Bittium Oyj

The role of the administrative, management and supervisory bodies

Reference: pages 51-53.

Bittium's Board of Directors had six members in FY2025, elected annually at the Annual General Meeting. At year end, 83% of Board members were men (5) and 17% were women (1); 83% were independent of the company and 100% independent of significant shareholders. One member, Raimo Jyvasjarvi, was non-independent "due to his previous position as an advisor to the Company."

The Board has an Audit Committee (3 members in 2025, all independent, with long-term business-management experience) which "handles and prepares responsibility issues" and "monitors the implementation of the strategy and compliance with sustainability requirements" before making proposals to the Board.

Sustainability governance layers, per the company's own diagram: the Board of Directors discusses sustainability per management proposals and approves the annual sustainability report; the Audit Committee handles/prepares responsibility issues; the CEO and Management Group set goals, track results and are responsible for implementing plans; the Sustainability Working Group monitors and evaluates implementation of sustainability goals and manages/assesses responsibility risks. The Working Group is led by the VP Communications and Sustainability and has six members (CEO, VP Communications and Sustainability, Chief Legal Officer, CFO, Director HR, Chief Quality and Research Officer).

"The terms of reference of the management bodies or the Board's mandates do not specify how each management body's responsibility for impacts, risks and opportunities is taken into account."

Information provided to and sustainability matters addressed by the administrative, management and supervisory bodies

Reference: pages 53-54.

"Bittium's Management Group discusses sustainability issues regularly. Sustainability targets are set annually, and their implementation and performance are monitored in the annual management review." The Audit Committee "discusses sustainability issues regularly and whenever necessary" and "oversees the Group's sustainability reporting, its process and verification." The Board "discusses sustainability issues based on proposals from the Management Team and annually approves the Group's sustainability report."

In 2025 the Sustainability Working Group "reported to the administrative, management and supervisory bodies on the material impacts, risks and opportunities ... as part of the dual materiality assessment."

A table (page 54) lists specific IROs addressed by governance bodies during the year, for example: E1 "switching own facilities to renewable energy" matched to "introduction of a new emissions calculation tool"; S2 "potential human rights violations in Bittium's value chain" matched to "approval of 2026 sustainability targets. Human Rights Impact Assessment as part of the annual plan"; S4 information-security opportunity matched to "investment decision, partnership agreement and launch of a new security phone."

Due diligence reporting on effectiveness to governance bodies is stated to begin "starting in 2026."

Integration of sustainability-related performance in incentive schemes

Reference: page 54.

"Bittium's remuneration policy principles guide the Group's incentive structure and earning criteria," designed "to align the interests of employees and shareholders and to support the Group's performance-based remuneration," supporting "the implementation of the Group's strategy and long-term sustainable growth."

This is a nil disclosure stated plainly: "Bittium's remuneration policy does not include incentive and remuneration systems related to sustainability issues for members of the administrative, management and supervisory bodies. Climate-related aspects are not taken into account in the remuneration of Bittium's administrative, management or supervisory bodies."

Statement on due diligence

Reference: page 55.

Bittium maps the ESRS 1 AR 9 core elements of due diligence to sections of its own sustainability statement:

"Bittium's due diligence process has been described in accordance with the OECD, and the creation of operating principles, actions, metrics and targets for its handling will continue in 2026. Bittium will report on the results and effectiveness of the process to the administrative, management and supervisory bodies starting in 2026."

Risk management and internal controls over sustainability reporting

Reference: page 54.

"The goal of risk management is to safeguard the company's performance and ensure business continuity by implementing risk management cost-effectively and systematically in different business segments and support functions." Risk management "is part of Bittium's strategic and operational planning, daily decision-making process and internal control system," following a Board-approved policy, and covers "setting objectives, identifying, measuring, assessing, processing, reporting, monitoring, controlling and responding to risks."

Risks are scored on severity and probability, with severity weighted more heavily. "Since 2024, the risk management assessment has also taken into account criteria for identifying potential risks related to the environment, human rights and good governance."

Risks specific to the reporting process identified: "resource adequacy, schedule, and sufficient expertise related to compliance." Mitigations: data-collection tools, distributing responsibilities across the organization to widen participation and reduce workload, and regular coordination in working groups. Reporting-process risks go to the Audit Committee and Board "according to the annual calendar." Compliance monitoring across business units is coordinated by the General Counsel.

Strategy, business model and value chain

Reference: pages 56-57.

Bittium has three business segments: Medical (biosignal measurement and remote monitoring for cardiology, neurology and sleep apnea); Defense & Security (communication and information-security products and services for defense and government markets); and Engineering Services (product development services in IoT/wireless, healthcare and mobile systems). Corporate functions cover administration, strategic projects and listing-related functions.

