AROBS Transilvania Software

The role of the administrative, management and supervisory bodies

Reference: pages 103-104; restated for business conduct at page 216. The Annex IRO-2 table lists the GOV-1 gender diversity (21(d)) and board independence (21(e)) datapoints as Material at page 103.

Governance sits with a single-tier Board of Directors, with "overall responsibility for overseeing the company's strategy, operational performance and the management of material impacts, risks and opportunities, including those related to sustainability" (page 103).

At 31 December 2025 the Board had five members: two executive, three non-executive, of whom two are independent, "which corresponds to a share of 40% of the total members of the Board". Members are named: Voicu Oprean (Chairman and CEO), Aurelian-Calin Deaconu, Mihaela-Stela Cleja, Ioan-Alin Nistor and Razvan-Florin Olosu-Ittu. Gender diversity is 20% women, 80% men (pages 103-104). The term runs to 29 September 2027.

Operational responsibility is "distributed across executive management and relevant internal functions, including finance, human resources, operational, IT security, risk management and marketing/sustainability", with the CEO reporting to the Board (page 104). There is no employee representation on the Board, and no skills matrix is given.

Information provided to and sustainability matters addressed by the administrative, management and supervisory bodies

Reference: page 105.

The Board is "regularly informed about the material impacts, risks and opportunities (IRO), as well as the implementation of due diligence processes and the effectiveness of ESG policies, actions and objectives", through periodic reports from the CEO and the Finance, HR, IT Security and Risk Management functions, the annual risk assessment, the double materiality analysis and annual ESG reporting (page 105).

Frequency is stated: "Formal sustainability reporting takes place at least annually as part of the ESG reporting process, and relevant issues may be further discussed when significant risks or relevant developments arise."

The Board considers material IROs when overseeing strategy, analysing major transactions, assessing the risk framework and approving ESG objectives, and "may also analyze possible trade-offs between short-term financial objectives and medium- and long-term sustainability objectives" (page 105).

Topics addressed in 2025 are listed as "climate change and energy consumption; human capital and talent retention; cybersecurity and data protection; responsible use of artificial intelligence; business ethics and regulatory compliance; integrating ESG criteria into relations with suppliers and business partners" (page 105).

No meeting dates and no record of specific decisions taken are disclosed.

Integration of sustainability-related performance in incentive schemes

Reference: pages 105-106; restated for climate at page 133.

This is a nil return: "To date, AROBS has not integrated sustainability-related indicators or targets into remuneration schemes or incentive mechanisms applicable to management, management or supervisory bodies." Variable remuneration "is set based on financial, operational and strategic criteria, without the explicit inclusion of ESG indicators or targets on identified material impacts, risks and opportunities" (page 105).

The datapoint follows: "As a result, the percentage of variable remuneration dependent on sustainability objectives or impacts is currently 0%" (page 106).

The climate chapter repeats the position under its own ESRS 2 GOV-3 heading: "During the reporting period, AROBS did not include climate-related performance indicators in the remuneration mechanisms of the management, management, or supervisory bodies" (page 133). If such components are introduced, the company undertakes to disclose their share of total remuneration, the indicator type and the verification methodology.

AROBS states that it "recognizes the importance of aligning executive performance with sustainability objectives and is looking at the possibility of gradually integrating relevant ESG indicators into future remuneration policies" (page 106). No date is set for that step.

Statement on due diligence

Reference: pages 106-107. The Annex IRO-2 table lists "ESRS 2 GOV-4, Due Diligence Statement, paragraph 30" as Material at page 106 (page 220).

Due diligence is described as resting on the double materiality analysis, "integrated into the company's overall risk management framework", and encompassing "the identification of actual and potential impacts on the environment, society and governance, the assessment of related risks and opportunities, the definition of mitigation measures, and the regular monitoring of progress" (page 106). Results are reported to executive management and the Board and underpin the disclosures in this statement.

The mapping table sets the five core elements against report sections (pages 106-107):

• (a) inclusion of due diligence in governance, strategy and business model: GOV-1, GOV-2, SBM-1, SBM-3, IRO-1
• (b) engaging with affected stakeholders at all key stages: SBM-2, IRO-1
• (c) identification and assessment of adverse impacts: IRO-1, SBM-3
• (d) measures taken to address negative impacts: S1-1, S1-3, S1-4, S4-1, S4-3, S4-4
• (e) monitoring the effectiveness of these efforts and communicating them: GOV-2, GOV-5, IRO-2, S1-5 to S1-17, S4-5

The company qualifies its own coverage: "The process is currently being further developed and will be progressively expanded to provide broader coverage of the value chain in future reporting periods" (page 106).

Risk management and internal controls over sustainability reporting

Reference: page 107.

AROBS "applies an integrated risk management and internal control framework that also includes the risks associated with sustainability reporting", described by its steps: "data collection, aggregation and consolidation of information, use of estimates, documentation of methodologies, approval of reports and archiving of reporting support" (page 107).

Risk assessment has three components: "the annual company-wide risk analysis, the integration of ESG risks into the overall risk matrix, and the application of double materiality analysis". Risks are scored "based on likelihood, severity and impact, including with regard to data accuracy, compliance with ESRS/CSRD requirements, reputational considerations and value chain risks".

Results go to executive management and the Board "at least annually within the ESG reporting process, while significant risks may also be reported on an ad hoc basis".

Findings feed back into "updating policies and procedures, improving ESG data collection and validation systems, and strengthening control and reporting mechanisms", with responsibilities across Finance, HR, IT Security, Risk Management, Marketing and Sustainability. The 2025 analysis surfaced risks "specific to the IT sector, including those related to cybersecurity, the responsible use of artificial intelligence and financial transparency".

Strategy, business model and value chain

Reference: pages 108-109; scope and value chain at pages 96-100. The Annex IRO-2 table lists the four SBM-1 paragraph 40(d) involvement datapoints at page 108.

