SI-Bone (SIBN) Risk Analysis

In the ordinary course of our business, we collect and process personal data and other sensitive information. We process data of our employees, consultants, certain individuals who may be affiliated with our customers, including physician users of our products and, in the context of clinical investigations, patients. The personal data may include sensitive personal data including health information. We collect this kind of information for several purposes, such as billing, reimbursement support, marketing purposes, post-marketing safety vigilance, servicing potential warranty claims and during the course of clinical trials. We are subject to various federal, state and foreign laws that protect the confidentiality of certain sensitive information including patient health information, such as patient medical records, and restrict the use and disclosure of patient health information by healthcare providers, such as HIPAA in the United States and regulations in the European Union ("EU"), which are described in detail in "Item 1. Business - Data Privacy and Security Laws." Many U.S. states have enacted laws regulating the collection, use and disclosure of personal data and requiring that companies implement reasonable data security measures. Laws in all states and U.S. territories also require businesses to notify affected individuals, governmental entities and/or credit reporting agencies of certain security breaches affecting personal data. These laws are not consistent, and increase our compliance costs and potential liability in the event of a data breach. In the past few years, numerous U.S. states-including California, Virginia, Colorado, Connecticut, and Utah-have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights may include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 ("CPRA"), (collectively, "CCPA") applies to personal data of consumers, business representatives, and employees who are California residents, and requires businesses to provide specific disclosures in privacy notices and honor requests of such individuals to exercise certain privacy rights. The CCPA provides for fines of up to $7,500 per intentional violation and allows private litigants affected by certain data breaches to recover significant statutory damages. Although the CCPA includes exemptions for certain clinical trials data, and protected health information governed by HIPAA, the law may increase our compliance costs and potential liability with respect to other personal data we collect about California residents. Similar laws are being considered in several other states, as well as at the federal and local levels, and we expect more states to pass similar laws in the future. While these states, like the CCPA, also exempt some data processed in the context of clinical trials, these developments further complicate compliance efforts, and increase legal risk and compliance costs for us, the third parties upon whom we rely, and our customers. Outside the United States, an increasing number of laws, regulations, and industry standards govern data privacy and security. For example, the European Union's General Data Protection Regulation ("GDPR") and the United Kingdom's GDPR ("UK GDPR") impose strict requirements for processing personal data. The GDPR is directly applicable in each EU Member State. This should, in principle, result in a more uniform application of data privacy laws across the EU. The GDPR imposes onerous accountability obligations requiring data controllers and processors to maintain a record of their data processing and policies. It requires data controllers to be transparent and to disclose to data subjects (in a concise, intelligible and easily accessible form) how their personal information is to be used, imposes limitations on retention of information, increases requirements pertaining to pseudonymized (i.e., key-coded) data, introduces mandatory data breach notification requirements and sets higher standards for data controllers to demonstrate that they have obtained valid consent for certain data processing activities. Fines for non-compliance with the GDPR will be significant - the greater of € 20 million or 4% of global turnover. The GDPR provides that EU Member States may introduce further conditions, including limitations, to the processing of genetic, biometric, or health data, which could limit our ability to collect, use and share personal data, or could cause our compliance costs to increase, ultimately having an adverse impact on our business. Each EU Member State may also adopt additional related legislation and guidance in its own national data privacy regime and therefore the laws may differ by jurisdiction, sometimes significantly. We need to ensure compliance with the rules in each jurisdiction where we are established or are otherwise subject to local privacy laws. In the ordinary course of business, we may transfer personal data from Europe and other jurisdictions to the United States or other countries. Europe and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal data to other countries. In particular, the European Economic Area ("EEA") and the United Kingdom ("UK") have significantly restricted the transfer of personal data to the United States and other countries whose privacy laws it generally believes are inadequate. Other jurisdictions may adopt similarly stringent interpretations of their data localization and cross-border data transfer laws. Although there are currently various mechanisms that may be used to transfer personal data from the EEA and UK to the United States in compliance with law, such as the EEA standard contractual clauses, the UK's International Data Transfer Agreement / Addendum, and the EU-U.S. Data Privacy Framework and the UK extension thereto (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the Framework), these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the United States. If there is no lawful manner for us to transfer personal data from the EEA, the UK or other jurisdictions to the United States, or if the requirements for a legally-compliant transfer are too onerous, we could face significant adverse consequences, including the interruption or degradation of our operations, the need to relocate part of or all of our business or data processing activities to other jurisdictions (such as Europe) at significant expense, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors and other third parties, and injunctions against our processing or transferring of personal data necessary to operate our business. Additionally, companies that transfer personal data out of the EEA and UK to other jurisdictions, particularly to the United States, are subject to increased scrutiny from regulators, individual litigants, and activist groups. Some European regulators have ordered certain companies to suspend or permanently cease certain transfers out of Europe for allegedly violating the GDPR's cross-border data transfer limitations. In addition to data privacy and security laws, we are contractually subject to industry standards adopted by industry groups and, we are, or may become subject to such obligations in the future. For example, we may also be subject to the Payment Card Industry Data Security Standard ("PCI DSS"). The PCI DSS requires companies to adopt certain measures to ensure the security of cardholder information, including using and maintaining firewalls, adopting proper password protections for certain devices and software, and restricting data access. Noncompliance with PCI-DSS can result in penalties ranging from $5,000 to $100,000 per month by credit card companies, litigation, damage to our reputation, and revenue losses. We also rely on vendors to process payment card data, who may be subject to PCI DSS, and our business may be negatively affected if our vendors are fined or suffer other consequences as a result of PCI DSS noncompliance. We depend on a number of third parties in relation to the provision of our services, a number of which process personal data on our behalf. With each such provider we enter into contractual arrangements to ensure that they only process personal data according to our instructions and applicable laws, and that they have sufficient technical and organizational security measures in place to fulfil their related obligations. These third party service providers may breach their contractual or legal obligations, which could negatively effect our business and/or our reputation. We publish privacy policies, marketing materials and other statements, such as compliance with certain certifications or self-regulatory principles, regarding data privacy and security. If these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, or misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators or other adverse consequences. Obligations related to data privacy and security (and consumers' data privacy expectations) are quickly changing, becoming increasingly stringent, and creating uncertainty. Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions. Preparing for and complying with these obligations requires us to devote significant resources, which may necessitate changes to our services, information technologies, systems, and practices and to those of any third parties that process personal data on our behalf. In addition, these obligations may require us to change our business model. We have in the past, and could be in the future, subject to data breaches. Our failure (or perceived failure) to comply with applicable data privacy and security obligations, or to protect such data, could result in significant consequences to us, including fines, imprisonment of company officials and public censure, claims for damages by end-customers, and other affected individuals, and the imposition of integrity obligations and agency oversight, damage to our reputation, and loss of goodwill, any of which could harm our operations, financial performance, and business. In particular, plaintiffs have become increasingly more active in bringing privacy-related claims against companies, including class claims and mass arbitration demands. Some of these claims allow for the recovery of statutory damages on a per violation basis, and, if viable, carry the potential for monumental statutory damages, depending on the volume of data and the number of violations. Evolving and changing definitions of personal data, within the European Union, the United States, and elsewhere, may limit or inhibit our ability to operate or expand our business, including limiting strategic partnerships that may involve the sharing of data. Moreover, if the relevant laws and regulations change, or are interpreted and applied in a manner that is inconsistent with our data practices or the operation of our products, or if we expand into new regions and are required to comply with new requirements, we may need to expend resources in order to change our business operations, data practices, or the manner in which our products operate. Even the perception of privacy concerns, whether or not valid, may harm our reputation and inhibit adoption of our products.

