Biogen Inc.: 10-K Risk Factor Changes

As a global biopharmaceutical company, we are subject to taxation in numerous countries, states and other jurisdictions. As a result, our effective tax rate is derived from a combination of applicable tax rates, including 53 53 53 Table of Contents Table of Contents withholding taxes, in the various places that we operate. In preparing our financial statements, we estimate the amount of tax that will become payable in each of such places. Our effective tax rate may be different than experienced in the past or our current expectations due to many factors, including changes in the mix of our profitability from country to country, the results of examinations and audits of our tax filings, adjustments to the value of our uncertain tax positions, interpretations by tax authorities or other bodies with jurisdiction, the result of tax cases, changes in accounting for income taxes and changes in tax laws and regulations either prospectively or retrospectively and the effects of the integration of Reata. Our inability to secure or sustain acceptable arrangements with tax authorities and future changes in the tax laws, among other things, may result in tax obligations in excess of amounts accrued in our financial statements. The enactment of some or all of the recommendations set forth or that may be forthcoming in the OECD’s project on “Base Erosion and Profit Shifting” by tax authorities and economic blocs in the countries in which we operate, could unfavorably impact our effective tax rate. These initiatives focus on common international principles for the entitlement to taxation of global corporate profits and minimum global tax rates. Many countries have or are in the process of enacting legislation intended to implement the OECD GloBE Model Rules effective on January 1, 2024. The impact on the Company will depend on the timing of implementation, the exact nature of each country's GloBE legislation, guidance and regulations thereon and their application by tax authorities either prospectively or retrospectively.

As a global biopharmaceutical company, we are subject to taxation in numerous countries, states and other jurisdictions. As a result, our effective tax rate is derived from a combination of applicable tax rates, including withholding taxes, in the various places that we operate. In preparing our financial statements, we estimate the amount of tax that will become payable in each of such places. Our effective tax rate may be different than experienced in the past or our current expectations due to many factors, including changes in the mix of our 41 41 41 Table of Contents Table of Contents profitability from country to country, the results of examinations and audits of our tax filings (including those related to the impact of the Tax Cuts and Jobs Act of 2017), adjustments to the value of our uncertain tax positions, interpretations by tax authorities or other bodies with jurisdiction, the result of tax cases, changes in accounting for income taxes and changes in tax laws and regulations either prospectively or retrospectively (including those related to the IRA). Our inability to secure or sustain acceptable arrangements with tax authorities and future changes in the tax laws, among other things, may result in tax obligations in excess of amounts accrued in our financial statements. The enactment of some or all of the recommendations set forth or that may be forthcoming in the Organization for Economic Cooperation and Development’s project on “Base Erosion and Profit Shifting” (BEPS) by tax authorities and economic blocs in the countries in which we operate, could unfavorably impact our effective tax rate. These initiatives focus on common international principles for the entitlement to taxation of global corporate profits and minimum global tax rates.

Social media is increasingly being used to communicate about our products and the diseases our therapies are designed to treat. Social media practices in the biopharmaceutical industry continue to evolve and regulations relating to such use are not always clear and create uncertainty and risk of noncompliance with regulations applicable to our business. For example, patients may use social media channels to comment on the effectiveness 51 51 51 Table of Contents Table of Contents of a product or to report an alleged adverse event. When such disclosures occur, there is a risk that we fail to monitor and comply with applicable adverse event reporting obligations or we may not be able to defend the company or the public's legitimate interests in the face of the political and market pressures generated by social media due to restrictions on what we may say about our products. There is also a risk of inappropriate disclosure of sensitive information or negative or inaccurate posts or comments about us on social media. We may also encounter criticism on social media regarding our company, management, product candidates or products. The immediacy of social media precludes us from having real-time control over postings made regarding us via social media, whether matters of fact or opinion. Our reputation could be damaged by negative publicity or if adverse information concerning us is posted on social media platforms or similar mediums, which we may not be able to reverse. If any of these events were to occur or we otherwise fail to comply with applicable regulations, we could incur liability, face restrictive regulatory actions or incur other harm to our business. Additionally, the use of AI based software is increasingly being used in the biopharmaceutical industry. Use of AI based software may lead to the release of confidential proprietary information which may impact our ability to realize the benefit of our intellectual property.

