Henry Schein · Risk factors

We obtain a significant volume of the products we distribute from third parties, with whom we generally do not have long-term contracts.

While there is typically more than one source of supply, some key suppliers, in the aggregate, supply a significant portion of the products we sell.

In 2025, our top 10 Global Distribution and Value- Added Services suppliers and our single largest supplier accounted for approximately 24% and 4%, respectively, of our aggregate purchases.

Additionally, where we are the manufacturer of products for our speciality business ( , dental implants, endodontics, and orthopedics), we are dependent upon third parties for raw materials and purchased components.

Although no single supplier is material, because of our dependence upon such suppliers, our operations are subject to the suppliers’ ability and willingness to supply products in the quantities that we require, and the risks include delays caused by interruption in production based on conditions outside of our control, including a supplier’s failure to comply with applicable government requirements (which may result in product recalls, product detentions, and/or cessation of sales) or an interruption in the suppliers’ manufacturing capabilities.

In the event of any such interruption in supply, we would need to timely identify and obtain acceptable replacement sources.

There is no guarantee that we would be able to obtain such alternative sources of supply on a timely basis, if at all, and an extended interruption in supply, particularly of a high-sales volume and/or high- margin product, could result in a significant disruption in our sales and operations, as well as damage to our relationships with customers and our reputation.

Our 2025 – 2027 BOLD+1 Strategic Plan is defined under “Business, Business Strategy” above.

In particular, we are focused on continuing to grow our Henry Schein specialty brands and technology and value-added services solutions both organically and inorganically, and to drive greater efficiencies.

If we are unable to effectively implement our strategic plan, we may not achieve our desired return on our investments through our growth strategies.

On January 29, 2025, we announced a strategic investment by funds affiliated with KKR & Co. Inc. (“KKR”), a leading global investment firm, and a Strategic Partnership Agreement (the “Partnership Agreement”) with KKR.

Under the Partnership Agreement, two independent directors, Max Lin and William K. “Dan” Daniel, joined our Board of Directors.

On May16, 2025, we issued 3,285,151 shares of common stock to funds affiliated with KKR for an investment of $250 million, at approximately $76.10 per share.

Pursuant to the Partnership Agreement, KKR also has the ability to purchase additional shares via open market purchases up to a total equity stake of 14.9% of the outstanding shares of common stock of the Company.

On November 4, 2025, the Company and KKR entered into an amendment to the Partnership Agreement that increased the beneficial ownership limit from 14.9% to19.9% of the outstanding shares of the Company’s common stock that KKR is permitted to acquire during the standstill period.

The standstill provisions, including the increased ownership limit, continue in effect for a period of six months following the later of the expiration of the term of the Partnership Agreement and the date on which no KKR director appointed pursuant to the Partnership Agreement is serving on the Company’s Board of Directors.

On December 7, 2025, pursuant to the Partnership Agreement, KKR notified the Company of its election to exercise the Extension Election (as defined in the Partnership Agreement) whereby the Company’s Board of Directors will renominate KKR’s designees, Max Lin and William K. “Dan” Daniel, to stand for election at the Company’s 2026 annual meeting of stockholders for a term expiring at the Company’s 2027 annual meeting of stockholders. The Partnership Agreement may have unintended consequences, such as uncertainty about our management, operations, or future strategic direction, which could result in the loss of future business opportunities or negatively impact our ability to attract and retain qualified talent.

KKR also invests in many different types of businesses, and has or may continue to invest in customers, suppliers, joint venture partners, or other entities that have relationships with the Company, or in competitors of such entities, which may create unintended conflicts resulting in a loss of business.

Our future success depends on our ability to timely develop (or obtain the right to sell) competitive and innovative (particularly for our Global Technology and Global Specialty Products segments) products and services and utilize new technologies, such as artificial intelligence (“AI”) (among other emerging technologies) and to market them and/or utilize them quickly and cost-effectively.

Our ability to anticipate customer needs and emerging trends and develop or acquire new products, services and technologies at competitive prices requires significant resources, including employees with the requisite skills, experience and expertise, particularly in our Global Technology segment, including dental practice management, patient engagement and demand creation software solutions.

failure to successfully address these challenges could materially disrupt our sales and operations.

T3We have increased and expect to continue to increase our use of AI technologies in various contexts to improve customer and patient experiences and drive efficiencies in certain areas of our business, including, without limitation, making AI features available within our practice management systems, which, among other things, helps dentists and clinical staff detect caries.

While these innovations can present benefits to the Company, they also create risks and challenges.

The use of AI in healthcare offerings poses certain clinical risks resulting from potential misdiagnosis or misinformation provided from AI applications, diminishing critical judgment, or loss of interpersonal care from clinicians.

These deficiencies could undermine the decisions, predictions, or analysis AI applications produce, as well as their adoption, subjecting us to competitive harm, legal liability (including under new proposed legislation regulating AI in jurisdictions such as the EU or new applications of existing data protection, privacy, intellectual property, and other laws), regulatory actions, and reputational harm.

In addition, some AI scenarios, such as using AI applications to generate patient data (including, without limitation, using AI to capture and summarize patient interactions, and voice-activated perio charting), present ethical, privacy, or other social issues, risking reputational harm and/or reduced market demand or acceptance of AI solutions.

safeguards we have designed to promote the ethical implementation of AI may not be sufficient to protect us against negative outcomes.

All of these risks are amplified by the critical nature of healthcare decisions and the sensitivity of health-related information, and the occurrence of any of the above could have a material adverse effect on our business, financial condition or operating results.

Additionally, if investments in emerging technologies are less successful at attracting and retaining customers than similar investments by our competitors, or if we are otherwise unsuccessful at realizing the benefits of these technological investments generally, this could have a material adverse effect on our business, financial condition, or operating results.

Additionally, widely accessible generative AI that rapidly surpasses our organizational ability to understand associated risks and opportunities (including employees’ failure to comply with principles, policies and processes governing AI usage) could endanger our intellectual property, lead to misuse or loss of data and cause reputational harm and other fines, penalties or losses.

One of our business strategies has been to expand in part through acquisitions and joint ventures and we expect to continue to make acquisitions and enter into joint ventures in the future.

There is risk that one or more may not succeed.

