Amgen Inc

Item 1A.RISK FACTORS

This report and other documents we file with the SEC contain forward-looking statements that are based on current expectations, estimates, forecasts and projections about us, our future performance, our business, our beliefs and our managements assumptions. These statements are not guarantees of future performance and involve certain risks, uncertainties and assumptions that are difficult to predict. You should carefully consider the risks and uncertainties our business faces. The risks described below are not the only ones we face. Our business is also subject to the risks that affect many other companies, such as employment relations, general economic conditions, geopolitical events and international operations. Further, additional risks not currently known to us or that we currently believe are immaterial may in the future materially and adversely affect our business, operations, liquidity and stock price.

Below we provide in supplemental form the material changes to our risk factors that occurred during the past quarter. Our risk factors disclosed in Part I, Item 1A, of our Annual Report, on Form 10-K for the year ended December 31, 2023, provide additional disclosure for these supplemental risks and are incorporated herein by reference.

Our sales depend on coverage and reimbursement from government and commercial third-party payers, and pricing and reimbursement pressures have affected, and are likely to continue to affect, our profitability.

Sales of our products depend on the availability and extent of coverage and reimbursement from third-party payers, including government healthcare programs and private insurance plans. Governments and private payers continue to pursue initiatives to manage drug utilization and contain costs. Further, pressures on healthcare budgets from the economic downturn and inflation continue and are likely to increase across the markets we serve. Payers are increasingly focused on costs, which have resulted, and are expected to continue to result, in lower reimbursement rates for our products or narrower populations for which payers will reimburse. Continued intense public scrutiny of the price of drugs and other healthcare costs, together with payer dynamics, have limited, and are likely to continue to limit, our ability to set or adjust the price of our products based on their value, which can have a material adverse effect on our business. In the United States, particularly over the past few years, a number of legislative and regulatory proposals have been introduced and/or signed into law that attempt to lower drug prices. These include the IRA law that enables the U.S. government to set prices for certain drugs in Medicare, redesigns Medicare Part D benefits to shift a greater portion of the costs to manufacturers and enables the U.S. government to impose penalties if drug prices are increased at a rate faster than inflation (IRA Inflation Penalties). Additional proposals focused on drug pricing continue to be debated, and additional executive orders  or regulatory initiatives focused on drug pricing and competition are likely to be adopted and implemented in some form. In March 2024, the Administration released its budget plan for fiscal year 2025 that included proposals to expand the IRAs drug price setting to more drugs and sooner after launch and making IRA Inflation Penalties applicable to commercial health insurance. Government actions or ballot initiatives at the state level also represent a highly active area of policymaking and experimentation, including proposals that limit drug reimbursement under state run Medicaid programs based on decisions of drug affordability boards, use of reference prices, or permitting importation of drugs from Canada. Such state policies may also eventually be adopted at the federal level.

We are unable to predict which or how many policy, regulatory, administrative or legislative changes may ultimately be, or effectively estimate the consequences to our business if, enacted and implemented. However, to the extent that payer actions further decrease or modify the coverage or reimbursement available for our products, require that we pay increased rebates or shift other costs to us, limit or affect our decisions regarding the pricing of or otherwise reduce the use of our products, such actions could have a material adverse effect on our business and results of operations.

45

46

Changing U.S. federal coverage and reimbursement policies and practices have affected and are likely to continue to affect access to, pricing of and sales of our products

