1. Has the Company established and disclosed its Corporate Governance Best-Practice Principles based on the Corporate Governance Best-Practice Principles for TWSE/TPEx Listed Companies?

V

The Company has established and obtained approval from the Board of Directors for the “Corporate Governance Best Practice Principles,” which has been disclosed on the company’s official website.

No significant deviation.

2. Shareholding Structure and Shareholders’ Rights

1. Does the Company have Internal Operation Procedures for handling shareholders’ suggestions, concerns, disputes and litigation matters. If yes, have these procedures been implemented accordingly?

V

The Company has established a spokesperson and deputy spokesperson system to record and address shareholder suggestions, concerns, and disputes.

No significant deviation.

2. Does the Company know the identity of its major shareholders and the parties with ultimate control of the major shareholders?

V

The Company’s daily shareholder affairs are handled by a professional shareholder services agency, with dedicated personnel responsible for managing related matters. The company also keeps track of the list of major shareholders and ultimate controllers of the Company. Additionally, the Company’s official website discloses the list of the top ten shareholders.

No significant deviation.

3. Has the Company built and implemented a risk management system and a firewall between the Company and its affiliates?

V

1. The Company has established the “Subsidiary Supervision Management Guidelines” and the “Group Enterprises, Related Parties, and Specific Person Transaction Procedures” for transactions with related enterprises, and internal auditors regularly conduct audits.

2. The Company has assigned cybersecurity personnel to implement a firewall mechanism to block unauthorized external connections.

No significant deviation.

4. Has the Company established internal rules prohibiting insider trading of securities based on undisclosed information?

V

The Company has established the “Measures to Prevent Insider Trading.” In addition to being posted on the Company's official website, the company conducts irregular annual awareness campaigns for employees and insiders to prohibit insider trading.

In September and October 2025, the Company conducted awareness programs on the prohibition of insider trading and its related practices.

No significant deviation.

3. Composition and responsibilities of the board of directors

1. Have a diversity policy and specific management objectives been adopted for the board and have they been fully implemented?

V

The composition of the Board of Directors emphasizes diversity. Board members possess expertise across business management, the biotechnology and healthcare industry, financial accounting, legal affairs, marketing, and sustainable development. They collectively demonstrate the knowledge, skills, and professional competence required to perform their duties, along with extensive experience in management and operational decision-making, thereby leading the Company to maximize shareholder value. For further details, please refer to the “Board Diversity and Independence” section of this Annual Report.

No significant deviation.

2. Has the Company voluntarily established other functional committees in addition to the remuneration committee and the audit committee?

V

The Company has established a Compensation Committee and an Audit Committee in accordance with the law. Currently, no other functional committees have been established, but the company will evaluate the need for additional committees in the future.

Planning stage.

3. Has the Company established rules and methodology for evaluating the performance of its Board of Directors, implemented the performance evaluations on an annual basis, and submitted the results of performance evaluations to the board of directors and used them as reference in determining salary/compensation for individual directors and their nomination and additional office terms?

V

The Company has established the “Board of Directors Performance Evaluation Guidelines” and conducts an annual evaluation of the board's performance. The results of the performance evaluation are reported to the board and used as a reference for individual director compensation and the nomination for reappointment.

No significant deviation.

4. Does the Company regularly evaluate its external auditors’ independence?

V

The Company regularly evaluates the independence of the certified public accountants (Note 1) and the audit quality indicators (AQIs) (Note 2) provided by the accountants every year. The evaluation results are submitted to the Audit Committee for review and approval, and then reported to the Board of Directors for resolution and approval.

In the 2026 fiscal year, the independence and qualifications of the certified public accountants were approved by the Board of Directors on March 3, 2025.

No significant

deviation.

4. Does the TWSE/TPEx listed company have in place an adequate number of qualified corporate governance officers and has it appointed a chief corporate governance officer with responsibility corporate governance practices (including but not limited to providing information necessary for directors and supervisors to perform their duties, aiding directors and supervisors in complying with laws and regulations, organizing board meetings and annual general meetings of shareholders as required by law, and compiling minutes of board meetings and annual general meetings)?

V

The Company established the position of Corporate Governance Officer, which was approved by the Board of Directors on March 18, 2024. Currently, the Vice President of the Finance and Administration Department is responsible for corporate governance-related matters.

No significant deviation.

5. Has the Company established channels for communicating with its stakeholders (including but not limited to shareholders, employees, customers, suppliers, etc.) and created a stakeholders section on its company website? Does the Company appropriately respond to stakeholders’ questions and concerns on important corporate social responsibility issues?

V

The Company has set up a stakeholder section on its official website, providing multiple communication channels. Dedicated personnel are assigned to respond to the concerns of stakeholders and record these issues for regular reporting to the Board of Directors. In accordance with regulations, the company uploads relevant information to the Market Observation Post System (MOPS), ensuring that stakeholders have sufficient information to make informed decisions and protect their interests.

No significant deviation.

