Construcciones Y Auxiliar De Ferrocarriles S.A.

Governance roles

Reference: pages 67-82 (section 1.2.1, "The role of the governing bodies").

CAF's governance and administration rest with the General Shareholders' Meeting and the Board of Directors, assisted by two Board committees: the Audit Committee and the Appointments and Remuneration Committee. The Management Team runs day-to-day operations.

At year-end 2025 the Board had 11 seats (one vacancy), split 20% executive / 80% non-executive (30% independent, 20% proprietary, 30% other external); female directors are 40% of the Board, and the CEO/Chairman roles are separated. "CAF is not directly represented on the Board of Directors by employees or other workers of the Company" (page 67).

Sustainability governance runs through four levels (page 71): the Board and its Committees; the Strategic Sustainability Committee (led by the CEO, meets at least twice a year); the Sustainability Operating Committee (led by the Sustainability Function, at least four meetings a year); and specialised forums by material subject (e.g. Environment, Cybersecurity, Occupational Health and Safety). The Audit Committee "is responsible for... the supervision and assessment of the financial and non-financial risk control and management systems... including operational, technological, including cybersecurity and artificial intelligence, legal, sustainability, political, reputational and corruption-related risks" (page 75).

Information provided to and matters addressed by governing bodies

Reference: pages 82-84 (section 1.2.2).

In 2025 the Strategic Sustainability Committee met three times and the Sustainability Operating Committee met five times. At the Audit Committee, "the Chief Financial and Strategy Officer, the Head of the Sustainability Function and the Sustainability Reporting Verifier attended to report, among other matters, on sustainability reporting." The Head of the Sustainability Function also reported jointly to the Appointments and Remuneration Committee and the Audit Committee (February session) on the FY2024 Non-Financial Statement, and in December 2025 the Appointments and Remuneration Committee discussed a report on the supervision of the Sustainability Policy and environmental/social practices.

"In December, the members of the Board of Directors received specific training on sustainability, in particular on environmental and social issues." Senior management is also regularly invited to Board and Committee meetings to report on sustainability-relevant matters; the February 2025 Board meeting covered the organisational health index (Employee Satisfaction Survey), talent management, diversity and environmental issues with social impact.

Integration of sustainability-related performance in incentive schemes

Reference: pages 84-87 (section 1.2.3).

Short-term variable remuneration for executive directors: non-financial objectives carry "a maximum weight of 20% of the total short-term incentive," with examples including "the level of customer satisfaction, the Organisational Health Index..., the result of the EcoVadis sustainability assessment, the reduction of CO2 emissions or other ESG parameters."

Long-Term Incentive Plan (2023-2026): measured on "an economic-financial metric (aggregate EBIT Operating Result for the period 2023-2026) and a non-financial metric (CO2 Emission Reduction (Scope 3) at the end of 2026), with a weighting of 85% and 15%, respectively." The Scope 3 (product-use) metric "was introduced into the current Policy in response to suggestions received from key proxy advisors to incorporate non-financial parameters into the Long Term Incentive Plan." The Directors' Remuneration Policy (approved by shareholders 15 June 2024) governs both fixed and variable pay for Board members.

CAF's due diligence statement

Reference: pages 89-93 (section 1.2.4).

CAF states it "assumes a due diligence approach in accordance with applicable regulations... we take a proactive approach to due diligence throughout our global value chain on an ongoing basis." The Human Rights Due Diligence Policy anchors this, built on the International Bill of Human Rights, the UN Guiding Principles on Business and Human Rights, the OECD Guidelines for Multinational Enterprises (2023), the ILO Declaration, and the UN Global Compact.

Business opportunities are screened through a country-risk / business-opportunity flow: low-risk opportunities proceed without enhanced diligence, while high-risk ones go through a 39-question enhanced due diligence questionnaire covering military use, execution risk, geopolitical context, conflict minerals, land use, local suppliers, discrimination, indigenous communities, environment and international sanctions, among others, informed by the UNDP's Guide to Enhanced Human Rights Due Diligence in Conflict-Affected and High-Risk Contexts. The Double Materiality Assessment separately identified as material "the negative consequences on the economic, social and cultural rights of the affected communities" tied to CAF's business activities.

Risk management and internal controls over sustainability reporting

Reference: pages 98-102 (section 1.2.5).

CAF's Internal Control System over Sustainability Reporting (ICSSR) is based on the COSO framework (2023 interpretative report on applying ICIF-2013 to sustainability reporting). In 2025 CAF "implemented the SAP GRC Process Control tool to manage" the ICSSR, digitising the previously dispersed reporting-control systems.

Four pillars: (1) identification and assessment of specific risks per reporting process; (2) design of controls across preparation, consolidation and reporting; (3) progressive implementation of controls in digital tools; (4) continuous adaptation to new regulation. Risk categories: data quality and accuracy, coverage and materiality, third-party dependency, consolidation and perimeter, and regulatory compliance. Governance: "CAF's Board of Directors is responsible for the existence and maintenance of an adequate and effective" ICSSR; the Audit Committee oversees it and "is also responsible for discussing with the sustainability information verifiers any material weaknesses in the internal control system detected during the course of their review."</br>

Strategy, business model and value chain

Reference: pages 103-109 (sections 1.3.1-1.3.2).

CAF is a rail and bus manufacturer: "our operations span research and development, manufacturing, commercialization, and distribution" via the Railway segment (vehicles, signalling, components) and Solaris buses ("the most comprehensive range of low and zero emission solutions"). FY2025 revenue: railway EUR 3,305M, buses EUR 1,183M (total EUR 4,487M, "Manufacturing - Automobiles & Other Transport Vehicles" per ESRS). 17,500+ employees; over 60 markets; industrial sites in Spain, France, the UK, the US, Brazil, Mexico and Poland; order backlog >EUR 16 billion.

Value chain, three blocks: upstream (raw materials and component suppliers, service providers, SPVs); own operations (vehicle/component design and manufacture, service development, turnkey project management); downstream (operators, maintenance personnel, passengers, public administrations). CAF confirms it "does not significantly engage in other sectors covered by ESRS, especially those related to fossil fuels..., chemical manufacturing, arms manufacturing, or tobacco production."</br>

Interests and views of stakeholders

Reference: pages 111-113 (section 1.3.4.1).

Five stakeholder groups: shareholders, customers, people, suppliers, society, each mapped to dedicated channels (page 112) e.g. shareholders via the Investor Services Office and CNMV filings; people via the CAF Portal, internal channels and the Organisational Health Survey; suppliers via the supplier portal, audits and satisfaction survey; society via direct relationships with public administrations and forum participation.

"In the Double Materiality Assessment and in the preparation of the Sustainability Master Plan, key individuals from CAF... participated internally, as well as external entities representing our shareholders, suppliers, customers and society. Through interviews and workshops, the double materiality criterion has been applied to assess the relevance of each topic." Results feed the Sustainability Master Plan, with the Strategic Sustainability Committee overseeing consistency with CAF's strategy.