A substantial portion of our U.S. business relies on reimbursement from federal government healthcare programs and commercial insurance plans regulated by federal and state governments. See Part I, Item 1. BusinessReimbursement, of our Annual Report on Form 10-K for the year ended December 31, 2023. Our business has been and will continue to be affected by legislative actions changing U.S. federal reimbursement policy. For example, in 2022, the IRA was enacted and includes provisions requiring that beginning in 2026, mandatory price setting be introduced in Medicare for certain drugs paid for under Parts B and D, whereby manufacturers must accept a price established by the government or face penalties on all U.S. sales (starting with 10 drugs in 2026, adding 15 in 2027 and 2028, and adding 20 in 2029 and subsequent years such that by 2031 approximately 100 drugs could be subject to such set prices). The Medicare price setting process began in August 2023 when CMS announced the first 10 drugs for Medicare price setting, which includes ENBREL, currently a product that generates considerable revenue. Effective July 30, 2024, CMS has set a price for ENBREL in Medicare Part D that will be , applicable beginning on January 1, 2026, which we expect will negatively impact its profitability. See Part I, Item 2. Managements Discussion and Analysis of Financial Condition and Results of OperationsResults of operationsProduct salesENBREL. Depending on the growth and success of our medicines, other of our medicines may also be subject to selection by CMS in the next, or in a future, cycle of mandatory Medicare price setting. If other of our medicines are selected by CMS for mandatory Medicare price setting, we may be required to accept a price set by the government for Medicare similar to the process that was applied to ENBREL. Also under the IRA, starting on January 1, 2024, Medicare Part D was redesigned to cap beneficiary out-of-pocket costs and, beginning January 1, 2025, Federal reinsurance will be reduced in the catastrophic phase (resulting in a shift and increase of such costs to Part D plans and manufacturers, including by requiring manufacturer discounts on certain drugs). Further, the IRA created a mechanism for CMS to collect rebates from manufacturers if price increases outpace inflation. Rebate obligations began to accrue October 1, 2022 for Medicare Part D and January 1, 2023 for Medicare Part B, but CMS has not yet issued invoices and has some discretion as to when to issue such invoices to manufacturers. We expect that several of our products will be subject to these inflation rebates, and several of our products have been on lists that are issued and updated on a quarterly basis by CMS under a related program under which Medicare beneficiaries are charged reduced coinsurance if price increases exceed inflation. The IRAs drug pricing controls and Medicare redesign are likely to have a material adverse effect on our sales, our business and our results of operations, and such impact is expected to increase through the end of the decade and will depend on factors including the extent of our portfolios exposure to Medicare reimbursement, the rate of inflation over time, the number of our products selected for mandatory price setting and the timing of market entry of generic or biosimilar competition. Further, following the passage of the IRA, the environment remains dynamic and U.S. policymakers continue to demonstrate interest in health care and drug pricing changes. For example, in April 2024, CMS finalized policy changes that will give Part D plans more flexibility to substitute biosimilars for reference products on formularies in 2025. In early 2023, the HHS selected new healthcare payment and delivery models for testing, in response to an October 2022 Executive Order on Lowering Prescription Drug Costs for Americans, including the Accelerating Clinical Evidence Model, which could introduce new payment methods that reduce reimbursement for drugs approved under accelerated approval. That Executive Order followed a 2021 Executive Order designed to increase competition in the healthcare sector, including by calling for the FDA to work with states that seek to develop prescription drug importation programs and the FTC to apply greater scrutiny of anticompetitive activity and responses to which include actions from the HHS (which released a report with drug pricing proposals that seek to promote competition) and from the U.S. Patent and Trademark Office (which has taken steps to strengthen coordination with the FDA to address perceived impediments to generic drug and biosimilar competition). Other CMS policy changes and demonstration projects to test new care, delivery and payment models can also significantly affect how drugs, including our products, are covered and reimbursed. In the fourth quarter of 2021, HHS released a plan to address drug pricing that included potential future mandatory models that link payment for prescription drugs and biologics to certain factors, including the overall cost of care. In March 20234, the Administration released its budget plan for fiscal year 20245 that included proposals to expand the number of drugs subject to mandatory Medicare price setting under the IRA, imposing such price setting activity earlier, and extending to commercial health insurance the requirement that drug manufacturers pay rebates if price increases outpace inflation. While those proposed expansions of the IRAs drug pricing controls have not been enacted, the proposals demonstrate that this area continues to be a focus of the Administration.

We also face risks related to the reporting of pricing data that affects reimbursement of and discounts provided for our products. U.S. government price reporting regulations are complex and may require biopharmaceutical manufacturers to update certain previously submitted data. If our submitted pricing data are incorrect, we may become subject to substantial fines and penalties or other government enforcement actions, which could have a material adverse effect on our business and results of operations. In addition, as a result of restating previously reported price data, we may be required to pay additional rebates and provide additional discounts.

467

Changing reimbursement and pricing actions in various states have negatively affected and may continue to negatively affect access to, and have affected and may continue to affect sales of, our products

At the state level, legislation, government actions, and ballot initiatives can also affect how our products are covered and reimbursed and/or create additional pressure on our pricing decisions. Existing and proposed state pricing laws have added complexity to the pricing of drugs and may already be affecting industry pricing decisions. A number of states have adopted, and many other states are considering, PDABs, drug importation programs, reference pricing schemes, and other pricing actions, including proposals designed to require biopharmaceutical manufacturers to report to the state proprietary pricing information or provide advance notice of certain price increases.

