Novavax (NVAX) Risk Analysis

If we are unable to partner with a third-party to advance the development of one or more of our vaccine candidates, we will need to raise money through additional debt or equity financings. To the extent that we raise additional capital by issuing equity securities, our stockholders will experience immediate dilution, which may be significant. There is also a risk that such equity issuances may cause an ownership change under the Internal Revenue Code of 1986, as amended, and similar state provisions, thus limiting our ability to use our net operating loss carryforwards and credits. To the extent that we raise additional capital through licensing arrangements or arrangements with collaborative partners, we may be required to relinquish, on terms that may not be favorable to us, rights to some of our technologies or vaccine candidates that we would otherwise seek to develop or commercialize ourselves. In addition, economic conditions may also negatively affect the desire or ability of potential collaborators to enter into transactions with us. They may also have to delay or cancel research and development projects or reduce their overall budgets.

We are required by the Sarbanes-Oxley Act of 2002 to establish and maintain adequate internal control over financial reporting that provides reasonable assurance regarding the reliability of our financial reporting and the preparation of financial statements in accordance with GAAP. We are likewise required, on an annual basis, to evaluate the effectiveness of our internal controls and to disclose on a quarterly basis any material changes in those internal controls. As initially disclosed in Item 9A - Controls and Procedures in our Annual Report on Form 10-K for the year ended December 31, 2024, in connection with the audit of our financial statements for the year ended December 31, 2024, we identified a material weakness in our internal control over financial reporting with regard to deficiencies specifically related to ineffective change management review and periodic access review controls, with respect to our human resources information system ("HRIS"), which was implemented in 2024. As a result of the deficiencies, certain change management and user access controls, as well as the related process-level IT dependent manual controls and automated application controls across various processes impacted by the HRIS were also determined to be ineffective. While this material weakness was remediated in 2025, we may have additional material weaknesses or significant deficiencies in our internal control over financial reporting in the future. Any failure to maintain such internal controls, or to timely remediate any additional material weaknesses or significant deficiencies in the future, could adversely impact our ability to report our financial results on a timely and accurate basis and could restrict our future access to the capital markets. If our financial statements are not accurate, investors may not have a complete understanding of our operations or may lose confidence in our reported financial information. Likewise, if our financial statements are not filed on a timely basis as required by the SEC and Nasdaq, we could face severe consequences from those authorities. In either case, it could result in a material adverse effect on our business or have a negative effect on the trading price of our common stock.

As of December 31, 2025, we had $26.5 million aggregate principal amount of 2027 Notes and $225.0 million aggregate principal amount of 2031 Notes outstanding. On February 25, 2026, we entered into a Credit, Security, and Guaranty Agreement (the "Credit Agreement") and borrowed $50.0 million thereunder. We have the ability to incur additional indebtedness under the Credit Agreement, subject to satisfaction of certain conditions. Borrowings under the Credit Agreement bear interest at a variable rate based on a floating benchmark rate plus a margin, which exposes us to interest rate volatility which could increase our use of cash to pay interest. The term loans under the Credit Agreement mature in 2031 and are interest-only until maturity, which concentrates principal repayment obligations at maturity. The Credit Agreement includes prepayment premiums of up to 3% on certain voluntary repayments, which could increase the cost of refinancing or reducing our indebtedness. Our ability to make scheduled payments of the principal of, to pay interest on, or to refinance our indebtedness, including the Notes and borrowing under the Credit Agreement, depends on our future performance, which is subject to economic, financial, competitive and other factors beyond our control. If we cannot generate cash flow from operations sufficient to service our scheduled debt obligations and make necessary capital expenditures we may need to refinance our debt, sell assets, or obtain additional equity capital on terms that may be onerous or highly dilutive. Our ability to refinance our indebtedness at maturity, unless earlier converted, redeemed, repurchased, or repaid, will depend on the capital markets and our financial condition at such time. We may not be able to engage in any of these activities or engage in these activities on desirable terms, which could result in a default on our debt obligations, and limit our flexibility in planning for and reacting to changes in our business.

We may incur significant additional indebtedness in the future. If new debt is added to our current indebtedness levels, the related risks that we face could intensify.

We entered into a Credit, Security and Guaranty Agreement (the "Credit Agreement") with MidCap Financial Trust, as administrative agent ("Agent"), and the lenders from time to time party thereto (the "Lenders"). The Credit Agreement provides for a senior secured term loan facility of up to $330.0 million, of which $50.0 million was borrowed at closing. The Credit Agreement contains various covenants, including covenants regarding minimum cash and royalty revenue amounts, and restrictive covenants that limit our ability to engage in specified types of transactions. These covenants limit our ability and the ability of our subsidiaries to, among other things: - incur additional indebtedness or liens;- make certain investments or acquisitions;- make certain restricted payments;- enter into affiliate transactions; and - consolidate, merge, sell assets or engage in change of control transactions,in each case subject to customary exceptions and limitations. In the event that we breach one or more covenants under the Credit Agreement, the Agent may choose to declare an event of default and require that we immediately repay all amounts outstanding plus accrued interest, and foreclose on the collateral granted to it to secure such indebtedness. Such repayment could have a material adverse effect on our business, financial condition, results of operations, and prospects.

