ITEM 1A. RISK FACTORS

Summary of Risk Factors

Investing in our common stock involves a high degree of risk. You should carefully review the “Risk Factors” section before you invest in shares of our common stock. Listed below are some of the more significant risks relating to an investment in our common stock.

Risks Related to Our Business

•Our financial results currently depend mainly on sales of our Decipher Prostate and Afirma tests, and we may not generate sufficient revenue from these and our other diagnostic tests to grow our business.

•If we are unable to grow sales of our tests or products, or we are unable to launch or commercialize our new tests or products, our business may suffer.

•We have incurred losses in the past, we could incur net losses in the future, and we may not sustain our level of profitability in the future.

•We depend on a few payers for a significant portion of our revenue; if one or more significant payers stops providing reimbursement or decreases the amount of reimbursement for our tests our revenue could decline.

•If payers do not provide reimbursement, rescind or modify their reimbursement policies, delay payments for our tests, recoup past payments, or if we are unable to successfully negotiate additional reimbursement contracts, our commercial success could be compromised.

•We may experience limits on our revenue if physicians decide not to order our tests or if patients decide not to use our tests as a result of increased costs, fees or changing insurer policies.

•If we fail to comply with federal, state and foreign licensing requirements, we could lose the ability to perform our tests or experience disruptions to our business.

•We have engaged, and may continue to engage, in acquisitions, dispositions or other strategic transactions that could disrupt our business, cause dilution to our stockholders or reduce our financial resources. If our general strategy of seeking incremental growth through acquisitions and collaborations is not successful, or if we do not successfully integrate companies or assets that we acquire into our business, our prospects and financial condition may suffer.

•Our future success and international growth depend, in part, on our ability to adapt, manufacture and distribute our tests as IVD tests.

•We rely on sole suppliers for some of the reagents, equipment, and other materials used to perform or develop our tests, as well as certain sole source providers for kit components, instruments and associated services. We may not be able to find replacements or transition to alternative suppliers or service providers, which may materially impact our ability to generate revenue.

•We may be unable to manage our future growth effectively, which could make it difficult to execute our business strategy.

•If we are unable to support demand for our tests, products or services, our business could suffer.

•Changes in healthcare policy, including legislation reforming the U.S. healthcare system, recent U.S. judicial decisions and potential changes in the regulatory environment, may have a material adverse effect on our financial condition and operations.

•If the FDA or other foreign authorities regulate those of our tests that they do not currently regulate, we could incur substantial costs and delays associated with trying to obtain premarket clearance, approval or certification.

•Obtaining marketing authorization or certification by the FDA and foreign regulatory authorities or notifying regulatory bodies for our diagnostic tests will take significant time and require significant research, development and clinical study expenditures and ultimately may not succeed.

•If we are unable to compete successfully, we may be unable to increase or sustain our revenue and profitability.

•We depend on our senior management team, and the loss of one or more of our executive officers, or the inability to attract and retain highly skilled employees or other key personnel in our highly competitive industry, could adversely affect our business.

•Billing for our diagnostic tests is complex, and we must dedicate substantial time and resources to the billing process in order to collect cash and be paid.

Table of Contents

•If our internal sales force is less successful than anticipated, our business expansion plans could suffer and our ability to generate revenue could be diminished.

•Developing, commercializing and gaining reimbursement for new products involves a lengthy and complex process, and if we do not achieve our projected development, commercialization and reimbursement goals in the timeframes we announce and expect, our business may suffer, and our stock price may decline.

•Aspects of our international business expose us to business, personnel, regulatory, political, operational, financial, and economic risks associated with doing business outside of the United States.

•Security breaches, loss of data and other disruptions to our or our third-party service providers' data systems could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation.

•Risks associated with data privacy issues, including evolving laws, regulations and associated compliance efforts, may adversely impact our business and financial results.

•If we are unable to protect or successfully defend our intellectual property effectively, our business may be harmed.

•We may be involved in litigation related to intellectual property, which may be time-intensive and costly and may adversely affect our business, operating results or financial condition.

Risks Related to Being a Public Company

•If we are unable to maintain effective internal control over financial reporting, investors may lose confidence in the accuracy and completeness of our reported financial information and the market price of our common stock may be negatively affected.

Risks Related to Our Common Stock

•Our stock price may be volatile, and you may not be able to sell shares of our common stock at or above the price you paid.

Risks Related to Our Business

Our financial results currently depend mainly on sales of our Decipher Prostate and Afirma laboratory developed tests (LDTs), and we may not generate sufficient revenue from these and our other diagnostic tests to grow our business.

Most of our revenue to date has been derived from sales of our Decipher Prostate and Afirma laboratory developed tests (LDTs), which are used in the diagnosis of urological and thyroid cancers. Over the next few years, we expect to continue to derive a substantial portion of our revenue from sales of our Decipher Prostate and Afirma laboratory developed tests (LDTs) as well as our Prosigna LDT, MRD (LDT) and IVD strategies. Once our tests are clinically validated and commercially available for patient testing, we must continue to develop and publish evidence that our tests are informing clinical decisions in order for them to receive positive coverage decisions by payers. Without coverage policies, our tests may not be reimbursed and we will not be able to recognize revenue. While Afirma is covered by most major payers in the U.S., there remains payers that do not cover Decipher Prostate. We cannot guarantee that our tests we commercialize will maintain positive coverage decisions. If we are unable to maintain or increase sales and maintain or expand reimbursement for our Decipher Prostate and Afirma tests, our revenue and our ability to sustain profitability would be impaired, and the market price of our common stock could decline.

If we are unable to grow sales of our tests or products, or we are unable to launch or commercialize our new tests or products, our business may suffer.

We plan to launch the Prosigna LDT and our first indication of TrueMRD in MIBC in 2026. While we do not expect these tests to contribute meaningfully to revenue in 2026, our inability to successfully commercialize these tests or obtain adequate reimbursement could negatively affect our future revenue growth and impact our ability to achieve our revenue projections in future years. Additionally, our Prosigna IVD and Decipher Bladder test have not contributed significant revenue to date. Although we expect them to grow and become an increasingly important component of our portfolio, as well as our results of operations, we may be unable to increase sales or expand reimbursement, and therefore we may not meet our revenue projections. Additionally, we anticipate further expanding the reach of some of our tests in international markets; if our products are not widely adopted internationally, our business and results of operations may be adversely affected.

Table of Contents

We are in various stages of research and development for other diagnostic tests that we may offer, but there can be no assurance that we will be able to identify other diseases that can be effectively addressed or, if we are able to identify such diseases, whether or when we will be able to successfully commercialize solutions for these diseases and obtain the evidence and coverage decisions from payers. For example, we plan to introduce new tests going forward, including in MRD as a result of the C2i Acquisition, as well as our Percepta Nasal Swab. There can be no assurance that we will be successful in our launch or commercialization of new tests, nor that physicians will request our new tests be performed in sufficient volumes to realize revenue.

We have incurred losses in the past, we could incur net losses in the future and we may not sustain our level of profitability in the future.

For the year ended December 31, 2025, we had a net income of $66.4 million and as of December 31, 2025, we had an accumulated deficit of $377.6 million. Although we recorded net income in 2025 and 2024, we have recorded net loss in prior years, and we may be unable to sustain profitability in the future. Ongoing widespread inflationary pressures in the United States and across global economies have resulted in higher costs for our raw materials, non-material costs, labor and other business costs, and significant increases in the future could adversely affect our results of operations. We may not sustain or grow past our current levels of profitability, and our failure to do so in the future could cause the market price of our common stock to decline.

In addition, our ability to sustain profitability depends on a number of factors, including but not limited to:

•generating sufficient revenue from our existing diagnostic tests;

•developing and publishing evidence that our tests are informing clinical decisions and receiving positive coverage decisions by payers;

•launching and commercializing new tests and products;

•maintaining effective relationships with our payers; and

•receiving regulatory approval for our tests and products.

We depend on a few payers for a significant portion of our revenue; if one or more significant payers stops providing reimbursement or decreases the amount of reimbursement for our tests, our revenue could decline.

We receive a significant portion of our revenue from a limited number of third-party payers, some of which have not contracted with us to be a participating provider. See Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations – Financial Overview. The percentage of our revenue derived from our significant payers, such as Medicare and UnitedHealthcare Group, is expected to fluctuate from period to period as our revenue fluctuates, as additional payers provide reimbursement for our tests or if one or more payers were to stop reimbursing for our tests or change their reimbursed amounts.

Federal Medicare funding and state budgets are limited and have been placed under tremendous strain in recent years, which is likely to be further exacerbated as a result of macroeconomic uncertainty. Such budgetary pressures may force Medicare, Medicare Advantage or state agencies to reduce payment rates or change coverage policies. If there is a decrease in Medicare or other payers’ payment rates for our tests, our revenue from Medicare and such payers will decrease and the payment rates for some of our commercial payers may also decrease if they tie their allowable rates to the Medicare rates. These changes could have an adverse effect on our business, financial condition and results of operations.

For example, Decipher Prostate is currently reimbursed by Medicare pursuant to LCDs issued by Palmetto GBA's MolDX program and adopted by Noridian Healthcare Solutions, each acting as a MAC, as well as by a number of commercial payers. However, there are many commercial payers who currently do not provide reimbursement for our prostate genomic tests, or provide only limited reimbursement, and we have contracts for reimbursement with only a limited number of commercial payers for our prostate tests. In September 2024, a new LCD for “Gene Expression Profile Tests for Decision-Making in Castration Resistant and Metastatic Prostate Cancers” was finalized through the MolDX program. In December 2024, we received confirmation that our Technical Assessment, or TA, was approved with a retroactive effective date of October 18, 2024, and the metastatic indication for Decipher is now covered by Medicare.

Table of Contents

Additionally, coverage and payment determinations for our Afirma GSC classifier are covered by Noridian Healthcare Solutions, the current MAC for our jurisdiction, through the MolDX program, administered by Palmetto GBA, under a Local Coverage Determination, or LCD. On July 28, 2024, a new LCD took effect through the MolDX program, “Molecular Testing for Risk Stratification of Thyroid Nodules,” which provides expanded Medicare coverage for Afirma GSC.

Modifications to the LCDs and associated coverage articles for Afirma, Decipher Prostate and our other tests could have an adverse effect on our business, financial condition and results of operations.

We submit claims to payers directly using CPT codes, which plays a significant role in how our tests are reimbursed both from commercial and governmental payers. Any changes to the codes or associated reimbursement rates can materially affect our revenue. For example, with the transition from Afirma GEC to Afirma GSC, a new CPT Category I code (81546) was established for the Afirma classifier, effective January 1, 2021. This code underwent the national payment determination process for Medicare in 2020, through which the Centers for Medicare & Medicaid Services, or CMS, set its reimbursement rate at $3,600 on the Clinical Laboratory Fee Schedule (CLFS), the same rate as the prior CPT code for Afirma GEC, unchanged since 2018. Similarly, Decipher Prostate was assigned a Category I CPT code (81542) in 2020. CMS included this code in the gapfill pricing process and set the final CLFS reimbursement rate for CPT code 81542 at $3,873, effective January 1, 2021. Additionally, Decipher Bladder was assigned CPT code 0016U, which CMS priced through the gapfill process, setting a final CLFS reimbursement rate of $3469.83 effective January 1, 2021. Most recently, Congress passed the Consolidated Appropriations Act, 2026, which included revisions to PAMA review cycle. The first Protecting Access to Medicare Act of 2014, or PAMA, data reporting period for CPT 81546 (Afirma GSC), CPT 81542 (Decipher Prostate), and CPT 0016U (Decipher Bladder) under the current triennial data reporting process is expected to occur between May 1 through July 31, 2026 based on the data collection period of January 1 through June 30, 2025. This could result in updated reimbursement rates effective January 1, 2027 through December 31, 2029. There is no guarantee that Medicare payment rates for Afirma GSC, Decipher Prostate, or Decipher Bladder will remain stable in future PAMA reporting cycles, as rates are based on the weighted median of private commercial payer payments.

Although we have entered into contracts with certain third-party payers that establish in-network allowable rates of reimbursement for many of our tests, payers may suspend or discontinue reimbursement at any time, with or without notice, for technical or other reasons, may require or increase co-payments from patients, or may reduce the reimbursement rates paid to us. Reductions in private payer amounts could decrease the Medicare payment rates for our tests under PAMA. In addition, many private payers now require prior authorization for molecular diagnostic tests. Potential reductions in reimbursement rates or increases in the difficulty of achieving payment could have a negative effect on our revenue.

If payers do not provide reimbursement, rescind or modify their reimbursement policies, delay payments for our tests, recoup past payments, or if we are unable to successfully negotiate additional reimbursement contracts, our commercial success could be compromised.

Our revenue and commercial success depend on achieving coverage and reimbursement for our tests from payers, including both commercial and government payers. If payers do not provide coverage of, or do not provide adequate reimbursement for our tests, we may need to seek payment from the patient, which may adversely affect demand for our tests. Physicians might not order our tests unless payers reimburse a substantial portion of the test price. There is significant uncertainty concerning third-party reimbursement of any test incorporating new technology, including our tests. Reimbursement by a payer may depend on a number of factors, including a payer’s determination that these tests are:

•not experimental or investigational;

•pre-authorized and appropriate for the specific patient;

•medically necessary;

•cost-effective;

•supported by peer-reviewed publications; and

•included in clinical practice guidelines.

