CD Projekt — Governance Information 2026

May 27, 2026

CD PROJEKT S.A.

Supervisory Board Report
for 2025

---

2

Disclaimer

This English language translation has been prepared solely for the convenience of English speaking readers. Despite all the efforts devoted to this translation, certain discrepancies, omissions or approximations may exist. In case of any differences between the Polish and the English versions, the Polish version shall prevail. CD PROJEKT S.A., its representatives and employees decline all responsibility in this regard.

---

ASSESSMENTS PERFORMED BY THE SUPERVISORY BOARD

ASSESSMENT OF THE FINANCIAL STATEMENT OF CD PROJEKT S.A. FOR THE PERIOD BETWEEN 1 JANUARY 2025 AND 31 DECEMBER 2025

The Supervisory Board of CD PROJEKT S.A. with a registered office in Warsaw (the "Company") (the "Supervisory Board"), in its resolution adopted on 4 July 2024 concerning selection of an audit form to perform audits of financial statements and attestation of sustainability disclosures, among others selected Grant Thornton Polska PSA with a registered office in Poznań as the audit firm contracted to perform an audit of the financial statement of the Company for the period between 1 January 2025 and 31 December 2025 (the "Licenced Auditor").

This year's audit concerned the financial statement covering the period between 1 January 2025 and 31 December 2026, prepared on 18 March 2026.

The Supervisory Board familiarized itself with the audit report prepared by a Licensed Auditor, and furthermore on 19 March 2026 held a meeting during which a representative of the Licensed Auditor presented the audit report, including an assessment of the basis for its statement concerning the Company's ability to carry on with its activities, and replied to inquiries from Members of the Supervisory Board.

On 18 March 2026 the Licensed Auditor issued an opinion declaring that the relevant financial statement of the Company for the period between 1 January 2025 and 31 December 2025, comprising numerical data and supplementary information:

• presents a truthful and clear description of the material and financial standing of the Company as of 31 December 2025, along with its financial results and cash flows for the financial year ending on that date, in line with the International Accounting Standards, International Financial Reporting Standards, interpretations associated therewith as published in the relevant European Commission regulations, as well as the adopted accounting practices,
• is based on properly maintained accounting records,
• is formally and materially consistent with the legal requirements applicable to the Company as well as its Articles of Association.

The abovementioned opinion is consistent with the supplementary report provided to the Audit Committee on 18 March 2026 by the Licenced Auditor.

The abovementioned outcome of the audit formed the basis for the Supervisory Board assessment of the Financial Statement of the Company for the period between 1 January 2025 and 31 December 2025, in which the Supervisory Board declares that the Financial Statement of the Company is materially consistent with existing accounts and documents, as well as factually correct, and that the financial data contained therein is truthful and accurate, and that it was prepared and presented in line with the applicable statutory requirements, and that, consequently, the Supervisory Board recommends that the General Meeting approve the said financial statement.

ASSESSMENT OF THE CONSOLIDATED FINANCIAL STATEMENT OF THE CD PROJEKT GROUP FOR THE PERIOD BETWEEN 1 JANUARY 2025 AND 31 DECEMBER 2025

The Supervisory Board in its resolution adopted on 4 July 2024 concerning selection of an audit form to perform audits of financial statements and attestation of sustainability disclosures, among others selected the Licensed Auditor as the audit firm contracted to perform an audit of the consolidated financial statement of the CD PROJEKT Group for the period between 1 January 2025 and 31 December 2025.

This year's audit concerned the consolidated financial statement of the CD PROJEKT Capital Group covering the period between 1 January 2025 and 31 December 2025, prepared on 18 March 2026.

---

The Supervisory Board familiarized itself with the audit report prepared by a Licensed Auditor, and furthermore held a meeting on 19 March 2026 during which a representative of the Licensed Auditor presented the audit report, including an assessment of the basis for its statement concerning the Company's ability to carry on with its activities, and replied to inquiries from Members of the Supervisory Board.

On 18 March 2026 the Licensed Auditor issued an opinion declaring that the relevant consolidated financial statement of the CD PROJEKT Capital Group for the period between 1 January 2025 and 31 December 2025, comprising numerical data and supplementary information:

• presents a truthful and clear description of the material and financial standing of the CD PROJEKT Capital Group as of 31 December 2025, along with its financial results and cash flows for the financial year ending on that date, in line with the International Accounting Standards, International Financial Reporting Standards, interpretations associated therewith as published in the relevant European Commission regulations, as well as the adopted accounting practices,
• is formally and materially consistent with the legal requirements applicable to the CD PROJEKT Capital Group as well as the Company's Articles of Association.

The abovementioned opinion is consistent with the supplementary report provided to the Audit Committee on 18 March 2026 by the Licensed Auditor.