We have entered into, and may in the future enter into, collaboration, funding, supply and other agreements for our vaccines or vaccine candidates to help fund the development, manufacture and/or commercialization of our vaccines or vaccine candidates. Certain of these agreements may contain development, technology transfer, launch, sales and other milestones related to our vaccines or vaccine candidates pursuant to which we may be eligible to receive milestone payments upon the achievement of the requisite milestone. For example, we are eligible to receive future milestone payments under the Sanofi CLA totaling up to $350 million in the aggregate with respect to COVID-19 Vaccine products, of which $75 million remains outstanding for the completion of the technology transfer of the Company's manufacturing process for the COVID-19 Vaccine products to Sanofi, as well as up to $350 million in CIC Product-related development and launch milestones. We may experience challenges in satisfying our obligations under these agreements, including as a result of delayed performance of our third-party contractors and suppliers, which may impact our ability to achieve such milestones, potentially expose us to damages or other liability pursuant to these agreements, including the Sanofi CLA, and have a material and adverse effect on our financial condition. Under certain APAs, if we do not timely achieve requisite regulatory milestones for our COVID-19 Vaccine in the relevant jurisdictions, obtain supportive recommendations from governmental advisory committees, and/or achieve product volume or delivery timing obligations, purchasers may seek to terminate such agreements, reduce their purchase commitments, require us to refund all or some prepayments we have received, or renegotiate such agreements, each of which could have a material and adverse effect on our financial condition. For example, in the first quarter of 2025, the Company received written notice of a $23.0 million claim related to certain performance obligations under an APA agreement with a customer. The Company believes it has fulfilled the requirements related to this matter and is evaluating the merits of the claim. The timing to fulfill performance obligations related to supply agreements will depend on timing of product manufacturing, receipt of marketing authorizations for additional indications, delivery of doses based on customer demand, and the ability of the customer to request variant vaccine in place of COVID-19 Vaccine under certain of our supply agreements. The supply agreements typically contain terms that include upfront payments intended to assist us in funding investments related to building out and operating our manufacturing and distribution network, among other expenses, in support of our global supply commitment, and are applied to billings upon delivery of a qualifying COVID-19 Vaccine. Such upfront payments generally become non-refundable upon our achievement of certain development, regulatory and commercial milestones. We may not achieve such milestones, which could have a material and adverse effect on our financial condition. For example, in December 2024, we entered into an amendment to the Australia APA pursuant to which, among other things, we acknowledged the cancellation by Australia of the delivery of certain doses of our COVID-19 Vaccine scheduled for delivery between the fourth quarter of 2023 and the fourth quarter of 2025 and we agreed to credit approximately $31 million of the advanced payment paid by Australia to us against outstanding invoices and invoices for the future delivery of approximately three million doses of COVID-19 Vaccine without requiring additional cash payments. In addition, the amendment provides for certain remedies for Australia, including return of unused credit, cancellation of doses, or termination of the Australia APA, in the event we are unable to gain regulatory approval of a variant COVID-19 vaccine or supply doses per the terms of the agreement Specifically, Australia did not take delivery of doses that were due to be delivered in 2025 and may seek to cancel the future delivery of the 2025 as well as 2026 doses. If we are unable to provide doses per the supply schedule as amended, after six months, Australia may seek to terminate the APA. The amendment also provides Australia with the right to cancel doses if we fail to timely notify Australia of changes to our commercialization plans. In the event that we do not, on or before the relevant contractual deadlines, receive regulatory approval for, and deliver, the seasonally updated COVID-19 Vaccine, up to $92.5 million of deferred revenue may become refundable. As of December 31, 2025, $48.4 million was classified as current Deferred revenue and $85.4 million was classified as non-current Deferred revenue with respect to the Australia APA on our consolidated balance sheet, which will be recognized in product revenue as doses are delivered to Australia. In the third quarter of 2025 we withdrew our application for our COVID-19 Vaccine based on recommendations made by the TGA. The parties are in ongoing discussions and have agreed to a meeting to discuss outstanding issues and obligations under the APA. In light of these developments, we may seek to further amend the Australian APA, which amendment may not be achievable on acceptable terms or at all.

We have entered into regional collaborations to develop, manufacture and distribute our vaccine candidates in certain parts of the world, and we anticipate entering into additional regional collaborations. Our relationships with SII, Takeda, and SK bioscience are examples of these regional relationships. These relationships often involve the licensing of our technology to our partner or entering into a distribution agreement, frequently on an exclusive basis. Generally, exclusive agreements are restricted to certain territories. Because we have entered into exclusive license and distribution agreements, larger companies may not be interested, or able, to enter into collaborations with us on a worldwide-scale. Also, these regional relationships may make us an unattractive target for an acquisition.

