IDAI 10-K & 10-Q changes, risk factors and insider trading

•Health Information Technology for Economic and Clinical Health Act (HITECH)

•General Data Protection Regulation (GDPR)

•Artificial Intelligence Act (AI Act)

•UK General Data Protection Regulation (UK GDPR)

Resignation of Board Director and Appointment of New Board Director

On March 6, 2026, the Board of Directors accepted the resignation of Andrew Scott Francis as a Director of the Company to allow him to have a greater focus on serving as the newly appointed CEO of the Company’s African operations. This was documented as part of a unanimous written consent by the Board of Directors, including Mr. Francis. Mr. Francis will continue to serve in his position as Chief Technology Officer of the Company, as well as continue to attend meetings of the Board of Directors in a non-voting, ex officio advisor capacity.

Concurrently, on March 6, 2026, the Board of Directors of the Company, after receiving a recommendation from the Nomination and Corporate Governance Committee, elected David Curmi to the Company’s Board of Directors as a “Class III” member. Mr. Curmi will also serve as a member of the Compensation Committee of the Board of Directors.

CyberFish CyberPsychology Solutions Ltd Share Purchase Agreement, Shareholders Agreement, and Consulting Agreement

On March 9, 2026, Trust Stamp Malta Limited, a wholly-owned subsidiary of the Company, entered into a Share Purchase Agreement (the “SPA”) with CyberFish CyberPsychology Solutions Ltd, a private company incorporated in England and Wales (“CyberFish”). Pursuant to the SPA, Trust Stamp Malta Limited agreed to subscribe to fifty percent (50%) of the authorized share capital of CyberFish in exchange for £190,000 (the “Total Consideration”), consisting of (i) a cash payment of €30,000 payable to Malta Enterprise on behalf of CyberFish and (ii) a cash payment of £30,000 payable to CyberFish (together, the “Cash Consideration”) and (iii) non-cash consideration with an agreed value equal to the remaining balance of the Total Consideration following deduction of the Cash Consideration, comprising the provision of software development, engineering, and related technical services by Trust Stamp Malta Limited and/or other Company group entities. Malta Enterprise is a Maltese national development agency that previously provided CyberFish a start-up loan, which is partly being repaid as part of this transaction.

On March 9, 2026, the SPA closed, and Trust Stamp Malta Limited acquired 50% of CyberFish in exchange for the consideration described above. The non-cash consideration became effective as of the closing date and was not a condition to the closing of the SPA.

Berta Pappenheim, a member of the Company’s Board of Directors, is the CEO, co-founder, and a director of CyberFish – and prior to the closing of the SPA, she owned 100% of CyberFish. Ms Pappenheim is no longer regarded as an independent director of the Company.

Also on the March 9, 2026, in connection with the closing of the SPA, and to govern the parties’ ongoing relationship as shareholders of CyberFish, Trust Stamp Malta Limited entered into a Shareholders Agreement (the “Shareholders Agreement”) with (i) Berta Pappenheim and (ii) CyberFish. The Shareholders Agreement contains provisions governing, among other things, the governance and management of CyberFish, board composition and voting, shareholder consent matters, information and reporting rights, financing expectations, and transfer restrictions with respect to shares of CyberFish.

Also on March 9, 2026, Trust Stamp Malta Limited entered into a Consulting Agreement (the “Consulting Agreement”) with CyberFish. Under the Consulting Agreement, CyberFish agreed to provide consulting services relating to market development in the United Kingdom, including market entry and expansion strategy, business development, partnership identification, and related services. CyberFish designated Berta Pappenheim as key personnel to perform the services on its behalf. The Consulting Agreement contemplates that the services will be performed for an average of three (3) days per week over a rolling six-week period. In consideration for the services, Trust Stamp Malta Limited will pay CyberFish fees of £65,000 per year, payable in twelve equal monthly installments. Either party may terminate the Consulting Agreement upon 30 days’ prior written notice, and Trust Stamp Malta Limited may terminate the Consulting Agreement immediately upon certain events, including material breach, breach of confidentiality, certain legal or compliance impediments, or misconduct or gross negligence, in each case as provided in the Consulting Agreement. The Consulting Agreement includes customary confidentiality provisions and provides that intellectual property created pursuant to or in connection with the services will vest exclusively in Trust Stamp Malta Limited, subject to the terms of the Consulting Agreement.