The abovementioned outcome of the audit formed the basis for the Supervisory Board assessment of the Consolidated Financial Statement of the CD PROJEKT Capital Group for the period between 1 January 2025 and 31 December 2025, in which the Supervisory Board declares that the aforementioned statement is materially consistent with existing accounts and documents, as well as factually correct, and that the financial data contained therein is truthful and accurate, and that it was prepared and presented in line with the applicable statutory requirements, and that, consequently, the Supervisory Board recommends that the General Meeting approve the said financial statement.

ASSESSMENT OF THE MANAGEMENT BOARD REPORT ON CD PROJEKT GROUP ACTIVITIES FOR THE PERIOD BETWEEN 1 JANUARY 2025 AND 31 DECEMBER 2025

The Supervisory Board, in its resolution adopted on 4 July 2024 concerning selection of an audit form to perform audits of financial statements and attestation of sustainability disclosures, selected the Licensed Auditor as the audit firm contracted to also perform attestation of the sustainability reporting for the period between 1 January 2025 and 31 December 2025.

In its assessment of the Management Board report on CD PROJEKT Group activities for the period between 1 January and 31 December 2025, which includes the CD PROJEKT Group's sustainability reporting, the Supervisory Board took into account documentation prepared by the Licensed Auditor. In particular, the Supervisory Board took into account the Licensed Auditor's attestation report concerning sustainability reporting contained in the Management Board report on CD PROJEKT Group activities for the period between 1 January and 31 December 2025.

The Supervisory Board concluded that the aforementioned report is consistent with the available accounting records and documents, as well as being factually correct, and that it provides the required synthetic information concerning the activities of the Company and the CD PROJEKT Group in 2025.

Moreover, in the course of attestation procedures and based on the available evidence, the Licensed Auditor did not identify any circumstances which would indicate that:

• the sustainability reporting of the CD PROJEKT Group are not consistent, in all material aspects, with the requirements arising under Section 6c of the Accounting Act of 29 September 1994 (the "Accounting Act"), including with the European Sustainability Reporting Standards ("ESRS"),
• the materiality assessment carried out by the CD PROJEKT Group in order to identify information to be included in its sustainability disclosures (the "Materiality Assessment") is not consistent, in all material aspects, with ESRS,
• the sustainability disclosures of the CD PROJEKT Group are not consistent, in all material aspects, with the requirements arising under Art. 8 of the Regulation (EU) 2020/852 of the European Parliament and of the Council of 18 June 2020 on the establishment of a framework to facilitate sustainable investment, and amending Regulation (EU) 2019/2088.

---

The Supervisory Board recommends that the General Meeting of the Company approve the Management Board report on CD PROJEKT Group activities which contains the CD PROJEKT Group's sustainability reporting for the financial year ending on 31 December 2025.

ASSESSMENT OF THE RECOMMENDATION OF THE MANAGEMENT BOARD OF CD PROJEKT S.A. CONCERNING ALLOCATION OF NET PROFIT FOR 2025

In the resolution no. 13/2026 of 26 May 2026, having performed an assessment of the Financial Statement of the Company for the period between 1 January 2025 and 31 December 2025 and the Management Board's recommendation concerning allocation of net profit for 2025, expressed in the resolution of the Management Board no. 11/2026 of 20 May 2026 on the adoption and on submission of a recommendation to the Supervisory Board and the Ordinary General Meeting of a motion regarding the allocation of the net profit for 2025, gives a positive assessment of the Management Board recommendation and recommends to the next Ordinary General Meeting that the Company's net profit for 2025 in the amount of PLN 635,208,677.41, decreased by the amount of PLN 25,739,304.00 constituting the negative value of the retained earnings/(accumulated losses) from previous years, that is the amount of PLN 609,469,373.41 in such a way to transfer this entire amount to the reserve capital of the Company.

REPORT ON SUPERVISORY BOARD ACTIVITIES IN 2025

I. INTRODUCTION

In the course of discharging its obligations stemming from the Code of Commercial Companies ("CCC"), Best Practices for WSE Listed Companies, 2021 edition, as annexed to Resolution no. 13/1834/2021 of the Supervisory Board of the Warsaw Stock Exchange of 29 March 2021, ("BP2021"), the Company Articles and the Company Supervisory Board Regulations, the Supervisory Board of the Company hereby submits to the Ordinary General Meeting the Supervisory Board Report for the period between 1 January 2025 and 31 December 2025 (principle 2.11 of BP2021), including:

• information regarding the composition of the Supervisory Board and its committees, including the independence of members of the Supervisory Board, along with information regarding the composition of the Supervisory Board in the context of diversity (principle 2.11.1 of BP2021),
• summary of the activities of the Supervisory Board and its committees (principle 2.11.2 of BP2021),
• consolidated assessment of the condition of the Company, along with its internal control, risk management, compliance and internal audit systems (principle 2.11.3 of BP2021; Art. 382 §3¹ of CCC),
• assessment of the observance, by the Company, of corporate governance policies and discharge of disclosure obligations related thereto, as specified in the Stock Exchange Regulations and regulations concerning current and periodic disclosures required from issuers of securities (principle 2.11.4 of BP2021).
• assessment of expenditures incurred by the Company and the CD PROJEKT Group in the context of supporting culture, sports, charities, media, NGOs and trade unions (principle 2.11.5 of BP2021),
• assessment of the observance, by the Company, of corporate governance policies and discharge of disclosure obligations related thereto, as specified in the Stock Exchange Regulations and regulations concerning current and periodic disclosures required from issuers of securities (principle 2.11.4 of BP2021),
• assessment of the degree of implementation of the diversity policy with regard to the Management Board and the Supervisory Board (principle 2.11.6 of BP2021),
• assessment of the discharge, by the Management Board, of duties specified in Art. 380¹ of CCC; assessment of the means by which the Management Board prepares or submits to the Supervisory Board information, documentation, reports and clarification sought in accordance with Art. 382 § 4 of CCC; information on the total remuneration payable by the Company in association with audits commissioned by the Supervisory Board during the given financial year, as specified in Art. 382¹ of the CCC (Art. 382 § 3¹ of CCC),

II. COMPOSITION OF THE SUPERVISORY BOARD IN 2025

Between 1 January 2025 and 31 December 2025 the following persons held membership of the Supervisory Board:

---

Marcin Iwinski - Co-Chair of the Supervisory Board

Key competences and areas of experience:

Familiarity with the game dev industry | Management | Strategy

Marketing and distribution | International markets | Communication and PR

Adam Kicinski - Co-Chair of the Supervisory Board, Member of the Audit Committee

Key competences and areas of experience:

Familiarity with the game dev industry | Management | Strategy

Marketing and distribution | Technology and IT | Human talent management

David Gardner - Deputy Chair of the Supervisory Board, independent Member of the Supervisory Board*

Key competences and areas of experience:

Familiarity with the game dev industry | International entrepreneurship | Venture Capital

Strategic growth and expansion | Digital content and MMOs | Restructuring of enterprises

Agnieszka Słomka-Golebiowska - Chair of the Audit Committee, independent Member of the Supervisory Board

Key competences and areas of experience:

Corporate management and development | International entrepreneurship

Corporate governance | Sustainable development | Finance | Emerging technologies

Beata Cichocka-Tylman - Member of the Audit Committee, independent Member of the Supervisory Board

Key competences and areas of experience:

Familiarity with the game dev industry | Innovation | Finance

R&D activities, particularly in the context of IT, public aid, enterprise development and finance

In 2025 three members of the Supervisory Board: Agnieszka Słomka-Golebiowska, Beata Cichocka-Tylman and David Gardner fulfilled independence criteria specified in the Act of 11 May 2017 on licensed auditors, audit firms and public supervision (the "Act"), and had no actual and material links to any shareholder controlling at least $5\%$ of votes in the Company.

During 2025 the composition of the Supervisory Board included two women.

Changes in the composition of the Supervisory Board during the financial year and up until the preparation date of this Report

On 1 January 2025 a new joint four-year term of the Supervisory Board of the Company commenced, with the Board consisting of: Marcin Iwinski, Beata Cichocka-Tylman, David Gardner, Adam Kicinski and Agnieszka Słomka-Golebiowska.

On 8 January 2025, at the first meeting of the new Supervisory Board:

• Mr. Adam Kicinski and Mr. Marcin Iwinski were appointed Chairpersons of the Supervisory Board for the new term; consequently, under § 18 section 1 of the Company Articles, they will share the title of Co-Chair of the Supervisory Board;
  Mr. David Gardner was appointed Deputy Chair of the Supervisory Board.

III. SCOPE OF ACTIVITIES OF THE SUPERVISORY BOARD DURING THE REPORTING PERIOD, INCLUDING DISCHARGE OF DUTIES OF THE AUDIT COMMITTEE

---

7

Assessment of the Supervisory Board's activities in 2025

In the course of discharging its legal and statutory obligations in 2025 the Supervisory Board conducted active oversight of all matters related to Company activities. In particular, the Supervisory Board performed analyses of the Management Board's plans concerning the strategy of the Company and the CD PROJEKT Group, and provided ongoing assessment of the Company's operating and financial status.

In 2025 the Supervisory Board properly discharged all duties incumbent upon the supervisory board of a public company under the relevant legislation, the Articles of Association of the Company and the Supervisory Board Regulations.

The Supervisory Board held five meetings in 2025. Additionally, the Supervisory Board conducted its affairs during ongoing working meetings between members of the Supervisory Board and Company representatives, as well as by adopting resolutions outside of meetings. In total, the Supervisory Board adopted thirty resolutions in 2025.

In line with its prerogatives, in 2025 the Supervisory Board furthermore observed a significant portion of BP2021 insofar as such practices apply to supervisory boards of public companies.

