CAH, §1A diff (2024 → 2025)

Risk Factors

Risk Factors

The risks described below could materially and adversely affect our results of operations, financial condition, liquidity, or cash flows. These are not the only risks we face. Our businesses also could be affected by risks we do not currently consider material to our operations or of which we are not presently aware.

Legal, Regulatory, & Compliance Risks

Our business is subject to rigorous regulatory and licensing requirements.

As described in the "Business" section, products that we manufacture, source, distribute, or market must comply with U.S. federal, state, and foreign and regulatory requirements. Noncompliance or concerns over noncompliance, including noncompliance by suppliers, has in the past, and may in the future result in suspension of our ability to distribute, import, manufacture, or source products, recalls, safety alerts or seizures, or criminal or civil sanctions, which, in turn, could result in product liability claims and lawsuits, including class actions. If we fail to comply with regulatory requirements, or if allegations are made that we fail to comply, our results of operations and financial condition could be adversely affected.

To lawfully operate our businesses, we are required to obtain and hold permits, product registrations, licenses and other regulatory approvals from, and to comply with operating and security standards of, numerous governmental bodies. Failure to maintain or renew necessary permits, product registrations, licenses, or approvals, or to comply with required standards, could have an adverse effect on our results of operations and financial condition.

We are required to comply with laws relating to healthcare fraud and abuse. The requirements of these laws are complex and subject to varying interpretations. From time to time, regulatory authorities investigate our policies or practices, and may challenge them. For example, in November 2023, we received a Civil Investigative Demand ("CID") from the Department of Justice focused on potential violations of the Anti-Kickback Statute and False Claims Act in connection with a 2022 transaction in which we purchased a group purchasing organization and a minority ownership interest in a rheumatology managed services organization. We are cooperating with this investigation. We are also periodically subject to federal or state government investigations or qui tam actions (false claims cases initiated by private parties purporting to act on behalf of federal or state governments), which could result in civil or criminal sanctions, including the loss of licenses or the ability to participate in Medicare, Medicaid, and other federal and state healthcare programs or other remedial measures.

Some of our businesses are Medicare-certified suppliers or participate in other federal and state healthcare programs, such as state Medicaid programs and the federal 340B drug pricing program. In addition, some businesses manufacture pharmaceutical or medical products or repackage pharmaceuticals

that are purchased or reimbursed through, or are otherwise governed by, federal or state healthcare programs. Failure to comply with applicable eligibility requirements, standards, and regulations could result in civil or criminal sanctions, including the loss of our ability to participate in Medicare, Medicaid, and other federal and state healthcare programs.

We, and third parties acting on our behalf, collect, handle, and maintain patient-identifiable health information and other sensitive personal and financial information which are subject to federal, state, and foreign laws that regulate the use and disclosure of such information. Regulations currently in place continue to evolve, and they are extensive and complex. Compliance with these laws is difficult and costly. New laws in this area could further restrict our ability to collect, handle, and maintain personal or patient information, or could require us to incur additional compliance costs, either of which could have an adverse impact on our results of operations. From time to time, we have become aware of certain isolated alleged violations of federal, state, or foreign laws concerning privacy and data protection. When we become aware of such allegations, we investigate and, if warranted, notify affected people, entities, and regulatory bodies. As a result of these violations, we are, and may in the future be, subject to civil or criminal penalties, breach of contract claims, lawsuits, costs for remediation, and harm to our reputation.

Industry participants, including us, rely on ethylene oxide (“EtO”) and per- and polyfluoroalkyl (“PFA”) compounds to sterilize certain medical products, including products that we manufacture or distribute. Regulatory enforcement actions have been taken by certain environmental regulatory authorities to reduce emissions of these compounds during the sterilization and distribution process. If such measures become more widespread, we could experience increased costs to comply with reduced emissions standards and it is possible that we and other industry participants may be unable to effectively sterilize medical products, possibly resulting in supply shortages or an industry-wide reduction in surgical or medical procedures, which would negatively impact demand for our products. Such increased costs or industry-wide reductions in surgical and medical procedures would have a negative impact on our profit. Additionally, we have been named as a defendant in several lawsuits alleging personal injury as a result of EtO emissions. Additionally, we have incurred, and may incur additional costs associated with modifying certain manufacturing, distribution, or replenishment facilities in accordance with state environmental regulators' actions or requirements. It is possible that these or future regulatory actions or lawsuits could adversely impact our ability to procure products to distribute, resulting in increased costs or industry supply disruptions.

Our government contracts are subject to specific procurement requirements. Failure to comply with applicable rules or regulations or with contractual or other requirements may result in monetary damages and criminal or civil penalties as well as termination of

Cardinal Health | Fiscal 2025 Form 10-K

33

Risk Factors

our government contracts or our suspension or debarment from government contract work.