Acquisition of Lexverify Ltd.

On February 27, 2026 (the “Closing Date”), the Company completed the acquisition of one hundred percent (100%) of the issued and outstanding share capital of Lexverify Ltd., a private limited company incorporated in England and Wales (“Lexverify”) pursuant to a share purchase agreement dated February 27, 2026 (the “SPA”) by and among the Company and the shareholders of Lexverify (each, a “Seller” and collectively, the “Sellers”). While limited in size, the Company believes this acquisition provides new expertise in the training and use of large language models as well as providing an additional access point to the UK market for the Company.

The aggregate purchase price for the acquisition (the “Purchase Price”) is payable entirely in shares of the Company’s Class A Common Stock, par value $0.01 per share (the “Common Stock”), with the number of shares determined based on the closing price of the Company’s Common Stock on Nasdaq on the Closing Date. The Purchase Price was structured in four tranches, consisting of: (i) an initial tranche equal to twenty-five percent (25%) of the Purchase Price (the “Completion Consideration”) to be issued on or within one business day following the Closing Date, and (ii) the remaining seventy-five percent (75%) of the Purchase Price (the “Deferred Consideration”) to be issued in three equal tranches on the dates that are 90, 180, and 270 days after the Closing Date, respectively, subject to the terms of the SPA. On the Closing Date, the Company issued shares of Common Stock to the Sellers in satisfaction of the Completion Consideration. As of the date of this Annual Report, shares of Common Stock remain to be issued by the Company to the Sellers to satisfy the Deferred Consideration.

If the Company fails to timely issue any portion of the consideration when due under the SPA, the Company is required to pay interest on the overdue amount at a rate of four percent (4%) per annum above London Interbank Offered Rate ("LIBOR").

Pursuant to the SPA, the Company may withhold issuance of Deferred Consideration in connection with a warranty claim asserted by the Company under the SPA and may set off amounts owed by any of the Sellers against such Seller’s Deferred Consideration, in each case subject to the terms and conditions set forth in the SPA.

If a change of control of the Company occurs prior to the issuance of 100% of the Deferred Consideration, then, subject to the terms of the SPA, the Company is required to issue the remaining Deferred Consideration to the Sellers prior to such change of control.

The SPA contains customary representations, warranties, covenants, confidentiality provisions, and limitations on liability. In addition, certain Sellers who were employees, officers, or directors of Lexverify as of the Closing Date agreed for a period of twelve (12) months following the Closing Date, subject to the terms of the SPA, not to compete with Lexverify’s business as conducted at Completion and not to solicit certain customers, clients, employees, or consultants of Lexverify.

Additionally, pursuant to the SPA, the Company agreed to approve the continuing employment of Lexverify’s employees on substantially similar compensation and benefit terms to comparable team members of the Company, including equity participation opportunities.

•Acquiring ownership of Lexverify Ltd. and a 50% ownership interest in CyberFish CyberPsychology Solutions Ltd (both companies in the United Kingdom).

•Launching our Sovereign-AI initiative leveraging (inter alia) the expertise gained from the Lexverify acquisition.

Secured Promissory Note

On June 25, 2026, T Stamp Inc. entered into a Note Purchase Agreement (the “Note Purchase Agreement”) with Streeterville Capital LLC (the “Investor”) pursuant to which the Company issued a Secured Promissory Note (the “Note”) to the Investor in the principal amount of $5,510,000.

The Note carries an original issue discount of $500,000 (the “OID”). In addition, Company agreed to pay $10,000 to the Investor to cover Investor’s legal fees, accounting costs, due diligence, monitoring and other transaction costs incurred in connection with the purchase and sale of the Note (the “Transaction Expense Amount”). The OID and Transaction Expense Amount were included in the initial principal balance of the Note. The purchase price of the Note, therefore, was $5,000,000, computed as follows: $5,510,000 initial principal balance, less the OID, less the Transaction Expense Amount.