The medical device industry is regulated extensively by governmental authorities, principally the FDA and corresponding state and foreign regulatory authorities. The FDA and other U.S. and foreign regulatory authorities regulate, among other things, with respect to medical devices: -     design, development, and manufacturing;-     testing, labeling, content, and language of instructions for use and storage;-     clinical trials;-     product safety;-     marketing, sales, and distribution;-     premarket clearance and approval;-     conformity assessment procedures and the issue of related CE Certificates of Conformity;-     record keeping procedures;-     advertising and promotion;-     compliance with good manufacturing practices requirements;-     recalls and field safety corrective actions;-     post-market surveillance, including reporting of deaths or serious injuries and malfunctions that, if they were to recur, could lead to death or serious injury;-     post-market approval studies; and -     product import and export. The regulations to which we are subject are complex and have tended to become more stringent over time. Regulatory changes could result in restrictions on our ability to carry on or expand our operations, difficulties achieving new product clearances, higher than anticipated costs or lower than anticipated sales. Before we can market or sell a new regulated medical device or make a significant modification to an existing product in the United States, with limited exceptions, we must obtain either clearance under Section 510(k) of the FDCA for Class II devices or approval of a PMA application from the FDA for a Class III device. If the FDA requires us to go through a lengthier, more rigorous examination for future products or modifications to existing products than we expect, our product introductions or modifications could be delayed or canceled, which could cause our sales to decline. In addition, the FDA may determine that future products will require the more costly, lengthy, and uncertain PMA process. Although we do not currently market any devices under PMA, the FDA may demand that we obtain a PMA prior to marketing certain of our future products. In addition, if the FDA disagrees with our determination that a product we currently market is subject to an exemption from premarket review, the FDA may require us to submit a 510(k) or PMA in order to continue marketing the product. Further, even with respect to those future products where a PMA is not required, we cannot assure investors that we will be able to obtain the 510(k) clearances with respect to those products. If current or future products that we seek to commercialize are determined to require a PMA or De Novo 510(k) clearance, FDA may require evidence from clinical trials conducted under an investigational device exemption ("IDE"). Trials conducted under an IDE and a PMA or De Novo 510(k) submission to the FDA can be lengthy and costly processes, which could delay and add to the cost of commercializing our products, which could adversely affect our financial results. The FDA can delay, limit or deny clearance or approval of a device for many reasons, including: -     we may not be able to demonstrate to the FDA's satisfaction that our products are safe and effective for their intended uses;-     the data from our pre-clinical studies and clinical trials may be insufficient to support clearance or approval, where required; and -     the manufacturing process or facilities we use may not meet applicable requirements. In addition, the FDA may change its clearance and approval policies, adopt additional regulations or revise existing regulations, or take other actions which may prevent or delay clearance or approval of our products under development or impact our ability to modify our currently approved or cleared products on a timely basis. Any delay in, or failure to receive or maintain, clearance or approval for our products under development could prevent us from generating revenue from these products or achieving profitability. In addition, even after we have obtained the proper regulatory clearance or approval to market a product, the FDA has the power to require us to conduct post-marketing studies. These studies can be very expensive and time consuming to conduct. Failure to comply with those studies in a timely manner could result in the revocation of the 510(k) clearance for a product that is subject to such a 522 Order and the recall or withdrawal of the product, which could prevent us from generating sales from that product in the United States In the EU, the Medical Device Regulation became applicable on May 26, 2021, repealing and replacing the MDD. The Medical Device Regulation establishes transitional provisions. However, the changes to the regulatory system implemented in the EU by the Medical Device Regulation include stricter requirements for clinical evidence and pre-market assessment of safety and performance, new classifications to indicate risk levels, requirements for third party testing by Notified Bodies, tightened and streamlined QMS assessment procedures and additional requirements for the QMS, additional requirements for traceability of products and transparency as well a refined responsibility of economic operators. We are also required to provide clinical data in the form of a clinical evaluation report. Fulfillment of the obligations imposed by the Medical Device Regulation may cause us to incur substantial costs. We may be unable to fulfil these obligations, or our Notified Body may consider that we have not adequately demonstrated compliance with our related obligations to merit a CE Certificate of Conformity on the basis of the Medical Device Regulation. The FDA and other regulatory authorities, including foreign authorities, have broad enforcement powers. Regulatory enforcement or inquiries, or other increased scrutiny on us, could dissuade some physicians from using our products and adversely affect our reputation and the perceived safety and effectiveness of our products. Failure to comply with applicable regulations could jeopardize our ability to sell our products and result in enforcement actions such as: -     warning letters;-     fines;-     injunctions;-     civil penalties;-     termination of distribution;-     recalls or seizures of products;-     delays in the introduction of products into the market;-     total or partial suspension of production;-     facility closures;-     refusal of the FDA or our Notified Body or other regulator to grant future clearances or approvals or to issue CE Certificates of Conformity;-     withdrawals, variation, or suspensions of current clearances or approvals and CE Certificates of Conformity, resulting in prohibitions on sales of our products; and -     in the most serious cases, criminal penalties. Adverse action by an applicable regulatory authority, our Notified Body or the FDA could result in inability to produce our products in a cost-effective and timely manner, or at all, decreased sales, higher prices, lower margins, additional unplanned costs or actions, damage to our reputation, and could have material adverse effect on our reputation, business, results of operations, and financial condition.