Material impacts, risks and opportunities and their interaction with strategy and business model

Reference: pages 120-122 (section 1.4.2), plus pages 109-110 (section 1.3.3, resilience).

The 2024 Double Materiality Assessment (updated via a 2025 SWOT review) identified 66 individually-typed IROs across E1, E2, E5, S1, S2, S3, S4 and G1, plus an entity-specific topic, Innovation, added in the 2025 update ("Appendix 6" of this Report). E3 (Water and Marine Resources) and E4 (Biodiversity and Ecosystems) are not material.

"There are no current significant financial effects related to our identified risks and opportunities" is not stated verbatim for CAF, but the company reports it assessed financial effects "considering different scenarios of regulatory and social requirements... short, medium and long term," including carbon-tax exposure and innovation investment. On resilience: "a detailed resilience analysis dedicated to climate change has not been conducted. However, an analysis of the main strategic levers... has been carried out," concluding "the resilience of CAF would not be materially affected in any of the scenarios assessed" (page 135-136). In 2025, "the wording of 10 IROs, related to standards S1, S2, S3, S4 and G1, has been modified."</br>

Description of the processes to identify and assess material IROs

Reference: pages 118-120 (section 1.4.1).

CAF's first Double Materiality Assessment ran over H1 2024 under CSRD/EFRAG guidance, refreshed in 2025 via a SWOT exercise. Four phases: (1) Understanding - regulatory review and stakeholder-expectation study, drawing on "more than 50 documents"; (2) Identification - a preliminary IRO list from internal (policies, procedures, indicators) and external sources, informed by due diligence outputs and CAF's Risk Catalogue; (3) Evaluation - interviews and workshops applying dual materiality; (4) Definition and Validation - Strategic Sustainability Committee review and sign-off.

Impact materiality: severity (magnitude, scope, irremediability, logarithmic 1-16 scale) averaged with probability; threshold 32/256 (linear scale for human-rights impacts, prioritising severity). Financial materiality: magnitude x probability, logarithmic 1-16; threshold 16/256, deliberately low "in order to capture emerging risks and opportunities."</br>

Disclosure requirements in ESRS covered by the undertaking's sustainability statement

Reference: page 122 (section 1.4.3); Appendix 3.1 (pages 345-350) provides the full content index.

"the table of contents located in 'Appendix 3.1.' lists the CSRD disclosure requirements that have been included in this Report and the section in which they are presented." Appendix 3.1 lists, per ESRS topical standard, every material disclosure requirement with the corresponding report section: ESRS 2 (BP-1/BP-2, GOV-1 to GOV-5, SBM-1 to SBM-3, IRO-1/IRO-2, MDR-P/A/M/T), E1 (E1-1 to E1-8; E1-9 flagged "Omitted as a phased in requirement"), E2 (E2-1 to E2-5; E2-6 flagged "Transitory provision"), E5 (E5-1 to E5-5; E5-6 "Omitted as a phased-in requirement"), S1 (S1-1 to S1-17, with S1-7, S1-11 and S1-15 each flagged "Omitted as a phased-in requirement"), S2, S3 and S4 (all DRs), and G1 (GOV-1, IRO-1, G1-1, G1-2, G1-3, G1-4, G1-6 - G1-5 does not appear in this table). ESRS E3 and E4 do not appear in Appendix 3.1 at all, and Appendix 3.2 marks their underlying datapoints "Non-material" throughout (pages 354-355).</br>

Transition plan for climate change mitigation

Reference: pages 132-134 (section 2.2.2).

CAF's near-term and long-term GHG targets, validated by SBTi in November 2024, are "compatible with limiting global warming to 1.5 degrees C." Scope 1+2: -30% by FY2026, -55% by FY2030 (revised up from a 50% Strategic Plan target after SBTi review, to 54.7%), net zero by FY2045, vs 2019 base. Scope 3 category 11 (product use) intensity: -40% (2026), -55% (2030), net zero (2045).

The Decarbonisation Plan sets six numbered levers with quantified CAPEX/OPEX and avoided-tCO2e-by-2030 figures: (1) new heat-treatment line (CAPEX EUR 5M, 1,785 tCO2e avoided); (2) forging-calendar change (318 tCO2e, no CAPEX); (3) natural-gas-to-renewables substitution (14,152 tCO2e, CAPEX TBD); (4) renewable-electricity GO purchases (4,194 tCO2e, OPEX ~EUR 198k); (5) 100% renewable heat purchase (3,083 tCO2e); (6) zero-emission vehicle sales innovation (~EUR 10M/yr OPEX). "The Decarbonisation Plan... has been approved by CAF's Senior Management and is integrated into the initiatives of the Sustainability Master Plan," and CAF states it "is fully integrated and harmonised with our general strategy and financial planning." CAF "has not been excluded from the EU's benchmarks aligned with the Paris Agreement."</br>

Identification of climate-related risks and scenario analysis

Back-filled from ESRS 2 IRO-1 (climate-specific) and the E1 climate-strategy subsection, where this content is disclosed in the FY2025 report (section 2.2.3.1, pages 135-136, and section 2.2.4.1, pages 137-140). This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

Four climate scenarios, each pairing a physical (SSP/RCP) and a transition (IEA-style) pathway: Scenario 1 - SSP1-1.9 + NZE, +1.5C; Scenario 2 - SSP1-2.6 + APS, +1.7C; Scenario 3 - SSP2-4.5 + STEPS, +2.7C; Scenario 4 - SSP5-8.5 + STEPS, +4.5C (the most pessimistic, used deliberately: "STEPS has been used as it is the most pessimistic scenario for transition risk and the target is to measure the most pessimistic impact from a physical point of view"). Time horizons: short 2030, medium 2040, long 2050.

Physical-risk assessment used IPCC AR6 pathways and CMIP6 data, geolocating every site; extreme wind and rainfall/flood risk were flagged, water-scarcity risk was assessed as low. Transition risk/opportunity used CDP/TCFD categories (market, products and services, resource efficiency); CAF "finds more opportunities in a green scenario (SCENARIO 1)... than in a red scenario (SCENARIO 3)." A key assumption: achievement of the 2045 net-zero commitment. The analysis was refreshed in 2025 ("developing and improving both the methodology and the system... in 2025").</br>

Resilience in relation to climate change

Back-filled from ESRS 2 SBM-3 / the E1 climate-strategy subsection, where this content is disclosed in the FY2025 report (section 2.2.3.1, pages 135-136, cross-referring to section 1.3.3, pages 109-110). This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

CAF states plainly that "a detailed resilience analysis dedicated to climate change has not been conducted." In its place, "an analysis of the main strategic levers and their potential impact on climate change has been carried out," including the opportunity from growing demand for urban/intercity electric buses across every scenario and time horizon, and the impact of physical hazards, which is "greater" in "the most pessimistic scenarios... and longer time horizons" but does not threaten resilience because of CAF's "global presence... not only in headquarters and assets; also in customers and suppliers (supply chain)."

