Item 1A. RISK FACTORS

This report and other documents we file with the SEC contain forward-looking statements that are based on current expectations, estimates, forecasts and projections about us, our future performance, our business, our beliefs and our management’s assumptions. These statements are not guarantees of future performance and involve certain risks, uncertainties and assumptions that are difficult to predict. You should carefully consider the risks and uncertainties our business faces. The risks described below are not the only ones we face. Our business is also subject to the risks that affect many other companies, such as employment relations, general economic conditions, geopolitical events and international operations. Further, additional risks not currently known to us or that we currently believe are immaterial may in the future materially and adversely affect our business, operations, liquidity and stock price.

Below we provide in supplemental form the material changes to our risk factors that occurred during the past quarter. Our risk factors disclosed in Part I, Item 1A, of our Annual Report on Form 10-K for the year ended December 31, 2024, provide additional disclosure for these supplemental risks and are incorporated herein by reference.

Our sales depend on coverage and reimbursement from government and commercial third-party payers, and pricing and reimbursement pressures have affected, and are likely to continue to affect, our profitability.

Sales of our products depend on the availability and extent of coverage and reimbursement from third-party payers, including government healthcare programs and private insurance plans. Governments and private payers continue to pursue initiatives to manage drug utilization and contain costs. Further, pressures on healthcare budgets from the economic downturn and inflation continue and are likely to increase, across the markets we serve. Payers are increasingly focused on costs, which has resulted, and is expected to continue to result, in lower reimbursement rates for our products and/or narrower patient populations for which payers will reimburse. Continued intense public scrutiny of the price of drugs and other healthcare costs, together with payer dynamics, have limited, and are likely to continue to limit, our ability to set or adjust the price of our products based on their value, which can have a material adverse effect on our business. In the United States, particularly over the past few years, a number of legislative and regulatory proposals have been introduced and/or signed into law to lower drug prices. These include the IRA law that enables the U.S. government to set prices for certain drugs in Medicare, redesigns Medicare Part D benefits to shift a greater proportion of the costs to manufacturers and health plans, and enables the U.S. government to impose penalties if drug prices are increased at a rate faster than inflation (IRA Inflation Penalties). Additional proposals focused on drug pricing continue to be debated, and additional executive orders or regulatory initiatives focused on drug pricing and competition are likely to be adopted and implemented in some form. It is unclear what policies the new Administration will advance with respect to IRA implementation, other drug pricing proposals, including international reference pricing or changes to healthcare regulations affecting pharmaceuticals. Further, state government activity has been dynamic, including certain states enacting new laws limiting drug reimbursement under state run Medicaid programs and prohibiting restrictions on 340B Program use. Such state laws could also eventually be adopted at the federal level.

We are unable to predict which or how many policy, regulatory, administrative or legislative changes may ultimately be, or effectively estimate the consequences to our business if, enacted and implemented. However, to the extent that payer actions further decrease or modify the coverage or reimbursement available for our products, require that we pay increased rebates or shift other costs to us, limit or affect our decisions regarding the pricing of or otherwise reduce the use of our products, such actions could have a material adverse effect on our business and results of operations.

—Changing U.S. federal coverage and reimbursement policies and practices have affected, and are likely to continue to affect, access to, pricing of, and sales of our products

A substantial proportion of our U.S. business relies on reimbursement from federal government healthcare programs and commercial insurance plans regulated by federal and state governments. See Part I, Item 1. Business—Reimbursement, of our Annual Report on Form 10-K for the year ended December 31, 2024. Our business has been, and will continue to be, affected by legislative actions changing U.S. federal reimbursement policy. For example, the IRA includes provisions requiring that, beginning in 2026, mandatory price setting be introduced in Medicare for certain drugs paid for under Parts B and D, whereby

manufacturers must accept a price established by the government or face penalties on all U.S. sales (starting with 10 drugs in 2026, adding 15 in 2027 and 2028, and adding 20 in 2029 and subsequent years such that, by 2031, approximately 100 drugs could be subject to such set prices). The Medicare price setting process for the first 10 drugs subject to Medicare price setting in Part D began in 2023, which includes ENBREL, our product that currently generates considerable revenues. In 2024, CMS set a price for ENBREL under Medicare Part D that is significantly lower than currently applicable, beginning on January 1, 2026, which we expect will negatively impact its profitability in Medicare. See Part I, Item 2. Management’s Discussion and Analysis of Financial Condition and Results of Operations—Results of operations—Product sales—ENBREL. In January 2025, CMS announced the next 15 drugs for Medicare price setting that will be applicable beginning on January 1, 2027, which includes Otezla. Depending on the growth and success of our medicines, other of our medicines may also be subject to selection by CMS in the next, or in a future, cycle of mandatory Medicare price setting. If other of our medicines are selected by CMS for Medicare price setting, we may be required to accept a price set by the government for Medicare similar to the process that was applied to ENBREL. On April 15, 2025, the Administration issued an executive order (the April 2025 EO) that, among other directives, directs HHS to work with Congress to align the treatment of small molecule drugs and biologics in the Medicare price setting program under the IRA. It is currently unclear how such modifications would affect the timeframe in which Medicare price setting becomes applicable for selected drugs or biologics. Also under the IRA, Medicare Part D was redesigned to cap beneficiary out-of-pocket costs and, beginning January 1, 2025, Federal reinsurance will be reduced in the catastrophic phase (resulting in a shift and increase of such costs to Part D plans and manufacturers, including by requiring manufacturer discounts on applicable drugs). Further, the IRA inflation penalties allow CMS to collect rebates from manufacturers if price increases outpace inflation. Such rebate obligations began to accrue October 1, 2022 for Medicare Part D and January 1, 2023 for Medicare Part B, but CMS has not yet issued invoices and has some discretion as to when to issue such invoices to manufacturers. We expect that several of our products will be subject to IRA inflation penalties, and several of our products have been on lists that are issued and updated on a quarterly basis by CMS under a related program under which Medicare beneficiaries are charged reduced coinsurance if price increases exceed inflation. The IRA’s Medicare price setting and Medicare redesign are likely to have a material adverse effect on our sales, our business and our results of operations, and such impact is expected to increase through the end of the decade and will depend on factors including the extent of our portfolio’s exposure to Medicare reimbursement, the rate of inflation over time, the number of our products selected for Medicare price setting and the timing of market entry of generic or biosimilar competition. Further, following the enactment of the IRA, the environment remains dynamic, and U.S. policymakers continue to demonstrate interest in health care and drug pricing changes as well as potential changes affecting intellectual property. For example, in April 2024, CMS finalized policy changes that will give Part D plans more flexibility to substitute biosimilars for innovator products on formularies in 2025. Additionally, various government agencies have taken actions designed to reduce expenditures on prescription drugs. For example, HHS released a report with drug pricing proposals that seek to promote competition. The April 2025 EO also directs HHS to provide recommendations within 180 days to accelerate the approval of generics, biosimilars, combination products and second-in-class medications, as well as to address Medicaid drug rebates and Medicaid drug payment methodologies, and, within one year, to develop and implement a plan to test a payment model to enable Medicare to obtain pharmaceuticals at lower cost. Other CMS policy changes and demonstration projects to test new care, delivery and payment models can also significantly affect how drugs, including our products, are covered and reimbursed.