We cannot be sure, for example, that we will achieve the benefits of revenue growth that we expect from these transactions or that we will avoid unforeseen additional costs, taxes, or expenses.

Our ability to successfully implement our acquisition and joint venture strategy depends upon, among other things, the following:

the availability of suitable acquisition or joint venture candidates at acceptable prices;

our ability to consummate such transactions, which could potentially be prohibited due to U.S. or foreign antitrust regulations;

the liquidity of our investments and the availability of financing on acceptable terms;

our ability to retain customers or product lines of the acquired businesses or joint ventures;

our ability to retain, recruit and incentivize the management of the companies we acquire; and our ability to successfully integrate these companies’ operations, systems, services, products and personnel with our culture, management policies, legal, regulatory and compliance policies, information technology and cybersecurity systems and policies, internal procedures, working capital management, financial, operational and internal controls and strategies.

Furthermore, some of our acquisitions and future acquisitions may give rise to an obligation to make contingent payments or to satisfy certain repurchase obligations, which payments could have material adverse impacts on our financial results individually or in the aggregate.

Additionally, when we decide to sell assets or a business, we may encounter difficulty in finding buyers or timely executing alternative exit strategies on acceptable terms, which could delay the accomplishment of our strategic objectives.

Dispositions may also involve continued financial involvement in a divested business, such as through transition service agreements, indemnities or other current or contingent financial obligations.

The provisions of our certificate of incorporation and by-laws may make it more difficult for a third-party to acquire us, may discourage acquisition bids and may impact the price that certain investors might be willing to pay in the future for shares of our common stock.

These provisions, among other things require (i) the affirmative vote of the holders of at least 60% of the shares of common stock entitled to vote to approve a merger, consolidation, or a sale, lease, transfer or exchange of all or substantially all of our assets;

and (ii) the affirmative vote of the holders of at least 66 2/3% of our common stock entitled to vote to (a) remove a director; and (b) to amend or repeal our by-laws, with certain limited exceptions.

In addition, certain of our employee incentive plans provide for accelerated vesting of equity awards upon termination without cause within two years following a change in control, or grant the plan committee discretion to accelerate awards upon a change of control.

Further, certain agreements between us and our executive officers provide for increased severance payments and certain benefits if those executive officers are terminated without cause by us or if they terminate for good reason, in each case within two years following a change in control or within ninety days prior to the effective date of the change in control or after the first public announcement of the pendency of the change in control.

The terms on which we purchase or sell products from many suppliers may entitle us to receive a rebate or other purchasing incentive based on the attainment of certain growth goals.

Suppliers may reduce or eliminate rebates or incentives offered under their programs, or increase the growth goals or other conditions we must meet to earn rebates or incentives to levels that we cannot achieve.

Increased competition either from generic or equivalent branded products could result in us failing to earn rebates or incentives that are conditioned upon achievement of growth goals.

Additionally, factors outside of our control, such as customer preferences, consolidation of suppliers or supply issues, can have a material impact on our ability to achieve the growth goals established by our suppliers, which may reduce the amount of rebates or incentives we receive.

We offer certain corporate brand products that are available exclusively from us.

The sale of such corporate brand products and the sale of products that we manufacture subject us to potential product liability risks, mandatory or voluntary product recalls, potential supply chain and distribution chain disruptions and potential intellectual property infringement risks, among other risks.

In addition, an increase in the sales of our corporate brand products and our own manufactured products may negatively affect our sales of products owned by our suppliers which, consequently, could adversely impact certain of our supplier relationships.

Our ability to locate qualified, economically stable suppliers who satisfy our requirements, and to acquire sufficient products in a timely and effective manner, are critical to ensuring, among other things, that customer confidence is not diminished.

In addition, we are exposed to the risk that our competitors or our large customers may introduce their own private label, generic, or low-cost products that compete with our products at lower price points.

Such products could capture significant market share or decrease market prices overall, eroding our sales and margins.

Any failure to develop sourcing relationships with a broad and deep supplier base could have a material adverse effect on our business, financial condition or operating results.

We actively engage in discussions with our stockholders.

In other cases, stockholders can engage in certain divisive activist tactics, which can take many forms (including potential proxy contests).

Some stockholder activism has resulted in, and could in the future result in, substantial costs, such as professional fees, and the diversion of management’s and our Board of Directors’ attention and resources from our business and strategic plans.

Additionally, it could cause uncertainty about our management, operations or future strategic direction, which could result in the loss of future business opportunities or negatively impact our ability to attract and retain qualified talent.

Activists or other stockholders holding a large portion of our outstanding shares could also exert influence on actions requiring a stockholder vote, including the election of directors and the approval of certain extraordinary business transactions.

These risks could cause volatility in the trading price of our common stock based on factors other than the fundamentals of our business.

We rely on information systems (“IS”) in our business to obtain, rapidly process, analyze, manage and store customer, product, supplier and employee data to, among other things:

maintain and manage worldwide systems to facilitate the purchase and distribution of thousands of inventory items from numerous distribution centers;

receive, process and ship orders on a timely basis;

manage the accurate billing and collections for our customers;

process payments to suppliers;

provide products and services that maintain certain of our customers’ electronic medical or dental records (including protected health information of their patients); and maintain and manage global human resources, compensation and payroll systems.

There could be an adverse impact on our business, financial condition or operating results if we do not maintain an adequate information and technology infrastructure ( , hardware, networks, software, people and processes) to effectively protect and support the current and future information requirements of the business.

In addition to health information in our customers’ electronic medical and dental records, certain of our IS store other sensitive personal and financial information, such as health care and other information related to our employees and individuals we service, as well as other sensitive information such as credit card information from our third-party business partners, that is confidential, and in many cases subject to privacy laws.

Our IS are susceptible to, among other things, natural disasters, power losses, telecommunication failures, cybersecurity threats and other criminal activity.

Information security risks have significantly increased in recent years in part because of an overall increase in cyber incidents, their increased sophistication and the involvement of organized crime, hackers, terrorists and foreign state agents.

The health care industry has been targeted by threat actors seeking to undermine companies’ cybersecurity defensive measures.

Moreover, cyberattacks have become more difficult to detect and respond to.

