Addnode Group

Reference: page 52

Sustainability governance rests on the Group's existing structure, with responsibilities split between the Board, the President and CEO, and Group Management (p.52). "The Board has seven members, all non-executive. No employees or other workers are represented on the Board." Three of the seven, "corresponding to 43 percent, are women", and "Five out of seven Board members, or 71 percent, are independent of the company and its major shareholders"; Staffan Hanstorp and Jonas Gejer are former employees and, through Aretro Capital, also major shareholders. The Group "applies rule 4.1 of the Swedish Corporate Governance Code as its diversity policy".

The Board "has overall responsibility for the company's organization and administration as well as for the Group's sustainability agenda", sets targets, monitors outcomes and "is responsible for the Sustainability Report". In-depth responsibility sits with the Audit Committee, where "Sustainability is often a standing item at committee meetings." Group Management is the CEO, CFO, Head of M&A and the three Division Presidents.

A second GOV-1 entry opens the business conduct chapter (p.78), adding that the Board holds ultimate responsibility for business ethics, anti-corruption and compliance, delegated to each subsidiary board and then to its President.

Reference: page 52

"Addnode Group's CFO is the member of Group Management responsible for sustainability. Addnode Group's Head of Sustainability reports to the CFO." Together they ensure the Board, CEO and the rest of Group Management "are regularly kept informed about sustainability-related matters that are material to the Group's operations, risk management and strategic direction" (p.52). The CFO keeps the Board updated on the framework for sustainability-related due diligence, "including results, risks and the effectiveness of related processes", while the Head of Sustainability gives regular updates to the Audit Committee on sustainability matters, risks, internal controls and reporting.

In 2025 the Head of Sustainability "gave several presentations to the Board and Audit Committee", covering the results of the updated double materiality assessment, the status of sustainability due diligence and progress in implementing the CSRD and the ESRS. The Board and its committees worked on four listed items: review of reporting under the EU Taxonomy; progress on review of the double materiality assessment; the internal quality control and risk management system for sustainability reporting; and a draft of the Sustainability Report prepared under the CSRD including Taxonomy disclosures (p.52). No frequency of reporting or list of the specific IROs addressed per meeting is given.

Reference: page 53

A nil return. "In 2025, Addnode Group did not have any incentive programs or remuneration policies for the Board, CEO or other senior executives related to sustainability targets or outcomes" (p.53). The climate chapter carries an E1 GOV-3 heading but adds nothing, repeating only the cross-reference: "For more information on how sustainability performance impacts remuneration, see page 53 under ESRS 2" (p.62).

That single sentence is the whole disclosure. Because no sustainability-linked incentive exists, the consequential datapoints under this requirement (the percentage of variable remuneration tied to sustainability or climate considerations, the body that reviews the terms, and the GHG reduction targets used in the scheme) do not arise. The contrast with the Group's own target structure is worth noting: a 2030 gender-balance target is set and followed up annually by Group Management (p.74), and a Code of Conduct training completion rate is reported to Group Management and the Board (p.79), but neither is attached to executive pay.

Reference: page 53

GOV-4 is presented as a four-row mapping table that points each element of due diligence to the section of the Sustainability Report covering it (p.53):

• "a) Engaging with affected stakeholders in all key steps of the due diligence" maps to GOV-2, SBM-2, IRO-1 and MDR-P.
• "b) Identifying and assessing adverse impacts" maps to IRO-1, SBM-3 and the due diligence process.
• "c) Taking actions to address those adverse impacts" maps to S1-4 and the due diligence process.
• Row (d), "Tracking the effectiveness of these efforts and communicating", maps to MDR-T and the due diligence process.

The table is the complete disclosure; no narrative accompanies it. Two features are worth a reader's attention. First, row (c) points only to S1-4, which is consistent with own workforce being the single topical chapter in which actions are described, but it leaves the climate and business conduct chapters outside the due diligence map. Second, row (d) invokes MDR-T even though the climate chapter states that no quantitative climate targets have been set (p.62); the tracking that does exist is the gender-balance target (p.74) and the Code of Conduct training completion rate (p.79).