AROBS is "a technology company specialized in the development of customized software solutions and digital products", structured around software engineering services (application development, embedded systems, testing, DevOps, cybersecurity, integration) and its own software products, principally telematics and GPS fleet monitoring plus HR and business optimisation platforms (page 108). At 31 December 2025 the Group comprised the parent and 34 subsidiaries, listed with ownership percentages (pages 96-97). Turnover for 2025 was RON 449,015,741 (pages 127, 146).

Markets are Europe and North America, serving automotive, life sciences, travel technology, fintech, telecommunications, enterprise software and IoT, plus public institutions. Upstream the chain covers IT and cloud infrastructure, hardware, software licences and support services; downstream, corporate customers, SMEs and public institutions (pages 99, 108-109).

The exclusion datapoints are answered together: "AROBS does not operate in controversial sectors or sectors with a major impact on the environment, such as fossil fuels, chemical production, controversial weapons or tobacco cultivation and production" (page 109).

Interests and views of stakeholders

Reference: pages 110-111; stakeholder list at page 116.

Stakeholders are "shareholders and investors, employees and governance bodies, corporate customers and end-users, suppliers and business partners, regulatory authorities and bodies, as well as local communities, NGOs and academic institutions" (page 110). Page 116 names strategic partners as BVB, EBRD and institutional investors.

Engagement "is regulated by the Stakeholder Engagement Policy, approved by the Board of Directors". Mechanisms are surveys and questionnaires (employee satisfaction surveys, customer NPS, supplier ESG self-assessments), meetings with investors and analysts, internal town halls, consultations with authorities and dedicated digital ESG channels (page 110).

Views received are summarised: "investors prioritize financial performance and transparency, clients emphasize data security, quality of service and innovation, employees are concerned about job stability, professional development and equity, and authorities and civil society pursue regulatory compliance and corporate responsibility".

Material impacts, risks and opportunities and their interaction with strategy and business model

Reference: pages 111-114, results table at pages 120-122; topic-level SBM-3 at pages 134-136, 151-154 and 189-192.

The analysis produced 21 material IRO rows: E1 two, S1 nine, S4 three, G1 three and four entity-specific. "The analysis covered own operations and the upstream and downstream value chain, but the tangible IROs identified for 2025 are mainly concentrated in own and downstream operations" (page 111).

Scope: "The material IROs covered by the ESRS standards are those related to E1, G1, S1 and S4. In addition to this, AROBS included two entity-specific themes, namely cybersecurity and transparency" (page 114).

The single environmental impact is downstream and positive, "the current positive effect of GPS/telematics solutions that allow customers to measure and optimize certain elements relevant to reducing emissions"; downstream "the material potential negative impact is related to the misuse of consumer data and the effects that AI design, use and governance can have on customers and end-users" (page 112).

Anticipated financial effects are omitted under a transitional provision: "AROBS omits to disclose in this year the anticipated financial effects of the significant risks and opportunities set out in ESRS 2 SBM-3(e) (48)(e)" (page 113). Current effects are not quantified at Group level (page 112).

Description of the processes to identify and assess material impacts, risks and opportunities

Reference: pages 114-119; climate-specific process at pages 136-138; the G1 chapter cross-refers here (page 211).

The process "was designed in line with the requirements of CSRD and ESRS and with the guidance of EFRAG IG 1, being adapted to the context of the software sector", at consolidated level covering own operations and the value chain (page 114).

Method: "Scoring scales from 1 to 5 were used to assess the impacts, applied to criteria such as impact scale, magnitude, irreversibility and probability. For the assessment of risks and opportunities with financial effects, scales from 1 to 5 were also used, aligned with the internal risk management procedure." Thresholds "were established separately, by median, for the two dimensions" (page 115). Horizons are short under one year, medium one to five, long over five.

Stakeholders scored topic importance 1 to 5 through online questionnaires, and the company notes these "reflect their perception of the importance of the topics" rather than technical assessments (page 116). One exclusion follows directly: "Due to low stakeholder interest and lack of sectoral relevance, ESRS E5 'Circular Economy' standard has been removed from the list of material standards" (page 116).

Disclosure requirements in ESRS covered by the undertaking's sustainability statement

Reference: page 122; the table itself at pages 219-232.

The body carries only a pointer: "The information is presented in the Annex to the sustainability report" (page 122).

The annex, headed "Annex IRO-2 ESRS disclosure requirements covered by the sustainability statement" (pages 219-232), is in substance the ESRS 2 Appendix B table of datapoints derived from other EU legislation. Each row names a datapoint, its SFDR / Pillar 3 / Benchmark Regulation / EU climate law reference, a materiality verdict ("Material" or "It is not material") and a page. It is not a disclosure-requirement-by-disclosure-requirement concordance of the whole statement; the contents list and the report's DR-numbered headings (pages 80-83) carry that mapping.

Rows marked Material with a page: GOV-1 p.103; GOV-4 p.106; SBM-1 40(d)(ii)-(iv) p.108; E1-1 pp.133-134; E1-4 p.141; E1-5 p.143; E1-6 p.144; SBM-3 S1 pp.152, 155; S1-1 p.155; S1-3 p.161; S1-14 p.183; S1-16 p.185; S1-17 p.187; S4-1 p.193; S4-4 p.199; G1-1 p.212. The five E1-9 rows are Material with "Gradual introduction" instead of a page.

Rows marked "It is not material" with no page: SBM-1 40(d)(i), E1-5 intensity, E1-7, E2-4, E3-1, E3-4, E4-2, SBM-3 E4, E5-5, S2-1, S2-4, SBM-3 S2, S3-1, S3-4, G1-4.

A separate Annex BP-2 lists the transitional provisions used: SBM-1 40(b) and 40(c), SBM-3 48(e) and E1-9 (page 219).

Transition plan for climate change mitigation

Reference: pages 133-134. The Annex IRO-2 table lists E1-1 paragraph 14 as Material at page 133 and paragraph 16(g) as Material at page 134.