We also face risks related to the reporting of pricing data that affects reimbursement of and discounts provided for our products. U.S. government price reporting regulations are complex and may require biopharmaceutical manufacturers to update certain previously submitted data. If our submitted pricing data are incorrect, we may become subject to substantial fines and penalties or other government enforcement actions, which could have a material adverse effect on our business and results of operations. In addition, as a result of restating previously reported price data, we may be required to pay additional rebates and provide additional discounts.

—Changing reimbursement and pricing actions in various states have negatively affected, and may continue to negatively affect, access to, and have affected, and may continue to affect, sales of our products

At the state level, legislation, government actions, and ballot initiatives can also affect how our products are covered and reimbursed and/or create additional pressure on our pricing decisions. Existing and proposed state pricing laws have added complexity to the pricing of drugs and may already be affecting industry pricing decisions. A number of states have adopted, and many other states are considering, PDABs, drug importation programs, reference pricing schemes, and other drug pricing actions, including proposals designed to require biopharmaceutical manufacturers to report to the state proprietary pricing information or provide advance notice of certain price increases.

States are also enacting laws referencing the IRA and seeking to regulate and prohibit restrictions on the 340B Program. For example, following the passage of the IRA, bills have been proposed in multiple states that would apply the drug price caps set by HHS for Medicare to drug prices in an individual state, and such references to IRA price caps have also been included in PDAB legislation. For Medicaid patients, states have established a Medicaid drug spending cap (New York) and implemented a new review and supplemental rebate negotiation process (Massachusetts). Eight states (Colorado, Maine, New Hampshire, New

Jersey, Maryland, Minnesota, Oregon and Washington) have enacted laws that establish PDABs to identify drugs that pose affordability challenges, and four such states include authority for the state PDABs to set upper payment limits on certain drugs for in-state patients, payers and providers. In 2024, no fewer than 17 states introduced PDAB legislation. The eight states with enacted PDAB laws are in various phases of implementation, with Colorado’s PDAB being the furthest along. The Colorado PDAB deemed three of five drugs “unaffordable,” including ENBREL, and are subject to rulemaking to establish an Upper Payment Limit (UPL) commencing in the second quarter of 2025 and that could be effective as soon as the first quarter of 2026. Further, inappropriate expanded utilization of the 340B Program from broadened application of the 340B discounts has had, and is expected to continue to have, a negative impact on the Company’s product sales, business and results of operations. Thirteen states (Louisiana, Arkansas, West Virginia, Minnesota, Kansas, Mississippi, Missouri, Maryland, North Dakota, South Dakota, Utah, Nebraska and New Mexico) have enacted laws with mandates on manufacturers participating in the 340B Program, and, in 2025, no fewer than 28 states are considering similar legislation. These bills vary, but typically include provisions on restricting a manufacturer’s ability to direct drugs in 340B channels, recognizing 340B contract pharmacies and a prohibition on requiring the inclusion of 340B claims modifiers. In March 2024, the U.S. Court of Appeals for the 8th Circuit ruled that Arkansas’ Act 1103, which prohibits drugmakers from restricting the acquisition or delivery of 340B drugs to covered entities and their contract pharmacies, was not preempted by the federal 340B statute. The decision contributed to an increase in the number of states considering similar legislation. In July 2024, the U.S. District Court for the Southern District of Mississippi denied motions for a preliminary injunction in two cases challenging a similar law in Mississippi, finding that neither plaintiff had demonstrated a substantial likelihood of success on the merits. These orders are being appealed at the U.S. Court of Appeals for the 5th Circuit. In September 2024, the U.S. District Court for the Western District of Louisiana dismissed a lawsuit challenging Louisiana’s 340B contract pharmacy mandate law, and the U.S. District Court for the District of Maryland denied a motion for preliminary injunction challenging a similar law in Maryland. These lawsuits challenging states on their 340B contract pharmacy laws are subsequent to Genesis Health Care, Inc. v. Becerra, where the U.S. District Court for the District of South Carolina issued an order in November 2023 that enjoins the Health Resources and Services Administration from enforcing its more restrictive interpretation of who is considered a patient under the 340B Program, to the potential benefit of healthcare systems seeking to expand the application of 340B discounts.

Additionally, on January 5, 2024, the FDA authorized Florida to move forward with its importation program proposal, though the state has not yet completed any significant steps towards importation within the two-year authorization window. Colorado, Maine, New Hampshire, New Mexico, Texas and Vermont have also enacted state importation laws, and some have submitted plans for approval to the FDA. Other states could adopt similar approaches or could pursue different policy changes in a continuing effort to reduce their costs. Further, the April 2025 EO also directs HHS to, within 90 days, streamline and improve the drug importation program to ease the process for states to obtain drug importation approvals.

Ultimately, as with U.S. federal government actions, existing or future state government actions or ballot initiatives may also have a material adverse effect on our product sales, business and results of operations.

