CELU Celularity Inc

“Privileged Access: C ertain finance and accounting personnel have privileged access (also known as Super User Access) to our ERP systems, a material weakness in internal control which could result in unauthorized, inappropriate and undetected changes to financial-reporting systems.”

“Monitoring: We failed to design and implement certain monitoring activities to ascertain whether the components of internal control are present and functioning.”

“Information and Communication: We failed to design and implement certain information and communication activities related to obtaining or generating and using relevant quality information to support the functioning of internal control.”

“Control Activities: We failed to design and implement certain control activities that address relevant risks and retain sufficient evidence of the performance of control activities.”

“Risk Assessment: We failed to design and implement certain risk assessment activities related to identifying and analyzing risks to achieve objectives and identifying and assessing changes in the business that could impact our system of internal controls.”

“Control Environment : We failed to demonstrate a commitment to attract, develop, and retain competent and sufficient qualified resources with an appropriate level of knowledge, experience, and training in certain areas around our financial reporting process.”

“concluded, consistent with prior reporting periods, that these controls and procedures were not effective due to material weaknesses in internal control over financial reporting for complicated financial transactions causing the Company file quarterly and annual reports late.”

“Privileged Access: C ertain finance and accounting personnel have privileged access (also known as Super User Access) to our ERP systems, a material weakness in internal control which could result in unauthorized, inappropriate and undetected changes to financial-reporting systems.”

“Monitoring: We failed to design and implement certain monitoring activities to ascertain whether the components of internal control are present and functioning.”

“Information and Communication: We failed to design and implement certain information and communication activities related to obtaining or generating and using relevant quality information to support the functioning of internal control.”

“Control Activities: We failed to design and implement certain control activities that address relevant risks and retain sufficient evidence of the performance of control activities.”

“Risk Assessment: We failed to design and implement certain risk assessment activities related to identifying and analyzing risks to achieve objectives and identifying and assessing changes in the business that could impact our system of internal controls.”

“Control Environment : We failed to demonstrate a commitment to attract, develop, and retain competent and sufficient qualified resources with an appropriate level of knowledge, experience, and training in certain areas around our financial reporting process.”

“Management, with the participation of our Principal Executive Officer and Chief Financial Officer, evaluated the effectiveness of our disclosure controls and procedures as of June 30, 2026 and concluded, consistent with prior reporting periods, that these controls and procedures were not effective due to material weaknesses in internal control over financial reporting for complicated financial transactions causing the Company to file quarterly and annual reports late.”