cert-20231231

Table of Contents

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

__________________________________

FORM 10-K

__________________________________

(Mark One)

For the fiscal year ended December 31, 2023

For the transition period from _____to _____

Commission File Number: 001-39799

__________________________________

Certara, Inc.

(Exact Name of Registrant as Specified in Its Charter)

__________________________________

100 Overlook Center, Suite 101Princeton, New Jersey 08540

(Address of principal executive offices) (Zip Code)

Registrant’s telephone number, including area code: (609) 716-7900

Securities registered pursuant to Section 12(b) of the Act:

Title of each class Trading Symbol Name of each exchangeon which registered

Common stock, par value $0.01 per share CERT The Nasdaq Stock Market LLC

Securities registered pursuant to Section 12(g) of the Act: None

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act.

Yes oNox

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act.

Yes oNox

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yesx No o

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§ 232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). Yesx No o

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company,” and “emerging growth company” in Rule 12b-2 of the Exchange Act.

Large accelerated filer x Accelerated filer o

Non-accelerated filer o Smaller reporting company o

Emerging growth company o

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. o

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. x

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements. o

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officers during the relevant recovery period pursuant to §240.10D-1(b). o

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act). Yes o No x

The aggregate market value of the registrant’s outstanding voting common stock held by non-affiliates on June 30, 2023, determined using the per share closing price on that date on The Nasdaq Global Select Market, was $2.2 billion. There is no non-voting common equity of the registrant outstanding. Shares held by each executive officer and director and by each other person or entity deemed to be an affiliate have been excluded in such calculation. The determination of affiliate status is not necessarily a conclusive determination for other purposes.

As of February 15, 2024, the registrant had 159,855,345 shares of common stock, par value $0.01 per share, outstanding.

DOCUMENTS INCORPORATED BY REFERENCE

Portions of the proxy statement for the registrant’s 2023 Annual Meeting of Stockholders to be held May 23, 2023, which will be filed with the Securities and Exchange Commission within 120 days after the end of the 2023 fiscal year, are incorporated by reference in Part III of this Annual Report on Form 10-K.

Table of Contents

Page

PART I

Item 1. Business 7

Item 1A. Risk Factors 19

Item 1B. Unresolved Staff Comments 47

Item 1C. Cybersecurity 47

Item 2. Properties 49

Item 3. Legal Proceedings 49

Item 4. Mine Safety Disclosures 49

PART II

Item 6. [Reserved] 51

Item 7A. Quantitative and Qualitative Disclosures About Market Risk 79

Item 8. Financial Statements and Supplementary Data 82

Item 9A. Controls and Procedures 129

Item 9B. Other Information 129

Item 9C. Disclosure Regarding Foreign Jurisdictions that Prevent Inspections 130

PART III

Item 10. Directors, Executive Officers and Corporate Governance 131

Item 11. Executive Compensation 131

Item 14. Principal Accounting Fees and Services 131

PART IV

Item 15. Exhibits, Financial Statement Schedules 132

Table of Contents

Certara, Inc.

Unless otherwise indicated, references to the “Company,” “Certara,” “we,” “us” and “our” refer to Certara, Inc. and its consolidated subsidiaries.

SPECIAL NOTE REGARDING FORWARD-LOOKING STATEMENTS

This Annual Report on Form 10-K (this “Annual Report”) contains “forward-looking statements” within the meaning of Section 27A of the Securities Act of 1933, as amended (the “Securities Act”), and Section 21E of the Securities Exchange Act of 1934, as amended (the “Exchange Act”), which are subject to the “safe harbor” created by those sections. All statements (other than statements of historical facts) in this Annual Report regarding the prospects of the industry and our prospects, plans, financial position and business strategy may constitute forward-looking statements. In addition, forward-looking statements generally can be identified by the use of forward-looking terminology such as “may,” “should,” “expect,” “might,” “intend,” “will,” “estimate,” “anticipate,” “plan,” “believe,” “predict,” “potential,” “continue,” “suggest,” “project” or “target” or the negatives of these terms or variations of them or similar terminology. Although we believe that the expectations reflected in these forward-looking statements are reasonable, we cannot provide any assurance that these expectations will prove to be correct. Such statements reflect the current views of our management with respect to our operations, results of operations and future financial performance. The following factors are among those that may cause actual results to differ materially from the forward-looking statements:

•any deceleration in, or resistance to, the acceptance of model-informed biopharmaceutical discovery and development;

•our ability to compete within our market;

•changes or delays in government regulation relating to the biopharmaceutical industry;

•trends in research and development (“R&D”) spending, the use of third parties by biopharmaceutical companies and a shift toward more R&D occurring at smaller biotechnology companies;

•consolidation within the biopharmaceutical industry;

•pricing pressures due to increased customer utilization of our products;

•our ability to successfully enter new markets, increase our customer base and expand our relationships with existing customers;

•our ability to retain key personnel or recruit additional qualified personnel;

•risks related to the mischaracterization of our independent contractors;

•any delays or defects in our release of new or enhanced software or other biosimulation tools;

•issues relating to the use of artificial intelligence and machine learning in our products and services;

•failure of our existing customers to renew their software licenses or any delays or terminations of contracts or reductions in scope of work by our existing customers;

•risks related to our contracts with government customers, including the ability of third parties to challenge our receipt of such contracts;

•our ability to sustain recent growth rates;

Table of Contents

•increasing competition, regulation and other cost pressures within the pharmaceutical and biotechnology industries;

•any future acquisitions and our ability to successfully integrate such acquisitions;

•the accuracy of our addressable market estimates;

•our ability to successfully operate a global business;

•our ability to comply with applicable anti-corruption, trade compliance and economic sanctions laws and regulations;

•risks related to litigation against us;

•the adequacy of our insurance coverage and our ability to obtain adequate insurance coverage in the future;

•our ability to perform our services in accordance with contractual requirements, regulatory standards and ethical considerations;

•the loss of more than one of our major customers;

•our future capital needs;

•the ability or inability of our bookings to accurately predict our future revenue and our ability to realize the anticipated revenue reflected in our bookings;

•the occurrence of natural disasters, pandemics, epidemic diseases, and public health crises, which may result in delays or cancellations of customer contracts or decreased utilization by our employees;

•any disruption in the operations of the third-party providers who host our software solutions or any limitations on their capacity or interference with our use;

•our ability to reliably meet our data storage and management requirements, or the experience of any failures or interruptions in the delivery of our services over the internet;

•our ability to comply with the terms of any licenses governing our use of third-party open source software utilized in our software solutions;

•any unauthorized access to or use of customer or other proprietary or confidential data or other breach of our cybersecurity measures;

•our ability to comply with applicable privacy and cybersecurity laws;

•our ability to adequately enforce or defend our ownership and use of our intellectual property and other proprietary rights;

•any allegations that we are infringing, misappropriating or otherwise violating a third party’s intellectual property rights;

•our ability to meet the obligations under our current or future indebtedness as they become due and have sufficient capital to operate our business and react to changes in the economy or industry;

•any limitations on our ability to pursue our business strategies due to restrictions under our current or future indebtedness or inability to comply with any restrictions under such indebtedness;

•any impairment of goodwill or other intangible assets;

•our ability to use our net operating loss (“NOLs”) and R&D tax credit carryforwards to offset future taxable income;

Table of Contents

•the accuracy of our estimates and judgments relating to our critical accounting policies and any changes in financial reporting standards or interpretations;

•any inability to design, implement, and maintain effective internal controls when required by law, or inability to timely remediate internal controls that are deemed ineffective; and

•the other factors discussed under “Risk Factors.”

You should not rely upon forward-looking statements as predictions of future events. The forward-looking statements in this Annual Report are based on our beliefs, assumptions and expectations of future performance, taking into account the information currently available to us. These statements are only predictions based upon our current expectations and projections about future events. There are important factors, including those described in the section titled “Risk Factors” and elsewhere in this Annual Report, that could cause our actual results, level of activity, performance or achievements to differ materially from the results, level of activity, performance or achievements expressed or implied by the forward-looking statements. Other sections of this Annual Report may include additional factors that could adversely impact our business and financial performance. Moreover, we operate in a very competitive and rapidly changing environment. New risks emerge from time to time and it is not possible for our management to predict all risks, nor can we assess the impact of all factors on our business or the extent to which any factor, or combination of factors, may cause actual results to differ materially from those contained in any forward-looking statements we may make in this Annual Report. Before investing in our common stock, investors should be aware that the occurrence of the events described under the caption “Risk Factors” and elsewhere in this Annual Report could have a material adverse effect on our business, results of operations and financial condition.

Although we believe that the expectations reflected in the forward-looking statements are reasonable, we cannot guarantee that the future results, levels of activity, performance and events and circumstances reflected in the forward-looking statements will be achieved or occur. For a more detailed discussion of the risks, uncertainties and other factors that could cause actual results to differ, please refer to the “Risk Factors” in this Annual Report, as such risk factors may be updated from time to time in our periodic filings with the U.S. Securities and Exchange Commission (the “SEC”). Our periodic filings are accessible on the SEC’s website at www.sec.gov.

The forward-looking statements made in this Annual Report relate only to events as of the date on which the statements are made. Except as required by law, we undertake no obligation to update publicly any forward-looking statements for any reason after the date of this Annual Report to conform these statements to actual results or to changes in our expectations.

In addition, statements that “we believe” and similar statements reflect our beliefs and opinions on the relevant subject. These statements are based upon information available to us as of the date of this Annual Report, and while we believe such information forms a reasonable basis for such statements, such information may be limited or incomplete, and our statements should not be read to indicate that we have conducted an exhaustive inquiry into, or review of, all potentially available relevant information. These statements are inherently uncertain and investors are cautioned not to unduly rely upon these statements.

Channels for Disclosure of Information

Investors and others should note that we may announce material information to the public through filings with the SEC, our Investors Relations website (https://ir.certara.com), press releases, public conference calls and public webcasts. We use these channels to communicate with the public about us, our products, our services and other matters. We encourage our investors, the media and others to review the information disclosed through such channels as such information could be deemed to be material information. The information on such channels, including on our website, is not incorporated by reference in this Annual Report and shall not be

Table of Contents

deemed to be incorporated by reference into any other filing under the Securities Act or the Exchange Act, except as expressly set forth by specific reference in such a filing. Please note that this list of disclosure channels may be updated from time to time.

Statistical and Other Industry and Market Data

This Annual Report includes statistical and other industry and market data that we obtained from industry publications and research, surveys and studies conducted by third parties. Industry publications and third-party research, surveys and studies generally indicate that their information has been obtained from sources believed to be reliable, although they do not guarantee the accuracy or completeness of such information. We have not independently verified the information contained in such sources.

Table of Contents

PART I

Item 1. Business.

Our Company

We are a leading provider of biosimulation technology and solutions for using Model-Informed Drug Development ("MIDD") in the global biopharmaceutical industry. MIDD is an approach that utilizes biological and statistical models derived from preclinical and clinical data to inform decision-making in drug development and commercialization. Biosimulation is a critical component of MIDD that uses computer-aided mathematical simulation of biological processes and systems to understand the action of a drug in a human body or a population of humans.

Biosimulation and MIDD can increase the probability of success in bringing a new drug to market and decrease the costs of drug development. There are many successful examples of currently approved drugs where models were used in first-in-human dose predictions, clinical trial design, and for drug interaction label claims. Biosimulation is also used to support drug development beyond the approval stage; examples include determining formulation or manufacturing changes and label extensions. In addition, MIDD strategies are increasingly utilized to help predict commercial success, a critical part of the drug development process as new products must be both approved by regulators and adopted by the market.

The diagram below shows the different areas of expertise that come together to enable MIDD. Our organization has been purposefully designed to include all of these capabilities to collectively enable a new model of drug development for our clients.

Table of Contents

Our goal is to enable the life science industry to use data, modeling, and analytics to make better decisions during drug development and commercialization to increase productivity rates and vastly reduce development costs. The pharmaceutical industry spends more than $260 billion annually on research and development. On average, it takes 10-15 years and costs $6.2 billion to develop one new medicine, including the cost of failures. Drug development is necessarily a highly regulated process involving the collection of vast amounts of laboratory, clinical and evidence data, and there are many failures at every step along the way that add to total cost. Our software and scientists incorporate modern advances in scientific understanding, drug development experience, data analysis, and artificial intelligence resulting in significant opportunities to decrease the cost and increase the odds of new drug approval and commercial success.

Our proprietary biosimulation platforms are built on biology, chemistry, and pharmacology principles with proprietary mathematical algorithms that model how medicines and diseases behave in the body. For over two decades, our scientists have developed and validated our biosimulation technology using data from scientific literature, laboratory research, preclinical and clinical studies. To do this, we have developed solutions for the collection, standardization, validation, storage, and analysis of the preclinical and clinical data needed for MIDD. These data solutions are used internally and by global life sciences companies.

The scientific principles underlying our work with customers in biosimulation and MIDD must be transparent and fully explainable during the regulatory process, so we have become experts at incorporating data and results into regulatory documents. Our software and regulatory services streamline the creation of regulatory filings and speed regulatory data flow to maximize the chances of successful commercialization.