The company states plainly that no plan exists as a document: "At the time of reporting, AROBS does not yet have an approved climate transition plan as a stand-alone document. The company has included preliminary climate directions and benchmarks in the 2025-2030 Sustainability Strategy and aims to formalize the transition plan by 2028" (page 133).

What exists: "The objectives of the Sustainability Strategy include reducing Scope 1 and 2 emissions by 30% by 2030 (compared to 2024, emissions by market), increasing the use of renewable energy to a minimum of 50% and gradually integrating Scope 3 emissions into the decarbonization strategy" (page 133).

Approval: "The sustainability strategy is assumed by the executive management and the Board of Directors" (page 133). No dedicated budget is reported, "the costs being integrated into the existing operational and investment budgets" (page 134).

Locked-in emissions are addressed qualitatively: exposure "is considered low" because the company "does not operate in coal, oil or gas and does not operate energy-intensive assets", with the caveat that data centres "use electricity that may come partly from fossil sources" (page 134).

Identification of climate-related risks and scenario analysis

Back-filled from ESRS 2 IRO-1 for climate (pages 136-138) and the E1 chapter's ESRS 2 SBM-3 section (pages 134-135). This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

Risk classification (¶15). The E1 material IRO table carries only a downstream positive impact and a local opportunity, with no physical or transition risk row (page 135). "the company did not identify significant physical risks that would directly affect its operations" (page 135).

Methodology and exposure (¶16). Physical: "an initial high-level assessment was carried out to assess potential hazards such as extreme weather, rising temperatures and infrastructure disruptions", and "Our facilities, including data centers, are located in areas with low exposure to acute climate hazards. Of these, most are in Romania, in an area with low or moderate water risk." Value chain analysis is deferred to "future reporting exercises" (page 137). Transition risk is assessed across seven named countries (pages 137-138).

Scenario analysis (¶17). None performed: "the company has not yet conducted a quantitative climate analysis or a separate, documented stress testing exercise based on standardized climate scenarios" (page 135). The 1.5C reference is future tense (page 137), and no high-emission scenario or temperature projection is given.

Resilience in relation to climate change

Back-filled from the E1 chapter's ESRS 2 SBM-3 section, "Strategy and business model resilience in relation to climate change" (pages 135-136). This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

Analysis and results (¶19(a)). "AROBS carried out in 2025 a qualitative analysis of the resilience of the strategy and business model in relation to climate change. The analysis covered its consolidated own operations, including office space, IT infrastructure, and relevant segments of the value chain." It used "qualitative assumptions ... without separate financial modelling and without quantifying effects in detailed climate scenarios" (page 135).

The conclusion: "AROBS considers that its business model has relatively low direct climate exposure, given the lack of energy-intensive assets and the absence of coal, oil and gas activities. The main exposure arises indirectly from energy consumption, reporting and compliance requirements" (pages 135-136).

Uncertainty (¶19(b)). Under "Limitations": "The resilience analysis is still evolving, particularly in relation to the full integration of Scope 3 emissions and the development of quantified climate scenarios" (page 136).

Capacity to adjust (¶19(c)). Not addressed in terms of financial flexibility or asset redeployment. Next steps list "Strengthening scenario analysis" and "Development of the climate transition plan" (page 136).

Policies related to climate change mitigation and adaptation

Reference: pages 138-139.

There is no dedicated climate policy: "At the time of reporting, AROBS does not have a distinct, stand-alone policy dedicated exclusively to climate change. Climate-related issues are addressed through the Sustainability Strategy 2025-2030 and relevant operational processes and policies, including those on risk management, ESG data collection and consolidation, and supplier assessment from an ESG perspective" (page 138).

On mitigation, the approach is "to reduce greenhouse gas emissions through energy efficiency measures, increase the use of renewable energy, annual emissions monitoring (Scope 1 and 2 and progressively Scope 3) and integrate ESG criteria into the supply chain" (page 138). On adaptation, the company "includes the analysis of climate risks and their impact on operations, taking into account regulatory and market developments in its risk management processes" (page 139).

The only third-party benchmark is ISO 14001, held for the Telematics/TrackGPS division and described as "the main benchmark for the company's environmental management system" (page 139). The certification list shows ISO 14001 at a single site, Minerilor Cluj (page 90), so coverage is one division, not the Group. An EcoVadis process starts in 2026.

Actions and resources in relation to climate change policies

Reference: page 140.

The disclosure opens with an explicit absence: "AROBS has not yet implemented a dedicated climate programme, with separately quantified mitigation or adaptation actions and distinctly tracked CapEx or OpEx budgets" (page 140).

What was done in 2025 is preparatory rather than abatement work: "the greenhouse gas emissions inventory continuation, the assessment of the eligible activity from the perspective of the EU Taxonomy, the gradual digitization of ESG data collection and the initiation of the voluntary evaluation of suppliers from an ESG perspective" (page 140).

Decarbonisation levers appear only as future candidates: "Areas such as energy efficiency, the procurement of electricity from renewable sources, and the development of low-carbon products continue to be considered for future integration into a structured climate plan, once clear GHG reduction targets and accountability frameworks are established" (page 140).

No expected emission reduction is attached to any action and no monetary amount is given. The company undertakes to change that later: "In the future, the company intends to monitor and disclose the results of any climate-related actions undertaken, including achieved emissions reductions and alignment with relevant line items in the financial statements" (page 140).

Targets related to climate change mitigation and adaptation

Reference: pages 140-142; target values also appear in the E1-6 tables at pages 143-144. The Annex IRO-2 table lists E1-4 paragraph 34 as Material at page 141.

Mitigation. "the company aims to reduce Scope 1 and 2 emissions by 30% by 2030 (compared to the base year 2024, emissions depending on the market), increase the use of renewable energy to a minimum of 50% and progressively integrate Scope 3 emissions into the reduction targets" (page 140). The E1-6 tables give the figures: a 2030 objective of 407.80 tCO2e for Scope 1 and 144.42 tCO2e for market-based Scope 2 (pages 143-144).