They increasingly exploit AI and machine learning techniques, such as generative AI-phishing, deepfake impersonations, automated vulnerability discovery, adaptive malware and large- scale credential-stuffing campaigns.

New subsidiaries that we acquire and non-integrated subsidiaries have been, and may continue to be, targets to cyberattacks as we update their defensive measures to meet our standards.

have processes in place intended to ensure that our security measures keep pace with new and emerging risks.

regularly review, monitor and implement multiple layers of security through technology, processes and our people.

We utilize security technologies designed to protect and maintain the integrity of our IS and data, and our defenses are monitored and routinely tested internally and by external parties.

Despite these efforts, our facilities and systems and those of our third-party service providers have been, and may in the future be, vulnerable to privacy and security incidents, cybersecurity attacks and data breaches, acts of vandalism or theft, computer viruses and other malicious code, misplaced or lost data, programming and/or human errors, attacks or other acts undermining IS of third party business partners including our customers, or other similar events that could impact the security, reliability and availability of our systems.

In addition, hardware, software or applications developed internally or procured from third parties may contain defects in design or manufacture or other problems that could unexpectedly compromise information security.

As a practical matter, so long as we depend on IS to operate our business, and our business partners do the same, there can be no guaranty that such measures will successfully stop any one particular cybersecurity incident given the constantly evolving nature of the threat.

We have incurred, continue to incur, and may in the future incur substantial costs as we update our cybersecurity defense systems and our general computer controls to meet evolving challenges, and legislative or regulatory action related to cybersecurity which may increase our costs to develop or implement new technology products and services.

A cyberattack that bypasses or compromises our, or our vendors’, IS cybersecurity and/or general information technology (“IT”) controls (including third-party systems we rely on) causing an IS security breach may lead, and has in the past led, to a disruption of our, or our vendors’, IS business systems (including third-party systems rely on), interruption of operations (including, without limitation, receiving, verifying and processing customer orders, customer service, accounts payable, warehouse management and shipping and systems tied to internal controls over financial reporting), the loss or alteration of business, financial and other protected information, a negative impact on our financial performance, and to an adverse impact on our financial accounting and reporting controls.

A cyberattack that bypasses or compromises our IS cybersecurity and/or general computer controls or those of third parties with whom we engage may also lead to claims against us by affected parties and/or governmental agencies, and involve fines and penalties, as well as substantial defense and settlement expenses.

Any of these impacts may alone, or collectively, have a material impact on our business.

A successful cyberattack has, and may again in the future, disrupt our business operations, adversely impact our financial accounting and reporting of results of operations, divert the attention of management, and adversely impact our results of operations.

In addition, we develop products and provide services to our customers that are technology-based, and a cyberattack that bypasses the IS supporting our products or services causing a security breach and/or perceived security vulnerabilities in our products or services could also cause significant loss of business and reputational harm, and actual or perceived vulnerabilities may lead to claims against us by our customers and/or governmental agencies.

In addition, certain of our practice management products and services purchased by health care providers, such as physicians and dentists, are used to store and manage patient medical or dental records, and when cloud-based approaches are used, we may be responsible for hosting those records.

These customers, and in some cases, we are subject to laws and regulations which require that they protect the privacy and security of those records, and our products may be used as part of these customers’ comprehensive data security programs, including in connection with their efforts to comply with applicable privacy and security laws.

In addition to immaterial and unrelated incidents at certain of our subsidiaries, in October 2023 Henry Schein experienced a cybersecurity incident that primarily affected the operations of our North American and European dental and medical distribution businesses.

Henry Schein One, our practice management software, revenue cycle management and patient relationship management solutions business was not affected, and our manufacturing businesses were mostly unaffected.

Nevertheless, the October 2023 cybersecurity incident disrupted key business operations, adversely impacted our financial results for the fourth quarter and full year 2023, diverted attention of management, and caused the Company to incur significant remediation costs.

The incident had residual impact on our financial results in 2024.

We have spent, and plan to expend in the future, additional resources to continue to protect against, or to address problems caused by, business interruptions and data security breaches.

We also may be perceived as a more vulnerable target of the cyber hackers as a result of the October 2023 incident.

We compete with numerous companies, including several major manufacturers and distributors.

Some of our competitors have greater financial and other resources than we do, which could allow them to compete more successfully.

Most of our products are available from several sources and our customers tend to have relationships with several distributors.

Competitors could obtain exclusive rights to market particular products, which we would then be unable to market.

Manufacturers also could increase their efforts to sell directly to end-users and thereby eliminate or reduce our role in distribution.

Industry consolidation among health care product distributors and manufacturers, price competition, product unavailability, whether due to our inability to gain access to products or to interruptions in manufacturing supply, or the emergence of new competitors, also could increase competition.

Consolidation has also increased among manufacturers of health care products, which could have a material adverse effect on our margins and product availability.

We could be subject to charges and financial losses in the event we fail to satisfy minimum purchase commitments contained in some of our contracts.

Additionally, traditional health care supply and distribution relationships are being challenged by online commerce solutions.

The continued advancement of online commerce by third parties and online price transparency requires us to cost- effectively adapt to changing technologies, to enhance existing services and to differentiate our business (including with additional value-added services) to address changing demands of consumers and our customers.

emergence of such competition and our inability to anticipate and effectively respond to changes on a timely basis could have a material adverse effect on our business, financial condition or operating results.

The health care industry is highly regulated and subject to changing political, economic and regulatory influences.

Uncertainty surrounding possible changes to the health care environment, including changes to regulatory enforcement priorities, may directly or indirectly adversely affect us.

In recent years, the health care industry has been undergoing significant changes driven by various efforts to reduce costs, including, among other factors:

trends toward managed care; collective purchasing arrangements and consolidation among office-based health care practitioners; and changes in reimbursements to customers, including increased attention to value-based payment arrangements, as well as enforcement activities (and related monetary recoveries) by governmental officials.

Both our profitability and that of our customers may be materially adversely affected by laws and regulations reducing reimbursement rates for pharmaceuticals, medical supplies and devices, and/or medical treatments or services, changes to the methodology by which reimbursement levels are determined, or regulating pricing, contracting and discounting practices with respect to medical products and services.

It is possible that the adoption of the One Big Beautiful Bill Act could impact eligibility for participation in Medicare and Medicaid programs, resulting in a change in utilization of the health care system.