6. Has the Company appointed a professional shareholder services agent to handle matters related to its shareholder meetings?

V

The Company has appointed First Securities Inc. Shareholder Services Department to handle related matters.

No significant deviation.

7. Information Disclosure

1. Has the Company established a corporate website to disclose information regarding its financials, business, and corporate governance status?

V

The Company has an official website that provides information about its business operations and corporate governance. In accordance with regulations, financial, business, and corporate governance information is disclosed on the Market Observation Post System (MOPS).

No significant

deviation.

2. Does the Company use other information disclosure channels (e.g., maintaining an English-language website, designating staff to handle information collection and disclosure, appointing spokespersons, webcasting investors conference etc.)?

V

Since its public offering, the Company has complied with the regulations of the competent authorities and relevant laws regarding the announcement and filing of various information. The Company has designated personnel responsible for collecting company information and has implemented a spokesperson and deputy spokesperson system in accordance with regulations.

No significant

deviation.

3. Does the company publish and report its annual financial report within two months after the end of the fiscal year, and publish and report its financial reports for the first, second, and third quarters as well as its operating statements for each month before the specified deadlines?

V

The Company currently announces and files financial reports and monthly operational updates within the statutory timeframes, as required by regulations.

No significant

deviation.

8. Has the Company disclosed other information to facilitate a better understanding of its corporate governance practices (including but not limited to employee rights, employee wellness, investor relations, supplier relations, rights of stakeholders, directors’ and supervisors’ continuing education, the implementation of risk management policies and risk evaluation standards, the implementation of customer relations policies, and purchasing liability insurance for directors and supervisors)?

V

1.Employee Rights: The Company complies with the Labor Standards Act and relevant laws to ensure the rights and benefits of employees. Regular labor-management meetings are held to establish effective communication channels between labor and management, and regular employee health check-ups are conducted. In alignment with the company's goals, business plans, and the overall development of employee capabilities, a variety of training programs are provided. The company values the quality of employee training and, in 2022, passed the Talent Development Quality Management System (TTQS) evaluation for business organizations, conducted by the Ministry of Labor’s Workforce Development Agency. This reflects the company's commitment and effectiveness in training. Each year, diverse courses are arranged for employees to choose from, helping them develop their skills, accumulate knowledge, and cultivate diverse interests.

2.Employee Welfare: The Company has established an Employee Welfare Committee, which provides various subsidies for marriage, bereavement, celebrations, and childbirth. Additionally, the company organizes regular gatherings, travel activities, birthday parties, and festive events to promote the physical and mental well-being of employees, enhance interaction and emotional bonds among employees.

3.Investor Relations: The Company has implemented a spokesperson system responsible for communication with external parties. The company regularly discloses financial information on the Market Observation Post System and the Company’s official website for investors to reference and evaluate.

4.Supplier Relations: The Company regularly evaluates its suppliers and maintains long-term, strong cooperative relationships with them.

5.Stakeholder Rights: To protect the rights of stakeholders, the company has established various effective and smooth communication channels. Upholding the principles of integrity and responsibility, the company appropriately handles stakeholder concerns and has set up a dedicated stakeholder section on its official website.

6. Director Continuing Education: All directors of the company have completed continuing education and reporting in accordance with relevant regulations.

7. Risk Management Policy and Risk Measurement Standards Implementation:

(1) Risk Management Organizational Structure
The company’s risk management is overseen by the Board of Directors as the highest management and decision-making body. The Board approves risk management policies and procedures based on the Company’s business strategies and industry environment. Currently, the Vice President of the Finance and Administration Division is responsible for sustainability matters, and management at all levels, along with employees, are involved in promoting and implementing risk management. At least once a year, a comprehensive report on overall risk analysis, prevention, monitoring, and major risk control issues is submitted to the Board.

(2) Risk Management Policies and Procedures
In 2023, the Company’s Board of Directors approved the “Risk Management Practices Code.” The Board, management at all levels, and employees collectively participate in its implementation. The company regularly identifies significant risks related to operations each year, appropriately evaluates and controls potential risks, and uses the results to inform business strategy formulation.

(3) Risk Management Scope
Risk management primarily involves identifying the risks that may be faced during operations. To effectively control various risk factors, the company has broadly classified and defined the following:

A. Financial Risks: Risks to the Company’s financial and business performance due to factors such as domestic and international economic conditions, industry changes, interest rates, exchange rates, and credit risks.

B. Operational Risks: Risks that affect the Company’s normal operations, including customer rights, medical device safety, procurement, supply chains, trade secrets, intellectual property rights, and talent recruitment and training.

C. Strategic Risks: Risks related to business strategies, such as legal regulations, product development and market introduction, and marketing and market-related risks.

D. Health and Safety Risks: Risks from internal and external factors that could endanger employee health and safety, leading to company losses.

E. Climate Change-Related Risks: Risks from physical impacts of climate change (e.g., floods, droughts) due to global warming, which create operational pressures and shocks for businesses. Additionally, risks from government regulations and international initiatives to increase the use of renewable energy, leading to higher costs (e.g., higher electricity prices in Taiwan due to increased renewable energy use).