Gross targets. "The GHG emission reduction targets are raw [gross]. The Company does not include GHG removals, carbon credits or avoided emissions as a means of achieving the targets presented" (page 140).

Challenges. "the limited data availability for Scope 3 emissions, the reliance on infrastructure and leased space (which limits direct control over energy consumption), and the variability of energy sources available in different locations" (page 141).

No science-based validation is claimed, no interim milestone between 2024 and 2030 is given, and the targets are not stated to be 1.5C aligned.

Energy consumption and mix

Reference: pages 142-143. The Annex IRO-2 table lists the E1-5 paragraph 37 and 38 datapoints as Material at page 143, and marks the energy intensity datapoint for high climate impact sectors as "It is not material".

Total energy consumption: 3,516.36 MWh in 2025, against 3,472.80 MWh in 2024 (page 143).

Fossil (page 142): coal 0 MWh in both years; crude oil and petroleum products 1,515.48 MWh (2024: 1,617.64); natural gas 1,041.58 MWh (2024: 980.35); other fossil 0.00; purchased electricity, heat, steam and cooling from fossil sources 324.99 MWh (2024: 334.3). Total fossil 2,882.05 MWh, an 81.96% share, down from 2,932.33 MWh and 88.6%.

Nuclear: 191.05 MWh, 5.43% (2024: 161.75 MWh, 4.9%) (page 143).

Renewable (page 143): renewable fuel including biomass 0 MWh; purchased electricity, heat, steam and cooling from renewable sources 443.26 MWh (2024: 378.72); self-generated 0.00. Total renewable 443.26 MWh, a 12.61% share, up from 378.72 MWh and 11.4%.

The renewable share therefore stands at 12.61% against the strategy target of a minimum 50% by 2030 (page 133).

Intensity is not given, with a reason: "AROBS does not operate in sectors with a high climate impact (e.g. extractive industries or heavy manufacturing). As a result, no energy intensity rate (consumption per net income in a high-impact sector) is presented" (page 143). No breakdown by country or site is provided.

Gross Scopes 1, 2, 3 and Total GHG emissions

Reference: pages 143-149. The Annex IRO-2 table lists the E1-6 gross emissions and intensity datapoints as Material at page 144.

Scope 1: 666.9 tCO2e, against a restated 582.57 for 2024, up 14%; 2030 objective 407.80. No emissions fall under regulated ETS (page 143).

Scope 2: location-based 203.55 tCO2e (2024: 166.7), up 22%; market-based 188.68 (2024: 206.32), down 9%, against a 2030 objective of 144.42. "At the reporting date, the company did not use contractual instruments such as guarantees of origin" (page 144).

Scope 3: 3,357.45 tCO2e (2024: 3,244.98), up 3%. By category (page 144): purchased goods and services 2,479.85 (+101%); capital goods 64.4 (-91%); fuel and energy related 172.87; upstream transport 56.20; waste 23.16 (+97%); business travel 175.77 (+131%); employee commuting 329.66 (+181%); downstream transport 4.96 (-99%); use of products sold 12.34 (-93%); end-of-life 0.020; downstream leased assets 38.22 (-78%).

Total: 4,227.90 tCO2e location-based (+6%) and 4,213.03 market-based (+4%).

Restatement: the 2024 Scope 1 figure "was recalculated from 708 tCO2e to 582 tCO2e" after the 5% refrigerant leakage rate was omitted and one building was counted in full. "The difference does not reflect an actual reduction in emissions" (pages 102, 144).

Policies related to own workforce

Reference: pages 154-158. The Annex IRO-2 table lists the S1-1 datapoints on human rights commitments (¶20), ILO due diligence (¶21), human trafficking prevention (¶22) and the occupational accident prevention policy (¶23) as Material at page 155.

Eight policies are named: "Human rights policy; Diversity, equity and inclusion policy; Whistleblower Protection Policy; Occupational health and safety policy; Sustainability, ESG and CSR Policy; Group Rules of Procedure; Stakeholder engagement policy; General Data Protection Policy" (pages 154-155).

Human rights commitments cover "association freedom and the right to collective bargaining; prohibition of discrimination and harassment; equal opportunities in recruitment, evaluation and promotion processes; prohibition of forced labor, compulsory labor and child labor" (page 156).

The health and safety policy covers "periodic occupational risk assessment; occupational health and safety training of employees; monitoring incidents and applying corrective measures; emergency response procedures", supported by ISO 45001 for the TrackGPS division (page 156). Whistleblowing acknowledges receipt within seven calendar days and reports the outcome within three months, extendable to six (page 157).

Processes for engaging with own workforce and workers' representatives about impacts

Reference: pages 158-160.

Six mechanisms are named: annual satisfaction and organisational climate surveys; "Thematic questionnaires (including ESG), used in the context of assessing double materiality and updating sustainability targets"; "Regular town-hall meetings and Q&A sessions with management"; "Internal digital feedback channels (dedicated forms, internal communication, dedicated emails)"; the "Formal whistleblower protection mechanism"; and employee participation in improvement and development processes (page 158).

Dialogue is mapped to three stages: strategic planning and ESG assessment; the current operational stage, covering working conditions and health and safety risk assessment; and "In the remediation stage: in case of reporting incidents (e.g. discrimination, harassment, H risks)" (page 159).

On formal representation: "At the time of reporting, AROBS does not have a Global Framework Agreement (GFA) with international trade union federations or other workers' representative organizations at international/national level" (page 160). Vulnerable groups are reached through anonymous surveys, confidential channels and town halls. Effectiveness is assessed through surveys, whistleblowing monitoring "including resolution time and case typology", ESG social indicators and Board oversight.

Processes to remediate negative impacts and channels for own workforce to raise concerns

Reference: pages 160-163. The Annex IRO-2 table lists S1-3 paragraph 32(c) as Material at page 161.

