While we are continuing to modernize our IT systems and infrastructure (such as hardware, software and operating systems), there are still technologies in operation that are more vulnerable to risk of failures, interruptions and disruptions. In addition, while we continue to enhance business continuity and disaster recovery plans and strategies, there is no guarantee that such plans and strategies will be effective or account for all eventualities. We have experienced, and conduct business. Such a disruption could in the future experience, the failure, interruption or disruption of the functionality of our IT systems and infrastructure, or those of third-party vendors upon which we rely, which could impair our ability or that of our customers, suppliers and other business partners to conduct business, also result in the loss of BD our trade secrets or otherwise compromise personal, confidential or proprietary information of BD ours or its our customers, suppliers and other business partners, or of patients, patients. Additionally, depending on the nature of such a disruption, it could result in efficacy or safety concerns for certain of our products, result in reputational harm to our business and result in actions by regulatory bodies or civil litigation.
In addition, on April 13, 2023, the EPA published a Pesticide Registration Review: Proposed Interim Decision and Draft Risk Assessment Addendum for Ethylene Oxide. On January 14, 2025, the EPA published the Pesticide Registration Review; Interim Registration Review Decision for Ethylene Oxide (“PID”). The EPA has not yet finalized the PID, (“ID”), which regulates the use of ethylene oxide as a sterilant and is intended to mitigate any human health and environmental risks associated with its use. We cannot predict what Among other things, the final PID adopted ID requires medical device sterilization facilities to comply with a new and stricter occupational ethylene oxide exposure limit, establish engineering controls for worker protection, provide workers with personal protective equipment, conduct continuous stationary indoor monitoring and comply with a maximum concentration limit for ethylene oxide (with higher levels permitted if required and approved by the EPA may require and therefore we FDA). Compliance deadlines for the various mitigation measures required by the ID range from within 60 days to ten years of the effective date. We are not able to assess in the process of assessing the impact of the ID requirements on our sterilization facilities, on the third-party sterilization facilities that BD utilizes we utilize and our operations more generally. We expect to implement certain changes at our facilities to comply with NESHAP and ID requirements, which will require us to incur additional implementation and ongoing operating costs.
Cyberattacks continue to increase in frequency, sophistication and intensity, and are increasingly difficult to detect in real-time and may go undetected for long periods of time, especially as they relate to attacks on third-party vendors. vendors and those utilizing emerging technologies (such as AI). Such attacks are often carried out by motivated and highly skilled actors, who are increasingly well-resourced. Our IT systems and infrastructure, as well as those of various third parties on which we rely, have experienced, and are likely to continue to experience, a variety of cyberattacks, including, but not limited to, unauthorized access, malicious code execution and/or phishing attacks, which has could be further exacerbated by rapid technology evolution, including increased adoption of AI and geopolitical events. For example, AI is increasingly being used by malicious actors to create more targeted cyberattacks and spread misinformation. These cyberattacks have resulted, and could in the future result, in our and our customers’ personal, confidential or proprietary information being accessed, destroyed, lost, stolen or otherwise compromised and could lead to increased costs for cybersecurity measures measures, insurance or remediation. For example, through remediation and adversely affect our cybersecurity monitoring tools and processes, we recently identified incidents of unauthorized activity on a portion of our IT systems, in which certain information relating to BD’s IT infrastructure and service credentials for certain BD Diagnostics Solutions, BD PyxisTM, and Parata products utilized by laboratories, hospitals and pharmacies (the “Product Service Credentials”) were accessed and/or exfiltrated. After becoming aware of the incidents, BD terminated the unauthorized access, applied additional security measures, and is working with customers to update these Product Service Credentials. While an unauthorized party would have to penetrate a customer’s local network and, in some cases, may also need to be physically present at the instrument in order to use these Product Service Credentials, until these credentials are updated, there is a risk of unauthorized access that may impact the confidentiality, integrity and/or availability of the relevant products and associated systems or data. To date, we have not been made aware of any unauthorized use of these Product Service Credentials. As of the date of this filing, the incidents have not had, and we do not expect them to have, a material impact on BD’s overall business operations, reputation, financial condition or condition, results of operations. operations or competitive position in the market and result in other significant negative consequences, including lost revenue, damages or fines, manufacturing challenges or disruption, diversion of management attention, litigation, regulatory action and damage to our relationships with vendors, business partners and customers.
A substantial amount of our revenue is derived from international operations, and we anticipate that a significant portion of our future sales will continue to come from outside the U.S. The revenues we report with respect to our operations outside the U.S. have been and may continue to be adversely affected by fluctuations in foreign currency exchange rates, which are caused by a number of factors, including changes in a country's political and economic policies and inflationary conditions. Furthermore, currency exchange rates have been especially volatile in the recent past, and these currency fluctuations have affected, and may continue to affect, the reported value of our assets and liabilities, as well as our cash flows. A discussion of the financial impact of exchange rate fluctuations and the ways and extent to which we may attempt to address any impact is contained in Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations. Any foreign currency exchange rate hedging activities we engage in may only offset a portion of the adverse financial impact resulting from unfavorable changes in foreign currency exchange rates. We cannot predict with any certainty changes in foreign currency exchange rates or the degree to which we can effectively mitigate manage these risks. fluctuations.
