This document contains confidential and proprietary information of Prima Artificial Intelligence LLC. It is provided for the purpose of due diligence and governance review only and may not be reproduced or disclosed, in whole or in part, without the prior written consent of the General Counsel. In the event of conflict between this Charter and the constitutional documents of the company or applicable law of the Sultanate of Oman, the constitutional documents and applicable law prevail.

This Charter defines how Prima Artificial Intelligence LLC is directed and controlled. It establishes the mandate of the Board of Directors, the authority delegated to executive management, the committee structure through which material decisions are prepared and taken, and the risk, compliance and reporting disciplines that apply across the Company.

The Company is in the development phase of the KOM Oman AI Factory. This Charter therefore serves a dual purpose: it governs the Company today — through construction, procurement, financing and hiring — and it defines the operating governance that must be demonstrably in place before the Facility accepts its first production workload. Each governance body described herein carries an explicit stand-up milestone tied to the ready-for-service date.

It is written to be relied upon in due diligence as the authoritative statement of the Company’s decision rights and control environment, subject to the constitutional documents and applicable law.

Prima governs the Facility as critical infrastructure. The governance model is built on three convictions: that availability and security are produced by disciplined process rather than heroics; that decision rights must be explicit, singular and matched to accountability; and that a lean organization of 104 FTE stays fast only when routine decisions are delegated and reserved matters are few, clear and genuinely material. Authority is delegated to the lowest level at which the risk of the decision can be competently owned — and no lower.

Eight principles govern every body, delegation and control in this Charter. They are binding on directors, officers, employees and — through contract — on managed service providers acting for the Company.

Governance operates in four tiers. Authority flows down through documented delegation; accountability and reporting flow up through the structures in Sections 14 and 15.

During the development phase the same hierarchy governs a narrower agenda: construction, long-lead procurement, financing, certification and hiring. Committees stand up in two waves — the Executive, Investment and Procurement Committees at adoption of this Charter; the operational committees (Change Advisory Board, Operational Risk, Cybersecurity, Health & Safety) no later than 120 days before ready-for-service, so that each has rehearsed its mandate before the first customer workload.

The Board carries ultimate responsibility for the stewardship of the Company. Acting collectively, it:

• approves corporate strategy, the annual business plan and budget, and monitors delivery against them;
• appoints, evaluates and, where necessary, removes the CEO, and approves the appointment of the other executive officers;
• sets the risk appetite, approves the Risk Management Framework and satisfies itself that principal risks are managed within it;
• approves the reserved matters at 4.5 and the Delegation of Authority at Section 9;
• oversees the integrity of financial statements, external audit, internal controls, and compliance with law, sanctions and export control (Section 11);
• approves major customer commitments, financings and capital projects above executive authority, answering to shareholders and — through this Charter — to lenders, customers and regulators.

The Board comprises five to seven directors: a non-executive Chair, directors nominated by the shareholders in accordance with the shareholders’ agreement, at least two independent non-executive directors with data centre, infrastructure finance or cybersecurity expertise, and the CEO as the sole executive director. The roles of Chair and CEO are held by different individuals; the General Counsel acts as Corporate Secretary. Conflicted directors recuse from deliberation and vote per Section 12.

The Board holds all powers of the Company other than those reserved to shareholders by law or the constitutional documents. It delegates the executive management of the Company to the CEO — and through the CEO to the Executive Leadership Team — subject to the reserved matters at 4.5 and the monetary limits at Section 9, exercised solely through this Charter and the Delegation of Authority Matrix.

The following matters require prior Board approval. Monetary figures are in US dollars and refer to aggregate commitment over the life of the obligation.

Directors receive the monthly management flash report, the quarterly Board pack and the annual certification and audit reports defined at Section 15. Any director may require additional information from any officer through the Corporate Secretary, commission independent professional advice at the Company’s expense on reasonable notice to the Chair, and access the Facility subject to safety and security protocols. The Board is notified of any Severity-1 incident, any reportable data or security breach, and any regulatory contact of substance within 24 hours (Section 13).

The Executive Leadership Team (ELT) comprises the CEO, COO, CTO, CCO and CFO, with the General Counsel and the HR Manager attending as standing members. Individual accountabilities are summarised below and mapped in matrix form at Appendix D. Each officer operates within the Delegation of Authority at Section 9.