Six channels are listed: the formal whistleblower mechanism allowing confidential or anonymous reporting; direct contact with HR or the line manager; written or email complaint; face-to-face meetings at the reporter's request; "a dedicated hotline"; and town halls or health and safety consultations (pages 160-161).

Retaliation protection is explicit. The policy "prohibits measures such as dismissal, demotion, intimidation, harassment or any other disadvantageous actions in response to a complaint and is aligned with the requirements of Directive (EU) 2019/1937". Coverage extends to "current or former employees, candidates, members of management bodies and collaborators", and "Protection is granted to all persons who report in good faith, even in situations where the complaint is not subsequently confirmed" (page 161).

The procedure carries stated deadlines: receipt confirmed "within a maximum of 7 calendar days"; "impartial and documented investigation"; result communicated "within a maximum of 3 months, with the possibility of extending up to 6 months in justified cases"; corrective or disciplinary measures "without undue delay" (page 162).

Taking action on material impacts on own workforce

Reference: pages 163-165.

Actions for positive impacts are "training and professional development programs; annual performance reviews and coaching sessions; regular 1-on-1 meetings between employees and managers; annual employee satisfaction surveys, including eNPS indicators; initiatives to support work-life balance" (page 163).

Prevention and mitigation run through "internal reporting mechanisms, including the whistleblowing channel; direct communication with the Human Resources Department; internal surveys and other feedback mechanisms; monitoring of human resources indicators", with responses that "may include the formal investigation of the case, the application of disciplinary measures or the review of internal procedures" (pages 163-164).

Effectiveness is assessed through "HR indicators, such as retention, diversity and workforce structure; the results of the annual employee satisfaction surveys; feedback collected in annual performance reviews and 1-on-1 meetings; analysis of the notifications received through the internal reporting mechanisms" (page 165).

Resources are qualitative only: management of these impacts "is mainly achieved through the involvement of the Human Resources Department and executive management" (page 165). No budget, headcount or spend is attached to any action, and no action is dated or tied to a specific IRO such as the workload calibration risk at page 121.

Targets related to own workforce

Reference: pages 165-168.

Four target areas are set out (page 166):

• "increasing the representation of women in leadership positions by 15% by 2030"
• "organizational development goals, such as improving workforce retention, satisfaction, and diversity"
• "compliance and social governance objectives, including the creation of a formal framework of human resources policies and procedures based on equity, inclusion and safety"
• "skills development targets, such as training 100% of employees in ESG and data protection by 2026"

The reference year for the social objectives is 2024. Benchmarks are "the current structure of gender diversity in leadership positions (around 35% women and 65% men); the level of indicators on employee retention and satisfaction; level of indicators on health and safety at work (zero accidents objective)" (page 166).

Scope covers all employees, full-time and part-time, management staff and the functions implementing the objectives.

The 15% leadership target has no stated endpoint expressed as a share of women, and S1-9 reports women at top management falling from 35% in 2024 to 27% in 2025 (page 177). The retention, satisfaction and policy framework goals carry no numeric level or date.

Characteristics of the undertaking's employees

Reference: pages 168-173.

Headcount at the end of 2025: 1,102 employees, down from 1,211 at the end of 2024. The average number was 1,053 against 1,305 in 2024 (pages 168-169).

By gender at period end (page 169): male 593, female 509, other 0, undeclared 0. Averages: male 608, female 445.

By contract type at end 2025 (page 170): permanent 1,070 (male 575, female 495), temporary 32 (male 18, female 14), non-guaranteed hours 0, full-time 989, part-time 113 (male 57, female 56). The 2024 permanent and temporary columns are shown as "n.a.", so that split is first reported for 2025.

Geography (page 171): Romania is the only country with 50 or more employees representing at least 10% of the total, with 937 employees at the end of 2025 (average 885) against 1,084 at the end of 2024 (average 1,155).

Turnover (page 171): 316 employees left in 2025 and the rate was 29%, against 337 leavers and 25.8% in 2024, calculated as departures over the average headcount.

Data come from the internal "Data Collection Procedure - CSRD Reporting" and from payroll and HR systems, payrolls, contracts and termination records (pages 171-172). Outsourced personnel are excluded and reported under S1-7. Headcount and staff cost data "are reconciled with payrolls and annual financial statements" (page 173).

Characteristics of non-employee workers

Reference: pages 174-175.

The narrative and the table do not agree. The text states: "At the end of the reporting period, the company used 244 non-employed workers". The table immediately below gives 259 for 2025 and 253 for 2024 under "non-employed persons (PFAs, freelancers, service contracts)", with zero persons from temporary work agencies (NACE N78) in both years and a total matching those figures (page 174). Both numbers sit on the same page with no reconciliation.

Counting rules: a person is included where they "had an active contract for a period of more than one month in the reporting year"; a contract is active where there is "signed contractual document and actual provision of services"; "a person with several contracts in the same year is counted only once"; and "persons who appear simultaneously as employee and collaborator are classified exclusively as employees" (pages 174-175). Data were gathered by direct confirmation from each entity through a password-protected internal platform.

Limitations are disclosed: "The data does not include detailed information on the actual time worked (hours/FTE), as employees are not integrated into the employee timekeeping system. No additional demographic data (e.g., gender, age) is collected" (page 175). Use of collaborators is attributed to the IT operating model, "where projects may require specialized skills or additional temporary resources".

Collective bargaining coverage and social dialogue

Reference: pages 175-176.

Every figure is nil. "the percentage of AROBS's total workforce covered by collective bargaining agreements is 0%, the same as in 2024" (page 175). For Romania, "the country within the European Economic Area where the company has a significant number of employees, the percentage of employees covered by collective bargaining agreements is 0%, the same as in 2024" (page 176). For non-employee workers the estimated coverage rate is also 0%.

Social dialogue coverage is likewise nil: "the percentage of employees in Romania covered, at the unit level, by employee representatives is 0%, the same as in 2024, since the process of appointing and electing representatives had not been finalized as of the reporting date" (page 176).