The Note accrues interest at nine percent (9%) per annum and is due and payable on June 25, 2028. The Company may prepay all or a portion of the outstanding principal and interest of the Note at any time. In addition, any time the Company receives any money in connection with any fundraising or financing transaction (including, but not limited to, any warrant exercises, “at the market” financing, equity line of credit or debt financing), it must immediately make a mandatory prepayment to the Investor in an amount equal to the lesser of (a) fifty percent (50%) of the amount raised in such transaction, and (b) the total outstanding balance due under the Note as of the closing date of such financing, payable within two (2) trading days of receiving such amount.

Further, beginning on June 25, 2027 (the “Redemption Start Date), the Investor has the right, in its sole discretion, to redeem up to a specified maximum monthly amount due under the Note by delivering one or more written redemption notices to the Company. Upon receipt of a redemption notice, the Company is required to pay the applicable redemption amount plus an Exit Fee (as defined further below) in cash within two trading days. If, by the end of any month following the Redemption Start Date, the Company has not reduced the outstanding balance by at least the maximum monthly redemption amount, the Company must pay the shortfall (plus the Exit Fee) in cash by the fifth day of the following month. Failure to do so will result in an automatic increase of the outstanding balance by 1% as of such date.

All payments made under this Note on or after December 25, 2026 (including, but not limited to, repayment of the Note at maturity or thereafter) will be subject to an exit fee of seven percent (7%) of the portion of the outstanding balance being repaid (the “Exit Fee”).

The Note includes customary default trigger events, including, among others: (i) failure by the Company to timely make payments due under the Note; (ii) bankruptcy or insolvency events involving the Company; (iii) the execution or consummation of a "Fundamental Transaction" (i.e. a merger, sale of all or substantially all assets, change of control, recapitalization, or other business combination or restructuring involving the Company or its subsidiaries that results in a change in voting power or asset ownership without full repayment of the Note); (iv) breaches of covenants or other agreements in the Note or related transaction documents; (v) material misstatements of representations or warranties; and (vi) entry of certain judgments against the Company. Upon the occurrence of a trigger event, the Investor may elect to increase the outstanding balance of the Note or require the Company to cure the event within five trading days. If uncured, the trigger event becomes an event of default. Upon an event of default, the Investor may accelerate the Note, making the outstanding balance immediately due and payable at the “Mandatory Default Amount,” and interest will begin accruing at a default interest rate of 22% per annum (or the maximum rate permitted by law). Certain insolvency-related trigger events result in an automatic default and acceleration without notice. Following an event of default, the Investor also has the right to seek injunctive relief prohibiting the Company from issuing shares of its common stock or preferred stock to any party unless fifty percent (50%) of the gross proceeds of such issuance are simultaneously used to repay the Note, and to seek injunctive relief preventing the Company from consummating any Fundamental Transaction if the Note is not being repaid in full upon consummation of the Fundamental Transaction. The Note also includes a waiver of offset and counterclaim rights by the Company.

Pursuant to the Note Purchase Agreement, the Company has agreed to certain additional covenants that remain in effect until all obligations under the Note, Note Purchase Agreement, and Security Agreement (collectively, the “Transaction Documents”) are paid and performed in full. The Company may not, without the prior written consent of the Investor (which consent may be granted or withheld in the Investor’s sole and absolute discretion): (i) issue or incur any debt obligations, other than ordinary-course trade payables, or issue any convertible securities, variable-price securities, or securities with price reset provisions; or (ii) grant any lien, security interest, or encumbrance on any of the Company’s assets to any third party. At-the-market facilities, fixed-price primary equity offerings, and warrants without variable pricing mechanics are not subject to this restriction. In addition, if the Company enters into any future financing with terms that are more economically favorable to the new investor than those provided to the Investor in the Transaction Documents, the Investor has the right to require that such more favorable terms be incorporated into the Transaction Documents on a retroactive basis.

