Generation Bio (GBIO) Risk Analysis

We will face an inherent risk of clinical trial and product liability exposure related to the testing of any product candidates we may develop in clinical trials, and we will face an even greater risk if we commercially sell any products that we may develop. While we currently have no product candidates in clinical trials or that have been approved for commercial sale, the future use of product candidates by us in clinical trials, and the sale of any approved products in the future, may expose us to liability claims. These claims might be made by patients that use the product, healthcare providers, pharmaceutical companies or others selling such products. If we cannot successfully defend ourselves against claims that our product candidates or products caused injuries, we will incur substantial liabilities. Regardless of merit or eventual outcome, liability claims may result in: - decreased demand for any product candidates we may develop;- injury to our reputation and significant negative media attention;- withdrawal of clinical trial participants;- significant costs to defend any related litigation;- substantial monetary awards to trial participants or patients;- loss of revenue;- reduced resources of our management to pursue our business strategy; and - the inability to commercialize any product candidates we may develop. We will need to increase our insurance coverage if we commence clinical trials or if we commence commercialization of any product candidates. Insurance coverage is increasingly expensive. We may not be able to maintain insurance coverage at a reasonable cost or in an amount adequate to satisfy any liability that may arise. If a successful clinical trial or product liability claim or series of claims is brought against us for uninsured liabilities or in excess of insured liabilities, our assets may not be sufficient to cover such claims and our business operations could be impaired.

We are subject to data privacy and protection laws and regulations that apply to the collection, transmission, storage and use of personally-identifying information, which among other things, impose certain requirements relating to the privacy, security and transmission of personal information, including comprehensive regulatory systems in the United States, European Union and United Kingdom. The legislative and regulatory landscape for privacy and data protection continues to evolve in jurisdictions worldwide, and there has been an increasing focus on privacy and data protection issues with the potential to affect our business. Failure to comply with any of these laws and regulations could result in enforcement action against us, including fines, imprisonment of company officials and public censure, claims for damages by affected individuals, damage to our reputation and loss of goodwill, any of which could have a material adverse effect on our business, financial condition, results of operations or prospects. There are numerous U.S. federal and state laws and regulations related to the privacy and security of personal information. In particular, regulations promulgated pursuant to HIPAA, which establish privacy and security standards that limit the use and disclosure of individually identifiable health information, or protected health information, and require the implementation of administrative, physical and technological safeguards to protect the privacy of protected health information and ensure the confidentiality, integrity and availability of electronic protected health information. Determining whether protected health information has been handled in compliance with applicable privacy standards and our contractual obligations can be complex and may be subject to changing interpretation. These obligations may be applicable to some or all of our business activities now and in the future. If we fail to comply with applicable privacy laws, including applicable HIPAA privacy and security standards, we could face civil and criminal penalties. HHS enforcement activity can result in financial liability and reputational harm, and responses to such enforcement activity can consume significant internal resources. In recent months, the OCR has been especially active in enforcing the HIPAA rules. In addition, state attorneys general are authorized to bring civil actions seeking either injunctions or damages in response to violations that threaten the privacy of state residents. We cannot be sure how these regulations will be interpreted, enforced or applied to our operations. In addition to the risks associated with enforcement activities and potential contractual liabilities, our ongoing efforts to comply with evolving laws and regulations at the federal and state level may be costly and require ongoing modifications to our policies, procedures and systems. Additionally, the OCR is looking to amend the HIPAA Security Rule, which (if and when finalized) could create additional compliance obligations and risk for our business. In addition to potential enforcement by the HHS, we could also be potentially subject to privacy enforcement from the Federal Trade Commission, or FTC. The FTC has been particularly focused on the unpermitted processing of health and genetic data through its recent enforcement actions and is expanding the types of privacy violations that it interprets to be "unfair" under Section 5 of the FTC Act, as well as the types of activities it views to trigger the Health Breach Notification Rule (which the FTC also has the authority to enforce). The agency is also in the process of developing rules related to commercial surveillance and data security. We will need to account for the FTC's evolving rules and guidance for proper privacy and data security practices in order to mitigate risk for a potential enforcement action, which may be costly. Finally, both the FTC and HHS's enforcement priorities (as well as those of other federal regulators) may be impacted by the change in administration and new leadership. These shifts in enforcement priorities may also impact our business. There are also