Risk Factors Dashboard

Once a year, publicly traded companies issue a comprehensive report of their business, called a 10-K. A component mandated in the 10-K is the ‘Risk Factors’ section, where companies disclose any major potential risks that they may face. This dashboard highlights all major changes and additions in new 10K reports, allowing investors to quickly identify new potential risks and opportunities.

View risk factors by ticker

Search filings by term

Risk Factors - ZVRA

-New additions in green
-Changes in blue
-Hover to see similar sentence in last filing

ITEM 1A. RISK FACTORS.

Risks Related to the Commercialization of Our Approved Products and Product Candidates

If we are unable to establish effective sales, marketing and distribution capabilities for our approved products, including any of our product candidates that may receive marketing approval, we may not be successful in commercializing such products in the United States or any other jurisdictions.

In order to commercialize our approved products, we have added marketing, sales, medical affairs, distribution, managerial and other non-technical capabilities, or have made arrangements with third parties to perform these services. Building and maintaining a targeted specialty sales force is expensive and time consuming. Any failure or delay in the development of our internal sales, marketing and distribution capabilities would adversely impact our commercialization efforts. We may choose to collaborate with third parties that have their own sales forces and established distribution systems, in lieu of or to augment any sales force and distribution systems we may create.

Our approved products, as well as any of our product candidates that may receive marketing approval, may fail to achieve the degree of market acceptance by physicians, patients, third-party payors and others in the medical community necessary for commercial success.

The degree of market acceptance of our approved products will depend on a number of factors, including:

•the efficacy and potential advantages compared to alternative treatments, including less expensive generic treatments;

•the ability to obtain differentiating claims in the labels for approved products;

•the clinical indications for which our products are approved;

•the convenience and ease of administration compared to alternative treatments;

Table of Contents

•the willingness of the target patient population to try new therapies and of physicians to prescribe these therapies;

•the cost of treatment in relation to alternative treatments;

•the strength of marketing and distribution support;

•the availability of third-party coverage and adequate reimbursement or willingness of patients to pay out of pocket in the absence of third-party coverage; and

•the prevalence and severity of any side effects.

If our approved products do not achieve an adequate level of market acceptance, they may not generate significant product revenue and we may not become profitable.

Failure to obtain or maintain coverage and adequate reimbursement for our products could limit our ability to market those products and decrease our ability to generate revenue.

Decisions regarding the extent of coverage and amount of reimbursement to be provided for each of our products and product candidates is and will be made on a plan-by-plan basis. One payor’s determination to provide coverage for a product does not assure that other payors will also provide coverage, and adequate reimbursement, for the product. Each third-party payor determines whether or not it will provide coverage for a drug, what amount it will pay providers for the drug, and on what tier of its formulary the drug will be placed. These decisions are influenced by the existence of multiple drug products within a therapeutic class and the net cost to the plan, including the amount of the prescription price, if any, rebated by the drug’s manufacturer. Typically, generic versions of drugs are placed in a preferred tier. The position of a drug on the formulary generally determines the co-payment that a patient will need to make to obtain the drug and can strongly influence the adoption of a drug by patients and physicians. Patients who are prescribed treatments for their conditions and providers performing the prescribed services generally rely on third-party payors to reimburse all or part of the associated healthcare costs. Patients are unlikely to use our products unless coverage is provided, and reimbursement is adequate to cover a significant portion of the cost of our products. Additionally, a third-party payor’s decision to provide coverage for a drug does not imply that an adequate reimbursement rate will be approved. Also, third-party payors are developing increasingly sophisticated methods of controlling healthcare costs. As a result, coverage, reimbursement and placement determinations are complex and are often the subject of extensive negotiations between the payer and the manufacturer of the drug. Increasingly, both purchasers and payors are also conducting comparative clinical and cost effectiveness analyses involving application of metrics, including data on patient outcomes, provided by manufacturers.

This program is a voluntary Medicare benefit administered by private plans that operate under contracts with the federal government. These plans develop formularies that determine which products are covered and what co-pay will apply to covered drugs. The plans have considerable discretion in establishing formularies and tiered co-pay structures, negotiating rebates with manufacturers and placing prior authorization and other restrictions on the utilization of specific products, subject to review by the Centers for Medicare & Medicaid Services (“CMS”), for discriminatory practices. These Part D plans negotiate discounts with drug manufacturers, which are passed on, in whole or in part, to each of the plan’s enrollees through reduced premiums.

In order for reimbursement to be available for our products under Medicare or Medicaid, we participate in and have rebate obligations under the Medicaid Drug Rebate Program and are enrolled in the 340B drug pricing program, as well as the U.S. Department of Veterans Affairs Federal Supply Schedule pricing program. The programs we participate in, as well as our obligations under these programs, are described under the risk factor “If we fail to comply with our reporting and payment obligations under the Medicaid Drug Rebate Program or other governmental pricing programs in which we participate, we could be subject to additional reimbursement requirements, penalties, sanctions and fines.”

Third-party payers, including the U.S. government, continue to apply downward pressure on the reimbursement of pharmaceutical products. Also, the trend towards managed health care in the United States and the concurrent growth of organizations such as health maintenance organizations may result in lower reimbursement for pharmaceutical products. We expect that these trends will continue as these payors implement various proposals or regulatory policies, including various provisions of the recent health reform legislation that affect reimbursement of these products. There are currently, and we expect that there will continue to be, a number of federal, state and foreign proposals to implement controls on reimbursement and pricing, directly and indirectly.

Table of Contents

In international markets, reimbursement and healthcare payment systems vary significantly by country, and many countries have instituted price ceilings on specific products and therapies. For example, in the EU, pricing and reimbursement schemes vary widely from country to country. Some countries may require the completion of additional studies that compare the cost-effectiveness of a particular medicinal product candidate to currently available therapies. This Health Technology Assessment (“HTA”) which is currently governed by the national laws of the individual EU member states, is the procedure according to which the assessment of the public health impact, therapeutic impact and the economic and societal impact of use of a given medicinal product in the national healthcare systems of the individual country is conducted. The outcome of HTA regarding specific medicinal products will often influence the pricing and reimbursement status granted to these medicinal products by the competent authorities of individual EU member states. The downward pressure on healthcare costs in general, particularly prescription medicines, has become very intense. Pharmaceutical products may face competition from lower-priced products in foreign countries that have placed price controls on pharmaceutical products and may also compete with imported foreign products. Furthermore, there is no assurance that a product will be considered medically reasonable and necessary for a specific indication, will be considered cost-effective by third-party payors, that an adequate level of reimbursement will be established even if coverage is available or that the third-party payors’ reimbursement policies will not adversely affect the ability for manufacturers to sell products profitably.

Because the target patient population for our products and product candidates is small, we must achieve significant market share and obtain relatively high per-patient prices for our products to achieve meaningful gross margins.

We are focused on diseases with a small patient population. A key component of the successful commercialization of an approved product for these indications includes identification of patients and a targeted prescriber base for such product. Typically, drugs for conditions with small prevalence have higher prices in order to generate a return on investment, and as a result, the per-patient prices at which we sell our products are relatively high in order for us to generate an appropriate return for the investment in these product development programs and achieve meaningful gross margins. Additionally, patients who discontinue therapy or do not fill prescriptions are not easily replaced by new patients, given the limited patient population.

We face substantial competition, which may result in others developing or commercializing products before or more successfully than we do.

We will face competition and potential competition from a number of sources, including pharmaceutical and biotechnology companies, specialty pharmaceutical companies, generic drug companies, drug delivery companies and academic and research institutions. Our competitors may develop or market drugs that are more effective, more convenient, more widely used and less costly or have a better safety profile than our products or product candidates, and these competitors may also have significantly more resources than us and be more successful than us in manufacturing and marketing their products.

See Part I.

We may be subject to enforcement action if we engage in improper marketing or promotion of our products.

Failure to comply with the FDA’s promotional, marketing and advertising laws and regulations could lead to the issuance of warning letters, cyber letters, or untitled letters, adverse publicity, the requirement for dear-health-care-provider letters or other corrective information, fines and other monetary penalties, civil or criminal prosecution, including False Claims Act liability, restrictions on our operations and other operating requirements through consent decrees or corporate integrity agreements, debarment, exclusion from participation in federal health care programs and refusal of government contracts or future orders under existing contracts, among other consequences. Similar risks exist in foreign jurisdictions. Any of these consequences would harm the commercial success of our products.

