AFRY

The role of the administrative, management and supervisory bodies

Reference: page 52.

Board of Directors. The Board has 12 members "including four employee representatives" and "currently consists of 50 percent women and 50 percent men", which "exceeds the Swedish Corporate Governance Board's target of 40 percent for the underrepresented gender". It "approves policy documents that frame and guide sustainability work, and monitors work on the company's material sustainability topics", approves the Annual and Sustainability Report and the strategy, and the double materiality assessment results "have been presented to, and validated by, the Board of Directors" (page 52).

Committees. The Audit Committee "is responsible for completeness and reliability, data collection procedures, internal controls on sustainability information, and sustainability report in its entirety prior to external auditing". A Risk Committee of the President and CEO, CFO and Group General Counsel "meets quarterly to assess material risks in relation to ongoing client projects and provisions made for disputes", and reviews ethical topics with the Chief Ethics and Compliance Officer (page 52).

Management. Overall responsibility rests with the President and CEO; "Strategic responsibility has been assigned to the Head of Commercial & Communications". The Executive Team has nine members, "four women and five men". "The CFO is responsible for the preparation and content of the statutory sustainability statement." Divisional sustainability representatives meet monthly (page 52).

Information provided to and sustainability matters addressed by the administrative, management and supervisory bodies

Reference: page 52.

AFRY states that "AFRY's Board of Directors and the Executive Team have established processes for ensuring that sustainability topics are integrated into governance and decision making. Where necessary, information is also provided on sustainability risks and risk management activities identified as material, and on the status of ongoing sustainability initiatives and project-related sustainability topics" (page 52).

Cadence and routing. "These reports are drawn up by the Executive Team with assistance from central support functions, and distributed to all directors at least one week prior to each Board meeting. The results of the materiality assessment are submitted for approval each year prior to adoption of the Annual and Sustainability Report. Sustainability topics may also be raised during the year, for example regarding progress, risks, and decisions on actions that need to be taken." At management level, "The Executive Team considers sustainability topics on a continuous basis, and sustainability targets are followed up quarterly" (page 52).

Outcomes for the Group sustainability targets and selected underlying KPIs "are followed up quarterly by the Executive Team and the Board of Directors" (page 60). Conclusions from the enterprise risk management process "are reported to the Board prior to adoption of the Annual and Sustainability Report" (page 52). The statement does not list the individual topics addressed at each meeting during 2025.

Integration of sustainability-related performance in incentive schemes

Reference: page 53 (section opens on page 52).

AFRY discloses that it has no sustainability-linked variable pay. Remuneration "may consist of the following components: fixed cash salary, variable cash compensation (including STIP and LTIP), pension benefits, and other market-related benefits. At present, none of these components is directly linked to sustainability-related performance, but senior executives are responsible for making progress towards centrally established sustainability targets" (pages 52-53).

There is a negative-conduct gate rather than a positive incentive: "The terms of the incentive programs also give AFRY's management the right to exclude executives from participation on the grounds of unethical conduct, failure to address irregularities, or similar behavior" (page 53).

"The Board of Directors' remuneration does not include any variable components" (page 53). Guidelines for senior executive remuneration are prepared by the Remuneration Committee and "approved annually at the Annual General Meeting", with further detail cross-referenced to the corporate governance report on pages 37-39 (pages 52-53). No percentage of remuneration tied to climate or other sustainability considerations is disclosed, because none exists.

Statement on due diligence

Reference: page 53.

"AFRY's due diligence process is based on our Code of Conduct and Risk Management Policy" (page 53). The statement maps the core elements of due diligence to their locations in the report:

• Embedding due diligence in governance, strategy and business model - p. 52 (GOV-1), p. 52 (GOV-2), p. 52 (GOV-3)
• Engaging with affected stakeholders - p. 52 (GOV-2), p. 56 (SBM-2), p. 57 (SBM-3), p. 86-87 (S1-2), p. 98 (S3-2)
• Identifying and assessing negative impacts on people and the environment - p. 52 (GOV-2), p. 56 (SBM-2), p. 57 (SBM-3), p. 58 (IRO-1), p. 61 (E1, IRO-1)
• Taking action to address negative impacts on people and the environment - p. 66 (E1-3), p. 77 (E3-2), p. 79 (E4-2), p. 82 (E5-2), p. 88-90 (S1-4), p. 99 (S3-4), p. 102-103 (G1-3)
• Tracking the effectiveness of these efforts - p. 68-69 (E1-4), p. 77 (E3-3), p. 79 (E4-3), p. 83 (E5-3), p. 90 (S1-5), p. 99 (S3-4), p. 102-103 (G1-4)

Operationally, due diligence runs through the Responsible Business Due Diligence (RBDD) process applied at tender stage, with enhanced RBDD for elevated-risk projects (pages 102-103).

Risk management and internal controls over sustainability reporting

Reference: page 53.

AFRY describes a maturing rather than a completed control framework: "At present, basic and entity-specific control measures are applied in the reporting process. Quality assurance of sustainability data involves a combination of central system support for data collection and compilation, and manual controls in the subsequent review process" (page 53). The controls listed are:

• "Comparison of reported data from year to year to identify deviations and trends."
• "Reasonableness assessments of outcomes and metrics, based on an understanding of the business and known changes in organization and operations."
• "Application of the four-eyes principle to the compilation, review, and approval of sustainability information."
• "Analysis and follow-up of identified deviations in dialogue with responsible functions prior to reporting."

"Reporting is managed by the Group Financial Control function, which works closely with the sustainability topic owners" (page 53). The forward plan is "gradually implementing internal controls over sustainability reporting similar to those of financial reporting", with formalised procedures for data collection, verification and approval, and targeted controls covering data-quality risk, estimates such as sector-average data, and value chain data. "The control system will gradually be integrated into the financial reporting process" (page 53).

Strategy, business model and value chain

Reference: page 55.

"AFRY provides engineering, project management, and advisory services that enable the energy and industrial transition and strengthen resilience in society. Our strategy 'Unlocking AFRY' targets segments with large transition needs" (page 55). "Value is created mainly through project-based client assignments, where we work closely with clients and partners in energy, industry, and infrastructure." AFRY is "a global business with a primary presence in the Nordics and the rest of Europe" with "around 18,000 employees worldwide" (page 55). Net sales for 2025 were SEK 25,578 million (page 72).

Value chain (page 55):

• Upstream - "activities and impacts related to suppliers of goods and services that AFRY uses to conduct its business, primarily IT hardware and office equipment."
• Own operations - "workplaces and offices, storage facilities, and meeting facilities under AFRY's control, including company cars in our operations."
• Downstream - "impacts associated with the use of AFRY's consulting, engineering and project deliveries by customers, including indirect impacts resulting from implemented solutions and advisory services, as well as value creation for AFRY's shareholders."

IRO management is integrated through "the Group-wide strategy process, Enterprise Risk Management (ERM) process, and Responsible Business Due Diligence (RBDD) process". Segment revenue and cost structure are cross-referenced to Note 2 under IFRS 8 (page 55).

Interests and views of stakeholders

Reference: page 56.

"In 2025, we deepened that engagement as part of our updated double materiality assessment (DMA), in line with ESRS" (page 56). Five stakeholder groups are tabulated with engagement channels and the topics each considers most important (page 56):

• Clients - client and project meetings, follow-up interviews after project completion, KAM engagement. Topics: project-related climate impact, biodiversity and water footprint, circularity, regulatory compliance, decarbonization roadmaps.
• Employees and subconsultants - performance reviews, workplace meetings, internal learning, AFRY's Youth Panel, employee survey. Topics: working conditions, inclusion and belonging, career development, health and safety, internal climate competence.
• Shareholders - investor meetings, Capital Markets Days, AGM. Topics: climate-related risks and opportunities, GHG performance, transition risks, business conduct, "compliance with EU regulation, such as CSRD and Taxonomy".
• Suppliers - supplier meetings, tenders and procurement, surveys. Topics: compliance with the Supplier Code of Conduct, circularity, GHG emissions, supply chain transparency.
• Society - website, conferences, advice on specific topics.

Proxies were used rather than direct outreach for two groups: "interviews with selected Key Account Managers as a proxy for clients as key stakeholders, and interviews with the Investor Relations Manager acting as a proxy for investors and shareholders" (page 58).

Material impacts, risks and opportunities and their interaction with strategy and business model

Reference: page 57; see also pages 59 and 61-100 for the per-topic IRO tables.

The materiality matrix on page 57 places topics in three groups:

• Double materiality (impact and financial): climate change mitigation, project-related climate impact, project-related impact on circularity, working conditions, corporate culture, corruption and bribery.
• Financially material only: energy.
• Impact material only: project-related water impact, project-related impact on biodiversity, economic, social, and cultural rights of communities, rights of indigenous peoples, equal treatment and opportunities for all, other work-related rights, whistleblower protection, relationships with suppliers.