Accountable to the Board for the entire performance of the Company. The CEO holds the single point of executive authority: all delegation in this Charter flows through the office of the CEO. The CEO proposes strategy, budget and capital plans to the Board; chairs the Executive Committee; approves commitments within the limits at Section 9; represents the Company to shareholders, government, anchor customers and financiers; and is the ultimate escalation point for any crisis (Section 13). The CEO may not sub-delegate reserved matters or authority beyond the limits granted.

Accountable for the safe, secure and continuous operation of the Facility: the 24×7 data hall organization, all critical MEP infrastructure from utility intake to rack, the Network Operations Center, and operational oversight of the outsourced physical security provider. The COO owns facility availability against the Tier III concurrent-maintainability standard, the preventive maintenance programme, site health and safety, and incident command up to and including facility-level emergencies. Chairs the Operational Risk Committee and the Health & Safety Committee; holds emergency expenditure authority under Section 13.5.

Accountable for the compute, network and security platform: the NVIDIA Blackwell GPU fleet, Linux estate, Kubernetes and Slurm scheduling stack, storage, the InfiniBand and Ethernet fabrics, and DWDM interconnection. The CTO owns platform availability and performance as sold to customers, the technology roadmap and standards, capacity engineering, and — through the CISO — the information security management system and the ISO 27001 / SOC 2 programme. Chairs the Technology Committee; sponsors the Change Advisory Board; approves technical designs and platform changes within delegated authority.

Accountable for revenue and the customer relationship across its life cycle: pipeline and customer acquisition, contract negotiation within the Board-approved form of agreement, capacity allocation and pricing within approved floors, technical pre-sales, onboarding and customer success. The CCO owns SLA performance as experienced by the customer, customer reporting and satisfaction, and the commercial forecast that drives the capacity plan. Brings all non-standard terms to the General Counsel and, above threshold, to the Board.

Accountable for financial stewardship: accounting and financial reporting, budgeting and forecasting, treasury and cash management, tax, insurance placement, procurement and vendor commercial management, and the financial model relied upon by investors and lenders. The CFO owns the internal financial control environment, lender reporting and covenant compliance, and chairs the Investment Committee and the Procurement Committee. Counter-signs all commitments above US$ 250,000 (two-signature rule, Section 9.2).

Accountable for legal affairs and the integrity of the governance system itself: corporate records and Board support, contract review and execution formalities, regulatory and licensing matters, export-control and sanctions screening, data protection, disputes, and the ethics programme at Section 12 including the whistleblower channel. The General Counsel maintains this Charter and the policy register at Section 16, engages external counsel, and holds an unqualified right of escalation to the Chair where legal or ethical concerns are not resolved by management.

Accountable for the people system that a 24×7 critical facility depends on: recruitment against the 104-FTE staffing plan, shift and on-call compensation design, payroll, Omanisation and work-authorisation compliance, training and certification records for operational staff, performance management and workplace administration. HR administers the Code of Conduct attestation cycle and, with the General Counsel, conduct investigations.

Eight standing committees govern cross-functional decisions. Each operates under written terms of reference approved by the Executive Committee, keeps minutes and action logs, and reports as shown below. Committees decide within the Delegation of Authority of their chair; anything beyond is a recommendation to the CEO or the Board. Committee membership is by role, not by person.

Purpose. The principal instrument of executive coordination: reviews performance against plan, decides cross-functional matters within the CEO’s authority, arbitrates resource conflicts, tracks the risk and action registers, and prepares every matter that goes to the Board.

Purpose. Governs the technology platform: architecture standards, technology selection, capacity engineering against the commercial forecast, platform lifecycle and refresh, and the engineering roadmap. Reviews platform KPIs and post-incident engineering actions.

Purpose. Owns the operational risk register for the Facility: single points of failure, maintenance deferrals, vendor performance risk, environmental and utility risks. Reviews all Severity-1/2 incidents and near-misses, tracks corrective actions to closure, and approves the annual integrated maintenance plan.

Purpose. The management review body of the ISMS: threat landscape and intelligence, vulnerability and patch posture, identity and access reviews, security architecture decisions, supplier security assessments, incident-response readiness, and the ISO 27001 / SOC 2 audit programme. Convenes the security incident-response process when invoked.