Our iFuse Bone product is derived from human bone tissue, and as a result is subject to FDA and certain state regulations regarding human cells, tissues and cellular or tissue-based products, or HCT/Ps. To date, iFuse Bone is our only HCT/P product, and as a product regulated under Section 361 of the Public Health Service Act, we have not been required to file a 510(k) with respect to iFuse Bone. However, the FDA could require us to obtain a 510(k) clearance for future tissue products not regulated as 361 HCT/Ps. The process of obtaining a 510(k) clearance could take time and consume resources, and failing to receive such a clearance would render us unable to market and sell such products, which could have a material and adverse effect on our business. In addition, procurement of certain human organs and tissue for transplantation is subject to the National Organ Transplant Act ("NOTA"), which prohibits the transfer of certain human organs, including skin and related tissue, for valuable consideration, but permits the reasonable payment for costs associated with the removal, transportation, implantation, processing, preservation, quality control, and storage of human tissue and skin. We reimburse tissue banks for their expenses associated with the recovery, storage, and transportation of donated human tissue they provide to use for processing. We include in our pricing structure amounts paid to tissue banks to reimburse them for their expenses associated with the recovery and transportation of the tissue, in addition to certain costs associated with processing, preservation, quality control, and storage of the tissue, marketing and medical education expenses, and costs associated with development of tissue processing technologies. NOTA payment allowances may be interpreted to limit the amount of costs and expenses we can recover in our pricing for our products, thereby reducing our future revenue and profitability. If we were to be found to have violated NOTA's prohibition on the sale or transfer of human tissue for valuable consideration, we would potentially be subject to criminal enforcement sanctions, which could materially and adversely affect our results of operations.