For example, if we are unable to provide payers with sufficient evidence of the clinical utility and validity of our test, they may not provide coverage, may provide limited coverage or may terminate coverage, which will adversely affect our revenues

Table of Contents

and our financial condition. Since each payer makes its own decision as to whether to establish a coverage policy or enter into a contract to reimburse our tests, seeking these approvals is a time-consuming and costly process. Other countries, as well as some private payers, also control the price of health care products, directly or indirectly, through reimbursement, payment, pricing or coverage limitations, tying reimbursement to outcomes or (in the case of governmental entities) through compulsory licensing or limiting of intellectual property protections.

We are an out-of-network provider with some commercial payers in the United States and thus, we do not have control over rates or terms of reimbursement. Without contracted rates for reimbursement, our claims are often denied upon submission, and we must appeal the claims. The appeals process is time consuming and expensive and may not result in payment. In cases where we are out-of-network, there is typically a greater patient cost-share responsibility which may result in further delays and/or decreased likelihood of collection. Payers may attempt to recoup prior payments after review, sometimes after significant time has passed, which would impact future revenue.

We expect to continue to focus substantial resources on increasing adoption, coverage and reimbursement for Decipher Prostate, Afirma, Prosigna, TrueMRD and Decipher Bladder, as well as any other future tests we may develop. We believe it will take several years to achieve coverage and contracted reimbursement with most third-party payers across our entire portfolio of tests. We cannot predict whether, under what circumstances, or at what payment levels payers will reimburse for our tests. Also, payer consolidation is underway and creates uncertainty as to whether coverage and contracts with existing payers will remain in effect. Finally, if there is a decrease in the Medicare payment rates for our tests, the payment rates for some of our commercial payers may also decrease if they tie their allowable rates to the Medicare rates. Reductions in private payer amounts could also decrease the Medicare payment rates for our tests under PAMA. Our failure to establish broad adoption of and reimbursement for our tests, or our inability to maintain existing reimbursement from payers, will negatively impact our ability to generate revenue and sustain profitability, as well as our future prospects and our business.

We may experience limits on our revenue if physicians decide not to order our tests.

If we are unable to create or maintain demand for our tests in sufficient volume, we may not sustain profitability. To generate demand, we will need to continue to educate physicians about the clinical utility and cost-effectiveness of our tests through published papers, presentations at scientific conferences, marketing campaigns and one-on-one education by our sales force, which requires us to incur costs that may not result in increased demand. In addition, our ability to obtain and maintain adequate reimbursement from third-party payers will be critical to generating revenue.

In making coverage determinations, third-party payers often rely on practice guidelines issued by professional societies. Lack of guideline inclusion or recommendation could limit the adoption of our tests and our ability to generate revenue and sustain profitability, as physicians may be reluctant to order tests that are not recommended in these guidelines. Guidelines that include our tests currently may subsequently be revised to recommend another testing protocol, and these changes may result in physicians deciding not to use our tests. While the Afirma genomic classifier is included in most physician practice guidelines in the United States for the assessment of patients with thyroid nodules, historical practice recommended a full or partial thyroidectomy in cases where cytopathology results were indeterminate to confirm a diagnosis. The strength of the clinical data supporting the use of the Decipher Prostate Genomic Classifier has led to the test’s inclusion in leading clinical guidelines. For example, the Decipher Prostate test has Simon Level IB evidence, resulting in inclusion in the 2026 NCCN Guidelines for prostate cancer, distinguishing it as the only gene-expression test to do so. Nonetheless, if we are unsuccessful in maintaining the relative level of recommendation of Decipher Prostate or other of our genomic tests within these guidelines, unable to cause any new or modified genomic tests we develop to be included in these guidelines, unable to cause our genomic tests to be included in other influential guidelines, or if our competitors are successful at achieving similar or more extensive guidelines for their tests, we may be at a disadvantage in gaining market acceptance and market share relative to our competitors.

Additionally, to the extent international markets have existing practices and standards of care that are different than those in the United States, we may face challenges with the adoption of our tests in international markets. The Prosigna test is included in practice guidelines in the United States and internationally but faces competition from other products globally.

Because our Decipher Prostate Genomic Classifier, Afirma and Decipher Bladder testing services are performed by our certified laboratories under the CLIA, rather than by the local laboratory or pathology practice, pathologists may be reluctant to support our testing services as well. If physicians do not order our tests, our future revenues and results of operations would be adversely affected.

Table of Contents

We may experience limits on our revenue if patients decide not to use our tests as a result of increased costs, fees or changing payer policies.

Some patients may decide not to use our tests because of price, all or part of which may be payable directly by the patient if the patient’s insurer denies reimbursement in full or in part. There is a growing trend among insurers to shift more of the cost of healthcare to patients in the form of higher co-payments or premiums, putting patients in the position of having to pay more for our tests. In addition, volatile interest rates and ongoing inflation in the United States and globally may put further pressure on insurers and other providers to raise prices or reduce reimbursement, increasing the cost to the patient. We expect to continue to see pressure from payers to limit the utilization of tests, generally, and we believe more payers are deploying costs containment tactics, such as pre-authorization and employing laboratory benefit managers to reduce utilization rates. Payors are increasingly contracting with healthcare intermediaries like laboratory benefit managers as a way to contain healthcare costs by limiting both coverage and the level of reimbursement that may be provided to tests. Laboratory benefit managers may take steps to restrict patient access to our tests, including by not covering our tests through changes to medical policies or adding prior approval requirements before reimbursing providers or patients for using our tests. We cannot be sure that laboratory benefit managers will authorize coverage and reimbursement of our tests. Implementation of provisions of the Patient Protection and Affordable Care Act, as amended by the Health Care and Education Affordability Reconciliation Act, collectively the ACA, has also resulted in increases in premiums and reductions in coverage for some patients. These events may result in patients delaying or forgoing medical checkups or treatment due to their inability to pay for our tests, which could have an adverse effect on our revenue.

If we fail to comply with federal and state licensing requirements, we could lose the ability to perform our tests or experience disruptions to our business.

Our high complexity clinical labs that design, develop and manufacture our laboratory developed tests are subject to the Clinical Laboratory Improvement Amendment (CLIA) regulations, a federal law that regulates clinical laboratories that perform testing on specimens derived from humans for the purpose of providing information for the diagnosis, prevention or treatment of disease. CLIA regulations mandate specific personnel qualifications, facilities administration, quality systems, inspections, and proficiency testing. CLIA certification is also required for us to be eligible to bill state and federal healthcare programs, as well as many private third-party payers. To renew these certifications, we are subject to survey and inspection every two years. Moreover, CLIA inspectors may conduct random inspections of our clinical reference laboratories. If we fail to maintain CLIA certificates in our South San Francisco, California; San Diego, California; or Austin, Texas laboratory locations, we would be unable to bill for services provided by state and federal healthcare programs, as well as many private third-party payers, which may have an adverse effect on our business, financial condition and results of operations.

We are also required to maintain state licenses to conduct testing in our laboratories. The laws of California, New York, and Texas, among other states, require that we maintain a license and comply with state regulation, in addition to the federal CLIA regulation, as a clinical laboratory. Other states may have similar requirements or may adopt similar requirements in the future. In addition, all of our clinical laboratories are required to be licensed and approved by the New York State Department of Health on a test-specific basis to perform testing on specimens from New York. We have received New York State Department of Health approval for the Decipher Prostate, Afirma and Decipher Bladder tests. We will be required to obtain approval for other tests we may offer in the future. If we were to lose our CLIA certificate or California license for our South San Francisco or San Diego laboratories, or our CLIA certificate for our Austin laboratory, whether as a result of revocation, suspension, limitation or otherwise, we may experience delays in processing testing, experience increased costs, or may no longer be able to perform our molecular tests, which would eliminate our primary source of revenue and harm our business. If we were to lose our licenses issued by New York or by any other states where we are required to hold licenses, we would not be able to test specimens from those states. New tests we may develop, and modifications to existing tests, may be subject to new approvals by regulatory bodies such as the New York State Department of Health, and we may not be able to offer our new or modified tests until such approvals are received. Furthermore, certain state agencies, including the New York State Department of Health, have been experiencing delays in their response time which may cause delay in our receipt of our corresponding approvals or renewals for our tests. Any such delays or holds on our ability to test specimens could harm our business and operating results.

We have engaged, and may continue to engage, in acquisitions, dispositions or other strategic transactions that could disrupt our business, cause dilution to our stockholders or reduce our financial resources.If our general strategy of seeking

Table of Contents

incremental growth through acquisitions and collaborations is not successful, or if we do not successfully integrate companies or assets that we acquire into our business, our prospects and financial condition may suffer.

As an element of our growth strategy, we have, from time to time, pursued opportunities to license assets or purchase companies or assets that we believe would complement our current business or help us expand into new markets. For example, in the first quarter of 2024 we completed the C2i Acquisition, and we may pursue additional acquisitions of complementary businesses or assets as part of our business strategy. On August 1, 2025, we completed the divestiture of the contract manufacturing portion of our French subsidiary, Veracyte SAS, to Helio Diagnostics SAS in connection with a restructuring proceeding. Additional potential transactions that we may consider in the future include a variety of business arrangements, including spin-offs, strategic partnerships, joint ventures, restructurings, divestitures, business combinations and investments. Any such transaction could be material and could disrupt our business or change our business profile, focus or strategy significantly. This and any future acquisitions, dispositions or strategic transactions made by us also could result in significant write-offs or the incurrence of debt and contingent liabilities, any of which could harm our operating results.

We may not identify or complete these transactions in a timely manner, on a cost-effective basis, or at all, and we may not realize the anticipated benefits of any acquisition, technology license, strategic alliance, joint venture or investment. Any acquisitions or other strategic transactions we consummate may not strengthen our competitive position, and these transactions may be viewed negatively by customers or investors. To finance any acquisitions or investments, we have previously issued, and may choose in the future, to issue shares of our stock as consideration, which would dilute the ownership of our stockholders. If the price of our common stock is low or volatile, we may not be able to acquire other companies for stock. Alternatively, it may be necessary for us to raise additional funds for these activities through public or private financings, or we may decide to incur debt. Additional funds may not be available on terms that are favorable to us, or at all. If these funds are raised through the sale of equity or convertible debt securities, dilution to our stockholders could result.

There could be unanticipated adverse impacts on any strategic transactions. We could incur losses resulting from undiscovered liabilities or third-party claims of an acquired business that are not covered by any indemnification, including relating to intellectual property, current or former employees, customers or business partners, or governmental authorities. We may have failed to identify or assess the magnitude of certain liabilities, shortcomings or other circumstances prior to acquiring a new business, which could result in unexpected litigation or regulatory exposure, unfavorable accounting or tax treatment, a diversion of management’s attention and resources, and other adverse effects on our business, financial condition, and operating results. We may also obtain pre-existing contractual relationships of the acquired business that we would not have otherwise entered into, the termination or modification of which may be costly or disruptive to our business. Any dispositions may also cause us to lose revenue and may not strengthen our financial position.

Additionally, there can be no assurance that we will successfully integrate the assets acquired from such past or future acquisitions into our existing business. We may not successfully integrate the acquired business as planned (including, for example, systems integration), and we may otherwise not realize the expected return on our investments, which could adversely affect our business or operating results and potentially cause impairment to assets that we record as a part of an acquisition including intangible assets and goodwill. Integration of acquired companies or businesses we may acquire in the future also may require management resources that otherwise would be available for ongoing development of our existing business. We may have difficulties managing acquired products and tests or retaining key personnel from the acquired business. Our future successes will depend, in part, on our ability to manage an expanded business, which may pose substantial challenges for our management, such as increased costs and complexity.

We must successfully integrate our acquired businesses, such as C2i, to realize the strategic or financial goals that we currently anticipate.

We acquired C2i in early 2024 with an aim to expand our role across the cancer continuum, moving from providing early decision support to following the patient through treatment, helping to monitor the success of a therapeutic or surgical intervention, and supporting the determination of the best course of action for each patient. However, we must successfully integrate C2i to realize the strategic or financial goals that we currently anticipate.

Risks we face in connection with the integration of our acquired businesses, such as C2i, include:

•We may have difficulties integrating C2i’s whole-genome, AI-powered technology into our tests, and we may identify flawed algorithms or insufficient or biased datasets, which could adversely impact the reliability of our data

Table of Contents

and subject us to delays and competitive harm, regulatory action, or legal liability, as well as brand or reputational harm;

•Prior to its acquisition, C2i was not required to maintain internal controls that would meet the requirements of a public company. Given the limited size and scope of C2i’s operations, its inclusion in the Company’s consolidated financial statements does not have a material impact on the Company’s internal control over financial reporting. The Company has integrated C2i into its existing internal control framework where appropriate and will continue to evaluate control needs as integration activities progress;

•Our operating results or financial condition may be adversely impacted by (i) claims or liabilities related to the acquired business including, among others, claims from U.S. or international regulatory or other governmental agencies, terminated employees, current or former customers or business partners, or other third parties; (ii) unfavorable accounting treatment as a result of the acquired business’s practices; and (iii) intellectual property claims or disputes; and

•We may experience disruption in integrating key talent from the C2i Acquisition due to the ongoing conflict in the Middle East and related political, military and security conditions in and around Israel which may disrupt our Israel business activities, facilities, employees and access to electricity, gasoline, or water, as well as disrupt our ability to travel or conduct business in and out of the conflicted area.