States are also enacting laws referencing the IRA and seeking to regulate the 340B Drug Pricing Program. For example, following the passage of the IRA, bills have been proposed in multiple states that would apply the drug price caps set by HHS for Medicare to drug prices in an individual state, and such references to IRA price caps have also been included in PDAB legislation. For Medicaid patients, states have established a Medicaid drug spending cap (New York) and implemented a new review and supplemental rebate negotiation process (Massachusetts). Eight states (Colorado, Maine, New Hampshire, New Jersey, Maryland, Minnesota, Oregon and Washington) have enacted laws that establish PDABs to identify drugs that pose affordability challenges, and four such states include authority for the state PDAB to set upper payment limits on certain drugs for in-state patients, payers and providers. In 2024, no fewer than 167 states introduced PDAB legislation. The eight states with enacted PDAB laws are in various phases of implementation, with Colorados PDAB being the furthest along. In August 2023, the Colorado PDAB announced the first five drugs to undergo an affordability review, three of which, including ENBREL, have since been deemed unaffordable and will be subject to rulemaking to establish an Upper Payment Limit (UPL). For ENBREL, a UPL could be effective as soon as the seconthird quarter of 2025. Further, Louisiana, Arkansas, West Virginia, Minnesota, Kansas, Mississippi, Missouri and Maryland have enacted laws with mandates on manufacturers participating in the 340B drug pricing program, and, thus far in 2024, no fewer than 25 states have considered similar legislation. These bills vary, but include provisions on restricting a manufacturers ability to direct drugs in 340B channels, recognizing 340B contract pharmacies and a prohibition on requiring the inclusion of 340B claims modifiers. In March 2024, the U.S. Court of Appeals for the 8th Circuit ruled that Arkansas Act 1103, which prohibits drugmakers from restricting the acquisition or delivery of 340B drugs to covered entities and their contract pharmacies, was not preempted by the federal 340B statute. The decision could increase the number of states that will consider similar legislation. Further, in In July 2024, the U.S. District Court for the Southern District of Mississippi denied motions for a preliminary injunction in two cases challenging a similar law in Mississippi, finding that neither plaintiff had demonstrated a substantial likelihood of success on the merits. These orders are being appealed at the U.S. Court of Appeals for the 5th Circuit. In September 2024, the U.S. District Court for the Western District of Louisiana dismissed a lawsuit challenging Louisianas 340B contract pharmacy mandate law, and the U.S. District Court for the District of Maryland denied a motion for preliminary injunction challenging a similar law in Maryland. These lawsuits challenging states on their 340B contract pharmacy laws are subsequent to Genesis Health Care, Inc. v. Becerra, where the U.S. District Court for the District of South Carolina issued an order in November 2023 that enjoins the Health Resources and Services Administration from enforcing its more restrictive interpretation of what is considered a patient under the 340B program, to the potential benefit of healthcare systems seeking to expand the application of 340B discounts.

Additionally, on January 5, 2024, the FDA authorized Florida to move forward with its importation program proposal. Colorado, Maine, New Hampshire, New Mexico, Texas and Vermont have also enacted state importation laws, and some have submitted plans for approval to the FDA. Other states could adopt similar approaches or could pursue different policy changes in a continuing effort to reduce their costs.

Ultimately, as with U.S. federal government actions, existing or future state government actions or ballot initiatives may also have a material adverse effect on our product sales, business and results of operations.

U.S. commercial payer actions have affected and may continue to affect access to and sales of our products

Payers, including healthcare insurers, PBMs, integrated healthcare delivery systems (vertically-integrated organizations built from consolidations of healthcare insurers and PBMs) and group purchasing organizations, increasingly seek ways to reduce their costs. With increasing frequency, payers are adopting benefit plan changes that shift a greater proportion of drug costs to patients. Such measures include more limited benefit plan designs, high deductible plans, higher patient co-pay or coinsurance obligations and more significant limitations on patients use of manufacturer commercial co-pay assistance programs. Further, government regulation of payers may affect these trends. For example, CMS finalized a policy for plan years starting on or after January 1, 2021 that has caused commercial payers to more widely adopt co-pay accumulator adjustment programs. While the U.S. District Court for the District of Columbia struck down this policy in September 2023 and further clarified in December 2023 that its ruling had the effect of reinstating the co-pay accumulator adjustment policy from 2020, CMS and HHS have signaled that they do not intend to enforce certain restrictions from the 2020 policy that would reduce the adoption of co-pay accumulator adjustment programs, and CMS has indicated that the issue will be addressed in future rulemaking. Payers, including PBMs, have sought, and continue to seek, price discounts or rebates in connection with the

48

placement of our products on their formularies or those they manage, and to also impose restrictions on access to or usage of our products (such as Step Therapy), require that patients receive the payers prior authorization before covering the product, and/or chosen to exclude certain indications for which our products are approved. For example, some payers require physicians to demonstrate or document that the patients for whom Repatha has been prescribed meet their utilization criteria, and these requirements have served to limit and may continue to limit patient access to

47

Repatha treatment. In an effort to reduce barriers to access, we reduced the net price of Repatha by providing greater discounts and rebates to payers (including PBMs that administer Medicare Part D prescription drug plans), and in response to a very high percentage of Medicare patients abandoning their Repatha prescriptions rather than paying their co-pay, we introduced a set of new National Drug Codes to make Repatha available at a lower list price. However, affordability of patient out-of-pocket co-pay cost has limited and may continue to limit patient use. Further, despite these net and list price reductions, some payers have restricted, and may continue to restrict, patient access and may seek further discounts or rebates or take other actions, such as changing formulary coverage for Repatha, that could reduce our sales of Repatha. These factors have limited, and may continue to limit, patient affordability and use, negatively affecting Repatha sales.