Reference: page 53

Reporting "follows the Group's established principles and processes for external reporting, risk management and internal controls" and is "centrally coordinated by the Group's Head of Sustainability in close collaboration with the finance function and other relevant support and business units" (p.53). Internal control is "based on the systematic identification and assessment of risks, with a focus on the most material risks and opportunities" and is structured in line with the Group-wide internal control framework.

The risks are named: "The primary risks in Addnode Group's process for sustainability reporting pertain to the completeness and accuracy of the data reported." The response is "a clear governance and control model that defines roles, responsibilities and control activities", and "Reporting is primarily carried out through a dedicated system for sustainability reporting, enabling traceability and transparency in data flows". The Head of Sustainability "provides regular updates to the Audit Committee on risks and control activities pertaining to sustainability reporting".

No findings from internal control testing over the period are disclosed, and no description is given of how control deficiencies identified in 2025, if any, were remediated.

Reference: page 54

Addnode Group "generates sustainable value growth by acquiring new companies and actively supporting our subsidiaries to drive organic growth" (p.54). Through its subsidiaries it offers "digital solutions that enable the design, production, management and administration of a sustainable society", built on a mix of own software, own add-ins to partner software and partner software, complemented by implementation, integration, training, administration and packaged services. "In 2025, recurring revenue accounted for 63 percent of the Group's total revenue." Operations are organised in three divisions, Design Management, Product Lifecycle Management and Process Management, under "a decentralized governance model". The largest markets are Sweden, the USA, the UK and Germany.

Two exclusion statements are given: "Addnode Group does not operate in any high-risk sectors such as fossil energy, chemicals production, tobacco production or cultivation, or manufacturing of controversial or banned weapons", followed by the caveat "It is difficult to know how our customers use the digital solutions we provide."

The value chain map (p.55) sets out upstream software, IT infrastructure and consulting partners; own operations; and downstream customers, with material aspects named per stage: "Responsible supplier relationships" upstream, workforce, climate and ethics topics in own operations, and "Climate impact" downstream.

Reference: page 55

Stakeholder engagement is framed as "an integral part of its sustainability work and the double materiality assessment" (p.55). The identified primary groups are "customers, employees, collaborative partners, suppliers, shareholders, investors, banks and society", engaged through customer and employee surveys, sustainability workshops, supplier evaluations, investor dialogues and sector organisations.

Quantified 2025 engagement, with 2024 in brackets: all but two companies ran customer surveys, in which 1,400 (1,618) individuals responded, producing company-level NPS results ranging "between -30 and +80 (-22 and +93)"; all companies ran employee surveys, with 2,072 (2,108) responses and a Group employee Net Promoter Score of 28 (30); "379 (347) suppliers confirmed that they follow a Supplier Code of Conduct from either Addnode Group or one of the subsidiaries"; and the Group met 136 (148) investors, attended 6 (7) investor conferences, and had 31 (37) shareholder representatives at the AGM representing 80 percent (74) of the votes.

A five-row table (p.56) gives, per stakeholder group, the dialogue type, its goal, the prioritised sustainability matter and "How Addnode Group incorporated the results". The disclosure does not say how the views of affected stakeholders changed any specific decision in 2025.

Reference: page 57

SBM-3 lists the material IROs in four blocks (p.57). Negative impacts: climate change mitigation across the entire value chain, where "emissions still arise from owned and leased vehicles, office premises, business travel, and purchased goods and services" (actual); corruption across the entire value chain (potential); workers in the value chain (potential); protection of whistleblowers in own operations and downstream (potential); gender equality in own operations, covering "unconscious bias in recruitment and promotion as well as possible discrepancies in terms of equal pay for work of equal value" (actual); and employee well-being, where "Excessive workloads could lead to stress-related risks" (actual). The single positive impact is training and skills development in own operations (actual).

Page 58 states the financial effects plainly: "The material sustainability-related risks and opportunities are not currently deemed to have any material impact on Addnode Group's financial position, earnings or cash flows." It lists six material risks (climate change mitigation, gender equality and diversity, employee well-being, corruption, supplier management, whistleblowing) and one material opportunity (training and skills development), and maps the material matters to E1, S1 and G1.

