Quantum Computing Inc.

Evaluation of Disclosure Controls and Procedures

We maintain “disclosure controls and procedures,” as such term is defined in Rule 13a-15(e) under the Securities Exchange Act of 1934, as amended (the “Exchange Act”). In designing and evaluating our disclosure controls and procedures, our management recognized that controls and procedures, no matter how well conceived and operated, can provide only reasonable, not absolute, assurance that the objectives of the controls are met. Management necessarily applied judgment in evaluating the cost-benefit relationship of possible controls and procedures. The design of any controls and procedures also is based in part upon certain assumptions about the likelihood of future events, and there can be no assurance that any design will succeed in achieving its stated goals under all potential future conditions.

As of the end of the period covered by this Quarterly Report on Form 10-Q, we carried out an evaluation, under the supervision and with the participation of our management, including our principal executive officer and our principal financial officer, of the effectiveness of our disclosure controls and procedures. Based on such evaluation, our principal executive officer and principal financial officer concluded that, as of September 30, 2026, our disclosure controls and procedures were not effective to provide reasonable assurance that (a) the information required to be disclosed by us in the reports that we file or submit under the Exchange Act is recorded, processed, summarized and reported within the time periods specified in the SEC’s rules and forms, and (b) such information is accumulated and communicated to our management, including our Chief Executive Officer and Chief Financial Officer, as appropriate, to allow timely decisions regarding required disclosure. The ineffectiveness of our disclosure controls and procedures was due to material weaknesses in our internal control over financial reporting described below.

Material Weakness in Internal Control over Financial Reporting

A “material weakness,” as defined in Rule 1-02(a)(4) of Regulation S-X, is a deficiency, or a combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of our annual or interim financial statements will not be prevented or detected on a timely basis.

The ineffectiveness of the Company’s internal control over financial reporting was due to the following material weaknesses:

•We did not design and maintain an effective control environment commensurate with our financial reporting requirements. During the period, we lacked a sufficient number of trained professionals with (i) an appropriate level of accounting knowledge, training and experience to appropriately analyze, record and disclose accounting matters timely and accurately, and (ii) an appropriate level of knowledge and experience to establish effective processes and controls. Additionally, limited personnel resulted in insufficient segregation of duties in our finance and accounting functions.

•The material weakness in the control environment contributed to additional material weaknesses: (i) we did not design and maintain an effective risk-assessment process at a precise enough level to identify new and evolving risks of material misstatement in our financial statements, including timely changes to existing controls or implementation of new controls to respond to changes in risk; and (ii) we did not design and maintain effective information technology general controls (“ITGCs”) for information systems that are relevant to the preparation of our financial statements. Specifically, we did not design and maintain: (a) user-access controls to ensure appropriate segregation of duties and to adequately restrict user and privileged access to financial applications, programs and data; (b) program change-management controls to ensure that IT program and data changes affecting financial IT applications and underlying accounting records are identified, tested, authorized and implemented appropriately; (c) computer-operations controls to ensure that data backups are authorized and monitored; and (d) controls to obtain, review and evaluate third-party service-organization reports and to implement complementary user-entity controls, as applicable.

These material weaknesses did not result in a material misstatement to the unaudited condensed consolidated financial statements included in this Quarterly Report on Form 10-Q. However, if not remediated, these material weaknesses could result in a material misstatement to our annual or quarterly consolidated financial statements that might not be prevented or detected on a timely basis.

Management’s Plan to Remediate the Material Weaknesses

The Company has taken steps to strengthen its internal controls over financial reporting and continues to make progress in addressing previously identified material weaknesses.

The Company has been implementing and continues to implement measures designed to remediate the material weaknesses described above and to ensure that the related controls are designed, implemented and operating effectively. During 2025, we strengthened our accounting function through the hiring of five full-time accounting professionals, including a

Controller and a Manager of Technical Accounting, to enhance oversight, technical expertise and execution of key financial reporting processes. In addition to identifying and remediating design deficiencies in our processes, we have formally documented procedures for significant accounting and financial reporting processes, including procedures addressing revenue recognition and segregation of duties. In 2026, we increased accounting and finance staff through the LSI, NuCrypt and NHanced acquisitions, hired additional purchasing staff, and hired an Accounts Payable Manager and a Manager of Financial Reporting.

During the remainder of 2026, we plan to continue to (i) further document and implement control procedures and control monitoring; (ii) identify and remediate gaps in our information-technology general controls related to security, user access, restricted access and change management; and (iii) design and implement risk-assessment processes to identify and address new and evolving risks associated with financial reporting. We are committed to maintaining a strong internal control environment and believe that these remediation efforts will represent significant improvements in our control environment. Management will continue to monitor and evaluate the effectiveness of internal control over financial reporting on an ongoing basis and will implement additional enhancements as necessary. We currently expect that these measures, once fully implemented and operational for a sufficient period of time and tested, will remediate the material weaknesses; however, the material weaknesses will not be considered remediated until the applicable controls operate for a sufficient period of time and management has concluded, through testing, that these controls are operating effectively, and we cannot assure investors that remediation will be completed by the end of 2026 or at all.

Changes in Internal Control over Financial Reporting

Except for the remediation measures described above and the ongoing integration of the internal controls of LSI, NuCrypt and NHanced into our internal control over financial reporting, there were no changes in our internal control over financial reporting (as defined in Rule 13a-15(f) and Rule 15d-15(f) under the Exchange Act) during our most recent fiscal quarter that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.