Our future success and international growth depend, in part, on our ability to adapt, manufacture and distribute our tests as IVD tests.

Our strategy to expand into international markets depends on our ability to successfully adapt our menu of diagnostic tests as IVDs and secure necessary regulatory approvals. See Item 1. Business –Driving Global Growth with Distributed IVD Tests. Currently, the Prosigna Breast Cancer Assay is available globally as an IVD test that runs on the nCounter Analysis System platform. If we are not able to adapt our other current or future tests to be performed on IVD platforms or if our tests fail to be competitive against competing products in international markets, our prospects for growth could suffer. In addition, to the extent international markets have existing practices and standards of care that are different than those in the United States, we may face challenges with the adoption of our tests in international markets. For commercialization of our tests on other IVD platforms, we will be dependent on third parties for the support and clinical registration of their platforms as well as certain reagents, instruments, software or components.

Additionally, our success in international markets depends on the ability of our contract manufacturers to produce test kits at a quality and quantity to keep up with demand. We have and may continue to experience quality, regulatory, or manufacturing irregularities and challenges. Our contract manufacturers may fail to successfully grow manufacturing capacity needed to meet demand.

If we do not manage inventory in an effective and efficient manner, it could adversely affect our results of operations.

Many factors affect the efficient use and planning of inventory of certain components and other materials used in our manufacturing process and in our testing laboratories, such as effectiveness of predicting demand, effectiveness of manufacturing or testing to meet demand, efficiently meeting product quality and demand requirements, global supply chain issues, and expiration of materials in inventory. We may be unable to manage our inventory efficiently, keep inventory within expected budget goals, keep inventory on hand or manage it efficiently, control expired inventory or keep sufficient inventory of materials to meet product demand due to our dependence on third-party suppliers. As we introduce any new test or product, we may experience supply issues as we ramp up volumes. Finally, we cannot provide assurances that we can keep inventory costs within our target levels. Failure to do so and efficiently manage inventory may harm our long-term growth prospects.

We rely on sole suppliers for some of the reagents, equipment and other materials used to perform our tests, as well as certain sole source providers for kit components, instruments and associated services. We may not be able to find replacements or transition to alternative suppliers or service providers, which may materially impact our ability to generate revenue.

We rely on sole suppliers for critical supply of reagents, equipment and other materials and services that we use to perform our CLIA tests as well as to satisfy demand for our Prosigna test kits, service kits and service on the nCounter Analysis System. We also purchase components used in our extraction and sample collection kits from sole-source suppliers. Some of these items are unique to these suppliers and vendors and their inability to provide us with reagents that perform to

Table of Contents

specifications, could negatively impact our ability to provide timely response and reports to our customers and, as a result, may materially impact our ability to generate revenue.

If suppliers can no longer provide us with the materials we need to perform tests or produce test kits, if the materials do not meet our quality specifications or are otherwise unusable, if we cannot obtain acceptable substitute materials, or if we elect to change suppliers, a sustained interruption in test processing or system and test kit deliveries could occur, we may not be able to deliver tests to physicians or deliver patient reports or we may incur higher one-time switching costs.

For example, we rely on NanoString (now Bruker Spatial Biology as a result of Bruker Corporation’s asset acquisition of NanoString) for certain components and raw materials for the Prosigna test and nCounter service kits.

We also rely on sole service providers for certain services such as cytopathology professional diagnoses on thyroid fine needle aspiration. If any of these service providers were unable to provide the quality or quantity of services that we require, or if we were unable to agree on commercial terms and our relationships with such service providers were to terminate, our business could be harmed until we were able to secure the services of another provider. In addition, some of our software and operational support vendors and service providers represent our sole source of these services, and our ability to provide such services might be materially adversely affected if any of these parties experience or engage in operating difficulties, network or information system shutdowns or other service disruptions, or are otherwise unable to provide the services we need in a timely manner.

While we have developed alternate sourcing strategies for many materials, vendors and service providers, we cannot be certain whether these strategies will be effective or the alternative sources will be available when we need them. Moreover, the supply of key reagents and testing materials has been periodically challenged by quality of reagents received. Further, we experience supply chain disruptions, although, to date, this has not resulted in delays in our ability to return test results in a timely manner. Any such interruption may significantly affect our future revenue, cause us to incur higher costs, and harm our customer relationships and reputation. In addition, in order to mitigate these risks, we maintain inventories of these supplies at higher levels than would be the case if multiple sources of supplies were available. If our total test volume decreases or we switch suppliers, we may hold excess supplies with expiration dates that occur before use which would adversely affect our losses and cash flow position. As we introduce any new test or make changes to existing tests, we may experience supply issues as we ramp test volume.

We may be unable to manage our future growth effectively, which could make it difficult to execute our business strategy.

In addition to the need to scale our testing capacity, our future growth, including our transition to a multi-product company with international operations, will impose significant added responsibilities on management, including the need to identify, recruit, train and integrate additional employees with the necessary skills to support the growing complexities of our business, including the ongoing development of our IVD and LDT strategies, such as MRD. Rapid and significant growth may place strain on our administrative, financial and operational infrastructure. Our ability to manage our business and growth will require us to continue to improve our operational, financial and management controls, reporting systems and procedures. We have implemented an internally developed data warehouse, which is critical to our ability to track our diagnostic services and patient reports delivered to physicians, as well as to support our financial reporting systems. The time and resources required to optimize these systems is uncertain, and failure to complete optimization in a timely and efficient manner could adversely affect our operations. If we are unable to manage our growth effectively, it may be difficult for us to execute our business strategy and our business could be harmed.

If we are unable to support demand for our tests, products or services, our business could suffer.

As demand for our tests, products and services grows, we will need to continue to scale our capacity and processing technology, expand customer service, billing and systems processes, enhance our internal quality assurance program and ensure test and product continuity. We will also need additional certified laboratory scientists as well as other scientific and technical personnel to process higher volumes. We cannot assure that any increases in scale, related improvements, supply of reagents to perform testing, and quality assurance measures will be successfully implemented or that appropriate personnel will be available and able to be hired. Failure to implement necessary procedures, transition to new processes or hire the necessary personnel could result in higher costs of processing tests, quality control issues or inability to meet demand. There can be no assurance that we will be able to perform our testing or fulfill our product, testing, or service commitments on a timely basis at a level consistent with demand, or that our efforts to scale our operations will not negatively affect the quality of test results. If

Table of Contents

we encounter difficulty meeting market demand or quality standards, our reputation could be harmed and our future prospects and our business could suffer.

Further, our ability to produce total test volumes that meet customer demand is dependent upon our ability to forecast accurately and plan production capacities accordingly. However, our sales depend on physician’s ordering patterns, reimbursement, or customers’ budgets that may be subject to significant and unexpected variation, including seasonality. Any decrease in spending or change in test ordering patterns by physicians or spending priorities of our customers and potential customers could significantly reduce the demand for our products. As we expand into new geographic markets, our revenue may be impacted by seasonal trends in the different regions, the seasonality of customer budgets in those regions and the mix of domestic versus international sales. Additionally, we have growing, however limited, historical experience forecasting the direct sales of our molecular diagnostics tests and products, which makes forecasting difficult. Our inability to forecast customer demand could negatively impact our ability to meet customer demand, which can harm our operating results.

Changes in healthcare policy, including legislation reforming the U.S. healthcare system, recent U.S. judicial decisions and potential changes in the regulatory environment, may have a material adverse effect on our financial condition and operations.

In the United States and some foreign jurisdictions, there have been, and we expect there will continue to be, a number of legislative and regulatory changes to the healthcare system, including cost-containment measures that may reduce or limit coverage and reimbursement for our tests.

For example, the ACA, enacted in March 2010, made changes that significantly affected the pharmaceutical and medical device industries and clinical laboratories. Some significant measures contained in the ACA include coordination and promotion of research on comparative clinical effectiveness of different technologies and procedures, initiatives to revise Medicare payment methodologies, such as bundling of payments across the continuum of care by providers and physicians, and initiatives to promote quality indicators in payment methodologies. The ACA also includes significant fraud and abuse measures, including required disclosures of financial arrangements with physician customers, lower thresholds for violations and increasing potential penalties for such violations. Since its enactment, there have been various judicial, executive and congressional challenges to aspects of the ACA. It is unclear how any such challenges and any healthcare reform measures of the current administration, or any future presidential administration, will impact the ACA or our business. For example, a former administration issued various executive orders which eliminated cost sharing subsidies and various provisions that would impose a financial burden on states or a cost, fee, tax, penalty or regulatory burden on individuals, healthcare providers, health insurers, or manufacturers of pharmaceuticals or medical devices. Additionally, the U.S. Congress has previously introduced several pieces of legislation aimed at significantly revising or repealing the ACA. We cannot predict if, or when, the ACA will be amended, and cannot predict the impact that an amendment of the ACA will have on our business.

In addition to the ACA, various healthcare reform proposals have also periodically emerged from federal and state governments. For example, under the Budget Control Act of 2011 and its subsequent amendments, Medicare payments to providers, including payments to clinical laboratories, became subject to a reduction of up to 2% per fiscal year due to the automatic expense reductions (sequester) from April 1, 2013 until 2032 (with a temporary suspension of the sequester under the Coronavirus Aid, Relief, and Economic Security Act and subsequent legislation from May 1, 2020 through March 30, 2022, and a reduction of up to 1% from April 1, 2022 through June 30, 2022) . Reductions resulting from the congressional sequester are applied to total claims payment made by providers to Medicare; however, they do not currently result in a rebasing of the negotiated or established Medicare or Medicaid reimbursement rates.

Furthermore, state legislation on reimbursement applies to Medicaid reimbursement and managed Medicaid reimbursement rates within that state. Some states have passed or proposed legislation that would revise the reimbursement methodology for clinical laboratory payment rates under those Medicaid programs. For example, California’s Department of Health Care Services has continuously updated its methodology for clinical laboratories and laboratory services, most recently in 2023.

We cannot predict whether future healthcare initiatives will be implemented at the federal or state level, or in countries outside of the United States in which we do or may do business, or the effect any future legislation or regulation will have on us. The taxes imposed by the new federal legislation, cost reduction measures and the expansion in the role of the U.S. government in the healthcare industry may result in decreased revenue, lower reimbursement by payers for our tests or reduced medical procedure volumes, all of which may adversely affect our business, financial condition and results of operations. In

Table of Contents

addition, sales of our tests outside the United States subject our business to foreign regulatory requirements and cost-reduction measures, which may also change over time.

Ongoing calls for deficit reduction at the federal government level and reforms to programs such as the Medicare program to pay for such reductions may affect the pharmaceutical, medical device and clinical laboratory industries. Currently, clinical laboratory services are excluded from the Medicare Part B co-insurance and co-payment as preventative services. Any requirement for clinical laboratories to collect co-payments from patients may increase our costs and reduce the amount ultimately collected.

Additionally, CMS bundles payments for many clinical laboratory diagnostic tests together with other services performed during hospital outpatient visits under the Hospital Outpatient Prospective Payment System. CMS currently maintains an exemption for molecular pathology tests and “Criterion A” ADLTs from this bundling provision. It is possible that this exemption could be removed by CMS in future rule making, which might result in lower reimbursement for tests performed in this setting.

PAMA includes a substantial payment system for clinical laboratory tests under the CLFS. Under PAMA, laboratories that receive the majority of their Medicare revenue from payments made under the CLFS and the Physician Fee Schedule report on a triennial basis (or annually for ADLTs), private payer rates and volumes for their tests with specific CPT codes based on final payments made during a set data collection period. We believe that PAMA and its implementing regulations are generally favorable to us, however, there can be no assurance that the payment rate for Afirma, Decipher Prostate and Decipher Bladder will not decrease in the future or will not be adversely affected by the PAMA law and regulations. In addition, the Inflation Reduction Act of 2022 may subject certain products to government-established pricing, potentially impose rebates and subject manufacturers who fail to adhere to the government’s interpretation of the law to penalties.

In December 2016, Congress passed the 21st Century Cures Act, which, among other things, revised the process for LCDs. Additionally, effective June 11, 2017, a MAC is required to, among other things, publish a summary of the evidence that it considered when developing an LCD, including a list of sources, and an explanation of the rationale that supports the MAC’s determinations. In October 2018, CMS issued additional guidance revising the requirements for the development of LCDs. This guidance has extended the timelines for development of new LCDs and may result in impeded coverage for our test products, which could have a material negative impact on revenue.

The No Surprises Act, which took effect on January 1, 2022, prohibits an out-of-network provider from billing a patient at an amount in excess of the in-network cost sharing for services furnished with respect to a visit at certain in-network healthcare facilities. The law establishes an independent dispute resolution process between the provider and the payer to determine the appropriate payment rate to the provider. The No Surprises Act is understood to apply to laboratory tests furnished by an independent laboratory, such as our labs, with respect to a hospital visit. The No Surprises Act, and regulations and subregulatory guidance promulgated thereunder, may limit the price we charge or our ability to achieve payment in full for our testing services, which could affect our results of operations.

Further, in June 2024, the U.S. Supreme Court reversed its longstanding approach under the Chevron doctrine, which provided for judicial deference to regulatory agencies, including the FDA, in certain circumstances. As a result of this decision, there may be increased challenges to existing agency regulations and policies, and it is uncertain how lower courts will apply the decision in the context of other regulatory schemes. This decision may result in regulatory uncertainties in the healthcare industry and could impact the timely review of any regulatory filings or applications we submit to the FDA, which could negatively impact our business.