—U.S. commercial payer actions have affected, and may continue to affect, access to and sales of our products

Payers, including healthcare insurers, PBMs, integrated healthcare delivery systems (vertically-integrated organizations built from consolidations of healthcare insurers and PBMs) and group purchasing organizations, are continuing to seek ways to further reduce their costs. With increasing frequency, payers are adopting benefit plan changes that shift a greater proportion of drug costs to patients. Such measures include more limited benefit plan designs, high deductible plans, higher patient co-pay or coinsurance obligations and more significant limitations on patients’ use of manufacturer commercial co-pay assistance programs. Further, government regulation of payers may affect these trends. Payers, including PBMs, have sought, and continue to seek, price discounts or rebates in connection with the placement of our products on their formularies or those they manage, and to also impose restrictions on access to, or usage of, our products (such as Step Therapy), require that patients receive the payer’s prior authorization before covering the product, and/or chosen to exclude certain indications for which our products are approved. For example, some payers require physicians to demonstrate or document that the patients for whom Repatha has been prescribed meet their utilization criteria, and these requirements have served to limit patient access to Repatha treatment. In an effort to reduce barriers to access, we reduced the net price of Repatha by providing greater discounts and rebates to payers (including PBMs that administer Medicare Part D prescription drug plans), and in response to a very high percentage of Medicare patients abandoning their Repatha prescriptions rather than paying their co-pay, we introduced a set of new National Drug Codes to make Repatha available at a lower list price. However, affordability of patient out-of-pocket co-pay cost has limited, and, going forward, may in the future limit, patient use. Further, despite these net and list price reductions, some payers have restricted, and may continue to restrict, patient access and may seek further discounts or rebates or take other actions, such as changing formulary coverage for Repatha, that could reduce its sales. These factors have limited, and may continue to limit, patient affordability and use, negatively affecting Repatha sales.

Further, significant consolidation in the health insurance industry has resulted in a few large insurers and PBMs, which places greater pressure on pricing and usage negotiations with biopharmaceutical manufacturers, significantly increasing

discount and rebate requirements and limiting patient access and usage. For example, in the United States, the FTC’s interim report released in 2024 showed that the top six integrated health plans and PBMs controlled about 94% of all pharmacy prescriptions. This high degree of consolidation among insurers, PBMs and other payers, including integrated healthcare delivery systems and/or with specialty or mail-order pharmacies and pharmacy retailers, has increased the negotiating leverage such entities have over us and other biopharmaceutical manufacturers and has resulted in greater price discounts, rebates and service fees realized by those payers from our business. Each of CVS, Express Scripts and United Health Group (among the top six integrated health plans and PBMs) have Rebate Management Organizations that further increase their leverage to negotiate deeper discounts on their behalf and for the benefit of their other customers. Ultimately, additional discounts, rebates, fees, coverage changes, plan changes, restrictions or exclusions imposed by these commercial payers could have a material adverse effect on our product sales, business and results of operations. Policy reforms advanced by Congress or the Administration that refine the role of PBMs in the U.S. marketplace could have downstream implications or consequences for our business and how we interact with these entities. For example, in September 2024, the FTC brought action against the three largest PBMs alleging anticompetitive and unfair rebating practices. In addition, multiple Congressional Committees have been investigating PBM practices and have also proposed legislation that could increase transparency and reporting of these practices and/or impact rebates and service fees. The results of such inquiries could have an effect on manufacturer interactions with PBMs, resulting in changes to access for certain medicines. See our Annual Report on Form 10-K for the year ended December 31, 2024, Part I, Item 1A. Risk Factors*—Concentration of sales at certain of our wholesaler distributors, and consolidation of private payers, such as insurers, and PBMs has negatively affected, and may continue to negatively affect, our business.*

Our business is also affected by policies implemented by private healthcare entities that process Medicare claims, including Medicare Administrative Contractors. For example, in 2022, several Medicare Administrative Contractors issued notice that TEZSPIRE would be added to their “self-administered drug” exclusion lists. Although the Medicare Administrative Contractors subsequently removed TEZSPIRE from their exclusion lists, these exclusions, if reintroduced and/or implemented, would result in Medicare beneficiaries with severe asthma losing access to TEZSPIRE coverage under Medicare Part B and potentially also under Medicare Advantage.

—Government and commercial payer actions outside the United States have affected and will continue to affect access to and sales of our products

Outside the United States, we expect countries will also continue to take actions to reduce their drug expenditures and to reduce intellectual property protections. See Part I, Item 1. Business—Reimbursement, of our Annual Report on Form 10-K for the year ended December 31, 2024. Pressures to decrease drug expenditures may intensify as governments take actions to address budgets strained by high inflation and weak economic conditions, including in Europe where the effects of the Russia–Ukraine conflict have challenged the economies in that region. Further, the EU is currently undergoing a review and revision of its general pharmaceutical legislation that, while full implementation is not expected before 2027, has led to proposals that would reduce intellectual property protection for new products (including potentially shortening the duration of regulatory data exclusivity and orphan drug exclusivity protections), as well as change the reimbursement and regulatory landscape. International reference pricing has been widely used by many countries outside the United States to control costs. International reference pricing policies can change quickly and frequently and may not reflect differences in the burden of disease, indications, market structures or affordability across countries or regions. Other expenditure control practices, including the use of revenue clawbacks, rebates and caps on product sales, are also used in various foreign jurisdictions. In addition, countries may refuse to reimburse, or may restrict the reimbursed population for a product, when their national health technology assessments do not consider a medicine to demonstrate sufficient clinical benefit beyond existing therapies or to meet certain cost effectiveness thresholds. For example, despite the EMA’s approval of Repatha for the treatment of patients with established atherosclerotic disease, prior to 2020, the reimbursement of Repatha in France was limited to a narrower patient population (such as those with homozygous familial hypercholesterolemia (HoFH)) following a national health technology assessment. Many countries decide on reimbursement between potentially competing products through national or regional tenders that often result in one product receiving most, or all of, the sales in that country or region. Failure to obtain coverage and reimbursement for our products, a deterioration in their existing coverage and reimbursement, or a decline in the timeliness or certainty of payment by payers to hospitals and other providers, has negatively affected, and may further negatively affect, the ability or willingness of healthcare providers to prescribe our products for their patients and otherwise negatively affect the use of our products or the prices we realize for them. Such failures and changes have had, and could in the future have, a material adverse effect on our product sales, business and results of operations.