In 2025 the supervisory activities of the Supervisory Board were exercised on an ongoing basis and with due diligence. The Supervisory Board carefully monitored all matters related to the Company's activities. The Supervisory Board remained in contact with the Management Board in relation to the information regarding the legal condition of the Company and activities undertaken in the Company's key activity areas.

In discharging its supervisory duties, the Supervisory Board relied on written documentation submitted by the Management Board as well as current information and explanations provided by Board Members during Supervisory Board meetings. As a rule, Supervisory Board meetings were attended by a representative of the Management Board.

The Supervisory Board also discharged its duties using remote communication tools.

In the Supervisory Board's opinion it discharged its duties dutifully in 2025, fulfilling its legal and statutory obligations. In the Supervisory Board's opinion its activities should be regarded as ensuring proper supervision of the Company. Consequently, the Supervisory Board hereby applies to the General Meeting of the Company to grant Members of the Supervisory Board who had held membership thereof between 1 January 2025 and 31 December 2025 discharge on the execution of their respective duties.

Assessment of the Audit Committee's activities in 2025 and changes in the composition of the Audit Committee during the financial year and up until the preparation date of this Report

On 8 January 2025, at the first meeting of the Supervisory Board for the new term, a new composition of the Audit Committee has been elected:

Agnieszka
Słomka-Gołębiowska
CHAIR OF THE AUDIT
COMMITTEE

Adam
Kiciński
MEMBER OF THE AUDIT
COMMITTEE

Beata
Cichocka-Tylman
MEMBER OF THE AUDIT
COMMITTEE

Agnieszka Słomka-Gołębiowska – Chair of the Audit Committee

• meets the independence criteria specified in Art. 129 section 3 of the Act,

---

• meets the criterion specified in Art. 129 section 1 of the Act, i.e. possessing knowledge and skills in the area of accounting or auditing financial statements, gained in the course of higher education and professional experience.

Adam Kiciński – Member of the Audit Committee

• meets the criteria specified in Art. 129 section 5 of the Act, i.e. possessing knowledge and skills related to the Company's main business segment, gained during his employment at the Company, and in particular during his tenure as Member of the Management Board of the Company.

Beata Cichocka-Tylman – Member of the Audit Committee

• meets the independence criteria specified in Art. 129 section 3 of the Act,
• meets the criterion specified in Art. 129 section 1 of the Act, i.e. possessing knowledge and skills in the area of accounting or auditing financial statements, gained in the course of gaining professional experience,
• meets the criteria specified in Art. 129 section 5 of the Act, i.e. possessing knowledge and skills related to the Company's main business segment, gained in the course of professional experience at other companies.

The composition of the Audit Committee remained unchanged as of the date of this Report.

The Audit Committee held five meetings during the reporting period. Additionally, the Audit Committee performed its work outside of meetings. In the course of discharging its duties, the Audit Committee, among others, monitored the financial reporting, sustainability reporting and financial audit activities, i.a. by analyzing the Company's periodic financial statements prior to their publication and organizing periodic meetings with auditors.

On November 24, 2025, the Audit Committee adopted a new, updated version of Policy for selecting and rotating the audit firm authorized to perform audits of financial statements and provide permissible services other than audits at the CD PROJEKT Group.

In the Supervisory Board's opinion the Audit Committee discharged its duties dutifully in 2025, fulfilling its legal and statutory obligations. In the Supervisory Board's opinion its activities should be regarded as ensuring proper supervision of the Company.

IV. SUMMARY ASSESSMENT OF THE COMPANY'S CONDITION, INCLUDING ITS INTERNAL CONTROL SYSTEM, RISK MANAGEMENT, COMPLIANCE AND INTERNAL AUDIT MECHANISMS

Based on analysis of the financial statement of the Company for the year 2025, the consolidated financial statement of the CD PROJEKT Group for 2025, the Management Board report on CD PROJEKT Group activities for 2025 and the Management Board report on internal control, risk management, compliance and internal audit systems at the Company in 2025, in addition to information received directly from the Management Board, the Supervisory Board concludes that the Company's condition is stable.

Despite the lack of major new releases, the CD PROJEKT Group generated a consolidated net profit of PLN 594,708 thousand in 2025. Moreover, throughout 2025, the Group invested 514,241 thousand as expenditure on development projects related to new projects and allocated 99,911 thousand to be distributed as dividend. The total amount of financial reserves of the Group (understood as the sum of cash, bank deposits and treasury bonds) amounted to 1,324,910 thousand as of 31 December 2025.