Further, significant consolidation in the health insurance industry has resulted in a few large insurers and PBMs, which places greater pressure on pricing and usage negotiations with biopharmaceutical manufacturers, significantly increasing discount and rebate requirements and limiting patient access and usage. For example, in the United States, as of the beginning of 2024, the top five integrated health plans and PBMs controlled about 92% of all pharmacy prescriptions. This high degree of consolidation among insurers, PBMs and other payers, including integrated healthcare delivery systems and/or with specialty or mail-order pharmacies and pharmacy retailers, has increased the negotiating leverage such entities have over us and other biopharmaceutical manufacturers and has resulted in greater price discounts, rebates and service fees realized by those payers from our business. Each of CVS, Express Scripts and United Health Group (among the top five integrated health plans and PBMs) have Rebate Management Organizations that further increase their leverage to negotiate deeper discounts. Ultimately, additional discounts, rebates, fees, coverage changes, plan changes, restrictions or exclusions imposed by these commercial payers could have a material adverse effect on our product sales, business and results of operations. Policy reforms advanced by Congress or the Administration that refine the role of PBMs in the U.S. marketplace could have downstream implications or consequences for our business and how we interact with these entities. For example, in June 2022, the FTC launched an inquiry into the business practices of PBMs and subsequently expanded the investigation to the three rebate management organizations owned by the three largest PBMs, and in JulySeptember 2024, the FTC published initial findings from its investigationbrought action against the three largest PBMs alleging anticompetitive and unfair rebating practices. In addition, multiple Congressional Committees are investigating PBM practices and have also proposed legislation that could increase transparency and reporting of these practices and/or impact rebates and service fees. The results of such inquiries could have an effect on manufacturer interactions with PBMs, resulting in changes to access for certain medicines. See our Annual Report on Form 10-K for the year ended December 31, 2023, Part I, Item 1A. Risk FactorsConcentration of sales at certain of our wholesaler distributors, and consolidation of private payers, such as insurers, and PBMs has negatively affected, and may continue to negatively affect, our business.

Our business is also affected by policies implemented by private healthcare entities that process Medicare claims, including Medicare Administrative Contractors. For example, in the second quarter of 2022, several Medicare Administrative Contractors issued notice that TEZSPIRE would be added to their self-administered drug exclusion lists. Although the Medicare Administrative Contractors subsequently removed TEZSPIRE from their exclusion lists, these exclusions, if reintroduced and/or implemented, would result in Medicare beneficiaries with severe asthma losing access to TEZSPIRE coverage under Medicare Part B and potentially also under Medicare Advantage.

Government and commercial payer actions outside the United States have affected and will continue to affect access to and sales of our products

Outside the United States, we expect countries will also continue to take actions to reduce their drug expenditures and to reduce intellectual property protections. See Part I, Item 1. BusinessReimbursement, of our Annual Report on Form 10-K for the year ended December 31, 2023. Pressures to decrease drug expenditures may intensify as governments take actions to address budgets strained by high inflation, expenditures to respond to the COVID-19 pandemic and weak economic conditions, including in Europe where the effects of the RussiaUkraine conflict have challenged the economies in that region. Further, the EU is currently undergoing a review and revision of its pharmaceutical legislation that, while full implementation is not expected before 2027, has led to proposals that would reduce intellectual property protection for new products (including potentially shortening the duration of regulatory data exclusivity and orphan drug exclusivity protections), as well as change the reimbursement and regulatory landscape. International reference pricing has been widely used by many countries outside the United States to control costs based on an external benchmark of a products price in other countries. International reference pricing policies can change quickly and frequently and may not reflect differences in the burden of disease, indications, market structures or affordability differences across countries or regions. Other expenditure control practices, including but not limited to the use of revenue clawbacks, rebates and caps on product sales, are used in various foreign jurisdictions as well. In addition, countries may refuse to reimburse or may restrict the reimbursed population for a product when their national health technology

49

assessments do not consider a medicine to demonstrate sufficient clinical benefit beyond existing therapies or to meet certain cost effectiveness thresholds. For example, despite the EMAs approval of Repatha for the treatment of patients with established atherosclerotic disease, prior to 2020, the reimbursement of Repatha in France was limited to a narrower patient population (such as those with homozygous familial hypercholesterolemia (HoFH)) following a national health technology assessment. Many countries decide on reimbursement between potentially competing products through national or regional

48

tenders that often result in one product receiving most or all of the sales in that country or region. Failure to obtain coverage and reimbursement for our products, a deterioration in their existing coverage and reimbursement or a decline in the timeliness or certainty of payment by payers to hospitals and other providers has negatively affected, and may further negatively affect, the ability or willingness of healthcare providers to prescribe our products for their patients and otherwise negatively affect the use of our products or the prices we realize for them. Such changes have had, and could in the future have, a material adverse effect on our product sales, business and results of operations.

A breakdown of our information technology systems, cyberattack or information security breach could significantly compromise the confidentiality, integrity and availability of our information technology systems, network-connected control systems and/or our data, interrupt the operation of our business and/or affect our reputation.

To achieve our business objectives, we rely on sophisticated information technology systems, including hardware, software, technology infrastructure, online sites and networks for both internal and external operations, mobile applications, cloud services and network-connected control systems, some of which are managed, hosted, provided or serviced by third parties. Internal or external events that compromise the confidentiality, integrity and availability of our systems and data may significantly interrupt the operation of our business, result in significant costs and/or adversely affect our reputation.