Table of Contents

Further, our promotional materials, statements and training methods must comply with regulatory prohibitions of the promotion of unapproved, or off-label, use. Any regulatory approval that the FDA grants is limited to those specific diseases and indications for which a product is deemed to be safe and effective by FDA. Physicians may use our products off-label, as the FDA does not restrict or regulate a physician’s independent choice of treatment within the practice of medicine. We may also be subject to actions by other governmental entities or private parties, such as the False Claims Act, civil whistleblower or “qui tam” actions. In that event, our reputation could be damaged and adoption of the products could be impaired. In addition, the off-label use of our products may increase the risk of product liability claims.

Product liability lawsuits against us could cause us to incur substantial liabilities and to limit commercialization of our approved products, or any of our product candidates that we may develop.

We face an inherent risk of product liability exposure related to commercializing drug products and testing our product candidates in human clinical trials. If we cannot successfully defend ourselves against claims that our product candidates or products caused injuries, we will incur substantial liabilities. Regardless of merit or eventual outcome, liability claims may result in:

•decreased demand for our products;

•injury to our reputation and significant negative media attention;

•termination of clinical trial sites or entire trial programs;

•withdrawal of clinical trial participants;

•initiation of investigations by regulators;

•significant costs to defend the related litigation;

•a diversion of management’s time and our resources;

•substantial monetary awards paid to trial participants or patients;

•product recalls, withdrawals or labeling revisions and marketing or promotional restrictions; and

•loss of revenue.

Although we maintain product liability insurance coverage, we cannot be sure that our insurance coverage will be adequate or otherwise protect us from or adequately mitigate liabilities or damages with respect to product liability claims, or that such coverage will continue to be available on acceptable terms at all. The successful assertion of one or more large claims against us that exceeds our available insurance coverage, or results in changes to our insurance policies (including premium increases or the imposition of a large deductible or co-insurance requirements), could have an adverse effect on our business. We may need to increase our insurance coverage as products become commercially successful. Insurance coverage is increasingly expensive, and we may not be able to maintain insurance coverage at a reasonable cost or in an amount adequate to satisfy any liability that may arise.

Significant political, trade, regulatory developments, and other circumstances beyond our control could delay, prevent or impair our development or commercialization efforts.

The extent and duration of any tariffs and the resulting impact on general economic conditions and on our business are uncertain and depend on various factors, such as negotiations between the United States and other countries, the response of such countries, and exemptions or exclusions that may be granted. Countries may also adopt other measures, such as controls on imports or exports of goods, technology or data, that could adversely impact supply chains. As these tensions continue to rise, more targeted approaches on certain products, industries or companies could significantly impact our development and commercialization efforts. As a result, our business, operations, and financial condition could be materially harmed.

Table of Contents

Our product candidates may be associated with serious adverse events, undesirable side effects or have other properties that could halt their clinical development, prevent their regulatory approval, limit their commercial potential or result in significant negative consequences.

Adverse events or other undesirable side effects caused by our product candidates could cause us or regulatory authorities to interrupt, delay or halt clinical trials and could result in a more restrictive label or the delay or denial of regulatory approvals by the FDA or other comparable foreign regulatory authorities. If any serious adverse events occur, clinical trials could be suspended or terminated, and our business could be seriously harmed. Regulatory authorities could order us to cease further development of or deny approval of product candidates.

Any side effects or adverse events caused by approved products following regulatory approval, could result in a number of potentially significant negative consequences.

For approved products, if we or others later identify undesirable side effects or adverse events caused by such products, a number of potentially significant negative consequences could result, including but not limited to:

•regulatory authorities may suspend, limit or withdraw approvals of such product, or seek an injunction against its manufacture or distribution;

•regulatory authorities may require additional warnings on the label, including “boxed” warnings, or issue safety alerts, Dear Healthcare Provider letters, press releases or other communications containing warnings or other safety information about the product;

•we may be required to change the way the product is administered or conduct additional clinical trials or post-approval studies;

•we may be required to create a risk evaluation and mitigation strategy, or REMS, which could include a medication guide outlining the risks of such side effects for distribution to patients;

•we may be subject to fines, injunctions or the imposition of criminal penalties;

•we could be sued and held liable for harm caused to patients; and

•our reputation may suffer.

Any of these events could prevent us from achieving or maintaining market acceptance of approved products and could seriously harm our business.

A variety of risks associated with marketing our approved products and any of our product candidates, if approved, internationally, could affect our business.

We may seek regulatory approval for our approved products and any of our product candidates, if approved, outside of the United States. For example, we have submitted an MAA to the EMA for the evaluation of arimoclomol for the treatment of NPC. Accordingly, we expect that we will be subject to additional risks related to operating in foreign countries including:

•different regulatory requirements for maintaining approval of drugs in foreign countries;

•differing payor reimbursement regimes, governmental payors or patient self-pay systems and price controls;

•the potential for so-called parallel importing, which is what happens when a local seller, faced with high or higher local prices, opts to import goods from a foreign market with low or lower prices rather than buying them locally;

•unexpected changes in tariffs, trade barriers, price and exchange controls and other regulatory requirements;

•economic weakness, including inflation, labor shortages, supply chain shortages, or other economic or political uncertainties or instability in particular foreign economies and markets;

•compliance with tax, employment, immigration and labor laws for employees living or traveling abroad;

Table of Contents

•foreign currency fluctuations, which could result in increased operating expenses and reduced revenue;

•difficulties staffing and managing foreign operations;

•workforce uncertainty in countries where labor unrest is more common than in the United States;

•potential liability under the Foreign Corrupt Practices Act of 1977 or comparable foreign regulations;

•challenges enforcing our contractual and intellectual property rights, especially in those foreign countries that do not respect and protect intellectual property rights to the same extent as the United States; and

•business interruptions resulting from geo-political actions, including war and terrorism, such as the current conflict with Ukraine and Russia.

These and other risks associated with our international operations may compromise our ability to achieve or maintain profitability.

If our Global EAP program is terminated prior to regulatory approval and commercialization of arimoclomol in applicable foreign jurisdictions, it will have a material adverse effect on our business, results of operations, cash flows, financial condition and/or prospects.

Arimoclomol is currently available to NPC patients in France, Germany, and other EU member states, as well as select territories outside of Europe through an EAP. We have submitted an MAA to the EMA for the evaluation of arimoclomol for the treatment of NPC, and the EAP is expected to remain in place until arimoclomol becomes commercially available in each of these EAP markets.

Risks Related to Our Business and Our Financial Position

We are highly dependent on one product for substantially all of our revenues, and any loss of revenue from this product could materially harm our business.

For the year ended December 31, 2025 we derived approximately 82% of our revenues from commercial sales of MIPLYFFA® (arimoclomol), which is indicated for a rare disease with a limited patient population. We expect that MIPLYFFA® (arimoclomol) will continue to be our main source of revenue for the foreseeable future. As a result, our business, financial condition, and results of operations are highly dependent on the continued commercial success of MIPLYFFA® (arimoclomol).

Sales of MIPLYFFA® (arimoclomol) may be negatively impacted by a number of factors, including competition from third parties, changes in clinical practice or treatment guidelines, pricing and reimbursement pressures from government and private payors, heightened scrutiny of high-cost rare disease therapies, adverse safety signals, manufacturing or supply disruptions, regulatory actions or labeling changes, and challenges to or expiration of our intellectual property rights. Because the target patient population is small, even modest changes in prescribing patterns, patient identification rates, or reimbursement decisions could have a disproportionate effect on our revenues.

If MIPLYFFA® (arimoclomol) fails to increase or maintain its current level of commercial success for any reason, we may be unable to replace the lost revenues, which could materially adversely affect our business, financial condition, and results of operations.

Table of Contents

We have had recurring negative net operating cash flows throughout our operating history, and we cannot guarantee or predict when we may begin to consistently generate positive net cash flows from operations, or if at all.

We incurred a net loss of $105.5 million for the year ended December 31, 2024. Our net income of $83.2 million for the year ended December 31, 2025 was primarily due to the sale of the PRV in the second quarter of 2025, which resulted in net proceeds of $148.3 million. As of December 31, 2025, we had an accumulated deficit of $422.1 million. We have had recurring negative net operating cash flows throughout our operating history, and we cannot guarantee or predict when we may begin to consistently generate positive net cash flows from operations, or if at all. If we are required by regulatory authorities to perform studies in addition to those currently expected, or if there are any delays in the initiation and completion of our clinical trials or the development of any of our product candidates, our expenses could increase. Even though we generated positive net income for the year ended December 31, 2025, we may not be able to sustain or increase profitability on a quarterly or annual basis. Our failure to become and remain profitable would depress our value and could impair our ability to raise capital, expand our business, maintain our research and development efforts, obtain product approvals, diversify our product offerings or continue our operations. A decline in our value could also cause you to lose all or part of your investment. We may incur significant losses in the future for a number of reasons, many of which are beyond our control, including the market acceptance of our products, competitive products, future product development, our market penetration and margins, as well as the other risks described in this Annual Report on Form 10-K.