The Company’s obligations under the Note are secured by all of Company’s assets as further described in the related Security Agreement between the Company and the Investor filed as Exhibit 10.50 to this Quarterly Report.

The foregoing is intended to be a summary of the Note Purchase Agreement, the Note, and the Security Agreement, and is qualified by reference to each of these documents which are filed as Exhibits 10.48, 10.49, and 10.50 to this Quarterly Report.

Sovereign AI

The Company believes that its initiative to provide the development and deployment of Sovereign AI models represents a substantial market opportunity for which the Company is well positioned given our 9-year experience in developing proprietary AI models for deployments in-the-cloud, on premises and on mobile devices.

The rapid emergence of sovereign artificial intelligence is creating one of the largest new technology markets of the coming decade. Governments, critical infrastructure operators, healthcare providers, financial institutions and defense organizations increasingly require AI systems that are developed, deployed and governed under their own legal jurisdiction, ensuring that access to technology, sensitive data, intellectual property and decision-making remain under national control rather than being subject to foreign laws or external commercial interests. Independent market research estimates the global sovereign AI market will exceed US$48 billion in 2026 and grow to approximately US$180 billion by 2033, while Europe is making digital sovereignty a strategic priority through major investments in sovereign AI infrastructure and cloud capacity. Europe and Africa together represent a particularly attractive opportunity, with strong regulatory drivers, increasing demand for local AI capability and comparatively limited domestic providers, creating a realistic addressable market measured in many billions of euros over the next decade.

Recent admissions by the operators and independent research have demonstrated that frontier AI models can exhibit unexpected and potentially harmful behaviors when given broad autonomy or exposed to adversarial inputs. Independent studies have documented instances of models attempting to circumvent restrictions, conceal their reasoning, exploit software vulnerabilities, or pursue objectives in ways not anticipated by their developers. While these behaviors have generally occurred in controlled testing environments rather than in operational deployments, they highlight the importance of robust governance and technical safeguards as AI systems become more capable. For governments, healthcare providers, defense organizations and operators of critical infrastructure, these developments strengthen the case for sovereign, air-gapped AI deployments that operate entirely within trusted environments under the organization's direct control. Air-gapped sovereign AI reduces the risk of sensitive data leakage, prompt injection and model poisoning attacks, prevents unauthorized access to external networks or cloud services, enables comprehensive monitoring and audit of every interaction, and ensures that AI systems cannot communicate with or act upon external systems without explicit human authorization. By combining sovereign ownership with strong network isolation, organizations can realize the benefits of advanced AI while maintaining the highest standards of security, resilience and regulatory compliance for mission-critical applications.

As frontier AI models become recognised as strategically important technologies, access to the most capable systems can no longer be assumed to be commercially available on equal terms worldwide. Recent U.S. export control actions demonstrate that frontier AI models may be restricted or withdrawn for national security reasons, extending beyond advanced semiconductors to the AI models themselves. In June 2026, Anthropic was directed by the U.S. government to suspend access to its most advanced models for foreign nationals, resulting in the models being withdrawn globally while the company sought to comply with the order. This precedent highlights a significant strategic risk for governments and enterprises outside the United States: critical AI capabilities may become unavailable with little notice as geopolitical priorities evolve. Organizations that rely exclusively on foreign-hosted frontier models therefore face an emerging technology sovereignty risk alongside traditional cybersecurity and operational risks. Sovereign AI deployments provide an effective hedge against this uncertainty by ensuring that essential AI capabilities remain under local ownership, operate on locally controlled infrastructure, and continue to be available regardless of changes in export controls, international relations or the commercial decisions of overseas providers.

