Envoy Medical, Inc.

Risk Management and Strategy

We have certain processes for the identification, assessment, and mitigation of cybersecurity risks which are incorporated into our overall risk management processes in coordination with our information technology function, which we rely on athird-party vendor who is associated with a Related Party to provide. Such processes include physical, procedural, and technical safeguards and routine review of our policies and procedures to identify risks and improve our practices. We use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs. We consider the cybersecurity practices of our third-party service providers, including through a general security assessment and contractual requirements, as appropriate, before engaging them in order to help protect us from any related vulnerabilities.

We donot believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. For more information about the cybersecurity risks we face, see the risk factor entitled “Failure of a key information technology system, process or site could have an adverse effect on our business” in the section titled*“Risk Factors”* in Part 1, Item 1A of this Annual Report.

Governance

Our third-party vendor, alongside oursenior management leads the operational oversight of the company-wide cybersecurity strategy, policy, standards and processes. As a smaller-reporting Company we do not have an employee who has significant and demonstrated professional IT management experience and possesses the requisite education, skills and experience expected to perform such a duty. The audit committee of the board of directors intends to provide oversight of our cybersecurity risk as part of its periodic review of enterprise risk management. Additionally, the board of directors intends to review our enterprise risk management processes and will be notified by management between management updates regarding significant new cybersecurity threats or incidents.