Conclusion: "the resilience of CAF would not be materially affected in any of the scenarios assessed, although demand could vary from one scenario to the next," due to "the diversification and flexibility of the Company's product portfolio." More broadly, section 1.3.3 states CAF's business-model resilience was analysed as part of the 2026 Strategic Plan and validated against the 2024/2025 Double Materiality Assessment, concluding "the opportunities in sustainability exceed the risks."</br>

Policies related to climate change mitigation and adaptation

Reference: pages 142-143 (section 2.2.5).

The lead policy is the Environmental Policy, which "sets out the corporate principles and criteria that guide our environmental performance, reinforcing our commitment to mitigating climate change, adapting to its impacts and promoting sustainable mobility solutions," owned by the Chief Technology Officer (CTO) and referencing ISO 14001/14064, the GHG Protocol, the ESPR Ecodesign Directive and REACH. It is complemented by the Ecodesign Policy (minimising lifecycle environmental impact from procurement through end-of-life), the Purchasing Policy and the Supplier Code of Conduct (extending climate expectations to suppliers, owned by the CFSO), plus the Sustainability Policy and the General Risk Management and Control Policy (both Board-owned, referencing CSRD and ISO 31000). All policies "extend to non-controlled investees and third parties in the value chain, in proportion to the risk and degree of influence," and are informed by "ongoing dialogue and transparency" with stakeholders.</br>

Actions and resources related to climate change policies

Reference: pages 147-151 (section 2.2.6).

Three of the named actions (of several): Action 1 - new heat-treatment line at the Beasain (Spain) wheel-forging workshop, to cut natural-gas use; investment EUR 5.4M (own funds and grants), medium-term horizon, commissioned in 2025 after 2024 construction. Action 2 - renewable-electricity purchase with Guarantees of Origin across domestic subsidiaries (Spain), delivering "15% reduction in scope 1+2 GHG emissions compared to the base year 2019" in 2024 rising to "22% reduction" in 2025 (vs the 2019 baseline electricity mix). Action 3 - renewable biogas purchase with GoOs for the rail-services activity in Sweden, delivering a further 0.5% reduction in scope 1+2 GHG emissions vs 2019 in 2025 (not applicable in 2024). CAF states the eligible/aligned CapEx for these decarbonisation actions is detailed under the EU Taxonomy disclosure (section 2.1.1).</br>

Targets related to climate change mitigation and adaptation

Reference: pages 152-153 (section 2.2.7); targets also stated pages 132-134 (section 2.2.2).

Scope 1+2 (own operations): reduction vs 2019 base (54,343 tCO2e) of 25.2% (2025 objective), 30.0% (2026), 55.0% (2030), 90.0% (2045); actual reductions achieved were 30.3% (2023), 29.3% (2024) and 32.6% (2025) - ahead of the 2025 objective. Scope 3 category 11 (use of sold products), gCO2/passenger-km intensity: target reductions vs 2019 base (7,499,806) of 35.3% (2025), 40.0% (2026), 55.0% (2030), 97.0% (2045); achieved reductions were 43.4% (2023 wording notwithstanding - the table shows 43.4%/33.1%/46.8% across 2023-2025), exceeding the 2025 objective.

Both targets are SBTi-validated and 1.5C-aligned; methodology follows "the SBTi and within the framework of its commitment to the continuous improvement of environmental performance." "No long-term targets have been set" beyond 2045/2030 milestones shown; objectives will be reviewed alongside the 2027-2030 Strategic Plan and Sustainability Master Plan.</br>

Energy consumption and mix

Reference: pages 153-155 (section 2.2.8).

FY2025 energy consumption (MWh): fossil fuel-based 182,679 (72% of total; crude oil/petroleum 11,916, natural gas 140,337, purchased fossil electricity/heat 30,426); renewable 71,912 (28%; renewable fuel 1,091, purchased renewable electricity/heat 70,655, self-generated renewable 166); total 254,591 MWh, intensity 56.7 MWh/EUR M (down from 61.4 in 2023). Renewable share rose from 26% (2023) to 27% (2024) to 28% (2025).

Renewable energy generation: 3,788 MWh in 2025 (3,003 in 2024; 1,974 in 2023), including hydroelectric output; "At CAF we do not generate energy that is not from renewable sources." 2025 efficiency measures included maintaining 100% renewable-electricity-with-GO coverage at CAF-owned Spanish sites (2025-2028 contract), commissioning the new Beasain heat-treatment line, a 0.079 MW rooftop photovoltaic installation at a Solaris warehouse, and energy audits. No coal, nuclear or other fossil-fuel-source consumption was recorded.</br>

Gross Scopes 1, 2, 3 and Total GHG emissions

Reference: pages 156-159 (section 2.2.9).

FY2025 (tCO2e): Scope 1 31,728 (2024: 31,166; 2019 base: 34,707; +2% YoY); Scope 2 market-based 6,141 (2024: 7,277; 2019: 19,636; -16% YoY), location-based 13,832; Scope 1+2 market-based total 37,869 (-2% YoY); Scope 3 3,402,232 (2024: 3,642,717; 2019: 7,623,373). Calculation follows ISO 14064:2018 and the GHG Protocol, operational-control consolidation, using Greemko carbon-accounting software "approved by an independent auditor."

Scope 3 included categories: purchased goods and services (1), upstream transport (4), waste (5), business travel (6), employee commuting (7), downstream transport (9), use of sold products (11) and franchises (14); categories 2, 3 and 15 are excluded for low significance, 8/10/13 as not applicable, 12 for lack of data. "81% of the Scope 3 activity data... comes from primary data" for categories other than 11 (which is entirely modelled from vehicle-use projections). "In CAF we have not identified biogenic emissions or the presence of PFC, SF6 and NF3 gases." 79% of electricity consumption is renewable with GO, delivering a 61% cut in Scope 2 vs the 2019 base.</br>

GHG removals and GHG mitigation projects financed through carbon credits

Reference: page 162 (section 2.2.10).

CAF reports a complete nil return rather than silence: "Over the course of 2025, we have neither contributed to the elimination of GHG in our own operations nor in our value chain, nor have we had GHG mitigation projects financed by carbon credits." It also states "CAF has not made any public statements involving the use of carbon credits." Appendix 3.1's content index maps E1-7 to this section with a page reference, confirming the company treats the requirement as covered even though the substantive answer is "none to report."

Looking ahead: "In order to meet our target of reaching Net Zero by 2045, a plan to neutralise residual emissions will be drawn up in the coming years" - i.e. no removals strategy exists yet.

Internal carbon pricing

Reference: pages 162-164 (section 2.2.11).