We currently market our products internationally and intend to expand our international marketing. International jurisdictions require separate regulatory approvals and compliance with numerous and varying regulatory requirements. For example, we intend to continue to seek domestic and international regulatory clearance to market our primary products Asia, the Middle East and other key markets. The approval procedures vary among countries and may involve requirements for substantial additional testing, and the time required to obtain approval may differ from country to country and from that required to obtain FDA clearance or approval or to obtain CE Certificates of Conformity. Clearance or approval by the FDA or obtaining a CE Certificate of Conformity does not ensure approval or certification by regulatory authorities in other countries or jurisdictions, and approval or certification by one foreign regulatory authority does not ensure approval or certification by regulatory authorities in other foreign countries or by the FDA. The foreign regulatory approval or certification process may include all of the risks associated with obtaining FDA clearance or approval, or a CE Certificate of Conformity for a medical device in the EEA, in addition to other risks. In addition, the time required to obtain foreign approval may differ from that required to obtain FDA clearance or approval, or a CE Certificate of Conformity in the EEA, and we may not obtain foreign regulatory approvals on a timely basis, if at all. We may not be able to file for regulatory approvals or certifications and may not receive necessary approvals to commercialize our products in any market. If we fail to receive necessary approvals or certifications to commercialize our products in foreign jurisdictions on a timely basis, or at all, our business, results of operations, and financial condition could be adversely affected.

We are in the process of developing our regulatory strategies for obtaining clearance approval or CE Certificates of Conformity for future products. Some of them may require 510(k) clearance by the FDA or a new CE Certificate of Conformity by a Notified Body. Other future products may require premarket approval. In addition, some of our new products may require clinical trials or significant clinical evidence to support regulatory approval and we may not successfully complete these clinical trials. Obtaining regulatory clearances or approvals and CE Certificates of Conformity can be a time-consuming process, and delays in obtaining required future regulatory clearances or approvals, and CE Certificates of Conformity would adversely affect our ability to introduce new or enhanced products in a timely manner, which in turn would adversely affect our business prospects. The FDA may not approve or clear these products or our Notified Body may not issue CE Certificate of Conformity for the indications that are necessary or desirable for successful commercialization. Indeed, the FDA may refuse our requests for 510(k) clearance or premarket approval of new products, new intended uses, or modifications to existing products and our Notified Body may refuse to issue new CE Certificates of Conformity. Failure to receive clearance, approval, or CE Certificates of Conformity for our new products would have an adverse effect on our ability to expand our business.

