Bavarian Nordic

Governance roles

Reference: pages 34, 45, 111. Composition and diversity datapoints (21 a-e) are incorporated by reference to the Management review, Corporate Governance (page 44).

Bavarian Nordic has a Board of Directors and Executive Management. Board committees are the Finance, Risk and Audit Committee (FRAC), the Nomination and Compensation Committee and the Science and Technology Committee.

Allocation of responsibility (page 45):

• Oversight of sustainability reporting is anchored under the FRAC; the Board oversees the sustainability strategy per its terms of reference.
• The CFO holds overall strategic responsibility for sustainability and oversees ESG reporting.
• Day-to-day management sits with the Director, Corporate Sustainability; reporting is anchored with ESG Finance and Corporate Sustainability.
• Implementation sits within the line of business, overseen by the relevant Executive Vice President.
• Executive Management "secures that appropriate skills for managing material IROs are available within their business units".

For business conduct, the Board and FRAC oversee the Global Business Ethics Compliance Program, and the Chief Compliance Officer reports directly to the CEO and independently to FRAC (page 111). The Board and FRAC each meet at least four times annually (page 46). Three of the eight Board members signing the Annual Report are employee-elected (page 196).

Information provided to and sustainability matters addressed by the administrative, management and supervisory bodies

Reference: pages 45-46.

Sustainability and ESG reporting are standing items at all FRAC meetings. Corporate Sustainability and ESG Finance each present items for information and/or decision, including: reporting progress, controls and risks; sustainability strategy topics; approval of the DMA methodology; and recommendation to the Board for signing off the annual DMA (page 45).

The CFO represents management at FRAC meetings. Both the Board and Executive Management "consider material IROs in strategy, major transactions, and risk management, including any trade-offs associated with these".

2025 update: from Q2 2025 the company reports internally on key KPIs to Executive Management quarterly, covering strategic initiatives, public commitments and general progress (page 46).

Executive Management is informed annually on the DMA outcome and quarterly on selected initiatives. Matters addressed during 2025 (page 46):

• Access — access to vaccines strategy roadmap in LICs and LMICs
• Environment — initiation of the multi-year phased conversion of the Swiss site heating/cooling system to a modular electric heat pump system
• Integrity — the Responsible Value Chain Program, including a new policy on supplier due diligence aligned to the UN Guiding Principles and OECD Guidelines

Integration of sustainability-related performance in incentive schemes

Reference: page 47; page 63.

Executive Management receives fixed and variable remuneration under the shareholder-approved Remuneration Policy, with short- and long-term incentives that include sustainability targets.

"The proportion of remuneration deriving from short-term and long-term incentives dependent on sustainability-related targets in 2025 amount to 10% of the total incentive remuneration of Executive Management."

Sustainability targets for 2025 covered:

• Environmental footprint — implement energy-saving solutions designed to reduce future CO2e emissions
• Safe and healthy work environment — reduce health hazards in operating sites through completion of mitigating actions following site-specific risk assessments
• Animal welfare — submit a regulatory file to support in-vitro potency testing, to reduce animal testing of produced batches
• Access — further expanding access to vaccines in low- and middle-income countries through an additional partnership

On climate, the company "did not in 2025 assess performance against absolute greenhouse gas (GHG) emission reductions targets (goals)", but climate considerations enter via the energy-saving target: "With this goal, 2.5% of the total remuneration derives from climate-related considerations."

The annual bonus pool allocation is also linked to internal annual CO2 reduction targets focused on energy efficiency and fossil fuel reduction projects (page 63).

Statement on due diligence

Reference: page 114 (Appendix 1: ESRS2 GOV-4 Statement on due diligence). GOV-4 is explicitly incorporated by reference to the Appendix of the sustainability statements (page 44).

Bavarian Nordic maps the core elements of due diligence to the pages of the sustainability statement as follows (Appendix 1, page 114):

The due diligence approach is guided by "authoritative global frameworks, such as the UN Guiding Principles on Business and Human Rights, and the OECD Guidelines for Multinational Enterprises" (page 84). In 2025 the company introduced a new policy under the Responsible Value Chain Program underlining expectations to suppliers' and business partners' commitments to sustainability due diligence in line with the UN Guiding Principles and OECD Guidelines (page 46).

Risk management and internal controls over sustainability reporting

Reference: page 47.

The approach is based on the principles of the COSO framework, "an internationally recognized framework that can be used to set up internal controls", and "covers all material sustainability data and disclosures".

Risks are identified and assessed annually with quarterly monitoring of key indicators. The disclosed six-step cycle is: identify & assess (annual assessment of material risks); monitor indicators (quarterly KPIs); mitigate risks (documentation, training, cross-functional validation); control & review (four-eye principle, analytical procedure); report & escalate (Executive Management & FRAC); improve & adapt.

The process "prioritizes risks that could impact reporting accuracy, such as data integrity, complexity, and gaps in competencies".

Control activities: all sustainability data is reviewed by the ESG Finance department, with additional controls in high-risk areas. "Analytical procedures are performed quarterly to detect anomalies and ensure consistency."

"The main risks identified include human error and completeness of data." Mitigations are "a four-eye review process to reduce the likelihood of errors and the involvement of employees from the relevant parts of the business to validate completeness and provide subject-matter expertise". Deficiencies or significant changes are reported quarterly to Executive Management and, when relevant, to the FRAC.

Strategy, business model and value chain

Reference: page 11 — incorporated by reference to the Management review (page 44); pages 42, 57, 60.

Bavarian Nordic is a pure-play vaccine company: "our operations span research and development, manufacturing, commercialization, and distribution of vaccines. These activities are resource-intensive and rely on both internal capabilities and external partners, including contract manufacturing organizations, raw material suppliers, and logistics providers" (page 60).

The sustainability approach is framed around four pillars — Access, Integrity, People, Environment — which "will be developed further in the course of 2026" (page 42).

Operations and value chain: manufacturing in Denmark (Kvistgaard) and Switzerland (Bern); research in Denmark (Hørsholm) and Germany (Martinsried); a San Diego research site closed early in 2025. Upstream covers raw materials, CROs and CMOs; downstream covers vaccine consumers and end-users (pages 56, 98).

Employees rose from 1,653 to 1,836 in 2025 (page 86). The company operates in high climate impact sectors only — biotechnology and pharmaceuticals, NACE code C21 (page 66) — and identified one EU Taxonomy activity, 'PPC 1.2 Manufacture of medicinal products' (page 77).

Appendix 3 records the SBM-1 datapoints on involvement in fossil fuel, chemical production, controversial weapons and tobacco activities as "Not material" (page 116).

Interests and views of stakeholders

Reference: pages 48-51.

Key stakeholders are employees; workers in the value chain; consumers and end-users; suppliers and business partners; industry bodies and regulators; investors, analysts and media; and animals for testing (a "silent stakeholder") (pages 48, 51).

Engagement runs through "both structured and ad-hoc processes, including the double materiality assessment (DMA) and ongoing interactions within lines of business". For the DMA the company "implemented formalized sessions to engage with stakeholders, both directly and through proxy representatives" (page 48).

Selected mechanisms and outcomes (pages 50-51):

• Employees — employee-elected board members, worker council dialogue several times yearly, engagement surveys at least annually, development dialogues at least twice yearly. Outcomes include increased engagement and reduced employee turnover.
• Workers in the value chain — PSCI membership; own workforce as proxy advisors.
• Consumers and end-users — advisory boards, MSL visits to HCPs, congress participation.
• Animals for testing — consultations with the Animal Welfare Officer, veterinarian inspections, internal audits per EU Directive 2010/63/EU; outcomes include gradual replacement of in-vivo tests.

DMA insights are formally presented to the Board and Executive Management, and in 2025 the company "introduced internal quarterly sustainability reporting". On strategy amendments it states it is "focused on executing our existing strategy" (page 48).

Material impacts, risks and opportunities and their interaction with strategy and business model

Reference: pages 56-57; per topic pages 59-61, 67, 71-73, 81-83, 98, 102-104, 110.

The 2025 DMA identified 18 named material IROs across E1, E2, E4, E5, S1, S2, S4 and G1 (page 56), described as 37 individual rows in the topical chapters.

"Most material IROs relate to our own operations and are closely linked to vaccine manufacturing." Upstream IROs "primarily concern carbon emissions and working conditions among workers in our supply chain"; downstream they "relate mainly to consumers and end-users". Critically: "There are no current significant financial effects related to our identified risks and opportunities" (page 57).

Resilience: considerations "are captured on a qualitative basis through discussions with subject matter experts" (page 57). For E1 and E4 the company states it has not conducted a resilience analysis as defined under the ESRS (pages 55, 72).

Changes in 2025 (page 57): three IROs were reassessed as not material — E1 "Reliance on energy sources stemming from the use of fossil fuels", E2 "Further restriction on the use of substances of very high concern", and E4 "Continued regulation on horseshoe crab reliance". S1 was fully reassessed using a more granular approach, increasing the number of material impacts and risks; health & safety was split into three impacts and one risk, and the 2024 risk "Equal treatment and opportunities" was removed.