As of December 31, 2025, we had federal net operating loss carryforwards of approximately $230.4 million, due to prior period losses, $11.1 million of which, if not utilized, will begin to expire in 2029 and $219.4 million of which have no expiration date. These net operating loss carryforwards could expire unused and be unavailable to offset future income tax liabilities, which could adversely affect our profitability. These federal net operating loss carryforwards are fully reserved under a valuation allowance in the consolidated balance sheet as of December 31, 2025. On December 22, 2017, the U.S. government enacted H.R. 1, “An Act to provide for reconciliation pursuant to titles II and V of the concurrent resolution on the budget for fiscal year 2018” (informally titled the Tax Cuts and Jobs Act). Under the Tax Cuts and Jobs Act, U.S. federal net operating losses incurred in 2018 and in future years may be carried forward indefinitely, but the deductibility of such federal net operating losses is limited. It is uncertain if and to what extent various states will conform or continue to conform to the Tax Cuts and Jobs Act or any subsequent or newly enacted federal tax legislation. In addition, under Section 382 and Section 383 of the Code, if a corporation undergoes an “ownership change,” which is generally defined as a greater than 50% change, by value, in its equity ownership over a three-year period, the corporation’s ability to use its pre-change net operating loss carryforwards and other pre-change tax attributes to offset its post-change income may be limited. We performed a Section 382 ownership change analysis through the period ending November 26, 2025 and determined that we experienced ownership changes in 2016, 2020, and 2021, which resulted in a portion of our net operating loss carryforwards being subject to an annual limitation under Section 382 for those respective tax years. No other ownership changes or limitations on our historical net operating loss carryforwards were noted through the period ending November 26, 2025. As of December 31, 2025, we maintain a full valuation allowance over our deferred tax assets for financial reporting purposes.

We recognized an impairment charge related to intangible assets. If our remaining assets become impaired in the future, we would incur additional impairment charges, which would negatively affect our operating results.

We recognized impairment charges of $58.7 million related to definite-lived intangible assets during the quarter ended June 30, 2025. If our remaining assets become impaired in the future, we would incur additional impairment charges, which would negatively affect our results of operations. There is significant judgment required in the analysis of a potential impairment of identified intangible assets and other long-lived assets. Impairment may result from, among other things, significant changes in the manner of use of the acquired assets, negative industry or economic trends and/or significant underperformance relative to historic or projected operating results. For additional information, see Note S of our consolidated financial statements included elsewhere in this Annual Report on Form 10-K.

Table of Contents

Risks Related to Our Dependence on Third Parties

We rely on a limited number of suppliers, in some cases sole-source suppliers.

We do not have any manufacturing facilities. We procure approved products and bulk drug substances from sole-source, third-party suppliers. We anticipate we will continue to do so for the foreseeable future. If a current contract manufacturer cannot perform as agreed, we may be required to replace such manufacturer and we may incur added costs and delays in identifying and qualifying any such replacement. Even if we are able to maintain our existing third-party relationships or establish any such agreements with other third-party manufacturers, reliance on third-party manufacturers entails additional risks, including:

•failure by any of our suppliers to comply with applicable regulations;

•the possible misappropriation of our proprietary information, including our trade secrets and know-how;

•disruption, delays and costs associated with changing suppliers, including additional regulatory filings;

•the possible breach, termination or nonrenewal of the agreement by the third party;

•a delay or inability to procure or expand sufficient manufacturing capacity;

•the inability to negotiate manufacturing agreements with third parties under commercially reasonable terms; and

•carrier disruptions or increased costs that are beyond our control.

The facilities used by our third-party contract manufacturers to manufacture our approved products and any of our product candidates are subject to review by the FDA pursuant to inspections, and such inspections could result in findings that lead to failure to obtain FDA approval of such marketing applications.

We are completely dependent on, our contract manufacturing partners for compliance with cGMP and similar regulatory requirements outside the United States and for manufacture of both active drug substances and finished drug products. If our contract manufacturers cannot successfully manufacture material that conforms to our specifications and the strict regulatory requirements of the FDA or other regulatory authorities, we will not be able to secure and maintain regulatory approval of our marketing applications for the use of their manufacturing facilities for our products.

The failure of our third-party manufacturers, to comply with applicable regulations could result in sanctions being imposed on us, including warning letters, clinical holds or termination of clinical trials, fines, injunctions, restitution, disgorgement, civil penalties, delays, suspension or withdrawal of approvals or other permits, FDA or foreign regulatory authorities refusal to approve pending applications, product detentions, FDA or DEA consent decrees placing significant restrictions on or suspending manufacturing and distribution operations, debarment, refusal to allow import or export, product detentions, adverse publicity, dear-health-care-provider letters or other warnings, license revocation, seizures or recalls of product candidates, operating restrictions, refusal of government contracts or future orders under existing contracts and civil and criminal liability, including False Claims Act liability, exclusion from participation in federal healthcare programs, and corporate integrity agreements, among other consequences, any of which could significantly and adversely affect supplies of our products.

Table of Contents

We rely on a limited number of third‑party distribution partners to commercialize MIPLYFFA, and the loss or inadequate performance of any of these partners could materially and adversely affect our ability to supply MIPLYFFA in key territories.

We rely on a single specialty pharmacy to distribute MIPLYFFA in the United States. We also rely on a single distributor in the EU and another single distributor for select territories outside of Europe to distribute MIPLYFFA under our Global EAP.

Any disruption in the services provided by these distributors—including failure to comply with regulatory requirements, breach of contractual obligations, operational failures, financial instability, changes in ownership, natural disasters or other business interruptions—could negatively impact product availability in the relevant markets. If any of these third parties were to cease providing services to us or were unable or unwilling to perform their obligations, we would be required to secure an alternative distributor. Identifying, qualifying, and contracting with a replacement distributor is often a time‑consuming process that may require regulatory notifications, new logistics arrangements, and additional compliance reviews. As a result, the transition to a new distribution partner could cause significant delays in our ability to supply our approved drug in affected territories, potentially resulting in reduced revenues, customer dissatisfaction, damage to our commercial reputation, and a material adverse effect on our business.

We rely on and expect to continue to rely on third parties to conduct our clinical trials for our product candidates, and those third parties may not perform satisfactorily.

We remain responsible for ensuring that each of our clinical trials is conducted in accordance with the general investigational plan and protocols for the trial and comply with regulatory standards commonly referred to as good clinical practices, or GCPs. Regulatory authorities enforce these GCPs through periodic inspections of trial sponsors, investigators and trial sites. Similar requirements apply in foreign jurisdictions. Failure to comply with these regulations may require us to repeat preclinical studies and clinical trials, which would delay the regulatory approval process. Failure to comply with the applicable requirements related to clinical investigations by us, our CROs or clinical trial sites can also result in clinical holds and termination of clinical trials, debarment, FDA or foreign regulatory authorities refusal to approve applications based on the clinical data, warning letters, withdrawal of marketing approval if the product has already been approved, fines and other monetary penalties, delays, adverse publicity and civil and criminal sanctions, among other consequences.

If this collaboration is not successful, we may not be able to capitalize on the market potential of AZSTARYS.

We entered into the AZSTARYS License Agreement with Commave pursuant to which we granted an exclusive, worldwide license to Commave to develop, manufacture and commercialize AZSTARYS. On behalf of Commave, Corium leads all commercialization activities in the United States for AZSTARYS under the AZSTARYS License Agreement. We cannot guarantee that the AZSTARYS License Agreement will be successful or that we will receive any future payments under the AZSTARYS License Agreement. Commave has the option to terminate the AZSTARYS License Agreement, in its entirety or on a product-by-product and country-by-country basis, at their convenience.

Table of Contents

In addition, a dispute has arisen with Commave concerning the interpretation of certain provisions under the AZSTARYS License Agreement, and in September 2024, Commave filed a complaint against us in the Court of Chancery of the State of Delaware alleging breach of contract and seeking injunctive relief, specific performance, declaratory relief, and damages regarding the parties' respective rights and obligations under the AZSTARYS License Agreement. The litigation is in its early stages, and we strongly disagree with Commave's allegations and believe this lawsuit is without merit. While we intend to vigorously defend against Commave's claims, the outcome of this matter is inherently uncertain. We cannot predict with certainty the timing or ultimate outcome of this litigation or its potential impact on our business, financial condition, or results of operations. The AZSTARYS License Agreement remains in effect during this litigation, and both parties continue to perform their respective obligations thereunder. However, there can be no assurance that this dispute will not have an adverse impact on our relationship with Commave or on our business.

