Company: BLLN
Filing Date: 2025-09-17
Form Type: DRS/A
Source: 0001193125-25-206347
Chunk: 90

Company: BillionToOne, Inc.
Filing Date: 2025-09-17
Form: DRS/A
Chunk 90
---
 lead to bias in the models and could lead us to make decisions that adversely impact the rights, employment, and ability of individuals or classes of individuals to obtain
certain pricing, products, services, or benefits. We also use AI, including AI/ML in our products and services. The development and use of AI/ML present various privacy and security risks that may impact our business. AI/ML are subject to privacy
and data security laws, as well as increasing regulation and scrutiny. While we have implemented robust controls, validations, and human oversight to mitigate the risks of the aforementioned biases and inaccuracies, these measures may not be found
sufficient by current or future privacy and data security laws.

Several jurisdictions around the globe, including Europe and certain U.S. states, have proposed
enacted, or are considering laws governing the development and use of AI/ML, such as the EU’s AI Act. We expect other jurisdictions will adopt similar laws. Additionally, certain privacy laws extend rights to consumers (such as the right to
delete certain personal data) and regulate automated decision making, which may be incompatible with our use of AI/ML. These obligations may make it harder for us to conduct our business using AI/ML, lead to regulatory fines or penalties, require us
to change our business practices, retrain our AI/ML, or prevent or limit our use of AI/ML. For example, the FTC has required other companies to turn over (or disgorge) valuable insights or trainings generated through the use of AI/ML where they
allege the company has violated privacy and consumer protection laws. If we cannot use AI/ML or that use is restricted, our business may be less efficient, or we may be at a competitive disadvantage.

In addition, the interpretation and application of consumer, health-related and data protection laws, especially with respect to genetic samples and data, in the United
States, European Economic Area (EEA) and elsewhere are often uncertain, contradictory and in flux. The General Data Protection Regulation (GDPR) and other privacy laws and regulations related to the use, transfer, and protection of data impose
obligations to the extent we

53

test EU citizens or expand internationally. While we believe that our current processes and practices comply with the GDPR, we may need to expend considerable time and resources, including management attention, to revise our practices to ensure ongoing compliance with GDPR. Some of the above privacy laws and regulations in many cases may be more restrictive than, and may