The climate resilience conclusion is also presented under E1-3 (2025 ESRS numbering).

Description of the processes to identify and assess material impacts, risks and opportunities

Reference: pages 52-55.

The 2025 DMA is Bavarian Nordic's second, led by Corporate Sustainability with ESG Finance support, built on "the methodology, thresholds, and conclusions from the 2024 DMA".

Four steps (page 52): mobilization and hypothesis (ESRS matters reviewed per ESRS 1 AR16, including peer IRO review); stakeholder engagement (subject matter expert interviews, internal stakeholders as informed proxies); validation session; and finalization — the IRO list was presented to the Danish Bavarian Nordic Workers Council, signed off by Executive Management and approved by the Board on FRAC recommendation.

Thresholds (page 53): inspired by the company's Enterprise Risk Management methods. "For topics with human rights relevance, lower thresholds were applied to reflect the heightened severity and sensitivity of potential adverse impacts on people." Actual impacts were assessed gross, "without considering existing mitigation measures", with severity taking precedence over likelihood for potential negative human rights impacts per ESRS 1, 45.

Key assumptions: point-in-time assessment; anticipated financial effects assessed qualitatively because quantification "was deemed premature at this stage"; internal stakeholders as proxies.

Climate (pages 54-55): informed by TCFD; the 2022 assessment was reviewed in 2024 but not updated in 2025 as "we believe the conclusions remain the same". Scenarios: IPCC SSP5-8.5 and SSP2-4.5 (physical) and IEA Net Zero Emissions by 2050 and Stated Policies (transition).

E4 (page 55): WWF Biodiversity Risk Filter scores of 3.32 (Medium) for the Danish site and 2.95 (Medium) for the Swiss site. 'Systemic risks' "were not considered as we have yet to develop the methodology to do this".

"Currently, there is no formalized process to integrate the DMA results of IROs into our ERM process" (page 54).

Climate-specific risk identification and scenario analysis is also presented under E1-2 (2025 ESRS numbering).

Disclosure requirements in ESRS covered by the undertaking's sustainability statement

Reference: page 57; pages 114-115 (Appendix 2); pages 116-118 (Appendix 3).

Appendix 2 provides a content index of material disclosure requirements with page references, covering ESRS 2 (BP-1, BP-2, GOV-1 to GOV-5, SBM-1 to SBM-3, IRO-1, IRO-2) and the topical standards E1, E2, E4, E5, S1, S2, S4 and G1.

Topics assessed and found not material: ESRS E3 Water and Marine Resources and ESRS S3 Affected communities, because they "did not meet the materiality thresholds established during the DMA" (page 57).

Appendix 3 lists datapoints derived from SFDR, Pillar 3, the Benchmark Regulation and the EU Climate Law with page numbers or a "Not material"/"Phase-in" marker. Marked "Not material": SBM-1 fossil fuel, chemical production, controversial weapons and tobacco involvement; E2-4 E-PRTR pollutants; the E3 water datapoints; several IRO-1 E4 and E4-2 datapoints; S3-1 and S3-4; and G1-1 UN Convention against Corruption. Marked "Phase-in": E1-9 physical risk disaggregation and real estate energy-efficiency classes, E2-4, and S1-16 excessive CEO pay ratio.

Phase-in: "We continue to apply all phase-in provisions set out in Appendix C of ESRS 1... In addition, for disclosure requirements covered by the ESRS 'quick-fix' delegated act, we apply the extended timelines that remain available to Wave 1 reporters." For 2025 the company also applied simplification measures to the EU Taxonomy disclosures per the Delegated Regulation of 4 July 2025 (page 44).

Omissions: "We have not omitted any specific information corresponding to intellectual property, know-how, impending developments or matters in the course of negotiations" (page 44).

Transition plan for climate change mitigation

Reference: page 61; pages 60-63.

"In 2024, we began to assess the compatibility of our GHG emission reduction targets with a 1.5°C pathway. Recognizing the importance of adhering to the Paris Agreement, we align with the Science-Based Targets initiative (SBTi). We also aim to secure third-party validation for our emissions targets" (page 61).

The transition plan "is our starting point in our commitment to mitigate climate change risks" and considers:

• the main decarbonization levers — electrification, renewable energy sourcing, energy efficiency
• resilience actions — preventive maintenance and flood prevention, supplier engagement targets
• business continuity planning across the value chain

Approval and embedding: "With input, involvement and approval by Executive Management, the analysis and targets show our commitment to mitigating material climate change-related impacts and risks and subsequently constitute an alignment with our overall business strategy and financial planning."

Locked-in emissions: "We have conducted a qualitative assessment of potential GHG emissions from Scope 1 and 2 sources. This assessment focused on assessing locked-in emission sources associated with energy-intensive equipment that requires long-term planning to abate."

Bavarian Nordic is not excluded from the EU Paris-aligned benchmarks (page 60).

Funding: the company has "not in 2025 allocated significant monetary amounts, in relation to CapEx and OpEx, to implement actions taken or planned" (page 60).

Identification of climate-related risks and scenario analysis

Back-filled from ESRS 2 IRO-1, where this content is disclosed in the FY2025 report (pages 54-55). This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

Climate-related IROs are informed by TCFD; the 2022 assessment was reviewed in 2024 but not updated in 2025, as "we believe the conclusions remain the same" (pages 54-55).

Scenarios used (pages 54-55):

• Physical risk — IPCC SSP5-8.5 and SSP2-4.5
• Transition risk — IEA Net Zero Emissions by 2050 and Stated Policies

Related disclosures in the same report: the company "began to assess the compatibility of our GHG emission reduction targets with a 1.5°C pathway" in 2024 (E1-1, page 61), and Appendix 3 marks the E1-9 physical-risk disaggregation and real-estate energy-efficiency datapoints as "Phase-in" (page 116).

Resilience in relation to climate change

Back-filled from ESRS 2 SBM-3, where this content is disclosed in the FY2025 report (page 57, cross-referring to pages 55 and 72). This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

The company states it has not conducted a resilience analysis as defined under the ESRS for either E1 or E4 (pages 55, 72).

Resilience considerations instead "are captured on a qualitative basis through discussions with subject matter experts", applying the same time horizons assessed in the DMA (page 57).

The transition plan does incorporate resilience actions — preventive maintenance and flood prevention, and supplier engagement targets — alongside business continuity planning across the value chain (E1-1, page 61).

Policies related to climate change mitigation and adaptation

Reference: page 60 (Material impacts, risks and opportunities — E1).

Bavarian Nordic discloses that it does not have a dedicated climate policy: "Our internal governance documents drive the management of climate change-related impacts and risks. We currently do not have a policy directly addressing climate change mitigation, adaptation, energy efficiency or renewable energy, because our actions to reduce our impact on climate change are captured within our Global Environmental, Health and Safety Policy" (page 60).

The company adds that "Our climate transition plan includes an evaluation of the most efficient decarbonization levers to reduce GHG emissions, priorities, timelines and targets" (page 60).

The Global Environmental, Health & Safety (EHS) Policy applies to all business areas and locations, commits the company to maintaining high standards of EHS performance and full legal compliance, managing EHS risks responsibly and continuously improving EHS performance. Site Heads hold direct responsibility for implementing the policy. The policy content was reviewed in 2024 and the updated version was formally issued in early 2025 (page 96).

In response to its material climate IROs, the company "review[s] our greenhouse gas emissions (GHG) and decarbonization opportunities on a quarterly basis" (page 60).

Actions and resources in relation to climate change policies

Reference: pages 60-63.

"In 2025, we went deeper into Scope 1 and 2 reductions through equipment electrification, transitioning to biofuels and increasing our investments in renewable energy" (page 62).

Action 1 — Scope 1 in manufacturing: at the Swiss site, a multi-year phased conversion of heating and cooling to a modular electric heat pump system; "Once fully implemented, this change will eliminate thousands of tons of CO2." Phase one was approved in 2025 and starts in 2026; the last phase is expected by 2030 at latest. At the Danish site, transition from fossil diesel to hydro-treated vegetable oil for emergency generators.

Action 2 — Renewable energy sourcing: the first PPA for the Danish site took effect November 2024, yielding 750 tonnes CO2e savings over two months. In 2025 the company sourced "nearly 100% of the site's electricity from wind and solar assets through the PPA", raising annual Scope 2 market-based savings to ~3,600 tonnes, an improvement of 2,850 tonnes versus 2024. "From 2026 onward, we do not expect similarly large year-over-year improvements."

Action 3 — Supplier engagement: the company "matured our approach to Scope 3 emissions using a tool to evaluate and track the climate target maturity of our top suppliers".

