McKesson Corporation: 10-K Risk Factor Changes

We sell and provide services involving complex software and technology that may contain errors, especially when first introduced to market. Healthcare professionals delivering patient care have heightened sensitivity to system and software errors due, among other reasons, to the critical nature of healthcare decisions. If our software and technology services are alleged to have contributed to faulty clinical decisions, compromised continuity of patient care, or injury to patients, we might be subject to regulatory scrutiny or claims by users of our software or services and/or their patients. Errors or failures might damage our reputation and negatively affect future sales. A failure of a system or software to conform to specifications might constitute a breach of warranty that could result in repair costs, contract termination, refunds, or claims for damages. The adoption and use of new technologies, including AI, may introduce new or enhanced risks, such as data inaccuracy, unreliability, or bias, as well as ethical or privacy concerns. Any of these types of errors, failures, or risks might have a materially adverse impact on our reputation, our business operations, and our financial position or results of operations. 18 18 18 Table of ContentsItem 1A IndexMcKESSON CORPORATION Table of ContentsItem 1A Index Table of Contents Item 1A Index

We sell and provide services involving complex software and technology that may contain errors, especially when first introduced to market. Healthcare professionals delivering patient care tend to have heightened sensitivity to system and software errors. If our software and technology services are alleged to have contributed to faulty clinical decisions, compromised continuity of patient care, or injury to patients, we might be subject to regulatory scrutiny or, claims by users of our software or services and/or their patients. Errors or failures might damage our reputation and negatively affect future sales. A failure of a system or software to conform to specifications might constitute a breach of warranty that could result in repair costs, contract termination, refunds, or claims for damages. These risks can be heightened upon the adoption of new technologies, including AI, and may introduce new or expanded risks, such as data inaccuracy, unreliability, or bias. Any of these types of errors or failures might have a materially adverse impact on our reputation, our business operations, and our financial position or results of operations.

We are subject to laws prohibiting improper payments and bribery, including the U.S. Foreign Corrupt Practices Act, the U.K. Bribery Act, and similar regulations in other jurisdictions. Our failure to comply with these laws might subject us to civil and criminal penalties that might have a materially adverse impact on our reputation, our business operations, and our financial position or results of operations.

We are subject to laws prohibiting improper payments and bribery, including the U.S. Foreign Corrupt Practices Act, the U.K. Bribery Act, and similar regulations in other jurisdictions. Our failure to comply with these laws might subject us to civil and criminal penalties that might have a materially adverse impact on our reputation, our business operations, and our financial position or results of operations. 15 15 15 Table of ContentsItem 1A IndexMcKESSON CORPORATION Table of ContentsItem 1A Index Table of Contents Item 1A Index

Our growth strategy includes consummating acquisitions, investments, or other strategic transactions that either expand or complement our business. To fund these strategic transactions, we may require financing that may not be available on acceptable terms. We may not receive governmental approvals needed to complete proposed transactions, or such approvals may be subject to delays or conditions that reduce transaction benefits. Achieving the desired outcomes of these strategic transactions involves significant risks including: diverting management’s attention from other business operations or priorities; challenges with assimilating the acquired businesses, such as integration of operations, systems, and technologies; failure or delay in realizing operating synergies; difficulty retaining key acquired company personnel; unanticipated accounting or financial systems issues with the acquired business, which might affect our internal controls over financial reporting; disputes with the sellers of acquired businesses; unanticipated compliance issues in the acquired business; unknown or unanticipated cybersecurity issues, as well as heightened vulnerabilities during integration; challenges retaining customers of the acquired business; unanticipated expenses or charges to earnings, including depreciation and amortization or potential impairment charges; risks of known and unknown assumed liabilities in the acquired business; failure of an acquired business or investment to perform as projected in the near or long term; and changes in laws or their interpretation or application with respect to an acquired business or investment, such as potential restrictions on certain healthcare ownership structures or arrangements (see “Government Regulation” in Item 1 of Part I above). Certain of these factors at times have negatively affected, and any of these factors could in the future negatively affect, our ability to achieve the anticipated benefits of an acquisition, investment, or other strategic transaction. Any of the foregoing risks might have a materially adverse impact on our business operations and our financial position or results of operations. 19 19 19 Table of ContentsItem 1A IndexMcKESSON CORPORATION Table of ContentsItem 1A Index Table of Contents Item 1A Index