In addition, a number of states are considering and enacting laws or regulations to expand their oversight of health care transactions, which may impact the financial stability and strategic opportunities of certain of our customers.

If we are unable to react effectively to these and other changes in the health care industry, our business could be materially adversely affected.

The ACA greatly expanded health insurance coverage in the United States and has been the target of legal and political challenges since its adoption.

Any outcome of these challenges that changes the ACA could have a significant impact on the U.S. health care industry and the ability or willingness of individuals to engage with it.

The health care products industry is subject to a multi-tiered costing structure, which can vary by manufacturer and/or product.

Under this structure, certain institutions can obtain more favorable prices for health care products than we are able to obtain.

The multi-tiered costing structure continues to expand as many large integrated health care providers and others with significant purchasing power, such as GPOs, DSOs and MSOs, demand more favorable pricing terms.

Additionally, the formation of provider networks, GPOs, DSOs and MSOs may shift purchasing decisions to entities or persons with whom we do not have a historical relationship and may threaten our ability to compete effectively, which could in turn negatively impact our financial results.

In addition, such organizations may establish direct relationships with manufacturers, thereby either eliminating or reducing the services historically provided by distributors.

Although we are seeking to obtain similar terms from manufacturers to access lower prices demanded by GPO, DSO and MSO contracts or other contracts, and to develop relationships with existing and emerging provider networks, GPOs, DSOs and MSOs, we cannot guarantee that such terms will be obtained or contracts executed.

Our ability to meet our customers’ expedited delivery expectations is an integral component of our business strategy for which our customers rely.

Shipping is a significant expense in the operation of our business.

We ship almost all of our orders through third-party delivery services, and typically bear the cost of shipment.

Accordingly, any significant increase in shipping rates could have a material adverse effect on our business, financial condition or operating results.

While we have recently experienced increases in shipping costs, we do not expect these additional expenses to be material to our results now, however they could become material in a future fiscal period.

Similarly, strikes or other service interruptions by those shippers, including at transportation centers or shipping ports, could cause our operating expenses to rise and materially adversely affect our ability to deliver products on a timely basis.

Uncertain global and domestic macro-economic and political conditions that affect the economy and the economic outlook of the United States, Europe, Asia and other parts of the world could have a material adverse effect on our business, financial condition or operating results.

These uncertainties, include, among other things, those listed under “Management’s Discussion and Analysis of Financial Condition and Results of Operations, Cautionary Note Regarding Forward-Looking Statements.”

Additionally, changes in government, government debt and/or budget crises may lead to reductions in government spending in certain countries, which could reduce overall health care spending and/or lead to higher income or corporate taxes, which could depress spending overall.

Recessionary or inflationary conditions and depressed levels of consumer and commercial spending may also cause customers to reduce, modify, delay, or cancel plans to purchase our products and may cause suppliers to reduce their output or change their terms of sale.

We have experienced inflationary pressures, including higher freight costs and interest expense, and pressures resulting from the strengthening of the dollar, which have and continue to impact our results of operations.

We generally sell products to customers with payment terms.

If customers’ cash flow or operating and financial performance deteriorate, or if they are unable to make scheduled payments or obtain credit, they may not be able to, or may delay, payment to us.

Likewise, for similar reasons suppliers may restrict credit or impose different payment terms.

We strive to be compliant with the applicable laws, regulations and guidance described below in all material respects, and believe we have effective compliance programs and other controls in place to ensure substantial compliance.

However, compliance is not guaranteed either now or in the future as certain laws, regulations guidance may be subject to varying and evolving interpretations that could affect our ability to comply, as well as future changes, additions and enforcement approaches, including in light of political changes.

Changes with respect to the applicable laws, regulations and guidance described below may require us to update or revise our operations, services, marketing practices, and compliance programs and controls, and may impose additional and unforeseen costs on us, pose new or previously immaterial risks to us, or may otherwise have a material adverse effect on our business.

There can be no assurance that current and future government regulations will not adversely affect our business, and we cannot predict new regulatory priorities, the form, content or timing of regulatory actions, and their impact on the health care industry and on our business and operations.

Global efforts to contain health care costs continue to exert pressure on product pricing.

In the United States, there has been increased scrutiny on drug pricing and concurrent efforts to control or reduce drug costs by Congress, the President, executive branch agencies and various states.

We may be required to report drug pricing data under federal laws and regulations.

Several U.S. states have adopted laws, that may apply to some of our operations, that require drug manufacturers, including re-packagers or re-labelers, to provide advance notice of certain price increases and to report information relating to price increases, while others have established prescription drug affordability boards or multi-payer purchasing pools to reduce the cost of prescription drugs.

At the federal level, for example, the Inflation Reduction Act of 2022, among other things, requires drug manufacturers that raise certain of their drug prices faster than the rate of inflation to pay rebates to Medicare, and over time will authorize the federal government to negotiate directly with drug manufacturers to lower the prices of certain brand-name drugs covered by Medicare.

These various evolving efforts create uncertainty and may adversely affect our business.

Under the Sunshine Act, we are required to collect and report detailed information regarding certain financial relationships we have with covered recipients ( , physicians, dentists, teaching hospitals, other health care practitioners) as well as physician ownership or investment interest.

We may be required to report information under state transparency laws that address circumstances not covered by the Sunshine Act.

We are also subject to similar foreign transparency laws.

While we believe we have substantially compliant programs and controls in place satisfying the above laws and requirements, such compliance imposes additional costs on us and the requirements are sometimes unclear.

Our business is subject to additional requirements under various local, state, federal and foreign laws and regulations applicable to the sale and distribution of, and third-party payment for, pharmaceuticals and medical devices and HCT/P products.

Among the federal laws with which we must comply are the Controlled Substances Act, the Food, Drug & Cosmetic Act, the Federal Drug Quality and Security Act, including the Drug Supply Chain Security Act, and Section 361 of the Public Health Services Act.