At year end Bittium employed 528 people (511 in 2024), 99% in Finland, with offices also in Germany, the UK and the US; headquarters in Oulu, with further Finnish offices in Espoo, Kajaani, Kuopio and Tampere, plus two production locations.

Value chain: upstream is mainly component suppliers' production facilities, "most of which are located in Asia"; downstream distributors, end users and service providers "are mainly located in the United States and Europe." Production inputs are "labor, materials used in products, production and financing." "Bittium aims to improve transparency in its supply chain over the next few years, including by acquiring a supplier management tool."

Products are "designed to be long-lasting, repairable and recyclable"; defense products in particular require "operational and delivery reliability, as well as maintenance and upgrade services for decades."

Interests and views of stakeholders

Reference: pages 57-59.

Bittium's key stakeholders, by its own table (page 59): personnel, customers, suppliers and partners, communities, and shareholders and investors (plus authorities).

Engagement channels cited per group: personnel - "an annual personnel survey, a semi-annual pulse survey, an equality survey and an orientation process satisfaction survey," plus exit interviews and an equality survey conducted in 2025; customers - "continuous contact and various annual surveys," reinforced by a 40th-anniversary event in 2025 that also drew suppliers and partners; suppliers and partners - "supplier surveys, self-assessments, supplier visits and audits"; communities - support for educational institutions and national/international R&D cooperation programmes (e.g. the Seamless and Secure Connectivity ecosystem); shareholders and investors - the AGM, institutional investor events, analyst meetings and "a moderated discussion forum for investors," noting "the majority of Bittium's shareholders are retail investors."

"The double materiality assessment investigated stakeholder views on the focus areas of responsibility... information was collected selectively from customers, partners, investors, personnel, management and other stakeholders." Stakeholder views "have been taken into account in Bittium's sustainability strategy."

Material impacts, risks and opportunities and their interaction with strategy and business model

Reference: pages 59-61.

Bittium's second double materiality assessment (conducted in full in 2024, reassessed internally in 2025 without external assistance; 15 key personnel involved) confirmed material topics as: E1 Climate change, E5 Resource use and circular economy, S1 Own workforce, S2 Workers in the value chain, S4 Consumers and end-users, and G1 Governance. E2 Pollution, E3 Water and marine resources, E4 Biodiversity and ecosystems, and S3 Affected communities fell outside the scope of reporting.

"As a result of the 2025 review, the E5 subtopic: resource inflow E5-4 and the S1 subtopic: diversity S1-9 and S1-16 were considered non-material subject areas below the threshold and thus excluded from reporting." A mid-2025 reassessment workshop found that "a total of seven impacts, risks or opportunities fell below the materiality threshold."

Per-topic narrative on where impacts sit: environmental IROs "mainly arise from Bittium's business-related procurement and production"; personnel/consumer/end-user IROs "arise mainly from our own operations"; value-chain-worker IROs "arise largely through the procurement of components"; governance IROs arise "mainly in the company's own operations ... and also from the value chain through procurement."

A data point within SBM-3 (paragraph 48(e), anticipated financial effects) used the ESRS 1 Appendix C transitional provision (page 51 table).

Description of the processes to identify and assess material impacts, risks and opportunities

Reference: pages 65-68.

The 2024 double materiality analysis was run with management, segment key personnel and an external expert organization (including external climate experts for the climate risk/scenario work); the 2025 reassessment was internal, with 15 key personnel.

Process: impacts, risks and opportunities were scored for severity/likelihood (impacts) and magnitude/likelihood (financial), each on a 1-5 scale, combined into a low/moderate/high/critical matrix; "the materiality threshold was high (and critical)." Time horizons follow ESRS 1: short (<1 year), medium (1-5 years), long (>5 years). Views were gathered via EFRAG guidance, internal materials, stakeholder interviews and surveys, and workshops; "the due diligence process was not taken into account at this stage ... as the extensive development of the process only started in late 2024."

Results were approved by the Audit Committee and Board in early 2025, then reassessed again in summer 2025 against the updated strategy.

Climate (E1 IRO-1, page 67): physical risk assessed under RCP8.5 (approx. 4°C warming, chosen as the most severe/conservative scenario); transition risk assessed against the Paris Agreement "below two degrees" pathway - "a scenario analysis according to 1.5 degrees has not been performed." Time frames: short+medium combined for physical risk (reference periods 2020-2040 and 1990-2020), long-term to 2040-2060; transition risk assessed to 2060.

Non-material topics (E2/E3/E4 IRO-1, page 67): "E2 pollution ... immaterial due to the low amount of substances of concern"; "E3 water ... immaterial due to the company's low water consumption" (production is "mainly final assembly"); E4 biodiversity impacts assessed as minor (offices in non-sensitive urban areas, no construction/agriculture/forestry activity).

E5 IRO-1 (page 68): views gathered via 2024 stakeholder interviews (suppliers, customers, partners, occupational health provider, owner) plus internal workshops and a personnel survey, focused on raw materials, recyclability and end use.