Adaptation (pages 60-61): annual refrigeration inspection and leak testing; a project to increase the Danish site's surface-water capacity and prevent flooding; business continuity plans, minimum inventory levels and intended dual sourcing, with effectiveness tracked by "testing performance in scenario-based simulations".

Resources: no significant CapEx or OpEx was allocated to these actions in 2025 (page 60).

Targets related to climate change mitigation and adaptation

Reference: page 63.

"In 2024 we committed to a near-term science-based targets to reduce GHG emissions in line with a 1.5°C global warming pathway... We intend to pursue SBTi validation of our near-term targets in 2026."

Scope 1 and 2 targets (2023 baseline):

• Minimum 4.2% annually (until 2027)
• 42% reduction by 2030
• Net-zero by latest 2050

"These are gross targets, with no reliance on GHG removals, carbon credits, or avoided emissions."

Scope 3: no absolute target; instead a supplier engagement target — 70% of suppliers by spend for purchased goods and services and capital goods, and 90% by spend for upstream transportation and distribution, to establish science-based targets by 2029.

Progress: Scope 1 and 2 of 8,984 tCO2e (2023), 8,233 tCO2e (2024) and 3,571 tCO2e (2025), against a target projection of -16.8% by 2027 and -42.0% by 2030.

Targets "follow a sectoral decarbonization pathway using a climate scenario model aligned with the Paris Agreement". Target setting involved Global EHS, Corporate Sustainability, Global Engineering and Global Procurement.

Key decarbonization levers: renewable energy sourcing (Danish site PPA; Renewable Energy Credits for Martinsried); biogenic fuels ("approximately 2.5 kg CO2e per liter" less than conventional diesel); electrification of key systems ("would reduce Scope 1 CO2e emissions by 73% compared to the 2023 baseline"); and supplier engagement.

Energy consumption and mix

Reference: page 65 (E1 - table 3); accounting policies page 66.

Energy consumption in MWh:

Coal, other fossil sources, nuclear and self-generated non-fuel renewable energy are all reported as 0 in both years. Total consumption was broadly flat while the renewable share rose from 18% to 40%, driven by the full-year effect of the Danish site PPA.

Restatements: ¹ gas comes from a grid pipeline containing both fossil natural gas and biomethane; prior years were corrected using supplier data — 3,190 MWh reclassified to renewable. ² Martinsried landlord-supplied electricity in 2024 was confirmed as covered by renewable energy certificates — restated by 705 MWh.

Energy intensity is disclosed because the company "operate[s] in high climate impact sectors only... (biotechnology and pharmaceuticals – NACE code C21)" (page 66).

Gross Scopes 1, 2, 3 and Total GHG emissions

Reference: pages 64-65 (E1 - tables 1 and 2); accounting policies page 66.

Gross emissions, tonnes CO2e:

Scope 2 market-based fell 93%; total market-based emissions rose 9%. 2025 split: Scope 3 93.9%, Scope 1 5.5%, Scope 2 0.6% (page 61).

Drivers (page 64): Scope 1's decrease is "primarily associated with the closure of our natural-gas-dependent research site in San Diego". Scope 2 fell on the full-year PPA effect plus a 28% decrease in the market-based emission factor. Scope 3 rose in categories 1 (chikungunya launch spending), 2 (Swiss facility expansion) and 5 (wastewater, Danish site "96% of our emissions in this category").

Intensity (tCO2e/mDKK): location-based 9.4 (2024: 8.8); market-based 9.3 (9.3).

Method: bundled instruments were a PPA covering 58% of purchased energy and a green certificate covering 4%; "We did not use any unbundled instruments". Categories 8-15 are excluded with stated reasons. Primary data accounts for 17% of total Scope 3 (page 66). The 2023 column is footnoted "Not subject to assurance".

Policies related to pollution

Reference: page 68.

E2 materiality is scoped to substances: "While the general pollution topic is not material to our operations, we have deemed substances of concern (SoC) and substances of very high concern (SVHC) to be material, as the use of such chemicals is part of our research and vaccine manufacturing process" (page 67).

Policies disclosed (page 68):

• Site-level handling and storage policies — manufacturing sites "have policies on handling and storage of such substances to minimize the risk of negative impacts", covering responsibilities for hazardous substances, protective equipment, and chemicals storage and disposal, with Heads of the sites accountable.
• EHS Rules and Regulation — defines "the responsibilities for tracking changes in the legislation" and establishes a compliance evaluation procedure "which takes place every quarter"; the Head of Site at the Danish manufacturing site is accountable.
• EHS Assessment – Chemicals/Products policy — addresses risk from introducing new SoC and SVHC. It "requires us to continuously work on evaluating lower-risk alternatives and to prioritize, where possible, reducing the use of SVHC", to "ensure that we seek safer alternatives to reduce our dependency on high-risk substances and prepare us for potential future restrictions", with the Head of Site Kvistgaard accountable.

"All the policies are accessible to affected stakeholders through our Quality Management System, which is available to all employees."

The company has "appropriate authorizations in place for the use of regulated substances" and does "not engage in the production, distribution, commercialization, or import/export of these substances".

Actions and resources related to pollution

Reference: pages 68-69.

Substances of very high concern: "In 2025, we discontinued the use of the most significant SVHC by weight in use at Bavarian Nordic, replacing it with safer alternatives. This resulted in a decrease of 91% in the use of SVHC in the production from 2024 to 2025." The substance, "containing a reproductive risk, was being used in our utilities system at our Danish manufacturing site". The company "underwent an analysis of many different products to identify an alternative with no health or environmental hazards that also met our performance requirements".

It also evaluated all other products reported as SVHC in 2024: "These products had SVHC concentrations below thresholds for hazard labelling and we found legacy substances that would be phased out, and products with no alternatives."

Substances of concern: "In 2025, we also continued a complex multi-year project to better identify all the potential SoC used in our operations through the implementation of a global chemicals register covering all our locations. This solution is needed to streamline and unify our chemicals management and reporting processes linking operations, EHS risks and procurement." Progress "will be reported when relevant as part of the quarterly EHS update report".

Forward action: "In 2026 and going forward, we will continue to evaluate SVHC and some SoC to ensure safe handling procedures, minimize risk and identify alternatives... The scope of this action encompasses our own activities. This includes all geographical locations where we operate."

Risk is "evaluated as part of the daily operations and strategic decision-making performed by the Environmental, Health, and Safety (EHS) department" (page 68).

Targets related to pollution

Reference: page 69; page 46.

Bavarian Nordic does not disclose a quantified numerical reduction target for substances of concern or substances of very high concern. The objective is stated qualitatively: "The objective of this action is to minimize any risk of SoC and to reduce and eliminate the use of SVHC where possible", scoped to "our own activities... all geographical locations where we operate" (page 69).

The company notes generally that "Not all identified material IROs have associated targets in alignment with the Minimum Disclosure Requirements" (page 46).

Progress is nonetheless quantified against the prior year: a 91% reduction in SVHC used in production, from 13.9 kg in 2024 to 1.3 kg in 2025 (pages 68-69; E2 - table 2 shows 0.0013 tonnes in 2025 versus 0.0139 tonnes in 2024). Forward commitments are framed as continuing evaluation and phase-out (page 69), and progress on the global chemicals register "will be reported when relevant as part of the quarterly EHS update report".

Related 2025 sustainability targets in Executive Management incentives concerned health hazards in operating sites rather than substances specifically (page 47).

Substances of concern and substances of very high concern

Reference: page 69 (E2 - tables 1 and 2); accounting policies page 70.

Substances of concern (E2 - table 1), tonnes:

Substances of very high concern (E2 - table 2), tonnes: health hazard 0.0011 (2024: 0.0135¹); environmental hazard 0.0002 (0.0004); health & environmental 0.0000 (0.0000); total 0.0013 (0.0139).

¹ "Following an internal review conducted in 2025, we identified an error in chemicals classification in 2024 - some substances classified as SVHC should have been classified as substances of concern - correction of 1,613 kg."

"Compared to 2024, the use of SoC in our production processes remained largely unchanged. Diesel oil continues to account for approximately 99% of the total by weight. Its primary function is steam generation, which is critical to the manufacturing process as it enables disinfection and helps maintain optimal temperature and humidity levels" (page 69).

Scope and method (page 70): only substances consumed at manufacturing sites are included; "Substances used at the research and development facilities are assessed immaterial for sustainability reporting purposes." SVHCs are a sub-group defined per Article 57 of REACH and the Candidate List process under Article 59(1). Volumes come from local ERP systems on transfer to production; litres were converted to kilograms using substance-specific factors where possible, otherwise assuming one kilogram per litre.

Transition plan on biodiversity and ecosystems

Reference: page 72.

The single material E4 IRO is reliance on Limulus Amebocyte Lysate (LAL), derived from horseshoe crab blood, for bacterial endotoxin testing (page 71).