Among other things, such laws and the regulations promulgated thereunder:

regulate the introduction, manufacture, advertising, marketing, promotion, sampling, pricing, reimbursement, labeling, packaging, storage, handling, returning, recalling, reporting, distribution of, disposal, and recordkeeping for drugs, HCT/P products and medical devices, including unique device identifiers;

subject us to inspection by the FDA, OSHA, and DEA and similar state authorities;

regulate the storage, transportation and disposal of hazardous materials;

require us to advertise and promote our drugs and devices in accordance with FDA regulations;

require us to report average sales price (ASP) to CMS for drugs or biologicals payable under Medicare Part B with or without a Medicaid drug rebate agreement;

require registration with the FDA and the DEA and various state agencies;

require us to design and operate a system to identify and report suspicious orders of controlled substances to the DEA and certain states;

require us to manage returns of products that have been recalled and subject us to inspection of our recall procedures and activities;

impose on us reporting requirements if a pharmaceutical, HCT/P product or medical device causes an adverse event, serious illness, injury or death;

require manufacturers, wholesalers, re-packagers and dispensers of prescription drugs to identify and trace certain prescription drugs as they are distributed;

require the licensing of prescription drug wholesalers and third-party logistics providers; and mandate compliance with standards for the recordkeeping, storage, handling and documentation of transactions involving prescription drugs and devices and associated reporting requirements.

The FDA regulates certain computer software and digital health products intended for use in health care settings, including, for example, AI and machine learning-enabled medical devices and the cybersecurity of medical devices.

Certain of our businesses involve the development and sale of software and related products to support physician and dental practice management, and it is possible that the FDA or foreign government authorities could determine that one or more of our products is subject to regulation as a medical device, which could subject our businesses to substantial additional requirements, costs, potential enforcement actions or liabilities for noncompliance with respect to these products.

For example, some of our imaging software is regulated as a medical device which subjects our businesses to substantial additional requirements, costs and potential enforcement actions or liabilities for noncompliance with respect to these products.

Applicable federal, state, local and foreign laws and regulations also may require us to meet various standards relating to, among other things, licensure, registration, program eligibility, procurement, third-party reimbursement, sales and marketing practices, product integrity and supply tracking to product manufacturers, product labeling, personnel, privacy and security of health or other personal information, installation, maintenance and repair of equipment and the importation and exportation of products.

The FDA, DEA, OCR, and state privacy regulators, as well as CMS (including with respect to complex Medicare reimbursement requirements applicable to our specialty home medical supplies business) and state Medicaid agencies, have recently increased their regulatory and enforcement activities and, in particular, the DEA has heightened enforcement activities due to the opioid crisis in the United States.

The failure to comply with any of these laws or regulations, or new interpretations of them, or the imposition of any additional laws and regulations, could materially adversely affect our business.

The costs to us associated with complying with the various applicable statutes and regulations, as they now exist and as they may be modified, could be material.

Allegations by a governmental body that we have not complied with these laws could have a material adverse effect on our businesses.

While we believe that we are substantially compliant with applicable laws and regulations, and have adequate compliance programs and controls in place to ensure substantial compliance, if it is determined that we have not complied with these laws, we are potentially subject to warning letters, substantial civil and criminal penalties, mandatory recall of product, seizure of product and injunction, consent decrees and suspension or limitation of payments to us, product sale and distribution.

If we enter into settlement agreements to resolve allegations of non-compliance, we could be required to make settlement payments or be subject to civil and criminal penalties, including fines and the loss of licenses.

Non-compliance with government requirements could also adversely affect our ability to participate in important federal and state government health care programs, such as Medicare and Medicaid, and damage our reputation.

The EU MDR significantly modified the regulatory compliance requirements for the medical device industry as a whole.

Among other things, as mentioned above, the EU MDR:

strengthens the rules on placing devices on the market and reinforces surveillance thereafter;

establishes explicit provisions on manufacturers’ responsibilities for the follow-up of the quality, performance and safety of devices placed on the market;

improves the traceability of medical devices throughout the supply chain to the end-user or patient through a unique identification number;

sets up a central database (EUDAMED) to provide patients, health care professionals and the public with comprehensive information on devices, importers, and distributors registered in the EU;

strengthens rules for the assessment of certain high-risk devices, such as implants, which may have to undergo an additional check by experts before they are placed on the market; and contains specific provisions in the event of interruption or discontinuation of supply of a device.

The EU MDR imposes strict requirements for the confirmation that a product meets the regulatory requirements, including regarding a product’s clinical evaluation and a company’s quality systems, and for the distribution, marketing and sale of medical devices, including post-market surveillance.

Pursuant to Regulation 2023/607 and subject to certain conditions, medical devices that (i) obtained a certificate under the EU Medical Device Directive from May 25, 2017, (ii) which was still valid on May 26, 2021, and (iii) has not been subsequently withdrawn may continue to be placed on the market or put into service until December 31, 2027 for higher risk devices or December 31, 2028 for medium and lower risk devices.

The modifications created by the EU MDR may have an impact on the way we design and manufacture products and the way we conduct our business in the EEA.

Certain of our businesses are subject to federal and state (and similar foreign) health care fraud and abuse, referral and reimbursement laws and regulations with respect to their operations.

Some of these laws, referred to as “false claims laws,” prohibit the submission or causing the submission of false or fraudulent claims for reimbursement to federal, state and other health care payers and programs.

Other laws, referred to as “anti-kickback laws,” prohibit soliciting, offering, receiving or paying remuneration in order to induce or reward the referral of a patient or ordering, purchasing, leasing or arranging for, or recommending ordering, purchasing or leasing of, items or services that are paid for by federal, state and other health care payers and programs.

Certain additional state and federal laws, such as the federal Physician Self-Referral Law (“Stark Law”), prohibit physicians and other health care professionals from referring a patient to an entity with which the physician (or family member) has a financial relationship, for the furnishing of certain designated health services (for example, durable medical equipment and medical supplies), unless an exception applies.

The fraud and abuse laws and regulations have been subject to heightened enforcement activity over the past few years, often as the result of “relators” who serve as whistleblowers by filing complaints in the name of the United States (and if applicable, particular states) under applicable false claims laws, and who may receive up to 30% of total government recoveries.

Penalties under fraud and abuse laws may be severe, including treble damages substantial civil penalties under the federal False Claims Act, as well as potential loss of licenses and the ability to participate in federal and state health care programs, criminal penalties, or imposition of a corporate compliance monitor, which could have a material adverse effect on our business.