Material topical IROs were identified for climate change (E1), own workforce (S1) and business conduct (G1); material entity-specific IROs were identified for climate change (project portfolio), water and marine resources (E3), biodiversity (E4), circular economy (E5) and affected communities (S3) (page 59).

A finding worth noting: "The results of AFRY's double materiality assessment show that the company does not have exposure to material climate-related risks (neither physical nor transition risks). Instead, a number of business opportunities linked to the climate transition have been identified" (page 62). Across all topics the report tabulates 37 individual IRO rows, none of which sits upstream-only in the environmental topics.

Description of the processes to identify and assess material impacts, risks and opportunities

Reference: pages 58-59.

"In preparation for AFRY's first sustainability statement in accordance with the CSRD and ESRS, we further enhanced the double materiality assessment. The updates for 2025 builds on the foundations established in 2023-2024" (page 58). The process has five described steps (pages 58-59):

1. Identification and screening - "A structured longlist of sustainability topics was drawn up on the basis of the sector-agnostic standards in ESRS, previous materiality assessments, industry benchmarks, AFRY's value chain, and emerging issues in client expectations." The 2025 refinement "now includes an assessment of sub-subtopics".
2. Stakeholder dialogue - global employee survey, analysis of clients' ESG questionnaires, KAM interviews as a client proxy, IR Manager interviews as an investor proxy, and Board and Executive Team interviews.
3. Assessment - impact materiality by "scale, scope, and remediability"; financial materiality "followed AFRY's ERM framework, where the likelihood and magnitude of potential impacts on financial performance are considered on the basis of AFRY's risk matrix and time horizons". Both used "predefined multi-level scales, where established thresholds were used".
4. Validation - "Internal topic owners reviewed and approved the assessment and identified IROs at sub-subtopic level." Consolidated results went to the Executive Team and Board in 2024; "No major changes in results were identified in the 2025 cycle from the previous year", so in 2025 selected Executive Team members reviewed the revised outcome and the Board "was informed".
5. Follow-up - "Although the assessment is not carried out annually, it will be updated on a need-based approach."

IROs are assessed before mitigation ("inherent IROs"), and time horizons are short <1 year, medium 1-5 years, long >5 years (pages 51, 58).

Disclosure requirements in ESRS covered by the undertaking's sustainability statement

Reference: pages 105-106.

AFRY prints a genuine ESRS content index: "AFRY has reported in accordance with the ESRS for the period January 1, 2025 to December 31, 2025. The ESRS content index below lists the ESRS disclosures that AFRY is reporting on" (page 105). Each row carries a disclosure code, a description, a Reported Yes/No column and a page reference, which makes the index unusually explicit about what was left out.

Coverage by standard: ESRS 2 (BP-1 to IRO-2, all Yes); E1 (E1-1 to E1-6 Yes; E1-7, E1-8 and E1-9 No, all pointing to page 73); E3 (E3-1, E3-2 Yes; E3-3 No); E4 (E4-2, E4-3 Yes; E4-4 No; no E4-1 row); E5 (E5-1, E5-2 Yes; E5-3 No); S1 (S1-1 to S1-9, S1-13, S1-14, S1-16, S1-17 Yes; S1-10, S1-11, S1-12, S1-15 No); S3 (S3-1 to S3-4 Yes; S3-5 No); G1 (G1-1 to G1-5 Yes; G1-6 "No", page "N/A").

E2 pollution, S2 workers in the value chain and S4 consumers and end-users do not appear in the index at all, consistent with the DMA outcome on page 59.

Two clerical points in the index itself: the E1 block labels the material-IRO row "SBM-1" while printing SBM-3's description, and the E3, E4 and E5 blocks each reuse the E3 wording "material water and marine resources-related impacts, risks, and opportunities" for their IRO-1 row (pages 105-106).

Transition plan for climate change mitigation

Reference: pages 63-64.

"AFRY's climate action is formalized in our transition plan, the AFRY 1.5°C Roadmap, which builds on the Exponential Business Playbook (version 4.1) from Exponential Roadmap Initiative" (page 63). It "covers its own operations, the value chain, integration into business strategy, and sharing knowledge in society" and rests on four pillars: "Reduce our own emissions / Reduce value chain emissions / Provide and scale solutions / Accelerate climate action in society" (page 63).

Targets. Halve carbon emissions by 2030 from a 2019 base year and "achieve net zero emissions by 2040", covering Scopes 1, 2 and material Scope 3 categories, "which collectively account for more than 90 percent of our total emissions". The targets are "based on the Science Based Targets initiative (SBTi) Corporate Net-Zero Standard and the principles of the Carbon Law", and short-term targets "have been validated by the SBTi" (page 63).

Locked-in emissions. "AFRY has not identified any material locked-in emissions" (page 63) - a bare nil return with no assessment method described.

Resources. "The implementation of AFRY's transition plan and identified key mitigation actions is not currently expected to require significant capital or operating expenditure", and "No taxonomy-aligned capital or operating expenditure in respect of increased taxonomy-aligned turnover is reported" (page 64).

Governance. Approved by the Executive Team and published in 2022; current version 2.1 published January 2025; "In the event of major changes, the transition plan is re-submitted to the Executive Team for approval, but no such changes have been made since its original publication" (page 63).

Benchmarks. "To our knowledge, AFRY is not covered by the mandatory exclusion criteria in Regulation (EU) 2020/1818" (page 64).

Identification of climate-related risks and scenario analysis

Back-filled from ESRS 2 IRO-1 and the E1 climate risk section, where this content is disclosed in the FY2025 report (page 62). This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

Risk classification. AFRY's analyses "include both transition risks as we move towards a more resilient, low-carbon economy, and physical risks (acute and chronic) associated with climate change" (page 62). The outcome, however, is a nil finding: "The results of AFRY's double materiality assessment show that the company does not have exposure to material climate-related risks (neither physical nor transition risks)" (page 62).

Methodology and scope. An initial TCFD-based analysis in 2022 was followed by "a separate and more in-depth climate scenario analysis conducted in 2023/2024". "Together, these two analyses cover AFRY's full value chain - upstream, own operations, and downstream" (page 62). Scope limits are stated: "The scenario analysis was limited to European region and the two largest sectors within each of AFRY's business divisions at the time." Nine drivers were evaluated at divisional level and three were carried into the scenarios: existing technologies adoption and scale-ups; market demand for sustainable solutions; development of climate regulation and policies (page 62).

Scenarios (page 62). "Three climate scenarios were considered in the analysis, based on the IEA's scenarios and in line with IPCC RCP 8.5, IPCC RCP 4.5 (IEA Stated Policies Scenario), and IPCC RCP 1.9 (IEA Net Zero Scenario)." A high-emission scenario (RCP 8.5) and a 1.5°C-aligned scenario (IEA Net Zero) are therefore both present. No global average temperature projection per scenario is given. The analysis "covers the period through to 2050", with risk horizons of 0-1, 2-5 and 6-30 years.

Assumptions. "All scenarios assume high-level macroeconomic trends, such as population growth and economic development, to continue as business as usual. No black swan event or major systemic collapse is assumed to occur" (page 62).

Currency and gaps. "Quantitative metrics and indicators have yet to be evaluated", and the analysis dates from 2023/2024 with no refresh disclosed for 2025 (page 62).

Resilience in relation to climate change

Back-filled from the E1 climate scenario analysis section, where this content is disclosed in the FY2025 report (page 62). This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

AFRY states plainly that it did perform a resilience analysis, but embedded in the scenario work rather than as a separate exercise: "AFRY has carried out a resilience analysis as an integral part of the climate scenario analysis. The implications for AFRY as a company have been examined for each scenario, for the three priority drivers, and for the climate-related transition events" (page 62).

Results and implications for strategy. "The analysis shows that the implications for AFRY are closely linked to the services we provide to our clients. To be resilient, we need to monitor changes in the market and take note of differences in geographies and sectors to ensure that we offer the right expertise for the prevailing circumstances." The strategic response is the diversified portfolio: "Our strategy 'Unlocking AFRY' is based on a diversified portfolio with focus on segments with substantial transition needs" (page 62). The conclusion drawn is that "AFRY is well-positioned to remain competitive and resilient in a changing world" (page 62).

Scope and timing. "Since the resilience analysis was conducted as part of the climate scenario analysis, the scope, method, limitations, and implementation date are the same" (page 62) - that is, European region only, the two largest sectors per division, and carried out in 2023/2024 with no 2025 refresh.