"Based on the assessment, we have initiated a transition plan in line with the time horizons applied in the double materiality assessment (DMA) process. To track progress of our transition plan, the EHS department monitors and reports on performance as part of the quarterly EHS update report."

Transition actions in 2025: "In 2025, we began a transition plan to explore how we can reduce our reliance on horseshoe crabs for the use of LAL endotoxin testing methods. We use LAL methods at our Danish manufacturing site. We have identified that no major capital expenses are required to transition methods, and we have ordered a new testing equipment and software as a step toward adopting synthetic Recombinant Cascade Reagent (rCR) methods. A synthetic method is currently in use at our Swiss manufacturing site... In 2026, we will identify the documentation and filing requirements from health authorities that would be required to switch testing methods."

Resilience: "We have not conducted a resilience analysis as defined under the European Sustainability Reporting Standards (ESRS)." The company nonetheless assesses that it is "resilient to any risk, in the short- and medium-term", citing continued LAL supply for legacy products and "the sustainable and regulated management of the horseshoe crab fishery".

The related 2024 risk "Continued regulation on horseshoe crab reliance" was reassessed as not material, partly because "regulatory requirements to maintain processes reliant on LAL for endotoxin testing are loosening" (page 57).

Policies related to biodiversity and ecosystems

Reference: page 72.

Bavarian Nordic discloses that it has no biodiversity-specific policy: "Our efforts to reduce our environmental impacts are anchored in our Global Environmental, Health and Safety Policy. We have not adopted biodiversity and ecosystem policies specifically related to horseshoe crabs. Our efforts are focused on understanding our material impact and planning an effective transition" (page 72).

The Global EHS Policy applies to all business areas and locations, commits the company to high standards of EHS performance and full legal compliance, with Site Heads holding direct responsibility for implementation. It was reviewed in 2024 and reissued in early 2025 (page 96).

On its horseshoe crab impact the company states: "No biodiversity offsets, mitigation measures, or incorporation of local knowledge and nature-based solutions have been undertaken at this time" (page 71).

Supplier-side expectations sit in the Standards for Responsible Business Conduct, which "outline our expectations to all external collaborations regarding human rights, labor rights, health and safety performance, environmental responsibility, animal welfare and business ethics", applying globally across the value chain (page 99).

Appendix 3 marks the E4-2 datapoints on sustainable land/agriculture practices, sustainable oceans/seas practices and policies to address deforestation as "Not material" (page 117).

Actions and resources related to biodiversity and ecosystems

Reference: page 72; page 55.

Transition away from LAL (page 72): in 2025 the company began a transition plan to reduce reliance on horseshoe crabs for LAL endotoxin testing at its Danish site. It "identified that no major capital expenses are required to transition methods", ordered new testing equipment and software toward adopting synthetic Recombinant Cascade Reagent (rCR) methods, and is assessing knowledge-sharing with the Swiss site. It "engaged in a dialogue with our supplier of LAL testing supplies about transition and mitigation for horseshoe crab populations".

Supplier practice: the LAL "is sourced from an external supplier who is committed to the high standards for licensed and regulated collection of horseshoe crabs which include handling practices and limits for duration of time out of water. Our supplier also participates in a multi-stakeholder process guided by state authorities." Crabs are "released back to the wild" after harvesting, which "results in some mortality and impacts reproduction and marine ecosystems".

Site-level work (page 55): 2025 assessments using the WWF Biodiversity Risk Filter gave physical risk scores of 3.32 (Medium) for Denmark and 2.95 (Medium) for Switzerland. "In 2025 we concluded our biodiversity monitoring project, which involved continuous data collection on flying insect species at our Danish and Swiss manufacturing sites." A lake protected under the Danish Protection of Nature Act §3 was identified at the Danish site, highlighting "a dependency on ecosystem services, which we are investigating and investing in". The company has "begun to engage with communities regarding shared biological resources and ecosystems" there.

Targets related to biodiversity and ecosystems

Reference: page 72; page 46.

Bavarian Nordic does not disclose a quantified biodiversity target. Its E4 objective is framed as the transition away from LAL dependency: "Based on the assessment, we have initiated a transition plan in line with the time horizons applied in the double materiality assessment (DMA) process. To track progress of our transition plan, the EHS department monitors and reports on performance as part of the quarterly EHS update report" (page 72).

Milestones rather than numerical targets are disclosed: new testing equipment and software have been ordered toward adopting synthetic Recombinant Cascade Reagent (rCR) methods, and "In 2026, we will identify the documentation and filing requirements from health authorities that would be required to switch testing methods" (page 72).

The company states generally that "Not all identified material IROs have associated targets in alignment with the Minimum Disclosure Requirements" (page 46). It also confirms that "No biodiversity offsets, mitigation measures, or incorporation of local knowledge and nature-based solutions have been undertaken at this time" (page 71).

A related target sits in Executive Management's 2025 incentive scheme under animal welfare — to "submit a regulatory file to support in-vitro potency testing with the purpose of reducing animal testing of produced batches" (page 47) — though animal welfare is presented under G1 rather than E4.

Policies related to resource use and circular economy

Reference: pages 74-75.

Bavarian Nordic discloses two distinct policy positions for its two material E5 IROs.

Waste from operations (page 75): "Our commitment to the environment is reflected in our policies designed to manage and mitigate the negative impact associated with waste generated. Each of our production and research facilities has a local policy on the handling of residual waste. These policies are implemented to ensure that the waste is properly classified, segregated, transported, recycled and destroyed by proper disposal methods in order to comply with local regulations and protect the environment and human health. The scope of the policies includes all employees involved in the management of production and laboratory waste within our own operations. Heads of sites are accountable for implementation of these policies."

Change of certain manufacturing methods (page 74): "With regards to the change of certain manufacturing practices, we do not have a corporate policy, as implementation and governance are captured in several other areas and processes. These relate to several quality and clinical requirements (GxP), all of which are governed by our Quality Department, and Research and Development Department."

Management of the waste impact "is part of our daily operations, conducted by the Environmental, Health and Safety (EHS) functions globally and locally" (page 73).

Actions and resources related to resource use and circular economy

Reference: pages 74-75.

Waste (page 75): "In 2025, we expanded our Global EHS department. This has enabled us to allocate more resources to further our understanding and management of our waste streams and the development of initiatives aimed at increasing the rate of recycled waste from our manufacturing and research facilities. In 2026, we will begin piloting waste tracing studies to develop further insights into the flow of waste materials, processes, and treatment. The analysis will include information about companies that receive our waste and their respective treatment processes." Progress "will be monitored and reported as part of the quarterly EHS update report".

Change of certain manufacturing methods (page 74): the opportunity "relates to a change of cell substrate, where the updated method is based on a continuous cell line compared to primary cells being used today", and "would result in significantly less dependence on certain raw materials and agents required today, significant increase in doses per batch, and less potential for contamination in each batch."

Actions: "Throughout 2024 and 2025 we have interacted with the health authorities, FDA and EMA, and shared information to seek their advice. Additionally, we have initiated a phase-2 clinical trial bridging study in adults, as it is required to 'prove' comparability of the new versus the old production method."

Governance: "The overall program is anchored with our Strategy Execution Office and is overseen by our Executive Management", with Swiss capacity work overseen by the Chief Operating Officer, and weekly reporting to Executive Management.

Targets related to resource use and circular economy

Reference: pages 74-76; page 46.

Bavarian Nordic does not disclose a quantified waste reduction or recycling target for 2025. Its stated ambitions are directional and process-based:

• Waste (page 75): the expanded Global EHS department has enabled more resources for "the development of initiatives aimed at increasing the rate of recycled waste from our manufacturing and research facilities", and "In 2026, we will begin piloting waste tracing studies to develop further insights into the flow of waste materials, processes, and treatment."
• Change of certain manufacturing methods (page 74): pursued "as part of our strategic roadmap to secure preparedness to meet global demands in case of future outbreaks", with 2025 actions described as "important steps in our ability to realize the opportunity in the medium-term".

The company states generally that "Not all identified material IROs have associated targets in alignment with the Minimum Disclosure Requirements" (page 46).

Performance is nonetheless quantified year on year (pages 75-76): total waste rose to 2,964 tonnes (2024: 2,429) and non-recycled waste to 2,680 tonnes or 90% (2024: 2,166 tonnes or 89%), with captured wastewater up 19% — attributed to "both higher production volumes and a more precautionary approach to capturing liquid waste".

Resource outflows

Reference: pages 74-76.

Waste streams (pages 74-75): total waste distribution in 2025 was 71% captured wastewater and 29% other waste. "Captured wastewater is our primary waste stream, accounting for over 70% of our overall waste by weight. While the majority of our wastewater is composed of water, it also includes organic matter, inactivated virus, media solutions and antibiotics. It is discarded and captured in a holding tank as hazardous waste which is collected by a specialized waste management service provider."