We also cannot predict the likelihood, nature or extent of government regulation that may arise from future legislation or administrative action, either in the United States or abroad. It is difficult to predict whether or how any current executive orders will be rescinded and replaced under the current administration. The policies and priorities of any administration and the U.S. Congress are unknown and could materially impact the regulations governing our business. If we are slow or unable to adapt to changes in existing requirements or the adoption of new requirements or policies or if we are not able to maintain regulatory compliance, then we may be subject to enforcement action and we may not achieve or sustain profitability.

Table of Contents

Because of Medicare billing rules, we may not receive reimbursement for all tests provided to Medicare patients.

Under previous Medicare billing rules, hospitals were required to bill for our molecular pathology tests when performed on Medicare beneficiaries who were hospital outpatients at the time of tissue specimen collection when these tests were ordered less than 14 days following the date of the patient's discharge.

In 2018, CMS revised its billing rules to allow the performing laboratory to bill Medicare directly for molecular pathology tests and Criterion A ADLTs performed on specimens collected from hospital outpatients, even when those tests are ordered less than 14 days after the date of discharge, if certain conditions are met. We believe that our Decipher Prostate, Afirma and Decipher Bladder classifiers, along with Prosigna, are covered by this policy. Accordingly, we bill Medicare for these tests when we perform them on specimens collected from hospital outpatients and meet the conditions set forth in CMS's revised billing rules.

This change does not apply to tests performed on specimens collected from hospital inpatients. We will continue to bill hospitals for tests performed on specimens collected from hospital inpatients when the test was ordered less than 14 days after the date of discharge.

In the CY 2020 Hospital Outpatient Prospective Payment System Proposed Rule, CMS solicited comments on potential revisions to these billing rules that could have impacted our ability to bill Medicare directly for our Decipher Prostate, Afirma and Decipher Bladder classifiers, as well as for Prosigna, when performed on specimens collected from hospital outpatients. Although these changes were not finalized, if CMS makes similar changes in the future, it could negatively impact our business.

In addition, we must maintain CLIA compliance and certification to sell our tests and be eligible to bill for diagnostic services provided to Medicare beneficiaries.

If the FDA or foreign authorities regulate those of our tests that they do not currently regulate, we could incur substantial costs and delays associated with trying to obtain premarket clearance, approval or certification.

Clinical laboratory tests have long been subject to comprehensive regulations under CLIA, as well as by applicable state laws. Most clinical diagnostic tests developed and run within a single CLIA-certified clinical laboratory are known as laboratory developed tests or LDTs. While the FDA has historically maintained its authority to regulate LDTs as devices, it has generally exercised enforcement discretion, meaning that it has not required premarket review, quality system/current Good Manufacturing Practice regulations, and other applicable medical device requirements for LDT developers and users. Certain reagents, instruments, software or components manufactured and sold by third parties and used by their customers to manufacture or perform diagnostic tests may be subject to regulation under certain circumstances. We believe that our Decipher Prostate, Afirma and Decipher Bladder classifiers, have been developed and are performed in a manner consistent with the FDA’s enforcement discretion policy concerning LDTs.

In May 2024, the FDA published a final rule to phase out its policy of enforcement discretion over LDTs, and that rule was vacated by a federal district court on March 31, 2025. As part of its current enforcement discretion policy, the FDA could still decide to pursue enforcement action at any time against LDTs that it deems to be violative of its regulations when appropriate.

While there is continued FDA enforcement discretion for our existing LDTs, if the FDA were to determine that Decipher Prostate, Afirma and Decipher Bladder classifiers, or modifications thereof, are not within the scope of the FDA's enforcement discretion policy for LDTs for any reason, including based on rules, regulations, policies or guidance, or due to changes in statute, our existing tests may become subject to extensive FDA requirements, or our business may otherwise be adversely affected and lead to potential adverse effects on our business, prospects, results of operations and financial condition. Furthermore, subject to any changes in regulation, any future Veracyte tests, not currently on market that we later develop and commercialize are likely to be subject to extensive FDA requirements, including potential pre-market review, which may adversely impact our business, prospects, results of operations and financial conditions.

If the FDA or foreign authorities were to require us to seek clearance, approval or certification for our existing LDTs that are not currently cleared, approved, or certified or any of our future products for clinical use, we may not be able to obtain such clearances, approvals or certifications on a timely basis, or at all. If premarket reviews or certifications are required, our business could be negatively impacted if we are required to stop selling our products pending their clearance, approval or

Table of Contents

certification. In addition, the launch of any new products that we develop or modifications we make to existing products could be delayed by the implementation of FDA or foreign regulations. The cost of complying with premarket review or certification requirements, including obtaining clinical data, could be significant. In addition, any future regulation by the FDA or foreign authorities could subject our business to further regulatory risks and costs.

The FDA has raised potential concerns where companies manufacture and label finished clinical test kits or clinical testing components as “research use only”, or RUO, or “investigational use only”, or IUO, and either knowingly use them or sell them for use in patient care. The FDA has taken the position that if evidence demonstrates that a product which otherwise meets the definition of a regulated medical device is inappropriately labeled as RUO or IUO, the distribution, sale, or use of the product could violate the misbranding or adulteration provisions of the FDC Act. In the EU, the IVDR expressly provides that products intended for RUO are excluded from the scope of the regulation. A product intended for RUO, without any medical purpose or objective, is therefore not considered as an IVD MD, and is not subject to compliance with the IVDR requirements. If any RUO product is integrated into an IVD MD, it must be fully assessed and documented as part of the device and comply with the IVDR. An RUO product on its own may not be used for clinical diagnostic purposes. Depending on the product in question, other regulations may be applicable to the RUO products. Some of the reagents, instruments, software or components obtained by us from suppliers for use in our products are currently labeled by those suppliers as “RUO” or “IUO”. If the FDA or foreign bodies were to determine that any of these reagents, instruments, software or components are improperly labeled as RUO or IUO and undertake enforcement actions, some of our suppliers might cease selling these reagents, instruments, software or components to us or be forced to recall them, and any failure to obtain an acceptable substitute could significantly and adversely affect our business, financial condition and results of operations, including increasing the cost of testing or delaying, limiting or prohibiting the purchase of reagents, instruments, software or components necessary to perform testing. Such actions could also lead the FDA to investigate our purchase and use of supplier products and for the Agency to question whether or not Veracyte has violated the FDC Act, which could have a material adverse affect on our business.

Failure to comply with applicable regulatory requirements of the FDA or foreign authorities could result in enforcement action, including receiving untitled or warning letters, fines, injunctions, or civil or criminal penalties. Any such enforcement action would have a material adverse effect on our business, financial condition and operations.

Obtaining marketing authorization or certification by the FDA and foreign regulatory authorities or notifying regulatory bodies for our diagnostic tests will take significant time and require significant research, development and clinical study expenditures and ultimately may not succeed.

Unless an exemption applies, before we begin to label and market some of our products for use as clinical diagnostics in the United States, we are required to obtain clearance from the FDA by submitting a premarket notification under section 510(k) of the FDC Act or 510(k), or approval from the FDA by submitting a premarket approval, or PMA. Alternatively, we may be able to obtain marketing authorization through a De Novo classification process rather than through a PMA for class I or class II devices if the 510(k) pathway is not available. Additionally, we may need to obtain the appropriate marketing clearance, approval, and authorization, as applicable, for any future tests that are offered as LDTs in accordance with the timelines provided in the policies discussed under the heading “If the FDA or other foreign authorities regulate those of our tests that they do not currently regulate, we could incur substantial costs and delays associated with trying to obtain premarket clearance, approval or certification.”

The process of obtaining a PMA is a rigorous, costly, lengthy and uncertain process. In the PMA process, the FDA must determine that a proposed device is safe and effective for its intended use based, in part, on extensive data, including, but not limited to, technical, pre-clinical, clinical study, manufacturing and labeling data. Even if the 510(k) clearance process is available, the FDA must still determine that a proposed device is “substantially equivalent” to a device legally on the market, known as a “predicate” device, in order to clear the proposed device for marketing. To be “substantially equivalent,” the proposed device must have the same intended use as the predicate device, and either have the same technological characteristics as the predicate device or have different technological characteristics and not raise different questions of safety or effectiveness than the predicate device. Clinical data is sometimes required to support a substantial equivalence determination. For lower-risk devices that would otherwise automatically be placed into Class III, which require a PMA because no predicate device is available and the devices do not fall within an existing 510(k)-exempt classification, an applicant may submit a de novo request to down classify the device into Class II or Class I, which would not require a PMA. In the de novo process, the FDA must determine that general and special controls are sufficient to provide reasonable assurance of the safety and effectiveness of a device, which is low to moderate risk and has no predicate. In other words, the applicant must justify the “down-classification”

Table of Contents

to Class I or II for a new product type, and clinical data may be required. For laboratory tests for which FDA clearance, authorization or approval is required, the FDA may also require data to support analytical and clinical validity.

Additionally, FDA guidance has stated that while there may be cases when a companion diagnostic could come to market through the 510(k) pathway, the FDA expects that most companion diagnostics will be Class III devices. It is possible that revenue from a cleared or approved beneficial or complementary IVD diagnostic device may be less than revenue from a cleared or approved IVD companion diagnostic device.

The FDA issued guidance specific to oncology companion diagnostic tests, “Developing and Labeling In vitro Companion Diagnostic Devices for a Specific Group of Oncology Therapeutic Products” in April 2020. The guidance explained that some oncology companion diagnostic tests can be developed in a way that results in labeling for a specific group of oncology therapeutic products, rather than a single therapeutic product. However, there is no assurance that we would be able to obtain clearance or approval for any of our diagnostic devices in development as a companion diagnostic device or that any such clearance or approval will occur without significant delay.

Any medical device product for which we obtain marketing authorization, including any tests that are currently offered as LDTs, would be subject to regulatory requirements that would affect how we are able to market and sell the device. The FDC Act and FDA regulations place considerable requirements on medical devices, including, but not limited to, compliance with the quality management system regulation, or QMSR, establishment registration and product listing with the FDA, and compliance with labeling, marketing, complaint handling, medical device reporting requirements, and reporting certain corrections and removals. Obtaining FDA clearance or approval for diagnostics can be expensive and uncertain, generally may take several months to several years, and generally requires detailed and comprehensive scientific and clinical data, as well as compliance with FDA regulations for investigational devices.

Outside of the 510(k) clearance for our Prosigna test required, we have limited experience in obtaining PMA approval, 510(k) clearance, or De Novo authorization from the FDA and therefore have supplemented and in the future may supplement our operational capabilities to manage the more complex processes needed to obtain and maintain marketing authorization. Notwithstanding the expense, these efforts may never result in FDA clearance or approval. Even if we were to obtain marketing authorization for each of our tests, it may not be for the uses we believe are important or commercially attractive, in which case we would not market our product for those uses.

Sales of our diagnostic tests outside the United States are subject to foreign regulatory requirements governing clinical studies, vigilance reporting, marketing approval, manufacturing, regulatory inspections, product licensing, pricing and reimbursement. These regulatory requirements vary greatly from country to country. As a result, the time required to obtain approvals or certifications outside the United States may differ from that required to obtain FDA marketing authorization, and we may not be able to obtain foreign regulatory approvals on a timely basis or at all. Marketing authorization from the FDA does not ensure approval or certification by regulatory authorities in other countries, and approval or certification by any foreign regulatory authority does not ensure marketing authorization or certifications by regulatory authorities in other countries or by the FDA. Foreign regulatory authorities could require additional testing beyond what the FDA requires. In addition, the FDC Act imposes requirements on the export of medical devices, such as labeling requirements, and foreign governments impose requirements on the import of medical devices from the United States. Failure to comply with these regulatory requirements or to obtain required approvals, clearances, and export certifications could impair our ability to commercialize our diagnostic products outside of the United States.

For instance, all IVD MDs, including our products, placed on the market in the EU must meet the general safety and performance requirements laid down in Annex I to the IVDR, including the requirement that an IVD MD must be designed and manufactured in such a way that it will not compromise the clinical condition or safety of patients, or the safety and health of users and others. In addition, the device must achieve the performances intended by the manufacturer and be designed, manufactured, and packaged in a suitable manner. To demonstrate compliance with the general safety and performance requirements and other IVDR requirements we must undergo a conformity assessment procedure, which varies according to the type of medical device and its (risk) classification.

As a general rule, demonstration of conformity of IVD MDs with the essential requirements must be based, among other things, on the evaluation of clinical data supporting the safety and performance of the products during normal conditions of use. Specifically, a manufacturer must demonstrate that the device achieves its intended performance during normal conditions of use, that the known and foreseeable risks, and any adverse events, are minimized and acceptable when weighed against the

Table of Contents

benefits of its intended performance, and that any claims made about the performance and safety of the device are supported by suitable evidence.

The EU regulatory landscape concerning medical devices has significantly changed, and the new IVDR governing IVD MDs became applicable on May 26, 2022 (subject to certain transitional provisions meaning that were such transitional provisions apply, the products can continue to be placed on the market under the IVDD for a certain period of time). The new requirements in the IVDR have a significant effect on the way we conduct our business in the EU and the EEA. In particular, substantially more IVDs require the involvement of a notified body to be able to affix a CE Mark to the product, which may lead to delay in being able to place such products on the market.

