Apotea

Governance roles

Reference: pages 44-45; ESRS content index page 88.

Apotea's Board of Directors holds overall responsibility for the Sustainability Report and for approving Group policies. "The Board has regularly monitored the implementation of the CSRD framework at Board meetings during 2025." (page 45)

The Audit and Sustainability Committee comprises three members and "is responsible for preparing impacts, risks and opportunities based on the double materiality assessment (DMA) ... ahead of Board meetings and Board decisions". Sustainability matters sit inside the company's risk management process, and controls in HR, Procurement and IT also mitigate sustainability risks. (GOV-1-22 a, b, c; page 45)

Expertise is distributed by ESRS topic (GOV-1-23 b, page 45):

• Sustainability department - E1 Climate change and E5 Resource use and circular economy.
• Group management and HR - G1 Business ethics and S1 Own workforce.
• Quality Manager, marketing and IT - S4 Consumers and end-users.

The Board "possesses broad and collective expertise in sustainability to address Apotea's material IROs", with competence needs assessed in connection with the Board's work and operational planning (GOV-1-23 a).

On metrics and targets the company is candid: "Apotea currently has complete metrics and targets in accordance with CSRD/ESRS only for climate targets under ESRS E1. Climate targets are approved annually by the CEO and monitored by analysing outcomes and investigating any deviations from target achievement." (GOV-1-22 d, page 45)

Information provided to and matters addressed by the administrative, management and supervisory bodies

Reference: pages 45-46; ESRS content index page 88.

"Apotea's Board of Directors approves Group-wide policies following an annual review by policy owners." Policy owners update the policies before Board approval and oversee compliance; "Any deficiencies are escalated to the CEO, who reports annually to the Board of Directors on policy compliance". The DMA "is prepared by the audit and sustainability committee and approved annually by the Board of Directors". (GOV-2-26 a, page 45)

Apotea publishes a governing-documents table listing the Sustainability Policy, Code of Conduct for employees, Code of Conduct for suppliers and partners, Data Protection Policy, HR Policy, Purchasing Guideline and Information Security Policy, each with a summary of its content (page 45).

"Material sustainability matters are considered in the company's sustainability strategy, which is approved by the CEO." Sustainability risks are considered in the risk assessment process and in the DMA review, and "The results of Apotea's risk assessment process are presented to the audit and sustainability committee and the Board of Directors annually." (GOV-2-26 b, page 46)

"During the reporting period for financial year 2025, all matters with material IROs have been addressed. For a summary of all material IROs, see the SBM-3 table on pages 49-50." (GOV-2-26 c, page 46)

A limitation is stated in the same section: "Apotea currently has no formalised due diligence process in accordance with ESRS 1, Chapter 4." (page 45)

Integration of sustainability-related performance in incentive schemes

Reference: page 46; repeated at page 63. ESRS content index page 88.

This is a complete nil return. Apotea states: "Apotea has no specific sustainability metrics included in incentive programmes or in the company's remuneration guidelines. (GOV-3-29 a, b, c, d, e)" (page 46).

The statement is repeated verbatim inside the climate chapter, tagged to the climate-specific cross-reference: "Apotea has no specific sustainability metrics included in incentive schemes or in the company's remuneration guidelines. (E1-GOV-3-13)" (page 63).

Because no sustainability-related performance is built into remuneration, the remaining GOV-3 datapoints (the characteristics of the schemes, the proportion of variable remuneration linked to sustainability targets, the level at which terms are approved) do not arise and are not disclosed. There is therefore no climate-linked pay at Apotea for FY2025, which stands in contrast to the company's SBTi-validated climate targets and is worth reading alongside the E1-4 outcome, where the scope 1 and 2 target was missed (page 65).

Statement on due diligence

Reference: page 46; ESRS content index page 88.

Apotea discloses that it does not meet the ESRS due diligence framework: "Apotea currently has no formalised due diligence process in accordance with ESRS 1, Chapter 4. Consequently, no complete mapping of the process steps can be provided in this Sustainability Report." (GOV-4-30, 32; page 46)

It then names the documents that partly cover the ground and states plainly that they fall short: "The following existing governing documents address due diligence: Apotea's Code of Conduct, procurement guidelines, and whistleblowing guidelines; however, these do not fulfil the requirements of the OECD due diligence process." (page 46)

The same admission appears under GOV-2 on page 45, so it is not a drafting slip. GOV-4 normally takes the form of a table mapping the core due diligence elements to the pages where each is addressed; Apotea provides no such table. The Appendix B list of datapoints derived from other EU legislation still records ESRS 2 GOV-4, Point 30, Statement on due diligence against SFDR Indicator No 10, Table 3, Annex I (page 90).

Risk management and internal controls over sustainability reporting

Reference: page 46; ESRS content index page 88.

Scope of the risk assessment: it "covers both qualitative and quantitative data, as well as the external systems used, such as HR systems, whistleblowing systems, and climate accounting systems" (GOV-5-36 a).

Approach and methodology (GOV-5-36 b): sustainability reporting sits inside Apotea's risk management and internal control framework, which runs in three steps. First, "The CEO initiates the identification and evaluation of strategic, operational and financial risks", assessed on impact, likelihood and the effectiveness of existing controls, scored, and recorded in a risk register that also covers sustainability reporting. Second, an internal control framework is established against the identified risks. Third, "an annual self-assessment of internal control is carried out, with the results analysed and reported to the Audit and Sustainability Committee for review and subsequently submitted to the Board of Directors for approval."

Main risks and mitigations (GOV-5-36 c): the risks identified are those relating to the Sustainability Report itself "as well as the risk of not achieving the established climate targets". Mitigations are controls "in accordance with the four-eyes principle when carrying out the DMA and preparing the Sustainability Report", plus the annual review of the sustainability policy.

Integration and reporting (GOV-5-36 d, e): the Sustainability department collects datapoints with other departments and external parties, and "Progress against the climate targets is reported annually to the CEO." (page 46)

Strategy, business model and value chain

Reference: pages 46-47; ESRS content index page 88.

Business. "Apotea operates an online pharmacy with distribution of prescription medicines, self-care products and related retail goods to consumers in Sweden and Norway. The largest product categories are prescription medicines and health-related retail goods." All sales run through an e-commerce platform and customers are private individuals. (SBM-1-40 ai, aii; page 46). The range comprises "over 50,000 products from numerous suppliers" (page 62).

Workforce. "The average number of employees in 2025 totals 727, of whom 705 are based in Sweden and 22 in Norway." (SBM-1-40 aiii, page 46)

Sites. Automated fulfilment centres in Morgongåva and Varberg, three prescription branches in the Stockholm area, and Norwegian operations based in Oslo (SBM-1-42 c, page 46).

Value chain. Upstream covers "suppliers of medicines, self-care products, packaging materials, and logistics and transport services"; downstream covers "consumers, transport operators and recycling actors". Apotea "holds a central position between suppliers and end customers" (SBM-1-42 a, b, c, page 46).

Strategy by topic (SBM-1-40 e, f, g; pages 47): climate targets cover scope 1-3 and apply to the whole business and value chain without limitation by product, customer group or geography; circular economy work focuses on packaging requirements and supplier advocacy; own workforce on systematic work environment management (SAM), harassment prevention and GDPR; consumers on the self-monitoring programme, deviation management and competence development; business ethics on culture, anti-corruption and the whistleblowing function.

The company also states it "does not engage in any coal-, oil- or gas-related activities" (page 62).

Interests and views of stakeholders

Reference: pages 47-48, with the stakeholder table on page 51. ESRS content index page 88.

Apotea splits stakeholders into "a) Affected stakeholders" and "b) Users of the Sustainability Report", and names the principal groups as "customers, employees, owners, the Board of Directors, suppliers, interest organisations, municipalities, and authorities" (page 47-48).

"A structured and in-depth stakeholder dialogue was conducted in 2025 as part of the DMA process." (SBM-2-45 a, page 48). The forms of dialogue are tabulated on page 51: surveys for customers, product-range suppliers, suppliers to own operations and freight companies; interviews for employees, trade union representatives, owners and the Board of Directors. Nature is "Included in DMA as a silent stakeholder".

A footnote records who was left out: "Local communities, subcontractors, interest organisations and industry associations, authorities, and water and waste companies have been excluded from the 2025 stakeholder dialogue." (page 52)

On board-level oversight the company is explicit about a limitation: "Apotea's audit and sustainability committee and the Board of Directors have not reviewed the results directly; instead, they have been informed through a presentation of the DMA covering the material IROs identified, which are based in part on the stakeholder dialogue conducted." (SBM-2-45 d, page 48)

Outcome: "The stakeholder dialogue confirmed that Apotea's stakeholders share the company's view on priority sustainability issues", with climate change flagged as of particular importance (SBM-2-45 b, page 48).

Material impacts, risks and opportunities and their interaction with strategy and business model

Reference: pages 48-51 (IRO table pages 49-50); ESRS content index page 88.