Our global operations (including transition services in connection with divestitures) are subject to the U.S. Foreign Corrupt Practices Act ("FCPA"), the U.K. Bribery Act and similar anti-bribery laws in other jurisdictions, and U.S. and foreign export control, trade embargo, and customs laws. If we fail to comply, or are alleged to fail to comply, with any of these laws, we could be subject to investigations or suffer civil or criminal sanctions.

Product quality issues could adversely affect operations, profitability, cash flows, and our financial condition.

As described in the "Business" section, products that we manufacture, source, distribute, or market must comply with rigorous quality requirements. These requirements include, among others, regulations regarding manufacturing practices, labeling, advertising, and post marketing reporting, including adverse event reports and field alerts and actions. Several of our facilities and procedures and those of our suppliers are subject to ongoing regulation and periodic inspection by the FDA and other authorities. Our products may not remain in compliance with applicable FDA and other regulatory requirements. Actions resulting from non-compliance with FDA and other regulations include fines, warning letters, injunctions, civil penalties, damages, recalls, consent decrees, seizures of products, and civil litigation and/or criminal prosecution. For example, following a facility inspection in December 2023, the FDA issued a warning letter to Cardinal Health in April 2024 related to plastic syringes sourced from a third party manufacturer in China asserting these products did not have appropriate 510(k) clearance and restating some of the observations from the December 2023 inspection. We promptly took action on these products and submitted a timely and comprehensive response to the warning letter describing our investigation and corrective actions, and we continue to cooperate with the FDA on this matter.

Noncompliance or concerns over noncompliance, including by suppliers, as a result of use of third party manufactures, or planned shifts in production sites, has in the past, and may in the future result in substantial modifications to our business practices and operations. These modifications can include suspension of our ability to import and distribute, refunds, or recalls, total or partial shutdown of production in one or more facilities while we or our suppliers remedy any actual or potential issues, the inability to obtain future pre-market approvals or marketing authorizations, and withdrawals or suspensions of current products from the market. In addition, it can be costly and time-consuming to obtain regulatory approvals or product registrations to market a medical device or other product, and such approvals or registrations might not be granted on a timely basis, if at all. Any of these supply chain and quality-related events could be disruptive to our business and have a material adverse effect on operations, profitability, cash flows, and our financial condition.

We could be subject to adverse changes in the tax laws or challenges to our tax positions.

We are a large multinational corporation with operations in the United States and many foreign countries. As a result, we are subject to the tax laws of many jurisdictions.

From time to time, proposals are made in the United States and other jurisdictions in which we operate that could adversely affect our tax positions, effective tax rate, or tax payments. Additionally, changes in tax laws or regulatory enforcement priorities may impact our tax position. For example, in July 2025, the OBBBA was signed into law and includes a broad range of tax reform provisions, which, among other things, extend or make permanent certain business and international tax measures initially established under the 2017 Tax Cuts and Jobs Act ("Tax Act"), which were set to expire, and reinstates 100% bonus depreciation. Specific initiatives that may impact us include possible increases in U.S. or foreign corporate income tax rates or other changes in tax law to raise revenue, the repeal of the LIFO (last-in, first-out) method of inventory accounting for income tax purposes, the establishment or increase in taxation at the U.S. state level on the basis of gross revenues, recommendations of the base erosion and profit shifting project undertaken by the Organization for Economic Cooperation, and Development and the European Commission’s investigation into illegal state aid.

Additionally, in connection with the accruals taken in connection with opioid-related lawsuits in fiscal year 2021, we recorded a net tax benefit, reflecting our then-current assessment of the estimated future deductibility of the amount that may be paid. We have made reasonable estimates and recorded amounts based on management's judgment and our current understanding of the Tax Act; however, the tax law governing deductibility was changed by the Tax Act, and these estimates require significant judgment and it is possible that they could be subject to challenges by the U.S. Internal Revenue Service ("IRS").

We also regularly review these estimates and assumptions from time to time and adjust our accruals based on our review, resulting in changes in our tax provisions/(benefit). The actual amount of tax benefit related to uncertain tax positions may differ materially from these estimates. See Note 9 of the "Notes to Consolidated Financial Statements" for more information regarding these matters.

In fiscal year 2021, our provision for income taxes reflected a $424 million benefit from the tax benefits of a self-insurance pre-tax net operating loss carryback under the Coronavirus Aid, Relief and Economic Security ("CARES") Act. Also, as a result of this net operating loss carryback, we received a U.S. federal income tax refund of $966 million. This fiscal year is being audited by the IRS, and it is possible that the IRS could challenge our tax position with respect to this self-insurance loss. If they do, our effective tax rate or cash flows could be adversely impacted. Additionally, laws governing insurance coverage vary by state and some state courts have interpreted laws and insurance policies in ways that may impact our self-insurance loss, which could negatively impact our financial position.

