Item 9A. Controls and Procedures

Smurfit Westrock’s management evaluated the effectiveness of the design and operation of its disclosure controls and procedures (as

such term is defined in Rules 13a-15(e) and 15d-15(e) under the Exchange Act) as of the end of the period covered by this report.

Disclosure controls and procedures include, without limitation, controls and procedures designed to ensure that information required to

be disclosed by the Company in the reports that it files or submits under the Exchange Act is accumulated and communicated to the

Company’s management, including its principal executive and principal financial officers, or persons performing similar functions, as

appropriate to allow timely decisions regarding required disclosure. Disclosure controls and procedures are designed by the Company

to ensure that it records, processes, summarizes and reports in a timely manner the information it must disclose in reports that it files

with or submits to the SEC. Anthony Smurfit, President & Group Chief Executive Officer, and Ken Bowles, Executive Vice President

& Group Chief Financial Officer, reviewed and participated in management’s evaluation of the disclosure controls and procedures.

Based on this evaluation, Anthony Smurfit, President & Group Chief Executive Officer, and Ken Bowles, Executive Vice President &

Group Chief Financial Officer, concluded that as of the end of the period covered by this Annual Report on Form 10-K, Smurfit

Westrock’s disclosure controls and procedures were effective, and the previously reported material weakness described below has

been remediated.

Remediated Material Weakness in Internal Control over Financial Reporting

A material weakness is a control deficiency, or combination of deficiencies, in internal control over financial reporting such that there

is a reasonable possibility that a material misstatement of annual or interim financial statements will not be prevented or detected on a

timely basis.

Smurfit Westrock’s management had previously identified and reported a material weakness relating to the company’s selection and

development of control activities intended to mitigate the risks to achieving its objectives. This related to certain processes and

controls principally at historical Smurfit Kappa that were not subject to the requirements of Section 404 of SOX prior to the

Combination between Smurfit Kappa and Westrock discussed elsewhere in this Annual Report.

This material weakness was the result of:

• A lack of formalization of an existing control process for documenting evidence of management review and performance of

control procedures, including the level of precision in the execution of controls and procedures to ascertain completeness and

accuracy of information produced by the Company.

• Existing controls related to the preparation and review of manual journal entries not designed to adequately mitigate the

associated risks.

• The need to augment General IT Controls, specifically as they pertain to (i) logical access controls to ensure appropriate

segregation of duties and that adequately restrict user and privileged access to financial applications, programs, and data to

appropriate Company personnel and (ii) program change management controls to ensure that information technology

program and data changes affecting financial IT applications and underlying accounting records are identified, tested,

authorized and implemented appropriately.

Remediation Plan

In response to the material weakness, we designed and implemented remediation measures whereby we:

• designed and implemented policies and guidance related to the operation of controls; complemented by training of control

operators, with a specific focus on the priority areas documented in the remediation plan;

• developed appropriate controls over the review of manual journal entries - automated approval workflows for manual journal

entries were implemented at relevant material locations, as well as an additional risk-based interim manual control; and

• enhanced and expanded the general IT processes and controls across the organization which included strengthening user and

privileged access controls as well as change management controls.

Testing to validate the effectiveness of these remediation efforts was conducted over a sustained period in 2025 and confirmed that the

material weakness was remediated as of December 31, 2025.

Management’s Report on Internal Control over Financial Reporting

Management is responsible for establishing and maintaining adequate internal control over financial reporting, as defined in Rule

13a-15(f) of the 1934 Act. Management has assessed the effectiveness of our internal control over financial reporting as of December

31, 2025 based on criteria established in Internal Control — Integrated Framework (2013) issued by the Committee of Sponsoring

Organizations of the Treadway Commission. As a result of this assessment, management concluded that as of the end of the period

covered by this Annual Report on Form 10-K, Smurfit Westrock maintained effective internal control over financial reporting, and the

previously reported material weakness has been remediated. The effectiveness of our internal control over financial reporting as of

December 31, 2025 has been audited by KPMG, an independent registered public accounting firm, as stated in their report, which is

included in Part II, Item 8 of this Annual Report on Form 10-K.

Changes in Internal Control over Financial Reporting

Other than the changes that resulted from the integration following the Combination and remediation actions described above, there

has been no change in Smurfit Westrock’s internal control over financial reporting (as such term is defined in Rules 13a-15(f) and

15d-15(f) under the Exchange Act) during the three months ended December 31, 2025 that has materially affected, or is reasonably

likely to materially affect, Smurfit Westrock’s internal control over financial reporting.