Uncertainty and adaptive capacity. Uncertainty is addressed only through the scenario analysis limitations: "Quantitative metrics and indicators have yet to be evaluated" (page 62). Financial adaptive capacity is not quantified; the statement says instead that "AFRY has not yet incorporated specific climate-related assumptions into its financial statements" (page 62) and that the transition plan "is not currently expected to require significant capital or operating expenditure" (page 64). No analysis of ability to redeploy, repurpose or decommission assets is given, which is consistent with an asset-light consulting business.

Policies related to climate change mitigation and adaptation

Reference: page 65.

AFRY does not present a single climate policy but a set of instruments. "Climate-related sustainability is addressed in the upstream value chain, in our own operations, and in the downstream value chain, on the basis of what is relevant for our IROs. Emissions are addressed for Scopes 1, 2, and 3" (page 65).

Upstream and own operations. "Policies and directives directly intended to reduce AFRY's emissions and mitigate its climate impact include our Sustainability Policy, HSEQ Policy, Travel Directive (in some cases supplemented with local vehicle policies), Sourcing Directive, and Supplier Code of Conduct." Commitments in the Sustainability Policy "include setting climate targets in line with the Paris Agreement and the 1.5°C target". The Swedish vehicle fleet is governed by a national vehicle policy that "targets a fossil-free fleet by 2030". The Travel Directive's "basic principle is that all business travel must be justified" (page 65).

Downstream, through client projects. "In the Sustainability Policy, we commit to actively seeking out transformative, innovative assignments that accelerate the sustainability transition, and to encouraging clients to adopt solutions that promote sustainable development, including but not limited to, 1.5°C aligned solutions." Under the Code of Conduct "all employees are expected to promote the Paris Agreement including the 1.5°C target" (page 65). Sector directives "establish mandatory requirements and expectations that apply to assignments within a specific sector", supported by the Guideline for Project and Sector Risk (page 65).

Coverage of adaptation is thin by the company's own account: "AFRY's policies mainly cover climate mitigation, but in addition we provide services that promote climate adaptation, energy efficiency, and renewable energy" (page 65). Climate risk enters the tender stage via the RBDD process, with enhanced RBDD and, where appropriate, ESIAs for higher-risk projects.

Actions and resources in relation to climate change policies

Reference: pages 66-67.

Own operations (Scopes 1 and 2), page 66. Named key actions: "Consider space and energy efficiency when choosing, planning, and managing offices"; "Choose fossil-free energy contracts where possible"; "Increase engagement with lessors to improve the environmental performance of leased offices"; "Increase the share of virtual meetings"; "Increase the share of sustainable modes of transport and sustainable fuels". Because "AFRY leases offices, it does not always control the choice of energy supplier or investment in the premises". The Swedish vehicle policy set a 2025 limit of "30 gCO2/km (WLTP)" for new leases, with an outcome of "10 gCO2/km for newly acquired vehicles and 13 gCO2/km for all vehicles" (page 66).

Value chain (Scope 3), page 66. Actions cover virtual meetings, sustainable transport and fuels, supplier engagement, purchasing criteria, office accessibility and commuting. The supplier action is quantified as a target: "87 percent of suppliers have set science-based climate targets by 2027". At end-2025 "AFRY's priority suppliers accounted for 62 percent of spend... and 65 percent of these had set science-based climate targets validated by SBTi. The proportion... was higher during the previous year, due to a change in AFRY's supplier base" (page 66).

Client projects, pages 66-67. Work continued on a portfolio model using the Professional Service Matrix from the Exponential Roadmap Initiative; "At present, AFRY's model supports analysis of the project portfolio based on one of the dimensions in the PSM matrix". Project-level actions listed include climate calculations and LCAs, climate adaptation advice, low-impact materials, renewable integration, SBTi support for clients, and digital climate-optimization tools (page 67).

Two explicit gaps. "The expected effects of identified actions on AFRY's emissions have yet to be quantified, but this is a priority area for future development. Unless otherwise stated, these actions are not time-bound" (page 66). On resources: "The implementation of AFRY's identified key actions and initiatives is not currently expected to require significant capital or operating expenditure" (page 67).

Targets related to climate change mitigation and adaptation

Reference: pages 68-70.

Long-term targets (page 68). "AFRY has committed to halve its absolute carbon emissions by 2030, with 2019 as base year, and achieve net zero emissions by 2040." "AFRY's base year emissions are 58,450 tCO2, which means that our target level for 2030 is 29,225 tCO2. By 2040, AFRY intends to reduce emissions close to zero, and neutralize residual emissions in accordance with the Corporate Net-Zero Standard." The E1-6 table gives the 2040 target level as 5,845 tCO2 (page 71).

Short-term SBTi-validated targets (page 68).

• "Reduce absolute carbon emissions in Scopes 1 and 2 by 36 percent by 2027 from a 2019 base year (7,094 tCO2)."
• "Reduce absolute carbon emissions from business travel in Scope 3 category 6 by 36 percent by 2027 from a 2019 base year (14,456 tCO2)."
• "Ensure that 87 percent of priority suppliers (in terms of spend connected to purchased goods and services and capital goods, Scope 3 categories 1 and 2) have set science-based climate targets by 2027."

Scope and expected split. Targets cover purchased goods and services, air and vehicle business travel outside AFRY's control, and employee commuting, together "more than 90 percent of AFRY's total emissions". Expected contribution by 2030: "90 percent reduction in Scope 1, 64 percent reduction in Scope 2, and 47 percent reduction in Scope 3" - each "an estimate and may be adjusted over time" (page 68).

Downstream objective, not yet a target (page 70). "AFRY has set an overarching sustainability objective for the project portfolio... to increase the proportion of net sales each year from projects that can contribute to the climate transition." 2025 is the first measurement year: 30 percent of net sales, "SEK 7.8 billion in revenue from projects identified as contributing", against 3 percent "linked to projects that entail a potential risk of contributing to increased GHG emissions" (mainly "petrochemicals, fossil gas, and oil refining") and 67 percent neutral.

Progress at end-2025: 65 percent of priority suppliers had SBTi-validated targets, "lower than previous year due to a change in AFRY's supplier base", and "The actions' quantitative contributions to achieving the targets have yet to be established" (page 69). No adaptation target is set.

Energy consumption and mix

Reference: page 71.

AFRY reports total energy consumption from own operations of 34,761 MWh in 2025 (2024: 34,306; 2023: 49,100; base year 2019: 38,024). Of that, 18,396 MWh came from non-renewable sources and 16,364 MWh from renewable sources, giving a renewable share of 47 percent against 34 percent in 2024, 52 percent in 2023 and 48 percent in 2019 (page 71).

Detail (page 71): fuel consumption from renewable sources 0 MWh; purchased or acquired electricity, heat, steam and cooling from renewable sources 16,364 MWh; self-generated non-fuel renewable energy 24 MWh (no comparative data); non-renewable energy production 0 MWh; renewable energy production 258 MWh (0 in prior years).

Two comparability caveats are disclosed. First, scope changed: "In the table for Energy consumption and mix, the fuel consumption for AFRY's own vehicle fleet has been included for 2025, whereas previous years only cover energy consumption in our offices. This should be considered when making year-on-year comparisons of total energy consumption" (page 71). Second, the renewable share rose partly for a methodological reason: "The introduction of a method for collecting guarantees of origin for heating and cooling has increased the reported energy consumption from renewable sources relative to 2024" (page 72).

A presentational limitation is stated in a footnote: "Fossil sources and nuclear sources are reported combined as non-renewable sources", because "we are not currently able to disaggregate nuclear power" (pages 71, 74). Primary energy data are collected for Sweden, Finland, Switzerland, Norway, Brazil, Germany, the UK and Denmark; "For all other countries, energy use is extrapolated based on the collected dataset" (page 74). No breakdown by high climate impact sector is given, and AFRY does not report energy intensity per net revenue in this table.

Gross Scopes 1, 2, 3 and Total GHG emissions

Reference: pages 71-72.

2025 gross emissions, with 2024 and the 2019 base year (page 71):

• Gross Scope 1: 604 tCO2 (2024: 340; 2019: 3,259) - up 78 percent year on year, down 81 percent on base year
• Gross location-based Scope 2: 2,845 tCO2 (2024: 3,089; 2019: 4,401)
• Gross market-based Scope 2: 2,572 tCO2 (2024: 3,295; 2019: 3,835)
• Material Scope 3: 40,335 tCO2 (2024: 41,398; 2019: 51,356), split purchased goods and services 22,058, business travel 10,476, employee commuting 7,802
• Total location-based: 43,785 tCO2; total market-based: 43,511 tCO2, down 3 percent on 2024 and 26 percent on the 2019 base year

Scope 3 is 93 percent of the footprint, Scope 2 six percent and Scope 1 one percent (page 69). Intensity: 1.70 tCO2 per net sales market-based and 2.43 tCO2 per employee (2024: 2.47) (page 72).

