Bavarian Nordic

Reference: page 43

Executive Management oversees the governance processes, controls and procedures used to monitor and manage IROs through delegated responsibilities. The Corporate Sustainability department is responsible for sustainability strategy development and the double materiality assessment, with day-to-day management anchored with the Executive Vice President and Chief People & Sustainability Officer, who holds overall strategic responsibility. Day-to-day management of ESG reporting sits with the Vice President Group Finance and Chief Financial Officer. Implementation of strategic initiatives lies with the lines of business under their respective Executive Vice President. Oversight of sustainability reporting is placed with the Finance Risk and Audit Committee (FRAC), and oversight of sustainability strategy with the Board of Directors, reflected in their terms of reference. Information on the composition and diversity of bodies is incorporated by reference to the Management review.

Reference: pages 43-44

The Board of Directors sets strategic direction and oversees strategic ESG matters, while Executive Management handles day-to-day management. The Board and Executive Management consider material IROs when overseeing strategy, major transactions and risk management, though as a first CSRD report these considerations are not yet formalized in a structured framework. Sustainability is a recurring item on all FRAC meeting agendas, where the ESG Finance and Corporate Sustainability departments present topics such as reporting progress, controls and risks, and the methodology and outcome of the DMA. The CFO and Chief People & Sustainability Officer attend FRAC meetings. The Board and FRAC each meet at least four times yearly, and in 2024 FRAC held an extraordinary meeting focused solely on CSRD implementation and the 2024 DMA outcome. Key matters addressed in 2024 included GHG emissions, fossil-fuel energy reliance and the access-to-medicine strategy.

Reference: page 44

All Executive Management members receive annual remuneration under the Remuneration Policy, which may include fixed and variable components and short- and long-term incentives that also include sustainability targets. The remuneration principles for the Board and Executive Management are governed by the Remuneration Policy, approved by shareholders. The proportion of remuneration deriving from short- and long-term incentives dependent on sustainability-related targets in 2024 amounts to 10% of total incentive remuneration of Executive Management. The targets, referred to as goals, were defined before final CSRD and ESRS adoption and are not aligned with the ESRS definition of targets addressing material IROs, but address key sustainability elements across three equally weighted goals. Bavarian Nordic did not assess performance against absolute GHG reduction targets in 2024; however climate-related considerations (energy-saving solutions) account for 3.33% of total remuneration.

Reference: page 42

The report states that the statement on due diligence is provided in the Appendix of the sustainability statements, incorporated by reference (GOV-4). The general disclosures describe how stakeholder engagement, the double materiality assessment and interactions with lines of business have informed the company's due diligence processes. Engagements with own workforce, value chain workers and consumers and end-users inform the strategy and business model and feed into the identification and management of material impacts and risks, including respecting and upholding human rights. The report notes the company may extend the contents of Board and FRAC meetings to include information on the implementation of due diligence and the results and effectiveness of policies, actions, metrics and targets related to its material IROs.

Reference: page 45

In 2024 Bavarian Nordic established an ESG Finance department to lead sustainability reporting, working with the Corporate Sustainability department to collect and control data from areas including EHS and People, Organization and Sustainability. Key reporting risks include inaccuracies, inconsistencies or misstatements from human error, incomplete data or fraud, amplified by recent growth. Controls include a single consolidated ESG software platform with access controls and input validation, alignment with ESRS accounting policy requirements, a governance framework with management reviews and reporting of risks to FRAC, and annual Board approval of the full annual report. The external auditor provides limited assurance on CSRD and ESRS compliance. ESG Finance conducted a metric-level risk assessment that informed development of an ESG Accounting Handbook setting definitions, scope, methodologies and data quality standards.

Reference: pages 42, 46

Elements of the company's strategy that relate to or impact sustainability matters, its business model and value chain are incorporated by reference to the Management review (SBM-1). The general disclosures describe Bavarian Nordic as a provider of critical healthcare solutions and a pioneering force in vaccines, whose core purpose is to expand access to life-changing solutions and prevent the spread of infectious diseases, including providing vaccines to endemic countries. The majority of identified IROs sit in own operations, closely tied to vaccine manufacturing, while downstream IROs generally relate to consumers and end-users of its vaccines. The company continuously assesses and amends its strategy and business model based on stakeholder views, though it notes it does not currently have initiatives specifically designed to integrate stakeholder views into the business model as required by the CSRD.