The FCPA and similar worldwide anti-bribery and anti-corruption laws prohibit companies and their intermediaries from corruptly providing any payments or other benefits to foreign government officials for the purpose of obtaining or retaining business. The U.S. Departments of Justice, Securities & Exchange Commission, Commerce, State and Treasury and other federal agencies and authorities have a broad range of civil and criminal penalties they may seek to impose against corporations and individuals for violations of the FCPA, economic sanctions laws, export control laws, and other federal statutes and regulations, including those established by the Office of Foreign Assets Control, or OFAC. In addition, the UK Bribery Act of 2010, or the Bribery Act, prohibits both domestic and international bribery, as well as bribery across both private and public sectors. An organization that fails to prevent bribery by anyone associated with the organization can be charged under the Bribery Act unless the organization can establish the defense of having implemented adequate procedures to prevent bribery. Similarly, U.S. and similar worldwide trade laws, including economic sanctions, export laws, and customs laws, regulate our ability to conduct business with certain jurisdictions and counterparties, and regulate the ways in which we may export and import products around the world. In connection with these laws, various government agencies may require us to obtain export licenses, and may impose modifications to business practices, including requiring the cessation of business activities in or with countries, entities, and individuals targeted with sanctions. The breadth and dynamic nature of these laws and regulations may increase compliance costs, and may subject us to fines. We have received a number of regulatory approvals in ex-U.S. jurisdictions and has commenced commercial operations in these international locations, including partnering with third-parties in certain higher-risk jurisdictions. Further, a portion of our business with respect to our manufacturing is conducted outside of the U.S. in higher-risk jurisdictions. We expect our international activities to increase in the future. Though we maintain policies, internal controls and other measures reasonably designed to promote compliance with applicable anti-corruption and trade laws and regulations, our employees or agents may nevertheless engage in improper conduct for which we might be held responsible. Any violations of these anti-corruption or trade laws, or even allegations of such violations, can lead to an investigation and/or enforcement action, which could disrupt our operations, involve significant management distraction, and lead to significant costs and expenses, including legal fees. If we, or our employees or agents acting on our behalf, are found to have engaged in practices that violate these laws and regulations, we could be subject to criminal and civil enforcement action, suffer severe fines and penalties, profit disgorgement, injunctions on future conduct, securities litigation, bans on transacting government business, delisting from securities exchanges and other consequences that may have a material adverse effect on our business, financial condition and results of operations. In addition, our reputation, our revenue or our stock price could be adversely affected if we become the subject of any negative publicity related to actual or potential violations of anti-corruption or trade laws and regulations.