Purpose. Controls every change to production infrastructure — facility, platform and network — under a single change calendar. Classifies changes (standard, normal, emergency), verifies method statements, rollback plans and customer-impact assessments, and enforces change freezes during high-risk windows.

Purpose. Reviews every capital commitment above Director authority: business case, lifecycle cost, vendor and financing structure, risk assessment and alignment with the capacity roadmap. Owns the capital plan, tracks approved projects against budget and benefit, and prepares Board capex papers.

Purpose. Governs occupational health and safety across the site, including contractors: hazard identification, permit-to-work and lock-out/tag-out discipline, arc-flash and confined-space controls, emergency drills, and investigation of all recordable incidents and near-misses. During construction, coordinates with the EPC contractor’s HSE organization and audits its performance.

Purpose. Ensures procurement is competitive, documented and free of conflicts: tender strategy and waivers, bid evaluation above Director authority, award recommendations, managed-service agreements and renewals, and vendor performance against SLA. Maintains the approved vendor register and the single-source justification log.

A matter escalates when it exceeds the holder’s authority, when required consultees disagree, or when the decision timebox lapses.

Where delay would endanger life, the environment, the security of customer systems or the continuity of service, the senior person present may act beyond their standing authority under Section 13.5 (emergency decision authority). Every such decision is reported to the CEO within 12 hours and ratified by the body that would ordinarily have decided — the ExCo within 48 hours, the Board at its next sitting. Emergency authority does not extend to entering new commercial commitments unrelated to the emergency.

Where the CEO and another executive disagree on a matter within the CEO’s authority, the CEO decides and the dissent is minuted. Where the disagreement concerns legality, ethics or safety, the matter must instead be referred to the Chair through the General Counsel.

Twelve functions execute the operating model defined in PRM-ORG-2026-001. Each is summarised here with its governance interface — where its authority comes from and where its performance is reviewed.

Runs the data halls in a four-shift rotation — smart hands, rack installation, hardware replacement, incident response and customer work orders. Each shift is self-sufficient, led by a Shift Lead holding defined emergency authority. Governance interface: Operational Risk Committee; work executed under SOPs and CAB-approved change.

Owns all MEP infrastructure — the electrical chain from utility intake to rack, cooling plant, UPS, generators, fuel and water systems, BMS. Runs the preventive maintenance programme to Tier III concurrent-maintainability discipline and supervises OEM service vendors. Governance interface: Operational Risk and H&S Committees; maintenance windows via CAB.

Continuously staffed monitoring of infrastructure, network and availability. First-line incident detection, classification and escalation into Operations, Facilities and Engineering under Appendix E; single source of the daily operations report (Section 15). The NOC declares incident severity and starts the escalation clock. Governance interface: Operational Risk Committee; Cybersecurity Committee for security events.

Delivered by a specialist provider under a long-term managed service agreement: 24×7 officers, access control, visitor management, CCTV and perimeter patrol. Reports operationally to the COO; audited by Information Security; contract owned by Procurement. Security incidents follow the same severity model as operational incidents. Governance interface: H&S Committee; vendor performance review by Procurement.

Runs the compute platform: Linux fleet, NVIDIA GPU systems, Kubernetes and Slurm scheduling, storage and automation, with a dedicated Infrastructure Architect owning standards. Chairs the CAB. Governance interface: Technology Committee for designs and standards; Investment Committee for platform capex.

Designs and operates the spine-leaf fabric, InfiniBand compute fabric, Ethernet, DWDM interconnection, routing and capacity planning. Changes to production fabric are CAB-controlled with customer-impact assessment; fabric availability is reported as a technology KPI (Section 14). Governance interface: Technology Committee; CAB for production change.

Operates the ISMS: security engineering and monitoring, vulnerability management, identity and access management, and the ISO 27001 / SOC 2 compliance programme. Audits the physical security provider and vendor security. The CISO chairs the Cybersecurity Committee and holds direct escalation rights to the CEO and the Audit & Risk Committee, independent of the CTO reporting line.