Healthcare providers, third-party sales agents and resellers and third-party payors play a primary role in the distribution, recommendation, ordering, and purchasing of any implant or other medical device for which we have or obtain marketing clearance or approval. Through our arrangements with customers and third-party payors, we are exposed to the risk that our employees, independent contractors, principal investigators, consultants, vendors, or third-party sales agents and resellers may engage in fraudulent or other illegal activity. Misconduct by these parties could include, among other infractions or violations, intentional, reckless and/or negligent conduct or unauthorized activity that violates FDA regulations, manufacturing standards, federal and state healthcare fraud and abuse laws and regulations, laws that require the true, complete, and accurate coding of claims for reimbursement for medical procedures submitted to private and governmental payors and reporting of other financial information or data, other commercial or regulatory laws or requirements, and equivalent foreign rules. It is not always possible to identify and deter misconduct by our employees and other third parties, and the precautions we take to detect and prevent this activity may not be effective in controlling unknown or unmanaged risks or losses or in protecting us from governmental investigations or other actions or lawsuits stemming from a failure to comply with such laws or regulations, and government authorities may conclude that our business practices do not comply with applicable fraud and abuse or other healthcare laws and regulations or guidance despite our good faith efforts to comply. There are numerous U.S. federal and state laws pertaining to healthcare fraud and abuse, including anti-kickback and false claims laws. Our relationships and our third-party sales agents and resellers' relationships with physicians, other healthcare professionals, and hospitals are subject to scrutiny under these laws. For example, we are subject to the federal health-care Anti-Kickback Statute, the federal civil False Claims Act, the Health Insurance Portability and Accountability Act ("HIPAA") and the federal Physician Payment Sunshine Act, each of which is described in detail in "Item 1. Business - Healthcare Fraud and Abuse" and "-Data Privacy and Security Laws". Certain states and countries also have enacted analogous state and foreign law equivalents of each of the above federal laws and may also mandate implementation of corporate compliance programs, require compliance with the industry's voluntary compliance guidelines, impose restrictions on device manufacturer marketing practices, and/or require tracking and reporting of gifts, compensation, and other remuneration to healthcare professionals and entities. Many of these state and foreign laws differ from each other in significant ways and may not have the same effect, thus complicating compliance efforts. If we or our employees are found to have violated any of the above laws we may be subject to significant administrative, civil and criminal penalties, including imprisonment, exclusion from participation in federal healthcare programs, such as Medicare, Medicaid, and equivalent foreign programs, significant fines, monetary penalties and damages, imposition of compliance obligations and monitoring, the curtailment or restructuring of our operations, and damage to our reputation. We have entered into consulting agreements and royalty agreements with physicians and healthcare executives, including some who are customers. We also engage in co-marketing arrangements with certain physicians who use our products. In addition, prior to our IPO, a small number of our current customer surgeons acquired from us less than 1.0% of our current outstanding common stock, which they either purchased in an arm's length transaction on terms identical to those offered to others or received from us as fair market value consideration for consulting services performed. While all of these transactions were structured to comply with applicable laws, including the federal Anti-Kickback Statute, state anti-kickback laws and other applicable laws, it is possible that regulatory agencies may view these transactions as prohibited arrangements that must be restructured, or discontinued, or for which we could be subject to significant penalties and criminal, civil and administrative liability. We would be materially and adversely affected if regulatory agencies interpret our financial relationships with physicians who order our products to be in violation of applicable laws and we were unable to comply with such laws, which could subject us to, among other things, monetary penalties for non-compliance, the cost of which could be substantial. Various state and federal regulatory and enforcement agencies, and foreign equivalents, continue actively to investigate violations of health-care laws and regulations, and the U.S. Congress continues to strengthen the arsenal of enforcement tools. To enforce compliance with the federal laws, the U.S. Department of Justice has continued its scrutiny of interactions between healthcare companies and healthcare providers, which has led to a number of investigations, prosecutions, convictions and settlements in the healthcare industry. For example, in October 2024, we received a civil investigative demand ("CID") from the U.S. Department of Justice, Civil Division, in connection with an investigation under the federal Anti-Kickback Statute and Civil False Claims Act (the "Investigation"). The CID requests information and documents primarily relating to meals and consulting service payments provided to health-care professionals. Dealing with this Investigation and other investigations may be time- and resource-consuming and can divert management's attention from the business. In addition, most of these laws apply to not only the actions taken by us, but also actions taken by our distributors and other third party agents, and healthcare providers with whom we interact. We have limited control over the business practices of our distributors and agents, and we may face regulatory action against us as a result of their actions which could have a material adverse effect on our reputation, business, results of operations, and financial condition. Additionally, if a healthcare company settles an investigation with the Department of Justice or other law enforcement agencies, it may need to agree to additional onerous compliance and reporting requirements as part of a consent decree, deferred or non-prosecution agreement, or corporate integrity agreement. Our current Investigation and any new investigation or settlement could increase our costs or otherwise have an adverse effect on our business. Even if we are not determined to have violated these laws, government investigations into these issues typically require the expenditure of significant resources and generate negative publicity, which could harm our financial condition and divert resources and the attention of our management from operating our business. The scope and enforcement of these laws is uncertain and subject to rapid change. The shifting compliance environment and the need to build and maintain robust and expandable systems and processes to comply with different compliance and/or reporting requirements in multiple jurisdictions increase the possibility that we may run afoul of one or more of the requirements or that federal or state regulatory authorities might challenge our current or future activities under these laws. Additionally, we cannot predict the impact of any changes in these laws, whether or not retroactive.