The Company is working intensively on new projects and products that should be a source of revenue in the future. In 2025 development activities were carried out mainly in the framework of the following announced projects:

• The Witcher 4 – the first instalment in the upcoming Witcher trilogy;
• Cyberpunk 2 (formerly codenamed Orion) – the second game set in the Cyberpunk universe;
• Project Sirius – an online multiplayer game set in The Witcher universe;
• Cyberpunk: Edgerunners 2 – a new installment in the cult anime series co-developed with the Japanese Studio TRIGGER and expected to launch on the Netflix platform;
• Cyberpunk 2077: Ultimate Edition – dedicated Nintendo Switch 2 release, completed and released on 5 June 2025;
• Cyberpunk 2077: Ultimate Edition – dedicated MacOS release for devices equipped with Apple Silicon hardware – completed and released on 17 July 2025.

---

In line with the foregoing, the Supervisory Board hereby expresses a positive assessment of the Company's condition, including the adequacy and effectiveness of its internal control systems, risk management, legal regulations and internal regulations, compliance with applicable norms and regulations, and internal audit mechanisms The Company has not established a separate internal audit function. Tasks related to monitoring control mechanisms and risks are carried out within the management and supervisory functions.).

The Supervisory Board, assessing the condition of the Company in 2025, analyzed key risks faced by the Company and did not identify any circumstances which would jeopardize continuation of the Company's activities.

Internal control and risk management systems at the Company are fully controlled by the Management Board, which, including the identification, monitoring, and assessment of risks material to the Company's operations.

a) INTERNAL CONTROL SYSTEM

The Company has an internal control system in place designed to ensure the effectiveness of its operations, the reliability of its financial and non-financial reporting, and compliance with applicable laws.

The Management Board takes part in daily business activities at the Company and remains in contact with persons charged with managing the Company's subsidiaries. Control activities are rooted in internal regulations (including policies, procedures and manuals) which specify the duties and responsibilities of each member of the team, thereby mitigating the risk of errors in each activity area of the Company. The internal policies and selected processes being implemented are communicated and made available on the Company's intranet.

IT systems constitute an integral part of internal control, supporting operational, financial, and reporting processes. Controls in this area ensure system continuity as well as the security, integrity, and availability of data, thereby supporting the reliability of reporting and regulatory compliance.

The foundation of the IT financial environment is the Microsoft Dynamics 365 Finance & Operations ERP system (implemented in 2025), supported by Cognos, Plus Workflow, Tagetik, enova365, and TrimTab systems. The appropriate business teams are responsible for the quality and consistency of information processed within IT systems. Responsibility for information security within the CD PROJEKT Group lies with the IT & Security Department, in particular the dedicated Cybersecurity team operating within it. The standards governing these areas are defined by the Information Security Policy of the CD PROJEKT Group and the procedures established under this policy.

The Finance Department, Accounting Department, Legal Department, Tax Department, and IT & Security Department all play significant roles in carrying out control responsibilities.

Accounting and finance control

Financial control is exercised by the Finance Department (including the Financial Controlling team), while the Accounting Department is responsible for maintaining the accounting books as well as for the verification and recording of documents. A document may be recorded in the accounting books only after substantive and formal verification and approval by authorized persons within the electronic document workflow system.

Payments are executed by specialized functions (Treasury, Employment & Payroll) in cooperation with the relevant teams, exclusively on the basis of documents recorded in the accounting books and the HR and payroll system. Any deviations from the established rules require approval by a Member of the Management Board or a Proxy (Prokurent) in each case.

The Company applies an inventory instruction that defines the rules for the preparation, conduct, valuation, and settlement of inventories of assets and liabilities, as well as other receivables and contingent liabilities not recorded in the accounting books. This instruction has been developed in accordance with the provisions of the Accounting Act.

Financial and sustainability reporting

The Company's reporting processes include the preparation of financial statements (both the Company's own reports and the consolidated reports) as well as non-financial reports, including sustainability reporting.

---

Annual financial statements are subject to audit by an independent statutory auditor (in the case of interim reports for the first half of the year, a review), while sustainability reporting is subject to assurance. These processes are carried out in accordance with applicable laws and the Company's internal regulations, in particular:

• the Act,
• the Accounting Act,
• the Policy for selecting and rotating the audit firm authorized to perform audits of financial statements and provide permissible services other than audits at the CD PROJEKT Group,
• the Accounting Policy of CD PROJEKT S.A.

The latest update to the Accounting Policy was introduced by Resolution No. 25/2025 of the Company's Management Board dated 12 August 2025 and included amendments related to the implementation of a new accounting system.

The Company's annual financial statements and the consolidated financial statements of the CD PROJEKT Capital Group are prepared in accordance with the International Financial Reporting Standards (IFRS), the Accounting Act, and the Accounting Policy of the Company. The reporting process is based on the cooperation of specialized teams responsible for individual data areas. Data is verified by the relevant business teams and subsequently approved within the reporting process. A key role in this process is played by the Accounting Department, which is responsible for maintaining the accounting books, recording economic events, and preparing statutory reports. The reliability of data is ensured through the application of appropriate control procedures and the assignment of responsibilities to relevant organizational functions.