Reference: page 59

The Group "applies a double materiality assessment that covers the entire value chain", based "on the principles of due diligence" and "integrated into the Group's overall risk management" (p.59). Impacts are scored on severity (scope, scale, irremediable character), with likelihood added for potential impacts; financial materiality is assessed "based on potential impacts on earnings, financial position, cash flow and reputational risk in combination with likelihood". Inputs include sector analysis, review of frameworks and legislation, peer comparison and stakeholder interviews. Method notes give "Scales for assessment (for example, 1–5)", three time horizons (short-term up to two years, medium-term three to five, long-term longer than five) and "Weighting and thresholds to determine materiality". The result is "documented in a materiality matrix", and "the entire Board confirms the double materiality assessment".

Two gaps are disclosed rather than concealed: "No comparisons with the preceding period are provided since this is Addnode Group's first reporting period under the CSRD", and the thresholds themselves are described only by example.

Topic-level additions follow on page 60, and a business-conduct IRO-1 appears on page 78. Climate-specific risk identification is also presented under E1-2 (2025 ESRS numbering).

Reference: page 60

IRO-2 is unusually thin, and this matters for anyone reading the statement. It says the material IROs "were identified and evaluated through Addnode Group's double materiality assessment, which covered all sustainability topics in accordance with ESRS 1 AR 16", and that "Information in the Sustainability Report is based on the disclosure requirements applied within the ESRS framework and on datapoints derived from other relevant EU legislation. A complete list of the datapoints derived from other EU legislation is presented in the Appendices to the Sustainability Report on pages 80–81" (p.60).

There is no table of the disclosure requirements covered. The statement prints no ESRS content index or concordance listing each DR against a page. What pages 80-81 contain is the narrower Appendix B table, "Datapoints derived from other EU legislation (ESRS 2 IRO-2)", with columns for the disclosure requirement, the related datapoint, the SFDR, Pillar 3, Benchmark Regulation and EU Climate Law references, and a section and page. Its legend reads "SUS – Sustainability Report", "CGR – Corporate Governance Report" and "N/A – Non-material disclosure for Addnode Group".

Classification on this page therefore rests on the printed DR headings inside the statement, the N/A markers in that appendix, and the explicit non-materiality statements on page 60.

Reference: page 62

A negative disclosure, stated without hedging: "Addnode Group does not currently have a transition plan in place to mitigate climate change and to ensure that the Group's strategy and business model are compatible with the transition to a sustainable economy and the goal to limit global warming to 1.5 °C, in line with the Paris Agreement" (p.62).

What exists instead is preparatory work: "Work has commenced to assess how best to develop a transition plan. The evaluation is based on the complete GHG data collected and calculated for 2024 and 2025. This data will form the basis for formulating long-term targets and prioritized actions during the coming years." No date is given for adoption of a plan.

The Group then reframes its contribution: "Addnode Group believes that its largest contribution to climate change mitigation is through the Group's digital solutions, which promote sustainable design, circular economy, resource efficiency and reduced environmental impact among its customers and collaborative partners." That claim is not quantified here, and the EU Taxonomy analysis reaches the opposite conclusion on eligibility, finding that the Group's solutions "are not directly considered to make a substantial contribution to reducing GHG emissions" (p.66).

The Appendix B table marks E1-1 paragraphs 14, 34 and 38 "N/A – Non-material disclosure for Addnode Group" and paragraph 16(g) as reported on page 62 (p.80).

Reference: page 60

Back-filled from the E1 additional information under ESRS 2 IRO-1 (page 60) and the climate-chapter ESRS 2 SBM-3 (page 62), where this content is disclosed in the FY2025 report. This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

Risk classification is explicit and one-sided: "All identified climate-related risks are classified as transition risks, meaning political, market, financial and technological changes related to the transition to a low-carbon economy. Exposure to physical risks is limited, such as disruptions to office premises during extreme weather events" (p.60). Page 62 extends physical exposure to "office operations or supply chains".

On methodology: "The process combined internal dialogues with advice from external environmental specialists. A supplementary environmental analysis was carried out with a focus on available emissions data and other climate-related impacts, including future development and transition events according to the Application Requirements in ESRS E1. The current analysis did not identify any additional material future risks beyond those reported."

No scenario analysis was performed. "Addnode Group continuously evaluates possible improvements, such as developing scenario analyses as data and capacity improve" (p.60). No named scenario, temperature projection or quantified exposure by time horizon is given.

