HERSHEY CO

Evaluation of Disclosure Controls and Procedures

The Company’s management, with the participation of the Company’s Chief Executive Officer and Chief Financial Officer, has evaluated the effectiveness of the Company’s disclosure controls and procedures, as defined in Rules 13a-15(e) and 15d-15(e) of the Securities Exchange Act of 1934 (the “Exchange Act”), as of December 31, 2025. Based on that evaluation, the Company’s Chief Executive Officer and Chief Financial Officer concluded that the Company’s disclosure controls and procedures were effective as of December 31, 2025.

Design and Evaluation of Disclosure Controls and Procedures

Disclosure controls and procedures are controls and other procedures that are designed to ensure that information required to be disclosed in the Company’s reports filed or submitted under the Exchange Act is recorded, processed, summarized and reported within the time periods specified in the Securities and Exchange Commission’s rules and forms. Disclosure controls and procedures include, without limitation, controls and procedures designed to ensure that information required to be disclosed in the Company’s reports filed under the Exchange Act is accumulated and communicated to management, including the Company’s Chief Executive Officer and Chief Financial Officer, as appropriate, to allow timely decisions regarding required disclosure.

Changes in Internal Control Over Financial Reporting

Management’s report on the Company’s internal control over financial reporting appears on the following page. There have been no changes to the Company’s internal control over financial reporting during the fourth quarter of 2025 that have materially affected, or are reasonably likely to materially affect, the Company’s internal control over financial reporting.

MANAGEMENT’S ANNUAL REPORT ON INTERNAL CONTROL OVER FINANCIAL REPORTING

The management of The Hershey Company is responsible for establishing and maintaining adequate internal control over financial reporting, as such term is defined in Exchange Act Rule 13a-15(f). The Company’s internal control system was designed to provide reasonable assurance to the Company’s management and Board of Directors regarding the preparation and fair presentation of published financial statements.

All internal control systems, no matter how well designed, have inherent limitations. Therefore, even those systems determined to be effective can provide only reasonable assurance with respect to financial statement preparation and presentation.

The Company’s management, including the Company’s Chief Executive Officer and Chief Financial Officer, assessed the effectiveness of the Company’s internal control over financial reporting as of December 31, 2025. In making this assessment, the Company’s management used the criteria set forth by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) in Internal Control–Integrated Framework (2013 edition). Based on this assessment, management concluded that, as of December 31, 2025, the Company’s internal control over financial reporting was effective based on those criteria.

Management’s assessment of and conclusion on the effectiveness of internal control over financial reporting did not include the internal controls of LesserEvil, LLC (“LesserEvil”), which was acquired on November 18, 2025, and is included in the 2025 consolidated financial statements of the Company and constituted 7.3% of total assets as of December 31, 2025 and less than 1% of net sales for the year then ended. This exclusion is in accordance with the guidance issued by the U.S. Securities and Exchange Commission that allows companies to exclude acquisitions from management’s report on internal control over financial reporting for the first year after the acquisition.

The Company’s independent auditors have audited, and reported on, the Company’s internal control over financial reporting as of December 31, 2025, which is included in Item 8 of this report and is incorporated by reference herein.