A breakdown of our information technology systems, cyberattack or information security breach could significantly compromise the confidentiality, integrity and availability of our information technology systems, network-connected control systems and/or our data, interrupt the operation of our business and/or affect our reputation.

To achieve our business objectives, we rely on sophisticated information technology systems, including hardware, software, technology infrastructure, online sites and networks for both internal and external operations, mobile applications,

cloud services and network-connected control systems, some of which are managed, hosted, provided or serviced by third parties. Internal or external events that compromise the confidentiality, integrity and availability of our systems and data may significantly interrupt the operation of our business, result in significant costs and/or adversely affect our reputation.

Our information technology systems are highly integrated into our business, including our R&D efforts, our clinical and commercial manufacturing processes and our product sales and distribution processes. Further, as the majority of our employees work remotely for some portion of their jobs in our hybrid work environment, our reliance on our and third-party information technology systems has increased substantially and is expected to continue to increase. Remote and hybrid working arrangements, including those of many third-party providers, can increase cybersecurity risks due to the challenges associated with managing remote computing assets and security vulnerabilities that are present in many non-corporate and home networks. The complexity and interconnected nature of software, hardware and our systems make them vulnerable to breakdown or other service interruptions, and to software errors or defects, misconfiguration and other security vulnerabilities. For example, in July 2024, businesses worldwide were affected by an information technology outage due to a faulty software update issued by a cybersecurity firm. Although our systems and operations were temporarily affected by the outage, the impact of this firm’s faulty update on the Company was immaterial to our business operations. However, there can be no assurance that a future similar incident would not result in a material adverse effect on our business or results of operations. Upgrades or changes to our systems or the software that we use have resulted and we expect, in the future, will result in the introduction of new cybersecurity vulnerabilities and risks. In 2022, we identified a number of security vulnerabilities introduced into our information systems as a result of flaws that we subsequently identified in software that we had purchased and installed, and these flaws required that we apply emergency patches to certain of our systems. While we did not experience any significant adverse effects as a result of these vulnerabilities, there can be no assurance that we will timely identify and address future vulnerabilities. Our systems are also subject to frequent perimeter network reconnaissance and scanning, phishing and other cyberattacks. For example, as a result of our cybersecurity monitoring of the Horizon legacy information systems, we detected phishing activity in the accounts of two Horizon executives. These accounts were de-activated, the incidents were investigated and the determination was made separately by both our internal cybersecurity team and our external digital forensics and incident response supplier that no confidential information had been exfiltrated, and the incidents are now closed. As the cyber-threat landscape evolves, these attacks are growing in frequency, sophistication, and intensity, and are becoming increasingly difficult to detect and increasingly sophisticated in using techniques and tools—including artificial intelligence—that circumvent security controls, evade detection and remove forensic evidence. Such attacks could include the use of harmful and virulent malware, including ransomware or other denials of service, which can be deployed through various means, including the software supply chain, e-mail, malicious websites and/or the use of social engineering/phishing.

We have also experienced denial of service attacks against our network, and, although such attacks did not succeed, there can be no assurance that our efforts to guard against the wide and growing variety of potential attack techniques will be successful in the future. Attacks such as those experienced by government entities (including those that approve and/or regulate our products, such as the EMA) and other multi-national companies, including some of our peers, could leave us unable to utilize key business systems or access or protect important data, and could have a material adverse effect on our ability to operate our business, including developing, gaining regulatory approval for, manufacturing, selling and/or distributing our products. For example, in 2017, a pharmaceutical company experienced a cyberattack involving virulent malware that significantly disrupted its operations, including its research and sales operations and the production of some of its medicines and vaccines. As a result of the cyberattack, its orders and sales for certain products were negatively affected. In late 2020, SolarWinds Corporation, a leading provider of software for monitoring and managing information technology infrastructure, disclosed that it had suffered a cybersecurity incident whereby attackers had inserted malicious code into legitimate software updates for its products that were installed by myriad private and government customers, enabling the attackers to access a backdoor to such systems. In 2022, Okta, Inc., a provider of software that helps companies manage user authentication, disclosed that several hundred of its corporate customers were vulnerable to a security breach that allowed attackers to access Okta’s internal network. Although this breach did not have a significant effect on our business, there can be no assurance that a similar future breach would not result in a material adverse effect on our business or results of operations.

Our systems also contain and use a high volume of sensitive data, including intellectual property, trade secrets and other proprietary business information, financial information, regulatory information, strategic plans, sales trends and forecasts, litigation materials and/or personal identifiable information belonging to us, our staff, our patients, customers and/or other parties. In some cases, we utilize third-party service providers to collect, process, store, manage or transmit such data, which have increased our risk. Intentional or inadvertent data privacy or security breaches (including cyberattacks) resulting from attacks or lapses by employees, service providers (including providers of information technology-specific services), business partners, nation states (including groups associated with or supported by foreign intelligence agencies), organized crime organizations, “hacktivists” or others, create risks that our sensitive data may be exposed to unauthorized persons, our competitors or the public. Malicious actors, including those working under state-sponsored campaigns, have sought employment, often in remote information technology roles, as a means to gain inside access at targeted companies. In two separate incidents, the most recent of which occurred in the first quarter of 2025, individuals used fraudulent identification in

connection with their hiring by the Company. While these individuals were detected and terminated before any data was extracted or malware installed, there can be no assurance that future attempts by similar actors will be unsuccessful. System vulnerabilities and/or cybersecurity breaches experienced by our third-party service providers have constituted a substantial share of the information security risks that have affected us. For example, in the first half of 2021, a supplier experienced a data breach in which an unauthorized third party acquired access to certain information provided to the supplier in the course of its provision of services to us, including business documents and certain personally identifiable patient information (not including social security or other financial or health insurance information). As required, we promptly notified the applicable state attorneys general and the individuals whose personally identifiable information was affected of this data breach at the supplier. In the third quarter of 2022, another service provider experienced a similar cybersecurity breach in which an attacker exfiltrated certain data (including non-significant Amgen data) from the service provider’s systems. Additionally, in April 2024, one of our former vendors notified us that its subsidiary that had provided us with certain patient support services until mid-2022, experienced a cybersecurity incident that it discovered in February 2024 and that data containing individually identifiable health information of over 1.7 million Amgen patients (that was retained as required by FDA regulations) was involved in the incident. Pursuant to the Health Breach Notification Rule requirements, we notified the FTC of this incident. Although these supplier data breaches have not resulted in material adverse effects on our business, there can be no assurance that a similar future cybersecurity incident would not result in a material adverse effect on our business or results of operations. Further, the timeliness of our awareness of a cybersecurity incident affects our ability to respond to and work to mitigate the severity of such events. For example, in 2020 and 2022, two of our vendors experienced cyberattacks and each initially reported to us that neither event involved our data. However, upon further investigation, they each subsequently informed us that the attackers had accessed limited, non-significant Amgen information. Although neither of these breaches had a significant adverse effect on our business, in the future we may again not receive timely reporting of cybersecurity events, and such events could have a material adverse effect on our business.