34

Cardinal Health | Fiscal 2025 Form 10-K

Risk Factors

We file income tax returns in the U.S. federal jurisdiction, various U.S. state jurisdictions, and various foreign jurisdictions. Tax laws are complex and subject to varying interpretations. With few exceptions, we are subject to audit by taxing authorities for fiscal years 2015 through the current fiscal year, including specific inquiries into a restructuring in connection with integrating the July 2017 acquisition of the Patient Recovery business and the net operating loss carryback described above. Proposed adjustments in ongoing audits may adversely affect our effective tax rate or tax payments.

Changes to the U.S. healthcare environment may not be favorable to us.

Over a number of years, the U.S. healthcare industry has undergone significant changes designed to increase access to medical care, improve safety and patient outcomes, contain costs, and increase efficiencies. These changes include a general decline in Medicare and Medicaid reimbursement levels, efforts by healthcare insurance companies to limit or reduce payments to pharmacies and providers, the basis for payments beginning to transition from a fee-for-service model to value-based payments and risk-sharing models, and the industry shifting away from traditional healthcare venues like hospitals and into clinics, physician offices, and patients’ homes.

We expect the U.S. healthcare industry to continue to change significantly in the future. Possible changes include changes in legislation or regulations governing prescription pharmaceutical pricing, healthcare services, U.S.-based medical product manufacturing, mandated benefits, efforts to promote increased transparency in the pharmaceutical supply chain, drug shortages, further reduction of or limitations on governmental funding at the state or federal level, or efforts by healthcare insurance companies to further limit payments for products and services. Federal, state, and local governmental entities have also continued to increase their scrutiny of the U.S. healthcare market.

Uncertainty surrounding possible changes to the healthcare environment, including changes to regulatory enforcement priorities, may directly or indirectly adversely affect us. The recently issued Executive Order titled "Delivering Most-Favored Nation Prescription Drug Pricing to American Patients" may impact the sales or profitability of branded pharmaceutical products; however, the extent of the impact may vary depending on the timeline for implementation and the number of pharmaceutical drugs that are impacted. Additionally, it is possible that the adoption of the OBBBA could reduce participation in Medicare and Medicaid programs, resulting in a change in utilization of the healthcare system. This may adversely affect demand for our products and services and could have an effect on our results of operations and financial condition.

Private challenges to government healthcare policy may also have an adverse impact on our business. For example, the federal 340B drug pricing program requires pharmaceutical manufacturers to offer discounts on certain drugs purchased by covered entities, and some of our Pharma segment customers are covered entities or contract pharmacies for covered entities. Over a dozen

pharmaceutical manufacturers have unilaterally restricted sales under the 340B drug pricing program to contract pharmacies. These practices are the subject of ongoing litigation; however, if manufacturers continue this practice and if courts uphold this practice, our customers may be adversely impacted, which could adversely impact our business.

Opioid-related legal proceedings and the NOSA we have entered into could have additional or unexpected negative effects on our results of operations or business.

Cardinal Health, along with other pharmaceutical wholesalers and other participants in the pharmaceutical supply chain, was named as a defendant in lawsuits related to the distribution of opioid pain medications. Plaintiffs in these lawsuits included state attorneys general, counties, and municipalities.

In April 2022, an agreement settling the vast majority of opioid-related lawsuits filed against us by state and local governmental entities became effective. It includes injunctive relief terms relating to distributors' controlled substance anti-diversion programs, with which we must comply. It is possible that the maintenance of the required changes to distributors' controlled substance anti-diversion programs may result in unforeseen costs or operational challenges which could have an adverse impact on our results of operations or performance. If we are unable to comply with these requirements, or are alleged to have failed to comply with these requirements, we could incur unforeseen costs or penalties, and our financial results may be negatively impacted.

We are also being sued by private plaintiffs, such as unions, other health and welfare funds, other healthcare providers, and individuals alleging personal injury for the same activities, and could be named as a defendant in additional lawsuits. We intend to vigorously defend ourselves against these lawsuits; however, legal proceedings are inherently unpredictable and it is possible that these lawsuits, either individually or in the aggregate, could have a negative impact on our results of operations.

We are involved in legal proceedings with insurers related to the availability of insurance coverage for some matters described above and our ability to recover losses from our insurers is uncertain. Additionally, laws governing insurance coverage vary by state and some state courts have interpreted laws and insurance policies in ways that may negatively impact our ability to receive indemnification under our insurance policies.