Our amended and restated certificate of incorporation and amended and restated bylaws contain provisions that could delay or prevent a change in control of our company. These provisions could also make it difficult for stockholders to elect directors that are not nominated by the current members of our board of directors or take other corporate actions, including effecting changes in our management. These provisions include: -     a classified board of directors with three-year staggered terms, which could delay the ability of stockholders to change the membership of a majority of our board of directors;-     the ability of our board of directors to issue shares of preferred stock and to determine the price and other terms of those shares, including preferences and voting rights, without stockholder approval, which could be used to significantly dilute the ownership of a hostile acquiror;-     the exclusive right of our board of directors to elect a director to fill a vacancy created by the expansion of our board of directors or the resignation, death or removal of a director, which prevents stockholders from being able to fill vacancies on our board of directors;-     a prohibition on stockholder action by written consent, which forces stockholder action to be taken at an annual or special meeting of our stockholders;-     the requirement that a special meeting of stockholders may be called only by a majority vote of our entire board of directors, the chairman of our board of directors, or our chief executive officer, which could delay the ability of our stockholders to force consideration of a proposal or to take action, including the removal of directors;-     the requirement for the affirmative vote of holders of at least 66 2/3% of the voting power of all of the then-outstanding shares of the voting stock, voting together as a single class, to amend the provisions of our amended and restated certificate of incorporation relating to the management of our business or our amended and restated bylaws, which may inhibit the ability of an acquiror to effect such amendments to facilitate an unsolicited takeover attempt; and -     advance notice procedures with which stockholders must comply to nominate candidates to our board of directors or to propose matters to be acted upon at a stockholders' meeting, which may discourage or deter a potential acquiror from conducting a solicitation of proxies to elect the acquiror's own slate of directors or otherwise attempting to obtain control of us. In addition, as a Delaware corporation, we are subject to Section 203 of the Delaware General Corporation Law. These provisions may prohibit large stockholders, in particular those owning 15% or more of our outstanding voting stock, from merging or combining with us for a certain period of time. A Delaware corporation may opt out of this provision by express provision in its original certificate of incorporation or by amendment to its certificate of incorporation or bylaws approved by its stockholders. However, we have not opted out of, and do not currently intend to opt out of, this provision. These and other provisions in our amended and restated certificate of incorporation, amended and restated bylaws and Delaware law could make it more difficult for stockholders or potential acquirers to obtain control of our board of directors or initiate actions that are opposed by our then-current board of directors, including delay or impede a merger, tender offer, or proxy contest involving our company. The existence of these provisions could negatively affect the price of our common stock and limit opportunities for our stockholders to realize value in a corporate transaction.

Effective internal control over financial reporting is necessary for us to provide reliable financial reports and, together with adequate disclosure controls and procedures, are designed to prevent fraud. Any failure to implement required new or improved controls, or difficulties encountered in their implementation could cause us to fail to meet our reporting obligations. We are required to disclose changes made in our internal controls and procedures on a quarterly basis and our management is required to assess the effectiveness of these controls annually. We are also required to obtain an independent assessment of the effectiveness of our internal controls which could detect problems that our management's assessment might not. Going forward, even if our management concludes that our internal control over financial reporting is effective, our independent registered public accounting firm may conclude that there are material weaknesses or significant deficiencies with respect to our internal controls or the level at which our internal controls are documented, designed, implemented or reviewed. If we or our independent registered public accounting firm identifies deficiencies in our internal control over financial reporting that are deemed to be material weaknesses or that may require prospective or retroactive changes to our financial statements, investors may lose confidence in our reported financial information, which could cause the market price of our common shares to decline and we could be subject to sanctions or investigations by the SEC or other regulatory authorities, which would require additional financial and management resources. Irrespective of compliance with Section 404, any failure of our internal control over financial reporting could have a material adverse effect on our stated operating results and harm our reputation.

We are a large accelerated filer and beginning with our Quarterly Report on Form 10-Q for the quarter ending March 31, 2024, we may no longer provide scaled disclosure as a "smaller reporting company" as defined under the Securities Exchange Act of 1934, as amended (the "Exchange Act"). As a smaller reporting company, we had the option to take advantage of certain exemptions from various reporting requirements that are applicable to other public companies, including, but not limited to, reduced disclosure obligations regarding executive compensation in our periodic reports and proxy statements. In addition, as a non-accelerated filer and smaller reporting company, we have availed ourselves of the exemption from the requirement that our independent registered public accounting firm attest to the effectiveness of our internal control over financial reporting under Section 404(b) of the Sarbanes Oxley Act ("Section 404"). However, we may no longer avail ourselves of this exemption as a large accelerated filer, which will increase our expenses and require a significant amount of management time.

Even if our clinical trials are completed as planned, or on a delayed basis, we cannot be certain that their results will support our product candidate claims or that the FDA, foreign authorities, or our Notified Body will agree with our conclusions regarding them. Success in pre-clinical studies and early clinical trials does not ensure that later clinical trials will be successful, and we cannot be sure that the later trials will replicate the results of prior trials and pre-clinical studies. The clinical trial process may fail to demonstrate that our product candidates are safe and effective for the proposed indicated uses, which could cause us to abandon a product candidate and may delay development of others. Any delay or termination of our clinical trials will delay the filing of our product submissions and, ultimately, our ability to commercialize our product candidates and generate revenue. It is also possible that patients enrolled in clinical trials will experience adverse events that are not currently part of the product candidate's profile.

