Cybersecurity and data breaches

Our IT systems and Technology are vulnerable to breakdown, interruption, cyber and other security attacks, system malfunction, unauthorized access, inadvertent exposure or disclosure of information, theft, and other events and, at times, requires the manual application of security upgrades or patches on each machine or device that utilizes the Technology. Third-party systems and solutions that we rely on are also vulnerable to the same risks and may contain defects in design or manufacture or other problems that could result in system disruption or compromise the information security of our own systems, products, and services. Security threats, including cyber and other attacks, have become very sophisticated, frequent, and adaptive. The adversarial use of AI also poses unique challenges and may impact real-time detection capabilities and containment efforts. In addition, we are at risk of our third-party service providers sustaining such attacks, which may impact our products, services, and operations. Further, we expect that the breadth and complexity of our information and technology systems and infrastructure will increase as we work to expand our product offerings to utilize and generate data analytics and potentially AI (which create emerging enterprise risks, including cybersecurity, monitoring, and oversight). See “Risks Relating to Our Operations – We are exposed to risks associated with incorporating AI, machine learning and other emerging technologies into our products, services and operations”. The continuing evolution of technology we use, including cloud-based computing, open-source software, data hosting, AI, and reliance on third parties and Software as a Service (Saas) solutions, whom may also use open-source software, cloud-based computing, data hosting, or AI tools, create additional opportunities for the unintentional, intentional, unauthorized or unlawful disclosure, exposure, dissemination, loss, alteration, access or destruction of Protected Information stored or processed in our devices, systems, servers, infrastructure, and products (collectively, Technology), and those of our Saas providers and third party service providers. Additionally, certain of our products and systems collect Protected Information regarding customers, partners, patients and their therapies, and are internet enabled and connect to our systems, hospital networks, electronic medical record systems, or electronic health record systems, and are subject to the same risks, and could impact patient safety and lead to field actions or product recalls.

While we have made, and expect to continue making, significant investments intended to strengthen our cybersecurity posture—including measures designed to protect our products, systems, and data—we cannot guarantee that these efforts will fully prevent, mitigate or remediate cybersecurity incidents or breaches. We maintain processes designed to monitor, detect and respond to threats and collaborate with government authorities and third-party partners in an effort to reduce risk. However, given the evolving nature, sophistication, scale and frequency of cybersecurity incidents and breaches, no system can be entirely secure. A successful cybersecurity incident or breach could materially adversely affect our business, financial condition, results of operations or cash flows.

risks, including from confidentiality, privacy, data protection, cybersecurity and compliance perspectives, and raises intellectual property issues and legal, regulatory, reputational ethical, operational, technological and other concerns (see, “Our operations are dependent in part on patents and other intellectual property assets” and “Cybersecurity incidents and breaches or breakdowns of our information and technology systems or infrastructure could have a material adverse effect on our operations” elsewhere in this Item 1A, Risk Factors). Additionally, if we do not effectively adopt and integrate AI into innovative, market-differentiated products in a timely manner, our competitive position could be adversely affected.

Furthermore, privacy and data protection risks extend beyond our direct operations. Non-compliance by third-party vendors, manufacturers, or service providers (especially those involved in data processing) can expose us to liability indirectly. Cybersecurity incidents, system failures, or breaches involving our own infrastructure or that of our partners may trigger regulatory scrutiny, financial penalties, business interruption, reputational harm, loss of competitive advantage and customer trust, as well as privacy litigation and civil lawsuits with damages.

Moreover, we are subject to various operational, compliance, and reputational risks associated with our adoption and utilization of AI technologies, including inaccurate or unpredictable outputs, such as errors or hallucinations, that may impair decision‑making, disrupt operations, or expose sensitive information. Integrating AI into our systems may also expand our cybersecurity attack surface, increasing exposure to data breaches, loss of intellectual property, or inadvertent disclosure of confidential data. Although we have taken steps intended to mitigate risks related to our use of AI, there can be no assurance that our use of AI will yield the anticipated benefits or that we will be able to effectively mitigate the associated risks. Externally, the rapid adoption of AI by competitors and malicious actors heightens risks as threat actors leverage AI to execute more sophisticated cyberattacks and social‑engineering campaigns, while competitor use of AI may accelerate innovation cycles and intensify competitive pressures. Any of these events could have a material adverse effect on our business, financial condition and results of operations.

Solventum has begun to deploy AI in its products and services, including as part of its research and development efforts, and Solventum expects to continue to explore additional uses as AI continues to develop. In addition, Solventum intends to devote significant resources to develop and deploy cloud, edge and software solutions in its healthcare solutions. For example, Solventum has incorporated AI into certain products in the Health Information Systems business segment and certain of its digital offerings and expects to continue to build AI into additional products. Any disruption or failure in the AI, machine learning, or other emerging technologies Solventum deploys or uses in its products and services, including as part of its research and development efforts, could adversely impact Solventum’s business, including as a result of flawed AI algorithms, insufficient or biased datasets, malfunctions or manipulations, unintentional release of confidential information, or product or service delays or recalls. In addition, any failure to successfully deploy or use such technologies in Solventum’s products and services, or to adapt to medical technology industry trends and developments related to such technologies in a timely manner (or at all), particularly as competitors incorporate such technologies into new and existing products and services, could adversely affect customer demand for Solventum’s products and its competitiveness. The deployment of AI, machine learning or other emerging technologies into Solventum’s products and services will require additional investment and increase its costs. Furthermore, the rapid advancement of technology, including AI, creates additional risks as Solventum includes such technology into its products and services, including from confidentiality, privacy, data protection, cybersecurity and compliance perspectives, and raises intellectual property issues and operational, technological and other concerns. Any of the above factors could adversely affect Solventum’s business, financial condition, results of operations and cash flows.