Reference: page 58

Back-filled from ESRS 2 SBM-3, "Resilience of strategy and business model" (page 58), and the climate-chapter ESRS 2 SBM-3 (page 62), where this content is disclosed in the FY2025 report. This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

The resilience statement is asserted rather than tested: "Given the nature of Addnode Group's operations, exposure to transition-related climate risks is deemed to be low. The Group's business model is considered to be resilient in terms of expected regulatory, market and technological changes associated with the transition to a low-carbon economy" (p.62). Page 58 grounds long-term competitiveness in "the Group's ability to adapt to technological developments, address environmental risks and take advantage of opportunities in digitalization and sustainability".

Because no scenario analysis was carried out (p.60), there are no scenario results to inform the assessment, no disclosed areas of uncertainty and no account of the capacity to redeploy or adapt assets over the three time horizons. The transition-plan limb cannot be met either, since the Group "does not currently have a transition plan in place" (p.62). This is a resilience conclusion without a documented resilience analysis behind it.

Reference: page 62

Climate and environmental work is governed by "the Group's Code of Conduct and Sustainability Policy, which cover its responsibilities for people, society and the environment. The policy is based on international standards such as UN and ILO guidelines" (p.62). The policy's emphasis is on the product rather than the footprint: it "states that Addnode Group's largest climate benefit is achieved through the development of digital solutions that contribute to sustainable social development and resource efficiency". The Group "also takes responsibility for its direct environmental impact, primarily linked to office premises, energy consumption and business travel".

The key admission is made plainly: "There is currently no separate climate or environmental policy, but Addnode Group plans to further develop its work related to climate change mitigation and adaptation as data quality, risk assessments and governance procedures are refined."

Accountability is specified. "The Board has the overall responsibility for implementing the Code of Conduct and Sustainability Policy as well as for approving it on an annual basis", while the CEO is responsible for collecting and following up climate data "according to the GHG Protocol" and reporting annually to the Board. The policy is published at addnodegroup.com and on the intranet. No scope exclusions or coverage percentage are given.

Reference: page 62

Another negative disclosure: "Addnode Group has not yet adopted a climate change action plan. During the current reporting period, the focus has been on establishing a reliable foundation for sustainability reporting and ensuring quality in the collection and calculation of GHG data" (p.62).

The reason offered is proportionality plus intent: "While direct GHG emissions from operations were deemed to be relatively limited, Addnode Group strives to be a responsible actor and, over time, will intensify its work to reduce the climate impact of its own operations and in the value chain." No named mitigation or adaptation action, no decarbonisation lever, no CapEx or OpEx allocation and no expected emission reduction is given, and no year is set for adopting a plan.

Two items elsewhere in the statement bear on resourcing even though they are not presented as climate actions: the Taxonomy review of 2025 CapEx covers "vehicle leases (SEK 15 m) and new and extended lease contracts in the year (SEK 70 m)", and the conclusion is that "none of the CapEx qualifies as Taxonomy-aligned", with the Group holding "a number of hybrid vehicles" that do not meet the Taxonomy CO2 threshold (p.67). The Group's stated largest contribution remains its customers' use of its software (p.62), which is not an action under its own control.

Reference: page 62

"Addnode Group has not yet established any quantitative targets related to climate change mitigation in accordance ESRS E1-4" (p.62). That is the disclosure, and it is a complete answer rather than a silence.

The stated reason and timetable: "The Group intends to begin work to establish climate-related targets and indicators in 2026, based on the complete GHG data prepared for 2024 and 2025 and the ongoing work to improve data quality, risk assessments and transition strategies. Since complete GHG data was only completed in the last two years, the Group has chosen to wait with setting targets until more reliable data is available."

No base year, no target year, no absolute or intensity reduction percentage, no Scope 3 ambition and no reference to a 1.5°C pathway or to SBTi validation appear anywhere in the climate chapter. The only disclosed climate trend is therefore backward-looking: total market-based emissions of 20,145 tCO2eq in 2025 against 20,853 tCO2eq in 2024, with the Group itself cautioning that "Changes between years are therefore largely due to changes in methodology" (p.63). Against that, GHG intensity moved the wrong way, rising 29 percent to 3.48 tCO2eq per SEK m of net revenue on a market-based basis, which the Group attributes in part to Autodesk's transition to a new transaction model (p.63).