Data-quality disclosures (page 71): "No Scope 1 GHG emissions from regulated emission trading schemes (0 percent). No biogenic emissions. 51 percent of purchased energy in Scope 2 are covered by guarantees of origin or renewable energy certificates. The share of primary data is 6 percent for Scope 3 category 1, 76 percent for Scope 3 category 3, and 0 percent for Scope 3 category 7. AFRY applies the financial control method."

Movements are explained rather than asserted: Scope 1 rose because of "better coverage of AFRY's own vehicle fleet"; Scope 2 market-based fell on "lower energy consumption and a more effective system for collecting and validating guarantees of origin"; commuting rose "due to the updated calculation method" following a 2025 global travel survey (page 72). Seven of the fifteen Scope 3 categories are excluded as "Not relevant for AFRY", four (categories 2, 3, 4 and 5) as having "Little to no impact", and category 8 upstream leased assets as already "Included in Scope 2" (page 75). Geographical and divisional breakdowns are given on page 72.

Policies related to water and marine resources

Reference: page 77.

E3 is disclosed on an entity-specific basis, framed around the project portfolio rather than AFRY's own water use: "Since AFRY is a consulting and engineering firm with mainly office-based operations, our own water consumption is considered to be limited to drinking water, cleaning, and sanitary purposes" (page 76). The material IROs are one actual positive and one potential negative impact, both downstream (page 76).

Own operations. "Our Code of Conduct expects all employees to use energy, water, and natural resources efficiently, sustainably, and economically in their day-to-day work. We also aim to minimize pollution, waste, and emissions that can negatively impact habitats or air, soil, and water quality. Water-related topics linked to our own operations are managed within the framework of our environmental management system" (page 77).

Downstream, through client projects. "In our Sustainability Policy, we commit to actively develop our company and our offer in line with global challenges, and encourage our clients to adopt solutions that promote sustainable development. The Sustainability Policy also requires that relevant sustainability topics are assessed and managed throughout the lifecycle of the assignment, that AFRY contributes to the UN Sustainable Development Goals through its client projects, and that the precautionary principle is applied in relation to environmental risks in assignments" (page 77).

Where water risks are sector-specific, "sector directives guide the business in assessing those risks and in managing negative impacts throughout the project lifecycle", supported by the Guideline for Project and Sector Risk. Water risks enter the tender stage through the RBDD process, with enhanced RBDD and, "Where appropriate, environmental and social impact assessments (ESIAs)" for higher-risk projects (page 77).

AFRY does not disclose a dedicated water policy, and no commitment on water withdrawal in areas of high water stress or on marine resources is stated.

Actions and resources related to water and marine resources

Reference: page 77.

AFRY is explicit that it runs no Group-level water programme: "AFRY has no public ESRS targets in relation to water and marine resources, and no separately defined Group common actions in this area. Actions are integrated into each client project based on its type, sector, and geography" (page 77).

The mechanism is the project delivery process: risks of negative impacts and opportunities for positive impacts identified at tender stage "are to be addressed during the project lifecycle in accordance with the delivery process". Examples given of actions in client projects (page 77):

• "Integration of water impacts into project processes and decision making"
• "Advising clients on risk reduction measures and innovative solutions for water efficiency and treatment"
• "Implementing technology and digital tools to optimize water use and monitoring"
• "Cross-disciplinary teams with expertise in hydrology, ecology, and environmental technology"
• "Tracking and reporting water-related KPIs and targets within the framework for project delivery"

Capability building is treated as an enabling action: "Sustainability training is an important element in increasing the business's ability to meet client expectations and requirements, and to increase sustainability in project delivery in accordance with our objectives" (page 77), with 95 percent of employees having completed sustainability learning at year-end (page 77).

No financial or other resources are quantified for these actions, no time horizons are attached, and no action is directed at AFRY's own water consumption.

Policies related to biodiversity and ecosystems

Reference: page 79.

Scope limitation stated up front. "The policy framework does not cover own production, sourcing, or consumption of raw materials originating from ecosystems managed to maintain or enhance conditions for biodiversity, as AFRY's business model does not include such activities. Any social impacts linked to impacts on biodiversity are managed as part of the company's overarching policies and processes for human rights and responsible business conduct" (page 79).

Own operations and suppliers. "Through our Code of Conduct, all employees are expected to aim for minimizing pollution, waste and emissions that can negatively affect living environments and air, soil and water quality. This also applies to our suppliers who are additionally expected, where applicable, to prevent environmental degradation, deforestation and negative impacts on biodiversity and animal welfare in accordance with AFRY's Supplier Code of Conduct. The management of impacts on biodiversity and ecosystems linked to our own operations takes place within the framework of our environmental management system" (page 79).

Downstream, through client projects. The Sustainability Policy commits AFRY "to actively develop our company and our offer in line with global challenges", requires that "relevant sustainability topics are assessed and managed throughout the lifecycle of the assignment" and that "the precautionary principle is applied in relation to environmental risks in assignments". Sector directives "set out mandatory requirements and expectations for assignments in the sector in question", supported by the Guideline for Project and Sector Risk and, at tender stage, the RBDD process with enhanced RBDD and ESIAs where appropriate (page 79).

No dedicated biodiversity policy is disclosed, and there is no reference to traceability, deforestation-free commitments beyond the supplier expectation above, or to the Kunming-Montreal Global Biodiversity Framework.

Actions and resources related to biodiversity and ecosystems

Reference: page 79.

As with water and circularity, AFRY runs no Group-level biodiversity programme: "AFRY has no public ESRS targets in relation to biodiversity and ecosystems, and there are therefore no separately defined Group common actions in this area. Actions are integrated into each client assignment based on project type, sector, and geography" (page 79).

Examples of actions in client projects (page 79):

• "Integrating biodiversity and ecosystems into project processes and decision making"
• "Preparation of biodiversity assessments and nature conservation inventories"
• "Designing nature-inclusive and ecosystem-based solutions into projects"
• "Restoration of habitats and ecological compensation where impacts cannot be avoided"
• "Advising clients on the TNFD recommendations, nature-positive targets, and biodiversity reporting"
• "Skills development and cross-disciplinary teams with expertise in ecology and nature conservation"
• "Tracking and reporting KPIs and targets in relation to biodiversity and ecosystems within the framework for project delivery"

Risks of negative impacts identified at the tendering stage "are to be addressed during the project lifecycle in accordance with the delivery process" (page 79).

The mitigation hierarchy appears only implicitly, through "Restoration of habitats and ecological compensation where impacts cannot be avoided". No biodiversity offsets are claimed, no resources are quantified, no time horizons are given, and no action addresses AFRY's own sites.

Policies related to resource use and circular economy

Reference: page 82.

Stated scope limitation. "The policy framework sets out overarching principles for resource efficiency and sustainability. More detailed actions in relation to transitioning away from the use of virgin resources, greater use of secondary materials, and sustainable sourcing of renewable resources, are managed and implemented at project level where relevant to the type of assignment, sector, and geographical context" (page 82).

Own operations and suppliers. "In our HSEQ policy, we commit to identify areas where we can increase positive impacts on the environment, which includes circularity, waste, and sustainable resource use. Our aim is to work on this in our purchasing, in our office operations, and in our assignments." The Supplier Code of Conduct expects business partners to ensure "the efficient, sustainable and economic use of resources", to manage and minimise waste, and to take "measures to promote waste reduction, reuse, and recycling". Concretely: "Through our contracts with suppliers of computers and IT equipment in AFRY's largest markets, we integrate circular principles and responsible resource use through leasing models that cover repair, reconditioning, take-back, and certified re-use of IT hardware" (page 82).

Downstream, through client projects. "The importance of circularity as a business driver for AFRY means that there will be numerous opportunities linked to our offer over time." Sector directives and the Guideline for Project and Sector Risk guide risk assessment, and circularity risks enter the tender stage through the RBDD process, with enhanced RBDD where the project profile warrants it (page 82).

The IT leasing arrangement is the one policy commitment tied to AFRY's own resource inflows; the rest addresses the project portfolio.

Actions and resources related to resource use and circular economy

Reference: page 82.

"AFRY has no public ESRS targets in relation to resource use and circular economy, and so no separately defined Group common actions in this area. Actions are integrated into each client assignment based on project type, sector, and geographical context" (page 82).