14 material IROs across five standards, tabulated on pages 49-50 with topic, description, type, time horizon, value-chain position and whether covered by an ESRS DR or an entity-specific disclosure. Every row is an impact: 6 actual negative and 8 potential negative. Counts by standard: E1 2, E5 3, S1 3, S4 2, G1 4.

No risks and no opportunities were found material. "Apotea has not identified any opportunities considered sufficiently significant to be classified as material under the applicable reporting requirements." (SBM-3-48 b, page 51) And under IRO-1: "IROs not assessed as material are not included in this report, and no IROs were assessed as financially material." (IRO-1-53 cii, page 52)

No strategy change. "the identified risks and adverse impacts have not been assessed as requiring changes to Apotea's current strategy or business model, and are managed within the existing sustainability framework" (SBM-3-48 b, page 51).

Where the impacts sit (SBM-3-48 ci, cii, ciii, c iv; page 51): Apotea's material impacts "relate primarily to negative effects on the environment in the form of greenhouse gas emissions and resource consumption in the value chain, particularly in connection with the manufacture and distribution of products"; people impacts are occupational health and safety in own operations, privacy for employees and customers, and consumer safety in handling medicines. Time horizons used in the DMA are 1 year, 2-5 years and 5-10 years.

Financial effects. "At present, no material financial impacts have been identified ... Furthermore, there is no assessed significant risk of material adjustments during the next annual reporting period to the carrying amounts of assets and liabilities recognised in the financial statements." (SBM-3-48 d, page 51)

Resilience. "Apotea has not conducted a resilience analysis of its business model and strategy in relation to its material IROs. (SBM-3-48 f)" (page 51)

Description of the processes to identify and assess material impacts, risks and opportunities

Reference: pages 51-54; ESRS content index page 88.

First-year assessment. "2025 is the first year in which Apotea has conducted a DMA. Accordingly, there are no changes to the process since the previous reporting period." (IRO-53 h, page 54)

Four steps (pages 51-53): (1) understanding the sustainability context across the value chain from upstream manufacturing to downstream use and recycling, covering the whole Group; (2) identification of IROs "on the basis of the subject matter list in ESRS 1, Appendix A, as well as Apotea's operational context and its known impacts in the value chain"; (3) materiality assessment; (4) determination of material matters.

Impact materiality method (IRO-1-53 a, page 52): "Each matter was assessed on three parameters: scale (severity of impact), scope (breadth of impact), and irremediability", combined into an overall assessment, with likelihood added for potential impacts. "Matters were classified as material where, taken together, they were assessed as having an impact of moderate or greater significance, being relatively widespread, and/or being wholly or partially irremediable."

Financial materiality method (IRO-1-53 cii, page 52): a combination of "the likelihood of a risk or opportunity materialising" and "the potential financial effect", material where there is "a moderate likelihood of producing material financial effects". Outcome: "no IROs were assessed as financially material."

Topic-level IRO-1 statements (pages 52-53) cover E1 items 20-21, E2 item 11, E3 item 8, E4 items 17-19, E5 item 11 and G1 item 6. Notable limitations disclosed there: for E2 and E3, "Apotea has not reviewed its operational sites and business activities" and "has not conducted consultations"; for E4, "Transition risks, physical risks and systemic risks have not been assessed"; for E5, "Apotea has not conducted consultations with affected communities".

Result (page 53): "Five ESRS standards have been assessed as material for reporting in accordance with Apotea's DMA" - E1, E5, S1, S4 and G1. "The DMA has been anchored in the audit and sustainability committee and approved by the Board of Directors." (IRO-1-54 d)

Disclosure requirements in ESRS covered by the undertaking's sustainability statement

Reference: page 54, with the content index at pages 88-89 and the Appendix B datapoint list at pages 90-93.

Apotea prints a genuine ESRS content index, headed "Content Index (ESRS IRO-2 56)", listing each disclosure requirement against a page reference (pages 88-89). It covers the twelve ESRS 2 requirements (BP-1, BP-2, GOV-1 to GOV-5, SBM-1 to SBM-3, IRO-1, IRO-2), then the material topical standards only:

• E1 - ESRS 2 SBM-3, E1-1 to E1-6 (pages 62-68). E1-7, E1-8 and E1-9 are absent.
• E5 - E5-1 to E5-5 plus two entity-specific metric rows (pages 70-72).
• S1 - ESRS 2 SBM-3, S1-1 to S1-7, S1-14 and S1-17 (pages 74-79). S1-8 to S1-13, S1-15 and S1-16 are absent.
• S4 - ESRS 2 SBM-3, S4-1 to S4-5 plus two entity-specific metric rows (pages 81-84).
• G1 - ESRS 2 GOV-1, G1-1, G1-3, G1-4 plus one entity-specific metric row (pages 86-87). G1-2, G1-5 and G1-6 are absent.

The basis for selection is described on page 54: "For the sustainability matters assessed as material within each IRO, Apotea has reviewed the ESRS disclosure requirements to determine which disclosures are material to report. The assessment has been based on the identified IROs and on whether the disclosure is subject to phasing-in rules or is voluntary. The documentation has been compiled in the IMA and is updated annually as the basis for a new assessment (IRO-2-59)."

The index does not say which requirements were left out or why, and no per-requirement phase-in claims are made anywhere in the statement. The separate Appendix B list marks the E2, E3, E4, S2 and S3 datapoints derived from other EU legislation as "Not material" (pages 91-93).

Transition plan for climate change mitigation

Reference: pages 62-63; ESRS content index page 88.

There is no transition plan. "Apotea does not have a separate formalised transition plan linked to its current climate targets, but has conducted emissions-reduction work within the framework of its ordinary business and sustainability activities. During 2026, the company intends to develop a transition plan. The plan will describe priority measures for achieving the targets, the allocation of responsibilities and monitoring over time. The transition plan will be adopted within Apotea's ordinary governance processes, and its implementation will be monitored and reported in the Sustainability Report for the 2026 financial year. (E1-1-14, 17)" (page 62)

What stands in its place are SBTi-validated targets adopted in 2021 with a 2019 base year and a 2025 target year (page 62):

• absolute scope 1 and 2 emissions -25.2% by 2025;
• absolute scope 3 emissions from transport and commuting -15.0% by 2025;
• relative scope 3 emissions from purchased products and their use -35.3% tCO2e per SEK million (profit after tax) by 2025.

"Through SBTi validation, the targets are assessed as being in line with the Paris Agreement and limiting global warming to 1.5 °C. Apotea does not engage in any coal-, oil- or gas-related activities." (page 62)

Locked-in emissions are addressed qualitatively and only in the value chain: "Apotea considers that emissions linked to purchased products represent a risk of locked-in emissions in the value chain, as emission-intensive production and raw material flows are largely outside Apotea's direct control and may therefore affect the ability to meet emissions targets over time." (page 63)

Scope 1 and 2 "account for less than one percent of Apotea's total emissions, owing to energy-efficient buildings and the use of and investment in renewable energy" (page 62), so the transition question is overwhelmingly a supplier question, addressed by advocacy and dialogue rather than by a plan with resources attached.

Identification of climate-related risks and scenario analysis

Back-filled from ESRS 2 IRO-1 (page 52) and the E1 SBM-3 section (page 62), where this content is disclosed in the FY2025 report. This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

Physical and transition classification is explicit. Under E1-SBM-3-18 (page 62) each risk is labelled: within own operations, "stricter energy-efficiency requirements, higher energy costs and other transition requirements that may lead to investment needs and increased operating costs (climate-related transition risk)", and "more frequent extreme weather events may affect operations and logistics flows" (climate-related physical risk). In the value chain, supplier climate-reporting and emissions-reduction demands are transition risk, while "extreme weather events in regions with low climate resilience may cause production and logistics disruptions" is physical risk.

Methodology (E1-IRO-1-20 b, 21, E1-AR11, AR12; page 52): "The analysis follows a structured process in which relevant physical hazards and transition events are identified per scenario and time horizon. All relevant assets and business activities are then reviewed to assess potential exposure (where in the business or value chain an event may have an impact) and sensitivity (the degree to which the impact can be managed given existing working practices and controls)."

Scenarios (E1-AR11 d, page 52): "a 1.5 °C scenario aligned with the Paris Agreement (SSP1) to identify and assess transition-related risks and opportunities, and a 3 °C scenario with high emissions and weak climate policy (SSP4) to identify and assess physical climate-related risk."

Scope and horizons (pages 52, 62): time horizons of 1, 5 and 10 years, aligned to short-term, medium-term and longer-term planning. "The assessment was limited to Apotea's logistics operations in Morgongåva and Varberg, and to the supply of prescription medicines."