Oversight of the proper conduct of the financial statement preparation process is exercised by the Member of the Management Board (CFO), and the Chief Accountant of the Company.

Responsibility for the preparation of non-financial reports, including sustainability reporting, lies with the Investor Relations Department (including the ESG Team). Oversight of this process is exercised by the Member of the Management Board (CFO). The reporting covers the Company and its subsidiaries included in consolidation. The sustainability reporting process includes the identification of material topics for the CD PROJEKT Group, conducted in accordance with the double materiality principle defined in the ESRS standards. The Company has established an ESG Management Group composed of VP-level executives and directors responsible for areas identified as material. Members of this Group are responsible for collecting and verifying sustainability data, including data from subsidiaries, which is then provided to the ESG Team for annual reporting purposes.

The content of the sustainability report is verified by members of the ESG Management Group in line with their areas of competence, with the involvement of the Chief Compliance Officer and the VP of Investor Relations, as well as with the support of the Legal Department. The final version of the reports is approved by the VP of Investor Relations and the Member of the Management Board (CFO).

b) RISK MANAGEMENT

Risk management within the CD PROJEKT Group is conducted based on the adopted Risk Management Procedure, which covers the identification, assessment, and monitoring of strategic, operational, and financial risks.

The following participants are involved in the risk management process:

• Risk Owners, i.e. individuals holding director-level positions who have the authority to manage risks within specific areas,
• Risk Custodians, i.e. individuals designated by Risk Owners and responsible for the ongoing monitoring of risks.

Each risk is analyzed primarily in terms of potential threats and, where justified, also in terms of related opportunities. The methodology applied within the CD PROJEKT Group is integrated and operational in nature. In addition to risk assessment based on probability and impact, including the determination of risk exposure levels, the Company uses measurable Key Risk Indicators (KRIs). KRIs are directly linked to data across individual areas. They enable ongoing risk monitoring based on current operational data, giving the process a forward-looking character and allowing, among other things, for the earlier identification of adverse trends.

10

---

In 2025, the risk management system at the Company operated in a manner that ensured effective identification, assessment, and monitoring of key risks related to the CD PROJEKT Group activities. As part of the process:

• the Company did not identify any risks exceeding the adopted risk tolerance level,
• the risk profile remained stable, while selected areas with higher dynamics of change were subject to ongoing monitoring,
• risk mitigation measures were appropriate to the nature of the specific risks.

The greatest focus was placed on strategic risks related to project execution, team management, and the market environment.

c) COMPLIANCE

The compliance management system in place at the Company is structured and continuous in nature and is based on the Deming cycle (Plan-Do-Check-Act). The system is designed to ensure compliance with applicable laws and supervisory authority guidelines, market standards (including WSE regulations), and the BP2021.

Oversight of the compliance area is exercised by the Chief Compliance Officer, supported by the Privacy & Compliance team, which ensures a consistent approach and provides substantive support. At the same time, responsibility for compliance with regulatory requirements remains decentralized and embedded within individual areas of the Company's operations, with significant involvement of specialized teams, in particular the Legal, Tax, HR, ESG, and Cybersecurity departments.

The Company conducts ongoing monitoring of regulatory changes, covering both legal regulations and the activities of supervisory authorities, using internal analyses, support from external advisors, and participation in industry initiatives. Key information in this area is systematically communicated to the relevant teams, supporting operational decision-making.

The Company's operations are conducted in accordance with the Rules of the Game: Business and ethics standards at the CD PROJEKT Group, which define the Company's approach to, among other things, respect for human rights, protection of privacy, compliance with laws and ethical standards, and the prevention of irregularities. During the reporting period, no cases of discrimination or violations of human rights, including forced or child labor, were identified. No incidents of corruption or sanctions for breaches of applicable regulations in this area were recorded.

An important element of the compliance system consists of internal regulations (policies, procedures, rules, and instructions), which support the lawful functioning of the organization, limit operational risk, and ensure transparency of operating principles. Responsibility for their development and updates lies with the Privacy & Compliance team, and their availability is ensured through internal communication tools.

The misconduct prevention system (SpeakUp!) comprises a set of regulations enabling the reporting of legal violations, breaches of ethical standards, and inappropriate behavior in the workplace, forming an integral part of the Company's compliance system. As part of this system, the Company monitors the potential occurrence of violations and misconduct within the organization and, where irregularities are identified, undertakes follow-up actions aimed at mitigating their potential effects.

d) INTERNAL AUDIT

In the Company, the internal audit function is carried out in a decentralized model, without a separate organizational unit. Control functions are performed by specialized teams with appropriate subject-matter expertise, in particular in the areas of Finance (including Financial Controlling), Accounting, Legal (including Compliance and Privacy), IT (including Cybersecurity), and Investor Relations (including ESG).

e) SUMMARY OF THE ASSESSMENT OF THE COMPANY'S SITUATION ON A CONSOLIDATED BASIS, INCLUDING AN EVALUATION OF INTERNAL CONTROL, RISK MANAGEMENT, COMPLIANCE, AND INTERNAL AUDIT SYSTEMS

In the opinion of the Supervisory Board, the internal control and risk management mechanisms in place at the Company are adequate to the scale of the Group's operations and its project-based nature, including long-term

---

production cycles and a specific risk profile. The control system is based on clearly defined procedures, a division of responsibilities, and the involvement of specialized teams, enabling ongoing monitoring of key areas of activity.