Disclosure requirements in ESRS covered by the undertaking's sustainability statement

Reference: pages 68-71.

Bittium's own ESRS Content Index (pages 69-70) states: "Bittium has excluded disclosure requirements according to standards E2, E3, E4 and S3 because they did not emerge as material topics for the company in the materiality assessment." The index lists, by section: ESRS 2 BP-1/BP-2/GOV-1 to GOV-5/SBM-1 to SBM-3/IRO-1/IRO-2; EU Taxonomy; E1-1, E1-2, E1-3, E1-4, E1-5, E1-6; E5-1, E5-2, E5-3, E5-5; S1-1 to S1-7, S1-11, S1-13, S1-14; G1-1 to G1-6. It does not list any E2, E3, E4, S3, S2 or S4 disclosure requirement codes.

Elsewhere (BP-2, page 51) the company states: "Regarding the disclosure requirements of the S2 and S4 standards, it has been decided to utilize the transitional provision and report in 2025 in accordance with the minimum disclosure requirements in accordance with Appendix C of ESRS 1." A separate "Transitional provisions used" table (page 51) lists ESRS 2 SBM-1 (paragraph 40(b)/(c)) and SBM-3 (paragraph 48(e)) datapoints, E1-9, E5-6, and "ESRS S2: All disclosure requirements" and "ESRS S4: All disclosure requirements" as phased in under Appendix C, each "with exception for average number of employees (750)."

"We have not omitted any specific information" is not itself stated; instead the company relies on naming the excluded standards and the transitional provisions used, as above.

Transition plan for climate change mitigation

Reference: pages 84-87; targets page 88-90; actions page 87-88.

"Bittium has a climate transition plan that aims to describe how the company intends to move towards a lower-emission and more sustainable future," covering "emissions from both Bittium's own operations and the value chain." The plan's GHG targets "have complied with the minimum requirements set by the Science Based Targets initiative (SBTi), ... in line with the Paris Climate Agreement (limiting warming to 1.5 degrees Celsius). However, the emission reduction targets have not been confirmed by SBTi."

The plan "has focused on comprehensively reducing emissions from its own operations, involving stakeholders in achieving emission reductions, and improving the energy and material efficiency of its own products." Sector-specific rules in Medical and Defense (e.g. transport-mode and recyclable-material restrictions) shape implementation; long product life cycles are identified as a risk factor delaying realized reductions.

Locked-in emissions: "Bittium has identified locked-in emissions regarding the use phase of Defense products," with influence "limited to improving energy and material efficiency during the design phase and in Mid Life Upgrade projects."

Approval: "Bittium's Board of Directors has approved the sustainability strategy and transition plan on 30 October 2025." Funding is not separately quantified: operating costs are folded into "fixed operating expenses and processes," with renewable-energy transition, emission-credited transport and "greener traffic" flagged as the likely sources of future cost increases, without a figure. "Bittium is not excluded from the EU Paris Agreement or its benchmarks" (Delegated Regulation (EU) 2020/1818).

Identification of climate-related risks and scenario analysis

Back-filled from ESRS 2 IRO-1 (E1 sub-section, page 67) and ESRS 2 SBM-3 (resilience analysis, pages 85-87). This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

Physical and transition risks are classified in the E1 material-IRO table (page 84): e.g. "possible disruption to the supply chain due to exceptional weather extremes" (physical/transition risk), "growing number of regulations and rules" (transition risk), and an "opportunity" from demand for energy-efficient products.

Methodology (page 67): the 2024 climate risk and scenario analysis (not repeated in 2025, "the results were considered to be still valid") covered own operations and the value chain, using the GHG Protocol carbon footprint, EU Copernicus and IPCC data, and NGFS materials. Exposure/sensitivity were scored using Bittium's risk-impact framework across short (0-1yr), medium (1-5yr) and long (>5yr, examined to 2040-2060) horizons, "based on the life cycle of Bittium's products, which is approximately 25 years at most."

Scenarios used: physical risk under RCP8.5 (approx. 4°C warming - "climate change is the strongest, so it has the greatest impact on Bittium's product design"); transition risk under the Paris Agreement, below-2-degrees pathway to 2060. "A scenario analysis according to 1.5 degrees has not been performed" - so the ESRS ¶17(a)(ii) requirement for a 1.5°C-aligned, no/limited-overshoot scenario for transition risk is not met; only the below-2°C Paris pathway is used. Key assumptions: rising raw-material and logistics costs, supplier-selection challenges, and rising fossil/green energy prices.