"In 2025, the volume of captured wastewater increased by 19% compared with 2024 (1,756 tonnes in 2024 vs. 2,093 tonnes in 2025). This increase reflects both higher production volumes and a more precautionary approach to capturing liquid waste."

Other waste includes single-use plastics from "equipment, connections, hoses, and bags for media or buffer solutions"; plastic items and vials which "may contain product residues, including viruses, which must be incinerated as biosafety waste"; empty raw material packaging in plastic, glass and cardboard; and chemical waste including ethanol (page 74).

Non-recycled waste: 2,680 tonnes / 90% in 2025 (2024: 2,166 tonnes / 89%). It "is calculated by summing the waste sent for disposal (incineration, landfill, and other disposal operations) and the waste directed to other recovery operations, primarily incineration with energy recovery" (page 76).

Products and materials are not reported as durable outflows, and no recyclable or recycled content rates for products and packaging are disclosed.

Waste

Reference: pages 75-76 (E5 - tables 1-4); accounting policies page 76.

Total waste generated (E5 - table 1), tonnes:

Diverted from disposal (E5 - table 2), tonnes: preparation for reuse — hazardous 0 (2024: 0), non-hazardous 7 (5); recycling — hazardous 2 (3), non-hazardous 276 (146); other recovery — hazardous 113 (1), non-hazardous 381 (108).

Directed to disposal (E5 - table 3), tonnes: incineration without energy recovery — hazardous 2,096 (1,808), non-hazardous 25 (281); landfill — hazardous 0 (0), non-hazardous 64 (72); other disposal — hazardous 1 (5), non-hazardous 0 (0).

Non-recycled waste (E5 - table 4): 2,680 tonnes / 90% (2024: 2,166 tonnes / 89%).

"Year-on-year developments in our waste metrics continue to be primarily influenced by our largest waste stream: captured wastewater at the Danish production site. Our non-hazardous waste also increased notably in 2025... driven mainly by increased production volumes and by expansion of the Bern facility, which generated more than 110 tonnes of construction-related waste" (page 75).

Scope (page 76): direct contracts at the manufacturing sites and the Hørsholm R&D facility allow precise data. For Martinsried, Germany, in a shared building, "we have applied estimates based on interviews with the landlord". Office facilities are excluded as not material, and "We have not identified any radioactive waste in our operations."

Waste is also a Scope 3 driver: category 5 emissions were 5,230 tCO2e, up 18%, with Danish site wastewater 96% of that category (page 64).

Policies related to own workforce

Reference: pages 84, 88, 93-94, 96.

Diversity and Inclusion Policy (page 84): "promotes a zero-tolerance approach to discrimination, covering, but not limited to, gender, age, ethnicity, educational background, physical ability, religion, and sexual orientation", and addresses material risks "by promoting bias-free recruitment, selection, and promotion processes". Accountability "lies with Executive Management, supported by our VP of People & Organization".

Human Rights Policy (page 84): "adopted by the Board in December 2023". The company follows the Universal Declaration of Human Rights, the ICCPR, the ICESCR and the ILO Core Labor Standards, guided by the UNGPs and OECD Guidelines, and adheres to "freedom of association, the right to collective bargaining, and the elimination of discrimination, forced labor, and child labor". "We have not identified any risks of child labor or forced labor in our operations." A gap is acknowledged: "Our policy does not explicitly address trafficking in human beings."

Code of Conduct and staff handbooks (page 84): the Code includes the commitment "to provide equal opportunities where possible and to maintain a healthy and safe working environment".

Harassment (page 93): a Global Policy on Sexual Harassment and a Policy on Bullying and Harassment at Work, which "makes it clear that any form of bullying, harassment, or victimization is unacceptable and subject to disciplinary action".

Work-life balance (pages 93-94): a Remote Working Policy, leave arrangements, and a Policy for Production Supporters for non-standard shifts.

Data privacy (pages 94-95): a Global Compliance Program and Privacy Policy designed for GDPR and Danish Data Protection Act compliance.

Health & safety (page 96): the Global EHS Policy, with Site Heads directly responsible, reviewed in 2024 and reissued in early 2025; and an Employee Vaccination Program for personnel "operating in high-risk environments involving live viruses".

Processes for engaging with own workforce and workers' representatives about impacts

Reference: pages 84-85, 88, 93-96.

"We are committed to maintaining an open and transparent relationship with our workforce. This includes actively engaging employees in matters that affect them and providing clear, accessible channels for raising concerns" (page 84).

Employee engagement survey (page 85): the main initiative, covering "workplace culture, work-life balance, job satisfaction, strategic priorities, overall employee well-being, and transformation & change". "Feedback is collected anonymously, where aggregated results are shared in each team, and presented into actionable insights for managers and leaders." "In 2025, two surveys were conducted, which we aim to implement as the standard process." The VP of People & Organization holds operational responsibility.

Workers councils (page 85): "Betriebsrat" in Germany and "Samarbejdsudvalg" in Denmark "function as formal channels to incorporate employee perspectives into organizational decision-making", bringing together "company-appointed representatives and employee-elected representatives".

BN Asks (page 85): an internal employee inbox on the intranet, "managed by our Corporate Communications and Executive Office department".

Health & safety (page 96): the EHS Committee "operates at a strategic level, partnering with Site Heads and EHS representatives". Engagement occurs "both directly and through employee representatives, integrating workforce perspectives into the planning, implementation, and review phases". The Global EHS Director holds overall accountability.

Topic-specific: annual Organizational Review and People Review processes, where "input from employee representatives is considered" (page 88); and for data privacy, "We actively involve employee groups in identifying training needs" (page 95).

Processes to remediate negative impacts and channels for own workforce to raise concerns

Reference: pages 84-85, 93, 95, 96.

"We recognize the importance of ensuring that all employees can speak up safely and without retaliation. We therefore maintain formal processes and grievance mechanisms that allow concerns to be raised, investigated, and addressed in a fair and confidential manner" (pages 84-85).

Escalation (page 85): "As a first step, employees are encouraged to raise any issues including concerns, inappropriate behavior, or potential misconduct with their immediate manager and/or the relevant HR Business Partner... Additionally, employees have access to formal grievance mechanisms and escalation channels, such as our Ethics Hotline to Legal & Compliance." "We uphold a strict non-retaliation policy to protect employees who report concerns in good faith."

Ethics Hotline mechanics (page 111): it "enables confidential and anonymous reporting". Claims "are subject to an initial assurance review by outside counsel and Legal & Compliance which has an independent reporting line to the Board through FRAC", and "quarterly reporting is anonymized".

Harassment channels (page 93): employees may use "direct conversations with the immediate manager, HR Business Partners, union or Betriebsrat representatives, Health & Safety representatives, or through anonymous reporting using our Ethics Hotline". Feedback "is reviewed and monitored by our Global EHS department, our People & Organization department, our Legal & Compliance department, and management teams to identify trends and strengthen prevention".

Health & safety (page 96): employees "can report issues through several routes, including our health and safety management system, designated representatives, or their line managers", and are encouraged to report "incidents, near misses, and unsafe conditions".

Data breaches (page 95): employees must report immediately "via the dedicated data breach reporting form on our intranet or directly to our Legal & Compliance department".

Taking action on material impacts on own workforce

Reference: pages 89-95, 97.

Enabling a resilient and capable workforce — four 2025 actions (page 89):

• Recruitment — a global recruitment process standardises requisition approval, advertising, screening, interviewing and offer management, with a new Talent Acquisition Operating Model; a new Applicant Tracking System was deployed in Q4 2024. Effectiveness is monitored via "monthly KPI reviews, such as time-to-hire and quality-of-hire" (page 90).
• Skills & knowledge — "Training in handling fundamental GxP and non-GxP documents, as well as Global Pharmacovigilance training is mandatory for all employees, including temporary staff, contractors, and consultants." Local Bootcamp and FastTrack programs target production operators; in 2025 the company hosted "two foundational project management courses and one advanced project management course" (page 90).
• Career paths — a Career Accelerator Pilot launched in Global Operations and Quality Assurance, "currently engaging five participants"; a November mid-term evaluation led to approval "through Q2 2027" (page 91).
• Developing our people — Performance Dialogues held "at least twice a year", and roll-out of the LeadPioneers leadership program (page 91).

Well-being (page 92): a Global Mental Health Week hosted by EHS was "a significant milestone in 2025". "Through our insurance schemes, employees in Denmark, Germany, Switzerland, and the US are covered by healthcare and pre-healthcare programs."

Harassment (page 93): "All employees complete mandatory Code of Conduct training, which includes modules on harassment prevention."

Data privacy (page 95): monthly IT security training with phishing modules; mandatory data privacy training within the first three months; and a centralized HR system with "role-based access controls... and audit trails".

Health & safety (page 97): "we have expanded our EHS department by recruiting several dedicated full-time specialists". Each pregnant employee "must undergo an individual risk assessment" (page 96).

Targets related to own workforce

Reference: page 97; page 46.