Cyberattackers are also increasingly exploiting vulnerabilities in commercially available software from shared or open-source code. We rely on third party commercial software that have had and may have such vulnerabilities, but as use of open-source code is frequently not disclosed, our ability to fully assess this risk to our systems is limited. For example, in December 2021, a remote code execution vulnerability was discovered in a software library that is widely used in a variety of commercially available software and services. Although this vulnerability has not resulted in any significant adverse effects on us, there can be no assurances that a similar future vulnerability in the software and services that we use would not result in a material adverse effect on our business or results of operations.

Domestic and global government regulators, our business partners, suppliers with whom we do business, companies that provide us or our partners with business services and companies we have acquired or may acquire face similar risks. Security breaches of their systems or service outages have adversely affected systems and could, in the future, affect our systems and security, leave us without access to important systems, products, raw materials, components, services or information, or expose our confidential data or sensitive personal information. For example, in 2019, two vendors that perform testing and analytical services that we use in developing and manufacturing our products experienced cyberattacks, and in April and September of 2020, vendors that provide us with information technology services and clinical data services, respectively, each experienced ransomware attacks. Although there was no breach of our systems, each of these incidents required us to disconnect our systems from those vendors’ systems. While we were able to reconnect our systems following restoration of these vendors’ capabilities without significantly affecting product availability, a more extended service outage affecting these or other vendors, particularly where such vendor is the single source from which we obtain the services, could have a material adverse effect on our business or results of operations. In February 2024, Change Healthcare, a large U.S. insurance claim and co-pay card processing clearinghouse, experienced a ransomware attack that has caused significant disruptions to healthcare provider and pharmacy operations. While Change Healthcare does not directly provide us with services, disruptions to co-pay card support, insurance billing and Medicaid rebate processing led to lost sales and required us to take action to help patients access their medications and to provide extended payment terms to certain customers. Although services have been rerouted and restored, and the impact on our business has been immaterial, similar disruptions may occur in the future stemming from the interconnectedness of the U.S. healthcare ecosystem and industry reliance on centralized claims processing systems and networks, and such future disruptions may have a material adverse effect on our business or results of operations. In addition, we distribute our products in the United States primarily through three pharmaceutical wholesalers, and a security breach that impairs the distribution operations of our wholesalers could significantly impair our ability to deliver our products to healthcare providers and patients. There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with or effective in protecting our information technology systems and sensitive data.

Although we have experienced system breakdowns, attacks and information security breaches, we do not believe such breakdowns, attacks and breaches have had a material adverse effect on our business or results of operations. We will continue to experience varying degrees of cyberattacks and other incidents in the future. Even though we continue to invest in the monitoring, protection and resilience of our critical and/or sensitive data and systems, there can be no assurances that our efforts will detect, prevent or fully recover systems or data from all breakdowns, service interruptions, attacks and/or breaches of our systems that could adversely affect our business and operations and/or result in the loss or exposure of critical, proprietary, private, confidential or otherwise sensitive data, which could result in material financial, legal business or reputational harm to us or negatively affect our stock price. While we maintain cyber-liability insurance, our insurance is not sufficient to cover us against all losses that could potentially result from a service interruption, breach of our systems or loss of our critical or sensitive data.

We are also subject to various laws and regulations globally regarding cybersecurity, privacy and data protection, including laws and regulations relating to the collection, storage, handling, use, disclosure, transfer and security of personal data. The legislative and regulatory environment regarding privacy and data protection is continuously evolving and developing and the subject of significant attention globally. For example, we are subject to the EU’s General Data Protection Regulation, which became effective in May 2018, and the California Consumer Privacy Act of 2018 (CCPA), which became effective in January 2020, both of which provide for substantial penalties for noncompliance. The CCPA was amended in late 2020, to create the California Privacy Rights Act to create opt in requirements for the use of sensitive personal data and the formation of a new dedicated agency for the enforcement of the law, the California Privacy Protection Agency. Similar consumer privacy laws went into effect in 13 other states, have been enacted (but not yet in effect) in six other states, and have been proposed in 14 additional states. Outside the United States, other jurisdictions where we operate have passed, or continue to propose, data privacy or cybersecurity legislation and/or regulations. For example, in China, the Personal Information Protection Law and the Data Security Law, which regulate data processing activities associated with personal and nonpersonal data, are in effect and build upon the existing Cybersecurity Law. Failure to comply with these current and future laws could result in significant penalties and reputational harm and could have a material adverse effect on our business and results of operations.

We are adopting and exploring the use of artificial intelligence (AI) in our business, and as an emerging and rapidly evolving technology, our use of AI introduces potential opportunities but also presents risks that could adversely affect our operations, information security and reputation. AI systems may produce inaccurate or flawed outputs due to flawed algorithms, or insufficient and/or erroneous training data. Reliance on flawed outputs could result in lower quality decision-making or prevent us from effectively utilizing AI in our business. We may also become vulnerable to operational disruptions if the AI technologies we use experience downtimes or are compromised by cyberattacks. If we do not effectively implement guardrails and train our staff on the safe and proper use of AI, or if our staff fail to effectively adhere to our established guardrails and training on the use of AI, we may experience adverse effects on our business, including data breaches, the loss of confidential information (including our intellectual property), unintentional disclosure of personal data, or other misuse of our proprietary information. Further, several governments and regulatory authorities have proposed or passed laws and regulations governing the use of AI. For example, in March 2024, the European Parliament adopted the Artificial Intelligence Act that provides for EU-wide rules on data quality, transparency, human oversight and accountability with respect to the use of artificial intelligence. In April 2024, the EU also revised its Cybersecurity Directive NIS2 rules that create new cybersecurity risk management and reporting obligations. Failure to comply with these current and future laws could result in significant penalties and reputational harm and could have a material adverse effect on our business and results of operations.

