The literal contract award-letter draft a buyer's legal team redlines before signing.

[Letterhead of [BUYER FULL LEGAL NAME — e.g. "Ministry of Defence, acting through Defence Science and Technology Laboratory (Dstl)"] [Buyer address line 1, line 2, postcode] [Date — to be inserted on signature] To: CSOAI Ltd (the "Supplier") Company No. 16939677 Registered office: [REDACTED — see Companies House] Trading as: DEFONEOS Subject: Contract Award — DEFONEOS Sovereign Public Services OS — 90-day Pilot Reference: DEFONEOS-PILOT-2026-[NN] Dear Sirs, 1. BACKGROUND Following your tender response dated [DATE] to our Statement of Requirement under reference [BUYER REFERENCE], and the subsequent clarification meetings held on [DATES], we are pleased to award the 90-day sovereign pilot engagement described in Schedule 1 (Statement of Work) on the terms set out in this Letter and the Schedules attached. 2. CONTRACT DOCUMENTS The Contract comprises: (i) this Letter; (ii) Schedule 1 — Statement of Work (DEFONEOS-PILOT-2026-[NN]-S1); (iii) Schedule 2 — Pricing Schedule (DEFONEOS-PILOT-2026-[NN]-S2); (iv) Schedule 3 — Intellectual Property Rights & Crown Copyright; (v) Schedule 4 — Data Protection (UK GDPR Art 28 Processor Terms); (vi) Schedule 5 — Security (JSP 440 baseline; SC-cleared personnel); (vii) Schedule 6 — Acceptance (240-test pytest gate); (viii) Schedule 7 — Exit, Escrow & Source Code Custody. In the event of conflict the order of precedence shall be (i) to (viii) above. 3. CONTRACT VALUE The total fixed price for the pilot is two hundred and fifty-two thousand pounds (£252,000) exclusive of VAT, payable in three milestone tranches: P1 (Day 30) — Acceptance of base deployment to buyer's nominated environment → 30% P2 (Day 60) — Acceptance of 33-agent BFT governance council integration → 30% P3 (Day 90) — Acceptance of DEFONEOS-SEAL issuance workflow + exit handover → 40% Pricing is firm for the 90-day pilot. Extensions are at the rates in Schedule 2. 4. COMMENCEMENT AND TERM The Contract shall commence on the date of the last signature below (the "Commencement Date") and shall continue for ninety (90) calendar days unless terminated earlier in accordance with Schedule 6. The Authority may, at its sole discretion, exercise up to two (2) extensions of ninety (90) days each at the rates specified in Schedule 2. 5. WARRANTIES AND COMPLIANCE The Supplier warrants that: (a) it holds and shall maintain for the duration of the pilot Cyber Essentials Plus (certification evidence at Schedule 5); (b) all personnel accessing Authority data hold SC clearance (Baseline) and shall provide evidence on request; (c) the Software is developed and hosted entirely within the United Kingdom and within the sovereign jurisdiction declared in Schedule 5; (d) the Software shall pass the 240-test pytest acceptance gate specified in Schedule 6. The Supplier shall issue a DEFONEOS-SEAL credential against the deployed Software at the end of the pilot, signed by a quorum (≥23 of 33) of its BFT governance council, evidence of which shall be appended to the final delivery report. 6. INTELLECTUAL PROPERTY IPR in the Software shall vest in the Supplier. The Authority receives a perpetual, irrevocable, non-exclusive, royalty-free licence (with the right to sub-licence to other UK Crown bodies and AUKUS partners) to use, copy, modify and distribute the Software for non-commercial governmental purposes. Crown Copyright in any Authority-supplied data or specifications shall vest in the Authority under the Copyright, Designs and Patents Act 1988 s.163. See Schedule 3 for the full text. 7. DATA PROTECTION The parties shall comply with Schedule 4 (Data Protection). The Supplier acts as Processor under UK GDPR Art 28 and shall not transfer Authority Personal Data outside the United Kingdom. 8. GOVERNING LAW This Contract is governed by the laws of England and Wales. The parties submit to the exclusive jurisdiction of the courts of England and Wales, save that where the Authority is a Crown body nothing in this clause shall prejudice any statutory right of the Crown under the Crown Proceedings Act 1947. 9. NOTICES Notices shall be sent to: Supplier: contracts@defoneos.org (with copy to legal@defoneos.org) Authority: [INSERT NAME & EMAIL] A notice is deemed received: by email, at 09:00 on the first working day after sending; by post, on the third working day after posting. 10. ENTIRE AGREEMENT This Contract constitutes the entire agreement between the parties in respect of its subject matter and supersedes all prior negotiations, MoUs, NDAs and representations, whether oral or written. 11. EXECUTION Please evidence your acceptance of this Contract by signing in the space provided below and returning a countersigned copy to the Authority within fourteen (14) working days of the date of this Letter. Yours faithfully, _______________________________ [NAME] [ROLE] For and on behalf of [BUYER FULL LEGAL NAME] Date: ____________________________ ACCEPTED AND AGREED: _______________________________ Nicholas Templeman Director, CSOAI Ltd (Company No. 16939677) For and on behalf of the Supplier Date: ____________________________]