We may seek to establish collaborations for certain product candidates, which may not be available on acceptable terms, or at all.

We may seek to collaborate with pharmaceutical and biotechnology companies for the development and potential commercialization of certain product candidates. Whether we reach a definitive agreement for a collaboration will depend, among other things, upon our assessment of the collaborator’s resources and expertise, the terms and conditions of the proposed collaboration and the proposed collaborator’s evaluation of several factors.

If we are unable to do so, we may have to curtail the development of product candidates, reduce or delay one or more of our development programs, delay potential commercialization of our product candidates or reduce the scope of any sales or marketing activities of our product candidates, or increase our expenditures and undertake development or commercialization activities of our product candidates at our own expense. If we elect to increase our expenditures to fund development or commercialization activities on our own, we may need to obtain additional capital, which may not be available to us on acceptable terms or at all. If we do not have sufficient funds, we may not be able to further develop our product candidates or bring our product candidates to market and generate product revenue.

Risks Related to Our Intellectual Property

If we are unable to obtain and maintain intellectual property protection for our technology, our approved products or our product candidates, or if the scope of the intellectual property protection obtained is not sufficiently broad, our competitors could develop and commercialize technology and products similar or identical to ours, and our ability to successfully commercialize our technology, our approved products, or our product candidates if approved, may be impaired.

Therefore, any such patents and applications may not be prosecuted and enforced in a manner consistent with the best interests of our business.

The patent position of biotechnology and pharmaceutical companies, generally, is highly uncertain, involves complex legal and factual questions and has in recent years been the subject of much litigation. In addition, the laws of foreign countries may not protect our rights to the same extent as the laws of the United States or visa-versa. Our patent position is subject to numerous additional risks, including the following:

•our pending patent applications may not result in issued patents or patents that will provide us with any meaningful protection;

•we cannot be certain that we are the first to invent the inventions covered by pending patent applications or that we are the first to file such applications and, if we are not, we may be subject to priority disputes or lose rights;

•because of the extensive time required for development, testing and regulatory review of a product candidate, it is possible that before a potential product can be commercialized, any related patent may expire, or remain in existence for only a short period following commercialization thereby reducing, or eliminating any advantage of the patent;

•we may not be able to acquire patent term extensions or supplemental certificates of certain patents, domestic or foreign, due to regulatory delays, among others, which may affect the term of enforceability of such patents over time;

Table of Contents

•there could also be delays at the USPTO caused by staffing cuts and other U.S. government actions as a result of the U.S. Department of Government Efficiency or other executive actions to reduce the size of the U.S. government;

•our competitors may be able to design around our owned or licensed patents by developing similar or alternative technologies or drugs without infringing on our intellectual property rights;

•third parties may develop products that have the same or similar effect as our products without infringing our patents; and

•there may be dominating or intervening patents relevant to our product candidates of which we are not aware.

Any of these factors could hurt our ability to gain full patent protection for our products.

We may become involved in lawsuits to protect or enforce our patents or other intellectual property, which could be expensive, time consuming and unsuccessful.

To counter infringement or unauthorized use, we may be required to file infringement claims, which can be expensive and time consuming and divert the time and attention of our management and scientific personnel. Any claims we assert against perceived infringers could provoke these parties to assert counterclaims against us alleging that we infringe their patents, in addition to counterclaims asserting that our patents are invalid or unenforceable, or both. The outcome following legal assertions of invalidity and unenforceability is unpredictable. An adverse outcome in a litigation or proceeding involving our patents could limit our ability to assert our patents against those parties or other competitors and may curtail or preclude our ability to exclude third parties from making and selling similar or competitive products and technologies. In addition, third parties may use technology covered by patent applications, but pending patent applications cannot be enforced against third parties practicing the technology claimed in such applications unless and until a patent issues from such applications. Any of these occurrences could adversely affect our competitive business position, business prospects and financial condition.

Third parties may initiate legal proceedings against us alleging that we are infringing their intellectual property rights, the outcome of which would be uncertain and could significantly harm our business.

There is considerable intellectual property litigation in the biotechnology and pharmaceutical industries. Although we seek to develop proprietary formulations that do not infringe the intellectual property rights of others, we may become party to, or threatened with, future adversarial proceedings or litigation, domestic or foreign, regarding intellectual property rights with respect to our products or other aspects of our technology. We cannot be certain that we have identified or will identify each and every third party patent and pending patent application in the United States and abroad that is relevant to or necessary for the commercialization of our current and future products and product candidates in any jurisdiction.

Litigation regarding intellectual property rights is inherently uncertain due to the complex issues involved, and we may not be successful in defending ourselves in such matters. However, we may not be able to obtain any required license on commercially reasonable terms, or at all. Even if we were able to obtain a license, it could be non-exclusive, thereby giving our competitors access to the same technologies licensed to us. We could be forced, including by court order, to cease commercializing the infringing technology or product. In addition, we could be found liable for monetary damages, including treble damages and attorneys’ fees if we are found to have willfully infringed a patent. A finding of infringement could prevent us from commercializing our product candidates or force us to cease some or all of our business operations.

Intellectual property litigation could cause us to spend substantial resources and distract our personnel from their normal responsibilities.

If securities analysts or investors perceive these results to be negative, it could hurt the price of our common stock. Such litigation or proceedings could substantially increase our operating losses and reduce the resources available for development activities or any future sales, marketing or distribution activities. We may not have sufficient financial or other resources to conduct such litigation or proceedings adequately. Some of our competitors may be able to sustain the costs of such litigation or proceedings more effectively than we can because of their greater financial resources.

Table of Contents

If we are unable to protect the confidentiality of our trade secrets, our business and competitive position would be harmed.

We seek to protect our trade secrets, in part, by entering into non-disclosure and confidentiality agreements with parties who have access to them, such as our employees, corporate collaborators, outside scientific collaborators, contract manufacturers, consultants, advisors and other third parties. We also enter into confidentiality and invention or patent assignment agreements with our employees and consultants. Despite these efforts, any of these parties may breach the agreements and disclose our proprietary information, including our trade secrets.

We have registered trademarks, including those for LAT, Zevra, MIPLYFFA and OLPRUVA. In addition, we have solicited and applied for trademarks for the Zevra logo and several potential trade names and logos for future product candidates. Third parties may oppose or attempt to cancel our trademark applications or trademarks, or otherwise challenge our use of the trademarks. If our trademarks are successfully challenged, we could be forced to rebrand our products, which could result in loss of brand recognition and could require us to devote resources to advertising and marketing new brands. Our competitors may infringe our trademarks and we may not have adequate resources to enforce our trademarks. We may license our trademarks and trade names to third parties, such as distributors. Although these license agreements may provide guidelines for how our trademarks and trade names may be used, a breach of these agreements or misuse of our trademarks and tradenames by our licensees may jeopardize our rights in or diminish the goodwill associated with our trademarks and trade names.

We may not be able to protect our intellectual property rights throughout the world.

Patents are of national or regional effect, and filing, prosecuting and defending patents on all of our products and technologies throughout the world would be prohibitively expensive. As such, our intellectual property rights in some countries outside the United States can be less extensive than those in the United States and we may not be able to prevent third parties from practicing our inventions in all countries outside the United States, or from selling or importing products made using our inventions in and into the United States or other jurisdictions. Competitors may use our technologies in jurisdictions where we have not obtained patent protection to develop their own products or technology and may export otherwise infringing products or technology to territories where we have patent protection, but enforcement rights are not as strong as those in the United States. Further, the legal systems of certain countries, particularly certain developing countries, do not favor the enforcement of patents and other intellectual property protection, particularly those relating to pharmaceuticals or biologics, which could make it difficult for us to stop the infringement of our patents or marketing of competing products in violation of our proprietary rights generally. Moreover, our ability to protect and enforce our intellectual property rights may be adversely affected by unforeseen changes in intellectual property laws of other countries. In those countries, we and our licensors may have limited remedies if patents are infringed or if we or our licensors are compelled to grant a license to a third party, which could materially diminish the value of those patents. In addition, many countries limit the enforceability of patents against government agencies or government contractors. This could limit our potential revenue opportunities. Accordingly, our efforts to enforce our intellectual property rights around the world may be inadequate to obtain a significant commercial advantage from the intellectual property that we develop or license.