Our current products and products in development cannot be sold without regulatory approval.

Our business is subject to extensive regulation by numerous state and federal government authorities in the United States, including the FDA, and by foreign regulatory authorities, including the EMA. We are required in the United States and in the other regions and countries in which we, or our partners and affiliates, sell to obtain approval from regulatory authorities before we manufacture, market and sell our products. Once our products are approved, the FDA and other U.S. and ex-U.S. regulatory agencies have substantial authority to require additional testing and reporting, perform inspections, change product labeling or mandate withdrawals of our products. Failure to comply with applicable regulatory requirements may subject us to administrative and/or judicially imposed sanctions or monetary penalties as well as reputational and other harms. The sanctions could include the FDA’s or ex-U.S. regulatory authorities’ refusals to approve pending applications, delays in obtaining or withdrawals of approvals, delays or suspensions of clinical trials, warning letters, product recalls or seizures, total or partial suspensions of our operations, injunctions, fines, civil penalties and/or criminal prosecutions.

Obtaining and maintaining regulatory approvals have been, and will continue to be, increasingly difficult, time-consuming and costly. Legislative bodies or regulatory agencies could enact new laws or regulations, change existing laws or regulations or change their interpretations of laws or regulations at any time, which could affect our ability to obtain or maintain approval of our products or product candidates. The rate and degree of change in existing laws and regulations and regulatory expectations have accelerated in established markets, and regulatory expectations continue to evolve in emerging markets. We are unable to

predict whether and when any further changes to laws or regulatory policies affecting our business could occur, such as changes to laws or regulations governing manufacturer communications concerning drug products and drug product candidates and whether such changes could have a material adverse effect on our product sales, business and results of operations. Further, we are reliant on regulators having the resources necessary to evaluate and approve our products. In the United States, a partial federal government shutdown halted the work of many federal agencies and their employees from late December 2018 through late January 2019. A subsequent extended shutdown or, pursuant to the new Administration’s actions in early 2025 to freeze or reduce the federal workforce, significant reductions of, or disruptions to, staffing and resources available to government agencies could result in reductions or delays of FDA’s activities, including with respect to our ongoing clinical programs, our manufacturing of our products and product candidates and our product approvals.

Recent initiatives to reduce the size and budgets of government agencies, including the HHS, FDA and NIH, may adversely impact our operations. In particular, reductions in staffing and resources at the FDA could result in delays in regulatory review timelines and marketing approvals. The FDA may also have limited capacity to engage in pre-approval or guidance meetings or meetings to negotiate labeling or post-marketing commitments. Further, reductions in communication and policymaking roles has reduced the transparency of agency actions. Additionally, any funding reductions and caps on research overhead costs imposed on the NIH and its programs may result in grant funding cutbacks for scientific and disease-related research at academic institutions and research centers, and such reductions, over the longer term, may slow the overall discovery and development of new therapies and/or slow or interrupt the flow of innovation into the pharmaceutical development pipeline. These developments and others associated with the reduction of personnel and budgets at the regulatory agencies that oversee our industry and operations may adversely affect our business activities, including our ongoing and future clinical research and drug development programs, research collaborations, manufacturing activities and regulatory submissions.

Regulatory authorities have questioned, and may in the future question, the sufficiency for approval of the endpoints we select for our clinical trials. A number of our products and product candidates have been evaluated in clinical trials using surrogate endpoints that measure an effect that is known to correlate with an ultimate clinical benefit. For example, a therapeutic oncology product candidate may be evaluated for its ability to reduce or eliminate minimal residual disease (MRD), or to extend the length of time during and after the treatment that a patient lives without the disease worsening, measured by progression-free survival (PFS). Demonstrating that the product candidate induces MRD-negative responses or produces a statistically significant improvement in PFS does not necessarily mean that the product candidate will show a statistically significant improvement in overall survival or the time that the patients remain alive. In the cardiovascular setting, a heart disease therapeutic candidate may be evaluated for its ability to reduce low-density lipoprotein cholesterol (LDL-C) levels, as an elevated LDL-C level has been a surrogate endpoint for cardiovascular events such as death, heart attack and stroke. The use of surrogate endpoints such as PFS and LDL-C reduction, in the absence of other measures of clinical benefit, may not be sufficient for broad usage or approval even when such results are statistically significant. Regulatory authorities could also add new requirements, such as the completion of enrollment in a confirmatory study or the completion of an outcomes study or a meaningful portion of an outcomes study, as conditions for obtaining approval or obtaining an indication. For example, despite demonstrating that Repatha reduced LDL-C levels in a broad patient population, only after our large phase 3 outcomes study evaluating the ability of Repatha to prevent cardiovascular events met certain of its primary composite endpoint and key secondary composite endpoint did the FDA grant a broader approval of Repatha to reduce the risk of certain cardiovascular events. There may also be situations in which demonstrating the efficacy and safety of a product candidate may not be sufficient to gain regulatory approval unless superiority to other existing treatment options can be shown. The imposition of additional requirements or our inability to meet them in a timely fashion, or at all, has delayed, and may in the future delay, our clinical development and regulatory filing efforts, delay or prevent us from obtaining regulatory approval for new product candidates or new indications for existing products, or prevent us from maintaining our current product labels.

