Redwire Corp

Evaluation of Disclosure Controls and Procedures

We maintain disclosure controls and procedures (as defined in Rules 13a-15(e) and 15d-15(e) under the Exchange Act) that are designed to ensure that information required to be disclosed in our Exchange Act reports is recorded, processed, summarized and reported within the time periods specified in the SEC’s rules and forms, and that such information is accumulated and communicated to our management, including our principal executive officer and principal financial officer, as appropriate, to allow for timely decisions regarding required disclosure. Our management, including our Chief Executive Officer and Chief Financial Officer, does not expect that our disclosure controls and procedures or our internal control over financial reporting will prevent all errors and all fraud due to inherent limitations of internal controls. Because of such limitations, there is a risk that material misstatements will not be prevented or detected on a timely basis by internal control over financial reporting. However, these inherent limitations are known features of the financial reporting process. Therefore, it is possible to design into the process safeguards to reduce, though not eliminate, this risk. As required by Rules 13a-15(b) and 15d-15(b) under the Exchange Act, we have carried out an evaluation, under the supervision and with the participation of our management, including our principal executive officer and our principal financial officer, of the effectiveness of the design and operation of our disclosure controls and procedures. Based on such evaluation, our principal executive officer and principal financial officer concluded that, as of the end of the period covered by this report, certain of our disclosure controls and procedures were not effective as of December 31, 2025 due to the material weaknesses in internal control over financial reporting described below.

Notwithstanding such material weaknesses in our internal control over financial reporting, our management, including our principal executive officer and principal financial officer, concluded that our consolidated financial statements in this Annual Report on Form 10-K present fairly, in all material respects, our financial position, results of operations and cash flows for the periods presented, in conformity with U.S. generally accepted accounting principles.

Management’s Report on Internal Control Over Financial Reporting

Our management is responsible for establishing and maintaining adequate internal control over financial reporting (as defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act). Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions or that the degree of compliance with the policies or procedures may deteriorate. Our management, with the participation of our principal executive officer and principal financial officer, under the oversight of our Board of Directors, conducted an assessment of the effectiveness of our internal control over financial reporting as of December 31, 2025. This assessment was based on the criteria set forth by the Internal Control – Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission. Our assessment of internal control over financial reporting did not include the internal control over financial reporting for Redwire Defense Tech Intermediate Holdings, LLC (formerly known as Edge Autonomy Intermediate Holdings, LLC), which was acquired in a business combination in the second quarter of 2025. Redwire Defense Tech Intermediate Holdings, LLC’s total assets and revenues represent 10% and 32%, respectively, of the Company’s consolidated total assets and total revenues as of and for the year ended December 31, 2025. Based on this assessment, management concluded that our internal control over financial reporting was not effective as of December 31, 2025 because of the material weaknesses described below.

A material weakness is a deficiency, or combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of our annual or interim consolidated financial statements will not be prevented or detected on a timely basis.

Management identified the following material weaknesses in internal control over financial reporting as of December 31, 2025:

•For substantially all of our U.S. operations, we designed process-level control activities pervasive across our financial reporting processes, but we were unable to fully deploy those process-level control activities with sufficient time to demonstrate their operating effectiveness.

•For European and remaining U.S. operations:

◦Due to insufficient time and resources, we did not (i) establish effective information technology (“IT”) general controls (“ITGCs”), specifically program change controls and access controls, that support the consistent operation of the Company’s IT operating systems, databases and IT applications, and end user computing over all financial reporting; and, ii) have policies and procedures through which ITGCs are deployed across the organization. Automated process-level controls and manual controls dependent upon the accuracy and completeness of information derived from IT systems were also rendered ineffective because they are affected by the lack of ITGCs.

◦As a result, we did not effectively design, implement or operate process-level control activities pervasive across our financial reporting processes.

The material weaknesses above did not result in a material misstatement to the consolidated financial statements as of and for the year ended December 31, 2025. However, the control deficiencies described above created a reasonable possibility that a material misstatement to the consolidated financial statements would not be prevented or detected on a timely basis if one were to occur.

Our independent registered public accounting firm, KPMG LLP, who audited the consolidated financial statements included in this Annual Report on Form 10-K, has also audited the effectiveness of our internal control over financial reporting as of December 31, 2025, and issued an adverse opinion on the effectiveness of our internal control over financial reporting. KPMG LLP’s report appears on page 62 of this Annual Report on Form 10-K.

Material Weaknesses in Excluded Acquired Business

In the second quarter of 2025, the Company acquired Redwire Defense Tech Intermediate Holdings, LLC. Prior to the acquisition, Redwire Defense Tech Intermediate Holdings, LLC’s management identified material weaknesses in its internal control over financial reporting, due to a lack of ITGCs and effective process-level control activities similar to those identified above related to the Company’s European and certain U.S. operations. These material weaknesses continue to exist as of December 31, 2025.

These material weaknesses did not result in any material misstatements to the consolidated financial statements as of and for the year ended December 31, 2025.

Management’s Remediation Plans

Management, with oversight from the Board of Directors, continues to implement a remediation plan to address the material weaknesses. The Company made progress during 2025 in its remediation of the material weaknesses as further described below.

•For substantially all of our U.S. operations we have designed and implemented both manual and automated process-level control activities but due to insufficient time and resources, we were unable to demonstrate their operating effectiveness. We plan to do so, through testing, during 2026.

For our European and remaining U.S. operations, including Redwire Defense Tech Intermediate Holdings, LLC, we will continue our remediation efforts including:

•Implementing one enterprise resource planning (“ERP”) system for our European operations and expanding the implementation of our U.S. ERP system for our remaining U.S. operations.

•Continuing our engagement of a third-party global consulting firm to accelerate the deployment of ITGCs and manual and automated process-level controls across our financial reporting process.

•Continuing to assess the specific training needs of personnel and developing and delivering training programs designed to uphold our internal control standards.

We believe the above actions will be effective in remediating the material weaknesses described above. However, the material weaknesses cannot be considered remediated until remediated controls operate for a sufficient period of time and management has concluded, through testing, that these controls are operating effectively. Although we intend to complete the remediation of remaining processes as promptly as possible, we cannot at this time estimate how long it will take to remediate the material weaknesses described above. We may discover additional material weaknesses that require additional time and resources to remediate, and we may decide to take additional measures to address the material weaknesses or modify the remediation steps described above.

If we are unable to successfully remediate existing or any future material weaknesses in our internal control over financial reporting, the accuracy and timing of our financial reporting may be adversely affected, investors may lose confidence in our financial reporting, and/or we could become subject to litigation or investigations by the New York Stock Exchange, the SEC or other regulatory authorities.

Changes in Internal Control over Financial Reporting

The Company has made the following changes to its internal control over financial reporting during the three months ended December 31, 2025 for substantially all of our U.S. operations to remediate certain of the material weaknesses that were present as of December 31, 2024:

•Implemented a new ERP system.

•Implemented effective ITGCs, including program change controls and access controls, that support the consistent operation of the company’s IT operating systems, databases and IT applications, and end user computing over financial reporting, and ensured they will support process-level automated and manual control activities that are dependent upon information derived from IT systems.

Except for these changes, there has been no change in the Company’s internal control over financial reporting (as such term is defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act) during the quarter ended December 31, 2025, that has materially affected, or is reasonably likely to materially affect, our internal control over financial reporting.