Results (page 62): "The scenario analysis identified no material effects within a one-to-five-year horizon in the scenarios examined. Over a ten-year horizon, the most relevant risk is linked to medicines supply in the 3 °C scenario, where recurring disruptions to production and logistics could result in parts of the range being temporarily restricted." Also: "Apotea has not identified any assets or business activities that are considered incompatible with a low-emissions scenario" (E1-AR12 d, page 53), and "The climate scenarios used are consistent with the climate-related assumptions in the financial statements." (E1-AR15, page 53)

Gap worth noting: no named global average temperature projection is given per scenario beyond the 1.5 °C and 3 °C labels, and the analysis was carried out during 2025 but "did not form the basis for Apotea's priorities or action planning during the reporting period" (page 65).

Resilience in relation to climate change

Back-filled from ESRS 2 SBM-3 (page 51) and the E1 SBM-3 / E1-1 section (page 62), where this content is disclosed in the FY2025 report. This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

Apotea states plainly that no resilience analysis was performed. Twice:

• "Apotea has not conducted a resilience analysis of its business model and strategy in relation to its material IROs. (SBM-3-48 f)" (page 51)
• "During 2025, Apotea conducted a climate scenario analysis to assess how the company's strategy and business model may be affected by climate-related changes. A resilience analysis has not been carried out." (page 62)

What the report does contain, from the scenario analysis that was carried out (E1-SBM-3-19 a, b, c, AR 7 b, AR 8; page 62):

• Implications for strategy. "Overall, the climate scenario analysis shows that no additional strategic measures have been identified as necessary beyond existing ways of working."
• Capacity to adapt. The one ten-year risk identified, restricted medicines supply under the 3 °C scenario, is judged manageable: "The financial impact of this is assessed as limited, given existing risk-mitigation practices such as inventory reviews and alternative procurement routes."
• Areas of uncertainty. "The main uncertainties relate to the development of climate-related impacts at the supplier level and the pace of change in regulations and market requirements. Over the longer term, towards 2050, the potential impact is assessed as likely to increase. The analysis is therefore monitored and updated as needed."
• Use of the results. "The results have been communicated to the relevant management function and are used as a basis for Apotea's risk management and sustainability work."

There is no analysis of the flexibility of financial resources, of the ability to redeploy or repurpose assets, or of the contribution of the mitigation and adaptation actions to resilience, because no resilience analysis was undertaken. The scenario work itself is confined to Morgongåva, Varberg and the prescription-medicines supply chain (page 62).

Policies related to climate change mitigation and adaptation

Reference: page 63; ESRS content index page 88.

One policy carries the topic: "Apotea's work to manage material impacts, risks and opportunities linked to climate change is governed by the company's sustainability policy, which applies to its own operations and, where applicable, also to suppliers (upstream). (ESRS 2-MDR-P-65 b) The policy is adopted annually by the Board of Directors and is designed on the basis of Apotea's annual DMA and stakeholder dialogues. (ESRS 2-MDR-P-65 c, e)"

Content of the commitments (E1-2-25, ESRS 2-MDR-P-65 a):

• "a commitment to continually reduce emissions in the company's own operations and in the value chain in line with Apotea's climate targets";
• "Apotea shall offer fossil-free and zero-emission delivery options and place requirements on carriers to accelerate the transition towards a zero-emission vehicle fleet";
• energy efficiency in own operations, "not least because energy-related emissions are covered by Apotea's scope 1 and 2 climate targets". "The company uses only renewable energy in its own operations."

Adaptation is deliberately out of scope: "Climate adaptation is not covered in the policy, as it is not assessed as material in the company's DMA."

Availability (ESRS 2-MDR-P-65 f): "The sustainability policy is not publicly available but is shared as needed with relevant stakeholders, such as suppliers or employees." Readers cannot therefore test the policy text against the summary given here.

The section closes by cross-referring the incentive question: "Apotea has no specific sustainability metrics included in incentive schemes or in the company's remuneration guidelines. (E1-GOV-3-13)"

Actions and resources in relation to climate change policies

Reference: pages 63-64; ESRS content index page 88.

Resources (E1-AR21, page 63): actions run "within the framework of the company's ordinary business, risk and sustainability processes", "primarily through internal resources and in collaboration with external partners, such as freight companies and suppliers". "Any investments and capital expenditure are managed within the ordinary budgeting and investment processes."

Transport (E1-3-29 a, ESRS 2-MDR-A-68; page 63): "In 2025, Apotea entered into a new collaboration with PostNord. Through PostNord's electric trucks, a growing proportion of Apotea's deliveries can be made entirely emission-free ... Under the new arrangement, mid-mile transport between terminals has also been electrified. These journeys were previously operated using biofuel (HVO)." Requirements are placed on carriers to move to a zero-emission fleet, alongside higher load factors, route optimisation and flow coordination. Apotea "works with a number of freight carriers, the majority of which adhere to Svensk Handel's (Swedish Commerce) industry agreement on fossil-free transport."

Assortment and supply chain (page 64): "In 2025, Apotea participated in an industry-wide initiative together with other pharmacy operators, with the aim of developing a common methodology for calculating the climate impact of pharmaceuticals and related transport."

Energy (page 64): only renewable energy in own operations; the logistics facilities in Morgongåva and Varberg "are certified to Miljöbyggnad Silver standard and have rooftop solar panel installations"; "In 2025, a new energy audit was commenced and will be completed during financial year 2026". "During the year, Apotea did not identify any quantifiable measures relating to upstream energy use in the value chain."

Two stated limitations. First, no per-measure quantification: "Achieved and expected emissions reductions are not quantified per individual measure, but are monitored collectively through the development of Apotea's greenhouse gas emissions over time in the carbon accounts (see table Greenhouse Gas Emissions, section E1-6). (E1-3-29 b)" The PostNord switch specifically "has not resulted in any material separately quantifiable reduction in emissions, as the route in question was previously operated using biofuel (HVO)". Second, no money: "Apotea does not currently report separately on significant capital expenditure and operating expenditure linked to individual climate measures ... The measures taken or planned are not assessed as giving rise to significant operating expenditure or capital expenditure." (E1-3-29 c; ESRS 2-MDR-A-69 a, b, c)

Aggregate effect disclosed: "During the 2025 financial year, transport emissions decreased by 33.5 percent compared with the previous year, reflecting the combined effect of the measures implemented." No nature-based solutions were identified in the portfolio (page 64).

Targets related to climate change mitigation and adaptation

Reference: pages 64-65, with the target table on page 65 and accounting policies on page 67. ESRS content index page 88.

Three SBTi-validated targets, base year 2019, target year 2025, and the outcomes reported against them (page 65):

Target 1 was missed and the company explains why: scope 1 and 2 reached 27.8 tCO2e, "an increase of 95.6 percent compared with the base year 2019. The primary explanation for the increase and the failure to meet the target is higher energy consumption of both electricity and district heating in connection with the commissioning of a new fulfilment centre." Apotea uses only renewable electricity, "however, the market-based emission factor applied in the climate calculation is not zero" (page 65).

Target 3 is acknowledged as a weak steering metric: "Apotea considers that the intensity metric is affected by variations in profit after tax as well as by inflation and price changes, meaning that it does not necessarily reflect actual climate impact." (page 65)

New targets. "During 2025, Apotea adopted new climate targets that have been validated and approved by SBTi and that take effect from 2026 ... A key change in the new targets is the introduction of a supplier engagement target." The values are not disclosed; they "will be presented and monitored in the Sustainability Report for financial year 2026" (page 64).

Scope and method (page 67): targets are gross, "No carbon credits, removals, or so-called avoided emissions are credited"; they apply to Apotea Sverige AB only, so "Emissions attributable to the Norwegian operations are therefore not included in the calculation of the current climate targets"; capital goods (category 2) are excluded from any target.

Stakeholders and validation: "Apotea's stakeholders have not participated in the setting of these targets" and "Apotea has no additional climate-related targets beyond the SBTi-validated climate targets" (E1-4-33, 34 e; page 64). Adaptation targets are absent, consistent with adaptation being assessed as not material (page 63).

Energy consumption and mix

Reference: page 66; ESRS content index page 88.

Total energy consumption in own operations, 2025 (MWh):

Explanatory note (E1-5-37 a, b, c, 39, E1-AR34): "Only renewable electricity is used in operations, and solar power is generated via photovoltaic installations on the roofs of the fulfilment centres. The reported fossil energy and nuclear energy relate to district heating and are affected by the supplier's fuel mix. Fuel consumption refers to Apotea's own vehicles, which run on 100 percent HVO."

The fossil and nuclear MWh are therefore not a fuel choice by Apotea but the residual fuel mix of its district heating supplier, which is also the reason scope 2 market-based emissions rose in 2025 (page 65).

Assurance of the figures is limited to the statutory auditor: "The reported figures have not been validated by an external body, other than by Apotea's auditor." (E1-5-37 a, b, c, 39; E1-AR34; ESRS 2-MDR-M-75, 77 b)

Energy intensity per net revenue for high climate impact sectors is marked "N/A" in the Appendix B datapoint list (page 90), Apotea not being in such a sector. No prior-year energy comparatives are given, consistent with 2025 being the first CSRD reporting year.