The EU Patent Package went into effect June 1, 2023. Under the UPC, all European patents, including those issued prior to ratification of the European Patent Package, will by default automatically fall under the jurisdiction of the UPC. The UPC will provide our competitors with a new forum to centrally revoke our European patents, and allow for the possibility of a competitor to obtain pan-European injunctions. It will be several years before we will understand the scope of patent rights that will be recognized and the strength of patent remedies that will be provided by the UPC. Under the EU Patent Package, we will have the right to opt our patents out of the UPC over the first seven years of the court’s existence, but doing so may preclude us from realizing the benefits of the new unified court.

Table of Contents

Risks Related to Regulatory Approval of Our Product Candidates and Other Legal Compliance Matters

If we are not able to obtain required regulatory approvals for any of our product candidates, we will not be able to commercialize them and our ability to generate revenue or profits could be limited.

We are not permitted to market any of our product candidates in the United States until we receive approval of an NDA from the FDA, or in any foreign countries until we receive the requisite approvals in such countries. In the United States, the FDA generally requires the completion of non-clinical testing and clinical trials of each drug to establish its safety and efficacy and extensive pharmaceutical development to ensure its quality and other factors before an NDA is approved. Of the large number of drugs in development, only a small percentage result in the submission of an NDA to the FDA and even fewer are approved for commercialization. Even if regulatory approval is obtained, subsequent safety, efficacy, quality or other issues can result in a product approval being suspended or withdrawn.

In order to market and sell our products in the EU and any other jurisdictions, we must obtain separate marketing approvals and comply with numerous and varying regulatory requirements. The approval procedure varies among countries and can involve additional testing. The time required to obtain approval may differ substantially from that required to obtain FDA approval. The regulatory approval process outside the United States generally includes all of the risks associated with obtaining FDA approval. In addition, in many countries outside the United States, it is required that the product be approved for reimbursement before the product can be marketed in that country. We may not obtain approvals from regulatory authorities outside the United States on a timely basis, if at all. Approval by the FDA does not ensure approval by regulatory authorities in other countries or jurisdictions, and approval by one regulatory authority outside the United States does not ensure approval by regulatory authorities in other countries or jurisdictions or by the FDA. However, failure to obtain approval in one jurisdiction may impact our ability to obtain approval elsewhere.

Changes in the regulatory approval policy during the development period, changes in or the enactment of additional statutes or regulations, or changes in regulatory review for a submitted product application may cause delays in the approval or rejection of an application or may result in future withdrawal of approval.

For more detailed information regarding the regulatory requirements for approval of product candidates in the United States and EU, see "Item 1. Business - U.S. Government Regulation and Product Approval" and "Item 1. Business - Foreign Regulation" above in this Annual Report on Form 10-K.

If we experience delays or difficulties in the enrollment of subjects in clinical trials, our receipt of necessary regulatory approvals could be delayed or prevented.

Subject enrollment is affected by other factors including:

•the size and nature of the subject population specified in the trial protocol, especially in indications for rare diseases;

•the eligibility criteria for the study in question;

•the perceived risks and benefits of the product candidate under study;

•ongoing trials by competitors for similar indications as our product candidates;

•severe or unexpected drug-related adverse events experienced by subjects in a clinical trial;

•the availability of drugs approved to treat the diseases or conditions under study;

•the patient referral practices of physicians;

•the severity of the disease or condition under investigation;

Table of Contents

•the ability to obtain and maintain subject informed consent;

•the clinical trial design, including required tests, procedures and follow-up;

•the ability to monitor subjects adequately during and after treatment;

•delays in adding new, or withdrawals of existing, investigators and clinical sites; and

•the proximity and availability of clinical trial sites for prospective subjects.

Our inability to enroll a sufficient number of subjects for clinical trials would result in significant delays, increased costs and could require us to abandon one or more clinical trials altogether.

Interim, topline, or preliminary data from our clinical trials that we announce or publish from time to time may change as more patient data become available and are subject to audit and verification procedures that could result in material changes in the final data.

As a result, the preliminary or topline results that we report may differ from future results of the same studies, or different conclusions or considerations may qualify such results, once additional data has been received and fully evaluated. Topline data also remains subject to audit and verification procedures that may result in the final data being materially different from the preliminary data we previously published. As a result, preliminary or topline data should be viewed with caution until the final data are available.

Interim data from clinical trials that we may complete are subject to the risk that one or more of the clinical outcomes may materially change as patient enrollment continues and more patient data become available or as patients from our clinical trials continue other treatments for their disease. Adverse differences between preliminary or interim data and final data could significantly harm our business prospects.

Our approved products are, and any of our product candidates for which we obtain marketing approval will be, subject to significant post-marketing regulatory requirements and oversight.

For MIPLYFFA and any other approved products, the manufacturing processes, labeling, packaging, distribution, adverse event reporting, storage, advertising, promotion and recordkeeping for the product will be subject to extensive and ongoing regulatory requirements. These requirements include submissions of safety and other post-marketing information and reports, registration, as well as continued compliance with cGMP and comparable foreign regulations and GCP for any clinical trials that we conduct post-approval. Non-compliance with EU requirements regarding safety monitoring or pharmacovigilance, and with requirements related to the development of drugs for the pediatric population, can also result in significant financial penalties.

Our inability to maintain compliance with post-marketing regulatory requirements may inhibit our ability to commercialize our products and generate revenue, and could require us to expend significant time and resources in response and could generate negative publicity. In addition, the policies of the FDA, the EMA and other regulatory authorities may change, and additional government regulations may be enacted that could impair our business. If we are slow or unable to adapt to changes in existing requirements or the adoption of new requirements or policies, or if we are not able to maintain regulatory compliance, we may be subject to enforcement action.

For more detailed information regarding post-approval regulatory requirements, see "Item 1. Business - U.S. Government Regulation and Product Approval - Post-Approval Requirements" above in this Annual Report on Form 10-K.

Table of Contents

Our approved products are, and if marketing approval of any of our product candidates is granted, such product candidates may be, subject to limitations on the indicated uses for which the product may be marketed.

For instance, the label for AZSTARYS contains black box warnings regarding the risks of abuse and dependence.

Current and future healthcare reform legislation or regulation may increase the difficulty and cost for us to obtain marketing approval of our product candidates and increase the cost to commercialize our approved products.

In the United States and many foreign jurisdictions, there have been a number of legislative and regulatory changes and proposed changes regarding the healthcare system that could, among other things, prevent or delay marketing approval of our product candidates, restrict or regulate post-approval activities and affect the ability to profitably sell approved products. Among policy makers and payors in the United States and elsewhere, there is significant interest in promoting changes in healthcare systems with the stated goals of containing healthcare costs, improving quality and/or expanding access. In the United States, the pharmaceutical industry has been a particular focus of these efforts and has been significantly affected by major legislative initiatives. For example, in 2010, the ACA was signed into law. The ACA substantially changed the way healthcare is financed by both governmental and private insurers, and significantly affects the U.S. pharmaceutical industry.

In addition, other legislative changes that have a significant impact on the pharmaceutical industry have been proposed and adopted since the ACA was enacted. The American Rescue Plan Act of 2021 eliminated the statutory Medicaid drug rebate cap, beginning January 1, 2024. The rebate was previously capped at 100% of a drug's average manufacturer price.

The drug price negotiation program is currently subject to legal challenges, and the impact of the IRA on us and the pharmaceutical industry cannot yet be fully determined, but is likely to be significant.

The One Big Beautiful Bill Act, which was enacted in July 2025, imposes significant reductions in the funding of the Medicaid program. Such reductions are expected to decrease the number of persons enrolled in Medicaid and reduce the services covered by Medicaid, which could adversely affect sales of approved products or of any product candidate that we commercialize.

The current U.S. administration is pursuing a two-fold strategy to reduce drug costs in the United States. While it is unclear whether and how proposals will be implemented, these policies are likely to have a negative impact on the pharmaceutical industry and on our ability to receive adequate revenues for our products. On the one hand, the current U.S. administration has threatened to impose significant tariffs on pharmaceutical manufacturers that do not adopt pricing policies such as most favored nation pricing, which would tie the price for drugs in the United States to the lowest price in a group of other countries. In response, multiple manufacturers have entered into confidential pricing agreements with the federal government. On the other hand, the current U.S. administration is pursuing traditional regulatory pathways to impose drug pricing policies and published two proposed regulations in December 2025, referred to as Globe and Guard. If finalized, these regulations would implement mandatory payment models under which manufacturers of eligible drugs would be required to pay rebates to the federal government on a portion of the units of their drugs that are reimbursed by Medicare, with the rebate amount based on most favored nation pricing. Imposing a rebate in the United States that is based on drug prices outside the United States would mark a drastic and unprecedented shift in the U.S. pharmaceutical market, and while the impact of the Globe and Guard proposed regulations, if finalized, cannot yet be determined, it is likely to be significant. Even proposals or executive actions that are ultimately deemed unlawful could negatively impact the U.S. pharmaceutical sector and our business, for example by causing uncertainty and delaying development and commercialization efforts.

