Protocol version 2 - Summary of Changes: - Typographical and administrative changes - Changed dose escalation to dose evaluation/escalation - Expanded inclusion criterion 1c with broader definitions extreme hyperdiploidy or hypodiploidy - Added further clarity for high-risk CNS relapse subjects in inclusion criterion 1i and exclusion criterion 1 - Clarified screening window i.e. Day -84 to Day -35 - Clarified the inpatient period in the case of a split dose i.e. 30 (-3/+5) days post-AUTO3 infusion and up to 14 days after the second split dose - Added text to clarify when the second split dose can be administered i.e. only at ≤ Grade 1 CRS and no ongoing CRS or neurotoxicity at Day 7 - Clarified the procedure for re-starting the trial following a halt as per the safety stopping criteria - Clarified DLT period of 30 days (±3 days) after last dose or until start of a new ALL therapy - Added hypoxia risks and mitigation strategy, respiratory toxicity guidelines - Added GVHD risks and mitigation strategy as per the Investigator’s Brochure - Clarified early use of tocilizumab for CRS safety management - Added text to note patients will be monitored for CMV weekly during admission or as necessary - Updated frequency of IDMC meetings to every 6 months in Phase II. Added text regarding the information received and the decision(s) that can be taken by the IDMC, particularly with regards to opening Phase II - Updated the withdrawal of consent for patient samples stored for research

Protocol version 3 - Summary of Changes: - Typographical and administrative changes - Updated and added new exclusion criteria - Clarified Rolling 6 Dose Evaluation Decision Rules - Added details on which blast count will be used to choose the cohort for a subject - Added that subjects must have a full neurological assessment prior to pre-conditioning (Day -7) - Amended central laboratory for MRD analysis from Great Ormond Street to Bristol Genetics Laboratory - Updated Management of CRS text - Updated concomitant medications and therapies

Protocol version 4 - Summary of Changes: - Typographical and administrative changes - Updated schedule of events - Added up to 3 dose levels for Phase 1 and clarified that each dose level will have 2 cohorts - Added interim analysis on safety and preliminary efficacy - Updated study product wording for AUTO3 - Changed dose evaluation to dose escalation - Increased the number of patients needed for Phase I from 12-18 to 18-30. And increased the total number of patients needed for the whole study from 50 to 62 - Modified pre-conditioning regimen - Timing of 2nd split dose reduced from 14 days (+/- 7d) to 5-10 days - Updates to inclusion and exclusion criteria - Addition of available clinical data in the first 3 patients treated with CD19/CD22 CAR-positive T cells - Clarification of use of data from re-treated patients - SEC recommended to declared the Cohort 1 dose as safe and escalate dose for subsequent patients to 3x10^6 CD19/CD22-positive CAR-T cells/kg and further if needed to establish a RP2D - Modified text based on recently published data indicating that patients at risk of severe CRS or neurotoxicity develop signs and symptoms very early and early dosing of the second fraction between day 5-10 is likely to maximise the potential effect of pre-conditioning induced cytokines on AUTO3 without increasing the risk of severe toxicity - Updated DLT criteria - Clarified text regarding patients with ≥25% blasts can be treated with single doses if both single and split doses are determined to be safe - Revised Safety Stopping Criteria - Dosing caveat added to increase patient safety - Updated text regarding re-treatment of patients - Updated the CRS management guidelines - Update the tocilizumab dosing guidelines to match the current label - Revised concomitant medications text - Updated dietary and lifestyle restrictions - Clarified interim analysis text - Clarified study discontinuation text - Clarified monitoring text

Protocol version 5 - Summary of Changes: - Clarified exclusion criteria - Updated schedule of events

Protocol version 6 - Summary of Changes: (US only; not implemented) - Typographical changes - Revised text regarding single or split doses based on disease burden, but clarified they will be analysed as one group - Updated DLT definition based on FDA recommendation - Made corrections to the risks and mitigations section

Protocol version 7 - Summary of Changes: (implemented in v. 8) - ‘Young adult’ has been replaced by ‘adult’ - Inclusion of a potential 4th dose level, that increases the total number of paediatric/young adult patients required for Phase I to 24-36 - Inclusion of an adult cohort (≥25 years), which adds 12-24 patients into Phase I - Update to Infectious Disease Screening - Reduction of blood volume required for RCR testing and insertional mutagenesis from 10ml to 5 - Update to paediatric/young adult exclusion criteria - Update of window for DLT period at Day 30 to ±3 days - The recommended in-patient stay after AUTO3 dosing in Phase I has been reduced from 30 (-3/+5) days to 14 days, or longer if necessary. In Phase II the duration of admission to hospital will be based on emerging data and the patient’s condition. Patient may be discharged before 14 days or treated as out patients - MRD will now be analysed at all time points by both PCR and flow - Bone marrow and cerebrospinal fluid tests at Day 0 removed - Frequency of blood tests for cytokines and CAR T cells reduced - Immunological profiling will be done in Phase I only - Schedule of assessments updated - Update to the clinical data in AUTO3-PA1 to new data - Update to secondary objectives and endpoints - The SEC has agreed that Cohort 2b (3x10^6/kg split dose) should be closed after 1 patient as it is deemed sub-therapeutic - A minimum of 6 patients need to be treated in a cohort before it can be declared as the phase 2 dose - Updated DLT definition - Updated text in risks and mitigation section - Clarification of patients going on hold before dosing - Update to information on the administration of AUTO3 - New text added to Monitoring During and After Drug Administration section - Definitions of relapse disease have been clarified - New text added for HRQOL measures and bridging therapy - New CRS/MAS treatment option - Updated Lee et al, 2018 guidance - CTCAE version updated to v5.

Protocol version 8 - Summary of Changes: - The recommended in-patient stay after AUTO3 dosing has been returned from 14 days to 30 days (±3), or longer if necessary for monitoring and management, per MHRA request - The following text was deleted: AEs such as severe cytopenias that require re-hospitalization within 30 (±3) days of AUTO3 because the patient was discharged early should not be automatically reported as SAEs unless clinically indicated ex febrile neutropenia - Reporting of prolonged Grade 4 cytopenia lasting more than 60 days: text moved and clarification added - BMA immunophenotyping and flow MRD tests at screening