The Supervisory Board positively assesses the functioning of the compliance system, which is continuous and structured in nature, supported by dedicated functions and ongoing monitoring of regulatory changes. The adopted solutions ensure an appropriate level of compliance of the Company's operations with applicable laws, market standards, and corporate governance principles.

In the Company, the tasks related to internal audit functions are carried out in a decentralized model, without a separate organizational unit. The Supervisory Board assesses that the adopted model is appropriate to the Company's specific business profile and supports the performance of control functions and the management of identified risks.

Based on the information available, the Supervisory Board has not identified any irregularities in the functioning of the above systems.

f) ASSESSMENT OF THE JUSTIFICATION FOR EXPENDITURES INCURRED BY THE COMPANY AND ITS GROUP ON SUPPORTING CULTURE, SPORTS, CHARITABLE INSTITUTIONS, MEDIA, SOCIAL ORGANIZATIONS, AND TRADE UNIONS

The Company undertakes initiatives aimed at having a positive impact on the social environment, fostering employee engagement around shared values, and supporting others by leveraging its resources and expertise. The Company is involved in social projects, nationwide charitable initiatives, and global aid for those most in need through in-kind donations, financial support, and knowledge sharing. The Company also carries out projects aimed at young people, offering opportunities for development and gaining experience in the gaming industry.

Under the Social Engagement Policy at CD PROJEKT and the Donation Procedure of CD PROJEKT S.A., the Company donated a total of PLN 531,000 to charitable causes in 2025. Financial donations were provided to the "Perspektywy" Educational Foundation, the Serhiy Prytula Humanitarian Foundation, the "Rozwój-Integracja-Sport" Foundation, the GraTy Foundation, the A.R.T. Foundation, the "Kampania Przeciw Homofobii" Association, and the "Azyl pod Psim Aniołem" Foundation.

The Supervisory Board assesses the Company's activities in this area as adequate to its resources and justified from the perspective of its social impact.

V. ASSESSMENT OF THE OBSERVANCE, BY THE COMPANY, OF CORPORATE GOVERNANCE POLICIES AND DISCHARGE OF DISCLOSURE OBLIGATIONS RELATED THERETO, AS SPECIFIED IN THE STOCK EXCHANGE REGULATIONS AND REGULATIONS CONCERNING CURRENT AND PERIODIC DISCLOSURES REQUIRED FROM ISSUERS OF SECURITIES

The Supervisory Board has reviewed the information published by the Company regarding its compliance with the Best Practice for GPW Listed Companies 2021 (DPSN), as well as the Statement on the application of corporate governance principles included in the Management Board's Report on the activities of the CD PROJEKT Group for 2025. The Supervisory Board positively assesses the Company's application of the corporate governance principles set out in the DPSN. The Company ensures transparency in this area by publishing comprehensive information on the extent of its compliance with the DPSN, including both the principles it applies and any justified deviations.

As at the date of publication of the report, the Company does not apply 9 of the DPSN principles, including 3 principles from the "Management Board and Supervisory Board" area (2.1, 2.2, 2.11.6) and 6 principles from the "Internal Systems and Functions" area (3.1, 3.3, 3.4, 3.6, 3.7, and 3.10). The deviations from these principles have been justified by the Company and disclosed in the published statement on the application of the DPSN. The Supervisory Board notes that during the reporting period, the Company did not report any incidental breaches of the DPSN principles. In 2025, the level of compliance (COMPLY) amounted to 86%.

The Supervisory Board has also reviewed the manner in which the Company fulfills its disclosure obligations to ensure that the Company complies with the obligations set forth in the Stock Exchange Rules and the regulations governing current and periodic disclosures by public companies.

12

---

In 2025, the Company published twenty current reports, four periodic reports of the CD PROJEKT Group (the annual report, the semi-annual report, and reports for the first and third quarters of 2025), the Company's annual report, and 2 reports regarding the scope of the Company's application of the DPSN.

The Supervisory Board assesses that in 2025 the Company conducted its operations in compliance with the principles applicable to public companies, including the declared corporate governance principles. In the opinion of the Supervisory Board, the Company duly fulfilled its disclosure obligations in 2025 with respect to the application of corporate governance principles and publication of current and periodic information.