Ongoing unfavorable publicity regarding the abuse or misuse of prescription opioid pain medications and the role of wholesale distributors in the supply chain of such prescription medications could continue to have an adverse effect on our reputation or results of operations.

The outcome or resolution of certain legal proceedings could adversely impact our cash flows or results of operations.

Due to the nature of our business, which includes the distribution of controlled substances and other pharmaceutical products and the sourcing, marketing, and manufacturing of medical products, we regularly become involved in disputes, litigation, and regulatory matters. Litigation is inherently unpredictable, disruptive, and time consuming and the unfavorable outcome of legal proceedings

Cardinal Health | Fiscal 2025 Form 10-K

35

Risk Factors

could adversely affect our results of operations or financial condition.

Additionally, some of the products that we distribute or manufacture have been and may in the future be alleged to cause personal injury, subjecting us to product liability claims. For example, since July 2021, we have entered into settlement agreements to settle the vast majority of product liability claims alleging personal injuries associated with the use of Cordis OptEase and TrapEase IVC filter products. Future settlements of or judgments for product liability claims may not be covered by insurance or exceed available insurance recoveries. If this happens, our results of operations and financial condition could be adversely affected.

In connection with legal proceedings, we occasionally enter into settlement agreements or become subject to consent decrees containing ongoing financial or operational obligations, including the injunctive relief provisions of the NOSA and the Corporate Integrity Agreement that our Specialty business entered into with the Office of Inspector General of the Department of Health and Human Services in connection with the rebates offered or provided to certain Specialty Solutions customers. Failure to comply with obligations under these agreements or decrees could lead to monetary or other penalties.

We might infringe intellectual property rights or our own intellectual property protections might be insufficient to protect our commercial interests.

Third parties have in the past and may in the future assert infringement claims against us. Litigation and proceedings related to intellectual property are unpredictable, and we might be required to pay significant damages, develop non-infringing products or services, obtain a license, cease selling or using allegedly infringing products or services, or incur other restrictions on our operations. Trade secret, patent, copyright, and trademark laws, nondisclosure obligations, and other contractual provisions are critical to our business. Our efforts to protect our intellectual property might be insufficient, and non-infringing products or services equivalent or superior to ours might be developed by competitors.

Industry & Economic Risks

Changes or uncertainty in U.S. or international trade policies and exposure to economic, political and currency, and other risks could disrupt our global operations or negatively impact our financial results.

We conduct our operations in various regions of the world outside of the United States, including Europe, Asia, and Latin America. Global developments can affect our business in many ways. Our global operations are affected by local economic environments, including inflation, recession, and competition. Additionally, divergent or unfamiliar regulatory systems and labor markets can increase the risks and burdens of operating in numerous countries. For example, recent U.S. tariffs imposed or threatened to be imposed on goods, materials, and products from countries where

we do business, and any retaliatory actions taken by such countries could result in us incurring substantial additional costs to source materials, directly and indirectly, from affected countries, and may require us to raise prices on certain products and seek alternative sources of supply. If our competitors do not increase prices, or increase prices to a lesser extent than we do, or are able to offset the impact of tariffs through other actions, our competitive and financial position may be adversely affected. Additionally, if we are not able to find adequate alternate sources of supply, we may experience supply shortages or disruptions. Additionally, in certain circumstances, including in our Other operating segment, we may not receive increased reimbursement commensurate with the increase in costs, which may negatively impact our results of operations. In addition, we conduct our business in U.S. dollars and various functional currencies of our foreign subsidiaries. Changes in foreign currency exchange rates could adversely affect our financial results, which are reported in U.S. dollars. We may not be able to hedge to protect us against these exposures, and any hedges may not successfully mitigate these exposures.

We are also subject to government import and export controls and regulations, including the requirement that we make a determination as to the country of origin of products that we source or manufacture outside the United States. From time to time, Customs and Border protection agencies, whether in the U.S. or other jurisdictions, have challenged these determinations. These and other actions by border protection have resulted in products being detained or delayed and supply disruptions and could result in the imposition of fines and penalties. In addition, the Uyghur Forced Labor Prevention Act, which went into effect in June 2022, prohibits the importation of any goods grown, produced, manufactured, or mined, wholly or in part, in the Xinjiang Uyghur Autonomous Region of China unless importers can provide clear and convincing evidence that goods were not made using forced labor. We have experienced supply constraints as a result of these and similar regulations, and it is possible that our business or results of operations could be further negatively impacted by future determinations and disruptions.

Our Pharmaceutical and Specialty Solutions segment’s profit margin could be adversely affected by changes in industry or market dynamics that we are not able to accurately predict.