CAF has developed, but not yet operationalised in reporting, an Internal Carbon Price (ICP) "as a strategic tool for integrating the cost of GHG emissions into corporate decision-making processes." Scope covers CAF's main train and bus manufacturing operations in Spain, Poland, France, Sweden and the United States (selected as the largest emission sources within the vehicle business line), plus Scope 3 categories 1 (purchased goods and services), 4 (upstream transport), 9 (downstream transport) and 11 (use of sold products).

Methodology: the "Shadow Price" technique - "assigning an economic value to CO2 emissions even in the absence of an explicit cost in the market" - built on science-based climate trajectories, regional carbon-price differentiation, anchoring to real market signals, a Country Alignment Index adjustment, and evolution of the price over time.</br>

Policies related to pollution

Reference: pages 166-168 (section 2.3.2).

Pollution materiality is scoped to air pollution: the Double Materiality Assessment identified "aspects related to air pollution and to the use and management of substances of concern and very high concern... as material, with the sites where manufacturing plants are located being those with the highest probability of generating impacts associated with pollution" (page 165). The governing policy is again the Environmental Policy (CTO-owned, ISO 14001/14064, GHG Protocol, ESPR, REACH), supported by the Ecodesign Policy and the Purchasing Policy / Supplier Code of Conduct (extending pollution-prevention expectations to suppliers). Later in the same section CAF confirms: "Air pollution is the only topic related to Pollution (E2) that has been material for CAF" (page 172) - i.e. water/soil/living-organism pollution and microplastics were screened and found not material.

Actions and resources related to pollution

Reference: page 169 (section 2.3.3).

Action: air pollution engagement initiatives, developed within the Basque Ecodesign Centre (a public-private collaboration on ecodesign and circular economy, of which CAF is a member). CAF "developed a common methodology that allows us to control and unify the information relating to atmospheric emissions generated at the Group's different sites, in order to report the overall consolidated results in this report," intended to support "more precise and homogeneous emission reduction targets in the coming years." A parallel workstream extends ISO 14001:2015 certification coverage across the Group. Scope: "All activities and geographical areas in which the CAF Group is present," medium-term horizon; 2025 results confirm certification coverage was maintained and emissions-control/reporting continued as planned.

Targets related to pollution

Reference: page 170 (section 2.3.4).

The only quantified E2 target is ISO 14001:2015 certification coverage: "Ensure that at least 85% of the Group's workforce is ISO 14001:2015 certified," 2026 objective 88%; base year 2020 = 65%, with coverage of 84% in 2025 (85% in 2024, 83% in 2023) - the small 2025 dip is explained as workforce growth outpacing certified-site headcount, "the number of certified companies has been maintained; however, the increase in the Group's workforce has affected the evolution of the percentage."

For substances: "At the time of reporting, we have not set specific targets for the prevention and control of substances of concern and very high concern; however, we are actively pursuing monitoring and data collection as a step towards defining future targets" - a stated gap, not a silent omission.

Air, water and soil pollution

Reference: pages 171-172 (section 2.3.5). Scope: air pollution only, per Regulation (EC) 166/2006 Annex II, excluding GHGs.

Pollutant emissions, tonnes: Railway segment 2025 - solid particles 4,917, NOx 4,784, CO 5,126, VOCs 42,622; Bus segment 2025 (2024 data used, "data for 2025 are not available") - solid particles 510, NOx 2,802, CO 5,257, VOCs 105,189. "We have not identified significant changes in the evolution of atmospheric emissions over time." Methodology follows direct measurement and the E-PRTR calculation procedure, covering CAF S.A., CAF USA and bus manufacturing sites. "The Group has not identified the generation or material use of microplastics in our processes." Water and soil pollution were not identified as material sub-topics and carry no figures here.

Substances of concern and substances of very high concern

Reference: pages 172-173 (section 2.3.6).

CAF states it cannot fully quantify substances of concern (SoC): "due to the absence of a clear European regulatory reference framework setting out what is meant by substances of concern, the absence of a supply chain reporting obligation for such substances... makes quantitative reporting of the use of such substances impossible." On its own operations: "due to the production nature of CAF, we do not directly generate or acquire substances of very high concern, nor do we emit such substances during production processes or during the use of our products" - the inflow/generation/emission limbs are addressed with a nil-to-own-operations answer, though purchased electronic articles do contain SVHCs.

Scale estimate: "90.1%" of sales (rolling components, rail vehicles and buses) is associated with products containing these substances, "present in very small quantities, mainly in electronic components," and "covers approximately 70% of the Group's sales." CAF is "in the process of identifying and cataloguing all substances of very high concern in our product portfolio" and complies with REACH and the Railway Industry Substance List (RISL, UNIFE). No SoC/SVHC quantities by hazard class (paragraph 34's outflow limb) are given, and the report explains this as a lack-of-framework limitation rather than silence.

Policies related to resource use and circular economy

Reference: page 176 (section 2.4.2).

Framed around three levers: Responsible Purchase - the Supplier Code of Conduct extends "the duty to carry out their activities under the premise of minimising negative environmental impacts and preventing pollution"; Innovation and Ecodesign - Environmental Product Declarations, an ecodesign methodology, energy-efficiency improvements, alternative fuels, longer useful life/recyclability, and noise/vibration reduction; Production/Life-cycle - "96% of all the hazardous and non-hazardous waste generated has been recovered," and "average recyclability for trains is 93% and for buses it is 96%." The Ecodesign Policy (CTO-owned) is the primary governing document, alongside the Purchasing Policy and Supplier Code of Conduct.

Actions and resources related to resource use and circular economy

Reference: page 179 (section 2.4.3).

Action: Ecodesign Programme, integrating environmental criteria into product design across the full life cycle. CAF participates in Rail4Earth, UNIFE's "Life Cycle Assessment" working group, the RTR Initiative and Railsponsible. 2025 expected/achieved results: an Ecodesign Manual, a methodology for eco-design actions with published monitoring indicators, a formalised policy governing procurement of substances of concern and SVHC in rail-vehicle manufacturing, and initial commercial-agreement discussions with key suppliers on inflow/outflow circularity targets. Scope: "All activities and geographical areas in which the CAF Group is present," medium-term horizon.

Targets related to resource use and circular economy

Reference: pages 182-183 (section 2.4.4).

Metrics tracked include circular content of newly-developed rail vehicles and buses (percentage of total vehicle weight from secondary/rapidly-renewable/reused material), recyclability rate of rail vehicles with environmental declarations (weighted average per ISO 21106) and of buses, and percentage of waste recovered. The recyclability-rate metric for buses is confirmed at 96% in the table. Associated IRO No. 50-IP: "Contribution to the circular economy in the Group's own operations, through the design, manufacture, maintenance, repair and modernisation of products and components." Methodology and significant assumptions are tied to the same ISO 21106/ISO 22628 basis used for E5-5 recyclability reporting.

Resource inflows

Reference: page 186 (section 2.4.5).

