SOLV: 10-K Risk Factor Changes

Solventum is also subject to extensive laws and regulations protecting the privacy, security, and integrity of personal information, including patient medical information, that it receives, including, among others, the U.S. Health Insurance Portability and Accountability Act of 1996, as amended, (the "HIPAA"), the California Consumer Privacy Act (the "CCPA"), and similar U.S. state laws, the European Union’s General Data Protection Regulation (the "E.U. GDPR"), the United Kingdom’s Data Protection Act 2018 (the "UK DPA") and the General Data Protection Regulation (the "U.K. GDPR"), and China’s Personal Information Protection Law ("PIPL"), and Personal Data Cross Border Transfer Rule ("CBDT"). Federal health information privacy laws, such as HIPAA, and consumer protection laws impose requirements for the collection, use, storage, access, transfer and protection of health-related and other sensitive and personal information, and failure to comply may result, such as with respect to any CCPA violations, in civil penalties. The CCPA has been amended by the California Privacy Rights Act ("CPRA"), which came into effect, in most material respects, on January 1, 2023, and was most recently updated again in 2025. The most recent updates address cybersecurity audits, risk assessments, and automated decision-making technology. The E.U. GDPR and the U.K. GDPR and UK DPA, together with national legislation, regulations and guidelines of the E.U. Member States and the United Kingdom governing the processing of personal data, impose strict obligations and restrictions on the ability to collect, analyze, store, transfer and otherwise process personal data, including health data and adverse event reporting. The E.U. GDPR contemplates fines for certain violations of up to four percent of global annual revenue or €20 million (or GBP 17.5 million under the U.K. GDPR), whichever is greater, and enforcement can include limits on data transfers to countries outside the E.U. or U.K. In China, Solventum is subject to PIPL, which applies to the secure processing of personal information of natural persons within China, and Solventum is also subject to CBDT for the processing of personal information outside China where the purpose is to provide products and services within China and the analysis or assessment of the activities of individuals within China. Consequences of non-compliance with PIPL may include monetary fines of up to five percent of the previous year’s revenue, termination of data transfers and personal liability imposed on those directly responsible. Solventum is also subject to similar privacy and data protection frameworks in other developed and emerging markets. While Solventum utilizes industry standard processes, including the National Institute of Standards and Technology (the "NIST") privacy framework and third-party management processes, to assess the potential impact of emerging laws and enforcement trends on its business and to mitigate potential impacts on its business, data privacy laws and regulations and their scope and enforcement are constantly evolving, and Solventum cannot predict what effect, if any, changes to these laws and regulations and Solventum’s compliance with them may have on its business. 13 13 13 13 13 13 Table of Contents Table of Contents Table of Contents