Reference: pages 45-48

Bavarian Nordic engages key stakeholders through the double materiality assessment and through interactions with lines of business, with engagement integrated into the business model via direct dialogue several times yearly and through representatives. Formalized sessions during the DMA captured the interests and views of own workforce, value chain workers, and consumers and end-users, informing due diligence and the DMA. The report describes how each group's interests inform strategy: workforce health, safety and well-being; respecting rights of value chain workers; and expanding access to vaccines for end-users. A stakeholder overview table (ESRS 2 table 1) details how engagement is organized, its purpose and outcomes for employees, value chain workers, consumers and end-users, suppliers and business partners, investors/analysts/media, industry bodies and regulators, and animals for testing. Stakeholder views are communicated annually to the Board and Executive Management during goal-setting and ad hoc throughout the year.

Reference: pages 53-59

Following its 2024 double materiality assessment, the company identified 34 material impacts, risks and opportunities across eight topical standards: E1 Climate change, E2 Pollution, E4 Biodiversity and ecosystems, E5 Resource use and circular economy, S1 Own workforce, S2 Workers in the value chain, S4 Consumers and end-users, and G1 Business conduct. The IROs are presented in a table (ESRS 2 table 2) with each item's type, location in the value chain and expected time horizon. Most IROs sit in own operations, closely tied to vaccine manufacturing, while downstream IROs relate to consumers and end-users. They span actual and potential negative impacts (such as GHG emissions, substances of concern, health and safety, horseshoe crab reliance and animal testing), risks (extreme weather, talent retention, compliance), and positive impacts and opportunities (preventing disease spread, expanding vaccine access). The company notes no significant current financial effects of its material risks and opportunities, and resilience was assessed qualitatively only.

Reference: pages 49-52

The 2024 double materiality assessment, the company's first, was led by the Corporate Sustainability department with support from an external consultancy, and assessed actual and potential positive and negative impacts, risks and opportunities and their interconnections. Steps included mobilization and hypothesis (reviewing ESRS sustainability matters per ESRS 1 AR16), stakeholder engagement via interviews with internal subject matter experts acting as proxies for external parties, a validation session with Executive Management, and finalization and documentation. Thresholds and scoring drew on the company's Enterprise Risk Management methods and ESRS 1 principles, assessing impact materiality (scale, scope, irremediability, likelihood) and financial materiality. IROs were tracked in an IRO workbook with documented rationales. The list of IROs was reviewed by the Workers Council, signed off by Executive Management and approved by the Board on FRAC recommendation. The report also describes topic-specific processes for climate change (TCFD-based scenario analysis using SSP5-8.5 and SSP2-4.5 and IEA scenarios), other environmental topics, and business conduct.

Reference: pages 103-105

The report states that the IRO-2 disclosures comprise the index of ESRS disclosure requirements complied with in preparing the sustainability statement, together with the list of data points that derive from other EU legislation. This index of material disclosure requirements covered is provided in the Appendix of the sustainability statements (pages 103-105) and is incorporated by reference under IRO-2 (56). All IROs identified in the 2024 DMA are covered by ESRS disclosure requirements, with the company reporting on data points identified as material and those mandated under the ESRS, applying the phase-in provisions of Appendix C of ESRS 1.

Reference: page 61

A transition plan was developed and approved by Executive Management in late 2024, embedded in overall business strategy and financial planning. In 2024 Bavarian Nordic initiated a feasibility analysis to test compatibility of its GHG reduction targets with a 1.5C pathway and aligns with the Science-Based Targets initiative (SBTi), seeking third-party validation; it is not excluded from EU Paris-aligned benchmarks. Targets: 42% absolute reduction in Scope 1 and 2 emissions by 2030 from a 2023 base year, net-zero by latest 2050; no absolute Scope 3 target set. Decarbonization levers: optimizing energy systems, transitioning to renewable energy via PPAs (a 5-year PPA signed Q4 2024 for the Danish site), electrifying key systems, and Scope 3 supplier engagement. A qualitative assessment of locked-in Scope 1 and 2 emissions informed the strategy. Progress: 12.6% reduction in total Scope 1 and 2 (market-based) emissions.