Within the U.S. (and within foreign countries), if we obtain full approval for any of our vaccine candidates and begin commercializing them, our operations may be directly, or indirectly through our arrangements with third-party payors and customers, subject to additional healthcare regulation and enforcement by the federal and state governments (or the regulatory bodies or governments of foreign countries), which may constrain the business or financial arrangements and relationships through which we sell, market and distribute our products. These laws and regulations may restrict or prohibit a wide range of pricing, discounting, marketing and promotion, structuring and commission(s), certain customer incentive programs and other business arrangements generally. Activities subject to these laws also involve the improper use of information obtained in the course of patient recruitment for clinical trials. The applicable U.S. federal and state healthcare laws and regulations (which may be comparable to foreign laws existing in foreign countries) that may affect our ability to operate include: - the Federal Food, Drug and Cosmetic Act, which among other things, strictly regulates drug product marketing and promotion and prohibits manufacturers from marketing such products for unapproved uses;- the federal Anti-Kickback Statute, which prohibits, among other things, persons from knowingly and willfully soliciting, receiving or providing remuneration, directly or indirectly, to induce the referral for an item or service or the purchase order of a good or service, for which payment may be made under federal healthcare programs such as Medicare and Medicaid. A person or entity does not need to have actual knowledge of the statute or specific intent to violate it to have committed a violation;- federal false claims laws, including the FCA, which prohibit, among other things, individuals or entities from knowingly presenting, or causing to be presented, information or claims for payment from Medicare, Medicaid, or other third-party payers that are false or fraudulent, knowingly making, using or causing to be made or used, a false record or statement material to a false or fraudulent claim or from knowingly making a false statement to avoid, decrease or conceal an obligation to pay money to the federal government. In addition, the government may assert that a claim including items or services resulting from a violation of the federal Anti-Kickback Statute constitutes a false or fraudulent claim for purposes of the FCA;- manufacturers can be held liable under the FCA even when they do not submit claims directly to government payors if they are deemed to "cause" the submission of false or fraudulent claims; the FCA also permits a private individual acting as whistleblower to bring actions on behalf of the federal government alleging violations of the FCA and to share in any monetary recovery;- federal laws that require pharmaceutical manufacturers to report certain calculated product prices to the government or provide certain discounts or rebates to government authorities or private entities, often as a condition of reimbursement under government healthcare programs;- the federal Physician Payment Sunshine Act and its implementing regulations, which require manufacturers of drugs, devices, biologicals, and medical supplies for which payment is available under Medicare, Medicaid or the Children's Health Insurance Program (with certain exceptions) to report annually to the DHHS information related to payments or other transfers of value made to physicians (defined to include doctors, dentists, optometrists and chiropractors), certain non-physician providers such as physician assistants and nurse practitioners, and teaching hospitals, as well as ownership and investment interests held by physicians and their immediate family members;- the federal law known as HIPAA, which, in addition to privacy protections applicable to healthcare providers and other entities, prohibits executing a scheme to defraud any healthcare benefit program or making false statements relating to healthcare matters. Similar to the federal Anti-Kickback Statute, a person or entity does not need to have actual knowledge of the statute or specific intent to violate it to have committed a violation;- federal consumer protection and unfair competition laws, which broadly regulate marketplace activities and activities that potentially harm consumers;- state law equivalents of the above federal laws, such as anti-kickback and false claims laws which may apply to items or services reimbursed by any third-party payer, including commercial insurers, and state gift ban and transparency laws, many of which state laws differ from each other in significant ways and often are not preempted by federal laws, thus complicating compliance efforts; and - state laws restricting interactions with healthcare providers and other members of the healthcare community or requiring pharmaceutical manufacturers to implement certain compliance standards. Because of the breadth of these laws and the narrowness of the statutory exceptions and safe harbors available, it is possible that some of our business activities could be subject to challenge under one or more of such laws. It is not always possible to identify and deter employee misconduct, and the precautions we take to detect and prevent inappropriate conduct may not be effective in controlling unknown or unmanaged risks or losses or in protecting us from governmental investigations or other actions or lawsuits stemming from a failure to be in compliance with such laws or regulations. Efforts to ensure that our business arrangements will comply with applicable healthcare laws may involve substantial costs. It is possible that governmental and enforcement authorities will conclude that our business practices may not comply with current or future statutes, regulations or case law interpreting applicable fraud and abuse or other healthcare laws and regulations. If any such actions are instituted against us and we are not successful in defending ourselves or asserting our rights those actions, our business may be impaired. If our operations are found to be in violation of any of such laws or any other governmental regulations that apply to us, we may be subject to, on a corporate or individual basis, penalties, including civil and criminal penalties, damages, fines, the curtailment or restructuring of our operations, the exclusion from participation in federal and state healthcare programs and even imprisonment, any of which could materially adversely affect our ability to operate our business and our financial results. In addition, the cost of implementing sufficient systems, controls, and processes to ensure compliance with all of the aforementioned laws could be significant. Any action for violation of these laws, even if successfully defended, could cause us to incur significant legal expenses and divert management's attention from the operation of the company's business. If any of the physicians or other healthcare providers or entities with whom we expect to do business is found not to be in compliance with applicable laws, that person or entity may be subject to criminal, civil or administrative sanctions, including exclusions from government funded healthcare programs. Prohibitions or restrictions on sales or withdrawal of future marketed products could materially affect business in an adverse way.