Our growth strategy includes consummating acquisitions or other strategic transactions that either expand or complement our business. To fund these strategic transactions, we may require financing that may not be available on acceptable terms. We may not receive governmental approvals needed to complete proposed transactions, or such approvals may be subject to delays or conditions that reduce transaction benefits. Achieving the desired outcomes of these strategic transactions involves significant risks including: diverting management’s attention from other business operations; challenges with assimilating the acquired businesses, such as integration of operations, systems, and technologies; failure or delay in realizing operating synergies; difficulty retaining key acquired company personnel; unanticipated accounting or financial systems issues with the acquired business, which might affect our internal controls over financial reporting; disputes with the sellers of acquired businesses; unanticipated compliance issues in the acquired business; unknown or unanticipated cybersecurity issues; challenges retaining customers of the acquired business; unanticipated expenses or charges to earnings, including depreciation and amortization or potential impairment charges; and risks of known and unknown assumed liabilities in the acquired business. These risks at times have adversely affected, and could in the future adversely affect, our ability to achieve the anticipated benefits of an acquisition, and might have a materially adverse impact on our business operations and our financial position or results of operations. 17 17 17 Table of ContentsItem 1A IndexMcKESSON CORPORATION Table of ContentsItem 1A Index Table of Contents Item 1A Index

We rely on sophisticated information systems and networks to perform our business operations, such as to obtain, rapidly process, analyze, and manage data that facilitate the purchase and distribution of thousands of inventory items from distribution centers. We provide remote services that involve hosting customer data and operating software on our own or third-party systems. Our customers rely on their ability to access and use these systems, and their data, as needed, and our ability to compete effectively is increasingly dependent on access to, and interpretation of, data. Data quality impacts customer ordering, order fulfillment and higher order processing. If we fail to effectively implement and maintain data governance structures across our businesses, to effectively interpret and utilize such data, or protect the integrity of such data, including systems powered by or incorporating AI and machine learning, our operations could be impacted, and we may be at a competitive disadvantage. Our networks and hosting systems are also vulnerable to interruption or damage from sources beyond our control. When those information systems or networks are disrupted, or if the timely delivery of medical care or other customer business requirements are impaired, we experience injury to patients or consumers, litigation or regulatory action, disruption of our business operations, loss of customers or revenue, cash flow impacts, and increased expense. In addition, hardware, software, and other applications and updates procured from third parties may contain defects that have, or may in the future, unexpectedly restrict access to or interfere with the proper operations of our information systems and hardware. Any such problems might have a materially adverse impact on our business, our reputation, and our financial position or results of operations.

We rely on sophisticated information systems and networks to perform our business operations, such as to obtain, rapidly process, analyze, and manage data that facilitate the purchase and distribution of thousands of inventory items from distribution centers. We provide remote services that involve hosting customer data and operating software on our own or third-party systems. Our customers rely on their ability to access and use these systems, and their data, as needed, and our ability to compete effectively is increasingly dependent on access to, and interpretation of, data. Data quality impacts customer ordering, order fulfillment and higher order processing. If we fail to effectively implement and maintain data governance structures across our businesses, to effectively interpret and utilize such data, or protect the integrity of such data, including systems 16 16 16 Table of ContentsItem 1A IndexMcKESSON CORPORATION Table of ContentsItem 1A Index Table of Contents Item 1A Index