Resilience in relation to climate change

Back-filled from ESRS 2 SBM-3 (resilience analysis, pages 85-87). This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

"Bittium's resilience analysis is based on a climate risk assessment and a scenario analysis for 2024, which scopes are equal." Results by scenario:

• Low-warming scenario: "Bittium's business strategy is adaptable," with the most critical near-term issues being regulatory change and supplier-relationship transition risk; product-design impacts are milder.
• Higher-warming / medium-to-long term: physical disruption risk to the component supply chain increases, but resilience is "quite good" given decentralized component sourcing across several suppliers; product-design resilience is also "good" given long product life cycles and component choices already accounting for heat, humidity and wind effects.
• Weakest point: "fluctuations in raw material prices, rising logistics costs, changes in emission reduction rights and rising prices of fossil and green energy," assessed as difficult to predict and most pronounced in higher-warming scenarios.

Adaptive capacity measures cited: Force Majeure clauses in supplier contracts, dual/alternative-supplier component selection, competitive bidding accounting for logistics cost, and "a control mechanism for the increase in raw material costs." Uncertainty: "the most uncertain are analyses related to stakeholder behavior," and "scenarios are descriptive, and it is not possible to set precise time frames for events." No ESRS-defined resilience analysis refresh occurred in 2025 - the 2024 assessment was carried forward unchanged.

Policies related to climate change mitigation and adaptation

Reference: page 87.

Climate policies are the Code of Conduct, the Sustainability Policy, the Procurement Policy and the Supplier Manual. In 2025 Bittium "combined its previous environmental and energy efficiency policies and its sustainability policy into a new sustainability policy," committing to "reducing negative environmental impacts" with goals covering "reducing greenhouse gas emissions, committing to renewable energy, improving energy and material efficiency, sustainability in the supply chain, reducing waste volumes and compliance with requirements."

Scope: the policies "cover all its own operations, personnel and management in Finland, Germany, the United States and the United Kingdom," and also extend to value-chain requirements via the Supplier Manual, which "deals with, among other things, requirements related to the environment and greenhouse gas emissions."

Governance: each business segment implements the policies; the management team is responsible at the highest level; implementation is monitored by the Sustainability Working Group; policies are reviewed annually against stakeholder requirements and legislative change.

Actions and resources in relation to climate change policies

Reference: pages 87-88.

2025 actions: updating the Sustainability Policy; implementing a new GHG emission calculation tool and refining the calculation process; preparing the climate transition plan and Scope 3 reduction measures; mapping sustainability-training needs; increasing renewable energy and introducing low-emission fuel on flight routes; and adding resources to the Sustainability team.

Quantified results: "Scope 1 emissions decreased by 25% compared to the previous year, as the number of leasing cars decreased and the share of electric cars increased." "Scope 2 market-based emissions decreased by 45%, as renewable district heating was introduced at the Oulu and Espoo locations," and the Oulu, Kuopio, Tampere and Espoo locations "switched to completely emission-free purchased electricity." Scope 3 actions in 2025 were mainly preparatory (refining the calculation process); low-emission fuel was "partially introduced in air cargo, but this did not have a major impact on total emissions in the first year."

Resources: the "majority of its operating expenses related to the transition plan, such as personnel and training costs," sit within fixed operating expenses; Bittium runs ISO 14001 (environmental) and ISO 50001 (energy efficiency) management systems supporting this work.

Targets related to climate change mitigation and adaptation

Reference: pages 88-90.

Base year 2023, calculated per the E1-6 methodology: 7,913.15 tCO2e (Scope 1-3, including expected growth). Overall target: -44% by 2030 (to c.4,461 tCO2e), using "the cross-sectoral emission reduction reference pathway (Pathways to Net-zero - SBTi Technical Summary, version 1.0, October 2021)"; sector-specific decarbonization guidance "were not available" at reporting time.

Scope-level targets: Scope 1 - -100% by 2030, by replacing leasing cars with electric vehicles; Scope 2 - -100% by 2030, via 100% renewable energy at all Finnish locations; Scope 3 - -42% overall by 2030, targeted mainly at purchased goods/services (committing critical suppliers to carbon neutrality; exploring recycled-material content), leased-equipment optimization, product-use-phase emissions (renewed ecodesign criteria), and logistics (lower-emission transport, partners with Paris-aligned transition plans).

"Emission reductions have been calculated as percentages in relation to the emissions in the base year 2023. Technologies related to achieving greenhouse gas emission reduction targets were not introduced during 2025." No interim target year has been set; the target date is 2030. Note: the 2025 emissions-tool recalculation (affecting categories 3.8 and 3.11) post-dates the transition plan's approval, so the plan "deviates from the absolute emissions reported in Table E1-6" and will be updated in 2026.

Energy consumption and mix

Reference: pages 90-91.

"71.4% of the electricity purchased by Bittium in 2025 was produced from renewable and emission-free energy sources." Oulun Energia's rooftop solar panels at the Oulu office produced 90.3 MWh.