Gross Scopes 1, 2, 3 and Total GHG emissions

Reference: pages 66-68; ESRS content index page 88.

Emissions, tonnes CO2e (page 66):

Largest scope 3 categories, 2025: purchased goods and services (category 1) 142,840.1 tCO2e, "over 80 percent of Apotea's total emissions", up 10.9%; capital goods (category 2) 30,084.6, "approximately 17 percent", down 4.2% as the Varberg build-out completed; upstream transportation and distribution (category 4) 945.4, down 33.5% (pages 66-67).

Intensity (E1-6-53, 55): "Total greenhouse gas emissions (market-based) per net revenue 24.3" tCO2e per SEK million, on Group net revenue of SEK 7,203.3 million (page 67).

Data quality (page 68): category 1 is "calculated based on product weight or a cost-based method, meaning that calculations are based on 100 percent secondary data"; categories 2, 5, 6, 7, 11, 13 and 15 are also 100% secondary; scope 1 is 100% primary and scope 2 is 84% primary. Categories 8, 9, 10, 12 and 14 are excluded as not relevant, and "No categories have been excluded on the grounds of low or immaterial emissions."

Restatements disclosed (page 66 footnotes): 2024 figures were corrected because transport emissions had been reported under category 9 rather than category 4, and because scope 3 had been split incorrectly into market-based and location-based rows.

Also reported: "During the year, 73.1 percent of parcel deliveries were fossil-free, in accordance with the Swedish Commerce's industry agreement" (page 68). Consolidation follows the operational control principle; gases covered are CO2, CH4, N2O, HFC, PFC, SF6 and NF3 (page 67).

Policies related to resource use and circular economy

Reference: page 70; ESRS content index page 88.

The topic is governed by the same instrument as climate: "Apotea's work on resource efficiency and circular economy is governed by the company's sustainability policy, which is adopted by the Board of Directors and applies to the entire Group. The policy is reviewed annually and forms the framework for sustainability governance. (ESRS 2-MDR-P-65 a, b, c)"

Third-party reference frameworks (ESRS 2-MDR-P-65 d): "It takes into account the Universal Declaration of Human Rights, the OECD Guidelines for Multinational Enterprises, the ILO core conventions, and the UN Guiding Principles on Business and Human Rights (UNGPs)."

Design input (ESRS 2-MDR-P-65 e): "When developing and revising the sustainability policy, the outcomes of Apotea's double materiality assessment (DMA) are taken into account; this assessment is based in part on dialogue with both internal and external stakeholders."

Scope of the environmental commitments (E5-1-14, 15 a, b): "Apotea's sustainability policy covers three main areas: environment and climate, own workforce, and long-term profitability and governance. Within the environmental area, governance is focused in particular on reducing climate emissions, promoting sustainable resource use with an emphasis on recycled, renewable, and recyclable materials, and ensuring responsible waste management."

Availability (ESRS 2-MDR-P-65 f): "The sustainability policy is not publicly available but is shared as needed with relevant stakeholders, such as suppliers or employees."

The policy contains no commitment on sustainable sourcing of specific inputs, on waste hierarchy priorities in numeric form, or on phasing out virgin resources; those elements are addressed, where at all, in the E5-2 actions rather than in policy.

Actions and resources related to resource use and circular economy

Reference: pages 70-71; ESRS content index page 88.

Apotea opens by naming the constraint: "Apotea's business model, selling pharmaceuticals, healthcare products, and general merchandise via e-commerce, is based on a linear model in which products are manufactured, sold, and consumed. The vast majority of products sold by Apotea are consumables and cannot be reused; accordingly, improving resource efficiency is a priority area." (page 70)

E-com ready is the lead action (ESRS 2-MDR-A-68 a, b, c; page 70): adapting suppliers' transport packaging to e-commerce logistics. "Apotea's fulfilment centre receives several hundred pallets of products daily, generating significant volumes of plastic, paper, and corrugated cardboard that go directly to recycling." The initiative covers the supplier tier (upstream) and continued through 2025. Apotea also joined the industry programme: "Apotea also participated during 2025 in the industry-wide initiative E-com ready 2.0, driven by Svensk Handel (Swedish Commerce) ... The work includes developing shared KPIs and producing guidelines for how e-com ready can be implemented and monitored in practice." (ESRS 2-MDR-A-68 e)

Packaging (page 71): the corrugated shipping box "is produced with a high proportion of recycled material and is FSC-certified"; "Apotea's packing machines adjust the height of each parcel to its contents, reducing the need for filling material and minimising the transport of air". For private-label products, internally adopted requirements apply to primary, secondary and transport packaging, which "must be designed using the minimum possible amount of material, be recyclable, and, where it consists of paper or cardboard, be FSC-certified". For third-party products, "Apotea requires, through supplier agreements, that unnecessary plastic packaging be reduced."

Careful product handling (page 70): regular training for employees in product handling and protective measures "to minimise the risk of leakage and other transit damage", reducing returns and write-offs.

Resources and cost (E5-2-17, ESRS 2-MDR-A-69 a, b, c; page 70): work is coordinated by the sustainability department, with sustainability and procurement setting supplier requirements and logistics implementing warehouse and distribution measures. "The measures taken or planned in the area of resource efficiency and circular economy are not expected to give rise to any significant operating expenditure or capital expenditure."

The published e-com ready benefit figures, "Material usage reduced by 55 percent", "Packaging costs reduced by 97 percent", "Carbon dioxide emissions from packaging reduced by 77 percent", are attributed to Svensk Handel's industry material, not to Apotea's own measurement (page 70).

Targets related to resource use and circular economy

Reference: page 71; ESRS content index page 88.

There are no targets. "Apotea has not yet implemented comprehensive targets in accordance with the CSRD and ESRS. Work to develop and establish such targets is ongoing. The results will be reported in the Sustainability Report for the 2026 financial year. (ESRS 2-MDR-T-81 a)"

Apotea then gives the MDR-T alternative: how effectiveness is tracked in the absence of a target (ESRS 2-MDR-T-81 b, bi). "Assessment of the appropriateness of current policies in relation to material sustainability-related impacts, risks, and opportunities is carried out as part of the annual policy review ... The review covers an assessment of compliance and actual application, an evaluation of whether the policy continues to address identified material impacts, risks, and opportunities, and decisions on revisions, responsibilities, timelines, and communication of changes."

Ambition level in place of a target (ESRS 2-MDR-T-81 bii): "Apotea's ambition level for circular economy and resource use is to reduce unnecessary material consumption and waste in its own operations and across the value chain. Apotea aims to continue ensuring that the corrugated cardboard used in its parcels is FSC-certified and that the corrugated boxes are fully recyclable."

Base year: "The year 2025 serves as the base year against which progress and changes are monitored and reported, as 2025 is the first year in which reporting is carried out in accordance with CSRD/ESRS using a harmonised methodology and data collection approach, making the data comparable over time."

So there is no measurable, outcome-oriented and time-bound target for resource inflows, outflows or waste; the ambitions are directional, and the two that are quantified in the entity-specific metrics (100% FSC-certified corrugated board, 100% recyclable parcel material, pages 71-72) are already at 100% and function as maintenance statements rather than improvement targets.

Resource inflows

Reference: page 71; ESRS content index page 88.

Scope of the impact (E5-4-30): "Apotea's material impacts related to resource inflows concern both the use of materials in the manufacture of products within Apotea's range and the procurement of materials and products used in its own operations. This includes, for example, Apotea's own packaging, machinery for logistics, and office supplies."

Why the ESRS quantities are not given (E5-4-31 a, b, c): "Apotea's product range encompasses a very large number of items from many brands and suppliers. As a retailer, Apotea has limited influence over the material composition and material choices in individual products and their packaging. Against this background, it is not possible to present a comprehensive summary of all material resources ... used in the manufacture of the entire range." And for private label: "As manufacturing is carried out by external contract manufacturers, Apotea does not have access to standardised and verifiable data that would enable a comparable summary of total material use at the manufacturing stage."

Qualitative description of the upstream inflows (page 71): "Pharmaceutical production, for example, may require significant volumes of water, both in production stages and in purification processes. Product categories such as dietary supplements and cosmetics often contain bio-based raw materials and are typically delivered in plastic or glass packaging. In addition, electronic products in the range may contain metals and components whose production depends on critical raw materials at the manufacturing stage."

Entity-specific metric disclosed instead (page 71):

Notes to the metric: volumes are taken from purchasing statistics on an invoiced basis; "Apotea does not reuse corrugated boxes for deliveries to customers; therefore, the share of reused components is not applicable"; "The share of recycled components is not currently reported, as the proportion of recycled material may vary between grades and deliveries". "FSC certification has been assured through FSC certificates obtained from suppliers. (E5-4-32)"

So the weight of products and materials used, the share of biological materials sustainably sourced, and the share of reused or recycled components are all absent for the range itself, with a stated data-availability reason for each.