Table of Contents

At the state level, legislatures are increasingly passing legislation and implementing regulations designed to control pharmaceutical product pricing, including price or patient reimbursement constraints, discounts, restrictions on certain product access and marketing cost disclosure, drug price reporting and other transparency measures. States are also seeking to implement general, across the board price caps for pharmaceuticals, or are seeking to regulate drug distribution.

) was published on April 26, 2023. The proposed revisions (affecting the duration of regulatory data protection and market protection, including for orphan medicinal products, revising the eligibility for expedited pathways, etc.) remain to be formally adopted by the European Parliament and Council of the EU , which is not anticipated before early 2026. The proposed changes are not expected to enter into application before 2028 and may have a significant impact on the biopharmaceutical industry in the long term.

We cannot be sure whether additional legislative changes will be enacted, or whether the FDA's or foreign regulations, guidance or interpretations will be changed. Any reduction in reimbursement from Medicare or other government programs may result in a similar reduction in payments from private payors. The implementation of cost containment measures or other healthcare reforms may prevent us from being able to generate revenue, attain or maintain profitability, or commercialize our product candidates.

We may not be able to obtain or maintain the benefits associated with orphan drug designation, including the potential for market exclusivity.

Under the Orphan Drug Act of 1983, the FDA may designate a drug as an orphan product if it is intended to treat a rare disease or condition.

Orphan designation entitles a party to financial incentives such as reduction of fees, fee waivers, protocol assistance, and access to the centralized marketing authorization procedure. Moreover, upon grant of a marketing authorization and assuming the requirement for orphan designation are also met at the time the marketing authorization is granted, orphan medicinal products are entitled to a ten-year period of market exclusivity for the approved therapeutic indication. The period of market exclusivity is extended by two years for orphan medicinal products that have also complied with an agreed Pediatric Investigation Plan.

In the EU, during the market exclusivity period, marketing authorizations may be granted to a similar medicinal product with the same orphan indication if: (i) the applicant can establish that the second medicinal product, although similar to the orphan medicinal product already authorized is safer, more effective or otherwise clinically superior to the orphan medicinal product already authorized; (ii) the marketing authorization holder for the orphan medicinal product grants its consent; or (iii) if the marketing authorization holder of the orphan medicinal product is unable to supply sufficient quantities of product.

Table of Contents

Our current and future relationships with healthcare professionals, principal investigators, consultants, customers and third-party payors in the United States and elsewhere may be subject to applicable anti-kickback, fraud and abuse, false claims, physician payment transparency, and other healthcare laws and regulations, which could expose us to penalties.

Healthcare providers and third-party payors in the United States and elsewhere play a primary role in the recommendation and prescription of drug products. Our and our commercial partners' current and future arrangements with healthcare professionals, principal investigators, consultants, customers and third-party payors may expose us to broadly applicable fraud and abuse and other healthcare laws, including, without limitation, the Anti-Kickback Statute and the False Claims Act, that may constrain the business or financial arrangements and relationships through which we and our commercial partners sell, market and distribute approved products. In addition, we may be subject to transparency laws with respect to drug pricing and transfers of value made to physicians and other healthcare professionals. The applicable federal, state and foreign healthcare laws that may affect our ability to operate include the following:

•the federal Anti-Kickback Statute;

•federal civil and criminal false claims laws, including the False Claims Act;

•the civil monetary penalties statute;

•the Health Insurance Portability and Accountability Act, or HIPAA;

•the federal Physician Payments Sunshine Act and its implementing regulations; and

•analogous state and foreign laws and regulations.

These laws may affect our and our commercial partners' sales, marketing, and other promotional activities by imposing administrative and compliance burdens. If our operations are found to be in violation of any of these laws or any other governmental regulations that may apply to us, we may be subject to significant civil, criminal and administrative penalties, including, without limitation, damages, fines, imprisonment, exclusion from participation in government healthcare programs, such as Medicare and Medicaid, corporate integrity agreements or similar agreements to resolve allegations of non-compliance with these laws, and the curtailment or restructuring of our operations, which could significantly harm our business. If any of the physicians or other healthcare providers or entities with whom we currently, or expect to, do business, including future collaborators, is found not to be in compliance with applicable laws, they and we may be subject to significant penalties and potential exclusion from participation in healthcare programs as a result of their non-compliance.

For more detailed information regarding applicable federal, state and foreign healthcare laws that may affect our ability to operate, see “Item 1. Business - U.S. Government Regulation and Product Approval - Other Healthcare Regulatory Frameworks” above in this Annual Report on Form 10-K.

Table of Contents

If we fail to comply with our reporting and payment obligations under the Medicaid Drug Rebate Program or other governmental pricing programs in which we participate, we could be subject to additional reimbursement requirements, penalties, sanctions and fines.

The MDRP requires us to pay a rebate to state Medicaid programs every quarter for each unit of our covered outpatient drugs dispensed to Medicaid beneficiaries and paid for by a state Medicaid program. The rebate is based on pricing data that we must report on a monthly and quarterly basis to the Centers for Medicare & Medicaid Services (“CMS”), the federal agency that administers the MDRP and other governmental healthcare programs. These data include the average manufacturer price (AMP) for each drug and, in the case of innovator products, the best price, which in general represents the lowest price available from the manufacturer to certain entities in the United States in any pricing structure, calculated to include all sales and associated rebates, discounts and other price concessions. The Medicaid rebate consists of two components, the basic rebate and the additional rebate, which is triggered if the AMP for a drug increases faster than inflation. If we become aware that our MDRP government price reporting submission for a prior quarter was incorrect or has changed as a result of recalculation of the pricing data, we must resubmit the corrected data for up to three years after those data originally were due. If we fail to provide information timely or are found to have knowingly submitted false information to the government, we may be subject to civil monetary penalties and other sanctions, including termination from the MDRP. In the event that CMS terminates our rebate agreement pursuant to which we participate in the MDRP, no federal payments would be available under Medicaid or Medicare Part B for our covered outpatient drugs. Our failure to comply with our MDRP price reporting and rebate payment obligations could negatively impact our financial results.

The IRA imposes rebates under Medicare Part B and Medicare Part D that are triggered by price increases that outpace inflation (first due in 2023), as described under the risk factor “Current and future healthcare reform legislation or regulation may increase the difficulty and cost for us to obtain marketing approval of our product candidates and increase the cost to commercialize our approved products,” above.

These 340B covered entities include a variety of community health clinics and other entities that receive health services grants from the Public Health Service, as well as hospitals that serve a disproportionate share of low‑income patients. The ACA expanded the list of covered entities to include certain free‑standing cancer hospitals, critical access hospitals, rural referral centers and sole community hospitals, but exempts “orphan drugs,” from the ceiling price requirements for these covered entities. The 340B ceiling price is calculated using a statutory formula based on AMP and rebate amount for the covered outpatient drug as calculated under the MDRP. We must report 340B ceiling prices to HRSA on a quarterly basis, and HRSA publishes those prices to 340B covered entities. In addition, HRSA has finalized regulations regarding the calculation of the 340B ceiling price and the imposition of civil monetary penalties on manufacturers that knowingly and intentionally overcharge covered entities for 340B-eligible drugs. HRSA has also finalized a revised regulation implementing an administrative dispute resolution process through which 340B covered entities may pursue claims against participating manufacturers for overcharges, and through which manufacturers may pursue claims against 340B covered entities for engaging in unlawful diversion or duplicate discounting of 340B drugs.

In order for approved products to be paid for with federal funds under the Medicaid and Medicare Part B programs and purchased by certain federal agencies and grantees, we also participate in the U.S. Department of Veterans Affairs (“VA”) Federal Supply Schedule (“FSS”) pricing program. As part of this program, we are required to make our products available for procurement on an FSS contract under which we must comply with standard government terms and conditions and charge a price that is no higher than the statutory Federal Ceiling Price (“FCP”), to four federal agencies (VA, U.S. Department of Defense (“DOD”), Public Health Service, and U.S. Coast Guard). Pursuant to applicable law, knowing provision of false information in connection with a Non-FAMP filing can subject a manufacturer to significant civil monetary penalties for each item of false information. The FSS pricing and contracting obligations also contain extensive disclosure and certification requirements.