A process is under way: "AROBS Transilvania Software S.A. meets the legal requirements for a collective bargaining agreement (CLA). We initiated collective bargaining procedures and invited employees to select employee representatives, and the procedure is still ongoing" (page 175). Internal email campaigns informed employees of the initiative and of candidates who had come forward, and "We will hold the first negotiation meeting after the employees' representatives are elected".

There is no European Works Council, SE or SCE works council agreement, attributed to operations being "primarily concentrated in Romania". AROBS is a member of ANIS and ARIES (page 176).

Diversity metrics

Reference: page 177.

Top management by gender. In 2025, 33 men and 12 women, that is 73% men and 27% women. In 2024 the figures were 15 men and 8 women, 65% and 35%. The share of women fell by 8 percentage points while the population counted almost doubled, from 23 to 45 people.

The definition is given: "'Top management' means: the CEO (General Manager) of the Group and the Executive Directors who report directly to the CEO (e.g. CFO, COO, CMO, CTO, etc.); The next lower level of management - managers who report directly to the members of the executive team (direct report to level 1)." The report states this definition is applied consistently to gender distribution in management, diversity in leadership indicators and organisational structure analysis.

Employees by age band: under 30, 263 in 2025 against 391 in 2024; 30 to 50, 753 against 783; over 50, 86 against 37. The bands total 1,102 for 2025 and 1,211 for 2024, matching the S1-6 period-end headcounts.

No age breakdown of management is given. The disclosure does not link back to the S1-5 target of "increasing the representation of women in leadership positions by 15% by 2030" against its stated 2024 benchmark of "around 35% women and 65% men" (page 166), against which the 2025 result moves away from the target.

Adequate wages

Reference: page 178.

"All AROBS employees are remunerated at least at the level of the legal minimum wage applicable in each jurisdiction, and in practice the level of remuneration exceeds the legal minimum thresholds. During the reporting period, 100% of employees were remunerated at least at the level of the applicable legal minimum wage ... This percentage remains unchanged compared to 2024."

The nil finding follows: "no cases of employees being paid below the appropriate salary level were identified during the reporting period."

The method is set against the statutory minimum rather than an adequate wage benchmark: "the salary used for verification is the gross monthly salary reported in the payrolls; the analysis is carried out separately for each entity in the scope of consolidation; for part-time employees, the salary is adjusted proportionally to the working time; The level of the minimum wage is verified in relation to the applicable normative acts or official statistical sources." Data are drawn from internal payroll and personnel administration systems and "reconciled with the company's payrolls and accounting records".

No comparison is made against any adequate wage benchmark other than the legal minimum, and no country-by-country breakdown is given for the jurisdictions outside Romania in which the Group's 34 subsidiaries operate (pages 96-97).

Social protection

Reference: pages 178-179.

"AROBS provides full coverage for its own employees in terms of social protection against loss of income due to illness, through legal compliance and by supplementing it with additional benefits, where appropriate" (page 178). The quantified result: "during the reporting period, same as in 2024, 100% of employees were covered by social protection programs, and no countries or categories of employees were identified that did not benefit from these mechanisms" (page 179).

All five major life events are covered explicitly: "sickness, through public health insurance systems and sick leave allowances; through mandatory contributions to public unemployment insurance funds; injury at work or acquired disability, through public social security systems and occupational safety and health legislation; parental leave, according to the applicable labor legislation; through mandatory contributions to public pension systems" (page 179).

Supplementary provision is described where it exists: "In addition to mandatory public protection, in certain jurisdictions AROBS offers private health insurance and/or the possibility of remote work or flexible working in non-serious medical cases." The jurisdictions concerned are not named. The indicator covers all own employees, full-time and part-time.

Persons with disabilities

Reference: pages 179-180.

"During the reporting period, the percentage of persons with disabilities among the employees of the AROBS Group was 0.36%, subject to legal restrictions on data collection. This percentage has increased slightly compared to 2024, when the percentage of people with disabilities was 0.31%" (page 179). The absolute number is not printed.

The definition applied: "'Person with disabilities' means an employee who holds an official disability certificate issued by the competent authority or has voluntarily declared the existence of a disability under applicable law. The definition is applied in accordance with the national law of each jurisdiction in which the Group operates."

The company qualifies the figure directly: "Reporting is based solely on voluntary declarations or documents submitted by employees. The actual number of people with disabilities may be higher than reported, as not all employees choose to report this information, and in some jurisdictions data collection is legally limited or restricted" (page 180).

The gender breakdown is withheld "because the collection of this information may be restricted by applicable law or data protection requirements" (page 180).

Training and skills development metrics

Reference: pages 180-182.

Average training hours per employee: 4.43 in 2025, against 0.18 in 2024 (page 181). The scale of that movement is not explained.

Performance and career development reviews: 78% of employees in 2025, against 100% in 2024, with 863 employees reviewed against 651. The 2024 figures carry a footnote: "The figures presented for 2024 apply to the parent company, Arobs Transilvania Software SA", so the two years are not on the same basis.

The fall is explained: "The integration of the acquired companies was carried out in stages and at different levels of organizational maturity, which led to the existence of uneven performance evaluation processes within the Group." AROBS "plans to absorb five more entities in 2026 and is currently carrying out a process of standardization and unification of the performance evaluation system at group level" (page 181).

By gender, under a row headed "Average number of training hours per gender": women 1,950, men 2,968, not specified 0, total 4,918. The label and the magnitudes disagree, since 4,918 over 1,102 employees is 4.46, close to the reported 4.43 average, indicating these are total hours rather than averages. "This information was not reported in 2024, as these are indicators phased in. 2025 is the first year in which they are reported" (page 181).

Health and safety metrics

Reference: pages 182-183. The Annex IRO-2 table lists the S1-14 datapoints on deaths and accident rate (¶88(b) and (c)) and days lost (¶88(e)) as Material at page 183.

Coverage: 100% of employees are covered by an occupational health and safety management system "based on legal requirements and/or recognized standards or guidelines", the same as in 2024.