Also, these measures may be interpreted or applied by a prosecutorial, regulatory or judicial authority in a manner that could require us to make changes in our operations or incur substantial defense and settlement expenses.

Even unsuccessful challenges by regulatory authorities or relators could result in reputational harm and the incurring of substantial costs.

Most states have adopted similar state false claims acts, and these state laws have their own penalties which may be in addition to federal False Claims Act penalties, and other fraud and abuse laws.

The U.S. government and industry trade associations (among others) have expressed concerns about financial relationships between suppliers or manufacturers on the one hand and physicians, dentists and other health care providers, on the other.

As a result, we regularly review and revise our marketing practices as necessary to facilitate compliance.

Our aspirations, goals and disclosures related to environmental, social and governance matters and the focus on regulators and private litigants among other things on related claims made by companies and funds expose us to numerous risks, including reputational, financial, legal and other risks, that could have an adverse impact on us.

California has adopted stringent new climate disclosure requirements, as has the EU.

We are subject to Directive (EU) 2022/2464 on corporate sustainability reporting (“CSRD”) which became effective on January 5, 2023.

CSRD requires in-scope companies to report sustainability-related information that is material from both a financial risk or opportunity and an environmental or social impact perspective, and the assessment of materiality is inherently subjective.

Furthermore, Directive No. 2025/794 of 14 April 2025, the “Omnibus” Directive, amended Directive 2022/2464 by introducing a two-year postponement of the sustainability reporting requirements for financial years beginning on or after 1 st January 2025 and on or after 1 st January 2026.

This “Omnibus” legislative package amending the CSRD alters the scope, thresholds, timing and contents of reporting obligations, which may increase our costs.

CSRD is being transposed into national law across EU Member States, and further legislative or implementation changes may also increase our costs.

We also are subject to certain United States and foreign laws and regulations concerning the conduct of our foreign operations, including the U.S. Foreign Corrupt Practices Act, the U.K. Bribery Act, German anti-corruption laws and other anti-bribery laws and laws pertaining to the accuracy of our internal books and records.

Our businesses are generally subject to numerous other laws and regulations that could impact our financial results, including, without limitation, securities, antitrust, consumer protection and marketing laws and regulations.

In the EU, Directive No. 2019/1937 of October 23, 2019, on the protection of persons who report breaches of Union law, organizes the legal protection of whistleblowers.

This Directive covers whistleblowers reporting breaches of EU laws and regulations and protects a wide range of people, including former employees.

All private companies with 50 or more employees are required to create effective internal reporting channels.

All EU Member States have now implemented the Directive.

In the EU, both active and passive corruption in the private sector are criminalized.

The EU Council Framework Decision 2003/568/JHA of 22 July 2003 on combating corruption in the private sector establishes more detailed rules on the liability of legal persons and deterrent sanctions.

However, the liability of legal persons is regulated at a national level.

Failure to comply with fraud and abuse laws and regulations, and other laws and regulations, could result in significant civil and criminal penalties and costs, including the loss of licenses and the ability to participate in federal and state health care programs, and could have a material adverse effect on our business.

We may determine to enter into settlements, make payments, agree to consent decrees or enter into other arrangements to resolve such matters.

Intentional or unintentional failure to comply with settlement agreements or consent decrees could materially adversely affect our business.

While we believe that we are substantially compliant with applicable laws and regulations, and believe we have adequate compliance programs and controls in place to ensure substantial compliance, we cannot predict whether changes in applicable law, or interpretation of laws, or changes in our services or marketing practices in response to changes in applicable law or interpretation of laws, could have a material adverse effect on our business.

Our businesses that involve physician and dental practice management products, equipment and our specialty home medical supplies businesses, and our self-funded employee benefits programs include information technology (IT) systems that store and process personal health, clinical, financial, and other sensitive information of individuals.

These IT systems may be vulnerable to breakdown, wrongful intrusions, data breaches and malicious attack, which could require us to expend significant resources to eliminate these problems and address related security concerns, and could involve claims against us by private parties and/or governmental agencies.

We are directly or indirectly subject to numerous and evolving federal, state, local and foreign laws and regulations that protect the privacy and security of personal information (including health data), such as HIPAA, CAN-SPAM, TCPA, Section 5 of the FTC Act, the CCPA/CPRA and various other privacy laws that have or will soon come into effect.

Laws and regulations relating to privacy and data protection are continually evolving and subject to potentially differing interpretations, including those relating to AI.

These requirements may not be harmonized, may be interpreted and applied in a manner that is inconsistent from one jurisdiction to another or may conflict with other rules or our practices.

In addition to state-specific data breach notification laws (which exist in all U.S. states and territories), cybersecurity laws such as the federal Cyber Incident Reporting for Critical Infrastructure Act of 2022, proposed Federal Acquisition Regulations and amendments to SEC reporting requirements may require us to provide notifications about cybersecurity incidents in limited timeframes and before investigations are complete.

Our businesses’ failure to comply with these laws and regulations could expose us to breach of contract claims, substantial fines, penalties and other liabilities and expenses, costs for remediation and harm to our reputation.

Evolving laws and regulations in this area could restrict the ability of our customers to obtain, use or disseminate patient information, or could require us to incur significant additional costs to re-design our products to reflect these legal requirements, which could have a material adverse effect on our operations.

In addition, the European Parliament and the Council of the EU adopted the GDPR that has been effective since May 25, 2018, which increased privacy rights for Data Subjects in the European Economic Area (EEA), including individuals who are our customers, suppliers and employees.

The GDPR extended the scope of responsibilities for data controllers and data processors, and generally imposes increased requirements and potential penalties on companies, such as us, that are either established in the EU and process personal data of Data Subjects (regardless the Data Subject location), or that are not established in the EU but that offer goods or services to Data Subjects in the EU or monitor their behavior in the EU. Noncompliance can result in penalties of up to the greater of EUR 20 million, or 4% of global company revenues (sanction that may be public), and Data Subjects may seek damages.

Member states may individually impose additional requirements and penalties regarding certain limited matters (for which the GDPR left some room of flexibility), such as employee personal data.