Some of our products have been approved by U.S. and ex-U.S. regulatory authorities on an accelerated or conditional basis with full approval conditioned upon fulfilling the requirements of regulators. For example, the FDA has approved LUMAKRAS under accelerated approval for the treatment of adult patients with KRAS G12C-mutated local advanced or metastatic non-small cell lung cancer (NSCLC). Following our submission of the LUMAKRAS/LUMYKRAS CodeBreaK 200 Phase 3 confirmatory data in March 2023 to the FDA and EMA, we received a Complete Response Letter from the FDA and a new post-marketing requirement for an additional confirmatory study to support full approval. Regulatory authorities are placing greater focus on whether the sponsors of products originally approved on an accelerated or conditional basis have met the conditions of the accelerated or conditional approvals. If we are unable to fulfill the regulators’ requirements that were conditions of a product’s accelerated or conditional approval and/or if regulators reevaluate the data or risk-benefit profile of our product, the conditional approval may not result in full approval or may be revoked or not renewed. Alternatively, we may be required to change the product’s labeled indications, conduct an additional confirmatory clinical trial, or even withdraw the product from the market.

Regulatory authorities can also impose post-marketing pediatric study requirements. Failure to fulfill such requirements may result in regulatory or enforcement action, including financial penalties or the invalidation of a product’s marketing authorization.

Safety problems or signals can arise as our products and product candidates are evaluated in clinical trials, including investigator sponsored studies, or as our marketed products are used in clinical practice. We are required continuously to collect and assess adverse events reported to us and to communicate to regulatory agencies these adverse events and safety signals regarding our products. Regulatory agencies periodically perform inspections of our pharmacovigilance processes, including our adverse event reporting. In the United States, for our products with approved Risk Evaluation and Mitigation Strategies (REMS, see Part I, Item 1. Business—Government Regulation—Postapproval Phase, of our Annual Report on Form 10-K for the year ended December 31, 2024), we are required to submit periodic assessment reports to the FDA to demonstrate that the goals of the REMS are being met. REMS and other risk management programs are designed to help ensure that a drug’s benefits outweigh the risks and vary in the elements they contain. If the FDA is not satisfied with the results of the periodic assessment reports we submit for any of our REMS, the FDA may also modify our REMS or take other regulatory actions, such as implementing revised or restrictive labeling. The drug delivery devices approved for use in combination with our products are also subject to regulatory oversight and review for safety and malfunctions. See our Annual Report on Form 10-K for the year ended December 31, 2024, Part I, Item 1A. Risk Factors*—Some of our products are used with drug delivery or companion diagnostic devices that have their own regulatory, manufacturing and other risks.* If regulatory agencies determine that we or other parties (including our clinical trial investigators, those operating our patient support programs or licensees of our products) have not complied with the applicable reporting, other pharmacovigilance or other safety or quality assessment requirements, we may become subject to additional inspections, warning letters or other enforcement actions, including fines, marketing authorization withdrawal and other penalties. Our product candidates and marketed products can also be affected by safety problems or signals occurring with respect to products that are similar to ours or that implicate an entire class of products. Further, as a result of clinical trials, including sub-analyses or meta-analyses of earlier clinical trials (a meta-analysis involves the use of various statistical methods to combine results from previous separate but related studies) performed by us or others, concerns may arise about the sufficiency of the data or studies underlying a product’s approved label. Such actual or perceived safety problems or concerns can lead to:

• revised or restrictive labeling for our products, or the potential for restrictive labeling that has resulted, and may in the future result, in our decision not to commercialize a product candidate;

• requirement of risk management or minimization activities or other regulatory agency compliance actions related to the promotion and sale of our products;

• post-marketing commitments, mandated post-marketing requirements or pharmacovigilance programs for our approved products;

• product recalls of our approved products;

• required changes to the processes used in the manufacture of our products, which could increase our manufacturing costs and affect the availability of contract manufacturers we may utilize to assist in such manufacturing;

• revocation of approval for our products from the market completely, or within particular therapeutic areas or patient types;

• increased timelines or delays in being approved by the FDA or other regulatory bodies; and/or

• treatments or product candidates not being approved by regulatory bodies.

For example, after an imbalance in positively adjudicated cardiovascular serious adverse events was observed in one of the phase 3 clinical trials for EVENITY but not in another, larger phase 3 study, in April 2019 the FDA approved EVENITY for the treatment of osteoporosis in postmenopausal women at high risk for fracture, along with a post-marketing requirement. The requirement includes a five-year observational feasibility study that could be followed by a comparative safety study or trial.

Regulatory authorities also require that our products are tested and controlled for impurities. Impurities exceeding established limits may lead to delayed product approvals or disrupt the manufacture and distribution of our products. For example, certain jurisdictions and regulatory agencies, including the FDA and EMA, require risk assessments, and if applicable, testing, for the presence of nitrosamine impurities in certain small molecule drugs, and we are following the established process of evaluating potentially impacted small molecule products. Testing of our cinacalcet product has indicated the presence of nitrosamines in certain lots above established limits. After working closely with regulatory agencies in each impacted country we have stopped distribution of cinacalcet in certain countries and initiated recalls in certain Middle Eastern countries.

In addition to our innovative products, we are working to develop and commercialize biosimilar versions of a number of products currently manufactured, marketed and sold by other pharmaceutical companies. In some markets outside the United States and EU, there is not yet a legislative or regulatory pathway for the approval of biosimilars. In the United States, the BPCIA provided for such a pathway. Discussions within the FDA and other regulatory authorities, and between regulatory authorities and sponsors, continue as to the evidence needed to demonstrate biosimilarity or interchangeability for specific products. See our Annual Report on Form 10-K for the year ended December 31, 2024, Part I, Item 1A. Risk Factors*—We currently face competition from biosimilars and generics and expect to face increasing competition from biosimilars and generics in the future.* Delays or uncertainties in the development or implementation of such pathways, or changes in existing regulatory pathways, including degradation of regulatory standards, could result in delays or difficulties in getting our biosimilar products approved by regulatory authorities, subject us to unanticipated development costs or otherwise reduce the value of the investments we have made in the biosimilars area. Further, we cannot predict the extent to which any potential legislative or policy initiatives would affect the biosimilar pathway or have a material adverse effect on our development of biosimilars, on our marketed biosimilars or on our pursuit of interchangeability designations for any biosimilar. In addition, if we are unable to bring our biosimilar products to market on a timely basis and secure “first-to-market” or other advantageous positions, our future biosimilar sales, business and results of operations could be materially and adversely affected.

Global economic conditions may negatively affect us and may magnify certain risks that affect our business.