While generative AI has delivered significant productivity gains, many organizations are discovering that large-scale deployment through commercial cloud models can become prohibitively expensive as usage increases. Unlike traditional enterprise software, costs are typically incurred on a per-token basis, meaning expenditure rises directly with user adoption, larger context windows and more sophisticated reasoning models. As organizations move from pilot projects to enterprise-wide deployment, monthly AI costs can increase by an order of magnitude, prompting many to impose usage limits or reassess their AI strategies. Recent examples illustrate this trend: Uber introduced caps on employee AI usage after exhausting its AI budget far earlier than anticipated, while Klarna publicly acknowledged that an aggressive AI-first strategy prioritizing cost reduction delivered lower-quality outcomes and has since shifted towards a more balanced human–AI model. Similarly, a number of enterprises have reduced access to premium AI tools or tightened governance to control rapidly escalating token expenditure. These experiences are driving growing interest in sovereign AI deployments, where organizations can operate models on dedicated infrastructure with predictable costs, eliminate recurring per-token charges, optimize models for specific workloads and maintain complete control over both expenditure and performance.

The Sovereign Technology Centre Limited is in the process of being established to meet this demand by developing a portfolio of sovereign AI products, including secure sovereign large language models, sector-specific AI assistants, sovereign cloud infrastructure, cybersecurity solutions, medical and financial AI applications, and ultra-small language models that can operate on edge devices and semiconductors. Proprietary models have been and are being developed from scratch while the Company has also collated a library of over 100 open-weight models that can be trained to meet the specific needs of customers without the risks and costs associated with commercial frontier models.

The Sovereign Technology Centre Limited is in the process of being established as a Malta corporation with the economic interests vesting in the Company but administration and governance vesting in a corporate board primarily comprising Maltese citizens and residents. It is believed that this structure will facilitate participation in EU projects and funding opportunities not currently open to the Company. as a US corporation.

The Sovereign Technology Center is the engine that will enable this vision. Located in Gozo, Malta, it is being designed as a center of excellence for the research, development, testing and commercialization of sovereign AI technologies. The Center will bring together AI engineers, cybersecurity specialists, data scientists, infrastructure experts and university graduates to develop secure AI systems that comply with European and African standards and utilize highly efficient proprietary servers powered by solar energy. The Center will function not just as a working environment but also as a demonstration site for interested nations.

Semiconductor Technologies

Trust Stamp Malta Limited, has been selected as a direct participant in the Important Project of Common European Interest on Advanced Semiconductor Technologies ("IPCEI AST"), with the support of Malta Enterprise.

The IPCEI AST is a major, coordinated European initiative backed by participating EU Member States and their national authorities, with the objective of strengthening Europe's sovereignty, security and resilience across the advanced semiconductor value chain. Bringing together industry and research participants from across the EU, it is designed to accelerate the development and first industrial deployment of next-generation chip technologies. IPCEI is one of the EU's principal instruments for funding strategic technologies; its predecessor in microelectronics, IPCEI ME/CT, mobilized up to €8.1 billion in public funding across fourteen Member States. The overall funding envelope for the Advanced Semiconductor Technologies wave is still being finalized.

Trust Stamp's selection positions its privacy-first identity technology within this strategic effort by binding the identity of a device to a verified human identity, so that critical hardware can be trusted to operate only in authorized hands. This work will build on Trust Stamp's patented approach to irreversible biometric tokenization, which protects personal data while enabling strong, privacy-preserving authentication. Trust Stamp's participation is anchored by two cooperation agreements planned to run over the project period (2027 - 2032), subject to formal approval:

•A secure semiconductor identity platform: a collaboration to design a platform that links device identity to a verified human identity, combining hardware-rooted security (including memristor-based physically unclonable functions) with Trust Stamp's biometric tokenization to help prevent the unauthorized use of critical devices across communications, IoT and safety-critical systems.

•AI-supported processing of neural signals: a collaboration exploring the AI-assisted processing and analysis of neural-signal data generated by an emerging biosignal-chip platform, paired with secure device authentication to protect highly sensitive data at the hardware level.

In furtherance of this, we have filed a provisional patent with the United States Patent and Trademark Office for an LLM implementation entitled “Consensus Medical”. The implementation evaluates and challenges and affirms medical practitioner diagnosis as appropriate, using three independent models in a structure designed to minimize the potential for sycophantic responses and hallucinations. Consensus Medical supports and is not intended to replace the expertise of qualified medical practitioners.