Artificial intelligence (AI) and machine learning technologies are being incorporated across our software and services portfolios providing opportunities to expand the number of data sources utilized, better predict outcomes, and streamline reporting. For example, we are using machine learning to automate and speed the process of biosimulation, and we have created an AI application to aid creating regulatory documents from scientific analyses and clinical data. We believe that AI predictive models will continue to enhance the accuracy and usefulness of biosimulation models and be utilized broadly across drug development.

We deliver software and technology-enabled services. Our strategy is to create and apply validated software applications that can be used broadly in the life science industry. We offer services, leveraging our technology, delivered by scientists with extensive drug development experience to aid our customers in applying biosimulation and MIDD to their specific projects.

Since 2014, customers who leverage our solutions have received more than 90% of all new drug approvals by the US Food and Drug Administration ("FDA"). We have worked with nearly 2,400 life sciences companies and academic institutions and have collaborated on more than 8,000 customer projects in the last decade across a wide variety of therapeutic areas ranging from cancer and hematology to diabetes and hundreds of rare diseases. Our software products are licensed by more than 57,000 users and are also used by 23 global drug regulatory agencies, including the FDA, Japan’s Pharmaceuticals and Medical Devices Agency (“PMDA”), and China Food and Drug Administration ("cFDA").

Our Solutions

We offer differentiated and comprehensive solutions for MIDD, which include software and technology-enabled services. Customers use our solutions to implement MIDD with the aim of improving certainty, accuracy, commercial success and the speed decisions are made during the drug development process.

Life sciences companies make many decisions during the MIDD process that have regulatory considerations. We help support these decisions with comprehensive regulatory science solutions that include technology platforms along with regulatory submission and regulatory writing expertise. In addition, recognizing that time

Table of Contents

to approval is one of the most valuable components of the drug development journey, we designed our regulatory solutions to accelerate the regulatory writing and filing process.

By offering solutions including both software and services, we provide flexible offerings for life sciences companies of all sizes and requirements. Services are complemented by scientific and regulatory expertise to conduct and interpret biosimulation results and make recommendations on the next best action to take to move a program forward. In 2023, we extended the capabilities of MIDD and regulatory offerings with the launch of an AI platform designed for life sciences, Certara.AI. It is a secure, flexible platform for deploying life science specific Generative Pre-Trained Transformers ("GPTs") across an organization’s data, enabling faster search, connectivity, and content generation.

Our Biosimulation Solutions

Our biosimulation solutions are designed to predict both pharmacokinetics (how the body interacts with drugs) and pharmacodynamics (how a drug affects the body). We offer both mechanistic and empirical biosimulation solutions providing clients with a comprehensive offering based on their therapy goals, mechanism of action, and available data sources. Mechanistic biosimulation models are built by experts using known scientific principles and facts, while empirical biosimulation solutions are typically statistical models built using preclinical and clinical data. Our customers use biosimulation results to improve the design of clinical trials, reduce trial size and complexity, and in some cases obtain clinical trial waivers to replace clinical testing.

Simcyp Simulator

The Simcyp Simulator is a mechanistic biosimulation platform for physiologically-based pharmacokinetic ("PBPK") simulation. It is frequently utilized for determining first-in-human dosing, optimizing clinical study design, evaluating new drug formulations, setting the dose in untested populations, performing virtual bioequivalence analyses, and predicting drug-drug interactions ("DDIs"). The Simcyp Simulator has been applied to small molecules, biologics, antibody-drug conjugates ("ADCs"), generics, and new modality drugs. Simcyp was started over 20 years ago and has been expanded each year with extensions and additions to its biosimulation models and is designed to produce “regulatory quality” results that customers can use in their drug approval applications. The Simcyp Simulator family includes various add-on modules, as well as products focused on specific aspects of drug development that can benefit from its mechanistic simulation approach. The major Simcyp products are described below.

•Simcyp Discovery – Targeted to scientists working on pre-Investigational New Drug ("IND") and translational stages.

•Simcyp Biopharmaceutics – Tailored for formulation scientists, who use it to identify and refine promising drug formulations in a cost-effective manner.

•Simcyp Secondary Intelligence - Integrates toxicology with quantitative analysis of large networks of molecular and functional biological changes to identify drug toxicity and adverse drug reactions earlier.

Empirical Biosimulation Software Platform

In addition to mechanistic modeling, MIDD requires empirical statistical modeling to account for all the data available on a drug including population variability. We have a large group of pharmacometrics scientists, who use clinical and preclinical data to quantify the impact of drugs on diseases and predict clinical efficacy and safety outcomes across various patient populations. These analyses are utilized to support the design of clinical trials and other drug development and/or regulatory decisions and are generally expected by regulators to support the justification of approved dosage regimens.

Table of Contents

According to the FDA, “the single-most important strength of such analyses is its ability to integrate knowledge across the development program and compounds, and biology.” We integrate drug development knowledge by providing customers with a powerful combination of scientific expertise, bringing experts with experience in thousands of projects across the industry, together with our industry-standard software applications.

Our PhoenixTM PK/PD suite is the life sciences industry’s premier software for managing, analyzing and reporting pharmacokinetic ("PK"), pharmacodynamic ("PD"), and toxicokinetic ("TK") data. Phoenix has four modules that support pharmacometrics and workflow.

•Phoenix WinNonlin – A platform for non-compartmental analysis ("NCA"), pharmacokinetic/pharmacodynamic ("PK/PD"), and toxicokinetic ("TK") modeling with a proven 30-year history and extensive use across the biopharmaceutics industry.

•Phoenix Hosted – A hosted (i.e. online) version of Phoenix, which provides a secured and validated Certara Amazon Web Services("AWS") workspace allowing for much quicker transit time from compliant data sources. It enhances productivity and supports compliance requirements by managing complex time-based drug data, the foundation for all PK/PD modeling.

•Phoenix NLME - A population modeling and simulation software for nonlinear mixed effects ("NLME") models, a type of pharmacometric model often used by pharmacometricians to model absorption effects.

•Pirana Modeling Workbench - A workbench provides modelers with a structure to facilitate the iterative processes used to create population PK/PD models and perform simulations using AI and machine learning resulting in more efficient analysis

Preclinical & Clinical Data Pipeline and Automation Suite

Our data suite allows customers to efficiently standardize preclinical and clinical data during the drug development process, utilize that data to support MIDD, and efficiently submit it to regulatory authorities for approval. Our customers typically collect large quantities of data from many sources during the drug development process, and our products allow them to reduce the cost of creating scientifically valid and analyzable data sets, speeding time to scientific insights and enabling better and faster decisions. The Certara suite of applications replace costly manual processes in which pharmaceutical companies collect laboratory and clinical data from many sources, standardize, validate, analyze the data, and include it in reporting and downstream systems. Our principal clinical data suite is the Pinnacle 21 family of products.

•Pinnacle 21 ("P21") - A cloud-based platform for clinical data automation, standardization, and validation with industry standards. Pinnacle 21 is widely utilized across the pharmaceutical industry and by its regulators to validate that clinical data meets the required standards for regulatory submittal. We supports two versions of Pinnacle 21- a fully featured enterprise version, which contains workflow and reporting tools needed by large-scale drug development customers, and a basic free community version designed for small organizations who want to try the software.

•Pinnacle 21 Data Exchange - Allows sponsors and data providers to define data standards and specifications (metadata) and ensure that data adheres to these specifications to make the process of acquiring external data from laboratory and clinical sources more efficient and predictable during the drug development process.

•Metadata Repository – A cloud-based Clinical Metadata Repository & Study Data Tabulation Model ("SDTM") automation suite to enable faster study design using controlled and standardized data.

Table of Contents

Regulatory Science

•CoAuthor – Structured and Assisted Content Authoring with Generative AI - Approval for a new drug or biologic requires expert development of numerous regulatory documents, which is a time intensive process often requiring inputs from a variety of data sources and types. CoAuthor by Certara powers efficient and expedited creation of regulatory documents and medical communications. Combining data integration, structured content authoring, and AI, CoAuthor enables writers to create and assemble regulatory submissions and medical publications faster and with confidence in the quality of their results.

•Global Submit eCTD Submissions Management - The Electronic Common Technical Document ("eCTD") is a standard format required for submitting applications to regulatory authorities. Our GlobalSubmitTM eCTD submissions management software provides regulatory teams with the tools they need to efficiently publish, validate, and review eCTD submissions.

Scientific Informatics for Discovery

Certara D360 – D360TM is a scientific informatics system for small molecule and biologics discovery research. It provides researchers with self-service data access, integrated data visualizations, analysis and collaboration tools for prioritization, development of Structure Activity Relationship ("SAR") and many other scientific data workflows to improve the effectiveness of data-driven research. In 2023, D360 incorporated AI enabled capabilities including advanced deep learning analytics for automated property predictions. The D360 AI capabilities are based on the advanced data fabric connectivity and predictive deep learning capabilities of the Certara.AI platform.

Technology Enabled Services

In addition to core software platforms, our scientists utilize our software to offer a broad range of technology-enabled services to help clients interpret biosimulation results, increase scientific insights related to the therapy, streamline drug submission and approval, and support the overall drug development process. We also provide the drug development expertise needed to ensure quality study execution and oversight along with preparation of commercialization plans and the evidence generation needed to ensure product launch success post approval.

Quantitative Systems Pharmacology ("QSP")

One of the most scientifically exciting areas of biosimulation is QSP, an approach which combines computational modeling and experimental data to examine the relationships between a drug, the biological system, and the disease process. With the 2023 acquisition of Applied Biomath, we boast one of the largest QSP teams of experts in the pharmaceutical industry. The insights delivered by our QSP team help answer critical questions about novel therapies required for development progression, including “which drug candidate is optimal” and “which patient populations are most likely to respond.” Our QSP team works with our QSP technology platform and Certara.AI to deliver a comprehensive solution.

We have differentiated our approach to QSP by building robust, regulatory-ready software platforms for reproducible model development as part of its offering. Currently, QSP platforms are available for immunogenicity, immuno-oncology, and soon, neurodegenerative diseases. This unique approach has been shared with US, European Union ("EU"), and Japanese regulators, all committed to advancing the use of QSP in drug discovery, development, and regulatory review.

Drug Development and Regulatory Strategy: Our experts develop and deliver drug development and regulatory plans and provide high-level regulatory input to customer projects, incorporating biosimulation and supporting decision making through critical development and investment stage gates.

Table of Contents

Pharmacometrics: Pharmacometrics uses mathematical and statistical models to quantify drug, disease, and trial information to help address these decisions. The data used to build pharmacometrics models comes from both internal preclinical and clinical data as well as external data on competitor drugs.

Data Science: As the volume, variety, and velocity of data available in research has grown rapidly, so has the complexity of collecting, analyzing, and publishing data. Certara offers biometrics and data sciences services to help clients analyze and standardize data for faster time to insight and for submission readiness, in addition to preparing and transforming data for use in biosimulation and pharmacometrics models.

Clinical Pharmacology: Certara has numerous industry leaders and experts that guide drug developers in clinical pharmacology decisions. They provide early-phase development plans and study designs across the development life cycle, often incorporating biosimulation along with regulatory support.

Regulatory Science: Certara provides expert services for regulatory submissions from early-stage INDs, new drug applications ("NDAs"), and MAAs that require CMC (Chemistry, Manufacturing, and Controls), nonclinical, and clinical expertise. Submission programs require the coordinated technology-enabled expertise that Certara regulatory writing solutions offers delivering quality and speed at scale.

Regulatory Operations: We manage the submission of regulatory documents using the GlobalSubmit platform. Submission management services include submission leadership, program management and planning, due diligence and readiness preparation, submission compilation, and eCTD publishing using Global Submit. Certara supports applications to all major health agencies, including the FDA, Europe’s European Medicines Agency ("EMA"), Health Canada, Japan’s PMDA, and China’s NMPA.

Our Markets

Our addressable market within the biopharmaceutical industry is large and rapidly expanding. Our core biosimulation market is estimated at $3.4 billion for 2023 and growing at 17% annually by Grand View Research. We also have solutions in the regulatory science market, which is estimated at $7.6 billion for 2023 and growing at 8% annually. Finally, many of our solutions directly or indirectly are used in market access which is estimated at $1.4 billion for 2023 and growing at 12% annually. With increasing adoption of technology across all stages of drug discovery and development, we believe our end-to-end platform and growth strategies position us to further penetrate the rapidly growing technology-driven biopharmaceutical R&D market of the future that leverages advanced modeling and analytics.

Traditional drug discovery and development is costly and prone to failure. The biopharmaceutical industry was estimated to have spent a total of approximately $262 billion in 2023 on R&D. The probability of success of compounds entering Phase I trials continues under 10%. With less than 50% of Phase III drugs reaching the market, late-stage failures are common and especially disappointing as sponsors have already incurred significant cost and time. At the same time, scientific advances are driving increased complexity as the R&D pipeline shifts from small molecules to biologics and cell and gene therapies.