Health and safety target (page 97): "In 2025, we set a health and safety target applicable to all workers at our operational sites, regardless of employment type, in support of our Global EHS Policy and Global EHS Strategy. Developed with input from the EHS department and Executive Management, the target focused on reducing occupational health hazards by expanding site-level risk assessments and closing 90% of identified mitigation actions. We are pleased to confirm that this target was achieved."

"For 2026, our health and safety target focuses on maintaining a safe and healthy work environment through the implementation of Site and Functional EHS Improvement Plans. The target requires that 100% of identified improvement opportunities are assessed for potential execution, with 90% of associated actions completed by year-end."

The target also "applies to on-premise value chain workers" (page 100), and is reflected in Executive Management's 2025 incentives (page 47).

Other workforce themes are monitored rather than governed by quantified targets. The company states that "Not all identified material IROs have associated targets in alignment with the Minimum Disclosure Requirements" (page 46). Monitoring includes turnover tracking, engagement surveys, performance and development talks and exit interviews (page 90); monthly recruitment KPI reviews; manager monitoring of registered working hours (page 94); and systematic review of data breaches for trends and root causes (page 95).

Characteristics of the undertaking's employees

Reference: page 86 (S1 - tables 1, 2, 3, 5); page 83; accounting policies page 87.

By gender (S1 - table 1): male 857 (2024: 766); female 979 (887); total 1,836 (1,653). 2025 split: female 53%, male 47%.

By country (S1 - table 2), headcounts:

*Countries with fewer than 50 employees are aggregated as other.

By employment characteristics (S1 - table 3): permanent — female 893, male 799 (2024: 856 / 749); temporary — female 86, male 58 (31 / 17).

By age (S1 - table 5): under 30 254 (228); 30-50 1,074 (963); over 50 508 (462).

Turnover (page 87): rate 13.5% (2024: 17.4%); employees who left 221 (255).

Drivers (page 83): the increase was "primarily driven by growth in Global Operations and the Commercial department", reflecting "a ramp-up of production in Denmark and the establishment of additional global roles, as well as expanded activities in Germany"; "the approval of our chikungunya vaccine has led to increased production activities in Switzerland".

Employees are "individuals working part-time or full-time under a contractual agreement with Bavarian Nordic", from HR records at period end (page 87).

Diversity metrics

Reference: page 86 (S1 - tables 4 and 5); accounting policies page 87.

Gender distribution in Top Management (S1 - table 4), headcounts:

Top Management "is defined as positions at the Vice President level and above", based on HR records at period end (page 87). Top Management grew from 20 to 24 positions in 2025, with the female share moving from 50% to 46%.

Age distribution (S1 - table 5), headcounts: under 30 years old 254 (2024: 228); 30-50 years old 1,074 (963); over 50 years old 508 (462).

Bavarian Nordic treats diversity and inclusion as cross-cutting rather than standalone: "diversity and inclusion therefore cut across all our workforce impacts and risks... the management of the related impact is not presented as a standalone disclosure" (page 83).

Board-level gender diversity and independence datapoints under GOV-1 are incorporated by reference to the Management review, Corporate Governance, at pages 36 and 34 respectively (pages 44, 116).

Health and safety metrics

Reference: page 97 (S1 - table 10); accounting policies page 97.

Recordable accidents rose from 6 to 17 and the rate from 2.3 to 5.8 per million hours worked — an increase of more than 150% year on year. There were no fatalities in either year. The company does not comment on the increase.

Definitions (page 97): "A recordable work-related accident is registered if the accident results in the employee being unable to perform their usual work for one day or more, excluding the day of the injury." The rate "represents the number of cases per one million hours worked", with hours "estimated based on standard full-time equivalent (FTE) hours, taking into account entitlements to leave periods". Fatalities are determined from HR records, and "All types of employees are considered for the metric."

On the management system: "Our goal is to implement a harmonized global health and safety management system to standardize processes and performance across all sites... While each site currently operates its own system, sites without a formal management system follow local manuals, procedures, and documented processes that meet national legal requirements" (pages 96-97).

Compensation metrics (pay gap and total compensation)

Reference: page 86 (S1 - table 6); accounting policies page 87.

*"The gender pay gap reflects a pay gap in favor of males."

The unadjusted gender pay gap narrowed from 1.6% to 1.3%, and the CEO remuneration ratio fell from 29 to 28.

Definitions (page 87): "Gender pay gap is defined as the difference of average pay levels between female and male employees, expressed as percentage of the average pay level of male employees. The metric is calculated based on total annual remuneration which includes both fixed and variable components." "The CEO remuneration ratio reflects the annual ratio between the total remuneration of the CEO (the highest paid individual) and the average remuneration of all employees (measured in FTEs) within the company, excluding executive management."

Appendix 3 references the unadjusted gender pay gap datapoint (97(a)) to page 86 and marks the "Excessive CEO pay ratio" datapoint (97(b)) as "Phase-in" (page 117).

Related context: 10% of Executive Management's total incentive remuneration in 2025 depended on sustainability-related targets, of which 2.5% of total remuneration derived from climate-related considerations (page 47).

Incidents, complaints and severe human rights impacts

Reference: page 87 (S1 - tables 7 and 9).

Incidents and complaints (S1 - table 9):

Severe human rights impacts (S1 - table 7): severe human rights incidents 0 (2024: 0); related fines, penalties and compensation DKK 0 (0).

Incidents of discrimination including harassment rose from 0 in 2024 to 6 in 2025, with no associated fines, penalties or compensation. No severe human rights incidents were recorded in either year. The company does not provide commentary on the increase, nor a breakdown by type or location.

Definitions (page 87): the metrics "represent the number of discrimination incidents and complaints cases reported to the Ethics Hotline or to our Legal & Compliance team in the reporting period", with severe human rights metrics defined on the same basis.

Related management context appears under the harassment theme: mandatory Code of Conduct training including harassment prevention modules, targeted workshops where team challenges are identified, and review of reporting mechanism feedback by the Global EHS, People & Organization and Legal & Compliance departments "to identify trends and strengthen prevention" (page 93).

Policies related to value chain workers

Reference: page 99.

"Workers in our value chain are covered under several company-wide policies that define expectations for health, safety, labor rights, and ethical conduct."

• Global Environmental, Health & Safety (EHS) Policy — "applies to all operations, including work carried out by both on-premise and off-premise workers. It sets requirements for risk assessment, hazard control, compliance with legislation, and continuous improvement. The policy also establishes expectations for reporting, training, and incident learning applicable to all individuals working within our operational footprint."
• Standards for Responsible Business Conduct (SRBC) — "outline our expectations to all external collaborations regarding human rights, labor rights, health and safety performance, environmental responsibility, animal welfare and business ethics. The policy applies globally across the upstream and downstream value chain... Executive Management is accountable for the implementation of the policy, which is available on our website." Introduced in 2025 on supplier due diligence "in line with the UN Guiding Principles and OECD Guidelines" (page 46).
• Code of Conduct — "applies to employees, contractors, suppliers, and their workers", mandating "ethical conduct, adherence to the law, transparent communication, and responsible behavior".
• Human Rights Policy — "explicitly prohibits forced labor, child labor, discrimination, and unsafe working conditions, and requires suppliers to uphold freedom of association, fair treatment, and decent working conditions."

Findings: "We have not identified any significant risks of child labor or forced labor among the stakeholders in our value chain", and "To date, no reported cases of adverse human rights impacts involving value-chain workers have been received".

Processes for engaging with value chain workers about impacts

Reference: pages 98-100.

Bavarian Nordic distinguishes on-premise workers (contracted services at its own sites — "repairs, maintenance, construction work, and other similar work performed by people who are not classified as employees or non-employees") from off-premise workers (upstream raw material sourcing, and contract research and manufacturing at CRO and CMO premises) (page 98).

On-premise engagement (page 99): "On-premise value chain workers are primarily engaged through mandatory induction programs. Induction covers hazard awareness, site rules, required behaviors, Personal Protective Equipment expectations, emergency procedures, and access restrictions. All visitors and external workers must sign documentation confirming their understanding. Depending on access level, some external workers must be escorted or supervised by Bavarian Nordic employees. Site Heads ensure engagement, supported by monthly EHS coordination meetings... Workers with particular vulnerabilities are assessed on an individual basis and provided with tailored protective measures where necessary."

Off-premise engagement (page 100): "Engagement with off-premise workers occurs primarily through our involvement in the Pharmaceutical Supply Chain Initiative (PSCI). Through monthly and ad hoc meetings, we receive insights into working conditions, health and safety risks, labor practices, and industry benchmarks across pharmaceutical supply chains. The Director, Corporate Sustainability, holds responsibility for PSCI engagement." The Global EHS Director "leads operational engagement with suppliers and CMOs".

On vulnerable workers: "As the PSCI is an organization solely focusing on pharmaceutical supply chains, the insights provided by them are deemed to take into consideration the perspectives of workers that may be particularly vulnerable to impacts."