"In 2025, we have worked with a total of 76,250 tonnes of raw materials that are transformed in the production process of the vehicle manufacturing activities (trains and buses) and rolling components." Split: biological raw materials 460 t (0.6%) - wood for bus flooring; technical raw materials 75,790 t (99.4%), dominated by steel ingots (57,844 t, 76%) and steel and aluminium profiles/sheets (17,066 t, 22%), both classified non-renewable, plus "Other" (adhesives, 880 t, 2%). 2024 comparatives: 16,938 t steel/aluminium profiles, 57,159 t steel ingots; 2023: 14,601 t and 53,596 t. CAF states materials purchased are "already processed materials, included in components, with metal being the most common element," and all raw materials acquired "are recyclable."</br>

Resource outflows

Reference: pages 189-190 (section 2.4.6).

Main product families: rail vehicles, buses/trolleybuses, railway components (bogies, wheels, axles, gearboxes, energy-storage and signalling systems), plus maintenance/modernisation services. Useful life: railway vehicles 32.7 years average (design target 30-40 years); modernised rail vehicles 20 years; buses 15 years. Recyclability/recoverability rates from published EPDs: railway - recyclability 92.8%, recoverability 95.7%; bus - recyclability 95.7%, recoverability 95.9% (ISO 21106 for rail, ISO 22628 for bus/rail). Products are "generally repairable" and delivered with maintenance manuals; end-of-life manuals are provided "if required by our customers." "We do not have specific programmes for the separate collection of end-of-life products," though electric-bus battery second-life/recycling initiatives have begun. Total waste generated in 2025: 39,904,664 kg (90% non-hazardous, 10% hazardous), of which 96% was recovered (page 190).</br>

Waste

Reference: pages 190-191 (section 2.4.6, "Waste" subsection), and Appendix 7 (page 387).

Total waste: 2025 - 39,904,664 kg (hazardous 3,939,652 kg / 10%; non-hazardous 35,965,012 kg / 90%); 2024 - 40,283,210 kg; 2023 - 36,465,313 kg. "No radioactive waste is generated at CAF." CAF has adhered since 2017 to Spain's Circular Economy Pact (MAPAMA). Management hierarchy: (1) reduce at source (recycled materials, returnable supplies, returning surplus to suppliers); (2) maximise reuse/recycling/recovery - "by 2025, 96% of the total amount of hazardous and non-hazardous waste generated will have been recovered"; (3) awareness campaigns on segregation; (4) defined treatment/management procedures with local waste managers.

Appendix 7 detail (2025, kg): non-hazardous waste - no-disposal routes (reuse, recycling, other reuse) totalled 35,706,669 kg (99% of NHW), disposal routes (incineration, landfill, other elimination) 258,343 kg (1%); packaging waste (wood, paper, cardboard, plastic) recycling alone accounted for 4,668,515 kg. "Actions to combat food waste are not considered because this content is not material to the CAF Group's activity, as concluded from the Double Materiality Assessment."</br>

Policies related to own workforce

Reference: pages 196-198 (section 3.1.2).

Four policies anchor S1: the People Policy (CHRO-owned, ILO guidelines) sets principles for "a safe, fair and inclusive working environment"; the Occupational Health and Safety Policy (CHRO-owned, ILO OSH guidelines) covers own workers and on-site suppliers/subcontractors; the Cybersecurity Policy (Board-owned) and Personal Data Protection Policy (Chief Legal & Compliance Officer) apply Group-wide.

"The people who make up CAF are fundamental to the Group's sustainable development." The People Policy "explicitly address[es] human trafficking, forced labour, compulsory labour and child labour" (Principle 7, "Eradicate child and forced labour"), cross-referenced to the Human Rights Due Diligence Policy sections 5.3.5 and 5.2.1. Remedy runs through the Internal Reporting System, with a dedicated workplace-issues channel covering harassment (including psychological, sex-, orientation- and identity-based) and working-conditions complaints. Policies are on the corporate website except the Personal Data Protection Policy (available on request).</br>

Processes for engaging with own workforce and workers' representatives about impacts

Reference: pages 202-203 (section 3.1.3).

A European Works Council Negotiating Commission was created in 2024 (15 representatives from 8 countries plus Central Management), under Directive 2009/38/EC. In 2025, 67% of the Group's workforce is subject to a collective agreement and 68% is represented by legal representatives; all parent-company and national-subsidiary employees are covered by sectoral/company agreements.

Effectiveness is tracked via the Organisational Health Index (biennial Employee Satisfaction Survey, 94% coverage in 2025), which "improved by one tenth of a point... to stand at 6.8." Occupational Health and Safety Committees operate at every main manufacturing site, "represent[ing] 95% of the Group's total employees in Occupational Health and Safety matters." An Equality Committee oversees equality plans and monitors indicators for vulnerable groups.</br>

Processes to remediate negative impacts and channels for own workforce to raise concerns

Reference: page 204 (section 3.1.4).

Accident/incident investigation is central: "we highlight the investigation of accidents and incidents, the objective of which is to adopt the necessary measures to avoid their repetition," identifying hazards, assessing risk and determining root causes per defined procedures, followed by statistical analysis and application of the standard risk-control hierarchy (elimination, substitution, engineering controls, signage/administrative controls, PPE). Reporting is encouraged through informative campaigns "as part of the continuous improvement process."

The Internal Reporting System (whistleblowing channel) is the cross-cutting remediation route for own-workforce complaints, integrating all reporting channels into one platform, with retaliation protection, described in full under section 4.1.9.

Taking action on material impacts on own workforce

Reference: pages 204-206 (section 3.1.5).

Priority areas: "working conditions, occupational health and safety, equal treatment and opportunities, professional development and personal data protection." Global Talent Management Strategy (associated IROs 59-IP, 63-IP, 55-IP, 64-IP, 57-IP, 117-IN, 43-R, 99-O, 44-O): 2025 results include Regional Top Employer certification for Europe (Spain, France, UK, Germany, Poland) and an improved Merco Talent 2025 ranking (82nd overall, up from 100th; 2nd in the industrial sector, up from 4th); a job-role-and-pay framework deployed to all businesses in Spain and Poland (incorporating the Willis Towers Watson valuation method into the parent company's equality plan); and a shared Diversity, Equity and Inclusion plan. Effectiveness is "assessed periodically by means of quantitative and qualitative indicators, including the results of the satisfaction and commitment surveys."</br>

Targets related to own workforce

Reference: page 207 (section 3.1.6).

Organisational Health Index (IRO 63-IP): target 6.8 for 2025/2026, achieved 6.8 in 2025 (6.7 in 2024, 6.6 in 2023; base 2018 = 6.04). ISO 45001 certification coverage (IRO 61-IP): "aim to maintain coverage above 90%"; achieved 88% in 2025 (83% in 2024; base 2020 = 45%), 2026 target 90%. Preventive culture index (1-4 scale): achieved 3.0 in 2025 (2.96 in 2024; base 2020 = 2.8), target "above 3." Frequency rate (accident ratio, IRO 51-R): "continue to reduce"; achieved 13.8 in 2025 (13.8 in 2024, 14.1 in 2023; base 2020 = 18.0), 2026 target 13.5.