With greater investment dollars being spent and increasing competition in the race to develop novel medicines, the speed and efficiency with which drugs are developed and brought to market have never been more critical. As a result, the demand for and willingness to adopt innovative approaches to discovery, development, and commercialization are rapidly increasing. Continued development and innovation in software and technology such as biosimulation, virtual trials, and real-world evidence tools are helping biopharmaceutical companies increase efficiency and decrease costs. This is further supported by regulatory agencies that have increasingly issued guidance that supports the adoption of many of these innovations. For example, the FDA announced in 2021 their Project Optimus initiative to reform the dose selection and optimization paradigm in oncology drug

Table of Contents

development to maximize both efficacy and safety. Biosimulation's use cases in dose finding and optimization are well-suited to help biopharmaceutical companies navigate this evolving regulatory landscape.

As technology and analytics become increasingly powerful along with AI and the application of new solutions is validated, we anticipate further demand for these innovations. We believe we are still in the early stages of a long-term trend that will continue to advance traditional drug discovery and development into a technology-driven era of advanced modeling, analytics, and AI enabled solutions.

Our end-to-end platform is well positioned to continue benefiting from market trends. In addition to continued growth in our core markets, we expect to capture a broader share of overall biopharmaceutical R&D spend as we continue to innovate and add new solutions, including numerous ones that are AI enabled to meet the increasingly strong demand across life sciences.

Our Growth Strategy

Our growth strategy is to build upon our platforms creating more value through increased automation and connectivity. We continue to innovate in biosimulation, develop more AI enabled offerings across our portfolio, engage with regulatory agencies, and land and expand our customer partnerships. We remain focused on reducing the cost, time, and probability of failure of clinical trials for our customers so that they can materially accelerate the availability of future therapies that are needed by patients worldwide. As exciting new research and technologies areas and opportunities arise, we continually attract and hire specialized talent and acquire complementary businesses to expand our offerings accordingly.

Advance Our Technology

The science, technology, and data behind biosimulation continue to advance rapidly, and our top investment priority is to develop additional functionality and uses for biosimulation to improve decision making and patient outcomes. We release new software, additional features, and upgrades on a frequent and regular basis. In 2023, we introduced 32 new software applications and upgrades, including Simcyp Biopharmaceutics and CoAuthor, a structured content authoring tool that utilizes Certara.AI to generate content for regulatory submissions preparation and medical writing.

Grow Within Our Existing Customer Base

As we continue to expand our portfolio of offerings, we integrate our solutions and sell more across our end-to-end platform. Our scientists and regulatory and market access experts, business developers, marketing professionals, and business leaders work together to ensure a high-quality customer experience and nurture long-term partnerships. As a result, our customer relationships grow steadily over time, driven by higher adoption of biosimulation with additional user licenses and more modules.

We also cross-sell our software and technology-enabled services throughout our end-to-end platform. Many of our customers who use biosimulation also rely on us for regulatory strategy, writing, and submissions support, including the majority of our top 50 customers. The number of customers with annual customer value of $100,000 or more in revenue increased from 370 in 2022 to 389 in 2023, a 5.1% increase. The success of our land and expand approach is further demonstrated by our high re-occurring revenue streams with an aggregate renewal rate of 88% for our software customers from 2022 to 2023 and net revenue repeat rate (defined as the level of technology-enabled services revenue generated from our existing services customers from period to period, accounting for expansion and churn) of 96% for our technology-enabled services customers from 2022 to 2023.

Expand Our Customer Base Globally

Table of Contents

We are growing our footprint globally to match that of the biopharmaceutical industry. There are more than 5,500 biopharmaceutical companies worldwide with active R&D pipelines as of January 2023, up from nearly 2,400 in 2011, according to Citeline’s Pharma R&D Annual Review 2023. Citeline also estimates that the R&D pipeline encompassed more than 21,000 drug programs in 2023. As drug discovery and development in Asia Pacific grows, we are investing to expand our presence in the region to work with these customers where they are, just as we already have in North America, Europe, China and Japan. We continue to build our sales and marketing capabilities and capacity to expand our global reach.

Scale Through Acquisitions

Biosimulation is an exciting technology with many promising future developments, and we believe there are numerous opportunities to pursue strategic acquisitions to accelerate our development roadmap. We have a proven record of successfully acquiring and integrating software and services companies. From 2013, we have acquired 20 companies of which 13 included software or technology such as Simcyp, the core of our mechanistic biosimulation platform, Pinnacle 21, which enhances our software offerings in data management and the regulatory drug approval process, and Vyasa, which brings state-of-the-art AI capabilities to our end-to-end platform. In 2023, we acquired three new businesses including Formedix, which added a metadata repository and clinical data flow automation to our data platform. Additionally, we acquired Applied Biomath, a company focused on QSP to expand and complement Certara’s existing QSP capabilities.

Inspire Our People

Our nearly 1,400 employees are the key to our success. The diversity and depth of expertise, experience, and backgrounds fuel innovation by bringing rich ideas, problem-solving capabilities, and mutual respect. We are dedicated to attracting, retaining, and growing leading scientists and experts, who are passionate about developing medicines that matter. We strive to encourage intellectual curiosity and offer a myriad of professional development opportunities to enable our colleagues to grow their skills. We continue to invest in our people to help them thrive, both personally and professionally, and solidify our position as an employer of choice with an award-winning culture in our industry.

Our Customers

Our customers include life sciences companies of all sizes along with contract research organizations, academic institutions, and global regulators. Certara software and service have been used by nearly 2,400 biopharmaceutical companies and academic institutions across 66 countries, including 38 of the top 40 biopharmaceutical companies by R&D spend in 2022. Since 2014, customers who use Certara biosimulation software and technology-enabled services have received 90% of all new drug approvals by the U.S. FDA. There are 23 global regulatory authorities that license Certara’s biosimulation software to independently analyze, verify, and review regulatory submissions, including the FDA, Health Canada, Japan’s PMDA, and the UK’s Medicines and Healthcare products Regulatory Agency (“MHRA”). In addition to life sciences, Certara serves customers in animal health, crop science, bio science, medical devices, and public sector industries.

Sales and Marketing

Our sales and marketing functions pursue a coordinated approach with a global commercial team of business development, product management, and marketing experts. Our global commercial team collaborates with our scientists, subject matter experts, and technologists to engage with customers and prospects to understand their needs and offer tailored solutions with our biosimulation software and technology-enabled services. Our scientists and experts have authored thousands of scientific publications, posters, and articles to share

Table of Contents

biosimulation knowledge and methods to advance adoption. We also partner with software distributors in global regions to expand our reach.

Competition

The market for our biosimulation products and related services for the biopharmaceutical industry is competitive and highly fragmented. The solutions offered by our competitors vary in size, capabilities and breadth. In addition to other solution providers, a significant competitor remains the status quo method of conducting research without fully leveraging modeling, simulation, AI, dataflow and analytics platforms to inform and de-risk decisions across each phase of research and development.

In our view, the principal competitive factors in our market are the functionality and quality of models, the breadth of molecular types, therapeutic areas, and modalities supported, regulator acceptance of our solutions, ease of use and functionality of applications, depth of experience in drug development, brand awareness and reputation, total cost, and the ability to securely integrate with other enterprise applications and the overall drug development process in the customer. We believe that we compete favorably based on these factors and that the time, effort, and investment necessary to develop validated models, modeling solutions, enterprise software and extensive MIDD experience presents a significant barrier to new entrants. Our ability to remain competitive depends on our ability to continue to invest in innovation as MIDD and drug development science advances.

In the biosimulation software market, we compete with other technology companies including Mathworks, Ansys, Simulations plus, and NONMEM, a division of ICON. Other competitors include open-sourced solutions such as R and PK-Sim and internally developed software from biopharmaceutical companies. We generally compete in the biosimulation software market based on the quality and capabilities of our products, our scientific and technical expertise, our ability to innovate and develop solutions attractive to customers, our regulatory agency partnerships, and price, among other factors.

Our technology-enabled services generally compete with in-house teams at biopharmaceutical companies. Additionally, we compete with other specialized service providers including Metrum Research, qPharmetra, and Pharmetheus. We compete in the technology-enabled services markets based on our reputation and experience, our scientific and regulatory expertise, our team's qualifications, and price among other factors. We believe our competitive position is strong and that we can effectively win new projects with our integrated, end-to-end platform.

Intellectual Property

We safeguard and enhance our innovative technology platforms, systems, processes, and databases with a full array of intellectual property rights, including copyrights, trade secrets, know-how, patents, and tradenames/trademarks. All our proprietary software products are copyright protected, and further reinforced by contractual provisions in our software license agreements prohibiting our users from reverse engineering, deriving, or otherwise using the source code and underlying algorithms for anything other than the permitted and intended use. Embedded within some of our biosimulation tools, including the Simcyp Simulator, are several decades’ worth of proprietary data that have been compiled and collated from both public and private sources. These data, in tandem with our proprietary source code and algorithms, create powerful modeling tools that cannot be readily duplicated. Continual ongoing development of source code and algorithms as well as new version release of modeling tools also ensures that our proprietary software products are difficult to copy. Our processes and systems are further protected by trade secrets and expertise, which we secure by requiring and strictly enforcing confidentiality obligations with our employees, contractors, customers, and other third parties, and invention assignment agreements with our employees, as well as through administrative and technical safeguards.

Table of Contents

We also maintain a portfolio of issued and pending patents in several jurisdictions in which we do business. As of December 31, 2023, our patent portfolio consists of 27 issued patents and 12 pending patent applications related to our software and technology. We do not currently consider any of our issued patents to be material to our business. We also have applied for and/or obtained and maintain registration in the United States and other countries for numerous trademarks, including Certara, Simcyp, Phoenix, Pinnacle 21, Virtual Twin, WinNonlin, Vyasa, and BaseCase. We pursue trademark registrations to the extent we believe doing so would be beneficial to our competitive position. We are not presently a party to any legal proceedings relating to intellectual property that, in the opinion of our management, would individually or taken together have a material adverse effect on our business, financial condition, results of operations or cash flows.

Human Capital

We are a globally diverse team united in our purpose to accelerate medicine to patients. Challenging the status quo, our talented team of scientists, software developers, and subject matter experts strive to understand our customers’ most difficult business challenges and apply cutting edge technology and rigorous scientific thinking to inform solutions. As of December 31, 2023, we employed 1,391 professionals in 28 countries, including 1,338 full-time employees and 53 part-time employees, of which 433 held PhD. in their respective disciplines, including clinical pharmacology and pharmacometrics. Most of the senior management team and the members of our board of directors also hold either PhDs and/or other advanced degrees. In 2023, we focused on continuing to build a robust culture and were proud to be second time recipients of the Great Place to Work award, as well as the Fortune Best Workplaces in Biopharma in the US.

Government Regulation

Regulation of Biopharmaceutical Products

The development, testing, manufacturing, labeling, approval, promotion, distribution and post-approval monitoring and reporting of biopharmaceutical products are subject to regulation by numerous governmental authorities at both the national and local levels, including the FDA in the United States, as well as those of other countries, such as the EMA in the EU and the MHRA in the United Kingdom. Although our biosimulation software products and platforms are not approved by the FDA or other government agencies, our customers’ products are subject to these regulations, which may be applicable to us to the extent that the services and deliverables we provide to our customers are used in their marketing applications. Consequently, we must comply with relevant laws and regulations relating to certain aspects of the drug and biologic development and approval process. For example, our customers may require that documents or records we produce that may be used in the approval process be compliant with part 11 of Title 21 of the U.S. Code of Federal Regulations, which relates to the creation, modification, maintenance, storage, retrieval, or transmittal of electronic records submitted to the FDA. Further, certain portions of our business, such as the biosimulation work we conduct in connection with designing clinical trials, must comply with current Good Laboratory Practices (“GLP”) and Good Clinical Practices (“GCP”) requirements as established by the International Council on Harmonisation of Technical Requirements for Registration of Pharmaceuticals for Human Use, as adopted by the FDA and similar regulatory authorities in other countries, which helps ensure the quality and integrity of the data we produce. To help ensure compliance with GLP and GCP, we have established a robust quality management system that includes standard operating procedures, working practice documents and processes, and quality assurance personnel to audit deliverables intended to be used in our customers’ drug and biologic approval applications.

Table of Contents

Privacy and Cybersecurity Laws

The collection, use, disclosure, disposal, protection, and other processing of information about individuals, in particular healthcare data, is highly regulated both in the United States, EU and other jurisdictions, including but not limited to, under the U.S. Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), as amended by the Health Information Technology for Economic and Clinical Health Act (“HITECH”) and other U.S. privacy, security and breach notification and healthcare information laws; the European Union’s General Data Protection Directive (“GDPR” and its national implementing laws) and other European privacy laws as well as privacy laws in other jurisdictions around the world. Although most of the clinical data we receive from our customers is de-identified within the meaning of HIPAA, in certain parts of our business, such as our real-world data and analytics program, we hold personal health and other information relating to persons who have been, are and may in the future be involved in clinical trials. The collection, retention, use, disclosure and other processing of such information is highly regulated, including under the laws described above. These data privacy and cybersecurity laws govern the use, handling and disclosure of information about individuals.