The frequency, timing, magnitude, and profit impact of generic pharmaceutical customer purchase volumes, pricing changes, customer contract renewals, generic pharmaceutical launches, and generic pharmaceutical manufacturer pricing changes, which contribute to the performance of our generic pharmaceutical program, remain uncertain. These factors have contributed to declines in some prior years and have more than offset the benefits from sourcing generic pharmaceuticals through our Red Oak Sourcing venture with CVS Health. If performance of our generic pharmaceutical program declines in future fiscal years and we are unable to offset the decline, our Pharma segment profit and consolidated operating earnings will be adversely affected.

Additionally, almost all of our distribution services agreements with branded pharmaceutical manufacturers provide that we receive

36

Cardinal Health | Fiscal 2025 Form 10-K

Risk Factors

fees from the manufacturers to compensate us for services we provide them. However, under certain agreements, branded pharmaceutical price appreciation, which is determined by the manufacturers, also serves as a part of our compensation. If manufacturers change their historical approach to setting and increasing wholesale acquisition cost, decide to reduce prices, not to increase prices, or to implement only small increases, and we are unable to negotiate alternative ways to be compensated by manufacturers or customers for the value of our services, our margins could be adversely affected.

We depend on direct and indirect suppliers to make their

products and raw materials available to us and are subject to fluctuations in costs, availability, and regulatory risk associated with these products and raw materials.

Our manufacturing businesses use oil-based resins, pulp, cotton, latex, and other commodities as raw materials in many products. Prices of oil and gas also affect our distribution and transportation costs. Prices of these commodities are volatile and can fluctuate significantly, causing our costs to produce and distribute our products to fluctuate. Beginning in the fourth quarter of fiscal year 2021, we experienced higher supply chain costs, which had a negative impact on our GMPD (former Medical) segment profit in fiscal 2021, 2022, 2023, 2024, and 2025. Supply chain constraints also had a negative impact on sales within our GMPD (former Medical) segment.

We did not offset the full impact of these cost increases in fiscal year 2023, 2024, and 2025; however, we implemented certain cost reductions, price increases, and surcharges to mitigate the impact. Due to competitive dynamics and contractual limitations, passing along cost increases is challenging. If we are not able to mitigate future cost increases through increased prices where necessary or if supply chain cost significantly increase or become subject to additional variability, GMPD segment profit could be negatively impacted.

We depend on others to manufacture some products, including pharmaceuticals, that we market and distribute. Our operations are also dependent on various components, compounds, raw materials, and energy supplied by others. We purchase many of these components, raw materials, and energy, and source certain products from numerous suppliers in various countries. In some instances, for reasons of quality assurance, cost effectiveness, or availability, we procure certain components and raw materials from a sole supplier. Our supplier relationships could be interrupted, become less favorable to us or be terminated and the supply of these components, compounds, raw materials, or products could be interrupted or become insufficient.

These supply interruptions or other disruptions in manufacturing processes could be caused by events beyond our control, including natural disasters, labor disputes, supplier facility shutdowns, defective raw materials, the impact of epidemics or pandemics, such as COVID-19, and actions by U.S. or international governments, including import or export restrictions or tariffs. Any material interruption in our supply chain or inability to obtain key products from third parties in a timely and cost-effective

manner, including as a result of trade or other restrictions, could adversely affect our business operations and results of operations, financial condition and cash flows.

In addition, due to the stringent regulatory requirements regarding the manufacture and sourcing of our products, we may not be able to quickly establish additional or replacement sources for certain components, materials, or products. A sustained supply reduction or interruption, and an inability to develop alternative and additional sources for such supply, could result in lost sales, increased cost, damage to our reputation, and may have an adverse effect on our business.

We could continue to suffer the adverse effects of competitive pressures, and changes in our relationships with significant customers could adversely affect us.

As described in greater detail in the "Business" section, we operate in markets that are highly competitive and dynamic. In addition, competitive pressures in each of our businesses may be increased by new business models, new entrants, new regulations, or changes in enforcement priorities, changes in consumer demand, or general competitive dynamics. Additionally, we may not be able to onboard new customers as efficiently as expected due to customer service issues or competitive service level offerings. We have also experienced delays in onboarding new customers due to factors outside of our control. Our businesses face continued pricing pressure from these factors, which adversely affects our margins. If we are unable to offset margin reductions caused by these pressures through steps such as sourcing or cost control measures, additional service offerings and sales of higher margin products, our results of operations could continue to be adversely affected.

Employee attrition may have an adverse impact on our business, results of operations, or internal controls.

Our ability to attract, retain, and develop qualified and experienced employees, including key executives, key employees at companies that we acquire, and other talent, is critical for us to meet our business objectives. We compete with many other businesses to attract and retain employees. It is possible that we could experience loss of key personnel for a variety of causes. If we do not adequately plan for succession of key roles or if we are not successful in attracting or retaining new talent, our operations, financial performance or internal control over financial reporting could be adversely impacted.