Reference: page 63

Bavarian Nordic states that internal governance documents drive the management of climate change-related impacts and risks. However, it currently does not have policies related to climate change mitigation, adaptation, energy efficiency or renewable energy deployment. A climate-related policy has not been drafted because the company has focused and allocated resources to establishing SBTi targets, including an evaluation of the most efficient decarbonization levers to reduce GHG emissions. The disclosure therefore reports the absence of formal policies rather than describing policy content, scope, or accountability.

Reference: page 63

In 2024 the company concentrated on three primary initiatives: optimizing energy systems, transitioning to renewable energy, and developing near-term and long-term net-zero climate targets. It actioned an energy optimization program across sites, focused on Danish operations, to increase energy efficiency in production facilities and office buildings. It secured a Power Purchasing Agreement for the Danish manufacturing site, supplying renewable electricity and significantly reducing Scope 2 market-based emissions. For Scope 3, it developed a supplier engagement dashboard tracking the climate target maturity of top suppliers in Purchased goods, Services, Capital goods, and Upstream transportation; by 2029 it aims for 70% of suppliers by spend in purchased goods and services and 90% in upstream transportation to commit to science-based targets. With 2023 as baseline, initial results show a 12.6% reduction in total Scope 1 and 2 (market-based) emissions. In 2024 no significant CapEx or OpEx amounts were allocated to these actions.

Reference: page 64

From 2024 Bavarian Nordic is committed to science-based targets to reduce GHG emissions in line with a 1.5C pathway, with near-term (2030) and long-term (2050) objectives. The Scope 1 and 2 target is a 42% absolute reduction by 2030 from a 2023 base year; these are gross targets with no reliance on GHG removals, carbon credits, or avoided emissions, following a sectoral decarbonization pathway. The trajectory implies a minimum 4.2% annual reduction until 2027 and net-zero by latest 2050. Progress to date is a 12.6% reduction in total Scope 1 and 2 emissions (10,682 to 9,333 tCO2e). For Scope 3, no quantitative reduction target is set; instead the company targets 70% of suppliers by spend (purchased goods, services, capital goods) and 90% (upstream transportation and distribution) to establish science-based targets by 2029. The feasibility analysis incorporated future demand, regulatory, and technology factors.

Reference: page 65

Total energy consumption in 2024 was 34,612 MWh. Fossil energy consumption totalled 32,411 MWh (94% of the total), comprising 8,027 MWh from crude oil and petroleum products, 9,724 MWh from natural gas, and 14,660 MWh of purchased electricity, heat, steam and cooling from fossil sources; there was no consumption from coal, other fossil sources, or nuclear. Renewable energy consumption totalled 2,201 MWh (6% of the total), all from purchased or acquired electricity, heat, steam and cooling from renewable sources; there was no fuel consumption from renewable sources or self-generated non-fuel renewable energy. Energy intensity per net revenue was 6.1 MWh per million DKK. Bavarian Nordic operates in high climate impact sectors only (biotechnology and pharmaceuticals, NACE code C21), so total net revenue is used for the intensity calculation.

Reference: page 66

In 2024 gross Scope 1 emissions were 4,111 tCO2e (down 6% from 4,364 in 2023), primarily from natural gas and diesel oil for heating. Gross location-based Scope 2 emissions were 1,715 tCO2e (down 44%) and gross market-based Scope 2 emissions were 5,222 tCO2e (down 17%), the market-based reduction attributed to the new PPA for the Kvistgaard site effective November 2024, which cut 750 tCO2e. Total gross Scope 3 emissions were 45,032 tCO2e (down 48%, not audited), with the largest categories being purchased goods and services (26,111) and capital goods (5,399). Total GHG emissions were 50,858 tCO2e location-based and 54,365 tCO2e market-based. GHG intensity per net revenue was 8.9 (location-based) and 9.5 (market-based) tCO2e per million DKK. Both location- and market-based methods were applied; primary supplier data covered 13% of Scope 3.

Reference: page 68

The Pollution topic overall is not material, but Substances of Concern (SoC) and Substances of Very High Concern (SVHC) are deemed material because they are part of vaccine research and manufacturing. Comprehensive policies manage and mitigate the related impacts and risks. Each production and research location using such substances, except the Martinsried site, has policies on handling and storage of these substances, covering management and employee responsibilities and safety measures for protective equipment and chemical storage. Heads of sites are accountable for implementation. A policy on monitoring changes in environmental laws and compliance is set out in the EHS Rules and Regulation, requiring annual compliance evaluation. The EHS Assessment Chemicals/Products policy addresses SVHC risks and seeks safer alternatives. Head of site Kvistgaard is accountable for relevant Danish-site policies. All policies are accessible via the internal document repository.