A substantial amount of our sales come from our operations outside the U.S., and we intend to continue to pursue growth opportunities in new and existing foreign markets, especially in emerging markets. Our foreign operations subject us to certain commercial, political and financial risks. In addition to fluctuations in foreign currency exchange (discussed above), our business in these foreign markets is subject to changing political, social, and geopolitical conditions, such as the evolving situations continuation and/or escalation of the situation in Ukraine, the Middle East and Asia. These conditions include instability resulting from war, terrorism, insurrections and civil unrest, political conflict, conflict and changing economic conditions, such as inflation, deflation, interest rate volatility and credit availability. Additionally, a number of factors, including U.S. relations with or among the governments of the foreign countries in which we operate, changes to international trade agreements and treaties, changes in tax laws and regulations, economic sanctions, export controls, restrictions on the ability to transfer capital across borders, tariffs and other increases in trade protectionism and barriers to market participation, or the weakening or loss of certain intellectual property rights in some countries, may affect our business, financial condition and results of operations. Foreign regulatory requirements, including those related to the testing, authorization, and labeling of products and import or export licensing requirements, could affect the availability of our products in these markets. In addition to these broader market conditions, our operations may also be impacted by a variety of local factors, such as competition from local companies, local product preferences and requirements, changes in local healthcare payment systems and healthcare delivery systems, changes resulting from new political administrations, and labor force instability.
Many of our businesses rely on patent, trademark and other intellectual property assets. These intellectual property assets, in the aggregate, are of material importance to our business. We can lose the protection afforded by these intellectual property assets through patent expirations, legal challenges or governmental action. Any patent applications we own or license may not result in patents being issued and any issued patents we obtain may not provide us with any competitive advantage. Furthermore, we may fail to accurately predict all of the countries where patent protection will ultimately be desirable, and if we fail to timely file a patent application in any such country, we may be precluded from doing so at a later date. Patents attained by competitors, particularly as patents on our products expire, may also adversely affect our competitive position. Competitors may design around our intellectual property to develop competing technologies and products without infringing our intellectual property rights. In addition, competitors may seek to invalidate patents on our products or claim that our products infringe upon, misappropriate or otherwise violate their intellectual property, which could result in a loss of competitive advantage or the payment of significant legal fees, damage awards damages and past or future royalties, as well as injunctions against future sales of our products. We also operate in countries that do not protect intellectual property rights to the same extent as in the U.S., which could make it easier for competitors to compete with us in those countries. Further, governmental regulation and laws related to AI and other emerging technologies may increase the burden and cost of research and development or require increased transparency that makes it more difficult to protect our intellectual property.
There has also been increased shifting focus by federal, international, state and local regulatory and legislative bodies to combat and/or limit the effects of on combating and limiting climate change and to promote sustainability and related efforts through a variety measures such as requiring disclosure of means, including regulating GHG emissions (and requirements to disclose climate-related risks and metrics, including GHG emissions), emissions, conducting risk assessments on sustainability practices, adopting policies mandating or promoting the use of renewable or zero-carbon energy energy, implementing sustainability initiatives and sustainability initiatives, and imposing additional taxes on fuel and energy. There has been, and in the future there may be additional, Additional legislation or regulations enacted or promulgated in the United States and in other jurisdictions in which we do business that and our suppliers operate may impose more stringent restrictions restrictions, and requirements on our operations than our historical legal or regulatory obligations as well as additional disclosure or reporting requirements. obligations. We have experienced, and companies in our supply chain have experienced, and may continue to experience, increased compliance burdens and costs to meet the regulatory these obligations. Such increased compliance burdens If we or our suppliers are unable or unwilling to comply with these obligations, it could be more difficult and/or costly to manufacture and costs could cause disruption in the sourcing, manufacturing and distribution sell certain of our products and we could experience supply chain interruptions, including impacts to sourcing and distribution. In addition, we could be subject to litigation, substantial fines and other damages if we fail to comply with these obligations, which could adversely affect impact our business, financial condition or condition, results of operations. operations and cash flows.
A global trend towards limiting growth cost-efficiency, which could lead to uncertainty with respect to innovation, quality and patient access challenges or supplier attrition, as seen in prior bidding cycles. In addition, we expect recently enacted and proposed changes under legislative debate to Medicare, Medicaid and the Affordable Care Act to impact healthcare coverage, all of healthcare costs may also put industry-wide pressure on medical device or clinical diagnostic pricing. In which if implemented could adversely affect both the U.S., these include value-based purchasing demand and managed care arrangements. Governments prices customers are willing to pay for our products. Globally, governments in China and other countries continue to use various mechanisms to control healthcare expenditures, including increased use of competitive bidding and tenders, price regulation (such as volume-based procurement programs (“VoBP”)), government imposed payback provisions, and changes in reimbursement practices and policies on average selling prices for our products, which have unfavorably impacted our revenues and may continue to impact our results of operations in certain countries.