market our services to current, past, or prospective customers. While we have invested in, and intend to continue to invest in, resources to comply with these standards, we may not be successful in doing so, and any actual or perceived failure to comply could result in additional cost and liability to us, damage our reputation and have an adverse effect on our business, results of operations and reputation. As data privacy, data use and data security laws are interpreted and applied, compliance costs may increase, particularly in the context of ensuring that adequate data protection and data transfer mechanisms are in place. In recent years, there has been increasing regulatory enforcement and litigation activity in this area in the United States, Germany and in various other countries in which we operate.

Our additive manufacturing software contains components that are licensed under so-called "open source," "free" or other similar licenses. Open source software is made available to the general public on an "as-is" basis under the terms of a non-negotiable license. We currently combine our proprietary software with open source software, but not in a manner that we believe requires the release of the source code of our proprietary software to the public. We do not plan to integrate our proprietary software with open source software in ways that would require the release of the source code of our proprietary software to the public; however, our use and distribution of open source software may entail greater risks than use of third-party commercial software. Open source licensors generally do not provide warranties or other contractual protections regarding infringement claims or the quality of the code. In addition, if we combine our proprietary software with open source software in a certain manner, we could, under certain open source licenses, be required to release to the public or remove the source code of our proprietary software. We may also face claims alleging noncompliance with open source license terms or infringement or misappropriation of proprietary software. These claims could result in litigation, require us to purchase a costly license or remove the software. In addition, if the license terms for open source software that we use change, we may be forced to re-engineer our solutions, incur additional costs or discontinue the sale of our offerings if re-engineering could not be accomplished on a timely basis. Although we monitor our use of open source software to avoid subjecting our offerings to unintended conditions, there is a risk that these licenses could be construed in a way that could impose unanticipated conditions or restrictions on our ability to commercialize our offerings. We cannot guarantee that we have incorporated open source software in our software in a manner that will not subject us to liability or in a manner that is consistent with our current policies and procedures.

We depend on third-party contract manufacturers for the production of several of our additive manufacturing systems. While there are several potential manufacturers for most of these products, several of our products are manufactured, assembled, tested and generally packaged by a limited number of third-party manufacturers. In most cases, we rely on these manufacturers to procure components and, in some cases, subcontract engineering work. Our reliance on a limited number of contract manufacturers involves a number of risks, including: - unexpected increases in manufacturing and repair costs;- inability to control the quality and reliability of finished products;- inability to control delivery schedules;- potential liability for expenses incurred by third-party contract manufacturers in reliance on our forecasts that later prove to be inaccurate;- potential lack of adequate capacity to manufacture all or a part of the products we require; and - potential labor unrest affecting the ability of the third-party manufacturers to produce our products. If any of our third-party contract manufacturers experience a delay, disruption, or quality control problems in their operations, or if a primary third-party contract manufacturer does not renew its agreement with us, our operations could be significantly disrupted, and our product shipments could be delayed. Ensuring that a contract manufacturer is qualified to manufacture our products to our standards is time consuming. In addition, there is no assurance that a contract manufacturer can scale its production of our products at the volumes and in the quality that we require. If a contract manufacturer is unable to do these things, we may have to move production for the products to a new or existing third-party manufacturer, which would take significant effort and our business, results of operations and financial condition could be materially adversely affected. As we contemplate moving manufacturing into different jurisdictions, we may be subject to additional significant challenges in ensuring that quality, processes, and costs, among other issues, are consistent with our expectations. For example, while we expect our third-party contract manufacturers to be responsible for cost resulting from manufacturing defects, there is no assurance that we will be able to collect such reimbursements from these manufacturers, which exposes us to take on additional risk for potential failures of our products. In addition, because we use a limited number of third-party contract manufacturers, increases in the prices charged may have an adverse effect on our results of operations, as we may be unable to find a contract manufacturer who can supply us at a lower price. As a result, the loss of a limited source supplier could adversely affect our relationships with our customers and our results of operations and financial condition. All of our products must satisfy safety and regulatory standards and some of our products must also receive government certifications. Our third-party contract manufacturers are primarily responsible for conducting the tests that support our applications for most regulatory approvals for our products. If our third-party contract manufacturers fail to timely and accurately conduct these tests, we may be unable to obtain the necessary domestic or foreign regulatory approvals or certifications to sell our products in certain jurisdictions. As a result, we would be unable to sell our products and our sales and profitability could be reduced, our relationships with our sales channel could be harmed and our reputation and brand would suffer.