Social media is increasingly being used to communicate about our products and the diseases our therapies are designed to treat. Social media practices in the biopharmaceutical industry continue to evolve and regulations relating to such use are not always clear and create uncertainty and risk of noncompliance with regulations 39 39 39 Table of Contents Table of Contents applicable to our business. For example, patients may use social media channels to comment on the effectiveness of a product or to report an alleged adverse event. When such disclosures occur, there is a risk that we fail to monitor and comply with applicable adverse event reporting obligations or we may not be able to defend the company or the public's legitimate interests in the face of the political and market pressures generated by social media due to restrictions on what we may say about our products. There is also a risk of inappropriate disclosure of sensitive information or negative or inaccurate posts or comments about us on social media. We may also encounter criticism on social media regarding our company, management, product candidates or products. The immediacy of social media precludes us from having real-time control over postings made regarding us via social media, whether matters of fact or opinion. Our reputation could be damaged by negative publicity or if adverse information concerning us is posted on social media platforms or similar mediums, which we may not be able to reverse. If any of these events were to occur or we otherwise fail to comply with applicable regulations, we could incur liability, face restrictive regulatory actions or incur other harm to our business.

Our revenue depends upon continued sales of our products as well as the financial rights we have in our anti-CD20 therapeutic programs. A significant portion of our revenue is concentrated on sales of our products in increasingly competitive markets. Any of the following negative developments relating to any of our products or any of our anti-CD20 therapeutic programs may adversely affect our revenue and results of operations or could cause a decline in our stock price: •the introduction, greater acceptance or more favorable reimbursement of competing products, including new originator therapies, generics, prodrugs and biosimilars of existing products and products approved under abbreviated regulatory pathways; •safety or efficacy issues; •limitations and additional pressures on product pricing or price increases, including those relating to inflation and those resulting from governmental or regulatory requirements, including those relating to any future potential drug price negotiation under the IRA; increased competition, including from generic or biosimilar versions of our products; or changes in, or implementation of, reimbursement policies and practices of payors and other third-parties; •adverse legal, administrative, geopolitical events, regulatory or legislative developments; or •our ability to maintain a positive reputation among patients, healthcare providers and others, which may be impacted by our pricing and reimbursement decisions. LEQEMBI and SKYCLARYS are in the early stages of commercial launch in the U.S. In addition to risks associated with new product launches and the other factors described in these Risk Factors, Biogen’s and Eisai’s ability to successfully commercialize LEQEMBI and our ability to successfully commercialize SKYCLARYS may be adversely affected due to: •Eisai’s ability to obtain and maintain adequate reimbursement for LEQEMBI; •the effectiveness of Eisai's and Biogen’s commercial strategy for marketing LEQEMBI; •requirements such as participation in a registry and the use of imaging or other diagnostics for LEQEMBI; •our ability to obtain approval in other markets; •the approval of other new products for the same or similar indications; •Eisai’s and Biogen’s ability to maintain a positive reputation among patients, healthcare providers and others in the Alzheimer’s disease community, which may be impacted by pricing and reimbursement decisions relating to LEQEMBI, which are made by Eisai; •Biogen's ability to obtain and maintain adequate reimbursement for SKYCLARYS; and •the effectiveness of Biogen's commercial strategy for marketing SKYCLARYS.