Examples of actions in client projects (page 82):

• "Integrating resource use and circular economy into project processes and decision making"
• "Lifecycle assessments and material flow analyses to identify resource flows and opportunities for increased circularity"
• "Advising on choosing reclaimed, recycled, and bio-based materials"
• "Designing for disassembly, re-use, and recycling"
• "Implementation of circular business models and solutions in projects"
• "Support for clients in setting and tracking targets for resource efficiency and waste minimization"
• "Digital tools for traceability of materials and circular flows"
• "Tracking and reporting KPIs and targets in relation to resource use and circular economy within the framework for project delivery"

For own operations the concrete action is the IT hardware arrangement described under E5-1: leasing models "that cover repair, reconditioning, take-back, and certified re-use of IT hardware" with suppliers "in AFRY's largest markets" (page 82).

No resources are quantified for these actions and none is time-bound. Circularity is nonetheless identified as a material opportunity in the E5 IRO table: "Circularity is one of AFRY's key business drivers in all sectors and divisions, from engineering and design to advisory services. It is expected to grow as a material opportunity for AFRY over time" (page 81).

Policies related to own workforce

Reference: page 86.

"All of the policies below are Group-wide and are reviewed and approved annually by the Board of Directors. They are publicly available at https://afry.com/en/about-us/policies-management-system. The policies did not change materially in 2025" (page 86).

• People Policy - "fair and equal working conditions, zero tolerance of discrimination and harassment, the right to be heard without retaliation, and respect for freedom of association and collective bargaining agreements".
• Code of Conduct - applies to all employees including the Executive Team and Board; "builds on the UN Global Compact and core ILO conventions"; zero tolerance of harassment, bullying and corruption; "clear mechanisms for reporting concerns, with protection from retaliation".
• HSEQ Policy - "frameworks for risk management, preventive safety work, and continuous improvement in accordance with ISO 45001", covering "both the physical and psychosocial working environment, and initiatives such as the 'right to disconnect'".
• Sustainability Policy, Human Rights Policy (built on the UNGPs, OECD Guidelines and UN Global Compact) and Data Privacy Directive (GDPR).

New in 2025: "At the end of 2025, AFRY launched a new Human Rights Directive to supplement the existing Human Rights Policy", with commitments including "Prohibition of child labor, forced labor, human trafficking, and all forms of discrimination", "Due diligence in high-risk countries and high-risk projects (including in the upstream value chain)" and "Mandatory training and capacity-building for relevant functions" (page 86).

Client-site interaction. Where AFRY staff work under a client's own health and safety or privacy rules, "AFRY's own policies are always the minimum acceptable standard, and external policies must never provide a lower level of protection for AFRY's employees than our own internal guidelines permit" (page 86).

Processes for engaging with own workforce and workers' representatives about impacts

Reference: pages 86-87.

Engagement runs at several points: "there is a dialogue early in the planning phase of strategic changes that affect working conditions or the working environment, with further dialogue during implementation for risk management purposes, and ongoing follow-up" (page 86). Types of engagement (pages 86-87):

• Day-to-day - "Regular meetings with managers, HR support, and local safety representatives".
• Structured forums - "Quarterly meetings with union representatives (for example, through the arrangement with Sveriges Ingenjörer and Unionen in Sweden)"; at divisional level "engagement at least quarterly through committees including divisional management".
• Surveys - "Our annual global employee survey (response rate of 81 percent in October 2025)" covering "perceived working conditions, psychosocial health, and work-life balance". "Two [pulse surveys] were carried out in 2025, looking at psychological safety and workload, providing insights that led to adjustments to our leadership programs."
• Other - town halls with the CEO, project start-up risk assessments, health and safety committees, "tailored to national laws and collective bargaining agreements... including all employees, including those in high-risk environments such as fieldwork".

Accountability. "Operational responsibility rests with the HR function and line managers, while the EVP People & Culture in the Executive Team has highest responsibility" and "ensures that the results of this engagement are integrated into strategic decisions and documented in AFRY's management system in accordance with ISO 45001" (page 87).

Effectiveness. "The 2025 employee survey introduced a Psychological Safety Index (median 86/5), which measures how confident employees are in expressing opinions, and this led to targeted initiatives such as increased training for managers" (page 87). AFRY notes it "does not have a global agreement with trade union organizations" but "applies the principles for social dialogue and collective bargaining in all countries in which we operate" (page 87).

Processes to remediate negative impacts and channels for own workforce to raise concerns

Reference: page 87.

"AFRY has established Group common processes for identifying, investigating, and addressing negative impacts on employees, such as occupational injuries, bullying, discrimination, and serious work-related stress. These processes are integrated into our ISO 45001-certified management system and build on the principles in our Code of Conduct and Human Rights Policy" (page 87).

The five-step incident process (page 87): report through one of the channels; "The case is then investigated promptly and impartially by HR and/or an external party"; the cause is identified and "the manager responsible produces an action plan (corrective and preventive action)"; "The employee affected is offered relevant support and, where necessary, remedy (e.g. rehabilitation, mental health support, or financial compensation under insurance or by law)"; "The case is followed up, and the lessons learned are used in future work."

Channels (page 87), all free of charge and without risk of retaliation:

"Protection from retaliation is an absolute principle. All forms of retaliation against those reporting concerns are prohibited and will lead to disciplinary action" (page 87).

"The results are reported quarterly to the company's Risk Committee and annually to the Audit Committee" (page 87). Incident volumes are reported under S1-17: 16 reports in 2025 (page 94). AFRY does not disclose whether it assesses worker awareness of or trust in the channels.

Taking action on material impacts on own workforce

Reference: pages 88-90.

"AFRY allocates organizational and financial resources to implement the actions and initiatives described in this section... This work is driven by the Group's HR and HSEQ functions, in close collaboration with the line organization" (page 88).

Occupational health and safety (page 88). The management system "covers all employees and all types of work carried out in the office, on site, and when travelling" and "is certified according to ISO 45001, ISO 14001 and ISO 9001". "AFRY carries out project-specific risk assessments ahead of client assignments... and projects with a high or very high risk profile undergo enhanced due diligence", which "can lead to requirements for special protective measures, personal protective equipment, enhanced safety instructions, additional training, or project-specific action and contingency programs".

Well-being and work-life balance (page 88). Actions include a "Hybrid working model", "Common guidelines on the 'right to disconnect', and recommendations on meeting-free days and avoiding emails and meetings outside ordinary working hours", wellness allowances and occupational health services, anonymous flagging of high workloads, and "Alternative holidays - the option of swapping Swedish public holidays with holidays from another culture or tradition".

Diversity, equality and inclusion (pages 88-89). Global Inclusion & Diversity e-learning, updated in 2025; the annual Inclusion & Diversity Week with recent focus on "inclusive leadership and neurodiversity"; a Recruitment Dashboard built in Power BI tracking the 40 percent female leaders target; LGBTQI+ initiatives; and an Inclusion & Diversity Toolbox.

Learning, leadership and the transition (page 89). AFRY Academy, documented annual career development reviews, succession planning, and global leadership programs. On climate: "AFRY believes that the transition to a climate-neutral economy creates new business opportunities and skills needs in the areas in which our consultants operate, rather than having a negative impact on our own workforce."

Privacy (page 90). Risk analyses of business-critical applications, encryption, access controls and continuous cyber-awareness training.

A stated limitation: "The actions and initiatives that AFRY introduces... are not time-bound" (page 89).

Targets related to own workforce

Reference: page 90.

AFRY discloses two workforce targets, both Group-level (page 90):

• eNPS - "an Employee Net Promoter Score (eNPS) in the top 25 percent of engineering and advisory firms globally by 2028". Measured against "an external benchmark via the supplier of the platform used for the employee survey", where "The benchmark provides a threshold for being in the top 25 percent at the time of the survey." Outcome: "The outcome for 2025 shows that AFRY is in the top 50th percentile" (page 90). This is a new target for 2025 (page 60).
• Female leaders - "at least 40 percent female leaders by 2030. Leaders are defined as managers who have responsibility for a team and serve as a line manager for its employees. Progress against this target is measured annually, and general statistics are presented in quarterly internal reports" (page 90). Outcome for 2025: 26.3 percent, unchanged from 26.3 percent in 2024 (pages 60, 91).

Worker involvement is explicitly absent. "AFRY's own workforce and their representatives were not directly involved in the formulation of the target. The target was set by management, based on the double materiality assessment and internal analyses" (page 90).

A third area has no target: "AFRY has no public ESRS targets in relation to employee privacy and data protection" (page 90).

For health and safety, no numeric target is set; the company "follow[s]-up work on occupational health and safety through a number of KPIs presented under S1-14" (page 90). Supporting KPIs tracked at Group level include female employees 31.5 percent, engagement index 79, leadership index 82, sickness absence 2.84 percent, employee turnover 11.6 percent and LTIF 0.83 (page 60).

