DATA I/O CORP

As previously disclosed in the Company’s Annual Report on the Form 10-K for the year ended December 31, 2024, the Company identified a material weakness in our internal control over financial reporting in the areas of user access and segregation of duties related to the information technology system that support the Company’s financial reporting processes. A material weakness is a deficiency, or combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of the Company’s annual or interim financial statements will not be prevented or detected on a timely basis.

During 2025, the Company implemented enhancements to system access controls, user access provisioning and de‑provisioning controls, role‑based access restrictions, monitoring controls over privileged access, improved segregation of duties, and expanded monitoring and review procedures in efforts to address the previously identified IT user access control deficiencies. The August 2025 ransomware incident prompted additional IT infrastructure improvements that support both cybersecurity and internal control objectives. Specifically, the Company removed administrative access from all employees outside of the IT department. We instituted regular reviews of access rights across all systems, and we implemented improved segregation of duties with respect to financial transactions and reporting, Management completed testing of the design and operating effectiveness of the revised controls and procedures during 2025.

While these actions were taken to improve access management and security controls, the material weakness was not fully remediated as of December 31, 2025. A material weakness continues to exist related to ineffective user access and segregation‑of‑duties controls within IT systems that support financial reporting, Accordingly, management concluded that the conditions underlying the previously identified IT‑related material weakness remained present as of December 31, 2025. Due to this material weakness, there is a reasonable possibility that a material misstatement of the Company’s annual or interim financial statements would not be prevented or detected on a timely basis.

In addition, management determined that the Company did not maintain effective controls over the completeness and accuracy of internally generated reports used in the preparation of the disaggregated revenue footnote. The report used to compile revenue by major category was not reconciled to the general ledger, resulting in a misstatement of revenue by category in previously issued financial statements. While total revenue and other primary financial statement line items were not affected, the control deficiency resulted in a misstatement of a required disclosure that could have been material and was not detected by the Company’s internal controls.

(a) Evaluation of disclosure controls and procedures.

Under the supervision and with the participation of our management, including our Chief Executive Officer and Chief Financial Officer, we evaluated the effectiveness of the design and operation of our disclosure controls and procedures (as defined in Rule 13a-15(e) and Rule 15d-15(e) under the Exchange Act) as of the end of the period covered by this report. Based upon that evaluation, the Chief Executive Officer and Chief Financial Officer concluded that, as of the Evaluation Date, our disclosure controls and procedures were not effective due to the material weakness described below.

(b) Management’s report on internal control over financial reporting

Management is responsible for establishing and maintaining adequate internal control over financial reporting. Internal control over financial reporting is defined in Rules 13a-15(f) and 15d-15(f) under the Securities Exchange Act of 1934 as a process designed by, or under the supervision of, our principal executive and principal financial officers and effected by our Board of Directors, management and other personnel to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles. Internal control over financial reporting is defined in Rule 13a-15(f) promulgated under the Exchange Act and includes those policies and procedures that:

(i) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the Company;

(ii) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the company are being made only in accordance with authorizations of management and directors of the company; and

(iii) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use or disposition of the company’s assets that could have a material effect on the financial statements.

Management, including the Company’s Chief Executive Officer and Chief Financial Officer, does not expect that the Company’s internal controls will prevent or detect all errors and all fraud. A control system, no matter how well designed and operated, can provide only reasonable, not absolute, assurance that the objectives of the control system are met. Further, the design of a control system must reflect the fact that there are resource constraints, and the benefits of controls must be considered relative to their costs. Because of the inherent limitations in all control systems, no evaluation of internal controls can provide absolute assurance that all control issues and instances of fraud, if any, have been detected. Also, any evaluation of the effectiveness of controls in future periods is subject to the risk that those internal controls may become inadequate because of changes in business conditions, or that the degree of compliance with the policies or procedures may deteriorate.

Our management assessed the effectiveness of the Company’s internal control over financial reporting as of December 31, 2025. In making this assessment, we used the criteria set forth by the Committee of Sponsoring Organizations of the Treadway Commission (“COSO”) in Internal Control – Integrated Framework (2013). Based on this assessment our Chief Executive Officer and Chief Financial Officer have concluded that material weaknesses existed related to segregation of duties and to the completeness and accuracy of internally generated reports used in the preparation of the disaggregated revenue footnote as of December 31, 2025.

Subsequent to the identification of the material weakness, management has implemented remediation actions designed to address the underlying control deficiencies, including enhancing review procedures and increasing management oversight over financial reporting activities. These actions are intended to improve the design and operation of the Company’s internal control environment. Management believes these remediation efforts appropriately address the root causes of the material weakness; however, the material weakness will not be considered remediated until the relevant controls have operated for a sufficient period of time and management has concluded, based on testing, that the controls are operating effectively. As of December 31, 2025, remediation efforts were ongoing. .