Characteristics of the undertaking's employees

Reference: page 209 (section 3.1.7).

Headcount at year-end 2025: 14,644 male (82%) and 3,144 female (18%) = 17,788 total; permanent-employee ratio 92%. Age split: under 30 - 2,903 (16%); (the 30-50 and over-50 bands continue in the same table). "The annual average number of part-time contracts is not broken down by gender, age and professional classification, as they do not represent a significant proportion of the Group's workforce."

Working-hours regulation is set per country/collective agreement; remote work is permitted for 20%-60% of the working timetable at several key legal entities, alongside digital-disconnection rules.

Collective bargaining coverage and social dialogue

Reference: pages 216-217 (section 3.1.8).

By region, 2025: Europe - collective-bargaining coverage 71%, social-dialogue/representation 73% (Spain 100%/92%; Poland 0%/34% - "Work Regulations" not counted as agreements under the GRI definition; France 100%/99%; Sweden 100%/98%; UK 38%/38%; rest of Europe 63%/23%). America - coverage 44%, dialogue 43% (Mexico 16%/16%; Brazil 100%/100%; Chile 81%/81%; US 0%/0%). Rest of world: coverage 6%, dialogue 2%.

CAF notes the social-dialogue percentage "is published as of financial year 2024, in accordance with sustainability regulations (CSRD and ESRS standards)," and flags several prior-year transcription-error corrections (e.g. UK 2023/2024 dialogue restated from prior figures to 38%/99%/100% as applicable).</br>

Diversity metrics

Reference: page 217 (section 3.1.9).

"Women represent 18% of the workforce and occupy 30% of Senior Management (three women and seven men), including those who are also Executive Directors" - using the CNMV Circular 3/2021 definition of senior management (executives reporting to the Board or CEO, plus the internal auditor). Age-band and gender distribution are cross-referenced to the S1-6 employee table (section 3.1.7). "At CAF, we incorporate the perspectives of gender, inclusion and diversity across the board in our operations, knowledge management and technical assistance."</br>

Adequate wages

Reference: page 218 (section 3.1.10).

"CAF is committed to offering people salaries that ensure a decent standard of living," with equal-pay mechanisms irrespective of gender, race, sexual orientation, gender identity, ethnicity, disability, age or religion, governed by the People Policy. Salary levels use specialist-consultant market benchmarking. "A comparative living wage analysis has been carried out on employee salary levels using benchmark indices recognised by the HDI, as well as other supplementary living wage reference sources specific to the region. This analysis has concluded that the remuneration of all CAF employees is above the living wage."

A 2024-initiated job-role and pay framework (global scope, railway and bus support/business functions) progressed further in 2025 (see S1-4).

Persons with disabilities

Reference: page 218 (section 3.1.11).

"We have 133 disabled employees in the Group, representing less than 1% of the Group's workforce (140 in 2024)." Compliance is achieved "through the direct hiring of workers with a certified disability and through the adoption of alternative measures envisaged in current legislation" per country. Universal accessibility extends to CAF's products: rail rolling stock follows the EU Technical Specification for Interoperability and Accessibility for Persons with Reduced Mobility (2014); city buses follow Directive 2007/46 (as amended by Regulation (EU) 2017/2400) and UNECE Regulation 107. The corporate website follows W3C WAI 1.0 accessibility guidelines.</br>

Training and skills development metrics

Reference: pages 219-220 (section 3.1.12).

Training runs through the Talent Hub learning ecosystem, aligned to "four strategic axes: commercial focus, operational efficiency, innovation and sustainability." Process design: a training-needs assessment (vertical by function, horizontal for cross-cutting subjects such as OHS, quality, product safety, and compliance), followed by implementation and three-level assessment (satisfaction, effectiveness, annual review). "Managing learning processes in a holistic, agile and practical way is critical for teams to contribute as much as possible to the competitiveness of our company."</br>

Health and safety metrics

Reference: pages 221-222 (section 3.1.13).

"In 2025, we achieved the target set for our own employed personnel, with 88% of the Group's total workforce covered by an OHS management system certified under the requirements of ISO 45001:2018," driven by new certifications at CAF Brasil, Rail Line, Sermanfer, Ctrens and CAF Power & Automation (the last two certified January 2026). "As far as own non-salaried personnel are concerned, no information is available on the percentage of members covered."

Management system components: risk assessment covering CAF's own and third-party facilities including subcontractor coordination; annual Occupational Risk Prevention Plans reviewed by the OHS Committees; and preventive control activities - safety inspections, work observations, management safety walks, PPE management, safety procedures/instructions, and emergency-response mechanisms at every manufacturing site.</br>

Pay metrics (pay gap and total compensation)

Reference: page 230 (section 3.1.14).

"The pay gap in the Group's activities as a whole is -1.3%" (average pay: female EUR 46,845.33, male EUR 46,235.88); hourly pay gap -1.6%, average hourly pay EUR 25.11. By age: under-30 gap -12.8% (women paid more), 30-50 gap -4.5%, over-50 gap +9.2% (men paid more). By professional group: employees +13.0% (avg EUR 55,484.78 vs EUR 46,235.88... table shows EUR 55,484.78 for employees); operators +20.6% (avg EUR 35,543.23). "On average, men's length of service across all CAF activities is 22% higher among employees and 45% among operators," identified as a driver of the gap alongside the asymmetric gender distribution across professional groups.</br>

Incidents, complaints and severe human rights impacts

Reference: page 232 (section 3.1.15).

"In 2025, no cases of protected discrimination were confirmed (whether based on gender, racial or ethnic origin, nationality or religion or beliefs, disability, age, sexual orientation or other relevant forms of discrimination), including harassment. Consequently, no fines, sanctions or compensation for damages have been imposed in this regard." "No cases of human rights violations among employees employed directly or through business relationships by the Group have been processed, nor have any fines or penalties been imposed for this reason."

Policies related to workers in the value chain

Reference: pages 240-243 (section 3.2.2).

Governing instruments: the Purchasing Policy (CFSO-owned, Global Compact / OECD Due Diligence Guidance / Railsponsible / SRI), the Supplier Code of Conduct (CFSO-owned, UN Guiding Principles, International Human Rights Charter, ILO Declaration, OECD 2023), the Crime Prevention, Anti-Corruption and Anti-Fraud Policy and the Conflict Minerals Statement (tin, tantalum, tungsten, gold - OECD 3TG guidance and EU Regulation 2017/821). The Supplier Code of Conduct "establishes the requirements suppliers must meet in relation to Human Rights, including the prohibition of child and forced labour," extends "Environment, Anti-Corruption and Bribery and Cybersecurity" standards down the chain, and requires 100% of suppliers to accept it (or an equivalent validated code) via the ARIBA SLP compliance questionnaire. CAF is a member of Railsponsible and EcoVadis's Sustainable Rail Initiative (SRI).</br>

Processes for engaging with workers in the value chain about impacts

Reference: pages 243-245 (section 3.2.3).

