Croatia osiguranje d.d.

The role of the administrative, management and supervisory bodies

Reference: page 9.

The Company's governing bodies are the Management Board, the Supervisory Board and the General Assembly. The Management Board "is responsible for supervising the impacts, risks and opportunities related to sustainability at the highest management level," and within that role it "validates the materiality assessments of identified impacts, risks and opportunities through the double materiality assessment process," "adopts decisions aimed at integrating sustainability factors into business processes," "defines or approves the proposed targets," "approves sustainability policies" and "approves the annual Sustainability Statement" (p.9).

Board composition and diversity are disclosed: the Management Board is 25% women / 75% men, and 28.57% of Supervisory Board members are independent (p.9). One Supervisory Board member is an employee representative elected by the workforce; Matilda Mrković Kalik was elected to that seat for a four-year term from 11 March 2026 (p.9). The Audit Committee oversees sustainability reporting and assurance, and the Nomination and Remuneration Committee reviews the Remuneration Policy through which sustainability factors are integrated into incentive schemes (pp.10-11).

Information provided to and sustainability matters addressed by the administrative, management and supervisory bodies

Reference: pages 9-11.

"The Company's Management Board is informed twice a year about the ongoing activities and the progress in the implementation of goals," and receives "regular updates at period meetings and workshops, especially within the reporting process, including information on material impacts, risks, opportunities, and progress regarding sustainability-related goals and policies" (p.11). In 2025, the Management Board "was involved in the double materiality assessment process and the identification of material impacts, risks and opportunities," whose results are set out in SBM-3 (p.11).

On expertise: the Company "established an ESG function and formed a multidisciplinary ESG team," Supervisory Board members receive sustainability training via the e-learning platform, and senior management "has climate risk management experience within their respective competences such as product development and claims management" (p.11).

Integration of sustainability-related performance in incentive schemes

Reference: page 12.

"The Remuneration Policy for the Members of the Management Board requires that the remuneration system must be focused on the sustainable development of the Company," and variable remuneration "must not encourage the Members of the Management Board... to take unreasonable risks" (p.12). Business performance and non-financial goals affect 25% of annual and 30% of multiannual variable remuneration; in 2025 this covered "the continued development of infrastructure for effective ESG reporting" and "the establishment of performance indicators for material sustainability matters" (p.12).

The Company is explicit about a gap: "Given that the Company has not yet prepared a transition plan for climate change mitigation and has not yet defined the actions and targets for the reduction of GHG emissions, specific issues related to climate and emission reduction targets are not included in the remuneration system for the Members of the Management Board at this time" (p.12).

Statement on due diligence

Reference: pages 12-13.

"As per ESRS requirements, CO Group initiated a detailed due diligence process for managing sustainability issues in 2024, relying on OECD's guidelines for multinational companies." Because of "the high level of uncertainty of the information in the value chain," the Group "used external information sources to conduct due diligence," and applies "transitional provision 10.2 to ensure a comprehensive process" (p.12).

The Statement includes a due-diligence core-elements table cross-referencing where each element is presented: embedding in governance/strategy at GOV-2 (p.11), GOV-3 (p.12), SBM-2 (pp.16-18) and SBM-3 (pp.18-26); stakeholder engagement and impact identification at IRO-1 (pp.27-31) and SBM-3; actions and effectiveness tracking in the topical ESRS chapters (p.13).

Risk management and internal controls over sustainability reporting

Reference: pages 13-14.

The Company "establishes and implements an effective internal control system in all areas of its business," organised on "a three-level internal control model": process owners (first level), control and key functions (second level), and internal audit (third level) (p.13). Sustainability reporting risk "is monitored within the Database of Operational Risks and Internal Controls," and in 2025 "the sustainability reporting process was formalised through the Sustainability Reporting Rulebook, applicable to all related companies within CO Group" (p.13).

The Company states plainly that it "is aware of the need to substantially improve and formalize the process in the coming reporting years," with further optimisation – including data gathering and processing – planned for 2026 (p.14). An Internal Control Committee oversees the system, and results feed an annual Report on the Adequacy of Procedures reviewed by the Management Board and noted by the Supervisory Board (p.14).

Strategy, business model and value chain

Reference: pages 14-16.

Insurance and reinsurance are CO Group's core segments; related activities span "pension fund management, performance of vehicle testing, provision of healthcare services, and real estate management" (p.14). CO Group operates in Croatia, Bosnia and Herzegovina, Serbia and North Macedonia, with 2025 headcount of 2,992 / 271 / 521 / 271 respectively (p.15). "At this time, the Company has not defined specific sustainability-related goals in terms of significant groups of products and services, customer categories, geographical areas" (p.15).