On April 5, 2017, the IVDR was adopted to establish a modernized and more robust EU legislative framework, with the aim of ensuring better protection of public health and patient safety. Unlike directives, the IVDR does not need to be transposed into national law and therefore reduces the risk of discrepancies in interpretation across the different European markets. The IVDR has increased the regulatory requirements applicable to IVD MDs in the EU and requires that we re-classify and obtain new certificates of conformity for our existing CE-marked IVD MDs subject to transitional provisions of the IVDR, meaning that where such transitional provisions apply, the products can continue to be placed on the market under the IVDD for a certain period of time. Currently Prosigna for use on the nCounter Analysis System is our only product that required recertification, which is currently in progress. For many IVD MDs, the manufacturer used to self-declare the conformity of its products with the essential requirements of the IVDD. Under the IVDR, the majority of IVD MDs now require the intervention of a notified body for conformity assessment depending on the new device classification. Notified bodies are independent organizations designated by EU member states to assess the conformity of devices before being placed on the market. Depending on the applicable conformity assessment procedure, which is primarily determined by the device’s (risk) classification, the notified body may review the technical documentation, assess the manufacturer’s quality management system and/or carry out additional assessments. If satisfied that the relevant product complies with the IVDR, then the notified body issues a certificate of conformity. The manufacturer may then apply the CE Mark to the device, which allows the device to be placed on the market throughout the EU. Complying with the stricter regulatory requirements of the IVDR, including with respect to clinical evaluation requirements, quality systems, and post-market surveillance, may require us to incur significant expenditures. If we fail to remain in compliance with applicable EU laws, we would be unable to continue to affix the CE mark to our products, which would prevent us from selling them within the EU and European Economic Area, or EEA (which consists of the 27 EU member states plus Norway, Liechtenstein and Iceland), and any other regions that tie their product registrations or regulations to the EU requirements.

The IVDR is not implemented in Great Britain. Since January 1, 2021, the Medicines and Healthcare products Regulatory Agency, or MHRA, has become the sovereign regulatory authority responsible for the Great Britain medical device market according to the requirements provided in the Medical Devices Regulations 2002 (SI 2002 No 618, as amended). The UK regulation implemented the three pre-existing EU directives, including the IVDD. Regulations require medical devices to be registered with the MHRA before being placed on the Great Britain market. See "Regulation" in Item 1 of Part I. The MHRA only registers devices where the manufacturer or their UK Responsible Person has a registered place of business in the UK. Manufacturers based outside the UK need to appoint a UK Responsible Person that has a registered place of business in the UK to register devices with the MHRA. Additionally, in Great Britain, all medical devices will require a UK Conformity Assessed, or UKCA, mark but CE marks (IVDD self-certified or IVDR issued by EU notified regulatory bodies, subject to validity of the certificate in the EU) will remain valid until June 30, 2030. Manufacturers may choose to use the UKCA mark on a voluntary basis until June 30, 2030.

The rules for placing medical devices on the Northern Ireland market differ from those in Great Britain, and the IVDR will apply in Northern Ireland. Under the terms of the Northern Ireland Protocol of the Withdrawal Agreement between the EU and UK, Northern Ireland follows EU rules on medical devices, including the IVDR when applicable. Therefore, devices marketed in Northern Ireland will require assessment according to the EU regulatory regime. Such assessment may be conducted by an EU notified body, in which case a CE mark is required before placing the device on the market in the EU or Northern Ireland. Alternatively, if a UK notified body conducts such assessment, a ‘UKNI’ mark is applied and the device may only be placed on the market in Northern Ireland and not the EU.

A mutual recognition agreement, or MRA, aligning IVD regulations between the European Union and Switzerland expired following the IVDR's May 26, 2022 date of application, impacting certification and authorized representation requirements for manufacturers. The Swiss government has issued its own Ordinance on In Vitro Diagnostic Medical Devices, or IvDO. The Swiss regulation aligns closely with the IVDR in terms of requirements for manufacturers, and follows the

Table of Contents

IVDR’s transitional timelines regarding compliance deadlines according to IVD risk classifications as well as designations of Swiss Authorized Representatives.

These modifications may have an effect on the way we intend to conduct our business in these countries. The process of obtaining approval or clearance from the FDA or foreign regulatory authorities for our future tests or with respect to enhancements or modifications to existing products, could take a significant period of time, require the expenditure of substantial resources, involve rigorous pre-clinical and clinical testing, require changes to products or result in limitations on the indicated uses of products. There can be no assurance that we will receive the required approvals, clearances or certifications for any new products or for modifications to our existing products on a timely basis or that any approval, clearance or certification will not be subsequently withdrawn or conditioned upon extensive post-market study requirements. Moreover, even if we receive FDA clearance or approval or certification from foreign bodies of new products or modifications to existing products, we will be required to comply with extensive regulations relating to the development, distribution, marketing, manufacture, adverse event reporting, recordkeeping, import and export of such products, among others, which may substantially increase our operating costs and have a material impact on our business, profits and results of operations. Failure to comply with applicable regulations could jeopardize our ability to sell our products and result in enforcement actions. Occurrence of any of the foregoing could harm our reputation, business, financial condition, results of operations and prospects.

If we are unable to obtain marketing authorizations or certifications, approvals, clearances or certifications to market Prosigna or our other IVD assays or if regulatory limitations are placed on our diagnostic kit products, our business and growth will be harmed.

While the FDA has cleared the Prosigna test for marketing in the United States, and Prosigna is CE marked, which currently permits us to market the test in the EU, and Prosigna has received marketing authorizations in selected other jurisdictions, we intend to seek regulatory authorizations or certifications for Prosigna in other jurisdictions and for IVD tests focused on other indications. We cannot guarantee that the regulatory authorization or certification for Prosigna or other tests will be granted or, if granted, will not be revoked, which could adversely impact our business, financial condition, and operations.

In addition, pursuant to our collaborations with pharmaceutical companies for the development of companion diagnostic tests for use with their drugs, we are sometimes responsible for obtaining regulatory authorizations or certifications to use the companion diagnostic tests in clinical studies as well as the authorizations or certifications to sell the companion diagnostic tests following completion of such studies. Some of the compensation we expect to receive pursuant to these collaborations is based on the receipt of authorizations or certifications. Any failure to obtain authorizations or certifications for our diagnostic kits in a particular jurisdiction.

In the EU, the IVDR has introduced a new classification system for companion diagnostics which are now specifically defined as a device which is essential for the safe and effective use of a corresponding medicinal product to: (a) identify, before and/or during treatment, patients who are most likely to benefit from the corresponding medicinal product; or (b) identify, before and/or during treatment, patients likely to be at increased risk of serious adverse reactions as a result of treatment with the corresponding medicinal product. Companion diagnostics have to undergo a conformity assessment by a notified body. Before it can issue a certificate of conformity, the notified body will have to seek a scientific opinion from the European Medicines Agency or the relevant national competent authority on the suitability of the companion diagnostic to the medicinal product concerned.

We are dependent on third-party platform and technology providers to maintain their platforms and technology in accordance with the requirements of applicable regulatory bodies. We cannot assure investors that we will be successful in obtaining or maintaining regulatory clearances, certifications, approvals, or marketing authorizations of our existing or future tests or technology, including nCounter. If we do not obtain or maintain regulatory clearances, certifications, approvals, or marketing authorizations for existing or future diagnostic kit products or technology, or expand future indications for diagnostic purposes, if additional regulatory limitations are placed on our diagnostic kit products or if we fail to successfully commercialize such products, the market potential for our diagnostic kit products would be constrained, and our business and growth prospects related to our IVD strategy would be adversely affected.

Table of Contents

We are subject to ongoing and increasingly extensive regulatory requirements, which may be subject to change, and our failure to comply with these requirements could substantially harm our business.

Certain of our products are regulated as IVD MDs, including Prosigna and the nCounter Analysis System. Accordingly, we and certain of our contract manufacturers are subject to ongoing obligations under the International Organization for Standardization, or ISO, the FDC Act and related FDA regulations, and other statutory and regulatory requirements enforced by other government authorities. These may include routine inspections by notified bodies, the FDA, CMS, and other health authorities, of our manufacturing facilities and our records for compliance with standards such as ISO 13485 and the QMSR, which establish extensive requirements for quality assurance and control as well as manufacturing and change control procedures, among other things. These inspections may include the manufacturing facilities of any suppliers. In the event that a supplier fails to maintain compliance with regulatory or our quality requirements, we may have to qualify a new supplier and could experience manufacturing delays as a result. We are also subject to other regulatory obligations, such as registration of our company offices and facilities and the listing of our devices with the FDA (and similar listings and certifications in certain other countries); continued adverse event and malfunction reporting; reporting certain corrections and removals; and labeling and promotional requirements.

For example, the FDA has recently finalized a rule to revise the QMSR under 21 CFR Part 820 to more closely align with ISO 13485:2016 but that also includes proposed clarifications and additional definitions and requirements. The revised Part 820 is now titled the Quality Management System Regulation, or QMSR, and device manufacturers must comply with the new QMSR by February 2, 2026. The promotional claims we can make for Prosigna in the United States are limited to the indications for use as cleared by the FDA or outside the United States as authorized or certified by the applicable regulatory authority. If we are not able to maintain regulatory compliance, we may not be permitted to market our medical device products and/or may be subject to enforcement actions by the FDA or other governmental authorities such as the issuance of warning or untitled letters, fines, injunctions, and civil penalties; recall or seizure of products; operating restrictions; and criminal prosecution. In addition, we may be subject to similar regulatory regimes of foreign jurisdictions as we continue to commercialize our products in new markets outside of the United States and Europe. Adverse actions in any of these areas could significantly increase our expenses and limit our revenue and profitability.

If we are unable to compete successfully, we may be unable to increase or sustain our revenue and profitability.

We operate in a highly competitive market. Growing understanding of the importance of biomarkers linked with therapy selection, response and early screening is leading to more companies offering services in genomic profiling which may lead to increased competition for our tests.

Our Decipher Prostate test faces competition from Myriad Genetics and MDx Health, which offer genomic testing for prognostic purposes within localized prostate cancer. Traditional methods used by pathologists and clinicians to estimate risk of disease progression also pose competitive threats to our business. In addition, we may face increased competition from companies that combine traditional pathology methods and new technologies such as AI and digital pathology, such as the ArteraAI Prostate Test. Technological development by others may result in our technologies, as well as tests developed using our technologies, becoming obsolete. Our competitors may be able to develop competing or superior technologies and processes and compete more aggressively and sustain that competition over a longer period of time. See “If we are unable to develop products to keep pace with rapid technological, medical and scientific change, our operating results and competitive position could be harmed.”

For our Afirma genomic classifier we face competition from companies and academic institutions that use NGS technology or other methods to measure mutational markers such as BRAF and KRAS, along with numerous other mutations. These organizations include Interpace Diagnostics Group, Inc., ThyroSeq (marketed by Sonic Healthcare Limited) and others who are developing new products or technologies that may compete with our tests.

We are not currently aware of a direct competitor offering genomic testing for prognostic purposes that matches the intended use population for the Decipher Bladder test. DNA mutational analysis and traditional clinical methods and nomograms are currently in use by physicians for similar purposes, which have been used for many years and therefore may be difficult to displace or supplement. To compete successfully, we must be able to demonstrate, among other things, that our diagnostic test results are accurate and cost effective.

Table of Contents

We believe our principal competitor in the breast cancer diagnostics market is Exact Sciences Corporation, which currently commands a substantial majority of the market. Other competitors in the breast cancer diagnostics market include Myriad Genetics, Inc. and Agendia, Inc.

As we expand our portfolio of tests, including into the MRD space, we may also face competition from companies informing treatment decisions such as Natera, Inc., Guardant Health, Inc., Exact Sciences Corporation, Personalis, Myriad Genetics, Neogenomics, Inc., Quest Diagnostics, Billion-To-One, Caris Life Sciences or TempusAI, Inc. However, we believe our primary competition in MRD for MIBC is Natera, Inc. Further, competition could also emerge using alternative samples, such as blood, urine or sputum, as well as tumor naive approaches.

In general, we also face competition from commercial laboratories, such as Laboratory Corporation of America Holdings, Quest Diagnostics, and Sonic Healthcare USA, with strong infrastructure to support the commercialization of diagnostic services. We also face potential competition from companies such as Thermo Fisher Scientific Inc., which has entered the clinical diagnostics market. Other potential competitors include companies that develop diagnostic products, such as Roche Diagnostics, a division of Roche Holding Ltd, Siemens AG and Qiagen N.V.

In addition, competitors may develop their own versions of our solutions in other countries that we may seek to enter where we do not have patents or where our intellectual property rights are not recognized. Additionally, competitors could encourage the use of their solutions by physicians in other countries.

Many of our potential competitors have widespread brand recognition and substantially greater financial, technical and research and development resources, and selling and marketing capabilities than we do. Others may develop products with prices lower than ours that could be viewed by physicians and payers as functionally equivalent to our solutions or offer solutions at prices designed to promote market penetration, which could force us to lower the list price of our solutions and affect our ability to sustain profitability. If we are unable to change clinical practice in a meaningful way or compete successfully against current and future competitors, we may be unable to increase market acceptance and sales of our products, which could prevent us from increasing our revenue or sustaining profitability and could cause the market price of our common stock to decline. As we add new tests, products and services, we will face many of these same competitive risks.

We depend on our senior management team, and the loss of one or more of our executive officers, or any inability to attract and retain highly skilled employees and other key personnel in our highly competitive industry, could adversely affect our business.