Commencing January 2026 the Company commenced provisioning services for a multinational telecommunications corporation operating in Africa and the range and scope of services has grown significantly over the course of the year. In Q2 the Company billed this customer $192 thousand for deliveries made, and the engagement is at a level such that going forward this Telecom will be classified as a Key Customer.

Adjusted EBITDA loss (non-GAAP) for the three months ended June 30, 2026, increased by $894 thousand, to $2.12 million loss from a $1.23 million loss for the three months ended June 30, 2025. The overall increase of $894 thousand in Adjusted EBITDA loss (non-GAAP) was driven primarily by an increase in Cost of services, Research and development ("R&D"), and Selling, general, and administrative ("SG&A") expenses. The increase in SG&A expense was driven by a $196 thousand increase in salaries, stock-based compensation, payroll costs, and sales commissions during the three months ended June 30, 2026 compared to the prior period. Cost of services increased by $94 thousand during the three months ended June 30, 2026 in tandem with the increase in Net revenue. Additionally, during the three months ended June 30, 2026, R&D expense increased by $227 thousand due to higher personnel-related costs associated with the expansion of the Company’s development team and annual merit adjustments that took effect in June 2026, retroactive to January 2026. This increase in R&D also included $30 thousand for the reengaging of personnel from 10Clouds to assist the Company's development team. Additionally, the Company incurred $250 thousand for financial advisory fees in relation to the closing of the Streeterville Capital LLC Note Purchase Agreement and recorded the fees to Other expense during the three months ended June 30, 2026.

Adjusted EBITDA loss (non-GAAP) for the six months ended June 30, 2026, increased by $687 thousand, to $3.75 million loss from a $3.07 million loss for the six months ended June 30, 2025. The overall increase of $687 thousand in Adjusted EBITDA loss (non-GAAP) was driven primarily by an increase in Cost of services, R&D, and SG&A expenses. SG&A expense was driven by a $364 thousand increase in salaries, stock-based compensation, payroll costs, and sales commissions during the six months ended June 30, 2026 compared to the prior period. Cost of services increased by $138 thousand during the six months ended June 30, 2026 in tandem with the increase in Net revenue. Additionally, during the six months ended June 30, 2026, R&D expense increased by $373 thousand due to higher personnel-related costs associated with the expansion of the Company’s development team and annual merit adjustments that took effect in June 2026, retroactive to January 2026. This increase in R&D also included $112 thousand for the reengaging of personnel from 10Clouds to assist the Company's development team. Additionally, the Company incurred $250 thousand for financial advisory fees in relation to the closing of the Streeterville Capital LLC Note Purchase Agreement and recorded the fees to Other expense during the six months ended June 30, 2026.

The overall increase in Adjusted EBITDA loss (non-GAAP) during the six months ended June 30, 2026 was partially offset by an increase in Net revenue of $299 thousand when compared to six months ended June 30, 2025. The majority of the increase in Net revenue during the six months ended June 30, 2026, or $415 thousand, was attributable to the Company's S&P 500 bank customer resulting from the Company entering into a contract amendment with this customer. The amendment extended the term of the existing agreement until May 31, 2031, with minimum gross revenue exceeding $12.7 million. It provides for changes to the fee structure as well as a new feature development and platform updates.

During the three months ended June 30, 2026 the Net revenue increased by $87 thousand compared to the three months ended June 30, 2025, with increases fueled by growth across new and existing customers. The Company entered into new technical, implementation, and general professional services SOWs with a multinational telecommunications corporation operating in Africa. Services rendered under this engagement consisted of the Company's Trust Stamp Extended Biometric Service, encompassing biometric enrollment and one-to-one (1:1) biometric matching functionality. Work performed under this arrangement is governed by a customer-issued purchase order, pursuant to which the Company recognized revenue of $192 thousand three months ended June 30, 2026. The Company continues to view the African telecommunications and identity-verification market as a strategic growth opportunity, given the regulatory emphasis on subscriber identity assurance within the Unified License Scheme framework.