Strategy integrates digitalisation with climate: "In 2025, CO Group intensified its efforts to improve the management of its own carbon footprint, and started planning actions to reduce Scope 1 and 2 emissions (renewable energy PPAs)." As at 31 December 2025, 33% of natural-person clients (258,118) had opted into e-invoicing, and over 75% of claims were notified digitally (p.15). The upstream value chain centres on local suppliers and technology providers; downstream on direct sales, brokers and digital platforms across Croatia, Serbia, Bosnia and Herzegovina and North Macedonia (p.16).

Note: CO Group applies the ESRS 1 section 10.4 phase-in relief for SBM-1 paragraphs 40(b) and 40(c) (p.8).

Interests and views of stakeholders

Reference: pages 16-18.

CO Group "recognises the stakeholder groups with a capacity to materially impact the Company's operations... as well as the stakeholders who are materially impacted by the CO Group's activities, as its key stakeholders" (p.17). The Management Board is kept informed "through regular coordination with the managers of the relevant sectors, such as the results of the employee satisfaction survey, results of market research, NPS scoring, and other channels" (p.17).

A stakeholder table sets out purpose and channels by group, covering employees and trade unions (satisfaction surveys, 360 evaluation), business partners and authorities (conferences, industry initiatives), educational institutions (career days, study programmes) and media (press conferences, expert commentary) (pp.17-18).

Material impacts, risks and opportunities and their interaction with strategy and business model

Reference: pages 18-26.

"A total of 114 impacts, risks and opportunities were identified and assessed at CO Group level... of which 45 impacts (18 of which are material impacts) and 69 risks and opportunities (17 of which are material risks and opportunities)" (p.18). The 18 material impacts sit in E1 climate change (GHG emissions from insurance, investments and own operations; green-project investment; energy use), S1 own workforce (seven positive impacts spanning working conditions, equal treatment and training), S3 affected communities (economic stability/resilience, financial and digital literacy, education collaboration), S4 consumers (user-data privacy risk; economic stability/resilience) and G1 (supplier and partner relations management) (pp.19-23).

The 17 material risks and opportunities are concentrated in E1 climate adaptation (ten risks including storms, floods, cold wave/frost, reinsurance availability; four opportunities including innovative insurance products and climate-resilient investment), plus S4 irresponsible marketing (risk) and G1 compliance/risk management and cybersecurity (risks) (pp.24-26). E3 (water and marine resources) and S2 (value chain workers) were not identified as material topics in the 2025 DMA.

Note: CO Group applies the ESRS 1 section 10.4 phase-in relief for SBM-3 paragraph 48(e) (p.8).

Description of the processes to identify and assess material impacts, risks and opportunities

Reference: pages 27-31.

"In 2024, CO Group conducted the initial Double Materiality Assessment in accordance with the European Sustainability Reporting Standards (ESRS)," updated in 2025 to reflect "developments in the regulatory environment and stakeholder expectations," which "confirmed the material topics and sub-topics from the previous period, with a revised assessment of one IRO" (p.27). Stakeholders were engaged through "structured interviews" (internal) and "value chain mapping and benchmark analysis" (external, passive) against sources including UNEP FI, S&P, EIOPA, MSCI, SASB, TCFD, CDP and PCAF (p.27).

Impacts, risks and opportunities were scored on defined 1-5 scales for scale, scope, irremediability and likelihood, against materiality thresholds of "3.0 for impact materiality... for actual impacts, 3.5 for... potential impacts, [and] 3.0 for financial materiality" (p.30). Results were "validated by the Company's Management Board and adopted by the Supervisory Board," then consolidated and validated at Adris grupa d.d. level (p.30).

Disclosure requirements in ESRS covered by the undertaking's sustainability statement

Reference: pages 32-35.

"In accordance with the identified material topics and subtopics, based on the results of the Double Materiality Assessment, the Company reports on disclosure requirements in compliance with the relevant material ESRS topical standards," excluding "indicators that relate to sub-topics and sub-sub-topics that are not material to the Group... as well as requirements that are being phased in due to limited data availability" (p.32). "A list of fulfilled disclosure requirements, along with page numbers, is provided in the table below" (p.32).

The printed index (pp.32-35) covers ESRS 2 (BP-1/BP-2, GOV-1 to GOV-5, SBM-1 to SBM-3, IRO-1, IRO-2, MDR-P/A/M/T), E1 (E1-1 to E1-6), S1, S3, S4 and G1-1/G1-2/G1-6. E2, E3, E4, E5 and S2 do not appear, consistent with the DMA in SBM-3. This review classifies each of the 84 disclosure requirement keys against that index; see the accompanying IRO note for the reconciliation of the phase-in carve-outs (E1-9, S1-7, S1-8, S1-12, S1-15) stated separately on page 8.

Transition plan for climate change mitigation

Reference: page 45.

