Our internal computer systems, cloud-based computing services and those of our current and future collaborators, third party service providers, and other contractors or consultants (collectively, our "information systems") are vulnerable to damage or interruption from computer viruses, ransomware, malware, data corruption, cyber-based attacks, phishing attacks, unauthorized access, natural disasters, terrorism, war and telecommunication and electrical failures. These computer systems may also experience disruptions or outages due to internal or third-party mistakes or technical errors, including due to software updates. Such information system disruptions, even if inadvertent, may limit or disable our access to our systems or access by our collaborators, third party service providers, or other contractors or consultants to their systems, which could disrupt our business. While we have taken steps to protect our information systems and the data maintained in those systems, we have, from time to time, experienced cyber incidents of varying degrees, although none of these cyber incidents have had a material adverse impact on our business, financial condition or results of operations. Our business is becoming increasingly dependent upon these information systems, including as a result of remote working policies following the COVID-19 pandemic. It is possible that in the future our safety and security measures will not prevent the improper functioning or damaging of our systems, or the improper access or disclosure of personally identifiable information, in particular as cyber-based attacks become increasingly sophisticated, and any such event could materially and adversely impact our business, financial condition or results of operations. If a significant system disruption, failure, accident, security breach or other cyber incident were to occur and cause interruptions in our operations, it could result in a disruption of our development programs and our business operations, whether due to a loss of our trade secrets or other proprietary information, the disclosure of protected personally identifiable patient information or other similar disruptions. For example, the loss of clinical trial data from completed or future clinical trials could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data. In addition, our software systems include cloud-based applications that are hosted by third-party service providers with security and information technology systems subject to similar risks. To the extent that any disruption, security breach or other cyber incident were to result in a loss of, or damage to, our data or applications, or inappropriate disclosure of confidential or proprietary information, we could incur liability, our competitive position could be harmed and the further development and commercialization of our product candidates could be delayed, any of which could materially adversely affect our business, financial condition, results of operations and growth prospects.
Furthermore, federal, state and international laws and regulations, such as the GDPR, which took effect in May 2018, and the CCPA which took effect on January 1, 2020, as well as the CPRA, which took effect on January 1, 2023 and made a number of significant amendments to the CCPA, can expose us to enforcement actions and investigations by regulatory authorities, and potentially result in regulatory penalties and significant legal liability, if our information systems security efforts fail or if our privacy practices do not meet the requirements of such laws. Other states are considering similar laws that could impact our use of research data with respect to individuals in those states. There are extensive documentation obligations and transparency requirements, which may impose significant costs on us.
Any computer system interruptions or security breaches of our information systems could result in a disruption of our operations, damage to our reputation, investigations, claims or lawsuits and we may also be subject to liability under relevant contractual obligations and laws and regulations protecting personal data and may be required to expend significant resources to defend, remedy and/or address any cybersecurity incidents and claims, investigations, penalties, fines, damages or settlements arising from cybersecurity incidents. We may not have adequate insurance coverage to compensate it for any losses that may occur.
The misuse of artificial intelligence could adversely impact our business, including by posing security risks to our confidential information, proprietary information and personal data.
The increasing use and integration of AI technologies, including generative AI and machine learning-based software, present risks and challenges that could materially and adversely affect our operations and business. While we may selectively integrate AI tools following legal and IT review, our current and future collaborators, third party service providers, and other contractors or consultants often may incorporate AI technologies into their platforms or services without disclosing such use to us. These tools may fall short of regulatory or ethical standards concerning privacy and data protection, leading to compromised data integrity, diminished service quality, and potential legal or reputational fallout.
Algorithmic bias and flawed analyses further compound these risks, with security breaches —real or perceived—by us or our third-party partners possibly resulting in the loss of intellectual property and sensitive information. The inadvertent disclosure of proprietary assets through AI systems can erode intellectual property protections and reduce their value. Combined with regulatory uncertainty surrounding AI development, these challenges heighten exposure to liability and adverse business outcomes.
Further, bad actors around the world use increasingly sophisticated methods, including the use of artificial intelligence, to engage in illegal activities involving the theft and misuse of personal information, confidential information, and intellectual property. Any of these outcomes could damage our reputation, result in the loss of valuable property and information, and adversely impact our business.
Our business is affected by macroeconomic conditions, including rising inflation, interest rates and supply chain constraints.*