Reference: page 69

In 2024, Bavarian Nordic initiated a project to better understand all potential SoC used across the company. In 2025, it will continue evaluating SoC and create action plans for particular SoC used in operations, aiming to ensure safe handling, minimize risk and potentially reduce use, with an expected reduction in some harmful substances. The action covers the company's own activities across all geographical locations where it operates. Another initiative planned for 2025 is implementation of a global chemicals register across all locations to streamline and unify chemicals management and reporting through a centralized system. The company is also investigating potential alternatives for critical SVHC to reduce dependency on high-risk substances, prepare for future restrictions, and reduce the need for costly vaccine reformulations.

Reference: page 69

Bavarian Nordic has not yet formalized targets related to pollution. The company states that its focus has been on further defining its policies and actions, and that it has not yet formalized targets. The planned 2025 actions, including evaluating SoC, creating action plans for particular SoC, and implementing a global chemicals register, are intended to support an eventual reduction in the use of some harmful substances and align with sustainability policies. The company also notes ongoing investigation of alternatives to SVHC to reduce dependency on high-risk substances and prepare for potential future restrictions, but no quantitative or time-bound targets have been set at this time.

Reference: page 69

Only substances consumed at manufacturing sites are included; those used at research and development facilities are assessed immaterial. Three hazard classes are defined: health hazard, environmental hazard, and combined health and environmental hazard, based on characteristics such as carcinogenicity, mutagenicity, reproductive toxicity, endocrine disruption, and aquatic or ozone hazards. SVHC are substances on REACH Annex XVII, the Annex XIV Authorisation List, or the Candidate List. In 2024, total SoC used was 611 tonnes (6 health hazard, 1 environmental hazard, 604 combined), and total SVHC was 2 tonnes (2 health hazard). Volumes are extracted from local ERP systems; liquids measured in liters were converted to kilograms. No substances of concern or very high concern were identified leaving facilities as emissions or in products.

Reference: page 71

Bavarian Nordic recognizes that its biodiversity and ecosystem impacts, dependencies, risks, and opportunities originate from its operations and value chain activities. The main impact stems from dependency on Limulus Amebocyte Lysate (LAL), derived from horseshoe crab blood, used for endotoxin safety testing as part of regulatory compliance, quality assurance, and product release. The North American horseshoe crab is listed as Vulnerable on the IUCN Red List; after blood harvesting, crabs are released back into their natural habitat. The company is currently working to better understand and specify these impacts and dependencies and is exploring options to transition away from reliance on this substance, aiming to gain insights to reduce its biodiversity dependency and impact while ensuring alignment with product safety standards and regulations. No formal transition plan is yet in place.

Reference: page 71

Bavarian Nordic's efforts are focused on understanding its material impact and risks related to biodiversity. The company has not implemented policies corresponding to the requirements in the European Sustainability Reporting Standards (ESRS) and has not yet developed dedicated policies to address biodiversity. It has not adopted biodiversity and ecosystem protection policies, nor policies related to deforestation or sustainable land and ocean practices. The LAL substance is sourced from an external supplier who is a member of the Pharmaceutical Supply Chain Initiative (PSCI) and is committed to following its established guidelines on this matter. The company states it is working to increase its understanding of the impact and risk before developing appropriate policies.

Reference: page 71

To address concerns and reduce reliance on the horseshoe crab, Bavarian Nordic is in the early stages of exploring the feasibility of alternative methods for endotoxin testing that could be implemented in its production process. Because regulations vary between countries, products tested with alternative methods can only be supplied to countries where such methods have been approved. At this time, the company has not implemented further actions or targets, as it is working to increase its understanding of the impact and risk in order to appropriately address the matter. No biodiversity offsets, mitigation measures, or incorporation of local knowledge and nature-based solutions have been undertaken at this time.

Reference: page 71

Bavarian Nordic has not set targets related to biodiversity and ecosystems. The company states that, at this time, it has not implemented further actions or targets, as it is working to increase its understanding of the impact and risk associated with its reliance on Limulus Amebocyte Lysate (LAL) derived from horseshoe crabs in order to be able to appropriately address the matter. Its current efforts focus on understanding the material impact and risks and exploring the feasibility of alternative endotoxin testing methods, but no quantitative or time-bound biodiversity targets have been established.

