assess whether an ownership change has occurred or whether there have been multiple ownership changes since our formation date, and there may be ownership changes in the future, some of which may be outside of our control. If we undergo an ownership change, and our ability to use our pre-change NOL carryforwards and other pre-change tax attributes (such as research tax credits) to offset our post-change income or taxes (if any) is limited, such limitation could harm our future results of operations by effectively increasing our future tax obligations. Similar provisions of state tax law may also apply to limit our use of accumulated state tax attributes. In addition, at the state level, there may be periods during which the use of net operating losses is suspended or otherwise limited, which could accelerate or permanently increase state taxes owed. As a result, even if we attain profitability, we may be unable to use all or a material portion of our net operating losses and other tax attributes, which could adversely affect our future cash flows.
Recent and future changes to tax laws could materially adversely affect our company.
The tax regimes we are subject to or operate under, including with respect to income and non-income taxes, are unsettled and may be subject to significant change. Changes in tax laws, regulations or rulings, or changes in interpretations of existing laws and regulations, could materially adversely affect our company. For example, the Tax Cuts and Jobs Act, the Coronavirus Aid, Relief, and Economic Security Act, and the Inflation Reduction Act enacted many significant changes to the U.S. tax laws. Future guidance from the Internal Revenue Service and other tax authorities with respect to such legislation may affect us, and certain aspects thereof could be repealed or modified in future legislation. For example, the Inflation Reduction Act (IRA) includes provisions that will impact the U.S. federal income taxation of certain corporations, including imposing a 15% minimum tax on the book income of certain large corporations and an excise tax on certain corporate stock repurchases that would be imposed on the corporation repurchasing such stock. In addition, many countries in Europe, as well as a number of other countries and organizations (including the Organization for Economic Cooperation and Development and the European Commission), have proposed, recommended, or (in the case of countries) enacted or otherwise become subject to changes to existing tax laws or new tax laws that could significantly increase our tax obligations in the countries where we do business or require us to change the manner in which we operate our business.
If our information technology systems, or those used by our CROs, CMOs, clinical sites or other third parties upon which we rely, are or were compromised, become unavailable or suffer security breaches, loss or leakage of data or other disruptions, we could suffer material adverse consequences resulting from such compromise, including but not limited to, operational or service interruption, harm to our reputation, regulatory investigations or actions, litigation, fines, penalties and liability, and other adverse consequences to our business, results of operations and financial condition.
In the ordinary course of our business, we, and the third parties upon which we rely, process personal information and other sensitive data, including intellectual property, trade secrets, proprietary or confidential business information, preclinical and clinical trial data, personal information related to relevant stakeholders, third-party data, and other sensitive data (collectively, sensitive information) and as a result, we and the third parties upon which we rely face a variety of evolving threats which could cause security incidents affecting or interruptions to our information technology systems and sensitive information.
Our information technology systems and those of our CROs, CMOs, clinical sites and other third parties upon which we rely are vulnerable to attack, damage and interruption from a variety of evolving threats, including but not limited to computer viruses, misconfigurations, software bugs, worms, or other vulnerabilities and malicious codes, malware (including ransomware and as a result of advanced persistent threat intrusions), application security attacks, social engineering (including through phishing attacks and deep fakes, which may be increasingly more difficult to identify as fake), supply chain attacks and vulnerabilities through our third-party service providers, denial or degradation-of-service attacks (such as credential stuffing), credential harvesting, personnel misconduct or error, fraud, server malfunctions, software or hardware failures, loss of data or other information technology assets, attacks enhanced or facilitated by AI, adware, telecommunications and electrical failures, terrorism, war, earthquakes, fires, floods, and other similar threats. Such threats are prevalent, are occurring more often, are increasingly difficult to detect, and come from a variety of sources, including traditional computer “hackers,” threat actors, “hacktivists,” organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation states, and nation-state-supported actors. In particular, ransomware attacks, including those from organized criminal threat actors, nation-