increased restrictions at the federal level relating to transferring sensitive data outside of the United States to certain foreign countries. For example, in 2024, Congress passed H.B. 815, which included the Protecting Americans' Data from Foreign Adversaries Act of 2024. This law creates certain restrictions for entities that disclose sensitive data (including potential health data) to countries such as China. Failure to comply with these rules can lead to a potential FTC enforcement action. Additionally, the Department of Justice recently finalized a rule implementing Executive Order 14117, which creates similar restrictions related to the transfer of sensitive U.S. data to countries such as China. These data transfer restrictions (and others that may pass in the future) may create operational challenges and legal risks for our business. In 2018, California passed into law the CCPA which took effect on January 1, 2020, and imposed many requirements on businesses that process the personal information of California residents. Many of the CCPA's requirements are similar to those found in the GDPR, including requiring businesses to provide notice to data subjects regarding the information collected about them and how such information is used and shared, and providing data subjects the right to request access to such personal information and, in certain cases, request the erasure of such personal information. The CCPA also affords California residents the right to opt-out of "sales" of their personal information. The CCPA contains significant penalties for companies that violate its requirements. In November 2020, California voters passed a ballot initiative for the CPRA, which went into effect on January 1, 2023 and significantly expanded the CCPA to incorporate additional GDPR-like provisions including requiring that the use, retention, and sharing of personal information of California residents be reasonably necessary and proportionate to the purposes of collection or processing, granting additional protections for sensitive personal information, and requiring greater disclosures related to notice to residents regarding retention of information. The CPRA also created a new enforcement agency – the California Privacy Protection Agency – whose sole responsibility is to enforce the CPRA, which will further increase compliance risk. The provisions in the CPRA may apply to some of our business activities. In addition to California, at least eleven other states have passed comprehensive privacy laws similar to the CCPA and CPRA. These laws are either in effect or will go into effect sometime before the end of 2026. Like the CCPA and CPRA, these laws create obligations related to the processing of personal information, as well as special obligations for the processing of "sensitive" data (which includes health data in some cases). Some of the provisions of these laws may apply to our business activities. There are also states that are strongly considering or have already passed comprehensive privacy laws during the 2023 legislative sessions that will go into effect in 2024 and beyond, including New Hampshire and New Jersey. Other states will be considering these laws in the future, and Congress has also been debating passing a federal privacy law. There are also states that are specifically regulating health information that may affect our business. For example, Washington state passed a health privacy law in 2023 that will regulate the collection and sharing of health information, and the law also has a private right of action, which further increases the relevant compliance risk. Connecticut and Nevada have also passed similar laws regulating consumer health data and additional states are considering such legislation for 2024. These laws may impact our business activities, including our identification of research subjects, relationships with business partners and ultimately the marketing and distribution of our products. Plaintiffs' lawyers are also increasingly using privacy-related statutes at both the state and federal level to bring lawsuits against companies for their data-related practices. In particular, there have been a significant number of cases filed against companies for their use of pixels and other web trackers. These cases often allege violations of the California Invasion of Privacy Act and other state laws regulating wiretapping, as well as the federal Video Privacy Protection Act. The rise in these types of lawsuits creates potential risk for our business. Similar to the laws in the United States, there are significant privacy and data security laws that apply in Europe and other countries. The collection, use, disclosure, transfer, or other processing of personal data, including personal health data, regarding individuals who are located in the EEA, and the processing of personal data that takes place in the EEA, is regulated by the GDPR, which went into effect in May 2018 and imposes obligations on companies that operate in our industry with respect to the processing of personal data and the cross-border transfer of such data. The GDPR imposes onerous accountability obligations requiring data controllers and processors to maintain a record of their data processing and policies. If our or our partners' or service providers' privacy or data security measures fail to comply with the GDPR requirements, we may be subject to litigation, regulatory investigations, enforcement notices requiring us to change the way we use personal data and/or fines of up to 20 million euros or up to 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher, as well as compensation claims by affected individuals, negative publicity, reputational harm and a potential loss of business and goodwill. The GDPR places restrictions on the cross-border transfer of personal data from the EU to countries that have not been found by the European Commission to offer adequate data protection legislation, such as the United States. There are ongoing concerns about the ability of companies to transfer personal data from the EU to other countries. In July 