VI. DISCLOSURE OF THE SCOPE OF IMPLEMENTATION OF THE DIVERSITY POLICY WITH REGARD TO THE MANAGEMENT BOARD AND THE SUPERVISORY BOARD

The Company does not currently have separate regulations defining detailed diversity criteria for its governing bodies, including target gender representation ratios. Decisions regarding the composition of these bodies are made taking into account qualifications, professional experience, and the diversity of perspectives relevant to the Company's operations. At the same time, a broader organizational context and the need to ensure diverse perspectives are taken into account when shaping the composition of governing bodies. This approach is reflected in changes to the composition of the Supervisory Board effective as of 1 January 2025 and changes to the composition of the Management Board effective as of 1 January 2026, which contributed to increasing the representation of women in both bodies of the Company. As at the date of this statement, the Company has not achieved a minority gender representation ratio of 30% on the Management Board, while the share of the underrepresented gender on the Supervisory Board stands at 40%.

Since 2019 a Diversity Policy has been in force at the Company. Pursuant to this policy, a general non-discrimination principle applies to members of the Management Board and Supervisory Board, as well as to all team members. Furthermore, we are a signatory to the Diversity Charter, which prohibits workplace discrimination and obligates its signatories to engage in activities which foster and promote diversity. Diversity, equality and respect for human rights are all basic values enshrined in the Rules of the Game. CD PROJEKT Group Business and Ethics Standards.

At the same time, the Company monitors legislative changes regarding gender diversity and plans to undertake actions necessary to ensure compliance with the requirements arising from applicable laws.

VII. ASSESSMENT OF THE MANAGEMENT BOARD'S PERFORMANCE OF OBLIGATIONS REFERRED TO IN ARTICLE 380¹ OF THE COMMERCIAL COMPANIES CODE; ASSESSMENT OF THE MANNER IN WHICH THE MANAGEMENT BOARD PREPARES OR PROVIDES THE SUPERVISORY BOARD WITH INFORMATION, DOCUMENTS, REPORTS, OR EXPLANATIONS REQUESTED PURSUANT TO ARTICLE 382 §4 OF THE COMMERCIAL COMPANIES CODE

The information obligations set out in Article 380¹ §1 and §2 of the Commercial Companies Code have been excluded pursuant to §14(2) of the Articles of Association of the Company.

According to § 14 section 2 of the Company Articles, the Management Board is obligated to notify the Supervisory Board of the Company of the Company's condition, including with regard to its assets, along with any notable developments related to the Company's affairs, transactions or other events or circumstances which have, or may have, a significant impact on the Company's material status, including its profitability or liquidity, as well as of changes in information previously provided to the Supervisory Board, if such changes have, or may have, a significant impact on the Company's condition. With regard to subsidiaries, the aforementioned obligation of the Management Board is limited to information in possession thereof, which may be regarded as significant in the context of the Company's material status. Such notifications may be provided in any form listed in the Management Board Regulations and Supervisory Board Regulations as an appropriate means of communication between the Management Board and the Supervisory Board, including in electronic form, as well as orally, during Supervisory Board meetings.

Throughout 2025 the Management Board provided the Supervisory Board with ongoing disclosures specified in § 14 section 2 of the Company Articles, as well as with all requested information, documentation, reports and clarifications related to the Company and particularly to its activities or assets, including in the context of subsidiaries and affiliates. The Supervisory Board has not exercised the power to require the preparation or transmission of information, documents, reports or explanations concerning the Company in the manner set out in the Art. 382¹ of CCC.

---

14

VIII. DISCLOSURE OF TOTAL REMUNERATION PAID OUT IN THE CONTEXT OF AUDITS COMMISSIONED BY THE SUPERVISORY BOARD UNDER ART. 382¹ OF THE CCC

In 2025, the Supervisory Board did not commission any audits in accordance with the procedure set forth in Article 382¹ of the Commercial Companies Code.

SUMMARY

The Supervisory Board hereby recommends that the Ordinary General Meeting:

• adopts a resolution concerning approval of the Company's financial statement for the period between 1 January 2025 and 31 December 2025,
• adopts a resolution concerning approval of the consolidated financial statement of the CD PROJEKT Group for the period between 1 January 2025 and 31 December 2025,
• adopts a resolution concerning approval of the Management Board report on CD PROJEKT group activities in the period between 1 January and 31 December 2025, which incorporates the CD PROJEKT Group sustainability statement,
• adopt a resolution endorsing the Supervisory Board report on the remuneration of members of the Management Board and the Supervisory Board in 2025,
• adopt a resolution concerning approval of the annual report of the Company's Supervisory Board for 2025,
• adopts a resolution concerning allocation of the Company's net profit in the amount of PLN 635,208,677.41, decreased by the amount of PLN 25,739,304.00 constituting the negative value of the retained earnings/(accumulated losses) from previous years, that is the amount of PLN 609,469,373.41 in such a way to transfer this entire amount to the reserve capital of the Company.