Nuclear share: 0% both years. Fuel combustion in leasing vehicles (Scope 1) was 94.04 MWh, "approximately 3% of total energy consumption." Purchased electricity and district heating totalled 3,125.1 MWh in 2025.

Energy intensity (high-climate-impact sector): Bittium's Medical segment is classified NACE C26.6.0 "Manufacture of irradiation, electromedical and electrotherapeutic equipment" under Commission Delegated Regulation (EU) 2022/1288; intensity was 758.8 MWh/MEUR (2024: 514.4), using the Medical segment's net revenue (MEUR 19.4) as the denominator.

The year-on-year fall in the renewable share (45% to 31%) and rise in fossil share (18% to 26%) is a direct consequence of the shift described in E1-6/E1-3's accounting-policy note on contractual instruments.

Gross Scopes 1, 2, 3 and Total GHG emissions

Reference: pages 91-94.

Market-based total emissions in 2025: 6,753 tCO2e, up 44% from 4,693 tCO2e in 2024. "There have been no significant changes in Bittium's business operations between 2024 and 2025" - the rise is a restatement/methodology effect (see below).

Scope 1 is "approximately 0.3%" of the footprint (diesel backup generator, leasing vehicles); Scope 2 "2.1%"; Scope 3 "97.6%." Contractual instruments covered 75.7% of Scope 2 (renewable-energy certificates of origin). GHG intensity: market-based 56.6 tCO2e/MEUR (2024: 55.1). The largest Scope 3 swings were Use of sold products (+113%, to 1,527 tCO2e), Employee commuting (+123%) and Upstream leased assets (+51%), driven by the new emissions-calculation tool recalculating categories 3.8 and 3.11 back to 2023, and a larger commuter-survey response pool. 5.2% of total 2025 emissions used primary data. Category 3.12 (end-of-life treatment) was found "immaterial, so it will no longer be reported for 2025."

Policies related to resource use and circular economy

Reference: pages 96-97.

Governing documents: the Code of Conduct, the Sustainability Policy (merged with the former environmental/energy-efficiency policy in 2025, committing to reduced negative environmental impacts), the Procurement Policy, and the Supplier Manual, which "sets out, among other things, process energy efficiency, use of renewable resources, avoidance of harmful substances and minimization of emissions." Bittium "requires its suppliers to have an environmental management system that meets the requirements of the ISO 14001 standard."

Scope: the Code of Conduct/Sustainability/Procurement policies "cover all of its own operations, personnel and management in Finland, Germany, the United States and the United Kingdom"; the Supplier Manual "covers the entire value chain." Each business segment implements the policies; the management team is responsible at the top level, monitored by the Sustainability Steering Group. "No direct stakeholder consultation process has been applied in the preparation of the policies."

The policy explicitly does not address transition away from primary resource use: "the policy does not set requirements for the sustainable procurement of renewable resources, as Bittium's products currently have restrictions related to the use of renewable materials."

Actions and resources related to resource use and circular economy

Reference: pages 97-98.

Core ongoing action: sustainable product design - "designing products to have the longest possible lifespan, product maintainability, and proper recycling." 2025-specific actions: "harmonization and updating of circular economy guidelines and ecological product design requirements," and "completion of the waste management plan." Personnel training on circular-economy principles is planned for 2026.

Ongoing programmes: Mid Life Upgrade (MLU), letting customers extend system life by replacing individual components rather than buying new systems; and End of Life (EoL) component purchases, which secure spare-part availability "so that the possible withdrawal of a component from the market does not cause unplanned configuration changes to the products delivered to customers."

Resources: "The implementation of the action plans has not required separate significant Capex or Opex expenses" - costs are absorbed as normal personnel, administrative and material costs of ongoing business.

Targets related to resource use and circular economy

Reference: page 98.

No quantified numerical target is set: "Bittium has not set time- and result-based targets for resource use or circular economy." Instead, effectiveness is monitored via the sustainability strategy's broader material- and energy-efficiency and transition-plan metrics (covered under E1). "Circular economy targets are related to the integration of circular economy principles into operational activities by 2027."

A data-limitation is disclosed: "Bittium does not have the possibility to trace end-of-life products from customers with sufficient accuracy," which constrains measurement of circularity outcomes at end of life.

Resource outflows

Reference: pages 98-99.

Outflows are Bittium's designed/manufactured biosignal-measurement and remote-monitoring devices and wireless/embedded defense solutions, their components, and transport/protective packaging. Circular-economy principles applied: "durability, reusability (Medical), repairability, dismantling, refurbishment and recycling." Defense products have long targeted lifespans ("up to tens of years") and are extended via MLU programmes rather than remanufactured; "customer requirements do not allow the use of recyclable materials in products" for Defense & Security, so "long service life and maintainability are the most important circular economy principles" there.