Processes to remediate negative impacts and channels for value chain workers to raise concerns

Reference: pages 99-100.

On-premise workers (page 99): "We have established processes to address and remediate negative impacts affecting on-premise value-chain workers. These processes align with those for employees, including incident reporting, root cause analysis, implementation of corrective actions, and tracking through site-level and global systems. Monthly EHS meetings ensure continued oversight."

Off-premise workers (page 100): "We are advancing our Responsible Value Chain Program to better capture, track, and mitigate health and safety impacts across the supply chain. This includes risk-based supplier screenings, targeted engagements, and structured monitoring of supplier performance."

Channels: both sections cross-refer to the Ethics Hotline, which "enables confidential and anonymous reporting of suspected violations of the Code of Conduct and applicable laws and regulations. Claims reported to the Ethics Hotline are subject to an initial assurance review by outside counsel and Legal & Compliance which has an independent reporting line to the Board through FRAC" (page 111).

The Code of Conduct "applies to employees, contractors, suppliers, and their workers" and "encourages reporting of concerns, unsafe practices, or violations through formal grievance mechanisms" (page 99).

Outcome: "To date, no reported cases of adverse human rights impacts involving value-chain workers have been received" (page 99). The company does not disclose whether value chain workers are aware of or trust these channels, nor a count of grievances received from them.

Taking action on material impacts on value chain workers

Reference: page 100.

On-premise workers: "Actions taken and planned to minimize the likelihood of negative impacts include implementation of the Global EHS Strategy, expansion of the EHS department, and updating the EHS Policy to cover on-premise workers. Furthermore, we have strengthened contractor and visitor induction processes at our Danish manufacturing site by revising our visitor induction presentation and making it available in a video format, enabling visitors to view it before arrival at our site. Progress is monitored jointly by Site Heads and the EHS department." The own-workforce health and safety target "also applies to on-premise value chain workers".

Off-premise workers — Responsible Value Chain Program: "Further developing our supplier management program continues to be a strategic priority... The purpose of the program is to further develop our supplier management and engagement processes to enable an understanding of our adverse impacts and how to address these in collaboration with suppliers."

Key 2025 progress: "Building on the introductory steps made in 2024, we initiated the roll-out in 2025 with the implementation of our global Standards for Responsible Business Conduct (SRBC). Following this milestone, we launched a pilot program with a selection of suppliers. The aim is to engage with key suppliers on their management of the areas covered in the SRBC, as well as to embed the SRBC contractually within existing agreements."

"As a part of our commitment to the PSCI and its Principles for Responsible Supply Chain Management, we have initiated work to increase the coverage of supplier audits."

"Our actions are tracked and assessed monthly by the key stakeholders involved in driving forward the strategic initiative."

Targets related to managing material negative impacts, advancing positive impacts, and managing material risks and opportunities

Reference: pages 100-101 (S2 - table 1).

Vendor audit rate target: "we have set a target to increase the share of scoped suppliers that have undergone an audit in accordance with the PSCI audit standards or similar. Our long-term target is for 70% of all in-scope suppliers and business partners to have undergone an audit in accordance with PSCI audit principles. The long-term target is due in 2027 with annual milestone targets" (page 101).

The 2025 target was missed. "In 2025, we did not meet our target of 25%, but we still recognize the effort and achievement of 24.2% which serves as an important milestone in expanding our scope of in-scope suppliers and business partners." The company presents this as "97% Achieved" of the 2025 target.

Governance: "The target setting process involved internal subject matter experts and the target was approved by Executive Management. The monitoring of progress is performed by the Corporate Sustainability and ESG Finance departments."

Definitions (page 101): in-scope suppliers "refer to Contract Manufacturing Organizations (CMOs) or other manufacturing organizations or suppliers providing critical production raw materials for commercial products". The metric "reflects the ratio of our total expenditures on audited vendors to all scoped vendor-related expenditures". "No individual vendor exceeded 10 percentage points of the metric."

Policies related to consumers and end-users

Reference: pages 103-104, 107-108.

Bavarian Nordic identifies three groups of consumers and end-users — vaccine recipients, clinical trial participants, and healthcare professionals (HCPs) (pages 103-104).

Access to vaccines (page 104): the company states it has no formal access policy: "We do not have a formal policy related to access to vaccines, because we have assessed that the governance in this area is sufficiently supported by our strategy and actions in which we manage the associated impacts, risks and opportunities." The Vice President, Commercial, Rest of World has operational responsibility for related engagement.

Safety (page 107): the Quality Management System (QMS) "is designed to ensure compliance with applicable legislation, safety requirements, and all Good Practice (GxP) standards across our trials, manufacturing. and testing", with mandatory training required. The Senior Vice President of Global Quality oversees implementation. The GxP framework comprises GCLP, GMP, GDP and GVP, following "the regulatory guidelines from the International Council for Harmonization (ICH)... the Declaration of Helsinki, Good Clinical Practice (GCP)".

Responsible marketing (pages 107-108): the approach "is anchored in our Code of Conduct", with review involving "Medical Affairs, Commercial, Regulatory Affairs, Legal & Compliance and Clinical Safety & Pharmacovigilance". Information shared with HCPs and patients must be "scientifically sound, accurate, balanced, fair, objective and substantiated". The Code applies to all employees, Executive Management, the Board and third parties, and "was most recently approved by the Board in December 2024".

Human rights (page 103): policies reflect commitment to the UNGPs, the ILO Declaration, the UN Global Compact and the UDHR. In 2025 there are "no cases of non-respect of human rights in our downstream value chain".

Processes for engaging with consumers and end-users about impacts

Reference: pages 49, 104, 107-108.

Access to vaccines (page 104): "We have ongoing engagement with supranational organizations, NGOs, governments and other partners... We consider these business partners as credible proxies for the people potentially in need of one of our vaccines."

General engagement (page 49): "we actively engage with stakeholders directly or through credible proxies in various initiatives, including advisory boards, Medical Science Liaison (MSL) visits to healthcare professionals (HCPs), participation in congresses, and medical events." Outcomes include "Research developed in function of needs of the public health community and HCPs" (page 50).

Safety engagement (page 107): "Our pharmacovigilance system supports the ongoing collection, assessment, and notification of relevant safety data. Procedures are in place for reporting adverse events, reactions, and/or product quality complaints." The Chief Medical Officer position, held on an interim basis by the CEO, "represents the most senior role within Bavarian Nordic with operational responsibility".

Clinical trial safeguards: "all clinical trials are reviewed and approved by independent review boards (IRB), independent bioethics committee (IBC), or an independent ethics committee (IEC)", and "we require that all clinical trial participants be provided an opportunity for informed consent, including risks associated with participation".

Feedback into products (page 107): "relevant safety information from clinical trials and post-marketing adverse events reports are included in our product labels to inform HCPs and the general public about both the risks and the benefits of our products."

Marketing (page 108): HCPs and the public can engage via the Ethics Hotline, regulatory authorities including the FDA, Health Canada and the EMA, and national advertising oversight bodies.

Processes to remediate negative impacts and channels for consumers and end-users to raise concerns

Reference: pages 107-108.

Safety remediation (page 107): "Efforts to remediate negative impacts for participants in clinical trials are handled internally or through the Contract Research Organization (CRO), to whom we transfer obligations but maintain oversight and assessment through the standard operating procedure for selection and management of vendors... In case of an adverse event happening in connection with a clinical trial, the clinical trial participant is advised by the responsible HCP."

"Our processes require that both adverse safety events and deviations from the approved protocol be documented, investigated, assessed, and reported to the IRB and regulatory authorities, as appropriate." A Corrective and Preventive Action (CAPA) system resolves corrective actions "and to help prevent future similar problems".

Channels (page 107): "Participants in clinical trials can contact the respective investigators or the CRO... Vaccine recipients of marketed products experiencing adverse effects can report concerns via a public email channel established by Bavarian Nordic." "Both affected stakeholders can report incidents without the risk of retaliation as per Bavarian Nordic's Code of Conduct. The effectiveness and perceived trustworthiness of both channels are evaluated through mandated regulatory quality and compliance processes."

Marketing concerns (page 108): HCPs and members of the public may use the Ethics Hotline; regulatory authorities "such as the US Food and Drug Administration (FDA) and Health Canada, the European Medicines Agency and the national competent authorities in each member state"; and "National advertising oversight bodies, where applicable".

No count of consumer or end-user complaints is disclosed.

Taking action on material impacts on consumers and end-users, and approaches to managing material risks and pursuing material opportunities

Reference: pages 104-108.