With respect to the personal data it protects, the GDPR requires, among other things, controller accountability, consents from Data Subjects or another acceptable legal basis to process the personal data, notification within 72 hours of a personal data breach where required, data integrity and security, and fairness and transparency regarding the storage, use or other processing of the personal data.

The GDPR also provides rights to Data Subjects relating notably to information, access, rectification, erasure of the personal data and the right to object to the processing.

Despite Brexit, the UK also has data protection laws equivalent to the GDPR and has implemented further data protection related legislation.

Switzerland enacted FADP.

Data protection authorities located in different EU Member States may interpret GDPR differently, or requirements of national laws may vary between the EU Member States, UK and Switzerland, or guidance on GDPR and related laws and compliance practices may be often updated or otherwise revised.

Any of these events will increase the complexity and costs of processing personal data in the European Economic Area, UK or Switzerland or concerning individuals located in these jurisdictions.

Effective November 1, 2021, China’s PIPL imposes specific rules for processing personal information and specifies that the law shall also apply to personal information activities carried out outside China but for the purpose of providing products or services to PRC citizens.

Any non-compliance with these laws and regulations may subject us to fines, orders to rectify or terminate any actions that are deemed illegal by regulatory authorities, other penalties, reputational damage, or legal proceedings against us, which may affect our business, financial condition or results of operations.

The PIPL carries maximum penalties of CNY50 million or 5% of the annual revenue of entities that process personal data.

Data protection laws in other countries, such as Brazil, are also quickly evolving, with many countries having updated, or are in the process of updating, their laws to bring them more in line with the model created by GDPR.

In the United States, the CCPA, effective January 1, 2020, establishes a privacy framework for covered businesses such as ours by, among other things, creating an expanded definition of personal information, establishing new data privacy rights for California residents and creating a new and potentially severe statutory damages framework for violations of the CCPA, as well as potentially severe statutory damages and a private right of action against businesses that suffer a data security breach due to their violation of a duty to implement reasonable security procedures and practices.

This private right of action may increase the likelihood of, and risks associated with, data breach litigation.

In addition, California voters adopted the CPRA (effective January 1, 2023) which enhances and strengthens regulatory requirements and individual protections that currently exist under the CCPA.

Effective as of January 1, 2026, the CCPA/CPRA regulatory framework includes expanded requirements.

Other states have enacted or are considering enacting similar privacy laws, which may subject us to additional requirements and restrictions that could have an impact on our business.

As of January 1, 2026, comprehensive privacy laws are now in effect in 20 states, further complicating our privacy compliance obligations through the introduction of increasingly disparate requirements across the various U.S. jurisdictions in which we operate.

Additionally, certain states have enacted specific health data privacy laws and other states are considering similar legislation.

Congress is considering legislation that may preempt some or all of such U.S. state privacy laws, but which may also provide a more expansive private right of action for privacy claims than exists under current state laws.

The evolving complexity of privacy and data security legislation in the U.S. and other jurisdictions globally may complicate our compliance efforts and further increase our risk of regulatory enforcement, penalties and litigation.

While we believe we have substantially compliant programs and controls in place to comply with privacy laws domestically and internationally, our compliance with data privacy and cybersecurity laws is likely to impose additional costs on us, and we cannot predict whether the interpretations of the requirements, or changes in our practices in response to new requirements/interpretations, could have a material adverse effect on our business.

Our products and services utilize new technologies, such as AI.

The regulatory landscape for AI is changing rapidly, with both domestic and international activity.

While there is currently no comprehensive federal legislation in the U.S. concerning the use, development or deployment of AI, regulators pursue AI-related enforcement actions under existing federal consumer protection laws and have issued related guidance.

Further, state privacy, consumer protection and AI-specific laws are proliferating and may be applicable to our business.

Other countries are also applying their data and consumer protection laws to AI, particularly generative AI, and are considering and implementing specific legal frameworks with respect to AI.

Regulation (EU) 2024/1689 on harmonized rules on artificial intelligence (the EU AI Act), for example, establishes a comprehensive regulatory framework for AI that became law in August 2024 with implementation phased through into 2027.

As with the GDPR, it has extra- territorial effect.

Any failure or perceived failure by us to comply with such requirements could have an adverse impact on our business.

Anticipated further evolution of regulations and legislation on this topic may substantially increase the penalties to which we could be subject in the event of any non-compliance.

Compliance with these laws is challenging, constantly evolving and time consuming and federal regulators, state attorneys general and plaintiff’s attorneys have been and will likely continue to be active in this space.

We may incur substantial expense in complying with legal obligations to be imposed by new regulations and we may be required to make significant changes to our solutions and expanding business operations, all of which may adversely affect our operations.

We also sell products and services that health care providers, such as physicians and dentists, use to store and manage patient medical or dental records.

These customers and we are subject to laws, regulations and industry standards, such as HIPAA and the Payment Card Industry (PCI) Data Security Standards, which require the protection of the privacy and security of those records.

Our products or services may be used as part of these customers’ comprehensive data security programs, including in connection with their efforts to comply with applicable data privacy and security laws and contractual requirements.

Perceived or actual security vulnerabilities in our products or services, or the perceived or actual failure by us or our customers who use our products or services to comply with applicable legal or contractual data privacy and security requirements, may not only cause us significant reputational harm, but may also lead to claims against us by our customers and/or governmental agencies and involve substantial fines, penalties and other liabilities and expenses and costs for remediation.

Additionally, under the GDPR (and equivalent laws) and U.S. state privacy laws, health data belong to the category of “sensitive data” and benefit from specific protection.

Processing of such data is generally prohibited, except for specific exceptions.

Certain of our businesses involve the manufacture and sale of electronic health record (EHR) systems and other products linked to government supported incentive programs, where the EHR systems must be certified as having certain capabilities designated in evolving standards, such as those adopted by CMS and ONC.

In order to maintain certification of our EHR products, we must satisfy the changing governmental standards.

If any other EHR systems do not meet these standards, yet have been relied upon by health care providers to receive federal incentive payments, we may be exposed to risk, such as under federal health care fraud and abuse laws, including the False Claims Act.

Additionally, effective September 1, 2023, the HHS-OIG issued a final rule implementing civil money penalties for information blocking as established by the Cures Act.

OIG incorporated regulations published by ONC as the basis for enforcing information blocking penalties.