Our revenue depends upon continued sales of our products as well as the financial rights we have in our anti-CD20 therapeutic programs. A significant portion of our revenue is concentrated on sales of our products in increasingly competitive markets. Any of the following negative developments relating to any of our products or any of our anti-CD20 therapeutic programs may adversely affect our revenue and results of operations or could cause a decline in our stock price: •the introduction, greater acceptance or more favorable reimbursement of competing products, including new originator therapies, generics, prodrugs and biosimilars of existing products and products approved under abbreviated regulatory pathways; •safety or efficacy issues; •limitations and additional pressures on product pricing or price increases, including those resulting from governmental or regulatory requirements; increased competition, including from generic or biosimilar versions of our products; or changes in, or implementation of, reimbursement policies and practices of payors and other third-parties; •adverse legal, administrative, regulatory or legislative developments; •our ability to maintain a positive reputation among patients, healthcare providers and others, which may be impacted by our pricing and reimbursement decisions; or •the inability or reluctance of patients to receive a diagnosis, prescription or administration of our products or a decision to prescribe and administer competitive therapies as a direct or indirect result of the COVID-19 pandemic. LEQEMBI is in the early stages of commercial launch in the U.S. In addition to risks associated with new product launches and the other factors described in these Risk Factors, Biogen’s and Eisai’s ability to successfully commercialize LEQEMBI may be adversely affected due to: •Eisai’s ability to obtain and maintain adequate reimbursement for LEQEMBI; •the effectiveness of Eisai's and Biogen’s commercial strategy for marketing LEQEMBI; and •Eisai’s and Biogen’s ability to maintain a positive reputation among patients, healthcare providers and others in the Alzheimer’s disease community, which may be impacted by pricing and reimbursement decisions relating to LEQEMBI, which are made by Eisai. The FDA may withdraw approval if Eisai and Biogen fail to comply with the conditions of the accelerated approval.

Our business and the business of several of our strategic partners involve the controlled use of hazardous materials, chemicals, biologics and radioactive compounds. Although we believe that our safety procedures for handling and disposing of such materials comply with state, federal and foreign standards, there will always be the risk of accidental contamination or injury. If we were to become liable for an accident, or if we were to suffer an extended facility shutdown, we could incur significant costs, damages and penalties that could harm our business. Manufacturing of our products and product candidates also requires permits from government agencies for water supply and wastewater discharge. If we do not obtain appropriate permits, including permits for sufficient quantities of water and wastewater, we could incur significant costs and limits on our manufacturing volumes that could harm our business. Additionally, regulators are considering new environmental disclosure rules. For example, the SEC and other regulators are considering environmental disclosure rules and California enacted new environmental disclosure laws in October 2023 that will generally require additional disclosure and reporting by 2026. The new California laws, the Climate Corporate Data Accountability Act and the Climate-Related Financial Risk Act, each impose additional climate-related reporting requirements on large companies conducting business in the state of California. We expect to be subject to these new laws, which impose extensive reporting obligations about greenhouse gas emissions and climate-related financial risks. These recently enacted and proposed regulations may require us to incur compliance and disclosure costs and require management attention.

Our business and the business of several of our strategic partners involve the controlled use of hazardous materials, chemicals, biologics and radioactive compounds. Although we believe that our safety procedures for handling and disposing of such materials comply with state, federal and foreign standards, there will always be the risk of accidental contamination or injury. If we were to become liable for an accident, or if we were to suffer an extended facility shutdown, we could incur significant costs, damages and penalties that could harm our business. Manufacturing of our products and product candidates also requires permits from government agencies for water supply and wastewater discharge. If we do not obtain appropriate permits, including permits for sufficient quantities of water and wastewater, we could incur significant costs and limits on our manufacturing volumes that could harm our business. Additionally, regulators are considering new environmental disclosure rules. For example, the SEC has proposed amendments to its disclosure rules regarding climate-related disclosure requirements. These proposed regulations may impact the manner in which we operate.

In order to support our future growth and drug development pipeline, we have expanded our large molecule production capacity by building a large-scale biologics manufacturing facility in Solothurn, Switzerland with no assurance that the additional capacity will be required or this investment will be recouped. Although the Solothurn facility was approved by the FDA for ADUHELM and LEQEMBI, there can be no assurance that the regulatory authorities will approve the Solothurn facility for the manufacturing of other products. Additionally, we are building a new gene therapy manufacturing facility in RTP, North Carolina with no assurance that this investment will be fully utilized. If we are unable to fully utilize this gene therapy manufacturing facility, charges from excess capacity may occur and would have a negative effect on our financial condition and results of operations. If we are unable to fully utilize our manufacturing facilities, our business may be harmed. Charges resulting from excess capacity may continue to occur and would have a negative effect on our financial condition and results of operations.