Consolidation in the U.S. healthcare industry may negatively impact our results of operations.

In recent years, U.S. healthcare industry participants, including distributors, manufacturers, suppliers, healthcare providers, insurers, and pharmacy chains, among others, have consolidated or formed strategic alliances. Consolidations create larger enterprises with greater negotiating power and could result in the possible loss of a customer in the situation where the combined enterprise selects one distributor from two incumbents or a reduction in our ability to market our products and services to new customers. Consolidations also impact other objectives, including

Cardinal Health | Fiscal 2025 Form 10-K

37

Risk Factors

our ability to use acquisitions to expand or complement our existing businesses. If this consolidation trend continues, it could adversely affect our results of operations.

Business & Operational Risks

Our business and operations depend on the proper functioning of information systems, critical facilities, and distribution networks and could be negatively impacted by events outside of our control.

We rely on our and third-party service providers' information systems for a wide variety of critical operations, including to obtain, rapidly process, analyze, and manage data to:

•facilitate the purchase and distribution of inventory items from numerous distribution centers;

•receive, process, and ship orders on a timely basis;

•manage accurate billing and collections for thousands of customers;

•process payments to suppliers;

•facilitate manufacturing and assembly of medical products; and

•generate financial information.

Our business also depends on the proper functioning and security of our and our suppliers' business processes, critical facilities, including our national logistics center, and our distribution networks. Our results of operations could be adversely affected if our or a service provider's business processes, information systems, critical facilities, or distribution networks are disrupted (including disruption of access), are damaged or fail, whether due to physical disruptions, such as extreme weather events, including wildfires, hurricanes, extreme temperatures, or other natural disasters, pandemics (as they were by the COVID-19 pandemic), supply chain disruptions, or power outages, systems updates, or due to cybersecurity incidents, ransomware, or other actions of third parties, including labor strikes or shortages, political unrest, and terrorist attacks. In addition, hardware, software, and other applications and updates procured from third parties may contain defects that have and may in the future unexpectedly restrict or prevent access to or interfere with the proper operation of our information systems and hardware. Manufacturing disruptions also can occur due to regulatory action, production quality deviations, safety issues, or raw material shortages or defects, planned shifts in production sites, or because we need to transition manufacturing facilities for any key products or components that is manufactured at a single manufacturing facility where there are limited alternate facilities. Additionally, we incur costs to remediate these disruptions, and it is possible that these costs could be significant.

Our ability to compete effectively is increasingly dependent on access to and interpretation of data, and we may provide services that involve hosting customer data and operating software on third-party or our own systems. Data quality impacts customer ordering, order fulfillment, and higher order processing. If we fail to effectively implement and maintain data governance structures across our businesses, to effectively interpret and utilize such

data, or protect the integrity of such data, including systems powered by or incorporating artificial intelligence and machine learning, our operations could be impacted, and we may be at a competitive disadvantage.

Our business and results of operations could be adversely affected if we experience a material cyber-attack or other systems breach.

Cybersecurity incidents and attacks resulting in unauthorized access to our systems and those of third parties we use in our business could have a material impact on our business operations as a result of loss or misuse of our information, including personal data and sensitive data, and disruption to normal business operations. Our business relies on the secure transmission, storage, and hosting of patient-identifiable health information, financial information, and other sensitive protected information relating to our customers, company, workforce, and individuals with whom we and our customers conduct business. We have programs in place to detect, contain, and respond to information security incidents. However, because the techniques used to obtain unauthorized access, disable, or degrade service or sabotage systems change frequently and may be difficult to detect for long periods of time, we may be unable to anticipate these techniques or to implement adequate preventative measures. In addition, hardware, software, or applications developed internally or procured from third parties may contain defects in design or manufacture or other problems beyond our control that could unexpectedly compromise information security.

Unauthorized parties have gained access in the past, and will continue to attempt to gain access, to our (including our recently acquired entities) or a service provider's systems or facilities through fraud, social engineering, or other forms of deception. The sophistication of cybersecurity threats and AI-powered cyber-attacks such as deep fakes and force attacks continues to increase. Additionally, our recently acquired MSO businesses are subject to cybersecurity-related risks which are, while similar in many respects, incremental to the cybersecurity risks experienced by our legacy businesses. If we are not able to adapt our systems and processes to mitigate these risks, we could experience additional financial losses, including as a result of class action lawsuits.

We and our service providers have been the target of cyber attacks. Although we do not believe these incidents had a material impact on us, either individually or in the aggregate, similar incidents or events in the future may negatively impact our business, reputation, or financial results.