Characteristics of the undertaking's employees

Reference: pages 91-92.

Headcount at year-end 2025 across all types of employment: 17,898 employees - 5,474 women, 12,414 men, 10 other. Of these, 15,935 are permanent (5,014 women, 10,917 men, 4 other) and 1,963 other temporary (460 women, 1,497 men) (page 91).

By geography, all types of employment (page 91): Sweden 7,550; Finland 2,349; Brazil 1,432; Norway 1,137; Switzerland 946; Denmark 855; Other 3,629.

"AFRY does not have any employees with non-guaranteed hours" (page 91).

Employee turnover among permanent employees was 2,643 leavers, 16.6 percent (women 15.4 percent, men 17.1 percent), highest in Brazil at 28.8 percent and lowest in Switzerland at 12.2 percent. New hires totalled 1,735, 10.9 percent of permanent employees (page 92). The turnover rate "is calculated by dividing the number of leavers during the financial year (among permanent employees) by the number of permanent employees on December 31 of that same year" (page 95).

Methodology (page 95): data "have been collected from the Group common HR system"; the permanent/temporary classification "is made locally by each country's HR function based on local employment contracts and in accordance with national legislation". The definition of employee numbers used in the financial statements is cross-referenced to page 176, and reporting on employee numbers to Note 6 (pages 91, 95).

The figure reconciles broadly with the business model description of "around 18,000 employees worldwide" (page 55). AFRY does not present a full-time/part-time split by gender or a separate breakdown of employees who left by reason.

Characteristics of non-employee workers

Reference: page 92.

AFRY reports non-employee workers as subconsultants engaged through a named partner structure: "The AFRY Partner Network is for consultants, including self-employed consultants and employees of medium-sized or large consulting companies, looking to partner with AFRY's organization and clients. These partners are engaged as subconsultants for a specific time or project, and are mainly based in Sweden. In 2025, the AFRY Partner Network consisted of around 21,600 registered partners" (page 92).

Active subconsultants in the largest markets, 2025 with comparatives (page 92): Sweden 3,185 (2024: 3,373; 2023: 3,388); Finland 337 (406; 584); Brazil 510; Switzerland 131 (131; 113); Norway 165 (79; 112); Denmark 212 (131; 70); Other 662 (802; 621). Total 5,202 (2024: 4,922; 2023: 4,888). A footnote records that the Brazil figure "also includes subcontractors in Brazil who are registered in the Group's common HR system (444)".

Methodology (page 95): "Information on non-employees in the workforce refers to the number of active subconsultants (headcount) in AFRY's SubCon App system, which covers subconsultants in AFRY's partner network. The disclosures are based on the number of subconsultants who are part of the partner network and were active on at least one client assignment at some point during the year in question."

The disclosure is a headcount only. AFRY does not break non-employee workers down by type - self-employed versus provided by undertakings engaged in employment activities - and gives no gender split.

Collective bargaining coverage and social dialogue

Reference: page 92.

"A total of 10,587 employees (including 7,534 in Sweden) were covered by collective bargaining agreements within the European Economic Area (EEA) at year-end. This corresponds to 65.3 percent of all employees. Throughout the business, terms of employment are competitive in the local market and comply with local regulations" (page 92).

The banded table places both EEA collective bargaining coverage and workplace representation for Sweden and Finland in the 80-100 percent band, with no countries in the lower bands and no non-EEA entries (page 92). Reporting covers "countries where we have significant employment as defined in ESRS (at least 50 employees representing at least 10 percent of total employees)"; AFRY notes it "also ha[s] employees covered by collective agreements in Switzerland, Norway, Denmark, Austria, and Italy, which do not meet the criteria for countries where we have significant employment as defined in ESRS" (page 92).

Outside the EEA: "terms of employment are covered primarily by local labor laws and individual employment contracts. In these markets, the company aims to ensure fair and competitive terms in accordance with applicable local legislation and the company's global HR principles" (page 92).

A stated data gap: "For the employment type 'PAI' (post-acquisition integration), which covers 287 people in Brazil, only mandatory minimum information is recorded in the Group's HR system. This does not include information on collective bargaining agreements, and so those classified as PAI are not included in this reporting" (page 95).

Social dialogue mechanisms are described under S1-2, including quarterly meetings with Sveriges Ingenjörer and Unionen in Sweden (page 87).

Diversity metrics

Reference: pages 91-92.

Gender distribution, share of women (page 91):

Age distribution, 2025 (page 91): total workforce 14.1 percent under 30, 59.3 percent 30-50, 26.5 percent over 50. The Board is 12.5 percent 30-50 and 87.5 percent over 50; the Executive Team 44.4 percent 30-50 and 55.6 percent over 50.

Share of women by division (page 91): Energy 25 percent consultants and 17 percent managers; Industry 24 percent and 19 percent; Transportation & Places 36 percent and 28 percent. Administrative staff are 79, 90 and 85 percent women in the three divisions respectively.

The manager figure is the one that matters against the target: 26.3 percent against "at least 40 percent female leaders by 2030" (page 90), flat year on year. New hires in 2025 were 539 women and 1,193 men (page 92).

"Data on employees refer to the total number of employees (headcount) and have been taken from the Group common HR system. Employees whose age or gender are unknown have been excluded" (page 95).

Training and skills development metrics

Reference: page 93.

Performance and career development reviews, share of permanent employees receiving them (page 93):

"Figures are for permanent employees. 404 individuals not included" (page 93).

Training hours (page 93):

Both the absolute and per-employee figures have fallen for a second consecutive year, from 40.40 hours in 2023 to 36.74 in 2025. The report does not comment on the decline.

Method and limits (pages 93, 95-96): "A formal dialogue between each employee and their line manager must take place at least once per year with the aid of the digital evaluation tool Career Model." Training hours are "based on training hours reported in our internal timesheet system", and the average is calculated as total hours divided by total permanent employees. AFRY flags the resulting uncertainty: "There is uncertainty about the results for the total number of training hours and training hours per employee, because there may be variations in the extent to which employees report actual training hours in the timesheet system" (page 95).

A gender gap in the data: "The number of training hours and average number of training hours per employee in 2025 have not been reported by gender due to system restrictions. We will assess the possibilities for doing so in future in the course of 2026" (page 96).

Health and safety metrics

Reference: pages 93-94.

Coverage. "100 percent of AFRY's own workforce is covered by the Group's management system", which "is based on applicable legal requirements and recognized international standards and guidelines, including ISO 45001" (page 93).

Metrics (page 94):

Absence: 357 days due to occupational injury (2024: 469); zero long-term occupational-injury absence (2024: 184 days); sickness absence 2.84 percent (2024: 2.87) (page 94).

AFRY attributes the rise to reporting, not to safety: "This change is considered to be mainly a result of targeted development work to strengthen internal reporting processes and raise awareness in the organization of the importance of reporting accidents and near-misses. The injury rate is still at a low and manageable level" (page 94). The uncertainty is acknowledged: "the degree of maturity and awareness of the reporting process vary between countries... some incidents may not be reported, or may be reported in different ways" (page 95).

Independent review. "The health and safety metrics are also reviewed by an independent third party separate to the company's auditor" - Intertek audits the HSEQ management system annually, and "site audits are carried out by Achilles, which performs supplier audits of selected sites on behalf of the company's largest clients" (page 93).

Work-related ill health is not yet reported: "The ambition is to present more comprehensive and accurate figures for work-related ill health with effect from the 2026 reporting year" (page 93).

Compensation metrics (pay gap and total compensation)

Reference: page 94.

CEO to median ratio. "The company's highest-paid employee in terms of fixed cash salary is the President and CEO. The total fixed cash salary for 2025 was SEK 8,052,000. The median remuneration at AFRY was SEK 597,800 (excluding the President and CEO, but including the fixed cash salary for members of the Executive Team). This includes both full-time and part-time employees. The ratio between the highest-paid employee (the President and CEO) and median employee remuneration in terms of fixed cash salary can thus be calculated as (8,052,000 / 597,800) = 13.5" (page 94).

Gender pay gap. "The unadjusted pay gap between men and women employed in Sweden in 2025 was 9 percent. Both full-time and part-time employees are included in the calculations" (page 94). Defined as "the difference in average pay level between female and male employees, expressed as a percentage of the average pay level for male employees" (page 96).

Two scope limitations are disclosed. First, geography: both metrics are drawn from "the company's Swedish payroll system", and "The company plans to further assess opportunities to gradually increase the scope of reporting in the coming years in order to fully comply with applicable regulatory requirements (all employees in all countries)" (pages 94, 96). Second, definition: "cash remuneration has been used, as current system limitations make it unreasonable to apply a broader definition of remuneration. This means that the calculation of the remuneration ratio would be misleading if total remuneration was included for the President and CEO, but not in median employee remuneration" (page 96).