Our information technology systems are highly integrated into our business, including our RD efforts, our clinical and commercial manufacturing processes and our product sales and distribution processes. Further, as the majority of our employees work remotely for some portion of their jobs in our hybrid work environment, our reliance on our and third-party information technology systems has increased substantially and is expected to continue to increase. Remote and hybrid working arrangements, including those of at many third-party providers, can increase cybersecurity risks due to the challenges associated with managing remote computing assets and security vulnerabilities that are present in many non-corporate and home networks. The complexity and interconnected nature of software, hardware and our systems make them vulnerable to breakdown or other service interruptions, and to software errors or defects, misconfiguration and other security vulnerabilities. For example, in July 2024, businesses worldwide were affected by an information technology outage due to a faulty software update issued by a cybersecurity firm. Although our systems and operations were temporarily affected by the outage, the impact of this firms faulty update on the Company was immaterial to our business operations. However, there can be no assurance that a future similar incident would not result in a material adverse effect on our business or results of operations. Upgrades or changes to our systems or the software that we use have resulted and we expect, in the future, will result in the introduction of new cybersecurity vulnerabilities and risks. In 2022, we identified a number of security vulnerabilities introduced into our information systems as a result of flaws that we subsequently identified in software that we had purchased and installed, and these flaws required that we apply emergency patches to certain of our systems. While we did not experience any significant adverse effects as a result of these vulnerabilities, there can be no assurance that we will timely identify and address future vulnerabilities. Our systems are also subject to frequent perimeter network reconnaissance and scanning, phishing and other cyberattacks. For example, as a result of our cybersecurity monitoring of the Horizon legacy information systems, we detected phishing activity in the accounts of two Horizon executives. These accounts were de-activated, the incidents were investigated and the determination was made separately by both our internal cybersecurity team and our external digital forensics and incident response supplier that no confidential information had been exfiltrated. As the cyber-threat landscape evolves, these attacks are growing in frequency, sophistication, and intensity, and are becoming increasingly difficult to detect and increasingly sophisticated in using techniques and toolsincluding artificial intelligencethat circumvent security controls, evade detection and remove forensic evidence. Such attacks could include the use of harmful and virulent malware, including ransomware or other denials of service, which can be deployed through various means, including the software supply chain, e-mail, malicious websites and/or the use of social engineering/phishing.

50

We have also experienced denial of service attacks against our network, and, although such attacks did not succeed, there can be no assurance that our efforts to guard against the wide and growing variety of potential attack techniques will be successful in the future. Attacks such as those experienced by government entities (including those that approve and/or regulate our products, such as the EMA) and other multi-national companies, including some of our peers, could leave us unable to utilize key business systems or access or protect important data, and could have a material adverse effect on our ability to operate our business, including developing, gaining regulatory approval for, manufacturing, selling and/or distributing our products. For example, in 2017, a pharmaceutical company experienced a cyberattack involving virulent malware that significantly disrupted its operations, including its research and sales operations and the production of some of its medicines and vaccines. As a result of the cyberattack, its orders and sales for certain products were negatively affected. In late 2020, SolarWinds Corporation, a leading provider of software for monitoring and managing information technology infrastructure, disclosed that it had suffered a cybersecurity incident whereby attackers had inserted malicious code into legitimate software updates for its products that were installed by myriad private and government customers, enabling the attackers to access a backdoor to such systems. In 2022, Okta, Inc., a provider of software that helps companies manage user authentication, disclosed that several hundred of its corporate customers were vulnerable to a security breach that allowed attackers to access Oktas internal network. Although this breach did not have a significant effect on our business, there can be no assurance that a

49

similar future breach would not result in a material adverse effect on our business or results of operations.