Action 1 — Mpox partnerships for LICs and LMICs (page 105): collaboration with the WHO, HERA, UNICEF, Gavi, Africa CDC and the US Government. "As of 2025, mpox vaccination activities have started in 14 African countries with our vaccine... in total more than 1.2 million vaccine doses have been administered in these 14 countries in 2025, out of which 687,016 doses of our vaccine have been administered in the Democratic Republic of the Congo." "12 African countries have received up to 700,000 doses" through the Gavi Advanced Procurement Agreement and a UNICEF agreement, ensuring "the lowest price for the 77 low- and lower-middle-income countries". With HERA, EU member states, the US and Canada, "over 900,000 doses" were delivered. In September 2024 the vaccine "became the first mpox vaccine to receive prequalification from WHO". Donations totalled 130,000 doses — 110,000 to Uganda via Africa CDC and 20,000 to UNICEF for Liberia.

Action 2 — Access strategy (page 105): in 2025 the company progressed with "settling specific KPIs for our access to vaccines strategy", anchored with Executive Management and running to 2028.

Action 4 — Chikungunya (page 106): the vaccine "was approved in February 2025 by the U.S. Food and Drug Administration (FDA) and received a marketing authorization in Europe in February 2025".

Action 5 — Serum Institute of India (page 106): under the 2024 mpox licence, "SII has the license to sell and distribute the vaccine in India, enabling supply to a market not previously served." "In March 2026, we expanded our strategic partnership with SII by signing a contract manufacturing agreement... for the chikungunya vaccine... and replaces the agreement previously entered with Biological E. Limited."

Action 6 — Clinical initiatives (page 106): CEPI-co-funded study topline results were positive for the mpox vaccine in children aged 2-11 years.

Also disclosed: life cycle management via the LCM Steering Committee (page 105); and safety/marketing actions including GxP refresher training "every 2 years", pharmacovigilance training for all employees, a Safety Committee, and a system of record for all promotional materials (pages 107-108).

Targets related to managing material negative impacts, advancing positive impacts, and managing material risks and opportunities

Reference: page 106; pages 107-108.

Access to vaccines — Sustainability Linked Loan KPIs (page 106): "As one of the three KPIs included in our Sustainability Linked Loan (SLL) credit facility, our target for 2025 was to meet the following KPIs:

• To finalize the technology transfer plan between Bavarian Nordic and a designated partner.
• To complete the technical runs of the mpox vaccine drug substance at Serum Institute of India."

Both were achieved: "The first KPI was met with a gap analysis and an agreed plan completed in July 2025. The second KPI was also achieved with successful small-scale technical runs of the mpox vaccine drug substance at Serum Institute of India. In 2026, we aim to continue with the next steps as defined in our SLL agreement."

"The KPI was set in collaboration with key internal functions, including the Corporate Sustainability department, the Strategy Execution Office, Business Development, Finance, and Commercial, as well as the respective banks involved in providing the revolving credit facility."

Safety (pages 107-108): no quantified target. Management is expressed through process commitments — internal and external audits, GxP refresher training "every 2 years", and mandatory pharmacovigilance training.

Responsible marketing (page 108): the company explicitly states it has no target: "We have not developed any formalized targets due to the differences in local promotional regulations and the evolving regulatory landscape." Materials review committees instead "ad hoc re-review previously approved marketing materials to ensure that they remain truthful and non-misleading".

Business conduct policies and corporate culture

Reference: pages 111-113.

Anti-corruption policies (page 112): "The Code of Conduct, Anti-Corruption Policy, and Speak-Up Policy prohibit corruption and bribery and establish an obligation to report suspected violations, and apply to all employees, our Executive Management, the Board, and third parties acting on our behalf. The Global Business Ethics Compliance Program includes annual monitoring activities including third parties and HCPs."

Corporate culture (page 112): "To promote and evaluate our corporate culture and risk mitigation efforts relating to corruption and bribery, we regularly review and update our policies and training programs, and conduct annual assessments to measure compliance and identify areas for improvement."

Whistleblower protection (page 111): violations "are handled according to the Speak-Up Policy". The Ethics Hotline enables confidential and anonymous reporting, with Legal & Compliance holding "an independent reporting line to the Board through FRAC". Appendix 3 marks the "United Nations Convention against Corruption" datapoint as "Not material" (page 118).

Animal welfare policies (pages 112-113):

• Animal Facility Policy — "specifies the operational framework for animal care, including facility access, hygiene standards, personnel responsibilities, and procedural guidelines".
• Daily Check Policy — "describes procedures for daily routine checks... It covers equipment and animal inspections, documentation requirements, and monitoring of critical systems such as ventilation, lighting, and environmental controls."
• Animal Welfare Policy (new in 2025) — "In 2025, we developed an Animal Welfare Policy that provides a comprehensive and structured approach to the ethical use of laboratory animals, emphasizing adherence to the 3R principle (Reduce, Refine, Replace). The policy specifies requirements for breeding, housing, handling, monitoring, and documentation."

"Responsibility for internal animal welfare policies rests with the Vice President of Research and the Head of Global Quality Control" (page 113).

Prevention and detection of corruption and bribery

Reference: pages 111-112.

Risk context (page 112): "we operate in an industry where interactions with government officials and healthcare professionals (HCPs) are a prerequisite for doing business, as breaches of anti-corruption and anti-bribery laws could result in litigation, fines, and charges."

Prevention framework (page 112): the Code of Conduct, Anti-Corruption Policy and Speak-Up Policy "prohibit corruption and bribery and establish an obligation to report suspected violations", applying to all employees, Executive Management, the Board and third parties acting on the company's behalf. The Global Business Ethics Compliance Program "includes annual monitoring activities including third parties and HCPs".

Training (page 112): "All employees, our Executive Management, and the Board receive training on the Code of Conduct, Anti-Corruption Policy, and Speak-Up Policy. All functions-at-risk identified in the annual Global Business Ethics Compliance Risk Assessment and their management are trained on the Anti-Corruption Procedure. Ad-hoc training is provided as necessary. Trainings include read & understand campaigns, and face-to-face or virtual trainings."

Detection and investigation independence (page 111): the Ethics Hotline "enables confidential and anonymous reporting of suspected violations". Claims "are subject to an initial assurance review by outside counsel and Legal & Compliance which has an independent reporting line to the Board through FRAC", and "quarterly reporting is anonymized".

Governance (page 111): "The Board and the Finance, Risk & Audit Committee (FRAC) oversee the Global Business Ethics Compliance Program... Our Chief Compliance Officer, who reports directly to our Chief Executive Officer and independently to FRAC, is responsible for implementing the compliance program."

The company does not disclose the percentage of functions-at-risk covered by training programmes.

Targets related to business conduct

Back-filled from the business conduct chapter, where targets are addressed as part of the MDR-T/GDR-T disclosures rather than as a numbered disclosure requirement. G1-3 became a standalone DR only in the 2025/2026 ESRS.

Bavarian Nordic discloses no measurable outcome-oriented business conduct targets. The company states generally that "Not all identified material IROs have associated targets in alignment with the Minimum Disclosure Requirements" (page 46).

Consistent with MDR-T, effectiveness is tracked in the absence of targets:

• "To promote and evaluate our corporate culture and risk mitigation efforts relating to corruption and bribery, we regularly review and update our policies and training programs, and conduct annual assessments to measure compliance and identify areas for improvement" (page 112).
• "The Global Business Ethics Compliance Program includes annual monitoring activities including third parties and HCPs" (page 112).
• Reported violations are handled under the Speak-Up Policy, with quarterly anonymised reporting reaching the Board through the Finance, Risk and Audit Committee (page 111).

One business-conduct-adjacent target does sit in Executive Management's 2025 incentive scheme, under animal welfare — to "submit a regulatory file to support in-vitro potency testing with the purpose of reducing animal testing of produced batches" (page 47). Bavarian Nordic presents animal welfare under G1 Business conduct.

Incidents of corruption or bribery

Reference: page 111.

"During the reporting period there have been no reported incidents of corruption or bribery, no confirmed incidents, no convictions or fines, and no actions taken as a result." (page 111)

Appendix 3 references the G1-4 datapoints "Fines for violation of anti-corruption and anti-bribery laws" (paragraph 24(a)) and "Standards of anti-corruption and anti-bribery" (24(b)) to page 111 (page 118).

Detection and handling context (page 111): reported violations of the Code of Conduct and applicable laws "are handled according to the Speak-Up Policy". The Ethics Hotline "enables confidential and anonymous reporting of suspected violations". Claims "are subject to an initial assurance review by outside counsel and Legal & Compliance which has an independent reporting line to the Board through FRAC. Reports are managed by external counsel or qualified lawyers in Legal & Compliance, data is stored in a secure and restricted system, and quarterly reporting is anonymized."

Related incident metrics elsewhere: 6 incidents of discrimination, including harassment in 2025 (2024: 0), with DKK 0 in related fines; and 0 severe human rights incidents (page 87). In 2025 there are "no cases of non-respect of human rights in our downstream value chain" (page 103), and "To date, no reported cases of adverse human rights impacts involving value-chain workers have been received" (page 99).

The company does not break down incidents by type or geography.