AFRY explains the gap structurally: "In some of our technically oriented areas, there is a higher proportion of men, whereas women are more likely to be found in administrative and support functions. Differences in vertical representation, with men still over-represented at senior management and leadership levels, also contribute" (page 94).

Incidents, complaints and severe human rights impacts

Reference: page 94.

"A total of 16 incidents were reported through the Group's whistleblower function in 2025, of which 15 concerned discrimination or harassment, and one concerned human rights" (page 94).

"No fines, penalties, compensation, sanctions, or other financial consequences arose as a result of the incidents and complaints reported above for 2025" (page 94).

An important scoping point: the count is not limited to AFRY's own workforce. "The whistleblower function is available for anonymous reporting by all parties across AFRY's value chain, including clients, suppliers, and other business partners. Matters reported may also include incidents which AFRY did not directly cause or contribute to, but where the impact arises in the value chain and AFRY is linked to it through participation in client projects. This is in line with the three forms of responsibility set out in the UN Guiding Principles on Business and Human Rights: cause, contribute, directly linked" (page 94). The same figure is cross-referenced from S3-3 as the count for affected communities (page 99).

The metric refers to "incidents reported through the 'Listen Up' grievance mechanism, which is the Group's whistleblower function" (page 96) - so incidents raised directly to a manager, to HR or to a local safety representative, the other two channels described under S1-3 (page 87), are not captured in this number.

No severe human rights incidents involving forced labour, child labour or trafficking are reported, and no separate count of severe human rights impacts is given.

Policies related to affected communities

Reference: page 98.

The material S3 IROs are entirely downstream: potential positive and negative impacts on "Economic, social, and cultural rights of communities" and a potential negative impact on "Rights of indigenous peoples", all through client projects (page 97).

Human rights instruments. "Our Human Rights Directive is aligned with the UN Guiding Principles on Business and Human Rights, the ILO Declaration on Fundamental Rights At Work, and the OECD Guidelines for Multinational Enterprises. No failures to comply with the directive were reported in 2025" (page 98). The Code of Conduct "expects all employees to act responsibly, respect human rights, conduct themselves ethically in relation to external stakeholders, and help to identify and manage risks of negative social impacts in our day-to-day operations" (page 98).

Downstream, through client projects. "The Sustainability Policy also requires that relevant sustainability topics are assessed and managed throughout the lifecycle of assignments, that AFRY contributes to the UN Sustainable Development Goals, and that the precautionary principle is applied in relation to social risks in assignments" (page 98).

Indigenous peoples. "In this process, AFRY also considers potential impacts on the rights of indigenous peoples and other particularly vulnerable groups, and commits to respect their rights and to identify, prevent, and mitigate any negative impacts through established processes for risk assessment and due diligence" (page 98).

Sector directives "set out mandatory requirements and expectations for assignments in the sector in question", supported by the Guideline for Project and Sector Risk, and community risks enter the tender stage through the RBDD process (page 98).

Processes for engaging with affected communities about impacts

Reference: pages 98-99.

"Internationally recognized frameworks and guidelines, such as the IFC Performance Standards and the Equator Principles, are applied in relevant client assignments to guide work on social engagement" (page 98).

Identification. "AFRY defines affected communities as groups whose economic, social, cultural, or environmental interests may be impacted positively or negatively by our projects or business activities. This includes communities close to project sites, indigenous peoples whose land or resources may be affected, vulnerable or marginalized groups, and communities that are impacted indirectly in the upstream value chain." Communities "are identified as part of the enhanced due diligence process (enhanced RBDD), including an analysis of the geographical context and the nature of the project. Where appropriate, environmental and social impact assessments (ESIAs) are performed, including engagement with affected communities and application of the free, prior, and informed consent (FPIC) principles in projects that affect indigenous peoples" (page 98). Where a third party carries out the ESIA, "the project manager is encouraged to ensure that they live up to AFRY's quality expectations".

Assessment. "AFRY's project team assesses potential and actual impacts by considering direct and indirect effects, impacts on human rights, special considerations in relation to vulnerable groups and indigenous peoples, and aspects of climate and environmental justice where relevant" (page 98).

Dialogue. Conducted "through project-based stakeholder dialogues, collaboration with clients, participation in industry initiatives, direct dialogue with community representatives and civil society organizations, and opportunities to communicate feedback and grievances". "The project team has operational responsibility for ensuring that engagement takes place" (page 99).

Results feed forward: "The results from engagement with affected communities are integrated into risk assessments and due diligence for new assignments, project planning, and delivery methodologies, and into the requirements for suppliers and the Code of Conduct" (page 99). No senior-level accountability for community engagement is named, and no effectiveness assessment of the engagement is disclosed.

Processes to remediate negative impacts and channels for affected communities to raise concerns

Reference: page 99.

"AFRY's whistleblower system Listen Up serves as a Group common grievance and reporting channel and is also available to external stakeholders, including affected communities. The reporting mechanism is confidential and provides protection against retaliation. Where appropriate, project-specific grievance mechanisms may be put in place to enable affected communities to report problems safely and confidentially" (page 99).

Listen Up is described elsewhere as an "Independent, external service, available 24/7 in 28 languages", with anonymity, published on the intranet and on www.afry.com "so that all partners throughout the value chain can report any irregularities" (pages 87, 103). Reports are handled "in the first instance by our Chief Ethics & Compliance Officer, who is responsible for the process and is independent of other management", with critical reports escalated and an annual summary to the Executive Team and the Audit Committee (page 103).

Remediation. "Where AFRY's activities cause or contribute to negative impacts, the company will collaborate on remedial action, including analysis of root cause, direct or contributing actions, and preventive measures to reduce the risk of recurring impacts, in dialogue with affected communities" (page 99).

Volumes are cross-referenced, not disaggregated. "The number of incidents reported in 2025 can be found under S1-17" (page 99), which reports 16 whistleblower cases in total - 15 discrimination or harassment and one human rights - with no split showing how many came from affected communities (page 94).

AFRY does not disclose whether affected communities are aware of the channel or trust it, and does not say how many project-specific grievance mechanisms were in place during 2025.

Taking action on material impacts on affected communities

Reference: page 99.

The disclosure is candid about its own limits. "At present, no ESRS-defined actions have been established" (page 99); community impacts are handled inside the project delivery process, where risks and opportunities identified during tendering "are to be addressed during the project lifecycle in accordance with the delivery process".

Examples of actions in client projects (page 99):

• "Integrating social impact assessments and community perspectives into project planning, decision-making documentation, and governance"
• "Advising clients on risk-mitigating actions of relevance to affected communities"
• "Adjusting project design to avoid or minimize negative impacts on local communities and indigenous peoples"
• "Tracking identified risks and actions throughout the project lifecycle"
• "Tracking and reporting relevant metrics and targets in project delivery"

A second stated gap on effectiveness: "At present, there is no established tracking or monitoring process to systematically identify and assess project-related impacts on affected communities. Tracking of such impacts may nevertheless be addressed via the project management committee, depending on the nature of the project and its risk profile" (page 99).

Resources. "The actions described are not considered to require any material financial or other resources for their implementation, but are carried out as part of existing organizational structures, processes, and resources. No special amounts are therefore reported separately; instead, they form part of the cost items presented in the Group's income statement, primarily under operating expenses. No additional or specially earmarked financial resources are planned for future periods" (page 99).

Business conduct policies and corporate culture

Reference: pages 101-102.

Culture. "Our core values - brave, devoted, team players - form the basis for our culture" (page 101). "We have zero tolerance of all forms of corruption or human rights violations, and we encourage all employees and business partners to report any irregularities and incidents through the Group common whistleblower function, anonymously and without risk of retaliation" (page 101).

Training, with a measured outcome. Code of Conduct training "is mandatory for all employees to complete" and covers "anti-corruption, human rights, accountability in the supply chain, and information security". "The annual completion target is 95 percent of all employees, and the outcome for 2025 was 97 percent" (page 101). The table gives 97.2 percent overall - managers 97.6, consultants 97.1, administrative personnel 96.8 - with Norway lowest at 92.0 percent and Brazil highest at 98.8 percent (page 101). "All senior decision makers at companies that AFRY acquires undergo a mandatory orientation in business conduct. In 2025, we carried out compliance onboarding of all Heads of Segments" (page 101).

Policy documents (pages 101-102). Code of Conduct; Supplier Code of Conduct, which "is to be appended to all project agreements"; Compliance & Ethics Policy, "aligned with the UN Convention against Corruption (UN Regulation No. 127)"; Human Rights Directive; Anti-Corruption Directive, which "prohibits all types of inducements and requires transparency in business relationships"; Information Security and Cybersecurity Policy; Data Privacy Directive; and sector directives, developed since 2023 "specific to sectors that we consider to have an elevated risk profile" and "approved by the Executive Team".