Resource outflows

Reference: page 72; ESRS content index page 88.

Recyclability of products and packaging is not quantified, with reasons given. "Apotea has limited influence over suppliers' product design and packaging and is therefore unable to report the proportion of recyclable material in these." For its own packaging: "requirements are in place for the material to consist of recycled fibre. To ensure the necessary strength, the packaging also contains a minor proportion of virgin fibre, meaning that exact proportions of recycled material cannot be stated ... The supplier states that the corrugated board contains a high proportion of recycled fibre but cannot guarantee that the proportion is 100 percent." (E5-5-36 c; E5-5-40)

Private label and producer responsibility (E5-5-40): "Apotea places products on the market under its own private label, which entails direct producer responsibility for resource outflows related to consumed products and packaging waste. To limit resource use and waste, Apotea applies packaging guidelines for its private label with a focus on recyclability and an increased proportion of recycled and/or renewable materials."

Stated gap and remediation plan (E5-5 31 a, b, c): "For the financial year 2025, Apotea has not had access to value chain data for its private label products to provide complete quantitative information on the total weight of products, the percentage of biological materials of sustainable origin, or reused or recycled components. Apotea intends to investigate the conditions for methodology and data collection from relevant suppliers."

Entity-specific outflow metric (page 72):

The metric is offered as a proxy: "To give visibility to the extent of resource outflows in the form of outer packaging arising at the customer's end, Apotea discloses a company-specific metric (in accordance with ESRS 1 §11) in the form of the number of packages dispatched during the reporting period." Data comes from internal systems and "has not been validated by an external body other than Apotea's auditor."

Waste figures, which E5-5 also covers, are set out separately in the Waste entry.

Waste

Reference: page 72 (Total waste table and accounting note), disclosed under E5-5 in the ESRS content index (page 88).

Total waste 2025: 1,266.8 tonnes, of which 1,258.5 non-hazardous and 8.3 hazardous. All of it is diverted from disposal; nothing is directed to disposal.

Composition (E5-5-38 a, b): waste "arises primarily in the logistics operations and consists largely of packaging materials such as plastic and corrugated board. To a lesser extent, hazardous waste is generated in the form of, for example, chemicals, pesticides, batteries, electronics, and pharmaceuticals ... The waste contains no rare earth metals or critical raw materials." And "Apotea does not generate radioactive waste. (E5-5-39)"

Treatment approach: "Apotea sorts all waste in accordance with applicable regulations and ensures that waste fractions are handled separately and delivered to approved recipients for recycling, energy recovery, or other appropriate treatment. The work prioritises material recycling in the first instance, and other appropriate treatment such as energy recovery in the second instance."

Method and uncertainty (E5-5-37 a, b, c, d, 40; ESRS 2-BP-2-11 b): the data "covers all fulfilment centres and offices"; pharmaceutical waste "refers to surplus medicines returned by customers to Apotea, where Apotea is subject to producer responsibility"; "All incineration is used for energy recovery, which is reported under 'Other recovery methods'"; "Data is based on reporting from external waste contractors ... A limited proportion of the data (5.5 percent) has been estimated on the basis of container volume where actual weight data was unavailable." "The data has not been validated by an external body, except by Apotea's auditors."

The 0.0% non-recycled figure follows from classifying energy recovery as "other recovery" rather than disposal, which is worth noting when comparing against peers who report incineration with energy recovery under directed to disposal.

Policies related to own workforce

Reference: pages 74-75; ESRS content index page 88.

Instruments (S1-1-19, ESRS 2-MDR-P-65 a, b, c, e): "Apotea's HR work is governed by applicable laws and regulations, collective agreements, and the internally governing documents: the HR policy, sustainability policy and employee code of conduct." The framework "has been adopted by the Board of Directors, which also holds overall responsibility for its content, and applies to all of Apotea's operations. It covers both directly employed staff and workers engaged through staffing agencies. The HR Director is responsible for implementing the HR policy."

International reference points (S1-1-20, 20 a, b, 21, 22, 24 c): the framework "takes into account the Universal Declaration of Human Rights, the OECD Guidelines for Multinational Enterprises, the ILO core conventions, and the UN Guiding Principles on Business and Human Rights (UNGPs)" and "includes explicit commitments against child labour, forced labour and discrimination".

Two gaps the company declares itself:

• Human trafficking: "Apotea takes a clear stance against human trafficking. At present, however, this is not explicitly stated in the policy framework, which will be reviewed during 2026."
• Vulnerable groups: "Apotea has no specific policy commitments regarding the inclusion or positive treatment of particularly vulnerable groups in the workforce, but the company's overarching policies include equal treatment and apply to all employees."
• Remediation: "Apotea's employee code of conduct does not currently include specific commitments on remediation in cases of human rights violations. In practice, however, specific measures are taken in response to adverse events, such as investigation, corrective work environment actions, support for affected employees and, where necessary, disciplinary measures." (S1-1-20 c, page 75)

Coverage (S1-1-23, 24 a, b): the HR policy "covers identified material impacts and risks relating to health and safety, rehabilitation, privacy and data protection" and also "harassment, whistleblowing, and gender equality and inclusion, with a focus on preventing discrimination based on the seven grounds of discrimination in Sweden: gender, gender-transcending identity or expression, age, sexual orientation, disability, religion or other belief, and ethnicity."

Supporting documents (page 75): a work environment handbook, a guideline on offensive conduct and harassment, a whistleblowing guideline, and a GDPR and privacy policy. Availability is internal: "The policy is made available to employees through their line manager and via the HR department." (ESRS 2-MDR-P-65 f)

Processes for engaging with own workforce and workers' representatives about impacts

Reference: page 75; ESRS content index page 88.

Channels (S1-2-27, 27 a, b, c, e): "Dialogue with employees is structured through monthly workplace meetings, employee councils, office meetings, and collaboration with safety representatives, trade union branches and HR. The safety committee meets quarterly to follow up on matters relating to the work environment, culture and areas for improvement."

Individual-level dialogue: "Managers are responsible for conducting and following up annual performance reviews, giving each employee the opportunity to discuss development, wellbeing and the work environment. Annual employee surveys are also conducted to capture views, identify areas for improvement and monitor engagement across the organisation."

Accountability for the process: "The HR Director ensures that the forms of dialogue are maintained and that outcomes are integrated into decisions and priorities, while line managers and department heads are responsible for ensuring that views are taken into account in operational improvement work."

Workers' representatives: "The collective agreement regulates the work environment, rights, obligations and conditions for the company's own workforce. Within the framework of these guidelines, regular contact takes place with the employee organisation and its representatives. These formalised forms of collaboration help the company gain a deeper understanding of employees' perspectives on their rights, work environment and conditions, which are taken into account in decisions and changes that affect the company's own workforce."

Employees and trade union representatives were also engaged directly in the double materiality assessment through interviews during the 2025 stakeholder dialogue (page 51). The report does not state how the effectiveness of the engagement itself is assessed, nor name a global framework agreement.

Processes to remediate negative impacts and channels for own workforce to raise concerns

Reference: pages 75-76; ESRS content index pages 88-89.

Work environment route (S1-3-32 a, page 75): "The systematic work environment management includes risk assessments, safety inspections, employee surveys and a structured system for incident and accident reporting ... When an adverse event is confirmed, for example an accident or near-miss, an investigation is conducted with a focus on root cause and action plan. Measures may include ergonomic adjustments, workplace adaptations, rehabilitation or redeployment." Adequacy is tested by follow-up "with the responsible manager and HR, and where necessary with occupational health services through follow-up meetings with the affected employee. If issues persist, the measures are adjusted and additional support or adaptations are put in place."

Harassment route (S1-3-32 a): "All reports are investigated in accordance with an established procedure. Measures may include supportive discussions, action plans and disciplinary action. Following the conclusion of an investigation and the implementation of measures, Apotea follows up with the affected employee to ensure that the adverse situation has ceased, that the support provided is adequate, and that the risk of recurrence has been reduced."

Whistleblowing (S1-3-32 b, c, 33; pages 75-76): "Apotea has a whistleblowing function that enables anonymous reporting of serious irregularities via an independent external party. The company's whistleblowing policy describes protection against retaliation and ensures that no one who reports misconduct in good faith risks adverse consequences." The external party "first makes an independent assessment of whether the matter constitutes whistleblowing under applicable law"; the HR Director then receives, follows up and investigates. "Where there is a material risk, or if the matter concerns management, it is reported to the Board of Directors; where criminal activity is suspected, a report to the relevant authority may be appropriate."

Awareness (S1-3-32 d, e; page 76): information sits in the employee portal and on workplace notice boards and forms part of induction. "Agency staff are given equivalent access through on-site induction and through targeted information provided to the staffing agency. Awareness of and trust in the whistleblowing function is monitored continuously through dialogue meetings ... and annually through the employee survey."