In relation to HIPAA, we do not consider our service offerings to generally cause us to be subject as a covered entity; however, in certain circumstances we are subject to HIPAA as a business associate. HIPAA requires the use of standard contracts (business associate agreements), notice and consent procedures and other privacy and cybersecurity standards. Accordingly, we may enter into business associate agreements with our customers who are covered entities under HIPAA. These business associate agreements define our obligations to safeguard the protected health information of patients provided by our covered-entity customers. We have adopted practices and have implemented procedures to satisfy the privacy and security rules and other practices to safeguard the receipt, maintenance and transmission of protected health information.

In addition, the Federal Trade Commission (the “FTC”) and many state attorneys general interpret federal, state and local consumer protection laws to impose evolving standards for the handling and security of personal information, including health-related information. Courts may also adopt the standards for fair information practices promulgated by the FTC, which concern consumer notice, choice, security and access. Consumer protection laws require us to publish statements that describe how we handle information about individuals and choices individuals may have about the way we handle their information.

Certain states have also adopted robust data privacy laws. For example, the California Consumer Privacy Act (“CCPA”), which became effective on January 1, 2020, as amended by the California Privacy Rights Act , which became effective on January 1, 2023, imposes obligations and restrictions on businesses regarding their collection, use, and sharing of personal information and provides new and enhanced data privacy rights to California residents, such as affording them the right to access and delete their personal information and to opt out of certain sharing of personal information. Additional privacy laws in Virginia, Connecticut, Colorado and Utah which also took effect during 2023, have similar requirements but more limited applications (i.e., only consumers and not employees or business-to-business data). The interpretation and application of the new state laws and their pending regulations are uncertain.

The processing of any personal data regarding individuals in the European Economic Area (“EEA”), including personal health data, is subject to the GDPR as of May 25, 2018. The GDPR and the UK’s post-Brexit equivalent of the GDPR (“UK GDPR”) is wide-ranging in scope and imposes numerous requirements on companies that process personal data, including requirements relating to processing health and other sensitive personal data, cross-border transfers, notice and consent and contractual obligations with vendors and service providers. The GDPR permits data protection authorities to impose large administrative penalties for violations of the GDPR or UK GDPR, including potential fines of up to €20 million or 4% of annual global revenues, whichever is greater, for each law.

Legal developments in Europe have created complexity and uncertainty regarding transfers of personal data from the EEA to the United States, including the Court of Justice of the European Union (the “CJEU”) decision

Table of Contents

to invalidate the EEA to U.S. personal data transfer framework as well as decisions from regulators in Austria, Denmark, France and Italy regarding transfers made via Google. We also currently rely on the standard contractual clauses to transfer personal data outside the EEA, including to the United States, among other data transfer mechanisms pursuant to the GDPR. While the CJEU upheld the adequacy of the standard contractual clauses (a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism,), it made clear that reliance on them alone may not necessarily be sufficient in all circumstances; this has created uncertainty.

In response to the data privacy laws discussed above and those in other countries in which we do business, we have implemented a multi-disciplinary privacy management program that includes technological safeguards, processes, contractual third-parties provisions, and employee trainings to help ensure that we handle information about our employees and customers in a compliant manner. Concurrently, we observe a trend toward expanding privacy data protection law both in number and scope that will expand our obligations. We may need to modify our practices and incur expenses to accommodate this evolving privacy compliance landscape.

Bribery, Anti-Corruption and Other Laws

We are subject to compliance with the U.S. Foreign Corrupt Practices Act (“FCPA”) and similar anti-bribery laws, such as the U.K. Bribery Act of 2010 (“Bribery Act”), which generally prohibit companies and their intermediaries from making improper payments to foreign government officials for the purpose of obtaining or retaining business. In addition, in the United States, we may also be subject to certain state and federal fraud and abuse laws, including the federal Anti-Kickback Statute and False Claims Act, that are intended to reduce waste, fraud and abuse in the health care industry. Our employees, distributors, and agents are required to comply with these laws, and we have implemented policies, procedures, and training, to minimize the risk of violating these laws.

Our Corporate Information

Certara, Inc. was incorporated in Delaware on June 27, 2017. Our principal business office is located at 100 Overlook Center, Suite 101, Princeton, New Jersey 08540, and the telephone number of our principal business office is (609) 716-7900. Our internet address is www.certara.com. Our internet website and the information contained therein or connected to or linked from our internet web site are not incorporated information and do not constitute a part of this Annual Report or any amendment thereto.

Available Information

Our Investor Relations website is located at https://ir.certara.com. We have used, and intend to continue to use, our Investor Relations website and our corporate website located at www.certara.com as a means of disclosing material non-public information and for complying with our disclosure obligations under Regulation FD. The following filings are available through our Investor Relations website as soon as reasonably practicable after we file them with, or furnish them to, the SEC: Annual Report on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K, and our Proxy Statement for our annual meeting of stockholders, Sustainability Report, as applicable (as well as any amendments to those reports). These documents are also available for download free of charge through a link on our Investor Relations website. The SEC also maintains a website at www.sec.gov that contains reports, proxy and information statements, and other information about reporting issuers, like us, that file electronically with the SEC. Our internet website and the information contained therein or connected to or linked from our internet web site are not incorporated information and do not constitute a part of this Annual Report.

Table of Contents

Item 1A. Risk Factors.

Investing in our common stock involves a high degree of risk. You should carefully consider the following risk factors together with other information in this filing, including our consolidated financial statements and related notes included elsewhere in this filing, before deciding whether to invest in shares of our common stock. The occurrence of any of the events described below could harm our business, financial condition, results of operations and growth prospects. In such an event, the trading price of our common stock may decline and you may lose all or part of your investment.

Summary of Risk Factors

Our business is subject to numerous risks and uncertainties, discussed in more detail in the following section.Theserisksinclude, among others, the following key risks:

•Deceleration in, or resistance to, the acceptance of model-informed biopharmaceutical discovery and development could reduce the demand for our products and services.

•We compete in a competitive and highly fragmented market.

•Changes or delays in government regulation relating to the biopharmaceutical industry could decrease the need for some of the services we provide.

•Reduction in R&D spending by our customers, as well as delays in the drug discovery and development process, may reduce demand for our products and services.

•Consolidation within the biopharmaceutical industry may reduce the pool of potential customers for our products and services or reduce the number of licenses for our software products.

•As customers increase their utilization of our products and services, we may be subject to additional pricing pressures.

•Our continued revenue growth depends on our ability to successfully enter new markets, increase our customer base and expand our relationships and the products and services we provide.

•We depend on key personnel and may not be able to retain these employees or recruit additional qualified personnel, which could harm our business.

•If our independent contractors are characterized as employees, we would be subject to adverse effects on our business and employment and withholding liabilities.

•Delays or defects in the release of new or enhanced software or other biosimulation tools may result in increased cost to us, delayed market acceptance of our products, diminished demand for our products, delayed or lost revenue, and liability.

•Issues relating to the use of artificial intelligence and machine learning in our products and services could adversely affect our business and operating results.

•If our existing customers do not renew their software licenses, do not buy additional solutions from us or renew at lower prices, our business and operating results will suffer.

•We have government customers and have received government grants, which subject us to risks including early termination, audits, investigations, sanctions, or penalties.

•Our recent growth rates may not be sustainable or indicative of future growth.

•We regularly evaluate potential acquisitions of other companies and technologies, which could divert our management’s attention, result in additional dilution to our stockholders, and otherwise disrupt our operations and adversely affect our operating results.

•Our estimated addressable market is subject to inherent challenges and uncertainties.

•We are subject to risks associated with the operation of a global business.

Table of Contents

•We are subject to the FCPA and the Bribery Act and similar anti-corruption laws and regulations in other countries.

•Our failure to comply with trade compliance and economic sanctions laws and regulations could materially adversely affect our reputation and results of operations.

•Current and future litigation against us could be costly and time consuming to defend.

•Our insurance coverage may not be sufficient to avoid material impact on our financial position resulting from claims or liabilities against us.

•If we fail to perform our services in accordance with contractual requirements, regulatory standards and ethical considerations, we could be liable for significant costs or penalties and our reputation could be harmed.

•We derive a significant percentage of our revenues from a concentrated group of customers and the loss of more than one of our major customers could materially and adversely affect our business, results of operations and/or financial condition.

•We may need additional funding. If we are unable to raise additional capital on terms acceptable to us or at all or generate cash flows necessary to maintain or expand our operations, we may not be able to compete successfully.

•Our bookings might not accurately predict our future revenue, and we might not realize all or any part of the anticipated revenue reflect in our bookings.

•Our business may be subject to risks arising from natural disasters, epidemic diseases, pandemics and public health crises.

•We rely upon third-party providers of cloud-based infrastructure to host our software solutions. Any disruption in the operations of these third-party providers, limitations on capacity or interference with our use could adversely affect our business.

•If we are not able to reliably meet our data storage and management requirements, or if we experience any failure or interruption in the delivery of our services over the internet, customer satisfaction and our reputation could be harmed and customer contracts may be terminated.

•Our software solutions utilize third-party open source software, and any failure to comply with the terms of one or more of these open source licenses could adversely affect our business.

•If our security measures are breached or unauthorized access to customer or other proprietary data is otherwise obtained, customers may reduce the use of or stop using our solutions and we may incur significant liabilities and loss of customer confidence.

•We are subject to numerous privacy and data security laws and related contractual requirements and our failure to comply with those obligations could cause us significant harm.

•We may be unable to adequately enforce or defend our ownership and use of our intellectual property and other proprietary rights.

•Third parties may initiate legal proceedings alleging that we are infringing their intellectual property rights, which could have a material adverse effect on our business.

•Our indebtedness could materially adversely affect our financial condition and our ability to operate our business.

•Restricted covenants governing our Credit Agreement may restrict our ability to pursue our business strategies.

•Impairment of goodwill and other tangible assets may adversely impact future results of operations.

•Our ability to use our NOLs and R&D tax credits carryforwards to offset future taxable income may be subject to certain limitations.

Table of Contents

•If our estimates or judgments relating to our critical accounting policies prove to be incorrect, our results of operations could be adversely affected.

Risks Related to Our Industry

Deceleration in, or resistance to, the acceptance of model-informed biopharmaceutical discovery and development by regulatory authorities or academic institutions could damage our reputation or reduce the demand for our products and services.

There has been a steady increase in the recognition by regulatory and academic institutions of the role that modeling and simulation can play in the biopharmaceutical development and approval process, as demonstrated by new regulations and guidance documents describing and encouraging the use of modeling and simulation in the biopharmaceutical discovery, development, testing and approval process, which has directly led to an increase in the demand for our services. Changes in government or regulatory policy, or a reversal in the trend toward increasing the acceptance of and reliance upon in silico data (trials, studies, or experiments conducted via computer or computer simulation) in the drug approval process, could decrease the demand for our products and services or lead regulatory authorities to cease use of, or to recommend against the use of, our products and services. This, in turn, could have a material adverse impact on our revenue and future growth.

Our software products are licensed by the FDA, Japan’s PMDA and 21 other regulatory authorities, who use them in assessing new drug applications. These licenses, which accounted for 0.2 % of our annual revenue in2023, are typically renewed on an annual basis, and there is no obligation for these regulatory authorities to renew these licenses at the same or any level. Although we do not believe that reduction or elimination of the use of any of our software products that are currently licensed by regulatory authorities would have a direct impact on the use of those products by our industry customers, it could diminish our reputation and negatively impact our ability to effectively market and sell our software products, particularly if such action were part of a wider reversal of government or regulatory acceptance of in silico data.

We also work closely with the global academic community on research, publications, and training of the next generation of biopharmaceutical scientists. Our software products are used in many academic institutions, often free of charge, where students, including PhD candidates, are first exposed to the types of tools and models that we offer. Upon graduating, these students often become employed by biopharmaceutical companies, where they continue to use our products and advocate for their continued use. If academic institutions decide to use competitive products, or develop their own biosimulation products, or reduce the exposure to biosimulation tools in general, familiarity with our products by the future generations of pharmacometricians and clinical pharmacologists will be diminished, which could ultimately result in a reduction in demand for our products.

We compete in a competitive and highly fragmented market.

