Company: ARTL
Filing Date: 2025-08-13
Form Type: 10-Q
Source: 0001640334-25-001429
Chunk: 37

Company: ARTELO BIOSCIENCES, INC.
Filing Date: 2025-08-13
Form: 10-Q
Item: Part II, Item 1
Chunk 37
---
 Our data privacy and security obligations necessitate the implementation and maintenance of targeted security protocols and tools. These measures adhere to industry standards and are designed to protect our information technology systems, as well as our proprietary and sensitive information.

While we have implemented security measures to safeguard our information technology systems and infrastructure, there is no absolute guarantee that these measures will completely thwart cyberthreats, attacks, security incidents, data breaches, malware, ransomware, and other disruptions that could harm our business. The dynamic nature of threats and their sophistication means that vulnerabilities may elude detection until after an incident occurs. Despite our diligent efforts to identify and address vulnerabilities, success is not assured. Additionally, delays in implementing remedial measures to tackle identified vulnerabilities may occur. Furthermore, inadequate internal accounting controls related to security incidents and cybersecurity could impact the accuracy and timeliness of our financial statements, potentially leading to regulatory scrutiny.

Compliance with data privacy and security obligations, including data breach notification laws in the U.S. and other jurisdictions, may necessitate notifying relevant stakeholders about security incidents. Such disclosures come at a significant cost, and failure to comply with these requirements could have adverse consequences. If we (or a third party on whom we rely) encounter a security incident or are perceived to have experienced one, we may face various negative outcomes. These include government enforcement actions (such as investigations, fines, penalties, audits, and inspections), additional reporting obligations, restrictions on processing sensitive information (including personal data), litigation (including class-action claims), financial liabilities to third parties, indemnification responsibilities, negative publicity, reputational damage, diversion of monetary funds, operational disruptions (including data availability), financial losses, and other similar harms. Security incidents and their associated consequences may disrupt our operations significantly and potentially lead to material program disruptions. For instance, the loss of clinical trial or nonclinical study data for our product candidates could cause delays in regulatory approval efforts and substantially increase costs due to the additional time and resources required for data recovery, verification, or potential reproduction.

Our contractual agreements may lack adequate limitations of liability, and even when present, there is no guarantee that these provisions sufficiently shield us from liabilities, damages, or claims related to our data privacy and security obligations. Additionally, we cannot definitively ascertain that our insurance coverage will adequately protect us or mitigate liabilities arising from our privacy and security practices. The availability of such coverage on commercially reasonable terms remains uncertain, as does its ability to cover future claims.

 52Table of Contents

Our employees or consultants may engage in misconduct or other improper activities, including