The clinical development, manufacturing, labeling, storage, record-keeping, advertising, promotion, import, export, marketing and distribution of our vaccine candidates are subject to extensive regulation by the FDA in the U.S. and by comparable foreign regulatory authorities in foreign markets. In the U.S., we are not permitted to market our vaccine candidates in the U.S. until we receive regulatory approval of a BLA from the FDA. The process of obtaining such regulatory approval is expensive, often takes many years following the commencement of clinical trials and can vary substantially based upon the type, complexity and novelty of the vaccine candidates involved, as well as the target indications and patient population. Approval policies or regulations may change, and the FDA and comparable regulatory have substantial discretion in the approval process, including the ability to delay, limit or deny approval of a vaccine candidate for many reasons. Despite the time and expense invested in clinical development of vaccine candidates, regulatory approval of a vaccine candidate is never guaranteed. Of the large number of drugs in development, only a small percentage successfully complete the FDA or foreign regulatory approval processes and are commercialized. Prior to obtaining approval to commercialize a vaccine candidate in the U.S. or abroad, we must demonstrate with substantial evidence from adequate and well-controlled clinical trials, and to the satisfaction of the FDA or comparable foreign regulatory authorities, that such vaccine candidates are safe and effective for their intended uses, and in the case of vaccines in the U.S., that such vaccine candidates are safe, pure and potent for their intended uses. Results from nonclinical studies and clinical trials can be interpreted in different ways. Even if we believe available nonclinical or clinical data support the safety purity, potency, or efficacy of our vaccine candidates, such data may not be sufficient to obtain approval from the FDA and comparable foreign regulatory authorities. The FDA or comparable foreign regulatory authorities, as the case may be, may also require us to conduct additional preclinical studies or clinical trials for our vaccine candidates either prior to or post-approval, or may object to elements of our clinical development program. The FDA or comparable foreign regulatory authorities can delay, limit or deny approval of a vaccine candidate for many reasons, including: - such authorities may disagree with the design or execution of our clinical trials;- negative or ambiguous results from our clinical trials or results may not meet the level of statistical significance or persuasiveness required by the FDA or comparable foreign regulatory agencies for approval;- serious and unexpected drug-related side effects may be experienced by participants in our clinical trials or by individuals using products similar to our vaccine candidates;- the population studied in the clinical trial may not be sufficiently broad or representative to assure safety in the full population for which we seek approval;- such authorities may not accept clinical data from trials that are conducted at clinical facilities or in countries where the standard of care is potentially different from that of their own country;- we may be unable to demonstrate that a vaccine candidate's clinical and other benefits outweigh its safety risks;- such authorities may disagree with our interpretation of data from preclinical studies or clinical trials;- such authorities may not agree that the data collected from clinical trials of our vaccine candidates are acceptable or sufficient to support the submission of a BLA or other submission or to obtain regulatory approval in the U.S. or elsewhere, and such authorities may impose requirements for additional preclinical studies or clinical trials;- such authorities may disagree with us regarding the formulation, labeling and/or the product specifications of our vaccine candidates;- approval may be granted only for indications that are significantly more limited than those sought by us, and/or may include significant restrictions on distribution and use;- such authorities may find deficiencies in the manufacturing processes or facilities of the third-party manufacturers with which we contract for clinical and commercial supplies; or - such authorities may not accept a submission due to, among other reasons, the content or formatting of the submission. With respect to foreign markets, approval procedures vary among countries and, in addition to the foregoing risks, may involve additional product testing, administrative review periods and agreements with pricing authorities. Where if we eventually complete clinical trials and receive approval of a BLA or comparable foreign marketing application for our vaccine candidates, the FDA or comparable foreign regulatory authority may grant approval contingent on the performance of costly additional clinical trials and/or the implementation of a REMS, which may be required because the FDA believes it is necessary to ensure safe use of the product after approval. Any delay in obtaining, or inability to obtain, applicable regulatory approval would delay or prevent commercialization of that vaccine candidate and would materially adversely impact our business and prospects.