Accounting, reporting, budgeting and forecast, treasury and vendor commercial management, and the procurement process under the Procurement Policy. Maintains the fixed-asset register for the GPU fleet and MEP plant, lender reporting and insurance schedules. Governance interface: Investment and Procurement Committees; Audit & Risk Committee for controls and audit.

Enterprise sales and solutions architecture: pipeline, qualification under KYC and export-control screening (Section 11), proposal and contract negotiation on the approved form, and technical pre-sales that translates customer requirements into platform capacity. Pricing within approved floors; deviations escalate per Table 7-1.

Owns the customer after signature: onboarding, service reviews, SLA reporting and credits, escalation liaison during incidents, and renewal. Publishes the customer KPI set at Section 14 and carries the customer’s voice into the Technology Committee and the CAB (impact notices).

Commercial contracts, regulatory compliance and licensing, NDAs, vendor agreements and corporate governance support to the Board. Runs sanctions and export-control screening with Commercial, data-protection compliance, and the ethics programme. External counsel is engaged under the GC’s authority for specialist and disputed matters.

Recruitment against the staffing plan, payroll, Omanisation compliance, training and certification records, employee development and office operations. Administers Code of Conduct attestations and the conflict-of-interest register with the General Counsel; supervises facility-services vendors (cleaning, waste, grounds).

Table 9-1 summarises approval limits by management level; the operative instrument is the Delegation of Authority Matrix (PRM-DOA-2026-001), which names individual holders and is countersigned by each. Limits are per commitment in US dollars, aggregate over the life of the obligation.

Commitments of US$ 250,000 or more carry two signatures — the accountable executive and the CFO (or CEO where the CFO is the sponsor). Bank mandates, payment-system approval chains and the contract-signature register are configured to mirror this table exactly; a payment that cannot be traced to a conforming approval is blocked by default. Delegations lapse on change of role and are re-issued in writing; temporary uplifts require CEO approval and expire automatically.

The CFO reports DoA exceptions — approvals out of level, split commitments, retrospective approvals — to the ExCo monthly and to the Audit & Risk Committee quarterly. Internal audit tests a sample of approvals against the matrix annually.

Risk is governed under a Risk Management Framework aligned with COSO ERM and ISO 31000, approved by the Board and operated day-to-day by management. The Board sets appetite; the Audit & Risk Committee tests that exposures remain within it.

A single enterprise risk register is maintained by the General Counsel with the CFO, scored for likelihood and impact on a 5×5 scale against defined criteria. First-line owners update their entries monthly; the Operational Risk and Cybersecurity Committees review their domains monthly; the ExCo reviews the top-ten enterprise risks monthly; the Audit & Risk Committee reviews the full register quarterly; the Board reviews appetite and the principal-risk report annually and on any material change. Risk acceptances follow the sign-off levels in Table 9-1.

The CFO places and annually reviews an insurance programme appropriate to a Tier III facility — property damage and business interruption, construction all-risks during the development phase, general and cyber liability, directors’ and officers’ cover — with limits benchmarked by an independent broker and reported to the Audit & Risk Committee. Insurance is a mitigation of last resort; it never substitutes for a required control.

The compliance programme covers certified management systems, third-party attestations and statutory obligations. Each element has a named owner, an assurance cadence and Board-level visibility through the Audit & Risk Committee.

Compliance obligations are cascaded into contracts: customer agreements carry the security, audit and export-control clauses the Company itself must honour, and vendor agreements carry flow-down obligations proportionate to access and criticality. No waiver of a compliance obligation may be granted below the General Counsel, and none at all where the obligation is statutory.

The GPU fleet is subject to US Export Administration Regulations. The Company maintains a written Export Compliance Programme covering: classification of controlled items; end-user and end-use screening of every customer and access-holding vendor against US, UK, EU and UN restricted lists; contractual prohibitions on prohibited end-uses; physical and logical access restrictions consistent with licence conditions; and record-keeping sufficient for regulator audit. Commercial may not issue a proposal, and Operations may not grant access, before screening clears. Escalation of any red flag is to the General Counsel, with authority to freeze the engagement pending resolution.

Before contract signature the Company identifies each counterparty’s legal identity, ownership to ultimate beneficial owner, and source of funds where relevant; screens against sanctions and PEP lists; and assigns a risk tier that sets the refresh cycle and approval level. Enhanced due diligence applies to state-linked entities and intermediated structures. Suspicious-activity concerns are reported by the General Counsel in accordance with Omani law; tipping-off is prohibited.