Our systems also contain and use a high volume of sensitive data, including intellectual property, trade secrets and other proprietary business information, financial information, regulatory information, strategic plans, sales trends and forecasts, litigation materials and/or personal identifiable information belonging to us, our staff, our patients, customers and/or other parties. In some cases, we utilize third-party service providers to collect, process, store, manage or transmit such data, which have increased our risk. Intentional or inadvertent data privacy or security breaches (including cyberattacks) resulting from attacks or lapses by employees, service providers (including providers of information technology-specific services), business partners, nation states (including groups associated with or supported by foreign intelligence agencies), organized crime organizations, hacktivists or others, create risks that our sensitive data may be exposed to unauthorized persons, our competitors or the public.  Malicious actors, including those working under state-sponsored campaigns, have sought employment, often in remote information technology roles, as a means to gain inside access at targeted companies. In the third quarter of 2024, an individual used fraudulent identification in connection with their hiring by the Company. While the individual was detected and terminated before any data was extracted or malware installed, there can be no assurance that future attempts by similar actors will be unsuccessful. System vulnerabilities and/or cybersecurity breaches experienced by our third-party service providers have constituted a substantial share of the information security risks that have affected us. For example, in the first half of 2021, a supplier experienced a data breach in which an unauthorized third party acquired access to certain information provided to the supplier in the course of its provision of services to us, including business documents and certain personally identifiable patient information (not including social security or other financial or health insurance information). As required, we promptly notified the applicable state attorneys general and the individuals whose personally identifiable information was affected of this data breach at the supplier. In the third quarter of 2022, another service provider experienced a similar cybersecurity breach in which an attacker exfiltrated certain data (including non-significant Amgen data) from the service providers systems. Additionally, in April 2024, one of our former vendors notified us that its subsidiary that had provided us with certain patient support services until mid-2022, experienced a cybersecurity incident that it discovered in February 2024 and that data containing individually identifiable health information of over 1.7 million Amgen patients (that was retained as required by FDA regulations) was involved in the incident. Pursuant to the Health Breach Notification Rule requirements, we notified the FTC of this incident. Although these supplier data breaches have not resulted in material adverse effects on our business, there can be no assurance that a similar future cybersecurity incident would not result in a material adverse effect on our business or results of operations. Further, the timeliness of our awareness of a cybersecurity incident affects our ability to respond to and work to mitigate the severity of such events. For example, in 2020 and 2022, two of our vendors experienced cyberattacks and each initially reported to us that neither event involved our data. However, upon further investigation, they each subsequently informed us that the attackers had accessed limited, non-significant Amgen information. Although neither of these breaches had a significant adverse effect on our business, in the future we may again not receive timely reporting of cybersecurity events and such events could have a material adverse effect on our business.

Cyberattackers are also increasingly exploiting vulnerabilities in commercially available software from shared or open-source code. We rely on third party commercial software that have had and may have such vulnerabilities, but as use of open-source code is frequently not disclosed, our ability to fully assess this risk to our systems is limited. For example, in December 2021, a remote code execution vulnerability was discovered in a software library that is widely used in a variety of commercially available software and services. Although this vulnerability has not resulted in any significant adverse effects on us, there can be no assurances that a similar future vulnerability in the software and services that we use would not result in a material adverse effect on our business or results of operations. 

51

Domestic and global government regulators, our business partners, suppliers with whom we do business, companies that provide us or our partners with business services and companies we have acquired or may acquire face similar risks. Security breaches of their systems or service outages have adversely affected systems and could, in the future, affect our systems and security, leave us without access to important systems, products, raw materials, components, services or information, or expose our confidential data or sensitive personal information. For example, in 2019, two vendors that perform testing and analytical services that we use in developing and manufacturing our products experienced cyberattacks, and in April and September of 2020, vendors that provide us with information technology services and clinical data services, respectively, each experienced ransomware attacks. Although there was no breach of our systems, each of these incidents required us to disconnect our systems from those vendors systems. While we were able to reconnect our systems following restoration of these vendors capabilities without significantly affecting product availability, a more extended service outage affecting these or other vendors, particularly where such vendor is the single source from which we obtain the services, could have a material adverse effect on our business or results of operations. In February 2024, Change Healthcare, a large U.S. insurance claim and co-pay card processing clearinghouse, experienced a ransomware attack that has caused significant disruptions to healthcare provider and pharmacy operations. While Change Healthcare does not directly provide us with services, disruptions to co-pay card support, insurance billing and Medicaid rebate processing led to lost sales and required us to take action to help patients access their medications and to provide extended payment terms to certain customers. Although services have been rerouted and restored, and the impact on our business has been immaterial, similar disruptions may occur in the future stemming from the interconnectedness of the U.S. healthcare ecosystem and industry reliance on centralized claims processing systems and networks, and such future disruptions may have a material adverse effect on our business or results of operations. In addition, we distribute our products in the United States primarily through three pharmaceutical wholesalers, and a security breach that impairs the distribution operations of our wholesalers could significantly impair our ability to deliver our products to healthcare

50

providers and patients. There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with or effective in protecting our information technology systems and sensitive data.

Although we have experienced system breakdowns, attacks and information security breaches, we do not believe such breakdowns, attacks and breaches have had a material adverse effect on our business or results of operations. We will continue to experience varying degrees of cyberattacks and other incidents in the future. Even though we continue to invest in the monitoring, protection and resilience of our critical and/or sensitive data and systems, there can be no assurances that our efforts will detect, prevent or fully recover systems or data from all breakdowns, service interruptions, attacks and/or breaches of our systems that could adversely affect our business and operations and/or result in the loss or exposure of critical, proprietary, private, confidential or otherwise sensitive data, which could result in material financial, legal business or reputational harm to us or negatively affect our stock price. While we maintain cyber-liability insurance, our insurance is not sufficient to cover us against all losses that could potentially result from a service interruption, breach of our systems or loss of our critical or sensitive data.