Reference: page 73

Bavarian Nordic's commitment to sustainability is reflected in policies designed to manage and mitigate the negative impact associated with waste generated. Each production and research facility has a local policy on handling residual waste. These policies are implemented to ensure waste is properly classified, segregated, transported, and destroyed by the proper disposal companies and disposal methods in order to protect the environment and human health. Their scope includes all employees involved in managing production and laboratory waste within the company's own operations. Heads of the sites are accountable for implementation of those policies. All policies are accessible to affected stakeholders through the internal document repository, which is available to all employees.

Reference: page 73

In 2024, Bavarian Nordic initiated an expansion of its Global EHS department. This expansion will enable the company to reassign current responsibilities and allocate new, improvement-focused tasks to employees, in addition to their regular operational activities. The company anticipates that the new structure and enhanced capacity of the department will further its understanding and management of its waste streams and the development of initiatives aimed at increasing the rate of recycled waste from its manufacturing and research facilities. At this time, the focus has been on further defining actions, and the company has not yet formalized targets related to resource use and circular economy.

Reference: page 73

Bavarian Nordic has not yet formalized targets related to resource use and circular economy. The company states that, at this time, its focus has been on further defining its actions, and it has not yet formalized targets. The 2024 expansion of the Global EHS department is intended to enhance capacity to understand and manage waste streams and to develop initiatives aimed at increasing the rate of recycled waste from manufacturing and research facilities, but no quantitative or time-bound targets have been established at this time.

Reference: page 72

Given the nature of its business, Bavarian Nordic generates hazardous waste in manufacturing and research, including chemicals and biological materials. Single-use plastics play a significant role, used in equipment, connections, hoses, and bags. Discarded plastic items and vials may contain product residues including viruses and are incinerated as biomedical waste. Wastewater is the primary waste stream, accounting for over 70% of overall waste by weight, and is treated as hazardous due to antibiotic content. In 2024, total waste was 2,429 tonnes (1,817 hazardous, 612 non-hazardous, 0 radioactive). Non-recycled waste was 2,166 tonnes, or 89%. Waste directed to disposal included incineration (1,808 hazardous, 281 non-hazardous), landfill (72 non-hazardous), and other disposal (5 hazardous). Waste diverted from disposal included recycling (3 hazardous, 146 non-hazardous) and other recovery.

Reference: page 72

Given the nature of its business, Bavarian Nordic generates hazardous waste in manufacturing and research, including chemicals and biological materials. Single-use plastics play a significant role, used in equipment, connections, hoses, and bags. Discarded plastic items and vials may contain product residues including viruses and are incinerated as biomedical waste. Wastewater is the primary waste stream, accounting for over 70% of overall waste by weight, and is treated as hazardous due to antibiotic content. In 2024, total waste was 2,429 tonnes (1,817 hazardous, 612 non-hazardous, 0 radioactive). Non-recycled waste was 2,166 tonnes, or 89%. Waste directed to disposal included incineration (1,808 hazardous, 281 non-hazardous), landfill (72 non-hazardous), and other disposal (5 hazardous). Waste diverted from disposal included recycling (3 hazardous, 146 non-hazardous) and other recovery.

Reference: page 81, 84, 85, 87

Bavarian Nordic's policies covering its own workforce include a Human Rights Policy, adopted by the Board of Directors in December 2023 and publicly accessible via the website, which follows the Universal Declaration of Human Rights, ICCPR, ICESCR, ILO Core Labor Standards, UN Guiding Principles, and OECD Guidelines. The company adheres to freedom of association, the right to collective bargaining, and elimination of discrimination, forced labor, and child labor. A Remote Working Policy, Diversity and Inclusion Policy, global policies on sexual harassment and on bullying and harassment, and a Global Environmental, Health and Safety Policy (revised in 2024, published early 2025) also apply. Executive Management is accountable for implementing the human rights, diversity, and harassment policies.

Reference: page 82, 84, 87

Bavarian Nordic engages its workforce through anonymous employee engagement surveys and continuous dialogue with workers councils in Denmark and Germany. In 2024, three engagement surveys were conducted, with feedback collected anonymously and aggregated results shared with teams and managers. The Chief People & Sustainability Officer is the most senior person accountable for the engagement survey, and the Executive Team drives engagement collectively. Workers councils (Betriebsrat in Germany and Arbejdsmiljoorganisation in Denmark) serve as formal channels to incorporate employee perspectives into decision-making on working conditions and personnel policies. For health and safety, engagement occurs directly and through workers' representatives via regular meetings, surveys, and feedback sessions across planning, implementation, and review phases.