Our business strategy as a diversified healthcare services company includes investing, organically and inorganically, to further build an integrated oncology and multispecialty care platform and expand our biopharma services business. Our ability to grow those businesses will depend, among other things, on our: hiring and retaining talented individuals with necessary knowledge and skills; acquiring, developing, and implementing new technologies and capabilities, including AI; establishing new offerings and pivoting or enhancing existing ones; successfully identifying, completing, and realizing the anticipated benefits of strategic transactions; forming and expanding business relationships; anticipating the needs of our customers; and successfully competing against providers of similar services. New technologies, such as AI, may not result in the benefits we anticipate, may not enable us to keep pace with our competitors and the rapidly evolving technological landscape, and may require us to expend significant resources, including to maintain our capabilities. We have increased, and expect to continue to increase, our use of AI technology, which could heighten these risks. Additionally, some of our historical competitors and a growing number of new competitive entrants have more experience than we do in enabling technologies such as data analytics, machine learning, or AI. As described in “Government Regulation” in Item 1 of Part I above, we also face certain regulatory risks in executing our growth strategy, including potential laws that place restrictions on certain healthcare ownership structures or arrangements. We may not achieve our desired return on our investments through our growth strategy, or acceptable sales and profitability in our strategic growth areas. Any of the foregoing risks might have a materially adverse impact on our business prospects and our financial position or results of operations.

Our business strategy as a diversified healthcare services company includes investing to build an integrated oncology and specialty care platform and expand our biopharma services business. Our ability to grow those businesses will depend on our: hiring and retaining talented individuals with necessary knowledge and skills; acquiring, developing, and implementing new technologies and capabilities, including AI; forming and expanding business relationships; and successfully competing against providers of similar services. New technologies, such as AI, may not result in the benefits we anticipate, may not enable us to maintain a competitive advantage, and may require us to expend significant resources. We have increased, and expect to continue to increase, our use of AI technology. The AI technologies we employ may become obsolete earlier than planned or we may be unsuccessful at realizing the benefits of these investments. Additionally, some of our historical competitors and a growing number of new competitive entrants have more experience than we do in enabling technologies such as data analytics, machine learning, or AI. We may not achieve our desired return on our investments through our growth strategies. If we fail to achieve acceptable sales and profitability in our strategic growth areas, it might have a materially adverse impact on our business prospects and our financial position or results of operations.

Many of our products and services are designed to function within the structure of current healthcare financing and reimbursement systems. The healthcare industry and related government programs continue to change. Some of these changes increase our risks and create uncertainties for our business. For example, certain changes in reimbursement methodologies (including government rates) for pharmaceuticals, medical treatments, and related services reduce profit margins for us and our customers and impose new legal requirements on healthcare providers. Those changes have included cuts in Medicare and Medicaid reimbursement levels, changes in the bases for payments, shifts from fee-for-service pricing towards value-based payments and risk-sharing models, and increases in the use of managed care. As described under “Healthcare Program Regulation” in Item 1 of Part I above, our business is subject to a broad range of recent and ongoing reform efforts, and challenges to those efforts, that could affect healthcare program access and spending, pharmaceutical pricing and reimbursement, and distribution economics. These include: the IRA; the OBBBA; Executive Order 14297; CMS rulemaking on BFSFs and proposed rebate models; 340B program litigation and developments; and state drug pricing legislation. Additionally, the pace and volume of healthcare reform initiatives and changes heighten the risks for our business. There is substantial uncertainty about the likelihood, timing, and results of these healthcare reform efforts and challenges, and their implementation or outcome might have a materially adverse impact on our business operations and our financial position or results of operations.

Many of our products and services are designed to function within the structure of current healthcare financing and reimbursement systems. The healthcare industry and related government programs are changing. Some of these changes increase our risks and create uncertainties for our business. For example, some changes in reimbursement methodologies (including government rates) for pharmaceuticals, medical treatments, and related services reduce profit margins for us and our customers and impose new legal requirements on healthcare providers. Those changes have included cuts in Medicare and Medicaid reimbursement levels, changes in the bases for payments, shifts from fee-for-service pricing towards value-based payments and risk-sharing models, and increases in the use of managed care. 20 20 20 Table of ContentsItem 1A IndexMcKESSON CORPORATION Table of ContentsItem 1A Index Table of Contents Item 1A Index

