Company: DVAX
Filing Date: 2025-05-06
Form Type: 10-Q
Source: 0001029142-25-000071
Chunk: 434

Company: DYNAVAX TECHNOLOGIES CORP
Filing Date: 2025-05-06
Form: 10-Q
Item: Part I, Item 2
Chunk 434
---
 commercialize our products, expenditure of time and resources to defend any claim or inquiry, or revision or restructuring of our operations.

In addition, privacy advocates and industry groups have proposed, and may propose, standards with which we are legally or contractually bound to comply or may become subject to in the future.

Our obligations related to privacy and data security are quickly changing and becoming increasingly stringent, creating uncertainty. These obligations may be subject to differing applications and interpretations, which may be inconsistent or in conflict among jurisdictions. Preparing for and complying with these obligations requires us to devote significant resources. These obligations may also necessitate changes to our information technologies, systems and practices and those of third parties upon which we rely. Moreover, despite our efforts, our personnel or third parties upon which we rely may fail to comply with such obligations, which could negatively impact our business operations and compliance posture. 

For instance, in the EU, the second Network and Information Security Directive (Directive (EU) 2022/2555, “NIS2”) entered into force on 17 January 2023 and had to be transposed into the national law of each Member State by 17 October 2024. NIS2 creates a specific legal framework for the resilience and incident response capabilities of entities operating in 18 sectors, including the health sector. As a result, companies in scope are obligated to maintain robust network and information systems security measures and report any significant incidents that might impact their operations. 

54

Table of Contents

Companies that fail to comply with NIS2 may face significant operational disruptions, legal liabilities, and regulatory penalties of a maximum of €10 million or up to 2% of the total worldwide turnover of the preceding financial year.

Our employees and other personnel can use generative artificial intelligence (“AI”) technologies, from time to time, in certain circumstances to perform portions of their work, and the disclosure and use of personal data in generative AI technologies is subject to various privacy laws and other privacy obligations. Governments have passed and are likely to pass additional laws regulating generative AI. Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and lawsuits. Our use of generative AI could make it more difficult to comply with various privacy laws and other privacy obligations in the U.S. and Europe and could negatively affect our ability to protect or own certain intellectual property, any or all of which may cause us to incur significant expense, cause reputational damage, and otherwise adversely affect our business.

If we fail to comply with the