Orthofix Medical Inc.

Risk Management and Strategy

We have implemented cybersecurity programs designed to maintain and protect our information technology systems and the confidentiality, integrity, and availability of our data. These programs serve to maintain compliance with applicable laws and regulations governing ethical business practices, including our relationships with suppliers, customers, and business partners.

We maintain formal processes for our cybersecurity program and incident response procedures, which are updated at least annually and reviewed by external legal and cybersecurity advisors. These processes include, among other things, detailed steps on how we assess cyber risks, identify threats, and determine the materiality of cyber incidents. These processes also designate certain roles within the company to execute these policies and certain leadership roles to manage material risk escalation. These processes endeavor to follow the National Institute of Standards and Technology Cybersecurity Framework and are tested at least annually.

Our Information Security team uses automated technology, third-party partners, and direct review of system indicators to monitor and implement the prevention, detection, mitigation, and remediation of cybersecurity incidents, and to stay current with the changing threat landscape. We also leverage encryption technologies and other measures to safeguard systems. We engage third parties as part of our cyber program, including external security firms that provide security technology, conduct regular security audits, and conduct penetration testing. We also engage third parties to conduct regular drills, such as tabletop exercises, to help with our overall preparedness.

We also engage third-party service providers to assist with managing various other aspects of our business. We have implemented processes designed to both assess and maintain oversight of third-party service providers with regards to cybersecurity risks. These service providers are subject to due diligence reviews of their information security programs during our vendor evaluation process.

Our employees are responsible for complying with our data security standards and are required to complete annual training to understand the behaviors and technical requirements necessary to keep data secure. We also require that cybersecurity training be part of the onboarding process for new hires.

As of December 31, 2025, we havenot had any known instances of material cybersecurity incidents, including third-party incidents, during any of the prior three fiscal years.

Governance

Cybersecurity is an important component of our enterprise risk management program. While the full Board of Directors has primary responsibility for risk oversight, the Board of Directors utilizes its committees, as appropriate, to monitor and address the risks that may be within the scope of a particular committee’s expertise or charter. The Board of Directors receives updates at quarterly board meetings on committee activities from each committee Chair.

The Audit and Finance Committee has oversight over and regularly reviews our cybersecurity, including information technology ("IT") risks, controls, procedures, and plans to mitigate cybersecurity risks and respond to security incidents. The Audit and Finance Committee receives reports on at least a quarterly basis from the Chief Information Officer and the Vice President, Information Security, on, among other issues, our cyber risks and threats, the status of projects, management’s strategies to strengthen our IT systems, assessments of our security program, third-party assessments and testing, our emerging threat landscape, and the review of our cybersecurity insurance policy. Pursuant to our incident response procedures, material cyber incidents will be reported to the Chair of the Audit and Finance Committee upon a determination of material status. Due to the importance of cybersecurity, the full Board of Directors also receives updates on cybersecurity matters from management at least annually.

Management is responsible for our company’s day-to-day risk management activities. Our cybersecurity program is led by our Chief Information Officer, who is responsible for assessing and managing cybersecurity risks. He has over 25 years of experience in both military and corporate leadership roles, including 14 years of experience in CIO-level leadership roles, including consulting with major firms, covering technology and security operations responsibility.

Our Vice President, Information Security, who reports to our Chief Information Officer, isresponsible for cybersecurity program execution, risk management, and oversight of information security staff and consultants. She has over 20 years of experience in IT roles, including 15 years in IT leadership roles and 7 years in cybersecurity program execution and oversight of information security.

Our Manager, Information Security, who reports to our Vice President, Information Security, is responsible for managing our security analyst and engineering team and is also responsible for the tactical execution of security operations. Hehas over 25 years ofexperience in IT roles including 15 years of experience in security leadership. He also has the following certifications: ISC2 CISSP, EC-Council Certified Ethical Hacker, and numerous vendor specific certifications.

As cybersecurity risks arise, our Information Security team executes the incident response procedure and communicates the appropriate details to management in alignment with the escalation steps in the procedure. In addition, our Chief Information Officer, Vice President, Information Security, and Manager, Information Security, conduct monthly cybersecurity program status reviews with the Information Security team that includes key performance indicator tracking, risk assessment, escalation actions, and project status.