Our success depends in part on the skills, experience and performance of members of our executive management team and others in key management positions. We have in the past and may in the future experience changes in our executive management, which may be disruptive to our business. The loss of services of any of these individuals and any executive transitions may impact our ability to implement our business strategy and could have a material adverse effect on our business.

In addition, our research and development programs and commercial laboratory operations depend on our ability to attract and retain highly skilled scientists. We may not be able to attract or retain qualified scientists and technicians in the future due to the intense competition for qualified personnel among life science businesses. Our success in the development and commercialization of advanced diagnostics requires a significant medical and clinical staff to conduct studies and educate physicians and payers on the merits of our tests in order to achieve adoption and reimbursement. We are in a highly competitive industry to attract and retain this talent, and the labor market in our industry is becoming increasingly competitive. Additionally, our success depends on our ability to attract and retain qualified salespeople.

There can be no assurance that we will be successful in maintaining and growing our business. Additionally, as we increase our sales channels for new tests we commercialize, we may have difficulties recruiting and training additional sales personnel or retaining qualified salespeople, which could cause a delay or decline in the rate of adoption of our tests.

Our business requires specialized capabilities in reimbursement, billing, and other areas and there may be a shortage of qualified individuals. If we are not able to attract and retain the necessary personnel to accomplish our business objectives, we may experience constraints that could adversely affect our ability to support our research and development, clinical laboratory, sales and reimbursement, billing and finance efforts. All of our U.S. employees are at will, which means that either we or the employee may terminate their employment at any time. We do not carry key person insurance for any of our employees.

Table of Contents

Finally, we rely, in part, on equity awards to compensate and incentivize our employees to drive our further growth. As the equity capital markets have been highly volatile in recent periods and the price of our common stock has declined, certain of our employees’ equity awards have lost some or all of their value, which may limit their effectiveness as retention tools, and in the event we fail to retain such employees, may adversely affect our business, results of operations and financial condition.

Billing for our diagnostic tests is complex, and we must dedicate substantial time and resources to the billing process in order to collect cash and be paid.

Billing for clinical laboratory testing services is complex, time-consuming and expensive. Depending on the billing arrangement and applicable law, we bill various payers, including Medicare, commercial insurance companies and patients, all of which have different billing requirements. We generally bill third-party payers for our diagnostic tests and pursue reimbursement on a case-by-case basis where pricing contracts are not in place. To the extent laws or contracts require us to bill patient co-payments or co-insurance, we must also comply with these requirements. We may also face increased risk in our collection efforts, including potential write-offs of accounts receivable and long collection cycles, which could adversely affect our business, results of operations and financial condition including cash collections. Furthermore, third-party payers may reduce or refuse to pay for our tests, with or without notice.

Several factors make the billing process complex, including:

•differences between the list price for our tests and the reimbursement rates of payers;

•compliance with complex federal and state regulations related to billing government payers, such as Medicare and Medicaid, including requirements to have an active CLIA certificate;

•risk of government audits related to billing Medicare and other government payers;

•disputes among payers as to which party is responsible for payment;

•differences in coverage and in information and billing requirements among payers, including the need for prior authorization and/or advanced notification;

•the effect of patient co-payments or co-insurance;

•individual payers may argue technical contract noncompliance and withhold payment;

•challenges obtaining medical records from the ordering providers;

•changes to billing codes used for our tests;

•incorrect or missing billing information; and

•the resources required to manage the billing and claims appeals process.

We use standard industry billing codes, known as CPT codes, to bill for our tests, including cytopathology. Effective January 1, 2021, we began using the new CPT code 81546 to bill for our Afirma classifier. Effective January 1, 2020, we began using CPT code 81542 to bill for Decipher Prostate tests. Effective October 1, 2020, we began using CPT code 0016M to bill for our Decipher Bladder test. See “We depend on a few payers for a significant portion of our revenue; if one or more significant payers stops providing reimbursement or decreases the amount of reimbursement for our tests, our revenue could decline.”

The CPT codes assigned to our tests have changed and in the future can change over time. When codes change, there is a risk of an error being made in the claim adjudication process. These errors can occur with claims submission, third-party transmission or in the processing of the claim by the payer. Claim adjudication errors may result in a delay in payment processing or a reduction in the amount of the payment received. Coding changes, therefore, may have an adverse effect on our total revenue.

As we introduce new tests, we will need to add new codes to our billing process as well as our financial reporting systems. Failure or delays in effecting these changes in external billing and internal systems and processes could negatively affect our collection rates, revenue and cost of collecting. Even when we receive a designated CPT code specific to our tests, there can be no assurance that payers will recognize these codes in a timely manner or that the process of transitioning to such a code and updating their billing systems and ours will not result in errors, delays in payments and a related increase in accounts receivable balances.

Table of Contents

Correct coding is subject to the coding policies of the American Medical Association CPT Editorial Panel, or AMA CPT. With respect to claims submitted to Medicare and Medicaid, it is also subject to coding policies developed through the National Correct Coding Initiative, or NCCI. Other payers may develop their own payer-specific coding policies. The broader coding policies of the AMA CPT, NCCI, and other payers are subject to change. For instance, the NCCI maintains a Coding Policy Manual, which it updates annually. The NCCI's coding policy changes have and in the future may negatively affect our total revenue and cash flow.

Additionally, our billing activities require us to implement compliance procedures and oversight, train and monitor our employees, challenge coverage and payment denials, assist patients in appealing claims, and undertake internal audits to evaluate compliance with applicable laws and regulations as well as internal compliance policies and procedures. Payers also conduct external audits to evaluate payments, which adds further complexity to the billing process. If the payer makes an overpayment determination, there is a risk that we may be required to return some portion of prior payments we have received. Additionally, under the ACA, providers and suppliers are generally required to report and return any overpayments received from government payers under the Medicare and Medicaid programs within 60 days of identification. Failure to identify and return such overpayments exposes the provider or supplier to liability under federal false claims laws. These billing complexities, and the related uncertainty in obtaining payment for our tests, could negatively affect our revenue and cash flow, our ability to sustain profitability, and the consistency and comparability of our results of operations.

We rely on third-party providers to transmit claims to payers, and any delay in transmitting claims could have an adverse effect on our revenue.

While we manage the overall processing of claims, we rely on third-party providers to ascertain insurance eligibility,

obtain prior authorizations, transmit the actual claims to payers based on the specific payer billing format and process payments from approved claims and submit appeals for denied claims. We have agreements governing the activities of our third-party contractors, however we have limited influence over their actual performance. We have previously experienced delays in prior authorizations and claims processing when our third-party provider made changes to its invoicing system, and again when it did not submit claims to payers within the timeframe we require. If prior authorizations and claims are not submitted to payers on a timely basis or are erroneously submitted, we may experience delays in our ability to process these claims, delays in the receipt of payments from payers, or the denial of claims for lack of timely submission. Additionally, if we choose to or are required to switch to a different provider to handle insurance eligibility, prior authorization or claim submissions, we may not be able to enter into arrangements with alternative third parties or do so on commercially reasonable terms or in a time frame acceptable to us. Any such delays or denials would have an adverse effect on our revenue and our business.

If our internal sales force is less successful than anticipated, our business expansion plans could suffer and our ability to generate revenue could be diminished.

Our molecular diagnostic tests and products are sold to providers and laboratories by our direct sales team and through distributors in certain countries. If our internal sales force and distributors are not successful or fail to gain traction among our customers, we may not be able to increase market awareness and sales of our molecular diagnostic tests and products. If we fail to establish our molecular diagnostic tests and products in the marketplace, it could have a negative effect on our ability to sell both current and subsequent molecular diagnostic tests and products, thereby hindering the desired expansion of our business.

Developing, commercializing and gaining reimbursement for new products involves a lengthy and complex process, and if we do not achieve our projected development, commercialization and reimbursement goals in the timeframes we announce and expect, our business may suffer, and our stock price may decline.

From time to time, we expect to estimate and publicly announce the anticipated timing of the accomplishment of various clinical and other product development goals. The actual timing of accomplishment of these targets could vary dramatically compared to our estimates, in some cases for reasons beyond our control. We cannot be certain that we will meet our projected targets, and the commercialization of our tests may be delayed or may not occur at all. If we do not meet our publicly announced targets, our stock price may decline, and our business may suffer.

We continually seek to develop enhancements to our test offerings and additional diagnostic tests that requires us to devote considerable resources to research and development. We may face challenges obtaining sufficient numbers of samples to validate a genomic signature for our products. We must provide sufficient clinical and analytical validity, as well as clinical

Table of Contents

utility studies that meet individual payer evidence requirements to obtain reimbursement. Even after launching new products, we must complete additional studies that meet the clinical evidence required by individual payers to obtain reimbursement.

In order to develop and commercialize diagnostic tests to be run in our CLIA lab, we need to:

•expend significant funds to conduct substantial research and development;

•conduct successful analytical and clinical studies;

•scale our laboratory processes and infrastructure to accommodate new tests; and

•build the commercial, regulatory, and compliance infrastructure to market and sell new products.

Our product development process involves a high degree of risk and may take several years. Our test and product development efforts may fail for many reasons, including:

•failure to identify a genomic signature in biomarker discovery;

•inability to secure sufficient numbers of samples at an acceptable cost and on an acceptable timeframe to conduct analytical and clinical studies;

•failure of analytical validation studies; or

•failure of clinical validation or clinical utility studies to support the effectiveness of the test.

Typically, few research and development projects result in commercial products, and success in early clinical studies often is not replicated in later studies. At any point, we may abandon development of a product candidate, or we may be required to expend considerable resources repeating clinical studies, which would adversely affect the timing for generating potential revenue from a new product and our ability to invest in other products in our pipeline. If a clinical validation study fails to demonstrate the prospectively defined endpoints of the study or if we fail to sufficiently demonstrate analytical validity, we might choose to abandon the development of the product, which could harm our business. If a clinical utility study fails to demonstrate the value of a particular test, we may not be able to obtain reimbursement for the test. In addition, competitors may develop and commercialize competing products or technologies faster than us or at a lower cost.

If we are unable to develop products to keep pace with rapid technological, medical and scientific change, our operating results and competitive position could be harmed.

In recent years, there have been numerous advances in technologies relating to diagnostics, particularly diagnostics that are based on genomic information. These advances require us to continuously develop our technology and to work to develop new solutions to keep pace with evolving standards of care. Our solutions could become obsolete unless we continually innovate and expand our product offerings to include new clinical applications. A significant aspect of our business is our investment in development activities, including activities related to the development of new tests and modifications and enhancements to our current tests, including the ongoing development of our LDT and IVD strategies, such as MRD and Prosigna LDT. If we are unable to respond timely to technological, medical and scientific advances or develop new products or to demonstrate the applicability of our products for other diseases, our sales could decline, and our competitive position could be harmed.

Complying with numerous statutes and regulations pertaining to our business is an expensive and time-consuming process, and any failure to comply could result in substantial penalties.

Our operations are subject to other extensive federal, state, local, and foreign laws and regulations, all of which are subject to change. These laws and regulations currently include, among others:

•HIPAA, which established comprehensive federal standards with respect to the privacy and security of protected health information and requirements for the use of certain standardized electronic transactions, and amendments made to those standards in 2013 pursuant to the HITECH Act, which strengthened and expanded HIPAA privacy and security compliance requirements, increased penalties for violators, extended enforcement authority to state attorneys general, and imposed new requirements for breach notification;

•Medicare billing and payment regulations applicable to clinical laboratories, including requirements to have an active CLIA certificate;

Table of Contents

•the Federal Anti-kickback Statute (and state equivalents), which prohibits knowingly and willfully offering, paying, soliciting, or receiving remuneration, directly or indirectly, in exchange for or to induce either the referral of an individual, or the furnishing, arranging for, or recommending of an item or service that is reimbursable, in whole or in part, by a federal healthcare program;

•the Eliminating Kickbacks in Recovery Act of 2018, which prohibits the solicitation, receipt, payment or offering of any remuneration in return for referring a patient or patronage to a recovery home, clinical treatment facility, or laboratory for services covered by both government and private payers;

•the Federal Physician Self-Referral Law (or the “Stark law” and state equivalents), which prohibits a physician from making a referral for certain designated health services covered by the Medicare program, including laboratory and pathology services, if the physician or an immediate family member has a financial relationship with the entity providing the designated health services, unless the financial relationship falls within an applicable exception to the prohibition;

•the Federal Civil Monetary Penalties Law, which prohibits, among other things, the offering or transfer of remuneration to a Medicare or state healthcare program beneficiary if the person knows or should know it is likely to influence the beneficiary’s selection of a particular provider, practitioner, or supplier of services reimbursable by Medicare or a state healthcare program, unless an exception applies;

•the Federal False Claims Act, which imposes liability on any person or entity who knowingly presents, or causes to be presented, a false, fictitious, or fraudulent claim for payment to the federal government;

•the Physician Payments Sunshine Act, enacted as part of the ACA, which imposes annual reporting requirements on manufacturers of certain devices, drugs and biologics for certain payments and transfers of value by them and in some cases their distributors to covered recipients, including physicians, as defined by such law, teaching hospitals, and certain healthcare providers as well as ownership or investment interests that physicians or physicians’ immediate family members hold with the reporting entity;

•other federal and state fraud and abuse laws, such as anti-kickback laws, prohibitions on self-referral, fee-splitting restrictions, prohibitions on the provision of products at no or discounted cost to induce physician or patient adoption, and false claims acts, which may extend to services reimbursable by any third-party payer, including private insurers;

•the prohibition on reassignment of Medicare claims, which, subject to certain exceptions, precludes the reassignment of Medicare claims to any other party;

•the Protecting Access to Medicare Act of 2014, which requires us to report private payer rates and test volumes for specific CPT codes on a triennial basis and imposes penalties for failures to report, omissions, or misrepresentations;

•the No Surprises Act, which prohibits an out-of-network provider from billing a patient at an amount in excess of the in-network cost sharing for services furnished with respect to a visit at certain in-network healthcare facilities, as well as various state laws restricting balance billing of patients;

•the rules regarding billing for diagnostic tests reimbursable by the Medicare program, which prohibit a physician or other supplier from marking up the price of the technical component or professional component of a diagnostic test ordered by the physician or other supplier and supervised or performed by a physician who does not “share a practice” with the billing physician or supplier;

•state laws that prohibit other specified practices related to billing such as billing physicians for testing that they order, waiving co-insurance, co-payments, deductibles, and other amounts owed by patients, and billing a state Medicaid program at a price that is higher than what is charged to other payers;

•the Foreign Corrupt Practices Act of 1977, and other similar anti-bribery and anti-corruption laws, which apply to our business activities;

•in California, the Private Attorneys General Act, or PAGA, which empowers employees to bring representative actions for alleged violations of the California Labor Code. As a California-based employer, we face heightened legal and financial exposure under PAGA, including exposure related to scale and complexity of class actions, statutory PAGA penalties, and compliance and defense burden of such claims;

•unclaimed property (escheat) laws and regulations, which may require us to turn over to governmental authorities the property of others held by us that has been unclaimed for a specified period of time;

•enforcing our intellectual property rights; and

•foreign laws and regulations equivalent to the above.

