GridAI Technologies Corp.

Cybersecurity Risk Management and Strategy

We maintain a cybersecurity risk management program designed to support the confidentiality, integrity and availability of our information systems and data. Our cybersecurity program is intended to identify, assess, manage and respond to cybersecurity risks affecting our corporate systems, legacy life sciences activities and, following the acquisition of Grid AI Corp., the software-enabled energy orchestration and related digital infrastructure associated with the Grid AI and AMPX businesses.

In designing and evaluating our cybersecurity initiatives, we use the National Institute of Standards and Technology Cybersecurity Framework, or NIST CSF, as a reference point for structuring aspects of our cybersecurity risk identification, assessment and response processes. Our use of that framework is intended as a guiding tool and does not mean that we certify compliance with any particular technical standard or framework requirement.

Our cybersecurity processes areintegrated into our broader enterprise risk management activities and are intended to align with our legal, compliance, strategic, operational and financial risk oversight processes. Because our current business includes software platforms, cloud-based systems, third-party integrations, digital communications and data processing activities, cybersecurity and information security are important operational and governance considerations.

Key elements of our cybersecurity risk management program include:

Our business relies on third-party systems and services, including cloud infrastructure, software tools, communications systems, external consultants, data providers and other vendors. In addition, the Grid AI and AMPX business depends in part on integrations with third-party devices, platforms, utilities, market operators and other external systems. As a result, our cybersecurity and operational

-56-

resilience may also depend on the cybersecurity practices and controls of third parties. Although we seek to evaluate and manage these risks, third-party systems and services remain a source of potential exposure.

As of the date of this Annual Report, we have not identified any cybersecurity incident that we believe has materially affected, or is reasonably likely to materially affect, our business strategy, results of operations or financial condition. However, like other public companies and technology-enabled businesses, we face ongoing cybersecurity risks, and there can be no assurance that we will not experience a material cybersecurity incident in the future.

Cybersecurity Governance

Our Board of Directors has oversight responsibility for risk management generally, including cybersecurity risk. The Audit Committee assists the Board in its oversight of cybersecurity and related information technology and data protection risks.

Management is responsible for the day-to-day assessment and management of cybersecurity risks. Management uses internal personnel and external advisers, as appropriate, to support cybersecurity risk identification, security-related processes, incident response planning and evaluation of significant cyber-related issues. Management is also responsible for escalating significant cybersecurity matters to the Audit Committee and Board, as appropriate.

The Audit Committee receives updates from management regarding material cybersecurity risks and cybersecurity-related developments as management determines appropriate, including updates regarding significant incidents, if any, and material aspects of the Company’s cybersecurity risk management efforts. The Audit Committee then reports to the Board, as appropriate, on cybersecurity matters relevant to the Board’s oversight responsibilities.

Because our business includes software-enabled energy orchestration activities and associated digital infrastructure, our cybersecurity governance processes are intended to consider risks not only to traditional corporate information systems, but also to operational software platforms, third-party-connected environments, data handling practices and other digital elements of the Grid AI Corp. and AMPX business.