Reference: page 63

The most substantive environmental disclosure in the statement. Market-based totals: 20,145 tCO2eq in 2025 against 20,853 in 2024; location-based 20,219 against 20,700 (p.63). Scope 1 is 265 tCO2eq (308), and 0 percent of it falls under regulated emission trading schemes. Scope 2 is 1,216 (1,147) location-based and 1,142 (1,300) market-based, and "0 percent of the market-based GHG emissions in Scope 2 are linked to contractual instruments." Scope 3 totals 18,738 (19,245) across ten categories: purchased goods and services 12,057; capital goods 474; fuel and electricity 129; upstream transport 12; waste 299; business travel 1,522; employee commuting 3,977; use of sold products 161; end-of-life 8; investments 99. Categories 8, 9, 10, 13 and 14 are N/A. The split is Scope 1 one percent, Scope 2 six, Scope 3 93 (p.64).

Intensity rose: market-based GHG per net revenue 3.48 tCO2eq/SEK m against 2.69, up 29 percent (p.63).

Data quality is disclosed candidly. Scope 3 uses "secondary data (spend-based approach) linked to the Group's cost data, meaning that there is a high degree of uncertainty in the data. No primary data from suppliers was used during the period" (p.64). Companies acquired in 2025 are excluded (p.63).

Reference: page 72

"Addnode Group's Board of Directors has the ultimate responsibility for the Group's sustainability efforts, including matters related to employees. Addnode Group's Code of Conduct and Sustainability Policy are the most important governance documents in this area. There is also a Group-wide policy on alcohol, drugs and gambling" (p.72). Implementation "is the responsibility of the board of each subsidiary, which in turn delegates this responsibility to the President of each subsidiary".

Coverage is described at topic level: "Policies cover topics such as non-discrimination, forced labor and child labor." One gap is stated rather than left implicit: "A policy to prevent workplace accidents has not been deemed necessary for Addnode Group's operations."

The disclosure then lists subsidiary certifications held at the end of 2025 as its evidence of management systems: Symetri UK ISO 9001; SWG ISO 9001 and ISO 27001 outside the Nordics; all of Technia's major offices ISO 9001 and ISO 14001; Decerno and Sokigo ISO 27001; Decerno, Icebound and Sokigo FR 2000; and Decisive holding Miljøfyrtårn.

The Appendix B table marks S1-1 paragraphs 20 and 23 as reported on page 72, and paragraphs 21 and 22 as "N/A – Non-material disclosure for Addnode Group" (p.81).

Reference: page 72

Short but specific: "Addnode Group has established processes for employee dialogues, including regular eNPS surveys, appraisal interviews and engagement activities. The results are shared openly and used to follow up commitment, work-life balance and well-being" (p.72). A cross-reference sends the reader to ESRS 2 for how workforce interests inform strategy (p.55).

The quantified engagement sits in SBM-2: "All companies carried out employee surveys. In total, 2,072 (2,108) employees responded to the question that measures employee engagement... Addnode Group's total employee Net Promoter Score was calculated as 28 (30)" (p.55). S1-4 adds that risks are identified from "Annual employee surveys (eNPS) and appraisal interviews" and from "Dialogues with stakeholders such as employees, trade union representatives, investors and customers" (p.73).

Two elements the requirement asks for are missing: no global function or named senior role is identified as operationally responsible for ensuring engagement happens, and beyond the single reference to trade union representatives there is no description of how workers' representatives or any works council are involved, nor of engagement with particularly vulnerable groups.

Reference: page 73

"Addnode Group has established channels for employees to report concerns, grievances/complaints or suspected violations. Addnode Group provides internal reporting pathways through managers or HR as well as an external whistleblower channel to enable anonymous reporting, with protection against retaliation" (p.73). Handling is standardised: "Grievance/complaint handling is based on standardized processes for receipt, investigation and action."

On awareness and trust the Group asserts rather than measures: "Addnode Group believes that employees are aware of these channels and trust them, based on ongoing communication, training and follow-up in HR processes and employee surveys." No awareness percentage is reported.