Our business is subject to price competition. Such price competition may adversely affect our results of operation, especially during periods of decreased demand. Decreased demand also adversely impacts the volume of our systems sales. If our business is not able to offset price reductions resulting from these pressures, or decreased volume of sales due to contractions in the market, by improved operating efficiencies and reduced expenditures, then our operating results will be adversely affected. Certain of our operating costs are fixed and cannot readily be reduced, which diminishes the positive impact of our restructuring programs on our operating results. To the extent the demand for our products slows, or the additive manufacturing market contracts, we may be faced with excess manufacturing capacity and related costs that cannot readily be reduced, which will adversely impact our financial condition and results of operations.

We rely heavily on our global network of resellers to sell our products and to provide installation and support services to customers in their respective geographic regions. These resellers may not be as effective in selling our products or installing and supporting our customers as we expect. Further, our contracts with our resellers provide for termination for convenience, and if our contracts with a significant number of resellers, or with the most effective resellers, were to terminate or if they would otherwise fail or refuse to sell certain of our products, we may not be able to find replacements that are as qualified or as successful in a timely manner, if at all. In addition, if our resellers do not perform as anticipated, or if we are unable to secure qualified and successful resellers, our sales will suffer, which would have an adverse effect on our revenues and operating results. Because we also depend upon our resellers to provide installation and support services for products, if our reseller relationship were terminated or limited to certain products, we may face disruption in providing support for our customers, which would adversely affect our reputation and our results of operations. Any failure to offer high-quality technical support services may adversely affect our relationships with our customers and adversely affect our financial results. Additionally, a default by one or more resellers that have a significant receivables balance could have an adverse impact on our financial results. We have reviewed our policies that govern credit and collections and will continue to monitor them in light of current payment status and economic conditions. In addition, we try to reduce the credit exposures of our accounts receivable by instituting credit limits. However, there can be no assurance that our efforts to identify potential credit risks will be successful. Our inability to timely identify resellers that are credit risks could result in defaults at a time when such resellers have high accounts receivable balances with us. Any such default would result in a significant charge against our earnings and adversely affect our results of operations and financial condition.

Macroeconomic conditions, such as high inflation, changes to monetary policy, high interest rates, volatile currency exchange rates, as well as credit and sovereign debt concerns in certain European countries, concerns about slowed growth in China and other markets outside of the U.S., decreasing consumer confidence and spending, including capital spending, concerns about the stability and liquidity of certain financial institutions, and global or local recessions can adversely impact demand for our products, which could negatively impact our business, financial condition, or results of operations. Recent macroeconomic conditions have been adversely impacted by political instability and military hostilities in multiple geographies (including the conflict between Ukraine and Russia and the conflict in Israel and surrounding areas) and monetary and financial uncertainties.

In 2020 and 2021, the COVID-19 pandemic caused disruption and volatility in the global economy and capital markets, which increased the cost of capital and adversely impacted access to capital. Government-enforced travel bans and business closures around the world significantly impacted our ability to sell, install and service our additive manufacturing systems at customers around the world. The pandemic has, and may continue to, disrupt our third-party contract manufacturers and supply chain and delay payments from customers. We also experienced some delays in installation of our products at customers' facilities, which has and could lead to postponed revenue recognition for those transactions. In addition, installation delays could prevent us from achieving anticipated consumables revenues due to systems being put into operation later, or at lower utilization, than expected. Furthermore, if significant portions of our workforce are unable to work effectively, including because of illness, quarantines, government actions, facility closures, remote working or other restrictions in connection with the COVID-19 pandemic, our operations will likely be adversely impacted. If future variants of COVID-19 cause any of these events to recur, we or our customers may be unable to perform fully on our contracts, which will likely result in increases in costs and reduction in revenue. These cost increases and revenue reductions may not be fully recoverable or adequately covered by insurance. The long-term effects of COVID-19 to the global economy and to us are difficult to assess or predict and may include a further decline in the market prices of our products, risks to employee health and safety, risks for the deployment of our products and services and reduced sales in geographic locations impacted. Any prolonged restrictive measures put in place in order to control COVID-19 or other adverse public health developments in any of our targeted markets may have a material and adverse effect on our business operations and results of operations.