Each information blocking violation carries a $1 million penalty.

While we believe we are substantially in compliance with such certifications and with applicable fraud and abuse laws and regulations and that we have adequate compliance programs and controls in place to ensure substantial compliance, we cannot predict whether changes in applicable law, or interpretation of laws, or resulting changes in our compliance programs and controls, could have a material adverse effect on our business.

Moreover, in order to satisfy our customers and comply with evolving legal requirements, our products may need to incorporate increasingly complex functionality, such as reporting and information blocking.

Although we believe we are positioned to accomplish this, the effort may involve increased costs, and our failure to implement product modifications, or otherwise satisfy applicable standards, could have a material adverse effect on our business.

Additionally, as electronic medical devices are increasingly connected to each other and to other technology, the ability of these connected systems to safely and effectively exchange and use exchanged information becomes increasingly important.

As a medical device manufacturer, we must manage risks including those associated with an electronic interface that is incorporated into a medical device.

We are subject to the tax laws and regulations of the United States federal, state and local governments, as well as foreign jurisdictions.

From time to time, various legislative initiatives may be proposed that could materially adversely affect our tax positions.

There can be no assurance that our effective tax rate will not be materially adversely affected by legislation resulting from these initiatives.

In addition, tax laws and regulations are extremely complex and subject to varying interpretations.

Although we believe that our historical tax positions are sound and consistent with applicable laws, regulations and existing precedent, there can be no assurance that our tax positions will not be challenged by relevant tax authorities or that we would be successful in any such challenge.

Our business involves a risk of product liability, intellectual property infringement and other claims in the ordinary course of business, and from time to time we are named as a defendant in cases as a result of our distribution of products.

Additionally, we own and own interests in companies that manufacture certain dental and medical products.

As a result, we could be subject to the potential risk of product liability, intellectual property infringement or other claims relating to the manufacture and distribution of products by those entities.

In addition, as our corporate brand business continues to grow, purchasers of such products may increasingly seek recourse directly from us, rather than the ultimate product manufacturer, for product-related claims.

Another potential risk we face in the distribution of our products is liability resulting from counterfeit or tainted products infiltrating the supply chain.

In addition, some of the products that we transport and sell are considered hazardous materials.

improper handling of such materials or accidents involving the transportation of such materials could subject us to liability or at least legal action that could harm our reputation.

Government-imposed import policies and legislation regulating the import of goods and prohibiting the use of forced labor or human trafficking could result in delays or the inability to import goods in a timely manner that are necessary to our operations, and such policies or legislation could also result in financial penalties, other sanctions, government enforcement actions and reputational harm.

Certain of our suppliers have had their ability to service certain markets restricted or negatively impacted because of allegations of forced labor in their supply chain.

While the Company has policies against and seeks to avoid the import of goods that are manufactured in whole or in part by forced labor or through human trafficking, as a result of legislative and governmental policy initiatives, we may be subject to increasing potential delays, added costs, supply chain disruption and other restrictions.

.

Our business operations, results of operations, cash flows, financial condition and liquidity may be negatively impacted by the effects of disease outbreaks, epidemics, pandemics, similar wide-spread public health concerns and other natural or man-made disasters, such as terrorism, civil unrest, fire and extreme weather (“disasters”).

For example, as a global health care solutions company, the COVID-19 pandemic and the governmental responses to it had a material adverse effect on our business, financial condition, operating results and cash flows.

The impacts and potential impacts from the COVID-19 pandemic included, and could include as a result of other disasters, adverse impacts such as significant volatility in supply, demand and selling prices, interrupted operations of industries that use or manufacture the products we distribute for personal protective equipment (PPE), test kits and related products, reduction in peoples’ ability and willingness to be in public, impact of adapted business practices, volatility in the financial markets, and unavailability or impairment of our manufacturing, distribution, or other facilities, or firmwide systems such as our IS.

Our global operations are subject to risks that could materially adversely affect our business, including, among other things:

difficulties and costs relating to staffing and managing foreign operations;

difficulties and delays inherent in sourcing products, establishing channels of distribution and contract manufacturing in foreign markets;

fluctuations in the value of foreign currencies;

uncertainties relating to trade agreements and international trade relationships;

longer payment cycles and difficulty of collecting receivables in foreign jurisdictions;

repatriation of cash from our foreign operations to the United States;

regulatory requirements, including, without limitation, anti-bribery, anti-corruption and laws pertaining to the accuracy of our internal books and records;

litigation risks;

unexpected difficulties in importing or exporting our products and import/export tariffs, quotas, sanctions or penalties;

limitations on our ability under local laws to protect our intellectual property;

unexpected regulatory, legal, economic and political changes in foreign markets;

changes in tax regulations that influence purchases of capital equipment;

civil disturbances, geopolitical turmoil, including terrorism, war or political or military coups; and risks associated with climate change, including physical risks such as impacts from extreme weather events and other potential physical consequences, regulatory and technological requirements, market developments, stakeholder expectations and reputational risk.

On July 15, 2025, the Company announced that Mr. Bergman will retire as the Company’s CEO on December 31, 2025 (which date was extended to March 1, 2026), and that Mr. Bergman will continue to serve as Chairman of the Board of Directors of the Company following his retirement.

On January 12, 2026, the Company announced the appointment of Frederick M. Lowery as its next CEO, effective March 2, 2026, at which time he will join the Company’s Board of Directors.

Our future success is substantially dependent upon the efforts and abilities of members of our senior management.

Competition for senior management is intense, burnout and turn-over rates are increasing workplace concerns, transitions among senior level officers can present challenges as well as opportunities, and we may not be successful in attracting and retaining key personnel, or transitioning to new personnel following departures.

Additionally, our future revenues and profitability depend on our ability to maintain satisfactory relationships with qualified personnel, as well as customers, suppliers and manufacturers.

If we fail to maintain our existing relationships with such persons or fail to acquire relationships with such key persons in the future, our business may be materially adversely affected.

Our ability to make scheduled payments or refinance our obligations with respect to indebtedness will depend on our operating and financial performance, which in turn is subject to prevailing economic conditions and financial, business and other factors beyond our control.

Disruptions in the financial markets may materially adversely affect the availability and cost of credit to us.