Any modification to a 510(k)-cleared device that could significantly affect its safety or effectiveness, or that would constitute a major change in its intended use, design, or manufacture, requires a new 510(k) clearance or, possibly, a PMA. The FDA requires every manufacturer to make and document this determination in the first instance. A manufacturer may determine that a modification could not significantly affect safety or effectiveness and does not represent a major change in its intended use, so that no new 510(k) clearance is necessary. FDA may review any manufacturer's decision and may not agree with our decisions regarding whether new clearances or approvals are necessary. The FDA may also on its own initiative determine that a new clearance or approval is required. We have modified some of our 510(k) cleared products and have determined based on our review of the applicable FDA guidance that in certain instances new 510(k) clearances or PMAs are not required. If the FDA disagrees with our determination and requires us to submit new 510(k) clearances or PMAs for modifications to our previously cleared products for which we have concluded that new clearances or approvals are unnecessary, we may be required to cease marketing or to recall the modified product until we obtain clearance or approval. In these circumstances, we may be subject to significant enforcement actions, regulatory fines, or penalties, which could require us to redesign our products and harm our operating results. If a manufacturer determines that a modification to an FDA-cleared device could significantly affect its safety or effectiveness, or would constitute a major change in its intended use, then the manufacturer must file for a new 510(k) clearance or possibly a premarket approval application. Where we determine that modifications to our products require a new 510(k) clearance or premarket approval application, we may not be able to obtain those additional clearances or approvals for the modifications or additional indications in a timely manner, or at all. FDA's ongoing review of the 510(k) program may make it more difficult for us to make modifications to our previously cleared products, either by imposing more strict requirements on when a new 510(k) for a modification to a previously cleared product must be submitted, or applying more onerous review criteria to such submissions. In the EEA, we must inform the Notified Body that carried out the conformity assessment of the medical devices we market or sell in the EEA of any planned significant changes are made to the products or if there are substantial changes to our quality assurance systems affecting those products. The Notified Body will then assess the changes and determine whether additional audits or actions are required prior to their implementation. Obtaining variation of existing CE Certificates of Conformity or a new CE Certificate of Conformity can be a time-consuming process, and delays in obtaining required future clearances, certifications or approvals would adversely affect our ability to introduce new or enhanced products in a timely manner, which in turn would harm our future growth. Moreover, any substantial changes that take place in the coming years may impact the continuing validity of our CE Certificates of Conformity that were issued on the basis of the Medical Device Directive.

In November 2018, we introduced our iFuse Bedrock technique, in which spine surgeons place iFuse triangular implants across the sacroiliac joint using a different surgical approach to treat sacroiliac joint dysfunction at the same time they are fusing multiple levels of the spine above and affixing those spinal fusion devices to the pelvis. In April 2019, the FDA cleared promotion of iFuse Bedrock for a broader and more general purpose, to provide additional stability and immobilization of the sacroiliac joint in connection with a thoracolumbar fusion procedure. In May 2022, we introduced iFuse Bedrock Granite, an implant which fuses the sacroiliac joint and attaches to the rods placed in a multi-segment spinal fusion construct, and which is used in substantially similar procedures as the iFuse Bedrock technique. To date, clinical experience with the iFuse Bedrock technique and with iFuse Bedrock Granite is limited and we have yet to complete a clinical trial to evaluate the iFuse Bedrock technique or the iFuse Bedrock Granite implant. Surgeons do not know if the addition of sacroiliac fusion devices to the implants used to fuse multiple levels of the lumbar spine will result in patient benefit. If surgeons' clinical experience with our implants in these procedures is not positive, or if our clinical trials do not show meaningful benefits to the patients undergoing this procedure, sale of our iFuse implants for this indication could be adversely impacted, which could negatively affect our operations and financial condition. In February 2021, we launched iFuse-TORQ, a line of 3D-printed threaded implants designed for use in pelvic trauma, as well as applications in sacroiliac joint dysfunction and degeneration. In 2022, the FDA provided clearance for an expanded indication for iFuse-TORQ to include acute, non-acute and non-traumatic fractures as well as for placement across the sacroiliac joint using our Bedrock technique. Clinical experience with iFuse-TORQ is limited and we have yet to complete a clinical trial to evaluate the use of iFuse-TORQ in patients with sacral fragility or insufficiency fractures. Physicians do not yet know if pelvic fracture fixation and sacroiliac joint fusion using iFuse-TORQ is superior to nonsurgical management in this class of patients. If physicians' clinical experience with our implants in these procedures is not positive, or if our clinical trials do not show meaningful benefits to the patients undergoing this procedure, sale of our iFuse implants for this indication could be adversely impacted, which could negatively affect our operations and financial condition.