Reference: page 82, 84, 85, 88

Employees are encouraged to raise concerns with their manager or the HR department, and the company strives to resolve issues raised. Formal reporting channels include an Ethics Hotline allowing confidential and anonymous reporting of misconduct, described further in the Business Conduct section. For equal treatment concerns, employees can speak with those involved, their manager, a trusted colleague, their HR Business Partner, or escalate to a higher-level manager, a union or Workers Council representative, or the Health and Safety Representative. A strict non-retaliation policy protects good-faith reporting. For health and safety, employees can report through the health and safety management system, health and safety representatives, or direct managers, enabling structured reporting and resolution.

Reference: page 84, 85, 88

In 2024, Bavarian Nordic initiated actions to attract and retain talent, including the LeadPioneers leadership development program (with Leading Others and Leading Leaders tracks) training leaders in cohorts through 2025, and a Performance Management system aligning expectations. The New Ways of Working initiative, introduced in 2021, promotes flexibility and work-life balance. For equal opportunities, two online programs were run in 2024 on Inclusive Colleagueship and Unconscious Bias. For health and safety, the company developed a new Global EHS strategy, began implementation, is filling key full-time EHS positions to build governance and capabilities, and introduced the updated Global EHS Policy addressing on- and off-premise workers.

Reference: page 84, 85, 88

For talent attraction and retention and for equal opportunities, Bavarian Nordic has not formalized targets but continuously monitors performance through turnover rates, engagement surveys, performance and development talks, leadership development, one-on-one dialogue, exit interviews, awareness trainings, and salary benchmark checks. For health and safety, the 2025 sustainability-related goals include a target relating to the health and safety of workers on-premise regardless of employment type, supporting the Global EHS Policy and Strategy. The target is to further reduce health hazards by expanding the portfolio of risk assessments in each location and addressing 90% of identified mitigating actions. The baseline will be finalized by end of Q1 2025, with quarterly tracking thereafter.

Reference: page 83

At the end of 2024, Bavarian Nordic had 1,653 employees by headcount, comprising 887 female and 766 male. By country: Denmark 979, Germany 301, Switzerland 215, United States 123, and other countries (each under 50 employees) 35. By employment classification, there were 1,605 permanent employees (856 female, 749 male), 48 temporary employees (31 female, 17 male), and zero non-guaranteed hours employees. The employee turnover rate was 17.4%, with 255 employees leaving the company during the year. Figures are based on HR system records at the end of the reporting period.

Reference: page 86

Gender distribution in Top management (defined as Vice President level and above) at the end of 2024 was 11 female (46%) and 13 male (54%), totaling 24. Age distribution across the own workforce was 228 employees under 30 years old, 963 employees aged 30 to 50, and 462 employees over 50, totaling 1,653. Figures are based on HR system records at the end of the reporting period.

Reference: page 88

Health and safety metrics related to own employees for 2024: the percentage of workforce covered under a health and safety management system was 100%; fatalities as a result of work-related injuries and ill health was 0; recordable work-related accidents totaled 6; and the rate of recordable work-related accidents was 2.3 (cases per one million hours worked). A recordable accident is registered when the employee is unable to perform usual work for one day or more, excluding the day of injury. Hours worked are estimated based on standard full-time equivalent (FTE) hours, accounting for leave entitlements.

Reference: page 86

For 2024, Bavarian Nordic reported a gender pay gap of -1.6%, where the negative figure reflects a pay gap in favor of males. The gender pay gap is defined as the difference in average pay levels between female and male employees, expressed as a percentage of the average pay level of male employees, calculated on total annual remuneration including both fixed and variable components. The CEO remuneration ratio was 29, reflecting the annual ratio between the total remuneration of the CEO (the highest paid individual) and the average remuneration of all employees measured in FTEs, excluding executive management, consistent with the CEO pay ratio in the Remuneration Report.