Outcome for the year: "During the year, 0 complaints were received via the whistleblower channel." (page 79)

Taking action on material impacts on own workforce

Reference: pages 76-78; ESRS content index page 89.

Actions are organised by the three material S1 impacts.

Health and safety (S1-4-38 a to d, 39, 41, 43; page 76). Systematic work environment management (SAM) covers "the entire business, including agency staff in logistics". Risks of physical strain and high workload "are taken into account when designing working methods, scheduling, and staffing, in order to counteract unhealthy workloads and enable recovery". Risk assessments run "in connection with major operational changes, such as reorganisations or significant changes to working methods". Effectiveness is monitored "through key performance indicators and qualitative data, including sickness absence, accident frequency, reported near-misses, results from employee surveys, and dialogue with safety representatives and trade union parties."

Three named 2025 actions (ESRS 2-MDR-A-68 a to e; pages 76-77):

• Promoting health and recovery - "In 2025, Apotea launched a digital recovery programme and a comprehensive wellness offering ... The initiative covers all of Apotea's employees in Sweden." Monitoring is by short-term sickness absence, absence over time and utilisation rates, with "A consolidated evaluation of outcomes ... carried out in 2026".
• Ergonomic improvements - "a review of workstations in logistics and office areas, and by providing additional ergonomic aids where needs were identified."
• Leadership training and mentoring - "Apotea's leadership training was enhanced with additional modules on inclusive leadership, work environment management, and early identification of ill health. A mentoring programme was also introduced for managers in logistics."

Harassment (page 77). The company reports no new action: "efforts to prevent this are conducted on an ongoing basis as an integrated part of Apotea's systematic work environment management, without a set completion deadline. No key actions were taken during 2025." Preventive work runs through zero-tolerance standards, induction and management training, employee dialogues and recurring surveys.

Work-related privacy (pages 77-78). Safeguards include "role-based access control, logging of system activities, encryption of sensitive data, recurring security reviews, and procedures for legal assessment of data processing", with access "restricted in accordance with the principle of least privilege". Incident handling is specific: "If an incident is assessed as reportable, notification is made to the relevant authority within 72 hours in accordance with GDPR. Internally, the incident is managed through correction or deletion of incorrectly processed data, feedback to affected parties within seven days, and an established action plan within thirty days." The 2025 action was "tightened access governance and clarified procedures for handling personal data, as well as updated training in data protection and information security for employees and managers."

Climate transition effects on the workforce are addressed and dismissed: "Measures to reduce the company's climate impact are not assessed as affecting the company's own workforce. No restructuring, workforce reductions or retraining needs have been identified." (S1-SBM-3-14 e, page 74). No capex or opex figures are attached to any of the S1 actions.

Targets related to own workforce

Reference: page 78; ESRS content index page 89.

No targets are set. "Apotea has not yet implemented comprehensive targets in accordance with the CSRD and ESRS. Work to develop and establish such targets is ongoing. The results will be reported in the Sustainability Report for the 2026 financial year. (ESRS 2-MDR-T-81 a)"

The MDR-T alternative is then given (ESRS 2-MDR-T-81 b, bi): effectiveness is tracked through "the annual policy review, which entails that all relevant governing documents (policies and guidelines) are reviewed and updated in accordance with an established annual cycle. The review includes an examination of compliance and actual application, an assessment of whether the policy addresses identified material IROs, and decisions on revisions, responsibilities, timelines and communication of changes."

Ambition levels stated in place of targets (ESRS 2-MDR-T-81 bii):

• Health and safety: "to ensure a safe and secure working environment through systematic work environment management, with a zero-vision for work-related injuries".
• Harassment: "the ambition is zero tolerance towards harassment, bullying and victimisation".
• Work-related privacy: "to ensure the protection of employees' personal data and to prevent unauthorised access and privacy violations".

Base year: "The year 2025 serves as the base year against which progress and changes are monitored and reported, as 2025 is the first year in which reporting is conducted in accordance with CSRD/ESRS with a harmonised methodology and data collection, making the data comparable over time."

There is no disclosure of whether workers or their representatives were involved in setting these ambitions, and no measurable, time-bound target against which the 28 work-related accidents reported for 2025 (page 79) could be assessed.

Characteristics of the undertaking's employees

Reference: page 78; ESRS content index page 89.

Headcount by contract type and gender (S1-6-50 b), persons employed at the end of the reporting period:

"The figures refer to the number of persons employed during the year at the end of the reporting period, and are presented as a total count (not an average). Fixed-term employees include on-call employees."

Average number of employees (S1-6-50 a, d, e, f): women 354, men 373, total 727. "The number of employees is calculated as an average of the number of employees at four representative points during the selected period, where the number of employees is the number of active positions regardless of working hours or form of employment." The Directors' report cross-reference is page 30. Of the 727, 705 are based in Sweden and 22 in Norway (page 46).

Turnover (S1-6-50 c, d, e): 101 terminated employments, a staff turnover rate of 13.9%. "Number of terminated employments refers to permanent employments ended during the year, regardless of reason. Staff turnover is defined as the number of terminated employments divided by the average number of employees."

Not disclosed: a breakdown by country, the split between full-time and part-time, the number of non-guaranteed-hours employees as a separate line, or a reconciliation to the financial statements headcount. Gender is reported on a binary basis only, with no "other" or "not disclosed" category.

Characteristics of non-employee workers

Reference: pages 78-79; ESRS content index page 89.

Definition given: "Information about non-employees in the company's own workforce refers to individuals who perform work for Apotea but are not employed by the company, such as temporary agency staff and consultants." (page 78)

Metric (S1-7-55 a, b, c, 56, 57; page 79):

Method and scope: "Agency staff refers to workers hired into the fulfilment centres via the staffing company Kila, and to pharmacists hired into all fulfilment centres and prescription branches. The figures are reported as full-time equivalents (FTE), where 1 FTE is defined as 2,064 hours worked per year. FTE is calculated as the total number of agency hours during the financial year divided by 2,064, reflecting average resource utilisation during the period rather than the number of individuals at the end of the period. Data on total agency hours have been sourced from invoicing records."

Volatility is flagged: "The level of agency staffing may vary between years and within the year, due in part to seasonal fluctuations and changing capacity requirements in logistics."

A stated exclusion: "Consultancy services for white-collar assignments and sole traders engaged as fixed project or service deliveries are excluded, as the underlying data currently lacks reliable information on hours worked or hourly rates for conversion to FTE." Self-employed people are therefore only partly captured, and the 168 FTE understates the full non-employee workforce by an amount the company does not size.

Agency workers are within scope of the S1 impacts throughout: "The Sustainability Report covers both directly employed staff and workers engaged through staffing agencies." (S1-SBM-3-14 a, page 74), and SAM "covers the entire organisation, including agency staff in logistics" (page 47).

Health and safety metrics

Reference: page 79; ESRS content index page 89.

Notes to the table (S1-14-88 a to e):

• "All employees are covered by the occupational health and safety system, with the exception of Group management."
• "Of the 28 accidents, 27 were minor injuries and one required medical attention."
• "The accident frequency rate is defined as the number of workplace accidents divided by the total number of hours worked, multiplied by 1,000,000. The number of hours worked amounted to 967,421 hours during 2025."

Two things a reader should check. First, the coverage figure of 100.0% is stated alongside an exception for Group management, so the two lines are in tension on their face. Second, 28 accidents including one requiring medical attention sits beside zero lost working days; the report does not reconcile these, and does not say whether the lost-days metric covers only the reporting period or excludes cases carried over.

Scope: the table does not state whether non-employees in the own workforce, the 168 FTE agency workers reported under S1-7 (page 79), are included in the accident counts, although SAM is said to cover "agency staff in logistics" (pages 47, 76). "The data has not been validated by an external body other than Apotea's auditor."

The S1-14 datapoints on fatalities, accident numbers and rate, and days lost are cross-referenced in the Appendix B list to SFDR Indicators No 2 and No 3, Table 3, Annex I (page 92).

Incidents, complaints and severe human rights impacts

Reference: page 79; ESRS content index page 89.

Discrimination and harassment (S1-17-103 a, b, c, d):

Footnote: "During the year, 0 complaints were received via the whistleblower channel."

Severe human rights incidents (S1-17-104 a, b):

This is a complete nil return across both tables. It should be read against two facts disclosed elsewhere in the same chapter: Apotea states that harassment prevention was maintained but that "No key actions were taken during 2025" (page 77), and that it "has not currently identified any specific group with higher exposure" to harassment risk while assessing "that the risk may affect the entire workforce" (page 74).

Accounting policy (page 79): "Reported data relating to own workforce is based on data recorded in the shared HR management tool ... internal controls are applied, including review and reasonableness assessment by the HR function prior to reporting. The data is consistent with the information used for payroll processing and the personnel costs recognised in the financial reporting, enabling reconciliation between sustainability and financial reporting. The data has not been validated by an external body other than Apotea's auditor."