In order to support our future growth and drug development pipeline, we are expanding our large molecule production capacity by building a large-scale biologics manufacturing facility in Solothurn, Switzerland with no assurance that the additional capacity will be required or this investment will be recouped. 38 38 38 Table of Contents Table of Contents If we are unable to fully utilize our manufacturing facilities, our business may be harmed. Charges resulting from excess capacity may continue to occur and would have a negative effect on our financial condition and results of operations. Although the Solothurn facility was approved by the FDA for ADUHELM and LEQEMBI, there can be no assurance that the regulatory authorities will approve the Solothurn facility for the manufacturing of other products.

We are increasingly dependent upon information systems and data to operate our business. Changes in how we operate have caused us to modify our business practices in ways that heighten this dependence, including changing the requirement that most of our office-based employees in the U.S. and our other key markets work from the office, with many of our employees now working in hybrid or full-remote positions. As a result, we are increasingly dependent upon our information systems to operate our business and our ability to effectively manage our business depends on the security, reliability and adequacy of our information systems and data, which includes use of cloud technologies, including Software as a Service (SaaS), Platform as a Service (PaaS) and Infrastructure as a Service (IaaS). Breakdowns, invasions, corruptions, destructions and/or breaches, which impact may include, but not limited to, comprising the capacity, reliability or security of our information systems or those of our business partners, including our cloud tech nologies, and/or unauthorized access to our data and information could subject us to significant liability, negatively impact our business operations, and/or require replacement of technology and/or sizeable ransom payments. Our information systems, including our cloud technologies, continue to increase in multitude and complexity, increasing our vulnerability when breakdowns, malicious intrusions and random attacks occur. Data privacy or security breaches also pose a risk that sensitive data, including intellectual property, trade secrets or personal information belonging to us, patients, customers or other business partners, may be exposed to unauthorized persons or to the public. Cybersecurity threats and incidents are increasing in their frequency, sophistication and intensity, and are becoming increasingly difficult to detect, particularly when they impact vendors, customers or suppliers, and other companies in our supply chain. Cybersecurity threats and incidents are often carried out by motivated, well-resourced, skilled and persistent actors, including nation states, organized crime groups, “hacktivists” and may include or target employees or contractors acting with careless or malicious intent. Recent developments in the threat landscape include use of AI and machine learning, as well as an increased number of cyber extortion attacks, with higher financial ransom demand amounts and increasing sophistication and variety of ransomware techniques and methodology. Geopolitical instability, including that related to Russia's invasion of Ukraine or the conflict in the Middle East, may increase the risk of cybersecurity threats. Cybersecurity threats or incidents may include deployment of harmful malware and key loggers, ransomware, a denial-of-service attack, a malicious website, the use of social engineering and other means to affect the confidentiality, integrity and availability of our information systems and data. Cybersecurity threats and incidents also include manufacturing, hardware or software supply chain attacks, which could cause a delay in the manufacturing of products or products produced for contract manufacturing or lead to a data privacy or security breach. Our key business partners face similar risks and any security breach of their systems could adversely affect our security posture. In addition, our increased use of cloud technologies heightens these and other operational risks, and any failure by cloud or other technology service providers to adequately safeguard their systems and prevent cyber-attacks could disrupt our operations and result in misappropriation, corruption or loss of confidential or propriety information. While we continue to build and improve our systems and infrastructure, including our business continuity plans, there can be no assurance that our efforts will prevent cybersecurity threats or incidents in our systems and any such incidents could materially adversely affect our business and operations and/or result in the loss of critical or sensitive information, which could result in material financial, legal, operational or reputational harm to us, loss of competitive advantage or loss of consumer confidence. Our liability insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks and other related breaches. 47 47 47 Table of Contents Table of Contents Regulations continue to change as regulators worldwide consider new rules. For example, the SEC has adopted additional disclosure rules regarding cyber security risk management, strategy, governance and incident reporting by public companies. These new regulations or other regulations being considered in Europe and around the world may impact the manner in which we operate. Regulators are imposing new data privacy and security requirements, including new and greater monetary fines for privacy violations. For example, the E.U.’s General Data Protection Regulation established regulations regarding the handling of personal data, and provides an enforcement authority and imposes large penalties for noncompliance. New U.S. data privacy and security laws, such as the CCPA, and others that may be passed, similarly introduce requirements with respect to personal information, and non-compliance with the CCPA may result in liability through private actions (subject to statutorily defined damages in the event of certain data breaches) and enforcement. Failure to comply with these current and future laws, policies, industry standards or legal obligations or any security incident resulting in the unauthorized access to, or acquisition, release or transfer of personal information may result in governmental enforcement actions, litigation, fines and penalties or adverse publicity and could cause our customers to lose trust in us, which could have a material adverse effect on our business and results of operations.