We rely on third parties for the supply of pharmaceutical and other products, and our operations are subject to our suppliers’ continued ability to supply the products that we require. From time to time, we experience difficulties and delays in sourcing and selling products due to a variety of causes that result in suppliers’ failure to satisfy production demand. Among these causes are suppliers’ challenges in complying with legal requirements (including product and production quality standards), access to raw materials, inputs, and finished goods, manufacturing shutdowns, and operational and systems difficulties. Supply disruptions also arise from other factors beyond our control, such as product rationalization; government actions or policies (including trade sanctions, tariffs and other trade restrictions, as well as the requisition, diversion, or allocation of inventory); shifts in customer or societal demand for products; labor disputes or shortages; ethical sourcing issues; supplier financial distress; natural disasters and weather-related events; civil unrest; military conflicts; and epidemics or pandemics. In these types of situations, our alternative sourcing efforts are not always fully successful. We might experience extended delays or incur higher sourcing costs or suffer harm to our customer relationships and reputation. Furthermore, changes in the healthcare industry’s or our suppliers’ pricing, selling, inventory, distribution, or supply policies or practices could significantly reduce our revenues and net income. Any of these disruptions or changes might have a materially adverse impact on our business operations and our financial position or results of operations.

We rely on third parties for the supply of pharmaceutical and other products, and our operations are subject to our suppliers’ continued ability to supply the products that we require. From time to time, we experience difficulties and delays in 21 21 21 Table of ContentsItem 1A IndexMcKESSON CORPORATION Table of ContentsItem 1A Index Table of Contents Item 1A Index

SectionPageLitigation and Regulatory Risks15Company and Operational Risks 17Industry and Economic Risks23General Risks25 Litigation and Regulatory Risks 15 Company and Operational Risks 17 Industry and Economic Risks 23 General Risks 25 The discussion below identifies certain representative risks that might cause our actual business results to materially differ from our forward looking statements. It is not practical to identify or describe all risks and uncertainties that might materially impact our business operations, reputation, financial position, or results of operations. Our business could be materially affected by risks that we have not identified or that we currently consider to be immaterial. This is not a complete discussion of all potential risks and uncertainties. The characterization of a risk as potential does not mean the risk has not occurred, is not currently occurring, or is unlikely to occur. 14 14 14 Table of ContentsItem 1A IndexMcKESSON CORPORATION Table of ContentsItem 1A Index Table of Contents Item 1A Index

SectionPageLitigation and Regulatory Risks13Company and Operational Risks 16Industry and Economic Risks20General Risks23 Litigation and Regulatory Risks 13 Company and Operational Risks 16 Industry and Economic Risks 20 General Risks 23 The discussion below identifies certain representative risks that might cause our actual business results to materially differ from our estimates. It is not practical to identify or describe all risks and uncertainties that might materially impact our business operations, reputation, financial position, or results of operations. Our business could be materially affected by risks that we have not yet identified or that we currently consider to be immaterial. This is not a complete discussion of all potential risks and uncertainties.

As described in “Government Regulation” in Item 1 of Part I above, we are subject to a variety of privacy, cybersecurity, and data protection laws that change frequently and have requirements that vary from jurisdiction to jurisdiction, as well as to rapidly developing and potentially divergent AI laws and guidance. Some of our contractual obligations might be breached if we fail to comply with privacy and data security laws. The use of AI solutions by our employees or third parties on which we rely could also lead to the misuse of data or public disclosure of confidential information (including personal data or proprietary information) in contravention of our internal policies and safeguards, applicable laws, contractual requirements, or third-party intellectual property rights. Our efforts to comply with privacy, data security, and AI laws and guidance complicate our operations and add to our costs. Any failure or perceived failure by us or any third-party providers to comply with these laws and guidance could subject us to regulatory enforcement activity, fines, investigations, legal proceedings (including private litigation such as class actions), liability, reputational impacts, and costs. Any of the foregoing risks might have a materially adverse impact on our reputation, our business operations, and our financial position or results of operations. 16 16 16 Table of ContentsItem 1A IndexMcKESSON CORPORATION Table of ContentsItem 1A Index Table of Contents Item 1A Index