The S1-17 discrimination and UNGP/OECD rows are cross-referenced to SFDR Indicator No 7, Table 3 and Indicators No 10, Table 1 and No 14, Table 3 in the Appendix B list (page 92).

Policies related to consumers and end-users

Reference: pages 81-82; ESRS content index page 89.

Instruments (S4-1-15, ESRS 2-MDR-P-65 a, b): "Apotea's material impacts, risks and opportunities relating to consumers and end-users are governed principally through Apotea's sustainability policy and data protection policy." Both "apply to the entire Group. They are adopted by the Board of Directors and reviewed annually."

The regulatory layer sits above the policies: "Pharmacy operations are strictly regulated ... The Swedish Medical Products Agency's requirements for a self-monitoring programme constitute the quality system for the operations, for which Apotea's Quality Manager is responsible. These governing documents require Apotea to offer safe products, maintain high standards of product quality and safe handling, and ensure accurate information and clear labelling so that consumers and end-users can make informed decisions."

Accountability (ESRS 2-MDR-P-65 c): "The Quality Manager is responsible for implementing and ensuring compliance with the quality system/self-monitoring programme, the COO is responsible for implementing the sustainability policy, and the CTO is responsible for implementing the technical and organisational security measures that support the data protection policy."

Human rights commitments (S4-1-16 a): "Apotea commits to respecting human rights throughout the company's entire customer journey, in line with the UN Guiding Principles on Business and Human Rights (UNGPs), the ILO Declaration on Fundamental Principles and Rights at Work, and the OECD Guidelines for Multinational Enterprises."

Substance of the commitments (S4-1-16, 16 a; page 82): the right to health and safety "through safe products, clear information, pharmaceutical advice and measures to prevent misuse of medicines", and the right to privacy, where "Apotea works to minimise data collection, ensure a lawful basis or consent, guarantee secure storage, and prevent undue profiling or sharing of personal data."

Remedy (S4-1-16 c): processes exist "for receiving, investigating, documenting and following up complaints and incidents ... Where an impact is confirmed, remedial action may include correction/restoration, compensation or other appropriate redress".

Nil return for the year (S4-1-17): "During 2025, no instances of non-compliance with the UN Guiding Principles ... the ILO Declaration ... or the OECD Guidelines ... relating to consumers or end-users have been identified or reported in Apotea's downstream value chain."

Processes for engaging with consumers and end-users about impacts

Reference: page 82; ESRS content index page 89.

The whole disclosure is short (S4-1-16 b, S4-2-20): "Apotea maintains ongoing dialogue with its customers through the company's customer service function, ratings and reviews on review platforms, and analysis of customer opinions and complaints. This feedback is used systematically to identify recurring issues, improve information, strengthen customer communication, and develop processes for the safe handling of medicines and other products."

Two things fill it out from elsewhere in the statement.

Customers were engaged directly in the DMA. The stakeholder table on page 51 records customers as an affected stakeholder engaged by survey during the spring 2025 stakeholder dialogue, and the results "have been shared with relevant management functions within Apotea to ensure that insights from employees and customers, for example, are taken into account by the parts of the organisation working on these issues." (page 48)

A limitation is declared under S4-3 that bears directly on engagement quality: "During 2025, Apotea did not conduct any customer surveys and therefore lacks a direct and systematic basis for assessing whether consumers and/or end users are aware of and trust the structures and processes in place for raising concerns ... Follow-up has instead been carried out indirectly through internal sources, such as the volume and categorisation of customer service matters (email, chat and telephone), complaints, and deviation management in delivery and returns processes, which can only provide a limited indication". (S4-3-26, page 82)

The disclosure does not name a senior role with operational responsibility for consumer engagement, does not state the stage or frequency of engagement in the ESRS terms, and does not identify any particularly vulnerable consumer group; the S4 SBM-3 section states separately that "Apotea has not conducted the analysis referred to in ESRS S4 SBM-3 paragraph 11 regarding whether and how certain consumers and/or end-users may be at greater risk of harm." (page 81)

Processes to remediate negative impacts and channels for consumers and end-users to raise concerns

Reference: page 82; ESRS content index page 89.

Channels and redress (S4-3-25 a, b, c, d): "Apotea's primary contact with customers is through its customer service function, which can be reached by email, chat or telephone. Where harm or incorrect handling is confirmed, Apotea offers redress commensurate with the type of harm that has occurred, for example, compensation for damaged or incorrect goods or for non-delivery or deviant delivery. Redress is provided in the form of a complaint resolution, repurchase, price reduction, redelivery or other appropriate remedy in accordance with applicable consumer protection legislation and relevant industry practice."

Triage and escalation: "Cases received through customer service are categorised to enable systematic evaluation and follow-up ... Cases assessed as serious or involving a risk to customer safety or quality are escalated to the responsible function for further investigation and a decision on action. Agreed corrective and preventive measures are documented, assigned to a responsible party, and followed up to completion, including verification of effectiveness where required."

Incident management for patient safety: "Apotea has a structured incident management process designed to ensure patient safety. The process covers the entire chain from prescription handling to logistics and delivery ... Serious incidents are promptly escalated to the Responsible Pharmacist, the function with overall responsibility for ensuring that medicines are handled and distributed in accordance with applicable regulations and to a high standard of patient safety."

Privacy route: "Apotea Sverige AB and Apotera.no AS have privacy policies on their websites", designed to give transparent information about data handling "as well as practical guidance on the rights of the data subject, including the right to lodge complaints with the relevant supervisory authority."

Declared limitation (S4-3-26): "During 2025, Apotea did not conduct any customer surveys and therefore lacks a direct and systematic basis for assessing whether consumers and/or end users are aware of and trust the structures and processes in place for raising concerns and having them addressed. The company also lacks a direct and systematic basis for evaluating customers' perceptions of whether the service provided is adequate." Retaliation is addressed: "Internal guidelines ensure that customers are not subjected to negative consequences when they raise complaints or draw attention to shortcomings."

Taking action on material impacts on consumers and end-users

Reference: pages 83-84; ESRS content index page 89.

Personal safety (S4-4-31 a, c, d; page 83): dispensing and advice follow pharmacy law; "Apotea applies a review process to every new product before it is added to the assortment"; "Apotea's automated logistics minimise the risk of handling errors"; "At all of Apotea's pharmacies, a responsible pharmacist ensures compliance with applicable requirements and reports serious deficiencies to the relevant authority."

Information and privacy (S4-4-32 a): "The technical platform is protected by multiple layers of security, including firewalls, segmented networks, access controls and continuous monitoring. Apotea uses external security services and automated monitoring to detect deviations, intrusion attempts and other threats at an early stage. Vulnerability scans and penetration tests are conducted regularly, and critical security vulnerabilities are remediated within defined timeframes."

Two named 2025 actions (ESRS 2-MDR-A-68; page 84):

• Security awareness training: "the company established an ongoing security awareness training programme in 2025 via a digital platform aimed at all employees with an email address using the apotea.se domain ... short, recurring training modules and simulated phishing exercises". Effectiveness is not measured: "During the year, Apotea has not conducted any formal measurement or systematic follow-up of the effects linked to the training programme, and is therefore unable to report quantitative results for the period."
• New distance-selling rules: preparations for "the Swedish Medical Products Agency's new regulations on the distance selling of medicines, which entered into force on 1 November 2025 ... delivery solutions with carriers have been adjusted so that medicines are no longer left accessible to unauthorised persons, but are instead delivered directly to the customer, a post box or a collection point."

Commercial conflicts (S4-4-34): "When commercial objectives conflict with patient safety, consumer protection or data protection, the latter take precedence, which may mean that Apotea refrains from certain campaigns or forms of targeted marketing."

Resources (S4-4-37): responsibility rests with the Board and CEO, with operational work by "the sustainability department, quality manager, responsible pharmacists, data protection officer and the IT/information security function."

Nil returns (S4-4-31 b, 35): "During the year, Apotea has not experienced any material impact that would have required the company to provide or enable remediation. There are therefore no cases of remediation to report" and "During 2025, no serious human rights issues or incidents relating to consumers or end users have been identified or reported."

Stated gap (S4-4-32 c): "During the reporting period, Apotea has not established or monitored specific key performance indicators or methods for measuring the effectiveness of remediation-related tools."

Targets related to managing material negative impacts, advancing positive impacts, and managing material risks and opportunities

Reference: page 84; ESRS content index page 89.

The ESRS position is that there are no targets: "Apotea has not yet implemented comprehensive targets in accordance with the CSRD and ESRS. Work to develop and establish such targets is ongoing. The results will be reported in the Sustainability Report for the 2026 financial year. (ESRS 2-MDR-T-81 a)"

But a compliance objective with a monitored outcome is set out for privacy: "Apotea shall achieve and continuously maintain its internal data protection policy and full compliance with GDPR and the Patient Data Act ... Any personal data incidents shall be prevented through clear processes and controls. Outcomes are monitored as the number of personal data incidents reported to the relevant authority."