Evolving state, federal and foreign laws, regulations and industry standards regarding privacy and security apply to our collection, use, retention, protection, disclosure, transfer and other processing of personal data. Privacy and data protection laws may be interpreted and applied differently from country to country and may create inconsistent or conflicting requirements, which increases the costs incurred by us in complying with such laws, which may be substantial. For example, the European Union General Data Protection Regulation (the "EU GDPR") and the United Kingdom General Data Protection Regulation (the "UK GDPR") (the EU GDPR and UK GDPR together referred to as the "GDPR"),, impose a broad array of requirements for processing personal data, including elevated disclosure requirements regarding collection and use of such data, requirements that companies allow individuals to exercise data protection rights such as their right to obtain copies or demand deletion of personal data held by those companies, limitations on retention of information, and public disclosure of significant data breaches, among other things. The GDPR provides for substantial penalties for non-compliance of up to the greater of €20 million / £17.5 million or 4% of global annual revenue for the preceding financial year. Furthermore, transferring personal data across international borders is complex and subject to legal and regulatory requirements as well as active litigation and enforcement in a number of jurisdictions around the world, each of which could have an adverse impact on our ability to process and transfer personal data as part of our business operations. For example, the EU GDPR and UK GDPR impose strict restrictions surrounding the transfer of personal data to countries outside the EEA and the UK respectively. Case law from the Court of Justice of the European Union states that reliance on the standard contractual clauses - a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism - alone may not necessarily be sufficient in all circumstances and that transfers must be assessed on a case-by-case basis. We expect the existing legal complexity and uncertainty regarding international personal data transfers to continue, and international transfers to the United States, China, and to other jurisdictions more generally to continue to be subject to enhanced scrutiny by regulators. As the regulatory guidance and enforcement landscape in relation to data transfers continue to develop, we could suffer additional costs; we may have to make operational changes; and/or it could otherwise affect the manner in which we operate our business, and could adversely affect our business, operations and financial condition. The U.S. has also enacted the Protecting Americans' Data from Foreign Adversaries Act of 2024 which establishes new restrictions on transfers of certain personally identifiable sensitive data to foreign adversary countries and entities controlled by a foreign adversary. Similarly, in 2024, the National Security Division of the U.S. Department of Justice (DOJ) issued a new rule-referred to as the "Data Security Program" (DSP)-to implement Executive Order 14117 aimed at preventing access to "bulk U.S. sensitive personal data" and "government-related data" by "countries of concern" (including China, Russia, Iran, North Korea, Cuba, and Venezuela) and "covered persons" (as all such terms are defined in the DSP). Effective as of April 8, 2025, and fully enforceable as of July 9, 2025, the DSP imposes stringent obligations on companies within its scope and prohibits or restricts "covered data transactions" that grant countries of concern or covered persons access to bulk U.S. sensitive personal data or any amount of government-related data. The DSP is new, complex and has yet to be enforced, and as such, there is a risk that our interpretation of its applicability, scope, and requirements is incorrect, incomplete, or misapplied.. If other countries implement more restrictive regulations for cross-border data transfers or do not permit data to leave the country of origin, such developments could adversely impact our business and our enterprise customers' business, our financial condition and our results of operations in those jurisdictions. Privacy laws and regulations are also expanding in the U.S. In the U.S., HIPAA imposes, among other things, certain standards relating to the privacy, security, transmission and breach reporting of individually identifiable health information. Certain states have also adopted other privacy and security laws and regulations that govern the privacy, processing and protection of health-related and other personal information. In addition, we may obtain health information from third parties (including research institutions from which we obtain clinical trial data) that are subject to privacy and security requirements under HIPAA. Depending on the facts and circumstances, we could be subject to significant penalties if we violate HIPAA. Such laws and regulations will be subject to interpretation by various courts and other governmental authorities, thus creating potentially complex compliance issues for us and our future customers and strategic partners. For example, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (collectively, the CCPA) requires covered businesses that process the personal information of California residents to, among other things: (i) provide certain disclosures to California consumers regarding the business's collection, use, and disclosure of their personal information; (ii) receive and respond to requests from California residents to access, delete, and correct their personal information, or to opt out of certain disclosures of their personal information; and (iii) enter into specific contractual provisions with service providers that process California resident personal information on the business's behalf.. Like the GDPR, the CCPA establishes potentially significant penalties for violation. In addition, a number of other states have passed similar comprehensive privacy laws that have taken effect, reflecting a trend toward more stringent privacy legislation in the United States. We also expect that there will continue to be new laws, regulations and industry standards concerning privacy, data protection and information security proposed and enacted in various jurisdictions, including specific health-data related laws. For example, Washington State enacted the Washington My Health My Data Act which broadly defines consumer health data, creates a private right of action to allow individuals to sue for violations of the law, imposes stringent consent requirements and grants consumers certain rights with respect to their health data, including to request deletion of their information. Furthermore, the Federal Trade Commission (FTC) and many state Attorneys General continue to enforce federal and state consumer protection laws against companies for online collection, use, dissemination and security practices that appear to be unfair or deceptive. In addition, we use artificial intelligence, machine learning and automated decision-making technologies (collectively, "AI Technologies") in our business. The regulatory framework for AI Technologies is rapidly evolving as many federal, state, and foreign government bodies and agencies have introduced or are currently considering additional laws and regulations. Additionally, existing laws and regulations may be interpreted in ways that would affect the operation of AI Technologies. As a result, implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future, and we cannot yet determine the impact future laws, regulations, standards, or market perception of their requirements may have on our business and may not always be able to anticipate how to respond to these laws or regulations. It is possible that new laws and regulations will be adopted in the United States and in other non-U.S. jurisdictions, or that existing laws and regulations, including competition and antitrust laws, may be interpreted in ways that would limit our ability to use AI Technologies for our business, or require us to change the way we use AI Technologies in a manner that negatively affects the performance of our products, services, and business and the way in which we use AI Technologies. We may need to expend resources to adjust our products or services in certain jurisdictions if the laws, regulations, or decisions are not consistent across jurisdictions. Further, the cost to comply with such laws, regulations, or decisions and/or guidance interpreting existing laws, could be significant and would increase our operating expenses (such as by imposing additional reporting obligations regarding our use of AI Technologies). Such an increase in operating expenses, as well as any actual or perceived failure to comply with such laws and regulations, could adversely affect our business, financial condition and results of operations. All of these evolving compliance and operational requirements impose significant costs that are likely to increase over time, may require us to modify our data processing practices and policies, divert resources from other initiatives and projects and could restrict the way services involving data are offered, all of which may adversely affect our results of operations. Certain state laws may be more stringent or broader in scope, or offer greater individual rights, than federal or other state laws, and such laws may differ from each other, which may complicate compliance efforts. State laws are changing rapidly and there is ongoing discussion in Congress of a new federal data protection and privacy law to which we may be subject. We will need to evaluate and update our privacy program to seek to comply with applicable privacy and data security laws, and we expect to incur additional expenses in our effort to comply. Any failure or perceived failure by us to comply with laws, regulations and other requirements relating to the privacy, security and handling of information could result in legal claims or proceedings (including class actions), regulatory investigations or enforcement actions.