The products we currently market in the United States have either received premarket clearance under Section 510(k) of the United States Federal Food, Drug, and Cosmetic Act ("FDCA"), or are exempt from premarket review. Those marketed in the EEA have been the subject of a CE Certificate of Conformity. The 510(k) clearance process of the U.S. Food and Drug Administration ("FDA") requires us to document that our product is "substantially equivalent" to another 510(k)-cleared product. The 510(k) process is shorter and typically requires the submission of less supporting documentation than other FDA approval processes, such as a premarket approval ("PMA"), and does not usually require pre-clinical or clinical studies. As a result, iFuse-TORQ and iFuse Bedrock Granite have been launched prior to gathering substantial prospective clinical trial evidence, and our post-market clinical studies may lack the size and scope of randomized controlled clinical trials required to support approval of a PMA. For these reasons, physicians may be slow to adopt our products, third-party payors may be slow to provide coverage, and we may be subject to greater regulatory and product liability risks. Further, future patient studies or clinical experience may indicate that treatment with our products does not improve patient outcomes. Such results would slow the adoption of our products by physicians, significantly reduce our ability to achieve expected sales, and could prevent us from achieving profitability.

Many of our employees were previously employed at other medical device companies, including our competitors or potential competitors, in some cases until recently. Some of our third-party sales agents or resellers sell, or in the past have sold, products of our competitors. We may be subject to claims that we, our employees, or our third-party sales agents or resellers have inadvertently or otherwise used or disclosed trade secrets or other proprietary information of these former employers or competitors. In addition, we have been and may in the future be subject to claims that we caused an employee to breach the terms of his or her non-competition or non-solicitation agreement. Even if we are successful in defending against these claims, litigation could result in substantial costs, divert the attention of management from our core business and harm our reputation. If our defense to those claims fails, in addition to paying monetary damages, we may lose valuable intellectual property rights or personnel. There can be no assurance that this type of litigation will not occur, and any future litigation or the threat thereof may adversely affect our ability to hire additional direct sales representatives. A loss of key personnel or their work product could hamper or prevent our ability to commercialize product candidates, which could have an adverse effect on our business, results of operations, and financial condition.

Substantially all of our revenue comes from the sale of iFuse, iFuse-3D, iFuse-TORQ, and iFuse Bedrock Granite implants, and related tools and instruments. Therefore, we are dependent on widespread market adoption of iFuse and we will continue to be dependent on the success of this single product family for some time. There can be no assurance that iFuse will maintain a substantial degree of market acceptance among physicians, patients or healthcare providers. Our failure to successfully grow the market for iFuse and increase our share within that market or any other event impeding our ability to sell iFuse, could adversely affect our results of operations, financial condition and continuing operations.

As of December 31, 2023, our U.S. sales force consisted of 82 territory sales managers and 69 clinical support specialists directly employed by us and 175 third-party sales agents. As of December 31, 2023, our international sales force consisted of 14 sales representatives directly employed by us and a total of 31 third-party sales agents and resellers, which together have had sales in 38 countries through December 31, 2023. Our operating results are directly dependent upon the sales and marketing efforts of both our direct sales force and of our third-party sales agents and resellers. As we launch new products and increase our marketing efforts with respect to existing products, we will need to expand the reach of our marketing and sales networks. Our future success will depend largely on our ability to continue to hire, train, retain and motivate skilled direct sales representatives and third-party sales agents and resellers with significant technical knowledge in various areas, such as spine and pelvic health and treatment. New hires require training and take time to achieve full productivity. If we fail to train new hires adequately, or if we experience high turnover in our sales force in the future, we cannot be certain that new hires will become as productive as may be necessary to maintain or increase our sales. If a direct sales representative or third-party sales agent or reseller departs and is retained by one of our competitors, we may be unable to prevent them from helping competitors solicit business from our existing customers, which could further adversely affect our sales. The launch of new products or entrance into new markets could distract our sales representatives from existing customers and markets and redirect resources from existing to novel markets. Furthermore, any such change affects our ability to hire, contract with and retain members of our direct sales force and third-party sales agents and resellers. Because of the intense competition for their services, we may be unable to recruit or retain additional qualified third-party sales agents and resellers or to hire additional direct sales representatives to work with us. Furthermore, we may not be able to enter into agreements with them on favorable or commercially reasonable terms, if at all. Failure to hire or retain qualified direct sales representatives or third-party sales agents and resellers would prevent us from expanding our business and generating sales. If our direct sales representatives or third-party sales agents fail to adequately promote, market and sell our products or decide to leave or cease to do business with us, our sales could significantly decrease. If we are unable to expand our sales and marketing capabilities domestically and internationally, we may not be able to effectively commercialize our products, which would adversely affect our business, results of operations, and financial condition.