The market for our biosimulation products and related services for the biopharmaceutical industry is competitive and highly fragmented. In biosimulation software, we compete with other scientific software providers, technology companies, in-house development by biopharmaceutical companies, and certain open source solutions. In the technology-driven services market, we compete with specialized companies, in-house teams at biopharmaceutical companies, and academic and government institutions. In some standard biosimulation services, and in regulatory, and market access, we also compete with contract research organizations. Some of our competitors and potential competitors have longer operating histories in certain segments of our industry than we do and could have greater financial, technical, marketing, R&D and other resources. Some of our competitors offer products and services directed at more specific markets than those we target, enabling these competitors to focus a greater proportion of their efforts and resources on those specific markets. Some competing products are developed and made available at lower cost by government organizations and academic institutions, and these entities may be able to devote substantial resources to

Table of Contents

product development. Some clinical research organizations or technology companies may decide to enter into or expand their offerings in the biosimulation area, whether through acquisition or internal development. We also face competition from open source software initiatives, in which developers provide software and intellectual property free of charge, such as R and PK-Sim software. In addition, some of our customers spend significant internal resources in order to develop their own solutions. Our current or potential competitors may develop products, services or technologies that are comparable, or superior to, or will render obsolete, the products, services and technologies we offer. In addition, our competitors may adapt more quickly than we do to technological advances and customer demands, thereby increasing such competitors’ market share relative to ours. Any material decrease in demand for our technologies or services may have a material adverse effect on our business, financial condition and results of operations.

Changes or delays in government regulation relating to the biopharmaceutical industry could decrease the need for some of the services we provide.

Governmental agencies throughout the world strictly regulate the biopharmaceutical development process. Our business involves assisting biopharmaceutical companies strategically and tactically navigate the regulatory approval process. New or amended regulations are expected to result in higher regulatory standards and potentially additional revenues for companies that service these industries. However, some changes in regulations, such as a relaxation in regulatory requirements or the introduction of streamlined or expedited approval procedures, or an increase in regulatory requirements that we have difficulty satisfying or that make our regulatory strategy services less competitive, could eliminate or substantially reduce the demand for our regulatory services. Regulatory developments that could potentially increase demand for our services could also be postponed or not fully implemented. Any material decrease or delay in demand for our technologies or services may have a material adverse effect on our business, financial condition and results of operations.

We cannot predict the likelihood, nature or extent of government regulation that may arise from future legislation or administrative action, or changes to governmental regulation that may be required as a result of judicial decisions, either in the United States or abroad. If we are slow or unable to adapt to changes in existing requirements or the adoption of new requirements or policies, or if we are not able to maintain regulatory compliance, our business may be harmed.

Reduction in R&D spending by our customers for a variety of reasons, as well as delays in the drug discovery and development process, may reduce demand for our products and services and negatively impact our results of operations and financial condition.

We provide biosimulation software platforms and services to the biopharmaceutical industry, both private and public companies as well as government and academic institutions. Because our products and services depend on our customers’ R&D expenditures, our revenues may be materially negatively affected by any economic, competitive, regulatory, demand, or other market impact that decreases our customers’ profitability or their ability to raise capital, which may cause them to decrease or delay R&D spend. In such an event, our revenues may be reduced through increased downward pricing pressure, reduction in the scope of projects, delays or cancellations of ongoing projects, or our customers shifting away from using third parties for their modeling and simulation work. Our customers’ expenses could continue to increase as a result of the higher costs of developing more complex drugs and biologics and complying with more onerous government regulations. Furthermore, our customers finance their R&D spending from both private and public sources, including the capital markets. As a result, our revenues and financial performance may be adversely impacted if our customers are unable to obtain sufficient capital on acceptable terms to finance their R&D spending. Government and university-based funding of scientific research can vary for a number of reasons, including general economic conditions, political priorities, changes in the number of students and other demographic changes.

Table of Contents

Our customers’ revenue and/or profitability could decline as a result of efforts by government and third-party payors to reduce the cost of healthcare. Governments worldwide have increased efforts to expand healthcare coverage while at the same time curtailing and better controlling the increasing costs of healthcare. If cost-containment efforts or other measures substantially change existing insurance models and limit our customers’ profitability, our customers may decrease R&D spending, which could decrease the demand for our services and materially adversely affect our growth prospects. In addition, industry trends, economic factors, regulatory developments, patent protection and political and other events and circumstances that affect the biopharmaceutical industry, such as volatility or declines in securities markets limiting capital and liquidity, decreased government funding of scientific research, or other circumstances that decrease our customers’ R&D spending also affect us.

Delays in the biopharmaceutical development cycle, particularly related to clinical trials being delayed or canceled, such as those caused by the ongoing COVID-19 pandemic, could also impact the demand or timing for our products and services.

Furthermore, our financial success depends upon the creditworthiness and ultimate collection of amounts due from our customers. If we are not able to collect amounts due from our customers in a timely fashion due to funding or liquidity challenges or for any other reason, we may be required to write-off significant accounts receivable and recognize bad debt expenses, which could materially and adversely affect our operating results. All of these events could have a material adverse effect on our business, results of operations or financial condition.

Consolidation within the biopharmaceutical industry may reduce the pool of potential customers for our products and services or reduce the number of licenses for our software products.

A significant portion of our customer base consists of biopharmaceutical companies, and our revenue is dependent upon expenditures by these customers. Consolidation through mergers or contraction through business failures within the biopharmaceutical industry may reduce the number of potential customers, particularly larger customers, for our products and services. Consolidation of major biopharmaceutical companies could result in consolidation of software licenses used by those companies, reduction of the number of individual user licenses, or increased pressure to negotiate price discounts or other terms for service that are less favorable to us, which may have a material adverse effect on our revenue and financial condition. Personnel redundancies and layoffs by merged companies to achieve deal synergies would result in a commensurate reduction in total users of our software, reducing the license fees we charge based on the number of users.

As customers increase their utilization of our products and services, we may be subject to additional pricing pressures.

One of our strategic goals is to increase the breadth and utilization of products and services we provide to our existing customers, such as increasing the number of user licenses for our software products, selling licenses for new software products and expanding the number and scope of services we provide to individual customers. As the total annual expenditure from a particular customer increases, we may experience pricing pressure, often from the customer’s procurement department, in the form of requests for discounts or rebates, price freezes and less favorable payment terms. This could have an adverse impact on our profitability.

Table of Contents

Risks Related to Our Business

Our continued revenue growth depends on our ability to successfully enter new markets, increase our customer base and expand our relationship and the products and services we provide to our existing customers.

Our products and services are used primarily by modeling and simulation specialists in pharmaceutical, biotechnology, and government research or regulatory organizations. We have relationships with many large companies in the biopharmaceutical sector, and part of our growth strategy entails deriving more revenues from these existing customers by expanding their use of our existing and new products and services. Our ability to increase revenues with existing customers may be limited without significant investment in marketing our existing products and services or developing new products, which could be time-consuming and costly and may not be successful. We are also focused on increasing the number of emerging or smaller biotechnology customers that we serve. These small companies are increasingly responsible for much of the discovery and development of new molecules and treatments, and their share of the total industry R&D discovery and development dollars is rapidly growing. Attracting these smaller customers may require us to expend additional resources on targeted marketing, as they may not be as familiar with our Company or products. And although these small biotechnology companies tend to use third parties such as Certara for many of their development activities, these smaller companies also tend to be less financially secure. If their products are not successful or they have difficulty raising sufficient investment capital, they may not be able to timely or fully pay for our services, or they may terminate or decrease the scope of projects for which they use our products and services, which could adversely impact our revenues.

Our strategy also includes expanding into new markets, new geographies, and new areas within our existing markets, either organically or by acquiring other companies in these markets. If our strategies are not executed successfully, our products and services may not achieve market acceptance or penetration in targeted new departments within our existing customers or new customers. We cannot guarantee that we will be able to identify new biosimulation or regulatory and market access technologies of interest to our customers, or develop or acquire them in a timely fashion. Even if we are able to identify and develop new technologies and biosimulation tools of interest, we may not be able to negotiate license agreements on acceptable terms, or at all. Some of our products, such as our QSP models, require significant time and investment to develop to a point where they can achieve market acceptance, and we may not be able to develop them at a rate that matches market demand. We may also face more significant pricing pressure as we expand geographically and our customer profile evolves. For example, smaller biotechnology companies, or companies based in countries that have less developed economies, may not be able to afford our products and services at our customary rates. If we are unable to develop or acquire new services and products and/or create demand for those newly developed services and products, accelerate the development of products where there is a market demand, or maintain or increase our historic pricing levels, our future business, results of operations, financial condition and cash flows could be adversely affected.

We depend on key personnel and may not be able to retain these employees or recruit additional qualified personnel, which could harm our business.

Our success depends to a significant extent on the continued services of our senior management and other key contributors throughout our business. As of December 31, 2023, 433 of our employees held PhDs. It is challenging to attract and retain critical and qualified employees because of the specialized scientific nature of our business and significant competition for qualified personnel in the biopharmaceutical industry. Many of our scientists also play a significant role in marketing and selling our products and services to new and existing customers. If any of our senior scientists or members of senior management team, such as our CEO, CFO or division presidents, do not continue in their present positions, our operations could be disrupted. Compensation for our employees makes up our most significant fixed cost. Unexpected revenue shortfalls in the future and rapid wage inflation may make it difficult for us to retain all of our employees. The loss of any key employee,

Table of Contents

or our inability to continue to recruit, retain, and motivate key personnel, replace departed personnel in a timely fashion, or train our scientists to develop new business, may adversely impact our ability to compete effectively and grow our business and negatively affect our ability to meet our short and long-term financial and operational objectives.

If our independent contractors are characterized as employees, we would be subject to adverse effects on our business and employment and withholding liabilities.

We structure the relationships with our independent contractors in a manner that we believe results in an independent contractor relationship, not an employee relationship. An independent contractor is generally distinguished from an employee by his or her degree of autonomy and independence in providing services. A high degree of autonomy and independence is generally indicative of a contractor relationship, while a high degree of control is generally indicative of an employment relationship. A further complicating factor is there is no single independent contractor test or standard which applies in every jurisdiction, and the test in some jurisdictions is more stringent than in others. Although we believe that our independent contractors are properly characterized as independent contractors, individuals, tax or other regulatory authorities may in the future challenge our characterization of these relationships. If regulatory authorities or state or federal courts were to determine that our independent contractors are employees, and not independent contractors, we would be required to withhold income taxes, to withhold and pay Social Security, Medicare and similar taxes and to pay unemployment and other related payroll taxes. We would also be liable for unpaid past taxes, subject to penalties and increased operating costs moving forward. As a result, any determination that our independent contractors are our employees could have a material adverse effect on our business, financial condition and results of operations.

Delays or defects in the release of new or enhanced software or other biosimulation tools may result in increased cost to us, delayed market acceptance of our products, diminished demand for our products, delayed or lost revenue, and liability.

Market acceptance of our products depends upon the continuous, effective and reliable operation of our software and other biosimulation tools and models. New or enhanced products or services, whether developed internally or acquired through acquisitions, can require long development and testing periods, which may result in delays in scheduled introduction. Our software solutions and biosimulation tools and models are inherently complex and may contain defects or errors. The risk of errors is particularly significant when a new product is first introduced or when new versions or enhancements of existing software solutions are released, such as the integration of AI technology with our existing software products. Although we extensively test and conduct quality control on each new or enhanced biosimulation product before it is released to the market, there can be no assurance that significant errors will not be found in existing or future releases. As a result, in the months following the introduction of certain releases, we may need to devote significant resources to correct these errors. There can be no assurance, however, that all of these errors can be corrected. Many of our customers also require that new versions of our software be internally validated before implementing it, which can result in implementation delays or the decision to skip smaller updates altogether. Any errors, defects, disruptions or other performance problems with our products could hurt our reputation and may damage our customers’ businesses. Any delays in the release schedule for new or enhanced products or services may delay market acceptance of these products or services and may result in delays in new customer orders for these new or enhanced products or services or the loss of customer orders, which may have a material adverse effect on our business, financial condition and results of operations.

To the extent that defects or errors cause our software or other biosimulation tools to malfunction and our customers’ use of our products is interrupted, or the data derived from the use of our products is incorrect or incomplete, our customers may delay or withhold payment to us, cancel their agreements with us or elect not to renew, make service credit claims, warranty claims or other claims against us, and we could lose future sales. The occurrence of any of these events could result in diminishing demand for our software, a reduction of our

Table of Contents

revenues, an increase in collection cycles for accounts receivable, and require us to increase our warranty provisions or incur the expense of litigation or substantial liability.

Issues relating to the use of artificial intelligence and machine learning in our products and services could adversely affect our business and operating results.

Artificial intelligence (AI) and machine learning technologies have been incorporated across our software and services portfolios providing opportunities to expand the number of data sources utilized, better predict outcomes, and streamline reporting. For example, we are using machine learning to automate and speed the process of biosimulation, and we have created an AI application to aid creating regulatory documents from scientific analyses and clinical data. We believe that AI predictive models will continue to enhance the accuracy and usefulness of biosimulation models and be utilized broadly across drug development and we plan to develop and incorporate additional AI technology in future products and services.

As with many technological innovations, there are significant risks and challenges involved in maintaining and deploying these technologies, and there can be no assurance that the usage of such technologies will enhance our products or services or be beneficial to our business, including our efficiency and profitability. In addition, issues in the development and use of AI combined with an uncertain regulatory environment may result in reputational harm, liability, or other adverse consequences to our business operations. AI presents risks, challenges, and unintended consequences that could affect our adoption and use of this technology. AI technologies are complex and rapidly evolving. Further, bad actors around the world use increasingly sophisticated methods, including the use of AI, to engage in illegal activities involving the theft and misuse of personal information, confidential information, and intellectual property. While we aim to develop and use AI responsibly and attempt to identify and mitigate ethical and legal issues presented by its use, we may be unsuccessful in identifying and resolving issues before they arise. AI-related issues, deficiencies and/or failures could give rise to legal and regulatory actions, including with respect to proposed legislation regulating AI, damage our reputation or otherwise materially harm our business.