The biotechnology and pharmaceutical industries are subject to intense competition and rapid and significant technological change. We have many potential competitors, including major pharmaceutical companies, specialized biotechnology firms, academic institutions, government agencies and private and public research institutions. Many of our competitors have significantly greater financial and technical resources, experience and expertise in: - research and development;- preclinical testing;- designing and implementing clinical trials;- regulatory processes and approvals;- production and manufacturing; and - sales and marketing of approved products. Principal competitive factors in our industry include: - the quality and breadth of an organization's technology;- management of the organization and the execution of the organization's strategy;- the skill and experience of an organization's employees and its ability to recruit and retain skilled and experienced employees;- an organization's intellectual property portfolio;- the range of capabilities, from target identification and validation to drug discovery and development to manufacturing and marketing; and - the availability of substantial capital resources to fund discovery, development and commercialization activities. Large and established companies, such as Merck & Co., Inc., GlaxoSmithKline plc, CSL Ltd., Sanofi Pasteur, SA, Pfizer Inc., AstraZeneca, and Moderna, among others, compete in the vaccine market. In particular, these companies have greater experience and expertise in securing government contracts and grants to support their research and development efforts, conducting testing and clinical trials, obtaining regulatory approvals to market products, manufacturing such products on a broad scale and marketing approved products. Smaller or early-stage companies and research institutions also may prove to be significant competitors, regardless of the diseases their product candidates target, particularly through collaborative arrangements with large and established pharmaceutical companies. As these companies develop their technologies, they may develop proprietary positions, which may prevent or limit our product development and commercialization efforts. We will also face competition from these parties in recruiting and retaining qualified scientific and management personnel, establishing clinical trial sites and participant registration for clinical trials and in acquiring and in-licensing technologies and products complementary to our programs or potentially advantageous to our business. If any of our competitors succeed in obtaining approval from the FDA or other regulatory authorities for their products sooner than we do or for products that are more effective or less costly than ours, our commercial opportunity could be significantly reduced. In order to effectively compete, we will have to make substantial investments in development, testing, manufacturing and sales and marketing or partner with one or more established companies. We may not be successful in gaining significant market share for any vaccine. Our technologies and vaccines also may be rendered obsolete or non-competitive as a result of products introduced by our competitors to the marketplace more rapidly and at a lower cost.

Even if we receive regulatory approvals for the commercial sale of our vaccine candidates, the commercial success of these vaccine candidates will depend on, among other things, their acceptance by physicians, patients and third-party payers, such as health insurance companies and other members of the medical community, as a vaccine and cost-effective alternative to competing products. If our vaccine candidates fail to gain market acceptance, we may be unable to earn sufficient revenue to continue our business. Market acceptance of, and demand for, any product that we may develop and commercialize will depend on many factors, including: - our ability to provide acceptable evidence of safety and efficacy;- the prevalence and severity of adverse side effects;- whether our vaccines candidates are differentiated from other vaccines;- availability, relative cost and relative efficacy of alternative and competing treatments;- the effectiveness of our marketing and distribution strategy;- publicity concerning our products or competing products and treatments; and - our ability to obtain sufficient third party insurance coverage or reimbursement. If our vaccine candidates do not become widely accepted by physicians, patients, third-party payers and other members of the medical community as well as the relevant public health authorities responsible for scheduling immunizations, our business, financial condition and results of operations could be materially and adversely affected.

We depend on third parties to conduct our preclinical studies and clinical trials for our vaccine candidates. Specifically, we rely on, and will continue to rely on, medical institutions, clinical investigators, CROs and consultants to conduct preclinical studies and clinical trials, in each case in accordance with our clinical protocols and regulatory requirements. These CROs, investigators and other third parties play a significant role in the conduct and timing of these trials and subsequent collection and analysis of data. Though we expect to carefully manage our relationships with our CROs, investigators and other third parties, there can be no assurance that we will not encounter challenges or delays in the future or that these delays or challenges will not have a material adverse impact on our business, financial condition and prospects. Further, while we will have agreements governing the activities of our third-party contractors, we have limited influence over their actual performance. Nevertheless, we are responsible for ensuring that each of our preclinical studies and clinical trials are conducted in accordance with the applicable protocol and legal, regulatory and scientific standards and requirements, and our reliance on our CROs and other third parties does not relieve us of our regulatory responsibilities. In addition, we and our CROs are required to comply with GCP requirements, which are regulations and guidelines enforced by the FDA and comparable foreign regulatory authorities for our vaccine candidates in clinical development. Regulatory authorities enforce these GCPs through periodic inspections of trial sponsors, principal investigators and trial sites. If we or any of our CROs or trial sites fail to comply with applicable GCPs, the clinical data generated in our clinical trials may be deemed unreliable, and the FDA or comparable foreign regulatory authorities may require us to perform additional clinical trials before approving our marketing applications. Furthermore, our clinical trials must be conducted with vaccine candidates and placebo produced under cGMP and similar foreign regulations. Failure to comply with these regulations may require us to repeat clinical trials or recall batches of our vaccine candidate or placebo, which would delay the regulatory approval process. There is no guarantee that any of our CROs, investigators or other third parties will devote adequate time and resources to our preclinical studies or clinical trials or perform as contractually required. If any of these third parties fails to meet expected deadlines, adhere to our clinical protocols or meet regulatory requirements, or otherwise performs in a substandard manner, our clinical trials may be extended, delayed or terminated. In addition, many of the third parties with whom we contract may also have relationships with other commercial entities, including our competitors, for whom they may also be conducting preclinical studies, clinical trials or other development activities that could harm our competitive position. If any of our relationships with these third parties terminate, we may not be able to enter into arrangements with alternative third parties on commercially reasonable terms or at all. Switching or adding additional CROs, investigators and other third parties involves additional cost and requires our management's time and focus. In addition, there is a natural transition period when a new CRO commences work. As a result, delays occur, which can materially impact our ability to meet our desired clinical development timelines. Though we work to carefully manage our relationships with our CROs, investigators and other third parties, there can be no assurance that we will not encounter challenges or delays in the future or that these delays or challenges will not have a material adverse impact on our business, financial condition and prospects.