2020, the Court of Justice of the European Union, or CJEU, invalidated the EU-U.S. Privacy Shield, one of the mechanisms used to legitimize the transfer of personal data from the EEA to the U.S. In July 2023, the data privacy framework, or DPF, adopted by the EU and U.S. to replace the Privacy Shield was deemed adequate by the European Commission and has taken effect. While the DPF was designed to address the concerns expressed by the CJEU in its decision invalidating the EU-U.S. Privacy Shield, it remains to be seen whether the CJEU will consider it adequate. Future CJEU review may lead to increased scrutiny on data transfers from the EEA to the U.S. generally and increase our costs of compliance with data privacy legislation as well as our costs of negotiating appropriate privacy and security agreements with our vendors and business partners. Beyond GDPR, there are privacy and data security laws in a growing number of countries around the world (including in the United Kingdom as a result of Brexit). While many loosely follow GDPR as a model, other laws contain different or conflicting provisions. These laws may impact our ability to conduct our business activities and the costs associated with these activities. These laws will impact our ability to conduct our business activities, including both our clinical trials and any eventual sale and distribution of commercial products, through increased compliance costs, costs associated with contracting and potential enforcement actions. While we continue to address the implications of the recent changes to data privacy regulations, data privacy remains an evolving landscape at both the domestic and international level, with new regulations coming into effect and continued legal challenges, and our efforts to comply with the evolving data protection rules may be unsuccessful. It is possible that these laws may be interpreted and applied in a manner that is inconsistent with our practices. We must devote significant resources to understanding and complying with this changing landscape. Failure to comply with laws regarding data protection would expose us to risk of enforcement actions taken by data protection authorities in the EEA and elsewhere and carries with it the potential for significant penalties if we are found to be non-compliant. Similarly, failure to comply with federal and state laws in the United States regarding privacy and security of personal information could expose us to penalties under such laws. Any such failure to comply with data protection and privacy laws could result in government-imposed fines or orders requiring that we change our practices, claims for damages or other liabilities, regulatory investigations and enforcement action, litigation and significant costs for remediation, any of which could adversely affect our business. Even if we are not determined to have violated these laws, government investigations into these issues typically require the expenditure of significant resources and generate negative publicity, which could harm our reputation and our business, financial condition, results of operations or prospects.

Our results of operations could be adversely affected by general conditions in the global economy and in the global financial markets. For example, the 2008 global financial crisis caused extreme volatility and disruptions in the capital and credit markets. A severe or prolonged economic downturn, such as the 2008 global financial crisis, could result in a variety of risks to our business, including, weakened demand for any product candidates we may develop and our ability to raise additional capital when needed on acceptable terms, if at all. A weak or declining economy could also strain our suppliers, possibly resulting in supply disruption. If the current equity and credit markets deteriorate, it may make any necessary debt or equity financing more difficult, more costly, and more dilutive. Failure to secure any necessary financing in a timely manner and on favorable terms could have a material adverse effect on our growth strategy, financial performance and stock price and could require us to delay or abandon clinical development plans. In addition, there is a risk that one or more of our current service providers, manufacturers and other partners may not survive such difficult economic times, which could directly affect our ability to attain our operating goals on schedule and on budget. Any of the foregoing could harm our business and we cannot anticipate all of the ways in which the current economic climate and financial market conditions could adversely impact our business. Furthermore, our stock price may decline due in part to the volatility of the stock market and any general economic downturn.

We depend on our employees, consultants, CMOs, CLROs, as well as regulatory agencies and other parties, for the continued operation of our business. While we maintain disaster recovery plans, they might not adequately protect us. Despite any precautions we take for natural disasters or other catastrophic events, these events, including terrorist attack, pandemics, hurricanes, fire, floods and ice and snowstorms, could result in significant disruptions to our research and development, preclinical studies, clinical trials, and, ultimately, commercialization of our products. Long-term disruptions in the infrastructure caused by events, such as natural disasters, the outbreak of war, the escalation of hostilities and acts of terrorism or other ‘‘acts of god,'' particularly involving cities in which we have offices, manufacturing or clinical trial sites, could adversely affect our businesses. Although we carry business interruption insurance policies and typically have provisions in our contracts that protect us in certain events, our coverage might not respond or be adequate to compensate us for all losses that may occur. Any natural disaster or catastrophic event affecting us, our CMOs, our CLROs, regulatory agencies or other parties with which we are engaged could have a significant negative impact on our operations and financial performance.