As an infrastructure provider the Company does not access customer workload data; contracts define the boundary of responsibility. For personal data the Company does control — employees, visitors, CCTV, business contacts — it maintains records of processing, retention schedules and breach-notification procedures under the Oman PDPL, applying GDPR-equivalent safeguards where customer contracts require them.

The Board-approved Code of Conduct binds every director, employee and contractor, and — through contract — the personnel of managed service providers working on site. It covers lawful and honest dealing, respect and non-discrimination, protection of Company and customer assets and information, and the duty to report suspected breaches. Every person attests on joining and annually; attestation records are kept by HR and reported to the Audit & Risk Committee.

Actual, potential or perceived conflicts — financial interests in vendors or customers, outside positions, family relationships in reporting lines — are declared on appointment, annually, and immediately on arising. The General Counsel keeps the conflicts register. A conflicted person takes no part in the affected evaluation, negotiation or approval; for directors, recusal is minuted. Undeclared conflicts are treated as misconduct.

A confidential reporting channel, operated by an independent external provider in English and Arabic, is available to all personnel and to vendor and customer staff. Reports may be anonymous. The General Counsel triages every report; matters implicating an executive officer or the General Counsel go directly to the chair of the Audit & Risk Committee. Investigations are documented, time-bound and reported quarterly to that Committee. Retaliation in any form is itself a dismissible breach of the Code.

The Company prohibits bribery and corruption in all forms, including facilitation payments, in line with Omani law and the extraterritorial reach of the US FCPA and UK Bribery Act. Gifts and hospitality above a nominal threshold defined in the ABC Policy are pre-approved and recorded in a register reviewed quarterly by the General Counsel. Interactions with public officials, and the use of agents or intermediaries, require prior written GC approval. Procurement decisions are documented so that the basis of every award can be independently reconstructed.

The Company does not transact, directly or indirectly, with sanctioned persons, entities or territories under applicable US, UK, EU, UN or Omani measures. Sanctions screening is embedded in customer, vendor and investor onboarding (11.4) and re-run on list updates. Where sanctions exposure emerges mid-contract, the General Counsel has authority to suspend performance pending legal determination, and the matter is reported to the Board.

Continuity is governed under a Business Continuity Management System aligned with ISO 22301: a Board-endorsed policy, business impact analysis, documented continuity and disaster recovery plans, and an exercise programme. This section defines who decides what when normal operations fail.

The COO owns the BCMS and the readiness of every continuity capability — fuel autonomy, spares, alternate work arrangements, recovery procedures. The CTO owns platform and data recovery, including customer-facing RTO/RPO commitments. The CCO owns customer communication during disruption. The CFO owns emergency funding lines and insurance response. The General Counsel owns regulatory notification. The CEO decides, and the Board is informed within 24 hours of any crisis declaration.

Every SEV-1 and SEV-2 incident receives a blameless post-incident review within five business days, chaired by the Operational Risk Committee (or Cybersecurity Committee for security incidents), producing a root-cause analysis, corrective actions with owners and dates, and — where customer-affecting — an RFO report issued by Customer Success. Corrective actions are tracked to closure and audited.

A crisis is any event — operational, security, safety, legal or reputational — whose impact or duration exceeds what the incident organization can manage within normal authority. The CEO, or the COO acting in the CEO’s absence, declares a crisis and convenes the Crisis Management Team: CEO (chair), COO (site command), CTO, CISO, CCO (customer and external communication), CFO, General Counsel and HR, with the security provider’s site manager in attendance for physical events. The CMT assembles — physically or virtually — within 60 minutes of declaration, around the clock. It operates from a pre-agreed battle rhythm: situation report, decisions, communications, next review. All external statements are approved by the CEO on advice of the General Counsel; customer notifications follow contractual timelines owned by the CCO.