We rely, and expect to continue to rely in part, on additional third-party manufacturers for the manufacture of our vaccine candidates and related raw materials for clinical development, as well as for commercial manufacture. The facilities used by third-party manufacturers to manufacture our vaccine candidates must be approved for the manufacture of such candidate by the FDA and any comparable foreign regulatory authority pursuant to inspections that will be conducted after we submit a BLA to the FDA or any comparable submission to a foreign regulatory authority. We do not control the manufacturing process of, and are completely dependent on, third-party manufacturers for compliance with cGMP and similar foreign requirements for manufacture of products. Our third-party manufacturers may be unable to successfully manufacture material that conforms to our specifications and the strict regulatory requirements of the FDA or any comparable foreign regulatory authority. In order for us to use the material manufactured by third-party manufacturers, their manufacturing facilities must comply with applicable legal requirements, including cGMP, and upon a request for marketing authorization, these facilities must be authorized for the manufacture of our vaccine candidates in connection with any approval of any marketing application we submit. In addition, we have no control over the ability of third-party manufacturers to procure raw material supplies and maintain adequate quality control, quality assurance and qualified personnel. Furthermore, the process of manufacturing biologics is complex and highly susceptible to product loss due to contamination, equipment failure, improper installation or operation of equipment, vendor or operator error, inconsistency in yields, variability in product characteristics and difficulties in scaling the production process. Even minor deviations from normal manufacturing processes could result in reduced production yields, product defects, other supply disruptions and higher costs. If microbial, viral or other contaminations are discovered at the facilities of our third-party manufacturers, such facilities may need to be closed for an extended period of time to investigate and remedy the contamination, which could delay clinical trials, result in higher costs of drug product and adversely affect our business. Further, our clinical supplies have a shelf lives that may expire prior to the full enrollment of our planned clinical trials causing similar delays or other supply disruptions. Any performance failure on the part of our third-party manufacturers could delay clinical development or marketing approval of any vaccine candidate, and may adversely affect our future profit margins and our ability to commercialize any vaccines that receive marketing approval on a timely and competitive basis. In addition, we may be unable to establish any supply agreements with additional third-party manufacturers or to do so on acceptable terms, which increases the risk of failing to timely obtain sufficient quantities of our vaccine candidates or such quantities at an acceptable cost. Even if we are able to establish long-term agreements with third-party manufacturers, reliance on third-party manufacturers entails additional risks, including: - failure of third-party manufacturers to comply with regulatory requirements and maintain quality assurance; breach of the manufacturing agreement by the third party;- failure to manufacture our product according to our specifications, our schedule, or at all;- infringement, misappropriation or other violation of our intellectual property and proprietary information, including our trade secrets and know-how; and - termination or non renewal of the agreement by the third party at a time that is costly or inconvenient for us. There are a limited number of manufacturers that operate under cGMP regulations and that might be capable of manufacturing for us, and any vaccine candidates that we may develop may compete with other vaccine candidates and products for access to such manufacturers and manufacturing facilities. Increased competition amongst developers to access manufacturers and materials could increase the costs of, or otherwise limit our ability to, manufacture our vaccine candidates. Our third-party manufacturers may be unable to successfully manufacture material that conforms to our specifications and the strict regulatory requirements of the FDA or any comparable foreign regulatory authority. In order for us to use the material manufactured by third-party manufacturers, their manufacturing facilities in which our materials are produced must comply with applicable laws and regulations governing the manufacture of biological products, and upon a request for marketing authorization, these facilities must be authorized for the manufacture of our vaccine candidates in connection with any approval of a marketing application we submit.