Enforcement. "Each manager is responsible for compliance with policies in their area of responsibility, while the Risk & Compliance function has responsibility for follow-up at Group level" (page 102). AFRY does not disclose a separate figure for the proportion of functions at risk of corruption covered by training programmes.

Management of relationships with suppliers

Reference: page 102.

Relationships with suppliers is one of AFRY's four material G1 sub-topics, carrying an actual positive impact and a risk (page 100).

Supplier Code of Conduct. "Governance is provided by AFRY's Supplier Code of Conduct, which builds on the UN Global Compact's ten principles for responsible corporate governance. The Supplier Code of Conduct formulates our requirements and strict principles in the supply chain in relation to responsible business conduct, health and safety, climate and environment, human rights, sanctions, and fair competition in the market." It "must always be appended to all of AFRY's agreements with suppliers, subconsultants, and collaborators. If a collaboration or partner does not live up to the criteria we expect, we will take action" (page 102).

Risk-based screening. "AFRY applies a risk-based analysis when we evaluate partners in high-risk projects" through the RBDD process (page 102).

Purchasing. "Purchasing and procurement of goods and services are governed by AFRY's Sourcing Directive. This sets out mandatory rules for all employees to ensure good governance, compliance with applicable legislation, and policies to ensure cost-effective procurement, in terms of sustainability and risk mitigation... It requires suppliers to be evaluated and selected on the basis of a combined assessment of cost and quality together with environmental, social, and governance factors" (page 102).

Supply chain profile. "As an advisory and service company, our relationships with suppliers mainly involve leasing and maintenance of office premises, purchases of office equipment, IT services, and business travel. In our projects, we mainly provide services, along with materials and purchases to some extent" (page 102).

What is not disclosed: no supplier audit count, no share of suppliers screened or signed up to the Code, and no social or environmental supplier assessment criteria applied to SMEs. The only quantified supplier measure in the report is climate-related - 65 percent of priority suppliers had SBTi-validated targets at end-2025, against a target of 87 percent by 2027 (page 66).

Prevention and detection of corruption and bribery

Reference: pages 102-103.

"AFRY applies a strict policy of zero tolerance of corruption and bribery, which is set out in our Code of Conduct. Preventive work includes regular risk analyses, clear internal guidelines, and training for employees on ethical principles and anti-corruption requirements" (page 102).

Training. Code of Conduct training "is completed by all new hires" and "sent out annually to all employees, including the Executive Team and the Board of Directors. It includes training on anti-corruption and bribery." Acquired companies' senior decision makers "undergo a mandatory orientation on business conduct", and "In 2025, AFRY's Chief Ethics & Compliance Officer carried out training with all Heads of Segments" (pages 102-103). Completion for 2025 was 97 percent (page 101).

RBDD, with a quantified activity measure. "RBDD is conducted in connection with tendering processes... The process builds on the OECD's Guidelines for Multinational Enterprises on Responsible Business Conduct, and assesses environmental, social, and governance risks, including the risk of corruption and bribery. When a project is considered to have an elevated risk profile, an enhanced RBDD process is required." Tracking now runs through the CRM system "with automatic notification of the Compliance & Ethics function in the event of new high-risk assignments". "Enhanced due diligence was triggered on around 530 occasions in 2025, compared with 460 occasions in 2024" (page 103).

Independence of the investigator. "All reports are dealt with in the first instance by our Chief Ethics & Compliance Officer, who is responsible for the process and is independent of other management. Critical reports are escalated to the individual who is ultimately responsible for the unit concerned. A summary of all reports is presented annually to the Executive Team and the Audit Committee. Since 2023, significant internal investigations have also been reported on a quarterly basis to a special Risk Committee" (page 103).

A gap the company states plainly: geography-specific corruption risk assessments "was carried out in Brazil in 2023, and in Peru and Thailand in 2024. No such assessments were carried out in 2025" (page 103).

Targets related to business conduct

Back-filled from the business conduct chapter, where targets are addressed as part of the MDR-T/GDR-T disclosures rather than as a numbered disclosure requirement. G1-3 became a standalone DR only in the 2025/2026 ESRS.

AFRY states that it sets no ESRS target for business conduct, and describes what it tracks instead: "AFRY has no public ESRS targets in relation to business conduct. The targets used to track the effectiveness of the company's policies and actions in relation to business conduct are based instead on operational and internal governance parameters, such as the level of completion of mandatory training in the Code of Conduct, and compliance with policy documents" (page 103).

"The methodology is based on available and verifiable data from the Group's internal systems, including training platforms and HR systems. No special assumptions about policy changes, market developments, or regulatory developments were applied when these targets were set" (page 103).

This satisfies MDR-T's second limb - effectiveness tracked in the absence of an outcome-oriented target - and the operational measure is quantified and has a stated threshold: "The annual completion target is 95 percent of all employees, and the outcome for 2025 was 97 percent" (page 101), with the detailed table showing 97.2 percent overall and a low of 92.0 percent in Norway. AFRY describes this as "a relative target, expressed as a percentage of the employee population concerned" (page 103), and the KPI is carried at Group level on page 60 as "Share of employees who have completed training regarding our Code of Conduct - Outcome: 97% (96)".

Two further effectiveness measures are tracked without being framed as targets: RBDD compliance, "including the share of high-risk projects subject to enhanced RBDD... tracked continuously by the Risk & Compliance function" (page 99), with 530 enhanced due diligence triggers in 2025 against 460 in 2024 (page 103); and whistleblower case volumes reported quarterly to the Risk Committee and annually to the Audit Committee (pages 87, 103).

No target covers corruption incidents, supplier Code of Conduct coverage or payment practices.

Incidents of corruption or bribery

Reference: page 103.

"No incidents of corruption or bribery were detected in 2025. AFRY did not pay any fines or penalties" (page 103).

The nil return sits alongside an active detection apparatus rather than in place of one. Enhanced due diligence "was triggered on around 530 occasions in 2025, compared with 460 occasions in 2024, suggesting that progress is being made in the implementation of risk assessment and due diligence processes" (page 103). Sixteen reports were made through the Listen Up whistleblower function during the year, 15 concerning discrimination or harassment and one concerning human rights - none classified as corruption or bribery - and "No fines, penalties, compensation, sanctions, or other financial consequences arose as a result of the incidents and complaints reported" (page 94).

AFRY does not disclose the number of confirmed incidents in which its own workers were dismissed or disciplined for corruption or bribery, nor the number of confirmed incidents relating to contracts with business partners, because no incidents were detected. No public legal cases regarding corrupt behaviour are reported.

A related gap is disclosed under G1-3: geography-specific corruption risk assessments were carried out in Brazil in 2023 and in Peru and Thailand in 2024, but "No such assessments were carried out in 2025" (page 103).

Political influence and lobbying activities

Reference: pages 103-104.

AFRY discloses this even though its own IRO-1 states that "Areas such as animal welfare and political engagement are not considered to be material, but we provide information on our advocacy work under G1-5" (page 101). Its ESRS content index nonetheless marks G1-5 as Reported: Yes, page 103 (page 106).

Activity. "AFRY engages in advocacy partly through its membership of industry associations and networks, and partly through its own dealings with political representatives... We are a member of various trade associations, including Technology Industries of Sweden, Swedenergy, and Kraftkvinnorna (Women in Power), which lobby on issues such as an improved energy supply, electrification, energy efficiency, circular economy, and recruitment of women" (page 103).

Controls and register. "No part of our operations provides political donations or party political support. All advocacy complies with our Code of Conduct and Anti-Corruption Policy... Employees who engage in political interactions undergo mandatory training in our Anti-Corruption Policy. EVP and Head of Commercial & Communications, part of the Executive Team, is responsible for AFRY's advocacy activities. AFRY is registered in the EU's transparency register: REG 443590298664-69" (page 104).

Revolving door. "During the reporting period, no member of our governing bodies had been made a member of, or held a comparable position in, a public authority (including a supervisory authority) in the two years before their appointment" (page 104).

Expenditure (page 104): political contributions SEK 0; membership of lobbying associations SEK 0; total expenditure on lobbying activities SEK 0.

The zero for association membership sits oddly beside the named memberships of Technology Industries of Sweden, Swedenergy and Kraftkvinnorna on the preceding page; AFRY does not reconcile the two. Substantive positions are stated: support for "a stable, fossil-free, and flexible energy supply", "better terms for the development of renewable energy and energy storage, in line with the work to establish new nuclear power", and promotion of the STEM subjects (page 104).