As described in “Government Regulation” in Item 1 of Part I above, we are subject to a variety of privacy, cybersecurity, data protection, and AI laws that change frequently and have requirements that vary from jurisdiction to jurisdiction. Failure to comply with these laws subjects us to potential regulatory enforcement activity, fines, private litigation including class actions, reputational impacts, and other costs. We also have contractual obligations that might be breached if we fail to comply with privacy and data security laws. The use of AI solutions by our employees or third parties on which we rely could also lead to the misuse of data or public disclosure of confidential information (including personal data or proprietary information) in contravention of our internal policies, applicable laws, contractual requirements, or third-party intellectual property rights. Our efforts to comply with privacy, data security, and AI laws complicate our operations and add to our costs. A significant cybersecurity and/or privacy breach or failure to comply with privacy and data security laws, by us or by external service providers, vendors, or other third parties with which we do business, might have a materially adverse impact on our reputation, our business operations, and our financial position or results of operations.

us, or delay payments, or fail to pay amounts, owed to us. Suppliers might increase their prices, reduce their output, or change their terms of sale due to limited availability of credit. Suppliers might be unable to make payments due to us for fees, returned products, or incentives. Interest rate increases or changes in capital market conditions, including as a result of macroeconomic events, might impede our or our customers’ or suppliers’ ability or cost to obtain credit. Any of these risks might have a materially adverse impact on our business operations and our financial position or results of operations.

events, might impede our or our customers’ or suppliers’ ability or cost to obtain credit. Any of these risks might have a materially adverse impact on our business operations and our financial position or results of operations.

We are subject to extensive, complex, challenging, and frequently changing healthcare, environmental, and other laws. As described in “Government Regulation” in Item 1 of Part I above, our industry is highly regulated and subject to a regulatory framework that is continually evolving. Legislative, regulatory, or industry measures related to the distribution of pharmaceuticals and controlled substances could affect our business in ways that we may not be able to predict. Further regulation of our distribution operations, technology, products, or services, or other aspects of our business, could impose increased costs, negatively impact our profit margins and the profit margins of our customers, delay the introduction or implementation of our new products, place restrictions on or require modifications to our practices or arrangements, limit our strategic options, or expose us to litigation and regulatory investigations, reviews, or other proceedings. We are subject to routine and ad hoc inspections and requests for information by governmental agencies to determine compliance with various statutes and regulations. We also incur remediation costs, and may incur additional costs, under environmental laws. Any noncompliance by us with applicable laws, or any failure to maintain, renew, or obtain necessary permits and licenses, could result in enforcement actions, fines, penalties, or other sanctions. In addition, certain states have enacted, and others continue to consider, legislation that would impose taxes, assessments, or similar charges on the distribution of controlled substances, including prescription opioids. Any such taxes, assessments, or other related compliance obligations could increase our costs, require changes to our distribution practices, or lead to adverse publicity. The scope, application, and financial impact of these measures vary by jurisdiction and may be difficult to predict. Any of the foregoing risks might have a materially adverse impact on our reputation, our business operations and our financial position or results of operations.

As described in “Government Regulation” in Item 1 of Part I above, our industry is highly regulated, and further regulation of our distribution businesses, technology products, and services could impose increased costs, negatively impact our profit margins and the profit margins of our customers, delay the introduction or implementation of our new products, or otherwise negatively impact our business and expose the Company to litigation and regulatory investigations. We incur cleanup costs under environmental laws and may incur additional costs under environmental laws. Additionally, we are subject to various routine and ad hoc inspections and requests for information by governmental agencies to determine compliance with various statutes and regulations. Any noncompliance by us with applicable laws, or the failure to maintain, renew, or obtain necessary permits and licenses, could lead to enforcement actions or litigation and might have a materially adverse impact on our business operations and our financial position or results of operations. 14 14 14 Table of ContentsItem 1A IndexMcKESSON CORPORATION Table of ContentsItem 1A Index Table of Contents Item 1A Index