The channel is detailed further under business conduct: the Whistleblower Policy "applies for all employees, consultants, suppliers and other stakeholders in Addnode Group's value chain", cases "are managed by independent functions with complete confidentiality", and "The Group has zero tolerance for retaliation" (p.78). Volumes are low: zero cases through the whistleblower function in 2025 against one in 2024, within a total of 2 (7) cases reported to HR and whistleblowing functions (p.76). The Appendix B table records paragraph 32(c) as reported on page 78 (p.81).

Reference: page 73

The longest disclosure in the statement. The Group describes "a structured process for identifying, evaluating and deciding on actions related to potential and actual negative impacts on its own workforce", led by the central Sustainability function with subsidiary HR managers and management teams "operationally responsible for implementing and following up actions in their local operations" (p.73). Risks are identified from four named sources, including annual eNPS surveys and appraisal interviews and "Follow-up of work environment data such as sickness absence, employee turnover and incidents, including harassment and discrimination".

The operating principle is stated: the Group "works according to the principle of 'prevention through governance'", meaning Group-wide governing documents, training, monitoring and internal controls, "as well as the quick correction of deviations through dialogues or whistleblowing. When shortcomings are identified, action plans are developed locally and followed up centrally."

Eight named actions follow, including mandatory annual Code of Conduct training; "Local programs for health support, ergonomics, work-life balance and stress prevention"; "Zero tolerance regarding discrimination and harassment"; and the external whistleblower system.

Scope is quantified: these actions "encompass the entire organization – approximately 3,000 in around 20 countries". No monetary resource allocation is given for any action.

Reference: page 74

One target is disclosed, and it is measurable and time-bound: "Addnode Group set a target in 2022 that at least 40 percent of each management team should consist of the underrepresented gender by 2030. This target includes the Board, Group Management and management teams in divisions and subsidiaries" (p.74).

Performance, 2025 (2024) against a 2022 base: women on the Board 43% (43%), base 43%; in Group Management 33% (33%), base 14%; in subsidiary management teams 27% (22%), base 27%. The Group reads its own results without flattery: "the trend at the Board level is positive, while actions still need to be taken to achieve the target in Group Management and in the subsidiaries".

Target setting drew on "double materiality, a gender analysis, HR dialogues and long-term skills requirements". Effectiveness is followed annually through gender statistics for senior positions, trend analyses in promotion and recruitment flows, eNPS results, and "Action plans in companies where representation is below the target level". The single planned action is to "Gradually increase the share of women in senior positions".

No target is set for the other two material workforce matters, employee well-being and training and skills development, and none for health and safety.

Reference: page 75

Headcount at the reporting date is 2,669 (2,698), split 737 female (763), 1,932 male (1,935), with zero other and zero not reported (p.75). By contract type: 2,652 permanent, 17 temporary and zero non-guaranteed hours employees. A country breakdown is given for 19 named countries: Australia, Austria, Canada, Denmark, Finland, France, Germany, India, Ireland, Japan, Lithuania, the Netherlands, Norway, Poland, Serbia, Slovakia, Sweden, the UK and the USA.

Method and boundary are disclosed: "Employee headcount is reported as of the last day of the reporting period. Companies acquired in 2025 are not included. The gender breakdown for employee headcount is based on the gender breakdown of the average number of FTEs, since gender breakdown is not reported for employee headcount. No other assumptions were used in reporting KPIs according to ESRS S1-6" (p.75). Reconciliation to the financial statements is signposted rather than tabulated.

Employee turnover is 12.7% (12.5%), which "corresponded to 338 (334) employees who left the Group during the year". Assurance scope is stated per table: "The data was reviewed by the Group's external auditor, but has not otherwise been validated by another external party." No figures are given for the eight companies acquired in 2025 and excluded from scope (p.51).

Reference: page 75

Diversity metrics are reported under their own S1-9 heading (p.75). Gender distribution at top management level is 27% female and 73% male for 2025, against 23% and 77% for 2024, with top management defined in a footnote as "members of Group Management, the management team of each division, and management of subsidiaries". In absolute numbers the same table gives 35 (30) female and 93 (105) male, zero other and zero not reported.

Age distribution of employees is given as a share and a count: under 30 years old 11% (293), 30-50 years old 59% (1,574), over 50 years old 30% (802), totalling 2,669 (p.75).

Assurance scope is stated on the table: "The data was reviewed by the Group's external auditor, but has not otherwise been validated by another external party."

