Company: ISRG
Filing Date: 2025-01-31
Form Type: 10-K
Source: 0001035267-25-000017
Chunk: 213

Company: INTUITIVE SURGICAL INC
Filing Date: 2025-01-31
Form: 10-K
Item: Item 1A
Chunk 213
---
 increasing our compliance obligations and risk, including risks of regulatory fines, litigation, and associated reputational harm.

In China, we are also subject to various aspects of the country’s data compliance regime, including the Cybersecurity Law, the Data Security Law, and the Personal Information Protection Law (“PIPL”). In addition to national laws, regulatory departments, provincial and municipal governments, and Free Trade Zones are left to identify “important data,” the definitions of which may impact our reporting, data protection, and data transfer obligations. Draft guidelines related to medical device and equipment data from the State Administration for Market Regulation and other unpublished rules and guidelines from other regulatory departments may impact Onsite data collection and transfers. With the possibility of more stringent medical data transfer rules in China, customers’ appetite for our digital products including Onsite, Telepresence, and Case Insights may become impacted in the future.

Any failure, or perceived failure, by us to comply with or make effective modifications to our policies or to comply with any federal, state, or international privacy, data-retention, or data-protection-related laws, regulations, orders, or industry self-regulatory principles could result in proceedings or actions against us by governmental entities or others, a loss of customer confidence, damage to our brand and reputation, and a loss of customers, any of which could have an adverse effect on our business. In addition, various federal, state, and foreign legislative or regulatory bodies may enact new or additional laws and regulations concerning privacy, data-retention, and data-protection issues, including laws or regulations mandating disclosure to domestic or international law enforcement bodies, which could adversely impact our business or our reputation with customers. For example, some countries have adopted laws mandating that some personal information regarding customers in their country be maintained solely in their country. Having to maintain local data centers and redesign products, services, and business operations to limit personal information processing to within individual countries could increase our operating costs significantly.

The European Strategy for Data includes a collection of laws focused on ensuring fundamental principles (including doing business in an ethical way, respecting fundamental rights of individuals, not exploiting individuals, and transparency in collection and use of data) are promoted and adhered to in support of innovation for the benefit of the community. In particular, the AI Act, European Health Data Space, and Data Act and Data Governance Acts regulate personal and non-personal data as well as artificial intelligence. These laws are meant to be read and interpreted together (and in concert with the GDPR), ensuring that innovation respects individuals’ fundamental rights and that