Item | Unit | Qty | Unit (£) | Total (£) ------------------------------------------------------------|---------------|-----|----------|---------- Sovereign Platform pilot fee (incl. 33-agent BFT council) | fixed price | 1 | 180,000 | 180,000 Deployment to buyer environment (air-gapped option +£60k) | fixed price | 1 | 60,000 | 60,000 DEFONEOS-SEAL issuance (1 seal, signed, escrow evidence) | per issuance | 1 | 12,000 | 12,000 ------------------------------------------------------------|---------------|-----|----------|---------- Subtotal (excl. VAT) | 252,000 VAT @ 20% | 50,400 TOTAL | 302,400 Extension rates (per 90-day extension): Platform extension fee £45,000 Additional BFT council convenings £12,000 each Additional SEAL issuances £12,000 each Advisory day rate (named expert) £2,400/day Travel & subsistence: at UK Government rates (GED). Subcontracting: none permitted without Authority written consent.

3.1 Supplier IPR. The Supplier retains all intellectual property rights in the Software, the Documentation, and any derivative works created in the performance of the Contract, subject to the licence granted at clause 3.3. 3.2 Crown Copyright. Crown Copyright in any Authority-supplied data, specifications, requirements or other material provided to the Supplier shall vest in the Authority under section 163 of the Copyright, Designs and Patents Act 1988. The Supplier shall not assert any rights in Authority-supplied material and shall affix the appropriate Crown Copyright notice as instructed. 3.3 Authority Licence. The Supplier grants the Authority a perpetual, irrevocable, worldwide, non-exclusive, royalty-free licence (with the right to sub-licence to other UK Crown bodies, NATO members, and AUKUS partners) to use, copy, modify, adapt, and distribute the Software and Documentation for any non-commercial governmental purpose, including for national-security, defence, and civil-resilience purposes. 3.4 Open-source carve-out. The Software is licensed to the general public under the Apache License 2.0. The Authority licence at clause 3.3 is additional to, and does not limit, any rights granted under that public licence. 3.5 Background IPR. Each party retains all rights in its Background IPR. Neither party acquires any rights in the other's Background IPR except as expressly set out in this Contract. 3.6 Escrow. Source code and build artefacts shall be deposited with NCC Group Escrow (or equivalent CESG-certified escrow agent) under a tri-partite escrow agreement attached at Schedule 7.

4.1 The Supplier is a Processor of Authority Personal Data under UK GDPR Article 28. The Processor shall: (a) process the Personal Data only on documented instructions from the Authority, including with regard to international transfers; (b) ensure that all personnel authorised to process the Personal Data are subject to confidentiality obligations no less protective than those in this Contract; (c) implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including encryption at rest (AES-256) and in transit (TLS 1.3); (d) not engage another processor without prior written consent; (e) taking into account the nature of the processing, assist the Authority by appropriate measures, insofar as possible, in fulfilling the Authority's obligation to respond to requests from data subjects exercising their rights; (f) at the choice of the Authority, delete or return all Personal Data after the end of the provision of services relating to processing; (g) make available to the Authority all information necessary to demonstrate compliance with Article 28 GDPR. 4.2 Sub-processors: none at Commencement. Any addition requires 30 days' written notice and the Authority's right to object. 4.3 International transfers: prohibited. All Personal Data shall remain within the United Kingdom at all times. 4.4 Breach notification: within 24 hours of becoming aware.

7.1 On termination or expiry, the Supplier shall: (a) deliver up-to-date source code, build scripts, infrastructure-as- code, and documentation to NCC Group Escrow within 14 days; (b) provide 60 days' transition assistance at the rates in Schedule 2; (c) return or destroy all Authority Personal Data per Schedule 4.6; (d) issue a final DEFONEOS-SEAL evidencing the state of the Software at exit. 7.2 Release events for escrow: (a) Supplier insolvency or liquidation; (b) Supplier ceases to support the Software and fails to remedy within 60 days of Authority notice; (c) Supplier commits a material breach incapable of remedy. 7.3 On release, the Authority receives a non-exclusive licence to use, modify, and support the Software for its own purposes, including the right to engage a third party to maintain it.