Reference: page 88

For 2024, Bavarian Nordic reported zero incidents of discrimination, including harassment; zero complaints filed through channels for people to raise concerns; zero DKK in fines, penalties, and compensation for damages resulting from discrimination; zero severe human rights incidents; and zero DKK in fines, penalties, and compensation for damages resulting from severe human rights incidents. These metrics represent the number of discrimination incidents, complaints, and severe human rights cases reported to the Ethics Hotline or to the Legal and Compliance team during the reporting period.

Reference: page 90, 91

On- and off-premise value chain workers are covered by Bavarian Nordic's Environmental, Health and Safety (EHS) Policy, described in the Own Workforce section. The Responsible Sourcing Standards Policy sets expectations for suppliers on health and safety, aiming to protect workers from work-related hazards. Its general objectives include compliance with relevant regulations, proactive risk assessment, and protective measures addressing chemical, biological and physical hazards, with monitoring through audits and corrective actions. The policy applies across the upstream and downstream value chain, covering suppliers, sub-suppliers and workers regardless of location, excluding no specific activities or geographies. The Chief Operating Officer is the most senior level accountable for implementation. The Code of Conduct and Human Rights Policy also apply to value chain workers.

Reference: page 91, 92

Engagement with on-premise workers is direct, covering training and information about their health and safety, including a visitor induction explaining site rules, expected behavior and what they may encounter. The site head holds operational responsibility for ensuring engagement, supported by monthly EHS meetings where matters are discussed and that inform decision-making. Needs of particularly vulnerable workers are assessed individually. For off-premise workers, engagement occurs through monthly and ad hoc meetings in the Pharmaceutical Supply Chain Initiative (PSCI), considered a credible proxy. EHS, Procurement and Corporate Sustainability functions participate, with the Global EHS Director holding operational responsibility for supplier and CMO engagement. Effectiveness is assessed regularly, drawing on PSCI insights into vulnerable workers.

Reference: page 91, 92

Bavarian Nordic has established processes to address and remediate potential negative impacts on on-premise value chain workers as part of its duty of care, aligning with processes used to remediate impacts for its own employees. Monthly EHS meetings ensure continuous attention to health and safety impacts on its sites. To capture health and safety impacts across the value chain, the company is further developing its Responsible Value Chain Program, and based on risk screenings aims to conduct targeted engagements with suppliers and business partners to track, monitor and mitigate impacts. The publicly available Ethics Hotline allows value chain workers to raise confidential and anonymous reports of suspected violations of the Code of Conduct and applicable laws and regulations.

Reference: page 91, 92, 93

For on-premise workers, Bavarian Nordic developed a new global EHS strategy, began implementation and plans to fill key EHS positions, updated its EHS Policy to address health and safety impacts, and updated visitor induction training so visitors understand their responsibilities and site rules. Actions are tracked and assessed by the site head with the EHS department. For off-premise workers, further developing a supplier management program is a strategic priority within the Responsible Value Chain program; the company completed a value chain mapping and high-level risk screening of tier 1 suppliers and business partners. As part of its PSCI commitment, it initiated work to increase supplier audit coverage. Actions are tracked monthly by key stakeholders.

Reference: page 92, 93

The target disclosed for health and safety of the own workforce also applies to on-premise value chain workers. For off-premise workers, to track the effectiveness of the Responsible Value Chain Program, Bavarian Nordic set a target to increase the share of scoped suppliers and business partners audited in accordance with PSCI audit standards or similar. The long-term target is for 70% of in-scope suppliers and business partners to be audited by 2027, with annual milestones of 12.5% in 2024, 25% in 2025 and 40% in 2026. The 2024 actual vendor audit rate was 12.6%, meeting the target; 2024 is the first tracking year so there is no 2023 baseline. Targets were approved by Executive Management.

Reference: page 95, 97, 98

Policies reflect Bavarian Nordic's commitment to human rights per the UNGPs, ILO Declaration, UN Global Compact and UDHR. For access to vaccines, there is no formal policy, but associated impacts are managed through actions. For safety, an end-user safety framework of quality and safety policies and procedures applies, including GCLP, GMP, GDP, GVP and applicable ethical standards, following ICH guidelines, the Declaration of Helsinki and GCP. A Quality Management System ensures compliance with legislation, safety requirements and GxP standards, with the Senior Vice President of Global Quality as management representative. For responsible marketing, the approach is anchored in the Code of Conduct, supported by documented marketing approval processes, ensuring promotion complies with applicable laws. The Code was approved by the Board in December 2024.