Table of Contents

We also participate in the Tricare Retail Pharmacy program, under which we are required to pay quarterly rebates on utilization of innovator products that are dispensed through the Tricare Retail Pharmacy network to Tricare beneficiaries. The rebates are calculated as the difference between the annual Non-FAMP and FCP. If we overcharge the government in connection with our FSS contract or Tricare Agreement, whether due to a misstated FCP or otherwise, we are required to refund the difference to the government. Failure to make necessary disclosures and/or to identify contract overcharges could result in allegations against us under the False Claims Act and other laws and regulations. Unexpected refunds to the government, and responding to a government investigation or enforcement action, would be expensive and time-consuming, and could have a material adverse effect on our business, financial condition, results of operations and growth prospects.

The calculations are complex and are often subject to interpretation by us, governmental or regulatory agencies, and the courts. CMS, the Department of Health & Human Services Office of Inspector General, and other governmental agencies have pursued manufacturers that were alleged to have failed to report these data to the government in a timely or accurate manner. Governmental agencies may also make changes in program interpretations, requirements or conditions of participation, some of which may have implications for amounts previously estimated or paid.

Risks Related to Cybersecurity and Data Privacy

Cybersecurity breaches, loss of data and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation.

In the ordinary course of our business, we may collect, process, transmit and store proprietary, confidential and sensitive information, including personal information (such as key-coded data and health information), intellectual property, trade secrets and proprietary business information owned or controlled by ourselves or other parties. It is critical that we do so in a secure manner to maintain the confidentiality and integrity of such information.

There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be complied with or effective in protecting our systems and information. Despite the implementation of security measures, our information technology systems and data, and those of our CROs and other third parties on which we rely, are vulnerable to system failure, interruption, compromise, attack or damage from several sources, such as data corruption; breakdown; malicious human acts; malware (such as ransomware); misconfigurations, “bugs” or other vulnerabilities; malicious code (such as computer viruses or worms); fraudulent activity; employee misconduct, theft or error; denial-of-service attacks; public health epidemics; cyber-attacks by sophisticated nation-state and nation-state supported actors; natural disasters; terrorism; war; and telecommunication and electrical failures. We have also outsourced elements of our information technology infrastructure, and as a result a number of third-party vendors may or could have access to our confidential information. Our recovery systems (and those of third parties upon whom we rely) are similarly vulnerable. Any of these events could lead to the unauthorized access, disclosure and use of proprietary, confidential, or otherwise non-public information.

The techniques used by criminal actors to attack computer systems are sophisticated, change frequently and may originate from less regulated and remote areas of the world. As a result, we may not be able to address these techniques proactively or implement adequate preventative measures. Attacks upon information technology systems are also increasing in their levels of persistence and intensity and are being conducted by sophisticated and organized groups and individuals with a wide range of motives and expertise. We may also experience security breaches that may remain undetected for an extended period. As a result of the continued hybrid working environment, we may also face increased cybersecurity risks due to our reliance on internet technology and the number of our employees who are working remotely, which may create additional opportunities for cybercriminals to exploit vulnerabilities.

Table of Contents

If we or our third-party vendors were to experience a significant cybersecurity breach of our or their information systems or data, it may result in a material adverse impact, including without limitation, fines, damages, litigation, enforcement actions, loss of trade secrets, personal information or other proprietary or sensitive information, a material disruption of our drug development programs, regulatory scrutiny or other harm to our business. For example, the loss of clinical trial data from completed or ongoing or planned clinical trials could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data. In addition, the costs associated with the investigation, remediation and potential notification of the breach to counter-parties and data subjects could be material. We may be required to expend significant resources, fundamentally change our business activities and practices, or modify our operations, including our clinical trial activities, or information technology in an effort to protect against security breaches and to mitigate, detect and remediate actual and potential vulnerabilities. The costs of maintaining or upgrading our cyber-security systems at the level commercially reasonable to keep up with our expanding operations and prevent against potential attacks are increasing, and despite our best efforts, our network security and data recovery measures and those of our vendors may still not be adequate to protect against such security breaches and disruptions.

Furthermore, federal, state and international laws and regulations can expose us to enforcement actions and investigations by regulatory authorities, and potentially result in regulatory penalties, fines and significant legal liability, if our information technology security efforts fail. We may also be exposed to a risk of loss or litigation and potential liability, which could materially and adversely affect our business, results of operations or financial condition. In addition, our remediation efforts may not be successful. If we do not allocate and effectively manage the resources necessary to build and sustain the proper technology and cybersecurity infrastructure, we could suffer significant business disruption, including transaction errors, supply chain or manufacturing interruptions, processing inefficiencies, data loss or the loss of or damage to intellectual property or other proprietary information.

The successful assertion of one or more large claims against us that exceeds our available insurance coverage, or results in changes to our insurance policies (including premium increases or the imposition of a large deductible or co-insurance requirements), could have an adverse effect on our business.

We are currently subject to, and may in the future become subject to additional, U.S. federal and state and international laws and regulations imposing obligations on how we collect, store and process personal information.

The secure processing, storage, maintenance, and transmission of sensitive personal information is vital to our operations and business. We are, and may increasingly become, subject to various laws and regulations, as well as contractual obligations, governing the collection, use, disclosure, retention, and security of personal information in the jurisdictions in which we operate. The regulatory environment related to data privacy and security is increasingly rigorous, with new and constantly changing requirements applicable to our business, and enforcement practices are likely to remain uncertain for the foreseeable future. These laws and regulations may be interpreted and applied differently over time and from jurisdiction to jurisdiction, and it is possible that they will be interpreted and applied in ways that may have a material adverse effect on our business, financial condition, results of operations and prospects.

In the United States, various federal and state regulators, including governmental agencies like the Federal Trade Commission, have adopted, or are considering adopting, laws and regulations concerning personal information and data security. Certain state laws may be more stringent or broader in scope, or offer greater individual rights, with respect to personal information than federal, international, or other state laws, and such laws may differ from each other, all of which may complicate compliance efforts. Additional compliance investment and potential business process changes may also be required. Similar laws have been passed in other states, and are continuing to be proposed at the state and federal level, reflecting a trend toward more stringent privacy legislation in the United States. These and future laws and regulations may increase our compliance costs and potential liability.

Table of Contents

The Health Insurance Portability and Accountability Act of 1996, and regulations promulgated thereunder (“HIPAA”) imposes privacy, security and breach notification obligations on certain healthcare providers, health plans and healthcare clearinghouses, known as covered entities, as well as their business associates that perform certain services that involve creating, receiving, maintaining or transmitting individually identifiable health information for or on behalf of such covered entities, and their covered subcontractors. Among other requirements, HIPAA requires business associates to develop and maintain policies with respect to the protection of, use and disclosure of protected health information (“PHI”), including the adoption of administrative, physical and technical safeguards to protect such information, certain notification requirements in the event of a breach of unsecured PHI, and requirements to report breaches of unsecured PHI to covered entities within 60 days of discovery of the breach by the business associate or its agents. Depending on the facts and circumstances, we could be subject to significant civil, criminal and administrative fines and penalties and/or additional reporting and oversight obligations if found to be in violation of HIPAA.

Foreign data protection laws may also apply to health-related and other personal data that we process, including personal data relating to clinical trial participants. European data protection laws impose strict obligations on the ability to process health-related and other personal data of data subjects in Europe, including standards relating to the privacy and security of personal data. For example, in Europe, the European Union General Data Protection Regulation, or the “EU GDPR”, and in the United Kingdom, the United Kingdom General Data Protection Regulation and Data Protection Act 2018, or the “UK GDPR” (together with the EU GDPR, referred to as the “GDPR”) imposes strict requirements for processing the personal data of individuals within the European Economic Area, or the EEA, or in the context of our activities within the EEA. In addition to fines, a breach of the GDPR may result in regulatory investigations, reputational damage, orders to cease/ change our data processing activities, enforcement notices, assessment notices (for a compulsory audit) and/ or civil claims (including class actions). Among other requirements, the GDPR regulates transfers of personal data subject to the GDPR to third countries that have not been found to provide adequate protection to such personal data, including the United States, and the efficacy and longevity of current transfer mechanisms between the EEA and the United States remains uncertain. Case law from the Court of Justice of the European Union (“CJEU”) states that reliance on the standard contractual clauses – a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism – alone may not necessarily be sufficient in all circumstances and that transfers must be assessed on a case-by-case basis.

On July 10, 2023, the European Commission adopted its Adequacy Decision in relation to the new EU-US Data Privacy Framework (“DPF”), rendering the DPF effective as a GDPR transfer mechanism to U.S. entities self-certified under the DPF. In relation to such cross border transfers of personal data, we expect the existing legal complexity and uncertainty regarding international personal data transfers to continue, and international transfers to the United States, China, and to other jurisdictions more generally to continue to be subject to enhanced scrutiny by regulators. As the regulatory guidance and enforcement landscape in relation to data transfers continue to develop, we could suffer additional costs, complaints and/or regulatory investigations or fines; we may have to stop using certain tools and vendors and make other operational changes; we may have to implement alternative data transfer mechanisms under the GDPR and/ or take additional compliance and operational measures; and/or it could otherwise affect the manner in which we operate our business, and could adversely affect our business, operations and financial condition.