We are also subject to various laws and regulations globally regarding cybersecurity, privacy and data protection, including laws and regulations relating to the collection, storage, handling, use, disclosure, transfer and security of personal data. The legislative and regulatory environment regarding privacy and data protection is continuously evolving and developing and the subject of significant attention globally. For example, we are subject to the EUs General Data Protection Regulation (GDPR), which became effective in May 2018, and the California Consumer Privacy Act (CCPA), which became effective in January 2020, both of which provide for substantial penalties for noncompliance. The CCPA was amended in late 2020, to create the California Privacy Rights Act to create opt in requirements for the use of sensitive personal data and the formation of a new dedicated agency for the enforcement of the law, the California Privacy Protection Agency. Similar consumer privacy laws went into effect in nine other states, have been enacted (but not yet in effect) in in 11 other states, and have been proposed in six additional states. Outside the United States, other jurisdictions where we operate have passed, or continue to propose, data privacy or cybersecurity legislation and/or regulations. For example, in China, the Personal Information Protection Law and the Data Security Law, which regulate data processing activities associated with personal and nonpersonal data, are in effect and build upon the existing Cybersecurity Law. Further, in March 2024, the European Parliament adopted the Artificial Intelligence Act that provides for EU-wide rules on data quality, transparency, human oversight and accountability with respect to the use of artificial intelligence. In April 2024, the EU also revised its Cybersecurity Directive NIS2 rules that create new cybersecurity risk management and reporting obligations. Failure to comply with these current and future laws could result in significant penalties and reputational harm and could have a material adverse effect on our business and results of operations.

Manufacturing difficulties, disruptions or delays could limit supply of our products and limit our product sales.

Manufacturing biologic and small molecule human therapeutic products is difficult, complex and highly regulated. We manufacture many of our commercial products and product candidates internally. In addition, we use third-party contract manufacturers to produce, or assist in the production of, a number of our products, and we currently use contract manufacturers to produce, or assist in the production of, a number of our late-stage product candidates and drug delivery devices. The number of third-party contract manufacturers that we use has increased with our recent acquisition of Horizon, as Horizon required such contract manufacturers for all of its products. See our Annual Report on Form 10-K for the year ended December 31, 2023, Part I, Item 1. BusinessManufacturing, Distribution and Raw MaterialsManufacturing; and Part I, Item 1A, Risk FactorsOur efforts to collaborate with or acquire other companies, products, or technology, and to integrate the operations of companies or to support the products or technology we have acquired, may not be successful, and may result in unanticipated costs, delays or failures to realize the benefits of the transactions. Our ability to adequately and timely manufacture and supply our products (and product candidates to support our clinical trials) is dependent on the uninterrupted and efficient operation of our facilities and those of our third-party contract manufacturers, which may be affected by:

capacity of manufacturing facilities;

contamination by microorganisms or viruses, or foreign particles from the manufacturing process;

natural or other disasters, including hurricanes, earthquakes, volcanoes or fires;

labor disputes or shortages, including the effects of health emergencies (such as novel viruses or pandemics) or natural disasters;

compliance with regulatory requirements;

changes in forecasts of future demand;

timing and actual number of production runs and production success rates and yields;

51

updates of manufacturing specifications;

contractual disputes with our suppliers and contract manufacturers;

timing and outcome of product quality testing;

power failures and/or other utility failures;

cyberattacks on supplier systems;

breakdown, failure, substandard performance or improper installation or operation of equipment (including our information technology systems and network-connected control systems or those of our contract manufacturers or third-party service providers);

delays in the ability of the FDA or foreign regulatory agencies to provide us necessary reviews, inspections and approvals, including as a result of a subsequent extended U.S. federal or other government shutdowns; and/or

geopolitical conflicts (such as the ongoing conflicts in Ukraine and the Middle East).

If any of these or other problems affect production in one or more of our facilities or those of our third-party contract manufacturers, or if we do not accurately forecast demand for our products or the amount of our product candidates required in clinical trials, we may be unable to start or increase production in our unaffected facilities to meet demand. If the efficient manufacture and supply of our products or product candidates is interrupted, we may experience delayed shipments, delays in our clinical trials, supply constraints, stock-outs, adverse event trends, contract disputes and/or recalls of our products. From time to time, we have initiated recalls of certain lots of our products. For example, in July 52014 we initiated a voluntary recall of an Aranesp lot distributed in the EU after particles were detected in a quality control sample following distribution of that lot, and in April 2018 we initiated a precautionary recall of two batches of Vectibix distributed in Switzerland after potential crimping defects were discovered in the metal seals on some product vials. If we are at any time unable to provide an uninterrupted supply of our products to patients, we may lose patients and physicians may elect to prescribe competing therapeutics instead of our products, which could have a material adverse effect on our product sales, business and results of operations.

Our manufacturing processes, those of our third-party contract manufacturers and those of certain of our third-party service providers must undergo regulatory approval processes and are subject to continued review by the FDA and other regulatory authorities. It can take longer than five years to build, validate and license another manufacturing plant, and it can take longer than three years to qualify and license a new contract manufacturer or service provider. If we elect or are required to make changes to our manufacturing processes because of new regulatory requirements, new interpretations of existing requirements or other reasons, this could increase our manufacturing costs and result in delayed shipments, delays in our clinical trials, supply constraints, stock-outs, adverse event trends or contract negotiations or disputes. Such manufacturing challenges may also occur if our existing contract manufacturers are unable or unwilling to timely implement such changes, or at all.