This metric connects directly to the Group's one workforce target, at least 40 percent of each management team from the underrepresented gender by 2030, where the subsidiary management team figure of 27 percent is also the 2022 base year figure and the Group concedes that "actions still need to be taken to achieve the target in Group Management and in the subsidiaries" (p.74). The statement reports no diversity dimension other than gender and age, which is consistent with the material sub-topic being framed as "Gender equality and diversity: Gender imbalances, lack of inclusion" (p.58).

Reference: page 76

Both required ratios are reported. The gender pay gap "was estimated at 18.6 percent for 2025", calculated "according to the formula set out in ESRS S1-16: (average gross hourly pay level of male employees – average gross hourly pay level of female employees) / average gross hourly pay level of male employees", with all currencies converted into SEK (p.76). The annual total remuneration ratio "amounted to 10.8", calculated as "CEO's total remuneration / average remuneration for employees excluding members of Group Management", where total remuneration "includes basic salary, variable remuneration and pension costs".

Limitations are disclosed rather than glossed: "Since Addnode Group is a decentralized group with several different systems for salary data, we have chosen to tailor our metric for pay gaps so that it is as fair as possible. Salary metrics are based on data for November, since that month is relatively unaffected by holidays, vacations and bonus payments." The word "estimated" is the Group's own.

The gap is explained as reflecting "the historical industry patterns within the IT sector" and a larger share of men among older, higher-paid and more senior employees. No 2024 comparative is given for either ratio. Both were "reviewed by the Group's external auditor".

Reference: page 76

A four-row table gives 2025 (2024) figures: incidents of discrimination 1 (0); incidents of harassment 1 (6); "Number of cases reported through the whistleblower function" 0 (1); and "Fines/penalties (SEK)" 133,656 (0) (p.76).

The narrative reconciles and explains these: "Addnode Group collects data about incidents, grievances/complaints and serious impacts linked to human rights through the Group's whistleblower function and from the HR functions. This information is compiled at the end of year for reporting purposes. In 2025 (2024), a total of 2 (7) cases were reported to the HR functions and the whistleblowing function. In 2025, fines, sanctions, compensation or damages were paid out in 1 (0) case." The severe-impacts limb is answered as a nil return: "No cases of serious human rights violations – including forced labor, human trafficking or child labor – were reported in 2025."

Assurance scope is stated: "The data was reviewed by the Group's external auditor, but has not otherwise been validated by another external party."

The table is not broken down by incident type beyond discrimination and harassment, and the SEK 133,656 in fines is not attributed to a specific case or category, so a reader cannot tell whether it relates to the discrimination incident, the harassment incident or another matter. The Appendix B table records paragraphs 103(a) and 104(a) as reported on page 78 (p.81), although the content sits on page 76.

Reference: page 78

Four policies are described (pp.78-79). The Code of Conduct and Sustainability Policy "describe the Group's values and ethical guidelines", apply "for all employees, management teams and boards of directors with the Group as well as for suppliers and partners", and are "based on international standards such as UN and ILO guidelines". The Whistleblower Policy enables "safe and anonymous reporting of suspected irregularities, breaches of the law or internal guidelines without the risk of retaliation", covers "all employees, consultants, suppliers and other stakeholders in Addnode Group's value chain", and runs through channels that "meet the requirements of the EU's Whistleblowing Directive". The Supplier Code of Conduct "sets out requirements for ethical, social and environmental responsibility in the supply chain", based on "the UN Global Compact and the ILO Core Conventions". An Alcohol, Drugs and Gambling Policy covers employees, managers and consultants.

Training is annual and universal: "All employees undergo annual online training in the Code of Conduct and Sustainability Policy, encompassing sustainability, ethics, the Code of Conduct and the whistleblower function."

Corporate culture rests on three core values, "Entrepreneurial spirit, Long-term commitment and Simplicity", monitored "through policy evaluations, employee dialogues and follow-up of sustainability targets".

Reference: page 79

"Addnode Group prioritizes long-term and stable partnerships with strategically important suppliers. Relationships are built on mutual dialogue, transparency and accountability" (p.79). Employees responsible for supplier collaborations "possess good knowledge" of the Code of Conduct and Sustainability Policy and of the Supplier Code of Conduct requirements.