Our operations and performance have been, and may continue to be, affected by global economic conditions. The economic downturn resulting from the COVID-19 pandemic precipitated a global recession, which was followed by high rates of inflation and actions taken by financial regulators to raise interest rates. Instability in the financial system, tighter lending standards and higher interest rates have added stress that may create additional vulnerabilities in the global economy, the effects of which may be of an extended duration. Additionally, with higher interest rates, deficits (including those associated with the pandemic), and other fiscal pressures, governments may be unable to sustain their previously high levels of fiscal spending. Further, in the United States, although Congress has approved stopgap measures to fund the government through early March, the federal government continues to be at risk of a shutdown if legislation providing funding for the fiscal year is not passed as a result of political divisions in Congress and an impasse on budgetary and spending matters. Congress must also reach an agreement to extend the federal debt ceiling in 2025 to avoid default on U.S. government debt, and such negotiation will also likely include a focus on decreasing government spending (which the new Administration and Congressional majorities have indicated will be a priority). Consequently, these and other financial pressures have caused, and may continue to cause, government or other third-party payers to more aggressively seek cost containment measures in healthcare and other settings. See Our sales depend on coverage and reimbursement from government and commercial third-party payers, and pricing and reimbursement pressures have affected, and are likely to continue to affect, our profitability. As a result of global economic conditions, some third-party payers may delay or be unable to satisfy their reimbursement obligations. Job losses or other economic hardships (including inflation) may also affect patients’ ability to afford healthcare as a result of increased co-pay or deductible obligations, greater cost sensitivity to existing co-pay or deductible obligations, lost healthcare insurance coverage or for other reasons. We believe such conditions have led and could continue to lead to reduced demand for our products, which could have a material adverse effect on our product sales, business and results of operations. The cumulative effects of inflationary pressures, an uncertain trade environment with escalating and rapidly-changing tariffs, and the effects from the armed conflict in Ukraine (including the effects of the sanctions that were implemented in response to the conflict and the resulting impacts on the commodity market and supply chains) and the Middle East have also increased our operating expenses and may continue to affect our operating expenses. Our operational costs, including the cost of energy, materials, labor, distribution and our other operational and facilities costs are subject to market conditions and are being adversely affected by inflationary pressures. Although we monitor our distributors’, customers’ and suppliers’ financial condition and their liquidity to mitigate our business risks, some of our distributors, customers and suppliers may become insolvent, which could have a material adverse effect on our product sales, business and results of operations. A significant worsening of global economic conditions could precipitate or materially amplify the other risks described herein. On April 2, 2025, the Administration issued an executive order (the April 2025 Tariff EO) imposing a universal 10% tariff on all imported goods, with certain exceptions including pharmaceuticals. The April 2025 Tariff EO imposed additional higher tariffs on approximately 60 countries with which the United States has trade deficits. However, on April 9, 2025 the Administration temporarily placed the country-specific tariffs on hold for 90 days, except the tariff on goods imported from China, which was subsequently raised to 145%. Shortly after the April 2025 Tariff EO, China announced 34% retaliatory tariffs that were subsequently increased to 125% on goods imported from the United States. The EU also announced 25% retaliatory tariffs on certain goods imported from the United States, excluding pharmaceuticals, which was subsequently paused for 90 days in response to the Administration’s pause on country-specific tariffs. While the April 2025 Tariff EO exempts pharmaceuticals, the universal 10% tariff and any foreign retaliatory tariffs will increase certain of our costs, including the materials we use to manufacture our products as well as to conduct our research and development activities, such as delivery devices, consumable supplies and certain other laboratory materials, and the tariffs imposed by China may negatively affect our business in that country. On April 1, 2025, the Administration initiated an investigation under Section 232 of the Trade Expansion Act of 1962 of the importation of

pharmaceuticals, pharmaceutical ingredients and their derivative products, which may lead to the imposition of a sector-specific tariff on such products. If the current tariff exemptions applicable to pharmaceutical products are revoked, or if new sector-specific tariffs targeting pharmaceuticals, pharmaceutical ingredients and their derivative products are imposed, our product sales and research and development activities may be adversely affected. Further, the administrative requirements of tariffs across global trade could also slow and/or delay the processing and delivery of products and materials in supply chains. Given the many uncertainties and variables, it is currently unclear the extent, and degree, to which existing and future tariffs will disrupt and adversely affect our business activities (including product sales, and conduct of clinical trial and research and development activities), and the global economic environment, and/or amplify the other risks described herein. See our Annual Report on Form 10-K for the year ended December 31, 2024, Part I, Item 1A. Risk Factors*—We may not be able to access the capital and credit markets on terms that are favorable to us, or at all*.

We maintain a significant portfolio of investments on our consolidated balance sheets. In the recent past, the global COVID-19 pandemic and interest rate increases have led to disruption and volatility in the global capital markets. We have certain assets, including equity investments, that are exposed to market fluctuations that could, in a sustained or recurrent series of market disruptions, result in impairments. The value of our investments may also be adversely affected by interest rate fluctuations, inflation, downgrades in credit ratings, illiquidity in the capital markets, geopolitical events and other factors that may result in other-than-temporary declines in the value of our investments. Any of those events could cause us to record impairment charges with respect to our investment portfolio or to realize losses on sales of investments. We also maintain a majority of our cash and cash equivalents in accounts with major multi-national financial institutions, and our deposits at these institutions exceed insured limits. Market conditions can adversely affect the viability of these institutions. In the event of failure of any of the financial institutions where we maintain our cash and cash equivalents, there can be no assurance that we would be able to access uninsured funds in a timely manner or at all. Inability to access, or a delay in accessing these funds, could adversely affect our business and financial position.

Item 2. UNREGISTERED SALES OF EQUITY SECURITIES AND USE OF PROCEEDS

During the three months ended March 31, 2025, we had one outstanding stock repurchase program, under which we had no repurchase activity.

Period						Total number of shares purchased						Average price paid per share						Total number of shares purchased as part of publicly announced program						Maximum dollar value that may yet be purchased under the program
January 1–31						—						—						—						$	6,779,253,902
February 1–28						—						—						—						$	6,779,253,902
March 1–31						—						—						—						$	6,779,253,902
Total						—												—