Every incident metric is nil in both 2025 and 2024 (pages 182-183): deaths in own workforce from work-related injury and ill health 0; recordable work accidents 0; recordable accident rate 0%; recorded occupational diseases 0; days lost to work-related injury, ill health and fatalities 0; recorded cases of work-related ill health 0; deaths of other workers on company sites 0.

Controls are "risk prevention procedures, periodic occupational risk assessments and occupational health and safety trainings", with the rate "calculated according to the national legislation applicable to each jurisdiction". Note that hours worked are estimated where exact figures are unavailable, using "the standard working norm, adjusted for paid absences" (page 173). The zero return sits alongside a material negative workforce impact recorded for "overwork, work-life imbalance, or ergonomic aspects" (page 121).

Work-life balance metrics

Reference: pages 183-184.

"100% of employees were entitled to family leave, in accordance with the law and their individual employment contracts, just as in 2024" and "24% of eligible employees took family leave, compared to 26% in 2024" (page 183).

By gender, the percentage of entitled employees taking family-related leave (page 184): men 15 and women 35 in 2025, against men 11 and women 15 in 2024. Take-up by women rose by 20 percentage points year on year, take-up by men by 4.

The entitlement is confirmed Group-wide: "the percentage of its employees who are entitled to family-related leave, according to social policies and the applicable legal framework, is 100% of eligible employees, in all jurisdictions in which the Group operates, same as in 2024". Rights "are also reflected in the Internal Regulation (ROI), the HR policies applicable at the entity level, as well as in the individual employment contracts" (page 184). The indicator covers all own employees, full-time and part-time.

Flexible working, which the double materiality analysis records as a current positive impact under "Flexible employment contracts and working from home" (page 120), is described qualitatively in S1-1 and S1-4 but is not quantified, so no figure is given for the share of employees working hybrid or remotely.

Compensation metrics (pay gap and total compensation)

Reference: pages 184-185. The Annex IRO-2 table lists the unadjusted gender pay gap (¶97(a)) and the executive remuneration ratio (¶97(b)) as Material at page 185.

Gender pay gap: 31% in 2025, against 24% in 2024, a widening of 7 percentage points. Total annual pay ratio: 7.30 in 2025, against 8.15 in 2024 (page 184).

Scope is limited: "All its employees in Romania (Active Individual Employment Contract), full-time and part-time are included. The calculation base is represented by the entire workforce in Romania, as most employees are established in Romania." Romania accounted for 937 of 1,102 employees at the end of 2025 (page 171), so the metric excludes roughly 15% of the workforce.

The pay ratio methodology changed this year. It "was determined using a methodology based on medians calculated at the entity level and subsequently aggregated at Group level", which the company argues "limits the disproportionate influence of entities with a high number of employees". It states the consequence directly: "the results for 2025 are not directly comparable with those reported for 2024, as a result of the change in the calculation methodology" (page 185); BP-2 records the same change (page 101).

AROBS "aims to formalize and implement a unitary calculation methodology at Group level in the next reporting cycle". No explanation is given for the widening of the pay gap.

Incidents, complaints and severe human rights impacts

Reference: pages 186-187. The Annex IRO-2 table lists incidents of discrimination (¶103(a)) and non-compliance with the UNGPs and OECD Guidelines (¶104(a)) as Material at page 187.

Reported figures (page 186): severe human rights issues and incidents related to own workforce 0; incidents of discrimination 0, a line printed twice; "Amount of fines, penalties and compensation for damages because of incidents of discrimination, including harassment and complaints filed: EUR 0"; and "Number of complaints submitted through channels for people in their own workforce to voice their concerns: 1".

The scope of the complaint figure is defined: "The data includes formal complaints submitted through the whistleblower protection channel, HR or legal/compliance department, as well as complaints about discrimination, harassment or violation of employees' rights confirmed by internal investigations ... Only formally registered cases are included." No detail is given on the subject matter, outcome or remedy of that complaint.

On severe impacts: "No cases of serious human rights violations were identified in its own workforce, including cases of forced labor, child labor or trafficking in human beings. This result remains unchanged compared to 2024" (page 187), consistent with the S1 SBM-3 finding that "no significant risks of forced labor or child labor have been identified in our operations" (page 153).

Policies related to consumers and end-users

Reference: pages 193-195. The Annex IRO-2 table lists S4-1 point 16 and paragraph 17 as Material at page 193.

Four policy areas are set out (pages 193-194):

1. Privacy and data protection. "The GDPR Data Protection Policy defines the requirements for the collection, processing, storage, and lawful retention of data. It focuses on consent management, security controls, and breach of notifications for consumer/end-user data."
2. Information security. "The management security policy sets out responsibilities for protecting information assets, including encryption, secure system configurations, and incident management."
3. Human rights and fair treatment. Code of Conduct requirements "impose non-discriminatory practices in the design and marketing of products, prohibit misleading advertising, and require fair treatment".
4. Safety and quality. "Internal and security audits are carried out to verify the functionality and security of the products."

Scope covers every identified user category with "no exclusions based on segment, geography, or user type" (page 193).

The breach procedure includes "notifying affected users within the deadlines provided by the GDPR (Art. 34)". AROBS "tracks any incidents of non-compliance reported in its downstream value chain (no such reports were recorded in 2024)" (page 194). That statement, and the no-complaints statement, are both dated 2024.

Processes for engaging with consumers and end-users about impacts

Reference: pages 196-197; supporting description at page 189.

Engagement runs on three routes: "Directly, through NPS frameworks, Continuous NPS, feedback forms and public grievance mechanism"; "Through legitimate representatives, especially in B2B relationships, where the customer's stakeholders convey the perspective to the end users"; and "Through approaches, such as satisfaction indicators, dedicated audits, and ESG assessments" (page 196).