Any compromise of our or a service provider's information systems, including unauthorized access to or use or disclosure of sensitive information, could result in the loss or misuse of our information, including personal data and sensitive data and adversely impact our operations, results of operations, or our ability to satisfy legal or regulatory requirements, including the EU general data protection regulation (GDPR) and those related to patient-identifiable health information and other sensitive personal and financial information at the state and U.S. federal level as further described in the Risk Factor titled “Our business is subject to other rigorous regulatory and licensing requirements,” above. A

38

Cardinal Health | Fiscal 2025 Form 10-K

Risk Factors

cybersecurity incident could result in a violation of these and other applicable laws and result in a loss of customers and revenues, remediation and other costs, increased insurance premiums, litigation, monetary fines and penalties, and damage to our competitiveness and reputation, any of which could adversely affect our financial condition and business.

In addition, insurance for losses arising from cyber-attacks or other breaches is becoming more costly and limited and may not be available to us at amounts that we historically have obtained or that we would like to obtain. It is possible that we could incur losses that may not be covered by insurance or that would exceed available insurance recoveries. If this happens, our results of operations and financial condition could be adversely affected.

Our sales and credit concentration is significant.

In fiscal year 2025, CVS Health was our largest customer. CVS Health accounted for 30 percent of our fiscal 2025 revenue and 26 percent of our gross trade receivable balance at June 30, 2025. If CVS or another significant customer reduces their purchases from us, defaults in payment to us, does not renew or terminates their agreements, whether due to an alleged default by us or otherwise, our results of operations and financial condition could be adversely affected.

Our ability to complete, integrate, and manage acquisitions could impact our strategic objectives and financial condition.

From time to time, we acquire or look to acquire other businesses that expand or complement our existing businesses or enable entry into new lines of business. For example, in fiscal year 2025, we completed several significant acquisitions in disparate businesses: the acquisition of Integrated Oncology Network and GI Alliance, which are part of our Specialty business, and the acquisition of Advanced Diabetes Supply Group, which is part of our Cardinal Health At-Home businesses.

Completion of acquisitions involves a number of risks, including the risk that required financing may not be available on favorable terms and the risk that we may not receive regulatory approvals necessary to timely complete an acquisition or otherwise satisfy closing conditions.

Additionally, we are subject to risks associated with the integration and operation of acquired businesses, including the risk that our management’s attention may be diverted to integration efforts at the expense of the legacy businesses, we may fail to retain key personnel of the acquired business, we may experience difficulties or delays establishing, integrating, or combining operations and systems, including manufacturing facilities and cybersecurity-related systems and processes, we may become subject to unforeseen liabilities arising from legal proceedings involving the acquired business, we may face challenges retaining the customers of the acquired business and we may encounter unforeseen internal control, regulatory, or compliance issues. Additionally, future developments may impair the value of our purchased goodwill or intangible assets or may otherwise negatively affect our ability to achieve the financial, strategic, or other benefits we expect from the acquisitions. For example, certain states have proposed legislation, and Oregon adopted

legislation, that would limit, restrict or prohibit corporate entities from owning or managing physician practices, directly, or indirectly, through a managed services organization. If these regulations proliferate, our ability to continue to own certain of our recently acquired businesses in certain jurisdictions and our ability to execute on our strategy may be impacted.

Our results of operations and financial condition may be adversely affected by risks associated with entering new lines of business, and our ability to execute our strategy.

As a result of our recently announced acquisitions, we are entering into new lines of business, including providing physician practice support and management services, that complement our pre-existing businesses. Such new lines of business involve numerous risks and uncertainties that may be different from or more significant than the risks and uncertainties facing our legacy businesses, including risks arising under or related to fraud, waste, and abuse laws, direct or indirect ownership of provider practices, litigation involving physicians, and risks from regulatory or legislative changes that may limit direct or indirect ownership of provider practices or our ability to provide physician practice support and management services. Additionally, these businesses are subject to cybersecurity risks that are, while similar in many respects, incremental to the cybersecurity risks experienced by our legacy businesses. If we are not able to adapt our systems and processes to mitigate these risks, we could experience additional financial losses, including as a result of class action lawsuits.

Additionally, our ability to successfully execute on providing physician practice support and management services, including through direct or indirect ownership of provider practices as permitted by applicable law, depends upon a number of factors, including: the ability to develop or acquire and integrate appropriate practice management and support expertise; the ability to support recruitment, integration, and retention of sufficient numbers of local providers and staff; the ability to successfully support negotiations with vendors, suppliers, and payors; the reimbursement environment; and competition from other healthcare organizations with greater depth of experience or market knowledge.

Failure to effectively or efficiently complete or manage critical business processes could have unforeseen consequences.