Product durability by category: biosignal-measuring products 3 years; security phones 8 years (vs. average 4); tactical radios and field phones 25 years. "Bittium products have small packaging quantities and the packaging is mainly paper, plastic and/or wood-based, all of which are 100% recyclable materials."

Waste

Reference: page 99 (Resource Outflows table).

"The waste generated by Bittium's own production is mainly sorted packaging waste, which is recycled with the help of a selected partner." Packaging waste is "mostly cardboard, paperboard and various plastics such as polystyrene." Hazardous waste from production includes "various adhesives, pastes and epoxies." "The amount of waste is monitored by waste type on an annual basis."

Only a small share of products is physically returned to Bittium for disposal, due to the information-security sensitivity of defense and healthcare customers, who "want to handle the recycling or disposal of the products through their own channels." Bittium states it "is committed to receiving and recycling the products it manufactures through appropriate channels, as required by producer responsibility."

Policies related to own workforce

Reference: page 103.

Guiding document: the Code of Conduct ("describes Bittium's entire corporate culture"), supplemented by a newly approved HR policy (2025) committing to "a work environment that promotes fairness, respect, diversity and professional growth," and the sustainability policy's social-responsibility section, which "promotes a safe and healthy work environment, fair working conditions" and "diversity, equality and inclusion." A separate personnel strategy (2024-2025) defines implementation/monitoring processes.

Bittium states alignment with the UN Guiding Principles on Business and Human Rights, the ILO Declaration on Fundamental Principles and Rights at Work, and the OECD Guidelines, and "condemns all forms of forced or child labor" across its operations and supply chain. Policies "cover its entire workforce, in all geographical areas of operation." The Group CEO and Management Team are the highest organizational level responsible for implementation. Remediation channels are cross-referenced to S1-3; engagement processes to S1-2.

Processes for engaging with own workforce and workers' representatives about impacts

Reference: pages 103-104.

Bittium "organizes events for its personnel during the year ... where they have the opportunity to ask questions and provide feedback," with "open dialogue and asking questions directly to management." Formal feedback channels are the annual Bittium Employee Survey (BES) and, in 2025, an additional Pulssi (pulse) satisfaction survey; results are posted on the intranet.

Governance of feedback: survey results go to the Board of Directors, Management Team, and business segment/team level; progress is reviewed at quarterly segment briefings; KPIs and people metrics are reviewed monthly by segment management and reported to the Board. An occupational health and safety committee exists to protect "the occupational health and work ability of Bittium's personnel."

Processes to remediate negative impacts and channels for own workforce to raise concerns

Reference: page 104.

The Whistleblowing reporting channel "offers the opportunity to report suspected misconduct to the organization confidentially," available to everyone via the internal website, with "all reports ... processed according to a uniform model" (full process description cross-referenced to G1-1). Employee-representative cooperation follows the Cooperatives Act; "the shop steward also has the opportunity to bring a question or disadvantage related to an individual person or group of personnel to a discussion with the employer's representative." Personnel retain a "right, guaranteed by law, to belong to a trade union." "No agreements have been made with personnel or their representatives in 2025."

The early support model (VARTU) addresses well-being risks, supplemented by substance-abuse treatment-referral guidance and a "Conflict Situation Prevention and Resolution Model." Employees can also raise concerns with an occupational health and safety officer, or externally with AVI (the state occupational safety authority). "Bittium does not have specific processes to assess staff trust or awareness of its channels."

Taking action on material impacts on own workforce

Reference: pages 104-106.

Actions are guided by an equality plan, a work community development plan, and an occupational health and safety action plan, each "updated and evaluated regularly." Workplace surveys by occupational health services "highlighted, for example, psychosocial stress and static working positions," producing recommendations for action.

2025-2026 Occupational Safety and Health Action Plan priority: raise awareness/usability of the internal near-miss reporting channel; "no reports of near-miss observations were received through the channel in 2025." Occupational accidents are reviewed by the safety committee "at least once a year ... and whenever a special risk arises." HR monitors fixed-term-contract numbers and working hours and "intervenes in excessive workloads at an early stage." Flexible/hybrid working is offered to balance "family, work and leisure life."

Wellbeing benefits beyond statutory minimums include occupational healthcare, bicycle and lunch benefits, and cultural/sports/massage/dental/travel benefits via an "E-pass." Training activities use platforms including Pluralsight. "The costs of actions affecting personnel are considered normal business expenses and do not require significant additional investments."

Targets related to own workforce

Reference: page 106.

2025 sustainability-strategy targets: training days - at least 5 days/person/year by 2030; employee satisfaction (BES) - >4.0 by 2030 (raised from the 2024 target of 3.8); sustainability training - launch new training in 2026, 100% of personnel trained by 2030; gender balance - 20% women among all personnel and superiors by 2030. Targets apply to all employees regardless of geography.