If our existing customers do not renew their software licenses, do not buy additional solutions from us or renew at lower prices, our business and operating results will suffer.

We expect to continue to derive a significant portion of our software revenues from the renewal of existing license agreements. As a result, maintaining the renewal rate of our existing customers and selling additional or upgraded software solutions to them is critical to our future operating results. Factors that may affect the renewal rate for our customers and our ability to sell additional solutions to them include:

•the price, performance and functionality of our software solutions;

•the availability, price, performance and functionality of competing products;

•the effectiveness of our professional services;

•ability to develop complementary software solutions, applications and services;

•the stability, performance and security of our technological infrastructure; and

•the business environment of our customers.

We deliver our software through either (i) a product license that permits our customers to install the software solution directly onto their own in-house hardware and use it for a specified term, or (ii) a subscription that allows our customers to access the cloud-based software solution for a specified term. Our customers have no obligation to renew their product licenses or subscriptions for our software solutions after the license term expires, which are typically between one and three years, and some of our contracts may be terminated or

Table of Contents

reduced in scope either immediately or upon notice. In addition, our customers may negotiate terms less advantageous to us upon renewal, which may reduce our revenues from these customers.

Our customers depend on our support to resolve technical issues relating to our solutions, as our software requires expert usage to fully exploit its capabilities. Any failure to offer high-quality technical support, or a market perception that we do not offer high-quality support, could adversely affect our renewal rates and our ability to sell additional solutions to existing or to sell to prospective customers. Factors that are not within our control may also contribute to a reduction in our software revenues. For instance, our customers may reduce the number of their employees who are engaged in research and who would have use of our software, which would result in a corresponding reduction in the number of user licenses needed for some of our solutions and thus a lower aggregate renewal fee. The loss, reduction in scope or delay of a large contract, or the loss or delay of multiple contracts, could materially adversely affect our business.

Our future operating results also depend, in part, on our ability to sell new software solutions and licenses to our existing customers. The willingness of existing customers to license our software will depend on our ability to scale and adapt our existing software solutions to meet the performance and other requirements of our customers, which we may not do successfully. If our customers fail to renew their agreements, renew their agreements upon less favorable terms or at lower fee levels or fail to purchase new software solutions and licenses from us, our revenues may decline and our future revenues may be constrained. Furthermore, our sales process is dependent on the reputation of our solutions and business and on positive recommendations from our existing customers. Any dissatisfaction from existing customers may adversely impact our ability to sell our solutions to new customers.

Our customers may delay or terminate contracts, or reduce the scope of work, for reasons beyond our control, or we may underprice or overrun cost estimates with our fixed-fee contracts, potentially resulting in financial losses.

Many of our technology-driven service contracts may be terminated by the customer at its discretion immediately or after a short notice period without penalty. Customers terminate, delay or reduce the scope of these types of contracts for a variety of reasons, including but not limited to:

•lack of available funding or financing;

•mergers or acquisitions involving the customer;

•a change in customer priorities;

•impacts to client trial operations;

•delay or termination of a specific product candidate development program; and

•the customer decides to shift business to a competitor or to use internal resources.

As a result, contract terminations, delays and reductions in scope occur regularly in the normal course of our business. However, the delay, loss or reduction in scope of a large contract or multiple smaller contracts could result in under-utilization of our personnel, a decline in revenue and profitability and adjustments to our bookings, any or all of which could have a material adverse effect on our business, results of operations, financial condition and/or cash flows.

Many of our contracts with customers also provide for services on a fixed-price or fee-for-service with a cap basis. Accordingly, we bear the financial risk if we initially underprice our contracts or otherwise overrun our cost estimates. In these situations, we attempt to revise the scope of activity from the contract specifications and

Table of Contents

negotiate contract modifications shifting the additional cost to the customer, but are not always successful. If we fail to adequately price our contracts or if we experience significant cost overruns (including direct and indirect costs such as pass-through costs), or if we are delayed in, or fail to, execute contract modifications with customers increasing the scope of activity, our results of operations could be materially adversely affected. From time to time, we have had to commit unanticipated resources to complete fixed-fee projects, resulting in lower margins and profitability on those projects. We might experience similar situations in the future, which could have a material adverse impact on our results of operations and cash flows.

We have government customers and have received government grants, which subject us to risks including early termination, audits, investigations, sanctions, or penalties.

We derive limited revenue from contracts with U. S. government, including the FDA and the Center for Disease Control and Prevention within the Department of Health and Human Services. We have also accepted limited grant funds from governmental entities, whereby we are reimbursed for certain expenses incurred, subject to our compliance with the specific requirements of the applicable grant, including rigorous documentation requirements. We may enter into further contracts with the U.S. or foreign governments in the future, or accept additional grant funds. These subject us to statutes and regulations applicable to companies doing business with the government. These types of contracts customarily contain provisions that give the government substantial rights and remedies, many of which are not typically found in commercial contracts and which are unfavorable to contractors, including provisions that allow the government to unilaterally terminate or modify our federal government contracts, in whole or in part, at the government’s convenience or in the government’s best interest, including if funds become unavailable to the applicable government agency. Under general principles of government contracting law, if the government terminates a contract for convenience, the terminated company may generally recover only its incurred or committed costs and settlement expenses and profit on work completed prior to the termination. If the government terminates a contract for default, the defaulting company may be liable for any extra costs incurred by the government in procuring undelivered items from another source. Further, the laws and regulations governing the procurement of goods and services by the U.S. government provide procedures by which other bidders and interested parties may challenge the award of a government contract at the U.S. Government Accountability Office (“GAO”) or in federal court. If we are awarded a government contract, such challenges or protests could be filed even if there are not any valid legal grounds on which to base the protest. If any such protests are filed, the government agency may decide to suspend our performance under the contract while such protests are being considered by the GAO or the applicable federal court, thus potentially delaying delivery of payment.

In addition, government contracts and grants normally contain additional requirements that may increase our costs of doing business, reduce our profits, and expose us to liability for failure to comply with these terms and conditions. These requirements include, for example:

•compliance with complex regulations for procurement, formation, administration, and performance of government contracts under the Federal Acquisition Regulations, agency-specific regulations supplemental to the Federal Acquisition Regulations, and regulations specific to the administration of grants by the U.S. government;

•specialized disclosure and accounting requirements unique to government contracts and grants;

•mandatory financial and compliance audits that may result in potential liability for price or cost adjustments, recoupment of government funds after such funds have been spent, civil and criminal penalties, or administrative sanctions such as suspension or debarment from doing business with the U.S. government;

•public disclosures of certain contract, grant, and company information; and

Table of Contents

•mandatory socioeconomic compliance requirements, including labor requirements, non-discrimination and affirmative action programs and environmental compliance requirements.

Government contracts and grants are also generally subject to greater scrutiny by the government, which can unilaterally initiate reviews, audits and investigations regarding our compliance with government contract and grant requirements. In addition, if we fail to comply with government contract laws, regulations and contract or grant requirements, our contracts and grants may be subject to termination or suspension, and we may be subject to financial and/or other liability under our contracts or under the Federal Civil False Claims Act. The False Claims Act’s “whistleblower” provisions allow private individuals, including present and former employees, to sue on behalf of the U.S. government. The False Claims Act statute provides for treble damages and other penalties and, if our operations are found to be in violation of the False Claims Act, we could face other adverse action, including suspension or prohibition from doing business with the United States government. Any penalties, damages, fines, suspension, or damages could adversely affect our ability to operate our business and our financial results.

Our recent growth rates may not be sustainable or indicative of future growth.

We have experienced significant growth in recent years. Revenue increased from $335.6 million for 2022 to $354.3 million for 2023. Our historical rate of growth may not be sustainable or indicative of our future rate of growth. We believe that our continued growth in revenue, as well as our ability to improve or maintain margins and profitability, will depend upon, among other factors, our ability to address the challenges, risks and difficulties described elsewhere in this “Risk Factors” section and the extent to which our various product offerings grow and contribute to our results of operations. In addition, our customer base may not continue to grow or may decline due to a variety of possible risks, including increased competition, changes in the regulatory landscape and the maturation of our business. Any of these factors could cause our revenue growth to decline and may adversely affect our margins and profitability. Failure to continue our revenue growth or improve margins would have a material adverse effect on our business, financial condition and results of operations. You should not rely on our historical rate of revenue growth as an indication of our future performance.

We regularly evaluate potential acquisitions of other companies or technologies, which could divert our management’s attention, result in additional dilution to our stockholders, and otherwise disrupt our operations and adversely affect our operating results.

We have acquired multiple businesses and technologies in the past and we regularly evaluate opportunities to acquire or invest in businesses, solutions or technologies that we believe could complement or expand our solutions, enhance our technical capabilities or otherwise offer growth opportunities. The pursuit of potential acquisitions may divert the attention of management and cause us to incur various expenses in identifying, investigating and pursuing suitable acquisitions, whether or not they are consummated.

We may not be able to successfully integrate the personnel, operations and technologies of the businesses we acquire, effectively manage the combined business following an acquisition or preserve the operational synergies between our business units that we underwrite at the time of such acquisition. The following factors could result in our failure to achieve the expected synergies:

•inability to integrate or benefit from acquired technologies or services in a profitable manner;

•unanticipated costs or liabilities associated with the acquisition;

•incurrence of acquisition-related costs;

•difficulty integrating the accounting systems, operations and personnel of the acquired business;

Table of Contents

•difficulties and additional expenses associated with supporting legacy products and hosting infrastructure of the acquired business;

•difficulty converting the customers of the acquired business onto our solutions and contract terms, including disparities in the revenues, licensing, support or professional services model of the acquired company;

•diversion of management’s attention from other business concerns;

•adverse effects to our existing business relationships with business partners and customers as a result of the acquisition;

•the potential loss of key employees;

•use of resources that are needed in other parts of our business; and

•use of substantial portions of our available cash to consummate the acquisition.

For example, in 2023, we acquired Formedix Limited, which added a metadata repository and clinical data flow automation to our data platform. We also acquired Applied Biomath, a company focused on quantitative systems pharmacology (QSP) to expand and complement our existing QSP capabilities. The planned integration of these businesses into our existing product offerings may be delayed or may not achieve the expected results.

Some acquisitions are structured in such a way that a portion of the purchase price may be based on achieving certain post-closing conditions (i.e. “earn-outs”), such as the Company recognizing certain levels of revenue generated by the acquired business. Failure to achieve the expected synergies or market acceptance could also result in the failure to achieve some or all of these conditions, which could result in disputes with the seller of the applicable business.

In addition, a significant portion of the purchase price of companies we acquire may be allocated to acquired goodwill and other intangible assets, which must be assessed for impairment at least annually. In the future, if our acquisitions do not yield the expected returns, we may be required to take charges to our operating results based on this impairment assessment process, which could adversely affect our results of operations.

Acquisitions could also result in dilutive issuances of equity securities or the incurrence of debt, which could adversely affect our operating results. In addition, if an acquired business fails to meet our expectations, our operating results, business and financial position may suffer.

Our estimated addressable market is subject to inherent challenges and uncertainties. If we have overestimated the size of our addressable market or the various markets in which we operate, our future growth opportunities may be limited.

Our Total Available Market ("TAM") is based on publicly available third-party market research and internal estimates regarding the size of our markets, is subject to significant uncertainty and is based on assumptions that may not prove to be accurate. We base the TAM for our business on our current core markets, biosimulation, regulatory science, and market access. These estimates may change or prove to be inaccurate. While we believe the information on which we base our TAM is generally reliable, such information is inherently imprecise. In addition, our expectations, assumptions and estimates of future opportunities are necessarily subject to a high degree of uncertainty and risk due to a variety of factors, including those described herein. If third-party or internally generated data prove to be inaccurate or if we make errors in our assumptions based on that data, our future growth opportunities may be affected. If our TAM, or the size of any of the various markets in which we

Table of Contents

operate, proves to be inaccurate, our future growth opportunities may be limited and there could be a material adverse effect on our prospects, business, financial condition and results of operations.

We are subject to risks associated with the operation of a global business.