Reference: page 96, 97, 98

For access to vaccines, Bavarian Nordic engages supranational organizations, NGOs, governments and partners, treating them as credible proxies for people in need of vaccines; the Vice President, Commercial, Rest of World holds operational responsibility. For safety, the pharmacovigilance system supports ongoing collection, assessment and notification of safety data, with procedures for reporting adverse events, reactions and product quality complaints, and employee training; the Chief Medical Officer holds operational responsibility. For responsible marketing, engagements are highly regulated, and the company follows required standards and procedures to manage and govern interactions. The disclosures across the section detail how processes and engagements are managed in relation to identified impacts on consumers and end-users.

Reference: page 97, 99

A Corrective and Preventive Action (CAPA) system assigns and resolves corrective actions to remedy identified issues and prevent recurrence. For clinical trials, remediation is handled internally or through the CRO under oversight, and participants are advised by the responsible healthcare professional when adverse events occur. Participants can contact investigators or the CRO, with communications treated under data privacy laws and effectiveness assessed through regulatory quality and compliance procedures. Vaccine recipients of marketed products who experience adverse effects can raise concerns through a publicly accessible email. For marketing, HCPs and the public can raise concerns via the Bavarian Nordic Ethics Hotline, regulatory authorities such as the FDA, Health Canada and the EMA, and national advertising oversight bodies.

Reference: page 96, 98, 99

For access, Bavarian Nordic worked with WHO, UNICEF, Africa CDC and Gavi during the 2024 mpox outbreak; its vaccine received WHO prequalification, over 250,000 donated doses reached the DRC, an advance purchase agreement secured 500,000 doses, and a UNICEF agreement plus donations secured over 2.5 million doses for low- and lower-middle-income countries. It expanded approvals to adolescents, advanced its chikungunya vaccine, formalized an access strategy running to 2028, and signed a License and Manufacturing Agreement with Serum Institute of India. For safety, it maintains its QMS, pharmacovigilance and GxP refresher training. For marketing, it provides annual Code of Conduct training and mandatory marketing materials review training.

Reference: page 97, 98, 99

For access to vaccines, as one of three KPIs in its Sustainability Linked Loan credit facility, Bavarian Nordic targeted finalizing its Access to vaccines strategy for low- and lower-middle-income countries by end of 2024; this target was completed when the strategy was approved by Executive Management in December 2024. In 2025 it aims to define quantitative targets and execute them in following years. For safety, no external reporting target is formalized, but a Safety Committee continuously evaluates the pharmacovigilance program and requires training for all employees. For responsible marketing, no formalized targets exist due to differing local promotional regulations; instead materials review committees periodically re-review approved marketing materials to ensure they remain truthful and non-misleading.

Reference: page 101, 102

Bavarian Nordic establishes its corporate culture through business conduct policies including the Code of Conduct, Anti-Corruption Policy, Third-Party Intermediary Policy, and Speak-Up Policy. These apply to all employees, Executive Management, the Board, and third parties acting on its behalf, and create an obligation to report suspected violations. As the company grows rapidly and onboards new employees, maintaining a healthy corporate culture is central to preventing negative impacts on staff. The Board and Finance, Risk & Audit Committee (FRAC) oversee business conduct matters. Animal welfare is mapped under business conduct: the company commits to the 3R-principle (Reduce, Replace, Refine) for the use of mice in in-vivo preclinical and batch-release testing, with permits, daily welfare checks, trained handling staff, and internal and external approvals.

Reference: page 101, 102

The Code of Conduct, Anti-Corruption Policy, and Speak-Up Policy prohibit corruption and bribery and require reporting of suspected violations. Functions-at-risk identified in the annual Global Business Ethics Compliance Risk Assessment, and their management, are trained on the Anti-Corruption Procedure, with ad hoc training as needed. Training includes read and understand campaigns and face-to-face or virtual sessions. The Global Business Ethics Compliance Program includes annual monitoring of third parties and Health Care Professionals. An Ethics Hotline enables confidential, anonymous reporting; claims undergo an initial assurance review by outside counsel and Legal & Compliance, which has an independent reporting line to the Board through FRAC. The Chief Compliance Officer reports to the CEO and independently to FRAC.

Reference: page 102

During the reporting period there were no reported incidents of corruption or bribery, no confirmed incidents, no convictions or fines, and no actions taken as a result.