We are increasingly dependent upon technology systems and data to operate our business. The COVID-19 pandemic has caused us to modify our business practices in ways that heighten this dependence, including changing the requirement that most of our office-based employees in the U.S. and our other key markets work from the office, with a number of our employees now working in hybrid or full-remote positions. As a result, we are increasingly dependent upon our technology systems to operate our business and our ability to effectively manage our business depends on the security, reliability and adequacy of our technology systems and data, which includes use of cloud technologies, including Software as a Service (SaaS), Platform as a Service (PaaS) and Infrastructure as a Service (IaaS). Breakdowns, invasions, corruptions, destructions and/or breaches of our technology systems or those of our business partners, including our cloud technologies, and/or unauthorized access to our data and information could subject us to liability, negatively impact our business operations, and/or require replacement of technology and/or ransom payments. Our technology systems, including our cloud technologies, continue to increase in multitude and complexity, increasing our vulnerability when breakdowns, malicious intrusions and random attacks occur. Data 34 34 34 Table of Contents Table of Contents privacy or security breaches also pose a risk that sensitive data, including intellectual property, trade secrets or personal information belonging to us, patients, customers or other business partners, may be exposed to unauthorized persons or to the public. Cyber-attacks are increasing in their frequency, sophistication and intensity, and are becoming increasingly difficult to detect, when they impact vendors, customers or companies, including vendors, suppliers and other companies in our supply chain. They are often carried out by motivated, well-resourced, skilled and persistent actors, including nation states, organized crime groups, “hacktivists” and employees or contractors acting with careless or malicious intent. Geopolitical instability, including that related to Russia's invasion of Ukraine may increase cyber-attacks. Cyber-attacks include deployment of harmful malware and key loggers, ransomware, a denial-of-service attack, a malicious website, the use of social engineering and other means to affect the confidentiality, integrity and availability of our technology systems and data. Cyber-attacks also include manufacturing, hardware or software supply chain attacks, which could cause a delay in the manufacturing of products or products produced for contract manufacturing or lead to a data privacy or security breach. Our key business partners face similar risks and any security breach of their systems could adversely affect our security posture. In addition, our increased use of cloud technologies heightens these and other operational risks, and any failure by cloud or other technology service providers to adequately safeguard their systems and prevent cyber-attacks could disrupt our operations and result in misappropriation, corruption or loss of confidential or propriety information. While we continue to build and improve our systems and infrastructure, including our business continuity plans, there can be no assurance that our efforts will prevent breakdowns or breaches in our systems that could adversely affect our business and operations and/or result in the loss of critical or sensitive information, which could result in financial, legal, operational or reputational harm to us, loss of competitive advantage or loss of consumer confidence. Our liability insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks and other related breaches. Regulators are considering new cyber security regulations. For example, the SEC has proposed amendments to its disclosure rules regarding cyber security risk management, strategy, governance and incident reporting by public companies. These proposed regulations may impact the manner in which we operate. Regulators are imposing new data privacy and security requirements, including new and greater monetary fines for privacy violations. For example, the E.U.’s General Data Protection Regulation established regulations regarding the handling of personal data, and provides an enforcement authority and imposes large penalties for noncompliance. New U.S. data privacy and security laws, such as the California Consumer Privacy Act (CCPA), and others that may be passed, similarly introduce requirements with respect to personal information, and non-compliance with the CCPA may result in liability through private actions (subject to statutorily defined damages in the event of certain data breaches) and enforcement. Failure to comply with these current and future laws, policies, industry standards or legal obligations or any security incident resulting in the unauthorized access to, or acquisition, release or transfer of personal information may result in governmental enforcement actions, litigation, fines and penalties or adverse publicity and could cause our customers to lose trust in us, which could have a material adverse effect on our business and results of operations.