Two entity-specific metrics carry the monitoring (page 84):

"A lower deviation rate reflects greater control across all process flows, reduced risk of error, and safer delivery to the customer." Both figures are from internal data sources and have "not been validated by an external body, except by Apotea's auditor."

Ambition levels in place of targets (ESRS 2-MDR-T-81 bii): "to conduct proactive, risk-based work in which the protection of personal privacy, access to accurate and comprehensible information, and customers' health and safety are embedded in the company's governance and processes ... to maintain a high level of protection for personal data and to ensure that customers receive relevant and up-to-date information".

Base year: 2025, "the first year in which reporting is carried out in accordance with CSRD/ESRS using a harmonised methodology and data collection".

The report does not state whether consumers or their representatives were involved in setting these ambitions, and neither the 0.35% deviation rate nor the zero-breach outcome is paired with a threshold that would define success or failure.

Business conduct policies and corporate culture

Reference: page 86; ESRS content index page 89.

Corporate culture (G1-1-9): "Apotea strives to maintain, develop and promote a sound corporate culture through a clear set of values, codes of conduct and internal dialogue. The culture is embedded during the onboarding process and sustained through day-to-day communication and leadership. Follow-up takes place through, among other things, performance reviews, working environment surveys and the annual employee survey, enabling the culture to be evaluated and improved over time."

Whistleblower protection (G1-1-10 a, c, e): "Apotea has an internal whistleblowing channel administered by an external, independent party, enabling confidential and, where necessary, anonymous reporting for employees and suppliers ... Apotea's ambition is to protect whistleblowers in accordance with applicable legislation implementing Directive (EU) 2019/1937, including through prohibition of retaliation, protection of identity and restricted access to data." Reports are handled by "specially designated and trained recipients within the HR function".

Risk position (G1-1-10 h): "Apotea's overall assessment is that the general risk of corruption is low ... At the same time, the procurement function is assessed as having a relatively higher exposure to corruption risk, as supplier selection and commercial terms may entail an increased risk of undue influence." The IRO-1 section adds the geographic basis: operations are "primarily in Sweden and Norway, markets with low perceived levels of corruption", in "a regulated pharmacy market requiring licences and subject to supervision" (page 53).

Training: a nil return, and a clear one (G1-1-10 g, G1-3-21 a, b, c, G1-4-24 b): "During the year, no training activities were carried out in the areas of business ethics or anti-corruption for the Board of Directors, Group management or other employees. Apotea is exploring whether targeted training initiatives should be introduced in the future."

Policy framework (ESRS 2-MDR-P-65 a, d): Code of Conduct for Employees; Code of Conduct for Suppliers and Business Partners; Whistleblowing Policy; Procurement Policy; Authorisation Policy. "Apotea's codes of conduct are based on international third-party guidelines and standards. They are grounded in the UN Universal Declaration of Human Rights, the OECD Guidelines for Multinational Enterprises, the ILO's core conventions and the UN Guiding Principles on Business and Human Rights (UNGPs)."

The Appendix B datapoint list marks ESRS G1-1, Point 10 b, United Nations Convention against Corruption as "Not material" and Point 10 d, Whistleblower protection as "N/A" (page 93).

Prevention and detection of corruption and bribery

Reference: page 87, with the risk assessment at page 86 and the IRO-1 basis at page 53. ESRS content index page 89.

Prevention (G1-3-18 a): "Apotea applies a zero-tolerance policy towards corruption and bribery. Preventive work is carried out through compliance with Apotea's codes of conduct, procurement guidelines, whistleblowing policy, and authorisation procedures. These documents clarify responsibilities, prohibited behaviours, and reporting channels."

Detection and investigation (G1-3-18 b, c): "Reports submitted to the whistleblowing function, including those relating to suspected cases of corruption or bribery, are handled by an external, independent party. Suspicions arising outside this channel are addressed promptly and independently, and escalated where necessary to an external party (for example, in cases of conflict of interest) ... Where there is material risk, or if the matter concerns management, it is reported to the Board of Directors; in cases of suspected criminal activity, a report to the relevant authorities may be made." Detection also runs through internal procedures (page 87).

Communication of the policies (G1-3-20, ESRS 2-MDR-P-65 f): "Apotea's code of conduct is signed by all employees at the start of their employment. Apotea's code of conduct for suppliers and partners forms part of Apotea's procurement agreements and is signed by all suppliers before any collaboration commences or is renewed. The whistleblowing policy is available via the company's employee portal."

Training is the disclosed gap (G1-3-21 a, b, c; page 86): "During the year, no training activities were carried out in the areas of business ethics or anti-corruption for the Board of Directors, Group management or other employees. Apotea is exploring whether targeted training initiatives should be introduced in the future." No breakdown of training by function-at-risk, and no coverage percentage, follows, because no training took place.

Actions (ESRS 2-MDR-A-68 a, b, c, e; page 87): "At present, Apotea has no specific actions relating to business ethics beyond its existing governing documents and guidelines. These form the foundation of the company's work to prevent and manage risks. Any future need for specific actions, such as training initiatives, will be evaluated during 2026."

So the separation of investigation from the chain of management involved is met through the external administrator of the whistleblowing channel, while the ESRS expectation of anti-corruption training for functions at risk is not met and the company says so directly.

Targets related to business conduct

Back-filled from the business conduct chapter (page 87), where targets are addressed as part of the MDR-T disclosures rather than as a numbered disclosure requirement. G1-3 became a standalone targets DR only in the 2025/2026 ESRS; Apotea's FY2025 statement is prepared under the 2023 ESRS, where the numbered G1-3 is prevention and detection of corruption and bribery.

Apotea discloses no measurable business conduct targets. "Apotea has not yet implemented comprehensive targets in accordance with the CSRD and ESRS. Work to develop and establish such targets is ongoing. The results will be reported in the Sustainability Report for the 2026 financial year. (ESRS 2-MDR-T-81 a)" (page 87)

Consistent with the other limb of MDR-T, the company sets out how effectiveness is tracked in the absence of a target (ESRS 2-MDR-T-81 b, bi): "Assessment of the appropriateness of current policies relating to material sustainability-related IROs is carried out within the framework of the annual policy review, which involves all relevant governing documents (policies and guidelines) being reviewed and updated in accordance with an established annual cycle. The review covers an assessment of compliance and actual application, an evaluation of whether the policy continues to address identified material IROs, and decisions regarding revisions, responsibilities, timelines, and communication of changes."

Ambition level in place of a target (ESRS 2-MDR-T-81 bii): "Apotea's ambition level for business ethics is to conduct operations with high integrity and to ensure responsible, lawful, and transparent conduct in all business relationships. Apotea has zero tolerance for bribery and corruption, and strives to maintain high business ethics standards throughout its operations. 2025 serves as the base year against which progress and changes are monitored and reported."

What is actually monitored (page 87): the entity-specific metric "Share of goods purchased from suppliers who have signed Apotea's Code of Conduct" stood at 90.5% for 2025, calculated on purchase value and including suppliers with "their own equivalent code of conduct that Apotea has approved". The proportion of suppliers signing "is monitored as part of Apotea's contract-signing procedures ... documented and also recorded in a separate follow-up document, which serves as the basis for the annual summary." Alongside it sit the G1-4 nil returns for confirmed corruption cases, dismissals and legal cases.

No target level is attached to the 90.5% figure, and no target exists for training coverage, which is the year's clearest gap given that no business ethics or anti-corruption training was delivered in 2025 (page 86).

Incidents of corruption or bribery

Reference: page 87; ESRS content index page 89.

Nil return, stated in narrative and in a table (G1-4-24 a, b; 25 a): "No convictions relating to corruption or bribery occurred during the year. Furthermore, the company did not pay any fines for violations of laws related to corruption and bribery during the reporting period ... No incidents of corruption or bribery were identified in the company's value chain during 2025."

"Reported metrics are based on internal data sources and monitoring procedures. The data has not been validated by an external body other than Apotea's auditor. (ESRS 2-MDR-M-75, 77 a, b)"

Detection basis (page 87): "Detection of corruption and bribery takes place primarily through Apotea's whistleblowing function, through which both employees and external parties may report suspicions anonymously. In addition, irregularities and misconduct may be identified through internal procedures." The whistleblowing channel recorded 0 complaints during the year (page 79).

A reader should weigh the nil return against the disclosed control environment. Apotea assesses general corruption risk as low but names procurement as the higher-exposure function (page 86), and reports that no business ethics or anti-corruption training was delivered to anyone, including the Board and Group management, during 2025 (page 86). A zero-incident year in a company with no training programme and a single detection channel is a weaker assurance signal than the same figure in a company running an active training and monitoring programme.

The Appendix B datapoint list cross-references ESRS G1-4, Point 24 a, Fines for violations of anti-corruption and anti-bribery laws and Point 24 b, Standards of anti-corruption and anti-bribery to SFDR Indicators No 17 and No 16, Table 3, Annex I, both against page 87 (page 93).