LITHIUM AMERICAS CORP.

Cybersecurity Risk Management and Strategy

The Company operates across a complex and interconnected digital landscape and recognizes the ongoing need to identify, assess and manage material risks associated with information technology (“IT”) assets and operations. As part of the Company’s business operations, it may collect and store sensitive information, including proprietary and confidential business data, intellectual property, third-party information, employee details and other personal information. To store and process this information, and to maintain key business processes such as inventory management, payment processing, cash collection, human capital management, financial operations and other essential procedures, the Company relies on both its internal and third-party information systems. The effective management of the Company’s business depends on the reliability, security and capacity of these systems.

To mitigate these risks, the Company has developed a risk and compliance policy and technology-specific cybersecurity standard intended to protect the confidentiality, integrity and availability of the Company’s critical systems and information. The Company relies on known frameworks and incorporates controls from National Institute of Standards and Technology (“NIST”), Center for Internet Security (“CIS”) and Control Objectives for Information Technologies (“COBIT”) within its policies and standards. The Company has also retained a third-party that provides a security operations center service, as well as a separate third-party that provides cybersecurity advisory services and manages its cybersecurity awareness program. The Company recognizes that third-party service providers may introduce cybersecurity risks. In an effort to mitigate these risks, the Company has established separate processes and procedures to oversee and identify cybersecurity risks associated with its use of third-party service providers. Before contracting with certain technology service providers, when possible, the Company conducts due diligence to evaluate their cybersecurity capabilities. Additionally, the Company endeavors to include cybersecurity requirements in its contracts with these providers and endeavors to require them to adhere to security standards and protocols. Further, the Company also endeavors to engage with any third-party service providers with access to personally identifiable employee information to evaluate their security controls.

The Company’s risk management processes areinte grated into the Company’s overall enterprise risk management system. The overarching cybersecurity program is aligned to the Company’s business strategy and shares common methodologies, reporting channels and governance processes that apply to other areas of enterprise risk, including legal, compliance, strategic, operational and financial risk.

Key elements of the Company's cybersecurity risk management program include:

•

annual risk assessments designed to help identify material cybersecurity risks to the Company's critical systems, information, products, services and broader enterprise IT environment;

•

designation of resources responsible for managing the Company's cybersecurity risk assessment processes, security controls and response to cybersecurity incidents;

•

the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of security controls;

•

monthly training and awareness programs for team members that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and controls;

•

a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and

•

implementation of technical security controls including identity and access management, network monitoring and logging, endpoint protection, and regular penetration testing and vulnerability assessments.

As of the date of this Annual Report, though the Company and the third parties with whom it does business have experienced certain cybersecurity incidents, the Company is not aware of cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business, financial condition or results of operations. However, the Company recognizes that cybersecurity threats are constantly evolving, and the potential for future cybersecurity incidents persists. The Company’s VP, Information Technology, supported by the IT Security Department, is dedicated to monitoring and assessing these risks to ensure the security and continuity of operations. Despite the implementation of robust cybersecurity programs, no security measures can entirely eliminate the risk of a significant cyberattack. A successful breach of the Company’s IT systems could have substantial consequences for its business. While the Company allocates considerable resources to safeguard its systems and information, these efforts cannot guarantee complete protection. For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition, refer to Part I -Item 1A: Risks Related to the Company’s Business and Securities - Increased reliance on digital technologies and new information systems to support the growing business could increase costs and cybersecurity related threats.

Cybersecurity Governance

The Audit and Risk (“A&R”) Committee of the Board has specific responsibility for overseeing cybersecurity threats, among other things. The Company's Chief Financial Officer (“CFO”) provides the A&R Committee periodic reports on the Company’s cybersecurity risks and any material cybersecurity incidents, and the Board also receives quarterly cybersecurity reports.

With regards to cybersecurity risk assessment and management, from January 2025 to June 2025, the Company’s Senior Technology Specialist reported to the Company’s Senior Vice President, Finance and Administration (who reported to the CFO). In June 2025, the Company hired a VP, Information Technology, who reports to the CFO, to support the Company’s growth as we scale-up to major construction at Thacker Pass, and subsequently into operations. The VP, IT is ultimately responsible for assessing and managing the Company’s material risks from the cybersecurity threats and is supported by the IT Security Department. The VP, IT brings over 20 years of extensive expertise in IT and has a proven track record of delivering transformative digital strategies that align technology with business and operational goals. He has consistently driven digital innovation, optimized multimillion-dollar technology portfolios and led complex organizational change through periods of significant growth. Specific to cybersecurity, the VP, IT has experience in securing both IT and operational technology systems and assets across several industries.

The IT Security Department, in conjunction with third party security operations, and cybersecurity services, monitors the prevention, detection, mitigation and remediation of cybersecurity risks and incidents through various means, which may include threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged, and alerts and reports produced by security tools deployed in the IT environment.