Timing is mapped to the project lifecycle: "In the initiation stage - through workshops and clarification of requirements ...; In the implementation stage - through operational meetings and monthly/quarterly monitoring; In the post-delivery stage - through NPS, Continuous NPS and standardized feedback processes; Permanent - through the public Stakeholder Feedback Grievance mechanism" (page 196).

Effectiveness is assessed as "Multi-dimensional", "Periodic & Ongoing" with monthly monitoring and quarterly reporting, "Integrated into governance" since "Indicators are part of the formal project management system and ESG reporting", and "Action-oriented" because "Feedback generates documented and monitored corrective actions" (page 197).

Processes to remediate negative impacts and channels for consumers and end-users to raise concerns

Reference: pages 197-198.

The remediation logic is set out first: "In case of identifying a negative impact, the company carries out an assessment of its severity and its role in producing the impact (causation, contribution, or connection through business relationships). Depending on the result, corrective measures such as technical fixes, operational adjustments, notification of affected parties, or activation of contractual mechanisms with partners or suppliers involved are implemented" (page 197).

The principal channel is public: "the public Stakeholder Feedback Grievance mechanism, available on the corporate website, which allows the confidential transmission of complaints or suggestions related to the company's practices, including environmental, social or governance issues". Alongside it sit satisfaction surveys (NPS), standardised customer feedback processes and, in corporate projects, project management teams, Customer Success and periodic performance reviews (page 197).

Retaliation is prohibited: internal ethics and compliance policies "provide that any form of retaliation against individuals who report concerns or possible irregularities in good faith is prohibited" (page 198).

Taking action on material impacts on consumers and end-users

Reference: pages 198-199. The Annex IRO-2 table lists S4-4 paragraph 35 as Material at page 199.

The process has five steps: "Identification through feedback mechanisms, monitoring and management of incidents; Formal risk assessment and determination of the company's role; Implementation of technical, operational and contractual corrective measures; Notification and transparency, where necessary; Preventive measures to avoid recurrence" (page 198).

Two practices are described for avoiding harm through the company's own conduct (page 199). Marketing and sales: "If tension arises (e.g., encouraging user data collection vs. privacy concerns), the data protection officer and senior management weigh the risks and proceed with a minimal data philosophy." Data use: "If a conflict arises between data-driven business objectives and user privacy, management is consulted before decisions are finalized."

Resources are qualitative: "AROBS allocates budget for specialized personnel (QA engineers, data privacy teams), invests in compliance tools (ticketing systems, monitoring) and provides continuous training to maintain the basic level at 0 incidents." No amount or headcount is given.

Effectiveness is judged by NPS and Continuous NPS and "indirectly by the evolution of business relationships, including customer retention, contract expansion, and market share growth" (page 198). No value for any of those is published.

Targets related to consumers and end-users

Reference: pages 199-201.

Four strategic objectives are set, aligned to the Sustainability Strategy 2025-2030: "strengthening personal data protection and digital security for users of the company's products and services; integrating consumer feedback into the process of developing and improving software products; increasing transparency and ethical accountability in the interaction with customers and end users; developing accessible and inclusive software products and services" (pages 199-200).

Four measures follow, two with a delivery status (page 200): robust data protection mechanisms and periodic cybersecurity assessments "from CISO and DPO functions"; "all software service projects are tested for WCAG compliance"; formal consumer feedback channels with clear response deadlines, "implemented in 2025"; and publication of digital ethics commitments, "implemented from 2025".

The one numeric target is a maintenance target with a base value: "AROBS aims to maintain the number of security incidents affecting end users at 0 for the period 2025-2030, compared to the reference value of 0 recorded in 2024" (page 200).

"Consumers and end-users are not directly involved in the formal setting of the company's strategic or ESG targets" (page 200). The other three objectives carry no measurable level or deadline.

Business conduct policies and corporate culture

Reference: pages 211-215; governance roles at pages 216-217. The Annex IRO-2 table lists G1-1 paragraph 10(b) on the UN Convention against Corruption and paragraph 10(d) on whistleblower protection as Material at page 212.

Thirteen policies are listed, including the "Whistleblower Protection Policy, ESG, Sustainability and CSR Policy, Anticorruption Policy, Human Rights Policy, Sponsorships and Donations Policy, Stakeholder Engagement Policy, Payment policy, Policy on the approval of non-audit services provided by the external auditor, Forecasting Policy, Related Party Transactions Policy, Diversity Policy, Nomination policy, Investor Relations Policy" (pages 211-212), plus the Rules of Procedure of the Board and of the Audit and the Nomination and Remuneration Committees.

Corporate culture is the one G1 sub-topic found material (page 114). Values are "integrity, transparency, accountability, respect for human rights, diversity and ethical conduct" (page 212).

Anti-corruption. The policy applies "at the level of the entire Group, in accordance with the principles of the United Nations Convention against Corruption", covering "preventing corruption and bribery; managing conflicts of interest; internal controls and segregation of duties; business partner assessment and due diligence" (page 213), with Audit Committee oversight (page 216).

Targets related to business conduct (part of MDR-T/GDR-T disclosures)

Reference: pages 212-214, with strategy context at pages 85 and 93-94. This statement was prepared under the 2023 ESRS, in which business conduct targets fell under MDR-T rather than a numbered G1 targets requirement, so there is no G1-3 targets section to extract and this entry is drawn from the business conduct chapter.

No numeric business conduct target is stated. The Sustainability Strategy 2025-2030 names "strengthening corporate governance" as one of four directions (page 85), expanded as continuing "to strengthen its governance structures and sustainability management processes, including through the adoption of policies and procedures aligned with the requirements of the Bucharest Stock Exchange's Corporate Governance Code, transparent reporting and the development of an integrated ESG data collection and management system" (page 94). No target level, base year or deadline is attached.

What the chapter does provide is MDR-T's other limb, how effectiveness is tracked in the absence of a target: "The assessment of corporate culture is carried out by monitoring compliance with internal policies, periodic reporting to management bodies, internal and external audit and collecting feedback from stakeholders, to continuously improve and align with strategic objectives and governance standards" (page 213).