2025 progress: "the targets in the sustainability strategy were achieved in terms of employee satisfaction" - BES result 3.8 (unchanged from 2024), against the raised >4.0-by-2030 target. Training days per person rose to 2.9 (from 1.4). Women represented 15% (15%) of all employees and 20% (18%) of managers. A staff survey was run in 2025 to map sustainability-training needs ahead of the 2026 launch.

Characteristics of the undertaking's employees

Reference: pages 106-107.

At end-2025 Bittium had 528 employees (511 in 2024): 78 women, 450 men (no "other"/"not reported" categories used). 500 (486) held permanent ("until further notice") contracts: 75 women, 425 men. 29 (46) left voluntarily/retirement/death; 21 (8) were dismissed; turnover was 9.5% (10.7%).

Of part-time contracts, 31% were women, 69% men (mostly by employee preference for flexible arrangements). Average reported employee headcount per the financial statements (Notes 6, 30): 528 (507). Data is collected from the HR system as headcount at period end, covering "all employees working for any entity included in the company's sustainability reporting."

Characteristics of non-employee workers

Reference: page 107.

"Bittium also employs non-employee employees," consisting mainly of temporary workers supplied by staffing agencies (e.g. production assembly roles), subcontractors (e.g. product-development design), and self-employed consultants (e.g. advisory/consulting work). "Bittium employed 85 (32) non-employee employees during 2025." The figure is "collected from data stored in the company's personnel system and given as the number of employees at the end of the reporting period." No further breakdown (by country or worker type) is disclosed.

Social protection

Reference: pages 107-108.

"All Bittium employees in Finnish companies are covered by social protection through public programs and benefits" against loss of income from illness, unemployment (from the start of employment), work-related injury and disability, parental leave and retirement. For the United States, social security benefits follow government eligibility rules, supplemented by "employer-sponsored health and pension programs, sick leave and parental leave." For Germany, "social security consists of five statutory components: health, long-term care, pension, accident and unemployment insurance." EU law separately "guarantees the right to parental leave, carer's leave and holidays."

Basis/limitation: the disclosure "is based on the assumption that the level of social protection defined in Finnish national legislation is sufficient to cover social protection needs arising from significant life events." Data for employees working abroad came from "the US personnel officer and from Germany based on the materials of the auditor and accounting firm," rather than a direct, standardized cross-country benefit comparison.

Training and skills development metrics

Reference: page 108.

"In 2025, the number of training days was 1,534 (750) days, or an average of 2.9 (1.5) days per employee," covering external and internal training, orientation and self-study. "A total of approximately 95% (60%) of the personnel participated in training in 2025." Training attendance was 9,200 hours (5,600), or 17.4 hours/person (11.0); women averaged 17.0 hours/person (21.2), men 17.5 hours/person (9.2).

Development discussions: held annually; 80% of personnel (425 people) participated in 2025, versus 83% (423 people) in 2024 - 72% of women (56) and 82% of men (369). Learning is supported via platforms including Pluralsight and an internal training portal. "Bittium's employee participation in training and development discussions is documented and reported based on data generated by the human resources system."

Health and safety metrics

Reference: page 108.

"All Bittium employees in Finnish companies (100%) are covered by an occupational health and safety management system" meeting the Finnish Occupational Health Care Act; "all Bittium locations in Finland have appropriate safety plans." "No near-miss observations were reported to the channel during 2025."

None of the 2025 accidents "resulted in compensation liability under the Finnish Act on Occupational Accidents and Diseases." "Bittium had no work-related health problems or cases that were subject to legal restrictions on data collection for the company's employees (0)."

Business conduct policies and corporate culture

Reference: pages 117-118.

Guiding principles: strategy, values (innovation, courage, trust), ethical principles, mission and vision. "Bittium's corporate culture is monitored and developed regularly as part of strategy work," with the Board, CEO, Management Team and business segment management responsible for developing it. "Bittium does not have operating principles that concern the provision of training related to conducting business" as a standalone policy area, though training is provided in practice (see G1-3).

Anti-corruption: a Group-wide management system with an Anti-Corruption Code of Conduct for Third Parties and an internal-use equivalent, aligned to the UN Convention against Corruption; mandatory self-study anti-bribery training. Highest bribery-risk group: "those who possess or have access to technical expertise or confidential information," given Defense & Security's attractiveness "as a target for bribery ... and, consequently, for corruption or corporate espionage."

Whistleblowing: managed by external provider WhistleB, fully anonymized; covers misconduct against ethical principles/law, and statutory Whistleblower Protection Act matters (excluding defense/security procurement). Investigated by a team comprising the Audit Committee Chairman and General Counsel, with conflict-of-interest recusal rules; acknowledged within 7 days, outcome communicated within 3 months.

A research-and-development-cooperation opportunity (EUR ~95m "Seamless and Secure Connectivity" ecosystem and EU Defense Fund projects) is also classified as a G1 corporate-culture IRO.

