Golden Minerals Co

Risk Management and Strategy

We maintain policies and procedures designed to assess, identify and manage material risks from cybersecurity threats. Given the size and scope of our operations, our information technology systems are supported and managed primarily by third-party service providers. As a result, our cybersecurity risk management processes areintegrated into our overall risk management framework and rely in part on the security controls, monitoring practices and risk management procedures of ourthird-party IT providers.

We periodically evaluate cybersecurity risks that may affect our information systems, including risks arising from potential unauthorized access, ransomware, phishing, data compromise or other cybersecurity incidents that could adversely affect the confidentiality, integrity or availability of our systems or data. In connection with material changes to our business practices or technology environment, we assess whether such changes may alter our exposure to cybersecurity threats.

Our evaluation of cybersecurity risks includes consideration of reasonably foreseeable internal and external threats, the potential likelihood and impact of such risks, and the adequacy of safeguards maintained by us and our service providers. We rely on a combination of internal oversight and third-party service provider controls to manage cybersecurity risks, including access controls, data backup processes and monitoring practices.

To date, we have not experienced any cybersecurity incidents that have materially affected our business strategy, results of operations or financial condition. However, we cannot provide assurance that future cybersecurity incidents will not occur or have a material adverse effect.

Governance

The Board of Directors has oversight responsibility for the Company’s overall risk management process, including risks arising from cybersecurity threats. The Board monitors strategic and operational risks facing the Company, and management is responsible for identifying, assessing and managing day-to-day risks, including cybersecurity-related risks.

Management informs the Board of cybersecurity matters as appropriate, including if a cybersecurity threat or incident is identified that could materially affect the Company’s business, financial condition or operations. While the Board does not receive scheduled periodic cybersecurity briefings, it is apprised of material developments or significant cybersecurity matters as they arise.

Management is responsible for overseeing cybersecurity risk management activities. Given the size and scope of our operations and our reliance on third-party information technology service providers, cybersecurity oversight is integrated into our broader operational and risk management processes. Management monitors potential cybersecurity risks, evaluates safeguards maintained by the Company and its service providers, and addresses cybersecurity matters as part of routine operational oversight.

We havenot experienced any cybersecurity incidents that have materially affected the Company. However, cybersecurity threats are continually evolving, and we cannot provide assurance that future incidents will not have a material adverse effect on our business, financial condition or results of operations.

Cybersecurity Threats

As of December 31, 2025, we have not identified any indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements. For further discussion of cybersecurity risks, please refer toItem 1A. Risk Factors.