Table of Contents

We have adopted policies and procedures designed to comply with applicable laws and regulations. In the ordinary course of our business, we conduct internal reviews of our compliance with these laws. Our compliance with some of these laws and regulations is also subject to governmental review. The growth of our business, sales organization and our expansion outside of the United States may increase the potential of violating these laws or our internal policies and procedures. We believe that we are in material compliance with all statutory and regulatory requirements, but there is a risk that one or more government agencies could take a contrary position.

In recent years U.S. Attorneys’ Offices have increased scrutiny of the healthcare industry, as have Congress, the Department of Justice, the Department of Health and Human Services’ Office of the Inspector General and the Department of Defense. These bodies have issued subpoenas and other requests for information to conduct investigations of, and commenced civil and criminal actions against, healthcare companies based on financial arrangements with health-care providers (including physicians and labs), regulatory compliance, product promotional practices and documentation, and coding and billing practices. Whistleblowers have filed numerous qui tam lawsuits against healthcare companies under the federal and state False Claims Acts in recent years, in part because the whistleblower can receive a portion of the government’s recovery under such suits. The scope for whistleblower rewards expanded in 2024 under the Department of Justice’s Corporate Whistleblower Awards Pilot Program, which allows a whistleblower to potentially receive an award for reporting healthcare fraud schemes targeting private insurers not subject to qui tam recovery under the False Claims Act.

Several EU member states have adopted specific anti-gift-type statutory restrictions or regulated payments and transfers of values to healthcare professionals and entities, which further limits commercial practices for medical devices (including IVD MDs). Additionally, several EU member states have adopted national “Sunshine Acts” which impose reporting and transparency requirements (often on an annual basis), similar to the requirements in the United States, on medical device manufacturers.

These laws and regulations are complex and are subject to interpretation by the courts and by government agencies, and it is difficult to ensure that all our employees, agents, contractors, vendors, licensees, partners or collaborators will comply, or have historically complied, with all applicable laws and regulations. If one or more such agencies alleges that we may be in violation of any of these requirements, regardless of the outcome, it could damage our reputation and adversely affect important business relationships with third parties, including managed care organizations and other commercial third-party payers. Any action brought against us for violation of these or other laws or regulations, even if we successfully defend against it, could cause us to incur significant legal expenses and divert our management’s attention from the operation of our business. If our operations are found to be in violation of any of these laws and regulations, we may be subject to applicable penalties associated with the violation, including civil and criminal penalties, damages and fines, we could be required to refund payments received by us, and we could be required to curtail or cease our operations. Any of the foregoing consequences could seriously harm our business and our financial results.

If we use hazardous materials in a manner that causes contamination, infection or injury, we could be liable for resulting damages.

Our operations generate or require the use of regulated hazardous materials and biohazardous waste, including chemicals, biological agents, compounds and human samples. We are subject to federal, state and local laws, rules and regulations governing the use, discharge, storage, handling and disposal of biological material, chemicals and waste. We cannot eliminate the risk of accidental contamination, infection or injury to employees or third parties from the use, storage, handling or disposal of these materials. We rely on qualified licensed service providers for the disposal of these materials, and any mishandling could result in liability. In the event of contamination, infection or injury, we could be held liable for any resulting damages, remediation costs and any related penalties or fines, and any liability could exceed our resources or any applicable insurance coverage we may have. The cost of compliance with these laws and regulations may become significant, and our failure to comply may result in substantial fines or other business or reputational consequences, any of which could negatively affect our operating results.

Aspects of our international business expose us to business, regulatory, political, operational, financial and economic risks associated with doing business outside of the United States.

Our business strategy currently includes international presence and expansion in select countries and may include developing and maintaining physician outreach and education capabilities outside of the United States, establishing agreements with laboratories, and expanding our relationships with international payers. For example, in 2024, we acquired C2i, an

Table of Contents

oncology diagnostics company based in Tel Aviv, Israel, with global operations. Doing business internationally involves a number of risks, including:

•multiple, conflicting and changing laws and regulations such as tax laws, privacy laws, export and import restrictions, employment laws, regulatory requirements and other governmental approvals, permits and licenses;

•potential disruptions to the development and launch of additional products or services as a result of having technology and research and development operations in Israel, including disruptions related to maintaining key research and development employees in Israel and the potential impact of the escalating hostilities in the Middle East on operations and business continuity as well as Company personnel who are performing, or on reserve to perform, military services as a result of such conflict;

•failure by us to obtain regulatory approvals, authorizations, or certifications where required for the use of our solutions in various countries;

•complexities associated with managing multiple payer reimbursement regimes, rebate requirements, government payers or patient self-pay systems, including payers mandating additional evidence requirements for reimbursement consideration;

•disagreements, challenges, work stoppage, labor shortages, strikes or other labor unrest, and litigation;

•logistics and regulations associated with shipping tissue samples, including infrastructure conditions and transportation delays;

•challenges associated with establishing laboratory partners, including proper sample collection techniques, management of supplies, sample logistics, billing and promotional activities;

•difficulties in staffing and managing foreign operations;

•limits on our ability to penetrate international markets if we are not able to process tests locally;

•financial risks, such as longer payment cycles, difficulty in collecting from payers, the effect of local and regional financial crises, and exposure to foreign currency exchange rate fluctuations;

•changes in international trade policies, including tariffs, sanctions, or other import or export restrictions;

•natural disasters, political and economic instability, including wars, terrorism, political unrest and other regional conflicts, outbreak of disease, including pandemics, boycotts, curtailment of trade and other business restrictions (including as a direct or indirect result of the conflict in Ukraine); and

•regulatory and compliance risks that relate to maintaining accurate information and control over activities that may fall within the purview of the Foreign Corrupt Practices Act of 1977, including both its books and records provisions and its anti-bribery provisions.

Any of these factors could significantly harm our future international expansion and operations and, consequently, our revenue and results of operations.

We have operations located in Israel, and conflict in the Middle East and any additional escalations of hostilities may cause interruption or suspension of this site without warning, or otherwise negatively impact the global economy or our business.

As part of the C2i Acquisition, we acquired assets and employees based in Israel. As of December 31, 2025, the conflicts in the Middle East have not impacted our operations. Although a ceasefire has been in place since October 2025, the situation remains volatile. The short and long-term implications of the Israel-Hamas war remains difficult to predict at this time, including the intensity, duration, and expansion of the war in other regions in the Middle East. The conflict has the potential to disrupt operations and business continuity, including physical damage or impaired access to Company facilities, offices, or technology and disruptions in access to electricity, gasoline, or water, as well as potential impact on our key employees located in Israel, such as the mobilization of employees who are members of the Israeli military reserves to active duty, disrupted communication with employees and restrictions on movement in areas subject to armed conflict. Additionally, a prolonged conflict may impact the global economy and result in, among other things, increased inflation, supply chain shortages and declines in economic growth. The war may also have the effect of heightening other risks to our business including, but not limited to, adverse effects on macroeconomic conditions, including inflation; disruptions to our global technology infrastructure, including through cyberattack, ransom attack, or cyber-intrusion; adverse changes in international trade policies and relations; disruptions in global supply chains; and constraints, volatility, or disruption in the capital markets, any of which could have a material adverse effect on our business and financial condition.

Table of Contents

Our reliance on distributors for sales of our products outside of the United States, and on clinical laboratories for delivery of Prosigna testing services, could limit or prevent us from selling our products and impact our revenue.

We are a party to distribution agreements for the Prosigna IVD test kit in Europe, Asia and Latin America. Distributors may not commit the necessary resources to market and sell our products to the level of our expectations or may choose to favor marketing the products of our competitors. If current or future distributors do not perform adequately, or we are unable to enter into effective arrangements with distributors in particular geographic areas, we may not realize long-term international revenue growth. In addition, we do not provide testing services directly for the Prosigna IVD test kit and thus we are reliant on clinical laboratories to offer Prosigna testing services. These clinical laboratories may take longer than anticipated to begin offering Prosigna testing services. Furthermore, we intend to contract with additional clinical laboratories to offer Prosigna testing services, including physician-owned laboratories, and we may be unsuccessful in attracting and contracting with these new clinical laboratory providers. If current or future Prosigna testing service providers do not perform adequately, or we are unable to enter into contracts with more clinical laboratories to provide Prosigna testing services, we may not be successful in growing sales of Prosigna as a distributed kit and our future revenue prospects may be adversely affected.

Errors or defects in our products or services could harm our reputation, decrease market acceptance of our products or services or expose us to product liability claims, and we could face substantial liabilities that exceed our resources.

We have created and are continuing to create new tests, products and services, many of which are initially based on novel technologies. Our tests and products may contain undetected errors or defects that are not identified until after they are first introduced to the market. As all of our tests, products and services progress, we or others may determine that we made unintended scientific or technological mistakes or omissions. Furthermore, the testing processes utilize a number of complex and sophisticated biochemical, informatics, optical and mechanical processes, many of which are highly sensitive to external factors and variation between testing runs. Refinements to our processes may initially result in unanticipated issues that reduce efficiency or increase variability. In particular, sequencing, which is a key component of these processes, could be inefficient with higher-than-expected variability. This could increase total sequencing costs and reduce the number of samples we can process in a given time period, which may negatively impact customer turnaround time. Additionally, our laboratory operations could result in any number of errors or defects. Our quality assurance system or product development processes may fail to prevent us from inadvertent problems with samples, sample quality, lab processes including sequencing, software, data upload or analysis, raw materials, reagent manufacturing, assay quality or design, or other components or processes. Moreover, our assays may have quality or design errors, and we may have inadequate procedures or instrumentation to process samples, assemble our proprietary primer mixes and commercial materials, upload and analyze data, or otherwise conduct our laboratory operations. Additionally, the marketing, sale and use of our current or future tests could lead to product liability claims if someone were to allege that the tests failed to perform as they were designed or marketed. We may also be subject to liability for errors in the results we provide to physicians or for a misunderstanding of, or inappropriate reliance upon, the information we provide. Our Afirma classifiers are performed on FNA samples that are diagnosed as indeterminate by standard cytopathology review. We report results as benign or suspicious to the prescribing physician. Under certain circumstances, we might report a result as benign that later proves to have been malignant. This could be the result of the physician having poor nodule sampling in collecting the FNA, performing the FNA on a different nodule than the one that is malignant or failure of the classifier to perform as intended. We may also be subject to similar types of claims related to our Decipher Prostate, Prosigna, and Decipher Bladder tests, as well as tests we may develop or acquire in the future, including MRD.

Additionally, with respect to the manufacturing of our IVD test kits, we have addressed and must continue to address any quality issues associated with our products, including in our engineering, design, manufacturing and delivery processes, as well as issues with third-party raw materials or components included in our products or with third-party contract manufacturers. Furthermore, quality and performance issues may increase as we continue to introduce new tests and rapidly scale up manufacturing to meet demand. Although we have established internal procedures to minimize risks that may arise from product quality issues, there can be no assurance that we will be able to eliminate or mitigate occurrences of these issues and associated liabilities.

Any of the foregoing defects or errors could harm our reputation, decrease market acceptance of our products or services or expose us to product liability claims. A product liability or errors and omissions liability claim could further result in substantial damages and be costly and time-consuming for us to defend. Although we maintain product liability and errors and omissions insurance, we cannot assure that our insurance would fully protect us from the financial impact of defending against these types of claims or any judgments, fines or settlement costs arising out of any such claims. Any product liability or errors

Table of Contents

and omissions liability claim brought against us, with or without merit, could increase our insurance rates or prevent us from securing insurance coverage in the future. Additionally, any product liability lawsuit could cause injury to our reputation, decrease market acceptance of our products or cause us to recall or suspend sales of our products and solutions. The occurrence of any of these events could have an adverse effect on our business and results of operations.