We derive a significant portion of our total revenue from our operations in international markets. During the years ended December 31, 2023 and 2022, 27% and 26%, respectively, of our revenues were transacted in foreign currencies, the majority of which included the British Pound Sterling, the Euro and Japanese Yen. Our global business may be affected by local economic conditions, including inflation, recession and currency exchange rate fluctuations. Changes in the value of the U.S. dollar relative to other currencies could result in material foreign currency exchange rate fluctuations and, as a result, our revenue and net earnings could be materially adversely affected. In addition, political and economic changes, including international conflicts and terrorist acts, throughout the world may interfere with our or our customers’ activities in particular locations and result in a material adverse effect on our business, financial condition and operating results. Although we do not believe the current conflicts between Russia and Ukraine in Europe and Israel and Hamas in the Middle East pose any immediate material impact to our business, if the conflict intensifies or expands beyond Ukraine or Gaza, it could have an adverse impact on our business, particularly our operations in Poland and our ability to use consultants in that region of the world. We could also experience a delay or cancellation of work orders to the extent they rely on clinical trials being conducted in Ukraine. Potential trade restrictions, exchange controls, adverse tax consequences and legal restrictions may affect our revenue from customers located outside the United States and the repatriation of funds into the United States. Also, we could be subject to unexpected changes in regulatory requirements, the difficulties of compliance with a wide variety of foreign laws and regulations, potentially negative consequences from changes in or interpretations of U.S. and foreign tax laws, import and export licensing requirements and longer accounts receivable cycles in certain foreign countries. Foreign currency exchange rate hedges, transactions, re-measurements, or translations could also materially impact our financial results. These risks, individually or in the aggregate, could have an adverse effect on our operating and financial results.

We are subject to the FCPA and the Bribery Act and similar anti-corruption laws and regulations in other countries. Violations of these laws and regulations could harm our reputation and business, or materially adversely affect our business, results of operations, financial condition and/or cash flows.

We operate in numerous countries around the world and are subject to the FCPA, the Bribery Act and similar anti-bribery laws in the countries in which we operate. Our business involves sales to government and state-owned agencies and brings us and others acting on our behalf, into contact with government officials around the world. The FCPA and the Bribery Act prohibit us and our officers, directors, employees and third parties acting on our behalf, including agents, from corruptly offering, promising, authorizing or providing anything of value to a “foreign official” for the purposes of influencing official decisions or obtaining or retaining business or otherwise obtaining favorable treatment. The FCPA further requires us to make and keep books, records and accounts that accurately reflect transactions and dispositions of assets and to maintain a system of adequate internal accounting controls. The Bribery Act also prohibits “commercial” bribery and accepting bribes.

Although our officers, directors, employees, distributors, and agents are required to comply with these laws, we cannot be sure that our internal policies and procedures will always protect us from liability for violations of these laws committed by persons associated with us, including our employees or third parties acting on our behalf. Violations of anti-corruption laws, or even allegations of such violations, could disrupt our business and result in a material adverse effect on our reputation, business, results of operations, financial condition and/or cash flows. For example, violations may result in criminal or civil penalties, disgorgement of profits, related stockholder lawsuits, debarment from government contracting and other remedial measures.

Table of Contents

Our failure to comply with trade compliance and economic sanctions laws and regulations of the United States and applicable international jurisdictions could materially adversely affect our reputation and results of operations.

We must operate our business in compliance with applicable economic and trade sanctions laws and regulations, such as those administered and enforced by the U.S. Department of Treasury’s Office of Foreign Assets Control, the U.S. Department of State, the U.S. Department of Commerce, the United Nations Security Council and other relevant sanctions authorities. Our global operations and use of distributors in jurisdictions outside the U.S. expose us to the risk of violating, or being accused of violating, either directly or indirectly through our distributors, economic and trade sanctions laws and regulations. Our failure to comply with these laws and regulations may expose us to reputational harm as well as significant penalties, including criminal fines, imprisonment, civil fines, disgorgement of profits, injunctions and debarment from government contracts, as well as other remedial measures. Investigations of alleged violations can be expensive and disruptive. Despite our compliance efforts and activities we cannot assure compliance by our employees or representatives, such as our distributors or resellers, for which we may be held responsible, and any such violation could materially adversely affect our reputation, business, financial condition and results of operations.

Current and future litigation against us, which may arise in the ordinary course of our business, could be costly and time consuming to defend.

We are subject to claims that arise in the ordinary course of business, such as claims in connection with commercial disputes, employment claims made by our current or former employees, or claims brought by third-parties for failure to adequately protect their personal data. Third parties may in the future assert intellectual property rights to technologies that are important to our business and demand back royalties or that we license their technology. Litigation may result in substantial costs and may divert management’s attention and resources, which may seriously harm our business, overall financial condition and operating results. Insurance may not cover such claims, may not be sufficient for one or more of such claims and may not continue to be available on terms acceptable to us. A claim brought against us that is uninsured or underinsured could result in unanticipated costs, negatively affecting our business, financial condition and results of operations.

Our insurance coverage may not be sufficient to avoid material impact on our financial position resulting from claims or liabilities against us, and we may not be able to obtain insurance coverage on attractive terms, or at all, in the future.

We maintain insurance coverage for protection against many risks of liability, including directors and officers liability, professional errors and omissions, breach of fiduciary duty, and cybersecurity risks. The extent of our insurance coverage is under continuous review and is modified as we deem it necessary. Despite this insurance, it is possible that claims or liabilities against us may not have been fully insured, or our insurance carriers may contest coverage, which could have a material adverse impact on our financial position or results of operations. In addition, we may not be able to obtain any insurance coverage, or adequate insurance coverage on attractive terms, or at all, when our existing insurance coverage expires and the cost of obtaining such insurance coverage may materially increase.

If we fail to perform our services in accordance with contractual requirements, regulatory standards and ethical considerations, we could be liable for significant costs or penalties and our reputation could be harmed.

The services we provide to biopharmaceutical companies and other customers are complex and subject to contractual requirements, regulatory standards and ethical considerations. For example, some of our services must adhere to the regulatory requirements of the FDA governing our activities relating to preclinical studies and clinical trials, including GLP and GCP. Additionally, we are subject to compliance with FDA’s regulations set forth in part 11 of title 21 of the Code of Federal Regulations, which relates to the creation, modification,

Table of Contents

maintenance, storage, retrieval, or transmittal of electronic records submitted to the FDA. FDA may also issue or finalize guidance documents that may have implications for our customers and our products, platforms, and services. We may be subject to inspection by regulatory authorities in connection with our customers’ marketing applications and other regulatory submissions. If we fail to perform our services in accordance with regulatory requirements, regulatory authorities may take action against us or our customers for failure to comply with applicable regulations governing the development and testing of therapeutic products. Regulatory authorities may also disqualify certain data or analyses from consideration in connection with applications for regulatory approvals, which would result in our customers not being able to rely on our services in connection with their regulatory submissions and may subject our customers to additional or repeat clinical trials and delays in the development and regulatory approval process. Mistakes in providing services to our customers, such as dosing models, could affect medical decisions for patients in clinical trials and create liability for personal injury. Such actions may include sanctions, such as warning or untitled letters, injunctions, or failure of such regulatory authorities to grant marketing approval of products, delay, suspension, or withdrawal of approvals, license revocation, loss of accreditation; product seizures or recalls; operational restrictions; civil or criminal penalties or prosecutions, damages or fines. Customers may also bring claims against us for breach of our contractual obligations or errors in the outcomes of our products or services, may terminate their contracts with us and/or may choose not to award further work to us. Any such action could have a material adverse effect on our reputation, business, financial condition and results of operations.

We derive a significant percentage of our revenues from a concentrated group of customers and the loss of more than one of our major customers could materially and adversely affect our business, results of operations and/or financial condition.

Our ten largest customers accounted for 28% of revenues for each of the years ended December 31, 2023 and 2022. The loss of any of our major customers could have a material adverse effect on our results of operations and financial condition. We may not be able to maintain our customer relationships, and our customers may delay payment under, or fail to renew, their agreements with us, which could adversely affect our business, results of operations or financial condition. Any reduction in the amount of revenues that we derive from these customers, without an offsetting increase in new sales to other customers, could have a material adverse effect on our operating results. A significant change in the liquidity or financial position of our customers could also have a material adverse effect on the collectability of our accounts receivable, our liquidity, and our future operating results.

We may need additional funding. If we are unable to raise additional capital on terms acceptable to us or at all or generate cash flows necessary to maintain or expand our operations, we may not be able to compete successfully, which would harm our business, results of operations, and financial condition.

We expect to devote substantial financial resources to our ongoing and planned activities, including the continued investment in our biosimulation software platform.

As of December 31, 2023, we had cash and cash equivalents of $235.0 million. We believe that our existing cash and cash equivalents will be sufficient to fund our operations and capital expenditure requirements for an extended period. However, we have based this estimate on assumptions that may prove to be wrong, and our operating plans may change as a result of many factors currently unknown to us. As a result, we could deplete our capital resources sooner than we currently expect.

Our future capital requirements will depend on many factors, including:

•the growth of our revenue;

•the growth of our employee base;

Table of Contents

•the timing and launch of new products;

•the continued expansion of sales and marketing activities; and

•mergers and acquisitions of technologies or services complementing or extending our biosimulation, regulatory science and market access businesses.

In the event that we require additional financing, we may not be able to raise such financing on terms acceptable to us or at all. In addition, we may seek additional capital due to favorable market conditions or strategic considerations, even if we believe we have sufficient funds for our current or future operating plans. If we are unable to raise additional capital on terms acceptable to us or at all or generate cash flows necessary to maintain or expand our operations and invest in our computational platform, we may not be able to compete successfully, which would harm our business, operations, and financial condition.

Our bookings might not accurately predict our future revenue, and we might not realize all or any part of the anticipated revenue reflected in our bookings.

Our bookings represent anticipated revenue for work not yet completed or performed under a signed contract or purchase order where there is sufficient or reasonable certainty about the customer’s ability and intent to fund and commence the software or services. Bookings vary from period to period depending on numerous factors, including sales performance and the overall health of the biopharmaceutical industry, among others. Once work begins, we recognize direct revenue over the life of the contract based on our performance of services under the contract. Contracts may be terminated or delayed by our customers for reasons beyond our control. To the extent projects are delayed, the anticipated timing of our direct revenue could be materially affected.

In the event a customer terminates a contract, we are generally entitled to be paid for services rendered through the termination date and for services provided in winding down the project. However, we are generally not entitled to receive the full amount of direct revenue reflected in our bookings in the event of a contract termination. A number of factors may affect bookings and the direct revenue generated from our bookings, including:

•the size, complexity and duration of solutions;

•changes in the scope of work during the course of a project; and

•the cancellation or delay of a solution.

Our bookings for the year ended December 31, 2023 were $402.3 million compared to bookings of $409.0 million for the year ended December 31, 2022. While bookings decreased in 2023 compared to 2022, an increase or decrease in bookings will generally result in an increase or decrease in future revenue to be recognized over time (depending on future contract modifications, contract cancellations and other adjustments), an increase in bookings at a particular point in time does not necessarily correspond to an increase in revenues during a particular period. The timing and extent to which bookings will result in direct revenue depend on many factors, including the timing of the commencement of work, the rate at which we perform services, scope changes, cancellations, delays, the receipt of regulatory approvals, and the nature, duration, size, complexity, and phase of the studies. In addition, delayed projects remain in bookings until they are canceled. As a result of these factors, our bookings are not necessarily a reliable indicator of future direct revenue, and we might not realize all or any part of the revenue from the authorizations in bookings at any given point in time.

Table of Contents

Our business may be subject to risks arising from natural disasters, epidemic diseases, pandemics, and public health crises.

We may be subject to risks related to natural disasters, epidemic diseases, pandemics, and public health crises, which could adversely impact supply chain interruptions, disruptions or delays to pipeline development and clinical trials and interruptions or delays in regulatory approvals. These and other adverse impacts on our customers and economic conditions may cause our customers to delay or cancel projects or significantly scale back their operations or R&D spending and limit the use of third parties, which could have a material adverse effect on our business.

Public health crises, such as the COVID 19 pandemic, could also impact the health of our employees and cause extensive absences from work, which may delay the completion of internal projects and lower our consultant utilization rates. Even if we follow what we believe to be best practices, we may not be able to prevent the transmission of disease between employees. Any incidents of actual or perceived transmission may expose us to liability claims and adversely impact employee productivity and morale.

Our business could be negatively impacted by other natural disasters, such as new disease epidemics, significant weather events, the outbreak of war or acts of terrorism, such as the war between Russia and Ukraine, or other “acts of God,” each of which may be exacerbated by the effects of global climate change. We are a global company with offices in many countries. Disruptions in the infrastructure, either on a local or global scale, caused by these types of events could adversely affect our ability to serve our customers.

Although we have disaster recovery plans, carry business interruption insurance policies and typically have provisions in our contracts that protect us in certain force majeure type events, our coverage might not be adequate to compensate us for all losses that may occur.

Risks Related to Intellectual Property, Information Technology and Data Privacy

We rely on third-party providers of cloud-based infrastructure to host our software solutions. Any disruption in the operations of these third-party providers, limitations on capacity or interference with our use could adversely affect our business, financial condition, reputation and results of operations.