Management of relationships with suppliers

Reference: pages 118-119.

"Supplier relations were identified as a material sub-topic in the dual materiality assessment in 2025," framed as a positive impact from "supplier requirements, audits and material reports" combined with responsible procurement and subcontracting practices. "Bittium does not set measurable, result-oriented targets related to supplier management ... or monitor the effectiveness of its operating principles and actions" against this specific IRO.

Governing documents: Bittium Procurement Policy, Bittium Supplier Manual (covering business practices, anti-corruption, child/forced-labor prohibition, environment, occupational safety, human rights and material-specific requirements), Self-assessment Checklist, Audit Assessment Checklist, and the General Purchase Agreement. Strategically important/critical suppliers must commit to these.

Process: regular audits of "strategically important or otherwise critical (Tier 1 and 2)" suppliers per an annual audit plan, combining self-assessment and Bittium-performed audits; a supplier management tool, further developed in 2025, improves oversight. Payment practices (small/SME-inclusive) are covered under G1-6. "Bittium does not have specific operating principles that apply to small and medium-sized enterprises" beyond this.

Prevention and detection of corruption and bribery

Reference: pages 119-120.

"In the dual materiality assessment process conducted in spring 2025, the potential reputational risk related to corruption and bribery was identified as a material sustainability issue," located upstream and in own operations. "Bittium has a zero tolerance policy towards bribery and corruption."

Guidance: ethical principles covering anti-corruption, IP protection, human rights/fairness, data protection, insider rules and transparency, publicly available on the company website. Training: mandatory Code of Conduct and Anti-Bribery Self-Study modules, each with a completion test, renewed every 3 years; 2025 completion: 61% (Code of Conduct), 59% (Anti-Bribery Self-Study) of all personnel, "reported for the first time in 2025." A prior-year reporting error is disclosed: "coverage of training in risk functions" in G1-3 for 2024 was "calculated incorrectly," so the 2025 figure is shown without a comparator.

Reporting route: the Whistleblowing channel, with independence safeguards if a report names a channel administrator, CEO or Board member (escalated to the full Board via its digital platform in the CEO/Board-member case).

Targets related to business conduct

Part of the MDR-T/GDR-T disclosures under the 2023 ESRS; reported within the G1-3 anti-corruption and bribery section.

Reference: page 120.

"Bittium has not set measurable result-oriented targets in accordance with the definition of sustainability reporting regarding the topic of corruption and bribery, but monitors the effectiveness of its operating principles and actions in relation to the material risk using its own target."

That target: "all personnel (100%) have completed both training courses [Code of Conduct and Anti-Bribery Self-Study] by 2030." The target was changed from the 2024-stated goal ("95% in 2025 and 100% in 2026") to the current 100%-by-2030 formulation. 2025 completion stood at 61% (Code of Conduct) and 59% (Anti-Bribery Self-Study) of all personnel, tracked against this target - i.e. effectiveness is tracked via ongoing training-completion monitoring in the absence of a numeric reduction target for incidents themselves.

Incidents of corruption or bribery

Reference: page 120.

A complete nil return, stated plainly: "No corruption suspicions or cases were reported for Bittium during 2025. No investigations have been opened or convictions have been issued for violations of laws on corruption and bribery. There were also no pending cases, convictions or fines regarding actions taken in previous years." No further breakdown (e.g. by business segment or geography) is provided, consistent with there being no incidents to disaggregate.

Political influence and lobbying activities

Reference: page 120.

"The double materiality assessment process conducted in spring 2025 identified the opportunity related to political influence and lobbying as a material sustainability issue at the sub-topic level: the potential to grow business in the face of the changed geopolitical climate," focused on own operations and downstream. Context cited: Finland's NATO accession and the partnership with the Finnish Defence Forces have raised Bittium's visibility in international defense/security markets.

Governance: in 2025 Bittium "prepared the company's Lobbying Policy and guidelines related to political interaction and lobbying, which also define the division of responsibilities." "In 2025, Bittium has not made political donations or participated in party political influence by participating in the campaigns of parties or individual candidates in cash or in kind." "Bittium has not set targets related to the identified material opportunity for political interaction and lobbying." Representatives met political actors and attended defense-industry/Defence Forces events in 2025, but "sustainability topics relevant to Bittium have not been significantly considered or promoted" in those settings. "In 2025, none of the members of Bittium's administrative, management and supervisory bodies have held public administration positions in the two years preceding their appointment."

Payment practices

Reference: pages 120-121.

"Approved purchase invoices submitted to Bittium are paid on Mondays and Thursdays. Invoices are always paid by the due date." This applies "to companies of all sizes, including small and medium-sized companies and all supplier groups."

"The calculation method has been corrected from 2024, when the share of invoices paid in accordance with standard terms was reported as 100%." "There are no pending lawsuits due to payment delays."