Reputable outlets only (Reuters, WSJ, CNBC, Barron's, and peers). More on Google News ↗
What Changed
Risk factors · Nov 27, 2024 → Nov 25, 2025
105 added · 117 removed between the two most recent 10-Ks. The risks a company starts — or stops — disclosing are often the story.
Newly disclosed
For example, AI is increasingly being used by malicious actors to create more targeted cyberattacks and spread misinformation.
Department of Commerce recently initiated an investigation under Section 232 of the Trade Expansion Act of 1962, as amended, into (among other things) imports of personal protective equipment, medical consumables and medical equipment (including devices), to determine whether they threaten U.S. national security, which further creates policy uncertainty in terms of tariffs.
The ultimate impact of any existing or new tariffs or other changes in international trade policies on our business, financial condition, results of operations and cash flows is subject to a number of factors, including, but not limited to, the duration of such tariffs, changes in tariff rates, the amount, scope and nature of the tariffs, any countermeasures that target countries may take or any mitigating actions that may become available.
We face competition across all our product lines and in each market in which our products are sold on the basis of product features, clinical or economic outcomes, product quality, availability, price, services and other factors. 15 Table of Contents Our ability to compete is also impacted by changing customer and patient preferences and requirements, including changes in demand as a result of changes to U.S. federal and state policies (affecting products such as pharmaceuticals and vaccines), increased focus on products using materials of concern and demand for more sustainable products, and for products utilizing emerging technologies (such as AI), as well as changes in the ways healthcare services are delivered, such as the transition of more care from acute to non-acute settings and increased focus on chronic disease management.
The foregoing could expose us to further risk of potential breaches, failures, interruptions and disruptions, which could result in adverse consequences, including regulatory inquiries or litigation, increased costs and expenses, reputational damage, lost revenue, and fines or penalties.
In particular, risks associated with the deployment and use of AI into our operations generally could introduce new risks related to the management of our information and technology systems and related infrastructure and our overall cybersecurity threat landscape.
Additionally, depending on the nature of such a disruption, it could result in efficacy or safety concerns for certain of our products, result in reputational harm to our business and result in actions by regulatory bodies or civil litigation.
Our IT systems and infrastructure, as well as those of various third parties on which we rely, have experienced, and are likely to continue to experience, a variety of cyberattacks, including, but not limited to, unauthorized access, malicious code execution and/or phishing attacks, which could be further exacerbated by rapid technology evolution, including increased adoption of AI and geopolitical events.
These cyberattacks have resulted, and could in the future result, in our and our customers’ personal, confidential or proprietary information being accessed, destroyed, lost, stolen or otherwise compromised and could lead to increased costs for cybersecurity measures, insurance or remediation and adversely affect our reputation, financial condition, results of operations or competitive position in the market and result in other significant negative consequences, including lost revenue, damages or fines, manufacturing challenges or disruption, diversion of management attention, litigation, regulatory action and damage to our relationships with vendors, business partners and customers.
Unauthorized tampering, adulteration or interference with our products, including through cyberattacks, may also create issues with product functionality that could result in a loss or alteration of data, risk to patient safety and product recalls or field actions, as well as impact our compliance with privacy, data protection and other laws and regulations and could result in reputational damage and actions by regulatory bodies or civil litigation.
The development, deployment and use of AI in our products and business operations generally could result in regulatory action, legal liability, operational challenges or reputational harm and our failure to adapt to medical technology industry trends and developments related to AI in a timely manner (or at all) could adversely affect our business, financial condition, results of operations and cash flows.
The development, deployment and use of AI (particularly generative AI) is in the early stages and presents various 19 Table of Contents risks, including from confidentiality, privacy, data protection, cybersecurity and compliance perspectives, and raises intellectual property issues and legal, regulatory, reputational ethical, operational, technological and other concerns (see, “Our operations are dependent in part on patents and other intellectual property assets” and “Cybersecurity incidents and breaches or breakdowns of our information and technology systems or infrastructure could have a material adverse effect on our operations” elsewhere in this Item 1A, Risk Factors).
No longer disclosed
For example, through our cybersecurity monitoring tools and processes, we recently identified incidents of unauthorized activity on a portion of our IT systems, in which certain information relating to BD’s IT infrastructure and service credentials for certain BD Diagnostics Solutions, BD Pyxis TM , and Parata products utilized by laboratories, hospitals and pharmacies (the “Product Service Credentials”) were accessed and/or exfiltrated.
Our ability to compete is also impacted by changing customer and patient preferences and requirements, including increased focus on products using materials of concern and demand for more sustainable products, and for products incorporating digital capabilities, including artificial intelligence, as well as changes in the ways healthcare services are delivered, such as the transition of more care from acute to non-acute settings and increased focus on chronic disease management.
We have experienced, and could in the future experience, the failure, interruption or disruption of the functionality of our IT systems and infrastructure, or those of third-party vendors upon which we rely, which could impair our ability or that of our customers, suppliers and other business partners to conduct business, result in the loss of BD trade secrets or otherwise compromise personal, confidential or proprietary information of BD or its customers, suppliers and other business partners, or of patients, result in efficacy or safety concerns for certain of our products, result in reputational harm to our business and result in actions by regulatory bodies or civil litigation.
These cybersecurity incidents and breaches could adversely affect our reputation, financial condition, results of operations or competitive position in the market and result in other significant negative consequences, including lost revenue, manufacturing challenges or disruption, diversion of management attention, litigation, regulatory action and damage to our relationships with vendors, business partners and customers. 18 Table of Contents Unauthorized tampering, adulteration or interference with our products, including through cyberattacks, may also create issues with product functionality that could result in a loss of data, risk to patient safety and product recalls or field actions, as well as impact our compliance with privacy, data protection and other laws and regulations and could result in reputational damage and actions by regulatory bodies or civil litigation.
In addition, certain factors, such as growth through acquisitions, rapid technology evolution, including increased adoption of artificial intelligence, and geopolitical events, have increased cybersecurity risks.
Ethylene Oxide/Sterilization On October 28, 2019, BD entered into a consent order with the Environmental Protection Division of the Georgia Department of Natural Resources (the “EPD”), following the filing of a complaint and motion for temporary restraining order by the EPD seeking to enjoin BD from continuing sterilization operations at its Covington, Georgia facility.
Following submission of data relating to the implementation of these operational changes, BD was permitted to return to normal operations in December 2021 at its facilities in Georgia in accordance with the operating conditions set forth in its permit applications, including a condition to continue ambient air monitoring.
Due to the inherent uncertainty of litigation and our underlying loss reserve estimates, additional reserves may be established or current reserves may be significantly increased from time-to-time.
For example, the FDA’s increased oversight of laboratory developed tests may impact certain of our customers and, as a result, could affect our financial performance.
The final air permits for (i) the Covington and Madison facilities and (ii) the Covington distribution center were issued by the EPD on May 5, 2023, and July 2, 2024, respectively.
Only) Year-Over-Year Change Executive 29% (1.0)% 23% +0.1% Management 42% +0.7% 30% +0.2% All associates 49% +0.1% 42% (0.8)% For the above table, we define “executives” as associates in positions of vice president and above.
By correspondence dated September 6, 2024, the EPD notified BD that the consent order had been terminated by the full and complete performance of each condition.