Although we work to comply with applicable laws, regulations and standards, our contractual obligations and other legal obligations, these requirements are evolving and may be modified, interpreted and applied in an inconsistent manner from one jurisdiction to another, and may conflict with one another or other legal obligations with which we must comply. Any failure or perceived failure by us or our employees, representatives, contractors, consultants, collaborators, or other third parties to comply with such requirements or adequately address privacy and security concerns, even if unfounded, could result in additional cost and liability to us, damage our reputation, and adversely affect our business and results of operations.

Risks Related to Ownership of Our Common Stock

The trading price of the shares of our common stock is likely to be volatile, and purchasers of our common stock could incur substantial losses.

In addition, the stock market in general and the market for pharmaceutical companies, in particular, have experienced extreme volatility that has often been unrelated to the operating performance of particular companies. As a result of this volatility, investors may not be able to sell their common stock at or above the price paid for the shares. The market price for our common stock may be influenced by many factors, including:

•actual or anticipated variations in our operating results;

Table of Contents

•changes in financial estimates by us or by any securities analysts who might cover our stock;

•conditions or trends in our industry, including without limitation changes in the structure of healthcare payment systems;

•stock market price and volume fluctuations of comparable companies;

•announcements by us or our competitors of significant acquisitions, strategic partnerships or divestitures;

•announcements of investigations or regulatory scrutiny of our operations or lawsuits filed against us;

•adverse regulatory announcements or determinations regarding our product candidates;

•capital commitments;

•investors’ general perception of us and our business;

•global macroeconomic conditions, including inflation, tariffs, labor shortages, supply chain shortages, or other economic, political or legal changes, uncertainties or adverse developments;

•political unrest, terrorism and wars, such as the current situation with Ukraine and Russia or Israel and Hamas;

•other events or factors, including those resulting from system failures and disruptions, earthquakes, hurricanes, other natural disasters, pandemics, or responses to these events;

•recruitment, retention, or departure of key personnel; and

•sales of our common stock, including sales by our directors and officers or specific stockholders.

Many of the factors described above are not within our control and we cannot guarantee that future instances of these influencing factors will not have effects on the trading price of our common stock.

These provisions may also prevent or frustrate attempts by our stockholders to replace or remove members of our board of directors or our management. Therefore, these provisions could adversely affect the price of our stock. Our corporate governance documents include provisions:

•establishing a classified board of directors with staggered three-year terms so that not all members of our board of directors are elected at one time;

•providing that directors may be removed by stockholders only for cause;

•preventing the ability of our stockholders to call and bring business before special meetings and to take action by written consent in lieu of a meeting;

•requiring advance notice of stockholder proposals for business to be conducted at meetings of our stockholders and for nominations of candidates for election to our board of directors;

•permitting the board of directors to issue up to 10,000,000 shares of preferred stock with any rights, preferences and privileges they may designate;

•limiting the liability of, and providing indemnification to, our directors and officers;

•providing that vacancies may be filled by remaining directors;

Table of Contents

•preventing cumulative voting; and

•providing for a supermajority requirement to amend our amended and restated bylaws.

For example, if we enter into a merger, an asset sale or any other change of control transaction, then Aquestive will be entitled to a royalty equal to 10% of the price being paid to us and our stockholders in such transaction which is attributable to the value of AZSTARYS or KP1077.

Any provision of our amended and restated certificate of incorporation, amended and restated bylaws or Delaware law or any term of our contracts that has the effect of discouraging, delaying or preventing a change in control could limit the opportunity for our stockholders to receive a premium for their shares of our common stock and could also affect the price that some investors are willing to pay for our common stock.

Our board of directors and management team strive to maintain constructive, ongoing communications with all stockholders who wish to speak with us, including activist stockholders, and welcome their views and opinions with the goal of working together constructively to enhance value for all stockholders. Activist stockholder activities may also cause significant fluctuations in our stock price based on temporary or speculative market perceptions, or other factors that do not necessarily reflect the fundamental underlying value of our business.

We have not declared or paid cash dividends on our common stock to date. We currently intend to retain our future earnings, if any, to fund the development and growth of our business. As a result, capital appreciation, if any, of our common stock will be your sole source of gain for the foreseeable future.

ITEM 1B. UNRESOLVED STAFF COMMENTS

Not applicable.

ITEM 1C. CYBERSECURITY

Cybersecurity Risk Management and Strategy

We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (“NIST CSF”). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

Table of Contents

Key elements of our cybersecurity risk management program include but are not limited to the following:

•risk assessments designed to help identify material risks from cybersecurity threats to our critical systems, and information;

•a security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents;

•the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes;

•cybersecurity awareness training of our employees, including incident response personnel, and senior management;

•a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and

•a third-party risk management process for key service providers, based on our assessment of their criticality to our operations and respective risk profile.

For more information, see “Cybersecurity breaches, loss of data and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation.” in the “Risk Factors” section above.

Cybersecurity Governance

Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (“Committee”) oversight of cybersecurity risks, including oversight of management’s implementation of our cybersecurity risk management program. The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, where it deems appropriate, regarding any cybersecurity incidents it considers to be significant or potentially significant.

The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our internal security staff or external experts as part of the Board’s continuing education on topics that impact public companies. Our management team, including our Chief Legal Officer, Secretary and Compliance Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team includes IT staff such as a Director of IT with more than 22 years of IT-related experience in various roles including managing information security, managing privacy and data protection, evaluating cybersecurity risks, developing cybersecurity strategy, and implementing cybersecurity programs, as well as a dedicated Information Security Manager, responsible for operational IT security initiatives.

Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.

In addition, our management team periodically evaluates and tests the effectiveness of our cybersecurity controls and incident response capabilities through internal reviews and, where appropriate, engagement of external specialists. These efforts may include security assessments, penetration testing, resilience and recovery exercises, and employee awareness initiatives designed to enhance preparedness against evolving threats, including ransomware and social engineering.

Recently Filed

Click on a ticker to see risk factors

Ticker *	File Date
RBB	47 minutes ago
TETEF	52 minutes ago
CHGG	55 minutes ago
SABS	an hour ago
TREE	an hour ago
CHRS	an hour ago
ACIC	an hour ago
EDIT	an hour ago
AMPY	an hour ago
GLRE	an hour ago
NL	an hour ago
FSP	an hour ago
OYSE	an hour ago
OWLT	an hour ago
RAIL	an hour ago
SVCC	an hour ago
HTBK	an hour ago
FIGX	an hour ago
OSUR	an hour ago
ACCO	an hour ago
NPWR	an hour ago
ZVRA	an hour ago
MYO	2 hours ago
CRBP	2 hours ago
RBOT	2 hours ago
RPAY	2 hours ago
SEPN	2 hours ago
KRO	2 hours ago
MGNX	2 hours ago
DSGN	2 hours ago
EGBN	2 hours ago
FISI	2 hours ago
BOX	2 hours ago
CTM	2 hours ago
ALXO	2 hours ago
DDD	2 hours ago
TIPT	2 hours ago
VYGR	2 hours ago
EBMT	2 hours ago
BCBP	4 hours ago
BETA	8 hours ago
CRCL	9 hours ago
DY	10 hours ago
GBTG	10 hours ago
SPRB	10 hours ago
DNTH	10 hours ago
BOLD	11 hours ago
RNAC	11 hours ago
CCRN	11 hours ago
MASS	12 hours ago

OTHER DATASETS

House Trading

Dashboard

Corporate Flights

Dashboard

App Ratings

Dashboard

Strategies

Alerts

Browse Data

Risk Factors Dashboard

View risk factors by ticker

Search filings by term

Risk Factors - ZVRA

-New additions in green
-Changes in blue
-Hover to see similar sentence in last filing

Recently Filed

OTHER DATASETS

House Trading

Corporate Flights

App Ratings

TRADE SMARTER

TRADE SMARTER

Strategies

Alerts

Browse Data

Risk Factors Dashboard

View risk factors by ticker

Search filings by term

Risk Factors - ZVRA

-New additions in green-Changes in blue-Hover to see similar sentence in last filing

Recently Filed

OTHER DATASETS

House Trading

Corporate Flights

App Ratings

TRADE SMARTER

TRADE SMARTER

-New additions in green
-Changes in blue
-Hover to see similar sentence in last filing