113 added · 118 removed between the two most recent 10-Ks. The risks a company starts — or stops — disclosing are often the story.
Newly disclosed
For example, the IRA includes provisions requiring mandatory pricing in Medicare for certain drugs under Parts B and D (starting with 10 drugs effective January 1, 2026, adding 15 in 2027 and 2028, and adding 20 in 2029 and subsequent years such that, by 2031, approximately 100 drugs would be subject to such set prices).
The Colorado PDAB deemed three of five drugs “unaffordable,” including ENBREL, and in October 2025 the Colorado PDAB established an Upper Payment Limit (UPL) substantially lower than the wholesale acquisition cost of ENBREL that would be generally applicable to all formulations of ENBREL, effective no earlier than January 1, 2027, and will be reviewed annually.
In November 2025, a third-party service provider had a cybersecurity incident in which Amgen-related information was accessed and disclosed by a threat actor that, upon review, did not involve information material to the Company.
On January 5, 2026, the OECD issued additional administrative guidance related to the global minimum tax agreement that exempts U.S. companies from extra territorial minimum taxes effective January 1, 2026.
While we have incorporated the impact of OB3 in our 2025 financial statements, the legislation is complex and guidance could be issued that could impact our 2025 or future U.S. taxes.
For example, in the past we have experienced cybersecurity incidents involving third-party service providers, including incidents in which unauthorized third parties accessed or exfiltrated certain information, including non-significant Amgen data and personally identifiable patient information, and we 37 have made required regulatory notifications in connection with certain such incidents.
For example, we have experienced cybersecurity incidents at third-party vendors that provide testing, analytical, information technology and clinical data services, which required us to temporarily disconnect our systems from those vendors.
For example, we have previously experienced incidents in which third-party vendors initially reported that cyberattacks did not involve our data but later determined that attackers had accessed limited, non-significant Amgen information.
For example, the Congressional Budget Office has projected that the OB3 will result in significant reductions in federal Medicaid spending over the next decade and an increase in the number of people without health insurance.
Certain appellate courts have issued decisions both upholding certain state 340B statues and affirming the denial of preliminary injunctive relief to manufacturers, while litigation and appeals concerning the validity, interpretation, and enforcement of these laws remain ongoing.
Delays, modifications or repeal, in whole or in part, of the administrative guidance or the OECD agreement itself, either by all OECD participants or unilaterally by individual countries, could result in negative impacts on our overall tax rate.
Such attacks include the use of harmful and virulent malware, including ransomware or other denials of service, which can be deployed through various means, including the software supply chain, e-mail, malicious websites and/or the use of social engineering/phishing, and/or AI to orchestrate and automate sophisticated cyberattacks, including the documented instance in which an AI agent was used to conduct a large-scale intrusion campaign, potentially lowering the barriers to high-speed, high-volume attacks.
No longer disclosed
For example, in the first half of 2021, a supplier experienced a data breach in which an unauthorized third party acquired access to certain information provided to the supplier in the course of its provision of services to us, including business documents and certain personally identifiable patient information (not including social security or other financial or health insurance information).
For example, the IRA includes provisions requiring that, beginning in 2026, mandatory price setting be introduced in Medicare for certain drugs paid for under Parts B and D, whereby manufacturers must accept a price established by the government or face penalties on all U.S. sales (starting with 10 drugs in 2026, adding 15 in 2027 and 2028, and adding 20 in 2029 and subsequent 29 years such that, by 2031, approximately 100 drugs could be subject to such set prices).
In 2022, Okta, Inc., a provider of software that helps companies manage user authentication, disclosed that several hundred of its corporate customers were vulnerable to a security breach that allowed attackers to access Okta’s internal network.
In the third quarter of 2022, another service provider experienced a 36 similar cybersecurity breach in which an attacker exfiltrated certain data (including non-significant Amgen data) from the service provider’s systems.
For example, in the United States, the FTC’s interim report released in 2024 showed that the top six integrated health plans and PBMs controlled about 94% of all pharmacy prescriptions.
For example, in 2022, several Medicare Administrative Contractors issued notice that TEZSPIRE would be added to their “self-administered drug” exclusion lists.
Court of Appeals for the 8th Circuit ruled that Arkansas’ Act 1103, which prohibits drugmakers from restricting the acquisition or delivery of 340B drugs to covered entities and their contract pharmacies, was not preempted by the federal 340B statute.
For example, in September 2024, the FTC brought action against the three largest PBMs alleging anticompetitive and unfair rebating practices.
For example, Horizon adds more than 30 contract manufacturing organizations (CMOs) to our operations, many of which are single source suppliers (including the CMO that produces TEPEZZA drug substance and the CMO that produces all of our KRYSTEXXA drug substance in Israel that is affected by the current conflict in Israel and Gaza).
For example, some payers require physicians to demonstrate or document that the patients for whom Repatha has been prescribed meet their utilization criteria, and these requirements have served to limit patient access to Repatha treatment.
Additional provisions of the OECD agreement may come into effect in future years, and the OECD is expected to continue to release additional guidance that may impact the application and interpretation of the agreement that could further increase our tax liabilities.
We may not realize the anticipated strategic benefits of our acquisition of Horizon, including our efforts to leverage Amgen’s global presence and commercial and medical capabilities in inflammation and nephrology to accelerate revenue growth of Horizon’s products.