The successful execution of our strategic and growth initiatives may depend upon internal development projects, commercial initiatives and external opportunities, which may include the acquisition and in-licensing of products, 41 41 41 Table of Contents Table of Contents technologies, companies, the entry into strategic alliances and collaborations or our Fit for Growth program, as well as our ability to execute on previously-announced initiatives such as the exploration of strategic options for our biosimilars business. While we believe we have a number of promising programs in our pipeline, failure or delay of internal development projects to advance or difficulties in executing on our commercial initiatives could impact our current and future growth, resulting in additional reliance on external development opportunities for growth. Supporting the further development of our existing products and potential new products in our pipeline will require significant capital expenditures and management resources, including investments in research and development, sales and marketing, manufacturing capabilities and other areas of our business. We have made, and may continue to make, significant operating and capital expenditures for potential new products prior to regulatory approval with no assurance that such investment will be recouped, which may adversely affect our financial condition, business and operations. The availability of high quality, fairly valued external product development is limited and the opportunity for their acquisition is highly competitive. As such, we are not certain that we will be able to identify suitable candidates for acquisition or if we will be able to reach agreement to make any such acquisition if suitable candidates are identified. We may fail to initiate or complete transactions for many reasons, including failure to obtain regulatory or other approvals as well as a result of disputes or litigation. Furthermore, we may not be able to achieve the full strategic and financial benefits expected to result from transactions, or the benefits may be delayed or not occur at all. We may also face additional costs or liabilities in completed transactions that were not contemplated prior to completion. Any failure in the execution of a transaction, in the integration of an acquired asset or business or in achieving expected synergies could result in slower growth, higher than expected costs, the recording of asset impairment charges and other actions which could adversely affect our business, financial condition and results of operations. For example, we recently acquired Reata and are in the process of integrating Reata into our Company. The ultimate success of our acquisition of Reata and our ability to realize the anticipated benefits from the acquisition, including the SKYCLARYS product and anticipated synergies, depends on, among other things, how effective we are in integrating the Biogen and Reata operations. We face risks associated with our Fit for Growth program that may impair our ability to achieve anticipated savings and operational efficiencies or that may otherwise harm our business. These risks include delays in implementation of cost optimization actions, loss of workforce capabilities, higher than anticipated separation expenses, litigation and the failure to meet financial and operational targets. In addition, the calculation of the anticipated cost savings and other benefits resulting from our Fit for Growth program are subject to many estimates and assumptions. These estimates and assumptions are subject to significant business, economic, competitive and other uncertainties and contingencies, many of which are beyond our control. if these estimates and assumptions are incorrect or if we experience delays or unforeseen events, our business and financial results could be adversely affected.

The successful execution of our strategic and growth initiatives may depend upon internal development projects, commercial initiatives and external opportunities, which may include the acquisition and in-licensing of products, technologies and companies or the entry into strategic alliances and collaborations. While we believe we have a number of promising programs in our pipeline, failure or delay of internal development projects to advance or difficulties in executing on our commercial initiatives could impact our current and future growth, resulting in additional reliance on external development opportunities for growth. 29 29 29 Table of Contents Table of Contents Supporting the further development of our existing products and potential new products in our pipeline will require significant capital expenditures and management resources, including investments in research and development, sales and marketing, manufacturing capabilities and other areas of our business. We have made, and may continue to make, significant operating and capital expenditures for potential new products prior to regulatory approval with no assurance that such investment will be recouped, which may adversely affect our financial condition, business and operations. The availability of high quality, fairly valued external product development is limited and the opportunity for their acquisition is highly competitive. As such, we are not certain that we will be able to identify suitable candidates for acquisition or if we will be able to reach agreement. We may fail to initiate or complete transactions for many reasons, including failure to obtain regulatory or other approvals as well as disputes or litigation. Furthermore, we may not be able to achieve the full strategic and financial benefits expected to result from transactions, or the benefits may be delayed or not occur at all. We may also face additional costs or liabilities in completed transactions that were not contemplated prior to completion. Any failure in the execution of a transaction, in the integration of an acquired asset or business or in achieving expected synergies could result in slower growth, higher than expected costs, the recording of asset impairment charges and other actions which could adversely affect our business, financial condition and results of operations.