Engagement is indirect, via due diligence: supplier registration/qualification, sustainability assessments (EcoVadis IQ + Vitals, biennial reappraisal, country/sector risk analysis), and ARIBA Risk continuous monitoring, plus on-site audits when required. "We do not currently have global framework agreements or agreements with international trade union federations," but rely on internal policies and UN/ILO/OECD reference principles.

111 suppliers are specifically selected under the Responsible Purchasing Programme "for the relevance of the ethical and social aspects associated with their activity." Supplier satisfaction survey results: 8.49/10 overall, 8.24/10 for communication-channel satisfaction. CAF is evaluating EcoVadis Worker Voice Connect as a dedicated worker-complaint channel; the Internal Reporting System is otherwise the cross-cutting route.

Processes to remediate negative impacts and channels for value chain workers to raise concerns

Reference: page 245 (section 3.2.4).

Formal remediation sequence: "analysis and assessment... dialogue with the supplier involved to agree on appropriate remedial action... definition and implementation of a corrective action plan with specific, verifiable, time-bound measures... continuous monitoring." Channels available to value-chain workers: CAF's own communication channels; a dedicated mailbox esg@caf.net for Supplier Code of Conduct conflicts/violations; and the Internal Reporting System (whistleblowing channel), open to "all of our stakeholders, including workers in the value chain, regardless of their contractual relationship." "In 2025, no notifications of conflicts of interest or violations of commercial ethical principles were received through this reporting channel from suppliers."</br>

Taking action on material impacts on value chain workers

Reference: page 246 (section 3.2.5).

Action 1 - digital supplier evaluation/monitoring (IROs 5-IN, 74-IN): EcoVadis IQ + Vitals, ARIBA Risk and SAC Analytics deployed to identify labour and human-rights risks. 2025 results: 74% of Target suppliers with completed rating assessments, 57.4% coverage of purchases with Target suppliers, and a named manager per subsidiary. Action 2 - reinforcement of the Supplier Code of Conduct, mandatory for all suppliers, prohibiting child/forced labour and requiring whistleblowing channels. Scope: "all suppliers, prioritising Target and suppliers located in geographic areas with the greatest social and human rights challenges."</br>

Targets related to workers in the value chain

Reference: page 251 (section 3.2.6).

Target 1 (IRO 74-IN, child/forced labour risk): reach 85% of Target suppliers with an ESG-risk assessment and remediate any identified cases through corrective plans; achieved 74% in 2025 (75% in 2024), against a base of 67% in 2023; 2026 objective 80%, 2025 objective already 85% per the target row. Target 2 (IRO 5-IN, value-chain worker health and safety): coverage of suppliers under a [named OHS-related programme] is tracked as a further metric in the same table (page 251), continuing the pattern of supplier-coverage KPIs tied to specific material IROs.

Policies related to affected communities

Reference: pages 253-255 (section 3.3.2).

Lead policy: the Code of Conduct, establishing "the ethical principles, values and standards of behaviour that must guide the actions of all people and entities of the Group and its stakeholders," Board-owned. Supported by the Sustainability Policy and the Human Rights Due Diligence Policy (both Board-owned, referencing the UN Guiding Principles, International Human Rights Charter, UN Global Compact, SDGs, ILO Declaration, OECD Guidelines 2023 and OECD Due Diligence Guide 2018). Affected-community due diligence is cross-referenced to section 1.2.4 (CAF's Due Diligence Statement).

Processes for engaging with affected communities about impacts

Reference: page 255 (section 3.3.3).

"The Group engages with its Human Rights stakeholders throughout the different phases of its activities and projects, through consultation and dialogue processes integrated into its due diligence system. This collaboration takes into account particularly vulnerable groups, including indigenous communities, and serves as a basis for the identification and management of risks and impacts." Full phase-by-phase detail, including indigenous-peoples safeguards, is cross-referenced to section 1.2.4 (CAF's Due Diligence Statement).

Processes to remediate negative impacts and channels for affected communities to raise concerns

Reference: page 255 (section 3.3.4).

Remediation and reporting follow the Human Rights Due Diligence Policy and Procedure. The Internal Reporting System "acts as a publicly accessible mechanism for reporting potential human rights violations related to the Group's operations or those of our business partners," cross-referenced to sections 4.1.9 (Internal Reporting System) and 1.2.4.6 (Human Rights Complaint Handling).

Taking action on material impacts on affected communities

Reference: page 256 (section 3.3.5).

Action: improving management of affected-groups' interests (IRO 82-IN): defining a global local-communities strategy and updating the social-action procedure. 2026 target: "have established and begun to deploy a strategy for the management of local communities and develop the Corporate Social Action Procedure." 2025 progress: "the specific actions foreseen for the relevant projects have been assessed in order to define a future standardised procedure and metrics." Performance metrics here "are qualitative... to date, they have not been validated by an external body." "No human rights violations have been identified in the course of the financial year."

Targets related to affected communities

Reference: page 257 (section 3.3.6).

"At the time of reporting, we do not have measurable, results-oriented objectives specifically linked to community management, as we manage this area mainly through qualitative action frameworks based on continuous dialogue, collaboration and adaptation to the particularities of each local context and project." CAF states it plans to move forward in defining such objectives, consistent with the qualitative, not-yet-externally-validated metrics described under S3-4.

Policies related to consumers and end-users

Reference: pages 259-264 (section 3.4.2).

Cybersecurity Policy (Board-approved 10 October 2024): protects "critical data, systems and operations" on confidentiality/integrity/availability/authenticity/traceability principles, requiring security-by-design across the product lifecycle. Quality Excellence Policy: systematic risk identification for products/services, passenger-safety and satisfaction data; certified to ISO 9001 and IRIS (Silver recognition achieved in 2025 for Rolling Stock and Wheelset). Products and Services Safety Policy: safety-management systems verified against EU Regulations 402/2013 and 779/2020 and EN 50126 (RAMS), overseen by the Corporate Safety Committee. Supporting policies: the Ecodesign Policy and the Human Rights Due Diligence Policy (passenger dignity and fundamental rights).</br>

Processes for engaging with consumers and end-users about impacts

Reference: page 264 (section 3.4.3.1).

"As a manufacturer of trains and buses, our interaction with passengers is limited." CAF's direct customers are transport operators, who translate passenger needs into vehicle specifications that CAF must meet to win orders. Indirect passenger-insight channels: regular meetings and annual customer satisfaction surveys with operators; sector research via bodies such as the International Rail Quality Board (IRQB); and trade-fair participation. Inputs feed design improvements in "passenger comfort, improving energy efficiency and incorporating accessible features for people with reduced mobility."</br>

Processes to remediate negative impacts and channels for consumers and end-users to raise concerns

Reference: pages 267-269 (sections 3.4.4-3.4.4.1).