Screening criteria are described: "Partners and suppliers are evaluated using a holistic approach whereby price and quality are assessed together with sustainability aspects such as working conditions, environmental impact and compliance. Where possible, partnerships with players that have relevant certifications such as ISO 9001, ISO 14001 and ISO 27001 are prioritized." Follow-up is "through dialogues, evaluations, self-assessments and site visits", and 379 (347) suppliers confirmed adherence to a Supplier Code of Conduct in 2025 (p.55).

The payment-practices limb is answered in one clause a reader should notice: "All partner and supplier relationships prioritize partnership, knowledge exchange and joint skills development rather than formal and regulatory control. This mutual respect forms part of Addnode Group's corporate culture and is the reason why no policy to prevent late supplier payments is necessary." Supplier management is one of the three G1 material matters (p.58). No share of procurement spend covered by screening is disclosed.

Reference: page 79

"Addnode Group conducts its operations with zero tolerance for corruption and bribery. Efforts to combat unethical behavior are a key component of the Group's governance and risk management, and corruption risks are assessed to be a material compliance area" (p.79). The risk is characterised rather than assumed away: "Despite a low risk of occurrence, corruption risks are prioritized, especially in international partnerships and procurements where the likelihood of risks could be higher."

Accountability is allocated: the central Sustainability function "has the overall responsibility for anti-corruption efforts", while subsidiaries handle implementation and report deviations to it.

The separation-of-duties requirement is met explicitly: "Investigations are managed by independent functions that are separate from the parts of the organization that conduct operational work related to preventive measures." Suspicions "can be reported anonymously through Addnode Group's whistleblower system", and "Incidents involving corruption are reported to the Board's Audit Committee".

Training is quantified. The course takes "around 20 minutes", and "All employees, including managers and external members of Addnode Group's Board, are required to complete it once per year", with a 2025 "completion rate of 94 percent among all employees assigned to the course", against 62 percent in 2024 (p.47). No breakdown by function or risk exposure is given.

Reference: page 79

Under the 2023 ESRS the statement was prepared against, business conduct targets fell under MDR-T rather than a numbered G1 targets requirement. Addnode Group sets no quantitative business conduct target, but it does disclose effectiveness tracking, which is MDR-T's other limb.

The tracked measure is Code of Conduct training completion: "The companies are responsible for following up on their completion rate and identifying any need for in-depth training. The completion rate is reported to Group Management and the Board, and to external stakeholders in Addnode Group's Annual Report. The level of engagement was high in 2025, with a completion rate of 94 percent among all employees assigned to the course" (p.79), against 62 percent in 2024 (p.47). No target level is stated for it.

Three further measures are tracked without targets: no incidents of corruption or bribery in 2025 (p.79); zero whistleblowing cases against one in 2024 (p.76); and 379 (347) suppliers confirming adherence to a Supplier Code of Conduct (p.55).

The due diligence table supports reading this as MDR-T content, mapping row (d), "Tracking the effectiveness of these efforts and communicating", to "MDR-T" and the due diligence process (p.53).

Reference: page 79

A nil return, stated across all three limbs: "In 2025, Addnode Group did not have any incidents of corruption or bribery. Nor was the Group involved in any legal proceedings related to bribery or corruption involving employees, and Addnode Group did not suffered any losses as a result of corruption or bribery" (p.79). The performance-measures page repeats it with a comparative, "Number of incidents of corruption 0 (0)" (p.47).

The Appendix B table records paragraphs 24(a) and 24(b) as reported in the Sustainability Report on page 79, the only two G1-4 datapoints it lists (p.81).

Because the answer is nil, the consequential datapoints under this requirement do not arise: there are no convictions, no fines, no details of public legal cases and no actions taken to address breaches to report. The disclosure does not state how many confirmed incidents were investigated or dismissed, nor whether any allegations were received and closed without confirmation, so a reader cannot tell whether the zero reflects no allegations or allegations that were not substantiated. Adjacent figures give some context: zero cases were reported through the whistleblower function in 2025 against one in 2024, within a total of 2 (7) cases reported to HR and whistleblowing functions, and SEK 133,656 in fines or penalties was paid in one case, which the statement does not attribute to corruption (p.76).