Issues relating to the use of AI and machine learning in our offerings could adversely affect our business and operating results.

We continue to integrate AI and machine learning to detect pathology features and support genomic variant identification. Issues relating to the use of new and evolving technologies such as AI and machine learning may cause us to experience brand or reputational harm, competitive harm, legal liability, financial losses, and new or enhanced governmental or regulatory scrutiny. Furthermore, we may incur additional costs to resolve such issues if they arise. As with many innovations, AI presents risks and challenges that could undermine or slow its adoption, and therefore harm our business. For example, perceived or actual technical, legal, regulatory, compliance, privacy, security, ethical (including algorithmic bias) or other issues relating to the use of AI may cause public confidence in AI to be undermined, which could slow our customers’ adoption of our products and services that use AI. In addition, litigation or government regulation related to the use of AI may also adversely impact our and others’ abilities to develop and offer products that use AI, as well as increase the cost and complexity of doing so. Developing, testing and deploying AI components in our product offerings may also increase the cost profile of our product offerings due to the nature of the computing costs involved in such AI systems, which could impact our product margin and adversely affect our business and operating results. Further, market demand and acceptance of AI technologies are uncertain, and we may be unsuccessful in our product development efforts.

Security breaches, loss of data and other disruptions to our or our third-party service providers' data systems could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation.

In the ordinary course of our business, we and our third-party service providers collect and store sensitive data, including legally protected health information, other personally identifiable information, credit card information, intellectual property, and our proprietary business and financial information. We manage and maintain our applications and data utilizing a combination of on-site systems, managed data center systems and cloud-based data center systems. We face a number of risks related to our protection of, and our service providers’ protection of, this critical information, including loss of access, blocked access, inappropriate disclosure and inappropriate access, as well as risks associated with our ability to identify and audit such events. For example, cyberattacks, security breaches, computer viruses, malware and other incidents could cause misappropriation, loss or other unauthorized disclosure of confidential data, materials or information, including those concerning our customers and employees. Furthermore, system failures or outages could compromise our ability to protect sensitive information and prevent business interference, which could harm our ability to conduct business, delay our financial reporting, result in the loss of customers or harm our reputation. Such failures could materially adversely affect our operating results and financial condition.

The secure processing, storage, maintenance and transmission of this critical information is vital to our operations and business strategy, and we devote significant resources to protecting such information. Although we take measures to protect sensitive information from unauthorized access or disclosure, our information technology and infrastructure may be vulnerable to attacks by hackers, viruses, malware or otherwise breached due to employee error, malfeasance or other activities. Increasingly complex methods have been used in cyberattacks, including ransomware, phishing, structured query language injections, social engineering schemes, distributed denial-of-service attacks, or other emerging technologies, such as advanced forms of AI and quantum computing, and we may be unable to anticipate these techniques or implement adequate preventative measures. In addition, threat actors are increasingly using artificial intelligence and machine learning tools to increase the speed, scale and sophistication of cyberattacks, which may make such attacks more difficult to detect and defend against. The risk of a security breach or disruption has generally increased as the number, intensity and sophistication of attempted attacks and intrusions from around the world have increased. Our information technology systems and those of our third-party providers, strategic partners and other contractors, subcontractors or consultants are also vulnerable to attack and damage or interruption from telecommunications or network failures, natural disasters, employee theft or misuse, human error, fraud, denial or degradation of service attacks, sophisticated nation-state and nation-state-supported actors or unauthorized access or use by persons inside our organization, or persons with access to systems inside our organization. As a result of the continued hybrid working environment, we and our third-party service providers and partners may face increased cybersecurity risks due to our reliance on internet technology and the number of our employees who are working remotely, which may create additional opportunities for cybercriminals to exploit vulnerabilities.

Table of Contents

While we are not currently aware of any cybersecurity incidents having occurred that has materially affected us, we and certain of our third-party service providers have been from time to time subject to cyberattacks and security incidents, including several of the types of attacks noted above.Further, the techniques used in cybersecurity attacks or breaches change frequently and often are not recognized until launched against a target. Consequently, we may experience security breaches that may remain undetected for an extended period. Even if identified, we may be unable to adequately investigate or remediate incidents or breaches due to attackers increasingly using tools and techniques that are designed to circumvent controls, to avoid detection, and to remove or obfuscate forensic evidence. We can provide no assurance that we or our vendors will be able to detect, prevent or contain the effects of such attacks or other information security risks or threats in the future.

If such a cybersecurity event was to occur, our networks could be compromised and the information we store on those networks could potentially be accessed by unauthorized parties, publicly disclosed, lost or stolen. Any such access, disclosure or other loss of information could result in legal claims or proceedings, liability, and penalties under federal, state, and international laws and regulations that protect the privacy and security of personal information, such as the HIPAA regulations and the EU General Data Protection Regulation, or GDPR. See “Risks associated with data privacy issues, including evolving laws, regulations and associated compliance efforts, may adversely impact our business and financial results.” Unauthorized access, loss or dissemination of such data also could disrupt our operations, including our ability to process tests, provide test results, bill payers or patients, process claims and appeals, provide customer assistance services, conduct research and development activities, collect, process, and prepare company financial information, provide information about our tests and other patient and physician education and outreach efforts through our website, and manage the administrative aspects of our business, any of which could adversely affect our business, including by materially damaging our reputation.

Risks associated with data privacy issues, including evolving laws, regulations and associated compliance efforts, may adversely impact our business and financial results.

Legislation in various countries around the world with regard to cybersecurity, artificial intelligence, privacy and data protection is rapidly expanding and creating a complex compliance environment. We are subject to many federal, state, and foreign laws and regulations, including those related to privacy, rights of publicity, data protection, content regulation, intellectual property, health and safety, competition, protection of minors, consumer protection, employment, and taxation.

The GDPR applies to our activities conducted from an establishment in the EU or related to products and services that we offer to EU users. The GDPR imposes compliance obligations applicable to our business, including accountability obligations requiring data controllers and processors to maintain a record of their data processing and implement policies as part of its mandated privacy governance framework. It also requires data controllers to be transparent and to disclose to data subjects how their personal data is to be used, protected, and shared; imposes limitations on retention of personal data; introduces mandatory data breach notification requirements; and sets higher standards for data controllers to demonstrate that they have obtained valid consent for certain data processing activities. Continued compliance with these obligations could cause us to change our business practices, and we risk financial penalties for noncompliance (including possible fines of up to 4% of global annual turnover for the preceding financial year or €20 million (whichever is higher) for the most serious infringements). In addition, the GDPR prohibits the transfer of personal data from the EEA to other jurisdictions that the European Commission does not recognize as having “adequate” data protection laws unless a data-protective transfer mechanism has been put in place. On July 16, 2020, the CJEU issued a decision undermining the validity of the data-protective transfer mechanisms previously relied on, creating widespread uncertainty about compliance with the GDPR rules on data transfers to non-“adequate” jurisdictions which, at that time, included the United States. The European Commission announced in July 2023 that it had adopted a new adequacy decision with respect to the United States under a new regulatory structure known as the EU-US Data Privacy Framework. Although the EU-US Data Privacy Framework potentially provides additional regulatory certainty regarding data transfers from the EU to the U.S., it may still be challenged before the CJEU. In addition, the EU-US Data Privacy Framework is not automatically available to all companies, but instead requires a company to meet certain jurisdictional and procedural requirements in order to get the benefit of utilizing such framework as a data-protective transfer mechanism.

Additionally, while the CJEU generally confirmed the validity of the European Commission-approved SCCs as a personal data-protective transfer mechanism, it made clear that reliance on the SCCs alone may not necessarily be sufficient in all circumstances. Use of the SCCs must now be assessed on a case-by-case basis taking into account the legal regime applicable in the destination country, in particular applicable surveillance laws and rights of individuals and additional measures and/or contractual provisions may need to be put in place, however, the nature of these additional measures is currently uncertain. In response to the CJEU decision, the European Commission has published revised SCCs, which we implemented in advance of the December 27, 2022 deadline. The revised SCCs are not to be relied on for data transfers to non-EEA entities subject to the

Table of Contents

GDPR, and we are waiting for further guidance on valid mechanisms for data transfers from the EEA to such entities. As a result, we may have to make certain operational changes, and we will have to implement revised standard contractual clauses and other relevant documentation for existing data transfers within required time frames.

Following the United Kingdom’s withdrawal from the EEA and the EU, and the expiry of the transition period, companies processing the information of EU data subjects are now required to comply with both the GDPR and the GDPR as incorporated into United Kingdom national law, or UK GPDR. Under the UK GDPR, the Information Commissioner has the ability to separately fine up to the greater of £17.5 million or 4% of global turnover in certain circumstances. The European Commission has adopted an adequacy decision in favor of the United Kingdom, enabling data transfers from EU member states to the United Kingdom without additional safeguards, but that decision is currently set to expire in December 2031. In June 2025, a new Data Use and Access Bill was passed by the parliament of the United Kingdom and received royal assent, becoming the Data (Use and Access) Act 2025, or the UK Act. The UK Act may have the effect of further altering the similarities between the United Kingdom and the EEA data protection regimes. These developments may lead to additional costs and increase our overall risk exposure.

In the United States, numerous federal and state laws and regulations, including federal health information privacy laws, state data breach notification laws, state health information privacy laws and federal and state consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), that govern the collection, use, disclosure and protection of health-related and other personal information could apply to our operations or the operations of our collaborators. In addition, we may obtain health information from third parties (including research institutions from which we obtain clinical trial data) that are subject to privacy and security requirements under HIPAA, as amended by HITECH. Depending on the facts and circumstances, we could be subject to civil and criminal penalties if we obtain, use, or disclose individually identifiable health information that we create, receive, maintain or transmit, including information maintained by a HIPAA-covered entity, in a manner that is not authorized or permitted by HIPAA.

The CCPA established individual privacy rights for California consumers and places increased privacy and data security obligations on entities handling personal information of consumers or households. The CCPA was amended several times after its enactment, most recently by the CPRA, which, as of its effective date of January 1, 2023, gives California residents expanded privacy rights, including the right to opt out of certain personal information sharing, the use of “sensitive personal information,” and the use of personal information for automated decision-making or targeted advertising. The CCPA and CPRA provide for civil penalties and a private right of action for data breaches that are expected to increase data breach litigation. The CCPA and CPRA may increase our compliance costs and potential liability , and it remains unclear what, if any, further amendments will be made to this legislation or how it will be interpreted. Following California, several other states, including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia have each enacted laws similar to the CCPA/CPRA. The multiple layers of privacy law within the United States could increase our potential liability, increase our compliance costs, and adversely affect our business.

Other countries outside of the United States and Europe have enacted or are considering enacting international data transfer restrictions and laws requiring local data residency and restricting international data transfer, which could increase the cost and complexity of delivering our services and operating our business. For example, Brazil's General Data Protection Law (as amended by Law No. 13,853/2019) contains restrictions on international transfer and heightened requirements on data concerning health, genetic and biometric data. China’s Personal Information Protection Law (effective November 2021), together with the Cyberspace Administration of China’s Measures on Security Assessment on Cross-border Data Transfer, broadly regulate the processing and international transfer of personal information and impose compliance obligations and penalties comparable to those of the GDPR.

In addition, the interpretation and application of consumer, health-related and data protection laws in the United States, Europe and elsewhere are often uncertain, contradictory, and in flux. It is possible that these laws may be interpreted and enforced in a manner that we have not anticipated in designing our practices and compliance policies. If so, this could result in government-imposed fines or orders requiring that we change our practices, which could adversely affect our business. We may be required to modify our data processing practices and policies and to incur substantial costs and expenses in an effort to comply.

Furthermore, the C2i Acquisition included acquiring personal data that may originate from, be processed in, or be transferred to and from, Israel, the EU and other jurisdictions. Our ability to process, use and transfer such personal data may

Table of Contents

be subject to Israel’s privacy and data protection laws including but not limited to Basic Law: Human Dignity and Liberty, 5752 -1992; the Protection of Privacy Law, 5741-1981 and the regulations promulgated thereunder, or the PPL, and the guidelines of the Israel Privacy Authority. The PPL was most recently amended in August 2024 and took effect in August 2025 as PPL, 5774-2024. Personal data acquired through the C2i Acquisition may be subject to third-party contractual restrictions, as well as privacy and data protection laws in additional jurisdictions. The additional layers of privacy laws in Israel, additional jurisdictions, and contractual requirements increases the complexity of our global data privacy and data protection compliance obligations and risks. This could increase our potential liability, compliance costs, and may adversely affect our business operations.

As privacy laws, regulations and standards continue to develop and evolve, we will likely need to review and amend the legal mechanisms by which we make and/ or receive personal data transfers to/in the United States and other countries outside of the EEA. As supervisory authorities issue further guidance on personal data export mechanisms, including circumstances where the SCCs cannot be used, and/or commence enforcement actions, we could suffer additional costs, complaints and/or regulatory investigations or fines, and/or if we are otherwise unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we provide our services and/or the geographical location or segregation of our relevant systems and operations, and could adversely affect our financial results.

If we are unable to protect our intellectual property effectively, our business may be harmed.

VCYT US Equity

VCYT · 10-K · period ended 2025-12-31

ITEM 1A. RISK FACTORS

VCYT US Equity☆

VCYT · 10-K · period ended 2025-12-31

ITEM 1A. RISK FACTORS

VCYT US Equity