"Although no current negative impacts have been identified in our Double Materiality Assessment, we recognise the possibility that they may arise in the future." Complaints/claims are monitored through transport operators, externally audited annually under ISO 9001 / IRIS, with a dedicated Internal Reporting System channel also open to passengers. In 2025, two new corporate procedures (complaints, claims) were defined with shared receive-register-analyse-respond-close stages. 69 new customer complaints were received (57 railway, 12 bus), of which 33 were closed by year-end; a new satisfaction-survey question on complaint resolution scored 7.8/10 average.</br>

Actions and resources related to consumers and end-users

Reference: page 269 (section 3.4.5).

"Regarding the measures taken on negative material impacts in relation to our passengers, no specific measures have been taken as there have been no negative impacts identified." CAF instead maintains "a proactive approach in order to remedy any negative impact that may occur," operationalised through the newly-defined Customer Complaint and Claims Management procedures described under S4-3, with uniform 2025 metrics for traceability and resolution tracking.

Targets related to consumers and end-users

Reference: page 274 (section 3.4.6.1).

Cybersecurity-linked targets (IRO 107-IP): "Number of cybersecurity communication pills" sent to employees - achieved 18 in 2025 (15 in 2024; base 2024 = 15), target ">15" for both 2025 and 2026; "Number of social engineering campaigns" (phishing tests) - achieved 6 in both 2025 and 2024, target ">15" is shown against the pills metric while campaigns carry their own target row in the same table, aimed at improving "cybersecurity culture and awareness" across all Group entities.

Corporate culture and business conduct policies

Reference: pages 280-283 (sections 4.1.3-4.1.3.1).

The Code of Conduct (initial version 27 July 2011, kept updated by the Board) "reflects a statement of compliance at the highest level... and is the cornerstone that serves as the basis for internal policies and operating standards," grounded in the International Bill of Human Rights, the UN Global Compact, the UN Guiding Principles on Business and Human Rights, the OECD Guidelines (2023) and the ILO Declaration. It is "mandatory for both Members of the Group and Business Partners."

Behavioural criteria span business ethics/due diligence/human rights/sanctions; crime prevention, anti-corruption and conflicts of interest (2025 update: revised Crime Prevention, Anti-Corruption and Anti-Fraud Manual); competition and promotional activity; market abuse; data protection; cybersecurity and AI use; fiscal responsibility; occupational health & safety and equality; and quality/reputation/sustainability commitments.</br>

Supplier relationship management

Reference: page 288 (section 4.1.4).

The Purchasing Policy "establishes principles and guidelines that integrate ethical compliance, sustainability and the promotion of competitiveness," applied through a risk-based pre-qualification process covering sustainability, environmental, climate, human-rights and compliance risk. Monitoring tools: EcoVadis IQ + Vitals (real-time risk scoring across sustainability, ethics, environment, labour, human rights and anti-corruption), ARIBA SLP (qualification/certification tracking - ISO, IRIS, OHSAS, Supplier Code of Conduct) and ARIBA Risk (sanctions-list and financial screening via D&B/Exiger). "During 2025, 74% of Target suppliers (491 of 666) were assessed according to our approach," with no qualification blocks or significant Code-of-Conduct deviations identified.</br>

Prevention and detection of corruption and bribery

Reference: page 304 (section 4.1.11.2).

CAF's Crime Prevention and Anti-Corruption and Anti-Fraud Policy "lays the foundations for uniform application of the corruption prevention principles for all the countries in which the Group operates," complemented by the Anti-Corruption Management System. Defined prohibited acts: corruption, bribery and fraud (with facilitation/extortion payments explicitly covered); defined acts subject to control: gifts and hospitality, relations with public officials, and donations/sponsorship/partnership agreements. "As a result of the update of the Crime Prevention and Anti-Corruption and Anti-Fraud Manual, specific training on Crime Prevention and Anti-Corruption for the members of the Board of Directors has been provided during the 2025 financial year." Named principal risks: "corruption between individuals... bribery... corruption in international transactions... influence peddling; and... illegal financing of political parties," plus money laundering. Highest-exposure functions: "directors, area managers or project managers, within purchasing, business strategy and sales, accounting and finance, institutional relations, recruitment and personnel management, exports."</br>

Targets related to business conduct

Sourced from the MDR-T/GDR-T objectives disclosed under the cybersecurity sub-topic of the Business Conduct chapter (section 4.1.15.2, page 312), since G1-3 became a standalone targets DR only in the 2025/2026 ESRS; under the 2023 ESRS this report was prepared against, business-conduct targets fall under MDR-T rather than a numbered G1 disclosure requirement.

Tied to IRO No. 86-R ("Reduced revenues due to reputational impact and disruption of operations and increased costs to repair systems affected by cyberattacks"), CAF's Business Conduct chapter carries stated, outcome-oriented targets: "Ensure zero serious cybersecurity incidents" (achieved: 0 major incidents in both 2024 and 2025) and "Ensure zero incidents related to the GDPR" (achieved: 0 in both years), plus awareness-building targets (">15 cybersecurity communication pills" - achieved 18 in 2025; ">5 social engineering campaigns" - achieved 6) and a resilience target ("improve resilience and risk management... 1+9 cyber exercises/simulations" planned against 1+7 achieved in 2024). "No long-term targets have been set for these metrics. The objectives will be reviewed in the new strategic cycle, together with the publication of the Strategic Plan and the Sustainability Master Plan 2027-2030."</br>

Incidents of corruption or bribery

Reference: page 304 (section 4.1.11.3).

"There have been no cases of corruption or bribery during the 2025 financial year, likewise, there have been no convictions or fines for violations of anti-corruption laws." CAF adds explicitly: "No action is warranted, as no cases of violation of anti-corruption and bribery procedures or standards have been recorded," and the fines/convictions/actions-taken datapoints "are not applicable, as it is stated that there have been no cases of corruption or bribery, convictions or fines for breaches of anti-corruption laws during the financial year 2025."</br>

Payment practices

Reference: page 313 (section 4.1.16).

"The 2024 Double Materiality Assessment established that the issue of 'Late payments to suppliers (especially SME suppliers)' is a material concern for CAF," incorporated into the Sustainability Master Plan. "The Group's average ratio of transactions settled in 2025 was 62 days (63 days in 2024)," with dispersion by jurisdiction: Spain 75 days (76 in 2024, "the Group is making an effort to reduce payment times"), rest of Europe 51 days (56 in 2024), rest of world 52 days (45 in 2024). CAF has created a reverse-factoring-without-recourse service in Spain: "at 31 December 2025, 222 suppliers have access to this policy, with a total of EUR 279 million paid out in 2025 through this method" (247 suppliers, EUR 292M in 2024). "During the 2025 financial year, the Group had no legal proceedings due to late payments."</br>