During a declared crisis, or where imminent danger to life, the environment, customer systems or service continuity leaves no time to convene normal authority, the senior person present may take any proportionate action — including shutdown, isolation, evacuation and emergency procurement within the monetary limits of Table 9-1. On site at night and weekends this is the Shift Lead; the NOC holds authority to execute pre-approved emergency operating procedures without further approval. Every emergency decision is logged contemporaneously, reported to the CEO within 12 hours, and ratified per Section 7.4. No one will be criticised for a good-faith emergency decision taken within this framework — failing to act is the governance failure.

The Disaster Recovery Plan defines recovery of the platform control plane, network management, BMS/DCIM and corporate systems, with recovery time and recovery point objectives approved by the Technology Committee and reflected in customer contracts by the CCO. DR readiness — backup integrity, restore tests, alternate management paths — is evidenced monthly to the Operational Risk Committee. Customer workload recovery remains the customer’s responsibility unless contracted otherwise; the boundary is stated in each service agreement.

Performance is governed through a fixed KPI set with named owners, defined targets and a single source of truth in the DCIM/BI stack. Targets are set with the annual budget and may be tightened, never silently relaxed; definitions change only by ExCo approval.

KPIs flow through the reporting framework at Section 15: daily operational indicators in the NOC report, the full set monthly to the ExCo with variance commentary, and quarterly to the Board with trend and peer benchmarks. Executive scorecards derive directly from this KPI set, and the Remuneration & Nomination Committee ties variable compensation to them — availability, safety and compliance measures gate all other incentives: a SEV-1 breach of the safety or compliance appetite zeroes the affected scorecard for the period.

Reporting follows the management line shown at Appendix C, on a fixed calendar. Every report has a named producer, a defined audience and a stable format, so that trends are comparable period over period. Exceptions and threshold breaches are reported when they occur — never held for the next cycle.

All periodic reporting draws from a single governed data layer — DCIM, the platform telemetry stack and the finance system — so that the Board, lenders and customers see the same numbers. Manual adjustments are disclosed. Report owners certify accuracy; material restatements are reported to the Audit & Risk Committee with cause. External reporting to investors, lenders and customers is released only through the CFO (financial) or CCO (service), on formats agreed in the underlying contracts.

This Charter sits at the top of a controlled document hierarchy. The register below lists the supporting corporate documents; each is version-controlled by the Corporate Secretary, and the versions relied upon in due diligence are those in the controlled data room.

Documents are drafted to be certifiable: the ISMS and BCMS documents follow ISO structure so that certification audits test the documents the Company actually uses, not parallel paperwork. Where a document named here does not yet exist at adoption of this Charter, its stand-up date appears in the pre-RFS certification roadmap (Section 11.2) and its owner reports progress monthly.

The Charter is reviewed annually, completing no later than the second quarter, so that any changes take effect with the budget-year governance calendar. The review is led by the General Counsel & Corporate Secretary under the direction of the Audit & Risk Committee, and concludes with Board re-approval of the Charter — amended or unchanged — recorded by resolution.

Between annual reviews, amendments may be initiated by the Board, the CEO or the General Counsel where a material change requires it — new financing covenants, a change in law or sanctions regime, a certification finding, or a structural change to the organization. Interim amendments follow the same drafting and approval path, and are consolidated at the next annual review. Editorial corrections that do not alter authority or obligation may be made by the Corporate Secretary and noted to the Board.

The review reports against fixed indicators: reserved matters decided with complete papers on first presentation; DoA exceptions per period and their disposition; escalations meeting the timeframes at Section 7.3; committee meeting and quorum discipline; audit findings closed on schedule; whistleblower cases resolved within target; and training and attestation completion. Persistent misses are treated as design defects of the framework — not merely performance failures of individuals — and drive amendment.

Core organization at steady state — 104 FTE at full build-out of both phases, ramping from 88 FTE in Phase 1. Full staffing detail in PRM-ORG-2026-001.

Solid reporting lines, secondary (functional) lines, and the standing forums each role attends.

Accountability by domain across the Executive Leadership Team. One A per domain; the CISO acts within the CTO column for security domains with the independence safeguards at Section 8.7.

Escalation paths by scenario. The clock starts at detection; a step that cannot reach its escalation contact within the stated window escalates past them. Severity definitions at Section 13.2.

Annual rhythm of governance events. Standing cadences: ExCo weekly · CAB weekly · management committees monthly (Procurement fortnightly) · monthly management pack and Board flash.