From time to time, our businesses perform business process improvements or infrastructure modernization or use service providers for key systems and processes, such as receiving and processing customer orders, customer service, and accounts payable. These initiatives, transitions, and improvements require an ongoing commitment of resources. If any of these initiatives, including those related to the ongoing implementation of new Enterprise Resource Planning technologies and supply chain optimization initiatives, and initiatives related to artificial intelligence and machine learning, are not successfully or efficiently implemented or maintained, or if our relationship with critical third-party service providers deteriorates, we could experience negative impacts on our business, financial results, and our internal control over financial reporting.

Cardinal Health | Fiscal 2025 Form 10-K

39

Risk Factors

Our business is affected by events outside of our control including public health crises, extreme weather-related events and natural disasters, geopolitical, and other catastrophic events.

We have experienced and expect to continue to experience weather-related impacts to the business, primarily driven by risks to certain physical components of our operations and risks related to the transition to a lower-carbon economy. For example, our properties have experienced physical damage resulting from adverse or extreme weather resulting in increased costs for repairs and may cause disruptions in operations. Additional risks associated with extreme weather may cause social and human effects such as shifts in populations, increased costs for critical services such as transportation, and other adverse effects. These factors may negatively impact cost or availability of certain products, commodities, or energy, and could impair our ability to secure goods and services required for the operation of our business at quantities and levels we require.

Environmental and other climate-related laws and regulations may impose costs, including increased spend associated with carbon pricing mechanisms, data gathering and reporting, third-party attestations, capital expenditures to implement lower greenhouse gas emissions technology, and other measures to reduce emissions. We cannot predict the potential impact on our competitive position, results of operations, or financial condition. A shift in customer or consumer preference towards low-carbon products and services may also place us at a competitive disadvantage if we fail to effectively adjust for these shifts. Our supply chain is subject to these same physical and transitional risks.

Events outside of our control also have, and will continue to, adversely impact our operations and financial results. These events include those related to public health crises, including epidemics or pandemics; geopolitical events or tensions, including civil unrest, trade sanctions, tariffs and other trade restrictions, armed conflicts, or terrorism; or unstable international governments and legal systems. Among other potential affects, these events may have a disruptive and unpredictable impact on our operations and those of our suppliers and vendors, or customers, hinder manufacturing and transportation, result in significant excess costs, lead to shifts in customer demand, or have a negative impact on capital markets. Such events are inherently unpredictable, and our responses may involve the implementation of measures which may not be as successful as intended in mitigating adverse impacts.

Our results of operations or strategic objectives could be adversely impacted if we fail to manage and complete divestitures.

We regularly evaluate our portfolio of businesses to determine whether an asset or business may no longer help us meet our objectives or whether there may be a more advantaged owner for that business. For example, in July 2023, we contributed our Outcomes™ business to Transaction Data Systems in exchange for a minority stake in the combined entity, and in fiscal year 2022,

we completed the divestiture of the Cordis business. When we decide to sell assets or a business, we may encounter difficulty finding buyers or alternative exit strategies, which could impact the achievement of our strategic objectives. We could also fail to obtain necessary regulatory approval or incur higher costs or charges than planned or incur unexpected charges and could experience greater dis-synergies than expected, which could have a negative impact on our results of operations.

Our goodwill or other long-lived assets may be further impaired, which could require us to record additional significant charges to earnings in accordance with generally accepted accounting principles.

U.S. GAAP requires us to test our goodwill for impairment on an annual basis, or more frequently if indicators for potential impairment exist. In addition, we review intangible assets with finite lives and other long-lived assets for impairment whenever events or changes in circumstances indicate that the related carrying amounts may not be recoverable.

In fiscal 2025, we performed annual impairment testing and concluded there were no impairments of goodwill for our reporting units as the estimated fair value of each reporting unit exceeded its carrying amount.

Impairment testing involves estimates and significant judgments by management. We believe our assumptions and estimates are reasonable and appropriate; however, additional adverse changes in key assumptions, a failure to meet expected earnings or other financial plans, or unanticipated events and circumstances, an increase in the discount rate, a decrease in the terminal growth rate, increases in tax rates, or a significant change in industry or economic trends could affect the accuracy or validity of such estimates and may result in goodwill impairment. It is possible that we may record significant charges from impairment to our goodwill reporting units, intangibles, and other long-lived assets in the future. Any charge or charges could adversely affect our results of operations.

During fiscal 2024 and 2023, we recorded aggregate goodwill impairment charges of $675 million, and $1.2 billion, respectively, related to GMPD (our former Medical unit) primarily driven by the performance and long-term financial plan assumptions. GMPD had no goodwill balance remaining at June 30, 2024.

See "Critical Accounting Policies and Sensitive Accounting Estimates" in MD&A above for more information regarding goodwill impairment testing.

40

Cardinal Health | Fiscal 2025 Form 10-K