F. Other Risks

(4) Risk Measurement Standards Implementation
The Company evaluates and analyzes significant proposals related to operational policies, investment projects, guarantees, loans, and bank financing by the appropriate departments. These proposals are then consolidated by the Finance and Administration Division, submitted to the Audit Committee for approval, and subsequently forwarded to the Board for resolution and execution.
The Audit Department prepares the annual audit plan based on the risk assessment results and submits it to the Audit Committee and the Board for approval. The Audit Department reports quarterly audit findings, audit recommendations, and subsequent improvements to the Audit Committee and the Board. The Audit Department consolidates the internal control assessments and audit results from various departments, with no significant internal control failures found for 2025. The effective internal control system assessment for 2025 was submitted to and approved by the Audit Committee and the Board. Through the oversight of the Audit Committee and the Board, the company effectively manages the execution of various risk management measures, ensuring compliance and minimizing non-compliance risks.

(5) Operational Status
The company reports its operational status to the Board at least once a year. On March 3, 2026, the following matters were reported to the Board:
A. 2026 Risk Management Execution Report and Sustainability Development Plan
B. The Audit Department prepares the annual audit plan based on the risk assessment results, reports quarterly audit findings, audit recommendations, and subsequent improvements to the Audit Committee and the Board. No significant internal control failures were found for 2025, and the internal control declaration for the effective internal control system for 2025 was submitted to and approved by the Audit Committee and the Board on March 3, 2026.

8. Customer Policy Implementation: The Company maintains stable and good relationships with customers to generate profits for the Company.

9. Director Liability Insurance: The Company has purchased director and officer liability insurance for all directors and key personnel of the 6th term, with the insurance period from July 1, 2025, to July 1, 2026. The coverage amount is USD 1.5 million.

10. Intellectual Property Management Plan: Bonraybio places great importance on the operation of its intellectual property. Whenever the R&D team comes up with new technological ideas or inspirations, after initial experiments and trials confirm feasibility, the intellectual property officer conducts a patent search to investigate the technical status. This includes confirming two major indicators:

Freedom-To-Operate (FTO): Ensuring that the technology does not infringe on existing patents and can be implemented without risk.

Patentability: Ensuring that the technology has not been disclosed in prior cases, increasing the likelihood of patent approval.

If the technology has Freedom-To-Operate, it proceeds to subsequent product development, manufacturing, and sales. Further, if the technology is patentable, patent applications are made for the major global markets (such as Taiwan, Mainland China, the United States, and Europe) to secure patent protection for the new technology.

The Company has established an “Intellectual Property Management Procedure” to protect operations and enhance corporate value. Additionally, through a review mechanism within the operational units, the company reduces the risk of infringement and respects others' intellectual property.

The Company reports relevant matters to the Board of Directors at least once a year. The report for 2026 is expected to include the following:

1. Patent Acquisition Results: As of the publication date of the annual report, the Company has filed a total of 130 patents worldwide, of which 111 have been granted, and 19 are still under application.

2. Trademark Registration Results: As of the publication date of the annual report, the Company has filed a total of 120 trademarks worldwide, of which 101 have been granted, and 19 are still under application.

3. Trade Secret Protection Results: The company has implemented the “Intellectual Property Management Procedure,” requiring customers, suppliers, and other relevant parties to sign non-disclosure agreements. Additionally, new employees sign labor contracts that include confidentiality obligations and responsibilities.

4. Patent Rights Status for 2025: As of the publication date of the annual report, there are no issues regarding parental rights for newly acquired patents in 2025.

11. Privacy Policy: The Company places great emphasis on privacy rights and has designated the Finance and Accounting Management Division as the responsible unit to ensure compliance with all relevant privacy and personal data protection laws in Taiwan. To safeguard personal privacy, the company has established a Personal Data Protection Management Regulation and regularly promotes personal data protection awareness and practices among all employees. The regulation outlines how the company collects, processes, and utilizes personal data. In addition to committing not to disclose any personally identifiable information to third parties, individuals also have the right, in accordance with Article 3 of the Personal Data Protection Act, to request access, review, copy, supplement, correct, suspend the collection/processing/use, or delete their personal data.

In 2025, there were 0 incidents of personal data breaches.

In 2025, there were 0 requests from individuals for their personal data.

No significant deviation.

9. Please describe improvements that have already been made based on the Corporate Governance Evaluation results released for the most recent fiscal year by the Corporate Governance Center, Taiwan Stock Exchange, and specify the priority enhancement objectives and measures planned for any matters still awaiting improvement.

The Company was officially listed on December 6, 2024, and participated for the first time in the 12th Corporate Governance Evaluation in 2025. The Company has proactively conducted a self-assessment based on the evaluation criteria, identified areas that have yet to meet the standards, and designated responsible personnel to formulate and implement improvement measures, with the aim of further enhancing the quality of corporate governance.