We outsource substantially all of the infrastructure relating to our hosted software solutions to third-party hosting services. Customers of our hosted software solutions need to be able to access our software platform at any time, without interruption or degradation of performance, and we provide them with service-level commitments with respect to uptime. Our hosted software solutions depend on protecting the virtual cloud infrastructure hosted by third-party hosting services by maintaining its configuration, architecture, features and interconnection specifications, as well as the information stored in these virtual data centers, which is transmitted by third-party internet service providers. Any limitation on the capacity of our third-party hosting services could impede our ability to onboard new customers or expand the usage of our existing customers, which could adversely affect our business, financial condition and results of operations. In addition, any incident affecting our third-party hosting services’ infrastructure that may be caused by cyber-attacks, natural disasters, fire, flood, severe storm, earthquake, power loss, telecommunications failures, terrorist or other attacks or other similar events beyond our control could negatively affect our cloud-based solutions. Work- from-home and other flexible work arrangements have impacted our third-party vendors by increasing operational challenges and risks, including vulnerabilities to cybersecurity and information technology infrastructure threats. A prolonged service disruption affecting our cloud-based solutions for any of the foregoing reasons would negatively impact our ability to serve our customers and could damage our reputation with current and potential customers, expose us to liability, cause us to lose customers or otherwise harm our business. We may also incur significant costs for using alternative equipment or taking other actions in preparation for, or in reaction to, events that damage the third-party hosting services we use.

Table of Contents

In the event that our service agreements with our third-party hosting services are terminated, or there is a lapse of service, elimination of services or features that we utilize, interruption of internet service provider connectivity or damage to such facilities, we could experience interruptions in access to our platform as well as significant delays and additional expense in arranging or creating new facilities and services and/or re-architecting our hosted software solutions for deployment on a different cloud infrastructure service provider, which could adversely affect our business, financial condition and results of operations.

If we are not able to reliably meet our data storage and management requirements, or if we experience any failure or interruption in the delivery of our services over the internet, customer satisfaction and our reputation could be harmed and customer contracts may be terminated.

As part of our current business model, the portion of our software that is delivered over the internet as SaaS is increasing, and we store and manage significant data for our customers, resulting in substantial information technology infrastructure and ongoing technological challenges, which we expect to continue to increase over time. If we do not reliably meet these data storage and management requirements, or if we experience any failure or interruption in the delivery of our services over the internet, customer satisfaction and our reputation could be harmed, leading to reduced revenues and increased expenses. Our hosting services are subject to service-level agreements and, in the event that we fail to meet guaranteed service or performance levels, we could be subject to customer credits or termination of these customer contracts. If the cost of meeting these data storage and management requirements increases, our results of operations could be harmed.

Some of our software solutions utilize third-party open source software, and any failure to comply with the terms of one or more of these open source licenses could adversely affect our business, subject us to litigation and create potential liability.

Some of our software solutions utilize software covered by open source licenses, and we expect to continue to incorporate open source software in our solutions in the future. Open source software is typically freely accessible, usable and modifiable, and is used by our development team in an effort to reduce development costs and speed up the development process. Use of open source software also in some respects entails greater risks than use of third party commercial software, as open source licensors generally do not provide warranties or other contractual protections regarding infringement claims or the quality of the code, including with respect to security vulnerabilities.

Although we have processes intended to fully comply with all license requirements in our software, certain open source software licenses require, among other things, that a licensor that distributes the open source software as a component of the licensor’s proprietary software to provide or offer to provide to the customer-licensee part or all of the source code to the licensor’s proprietary software. If the owner of the copyright of the relevant open source software were to allege that we had not complied with the conditions of one or more of these licenses, we could be required to incur significant legal expenses defending against such allegations and could be subject to significant damages, enjoined from the sale of our solutions that contain the open source software and required to comply with onerous conditions or restrictions on these solutions, which could disrupt the distribution and sale of these solutions. Litigation or other enforcement actions initiated by a copyright owner could have a negative effect on our business, financial condition and results of operations, or require us to devote additional R&D resources to change our solutions. Moreover, we could effectively be required to publicly release the affected portions of our source code, re-engineer all or a portion of our solutions or otherwise be limited in the licensing of our solutions, each of which could reduce or eliminate the value of our solutions. Disclosing our proprietary source code could allow our competitors to create similar products with lower development effort and time and ultimately could result in a loss of sales. Any of these events could create liability for us and damage our reputation, which could have a material adverse effect on our revenue, business, results of operations and financial condition and the market price of our shares.

Table of Contents

If our security measures are breached or unauthorized or unlawful access to customer or other proprietary data occurs, our solutions may be perceived as not being secure, customers may reduce the use of or stop using our solutions and we may incur significant liabilities.

The evolution of technology systems introduces ever more complex security risks that are difficult to predict and defend against. An increasing number of companies, including those with significant online operations, have recently disclosed breaches of their security, some of which involved sophisticated tactics and techniques allegedly attributable to criminal enterprises or nation-state actors. While we believe that we have taken appropriate measures to prevent unintended access to the data we hold (including implementing security and privacy controls, training our workforce and implementing new technology) and we continue to improve and enhance our systems in this regard, our efforts may not always be successful. In addition, cybersecurity threats are constantly evolving, are becoming more frequent and more sophisticated and are being made by groups of individuals with a wide range of expertise and motives, which increases the difficulty of detecting and successfully defending against them. Accordingly, we do not know whether our current practices will be deemed sufficient under applicable laws or whether new regulatory requirements might make our current practices insufficient.

Our solutions involve the collection, analysis and retention of our customers’ proprietary information related to their drug development efforts, including clinical data. Unauthorized access to this information or data, whether deliberate or unintentional, could result in the loss of information, litigation, indemnity obligations, damage to our reputation and other liability. Our reliance on remote access to our information systems exposes us to potential cybersecurity breaches and the risk of loss or exposure of such information and data. Additionally, we rely on third parties and their security procedures for the secure storage, processing, maintenance, and transmission of information that is critical to our operations and such third- parties may also suffer cybersecurity incidents. Depending on their nature and scope, this could potentially result in the misappropriation, destruction, corruption or unavailability of critical data and confidential or proprietary information (our own or that of third parties, including information about our customers and employees) and the disruption of business operations.

If there is a cybersecurity incident and we know or reasonably suspect that certain personal information has been subject to unauthorized or unlawful access or use, we may need to inform the affected individuals and may be subject to significant fines and penalties. Further, under certain regulatory schemes, such as the CCPA, individual California residents may bring private claims for our failure to deploy reasonable and appropriate cybersecurity controls and we also may be liable for statutory and multiple damages in California and other states. Further, if our technical and operational safeguards fail, our existing and prospective customers may lose confidence in our ability to maintain the confidentiality of their intellectual property and other proprietary data, we may be subject to breach of contract claims by our customers and we may suffer reputational and other harm as a result. Our insurance may not be adequate to cover losses associated with such events, and in any case, such insurance may not cover all of the types of costs, expenses and losses we could incur to respond to and remediate a security breach. Defending against investigations, claims or litigation based on any security breach or incident, regardless of their merit, will be costly and may cause reputation harm. The successful assertion of one or more large claims against us that exceed available insurance coverage, denial of coverage as to any specific claim, or any change or cessation in our insurance policies and coverages, including premium increases or the imposition of large deductible requirements, could have a material adverse effect on our reputation, business, financial condition and results of operations.

Table of Contents

We are subject to numerous privacy and cybersecurity laws and related contractual requirements and our failure to comply with those obligations could cause us significant harm, including financial losses and reputational harm.

In the normal course of our business, we collect, process, use and disclose information about individuals, including protected health information and other patient data, as well as information relating to health professionals and our employees. The collection, processing, use, disclosure, disposal and protection of such information is highly regulated both in the U. S. and other jurisdictions, including but not limited to, under HIPAA, as amended by HITECH; United States state privacy, security and breach notification and healthcare information laws; the European Union’s GDPR, UK GDPR, and other European and UK privacy laws, as well as the expanding number of privacy laws around the world, including China and Canada. These laws are complex and their interpretation is rapidly evolving, making implementation and enforcement, and thus compliance requirements, uncertain and potentially inconsistent. In addition, our collection, use, disclosure, protection and other processing of information is subject to related contractual requirements. Compliance with such laws and related contractual requirements may require changes to our information processing practices, and may thereby increase compliance costs. Failure to comply with such laws and/or related contractual obligations could result in regulatory enforcement or claims against us for breach of contract, or may lead third parties to terminate their contracts with us and/or choose not to work with us in the future. Should this occur, there could be a material adverse effect on our reputation, business, financial condition, and results of operations.

These regulations often govern the handling of information about individuals, including personal health information and require the use of standard contracts, privacy and security standards and other administrative simplification provisions. In relation to HIPAA, we do not consider our service offerings to generally cause us to be subject as a covered entity; however, in certain circumstances, we are subject to HIPAA as a business associate and may enter into business associate agreements.

Additionally, the FTC and many state attorneys general are interpreting existing federal and state consumer protection laws to impose evolving standards for the online collection, use, dissemination and security of information about individuals, including health-related information. Courts may also adopt the standards for fair information practices promulgated by the FTC, which concern consumer notice, choice, security and access. Consumer protection laws require us to publish statements that describe how we handle information about individuals and choices individuals may have about the way we handle their information. If such information that we publish is considered untrue, we may be subject to government claims of unfair or deceptive trade practices, which could lead to significant liabilities and consequences. Furthermore, according to the FTC, violating consumers’ privacy rights or failing to take appropriate steps to keep information about consumers secure may constitute unfair acts or practices in or affecting commerce in violation of Section 5(a) of the FTC Act.

In addition, certain states have adopted robust privacy and security laws and regulations. Such laws and regulations will be subject to interpretation by various courts and other governmental authorities, thus creating potentially complex compliance issues for us and our future customers and strategic partners. For example, the CCPA, imposes obligations and restrictions on businesses regarding their collection, use, and sharing of personal information and provides new and enhanced data privacy rights to California residents, such as affording them the right to access and delete their personal information and to opt out of certain sharing of personal information. Protected health information that is subject to HIPAA is excluded from the CCPA, however, information we hold about individuals that is not subject to HIPAA would be subject to the CCPA. It is unclear how HIPAA and the other exceptions may be applied under the CCPA. The CCPA may increase our compliance costs and potential liability. Many similar privacy laws have been proposed at the federal level and in other states.

Table of Contents

The GDPR and the UK GDPR regulate our processing of personal data, and imposes stringent requirements. Failure to comply with the GDPR or UK GDPR may result in fines up to the greater of €20 million or 4.0% of worldwide gross annual revenue and applies to services providers such as us under each of GDPR and UK GDPR.

There is uncertainty regarding transfers of personal data from the EEA to the United States, including regarding the status and enforceability of the EU-US Privacy Shield Framework (“Privacy Shield”) under which personal data could be transferred from the EEA to U.S. entities who had self-certified under the Privacy Shield scheme. While the Court of Justice of the European Union (CJEU) upheld the adequacy of the standard contractual clauses (a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism, and potential alternative to the Privacy Shield), it made clear that reliance on them alone may not necessarily be sufficient in all circumstances; and the validity of the standard contractual clauses as a transfer mechanism remains uncertain. We have previously relied on our own Privacy Shield certification and our relevant customers’ and third parties’ Privacy Shield certification(s) for the purposes of transferring personal data from the EEA to the United States in compliance with the GDPR’s data export conditions. We also currently rely on the standard contractual clauses to transfer personal data outside the EEA, including to the United States. If all or some jurisdictions within the European Union or the United Kingdom determine that the standard contractual clauses do not provide sufficient safeguards to transfer personal data to the United States, our ability to effect cross-border transfers of personal data will be severely limited or cause us to need to establish systems to maintain certain data in the EEA or UK, and thereby divert resources from other aspects of our operations, all of which may adversely affect our business or we may face governmental enforcement actions, litigation, fines and penalties or adverse publicity, which could have an adverse effect on our reputation and business.

We believe we maintain adequate processes and systems in compliance with the requirements of the GDPR and UK GDPR, but it is possible that we could fail to comply or that we could incur liability due to the acts or omissions of our vendors. In the event we are not able to secure indemnification or the indemnification and any insurance coverage is inadequate to cover our losses, we could suffer significant financial, operational, reputational and other harm and our business, results of operations, financial condition and/or cash flows could be materially adversely affected. Furthermore, as supervisory authorities issue further guidance on personal data export mechanisms, including circumstances where the standard contractual clauses cannot be used, and/or start taking enforcement action, we could suffer additional costs, complaints and/or regulatory investigations or fines, and/or if we are otherwise unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we provide our services, the geographical location or segregation of our relevant systems and operations, and could adversely affect our financial results.

Privacy and data security laws are rapidly evolving both in the United States and internationally, and the future interpretation of those laws is somewhat uncertain. Additional legislation or regulation might, among other things, require us to implement new security measures and processes or bring within the legislation or regulation de-identified health or other information about individuals, each of which may require substantial expenditures or limit our ability to offer some of our services.

We may be unable to adequately enforce or defend our ownership and use of our intellectual property and other proprietary rights.

CERT US Equity

CERT · 10-K · period ended 2023-12-31

Item 1. Business.

Item 1A. Risk Factors.

CERT US Equity☆

CERT · 10-K · period ended 2023-12-31

Item 1. Business.

Item 1A. Risk Factors.

CERT US Equity