In addition, regulatory agencies conduct routine monitoring and inspections of our manufacturing facilities and processes as well as those of our third-party contract manufacturers and service providers. If regulatory authorities determine that we or our third-party contract manufacturers or certain of our third-party service providers have violated regulations, they may mandate corrective actions and/or issue warning letters, or even restrict, suspend or revoke our prior approvals, prohibiting us from manufacturing our products or conducting clinical trials or selling our marketed products until we or the affected third-party contract manufacturers or third-party service providers comply, or indefinitely. See our Annual Report on Form 10-K for the year ended December 31, 2023, Part I, Item 1A. Risk FactorsOur current products and products in development cannot be sold without regulatory approval. Such issues may also delay the approval of product candidates we have submitted for regulatory review, even if such product candidates are not directly related to the products, devices or processes at issue with regulators. Because our third-party contract manufacturers and certain of our third-party service providers are subject to the FDA and foreign regulatory authorities, alternative qualified third-party contract manufacturers and third-party service providers may not be available on a timely basis, or at all. If we or our third-party contract manufacturers or third-party service providers cease or interrupt production or if our third-party contract manufacturers and third-party service providers fail to supply materials, products or services to us, we may experience delayed shipments, delays in our clinical trials, supply constraints, contract disputes, stock-outs and/or recalls of our products. Additionally, we distribute a substantial volume of our commercial products through our primary distribution centers in Louisville, Kentucky for the United States and in Breda, Netherlands for Europe and much of the rest of the world. We also conduct most of the labeling and packaging of our products distributed in Europe and much of the rest of the world in Breda. Our ability to timely supply products is dependent on the uninterrupted and efficient operations of our distribution and logistics centers, our third-party logistics providers and our labeling and packaging facility in Breda. Further, we rely on commercial transportation, including air and sea freight, for the

52

distribution of our products to our customers, which has been negatively affected by the COVID-19 pandemic, labor unrest, natural disasters and geopolitical security threats.

Changes in laws or regulations with respect to the use and/or presence of certain chemicals in our products or the components used in the research, development, manufacture and/or packaging of our products could also disrupt or restrict our ability to develop, produce or sell our products in the affected jurisdictions. For example, the EU, the U.S. Congress, the U.S. Environmental Protection Agency, and several U.S. states are considering legislation and/or policies to address the presence, and/or use, of certain chemicals in certain of the components used in the manufacture or packaging of commercial products, including chemicals known as per- and polyfluorinated substances (PFAS). Proposed legislation in several jurisdictions is under consideration to prohibit or otherwise regulate the importation, manufacture, or distribution of goods containing PFAS, and some such proposals do not provide exemptions for drug products, medical devices, their packaging, or the materials used in the research, development, or manufacture of such products or devices. For example, the EU is considering a ban on PFAS in the manufacturing and packaging of pharmaceutical products that could affect pharmaceutical research and development activities and distribution. Some proposals, if enacted without exemptions for pharmaceutical products, and materials used in their research, development, and manufacture, may cause significant disruptions to our ability to manufacture and supply products to the affected jurisdictions, potentially resulting in a material adverse effect on our business. Additionally, certain jurisdictions and regulatory agencies, including the FDA and EMA, require testing for the presence of nitrosamine impurities in small molecule drugs that are at risk of containing microcrystalline cellulose as an excipient. We are following the regulatorily defined process of evaluating and testing of potentially impacted small molecule products. Testing of our cinacalcet product has indicated the presence of nitrosamines in certain lots above established limits. As a result of such testing, we have worked closely with regulatory agencies to determine the appropriate action in each impacted country. In certain countries we have stopped short term distribution of cinacalcet and filed shortage notifications, and, additionally, we have initiated recalls in certain Middle Eastern countries.

There have also been legislative and administrative proposals seeking to incentivize greater drug manufacturing in the United States with the stated goal of improving supply reliability in the United States. For example, on August 6, 2020, the previous Administration issued an Executive Order aimed at boosting domestic production of essential medicines, medical countermeasures, and critical inputs titled Executive Order on Ensuring Essential Medicines, Medical Countermeasures, and Critical Inputs are Made in the United States. Additionally, one legislative proposal would have prohibited the U.S. Department of Veterans Affairs from purchasing certain drugs that have active pharmaceutical ingredients manufactured outside the United States. While we perform a substantial majority of our commercial manufacturing activities in the United States, including in the U.S. territory of Puerto Rico, and a substantial majority of our clinical manufacturing activities at our facility in Thousand Oaks, California, the passage of such legislation could result in foreign governments enacting retaliatory legislation or regulatory actions, which may have an adverse effect on our product sales, business and results of operations.

53