The disclosure is a single, direct statement: "The CO Group does not currently have a defined climate change mitigation transition plan and plans to adopt one in the medium term" (p.45). No decarbonisation levers, GHG reduction targets, capex/opex allocation or governance body approval of a transition plan are therefore described under this requirement; the surrounding E1 chapter (E1-2 to E1-4) sets out the adjacent policy, preliminary actions and absence of quantified targets instead (pp.49-51).

Identification of climate-related risks and scenario analysis

Back-filled from ESRS 2 IRO-1 / the E1 climate-DMA and ORSA sections, where this content is disclosed in the FY2025 report (pages 45-49). This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

Material climate risks are classified by the ORSA process into physical and transition risk, assessed across short- (0-1yr/0-5yr), medium- and long-term horizons (p.45-46). "The Company assesses acute physical climate risks in non-life insurance as material in the short term, while chronic physical risks and transition climate-related risks are assessed as non-material in the short term" (p.46).

Scenario analysis was used: "two scenarios were created that included medium-term and long-term effects of climate change. One scenario uses the assumptions of global temperature increase below 2°C, while the other uses the assumptions of global temperature increase above 2°C" (p.48-49). A severe-convective-storm scenario for Zagreb was modelled with a broker, showing the Group "would remain solvent thanks to the current reinsurance protection... even in a very extreme scenario" (p.49). No named scenario (e.g. SSP, RCP or IEA NZE) or explicit temperature-projection rationale per scenario is given beyond the above/below 2°C split, and assets have not been screened against EU Taxonomy climate-neutral-transition criteria (p.49).

Resilience in relation to climate change

Back-filled from the E1 "Resilience analysis" sub-section, where this content is disclosed in the FY2025 report (page 48). This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

"The resilience analysis covered the Company's own operations, suppliers, and clients. As the assessment moves downstream towards the business portfolio and the market, the level of impact and the potential for climate risk mitigation decreases" (p.48). Resilience is assessed through the ORSA process: "the Company regularly conducts stress testing, develops scenario analyses, and sensitivity analyses... The ORSA Report served as the starting point for conducting the DMA, and climate change risks identified within ORSA were incorporated into the DMA" (p.48).

No significant areas of uncertainty are itemised, and no separate disclosure of financial flexibility or asset redeployment capacity is given; the Company states only that it "plans to gradually adapt its risk assessment process as the identified impacts, risks and opportunities evolve" (p.48).

Policies related to climate change mitigation and adaptation

Reference: page 50.

"During 2025, the Company's Management Board adopted the Climate Change Mitigation and Adaptation Policy, which sets out the principles, objectives and measures for the effective management of material sustainability matters related to climate change, in accordance with the requirements of ESRS E1 Climate Change and the CSRD" (p.50). The Policy covers "climate change mitigation, climate change adaptation and energy," and targets Scope 1 and Scope 2 emissions management, energy efficiency and renewable energy use (p.50).

The Policy applies to the Company and to CO Group undertakings it controls, "to the extent applicable to them and provided that this does not create a risk of non-compliance with local laws." Responsibility sits with the Management Board, with drafting and monitoring delegated to the ESG function / Risk Management unit (p.50).

Actions and resources in relation to climate change policies

Reference: page 50.

The Company is explicit about the current state: "During 2025, the CO Group did not have formally defined climate change mitigation actions, an action plan with related operating or capital expenditure, or adaptation measures classified by type of solution... Accordingly, no analysis of achieved or expected greenhouse gas emission reductions was carried out" (p.50).

Preliminary steps taken in 2025 include "signing of the VPPA contracts that ensured guarantee of origin for electric energy from renewable sources for part of the Company's consumption," and "preparatory activities for investments in renewable energy sources on properties owned by Croatia nekretnine" (p.50). On adaptation, physical and transition risks continue to be assessed through the ORSA process, whose results "are used to strengthen the resilience of its business model, processes and infrastructure" (p.50). "These activities represent initial steps towards the future formalisation of a transition plan" (p.50).

Targets related to climate change mitigation and adaptation

Reference: pages 50-51.

"The CO Group has not yet defined quantified targets for individual performance indicators related to climate change. However, measures and general objectives aimed at contributing to climate change mitigation and adaptation have been identified and established, while the further development of quantified targets is planned in line with regulatory requirements, data availability and the development of internal methodologies" (p.50-51).

Stated (non-quantified) objectives include "reducing Scope 1 and Scope 2 greenhouse gas emissions, increasing the share of renewable energy sources in total energy consumption, and adopting a transition plan for climate change mitigation in the medium term" (p.51), plus strengthening business-model and infrastructure resilience to physical and transition risks and, in the long term, involving suppliers and partners (p.51). No base year, target year, scope or percentage-reduction figure is given.

Energy consumption and mix

Reference: pages 51-52.

2025 Scope 1 fuel consumption: "5,542.01 MWh of natural gas, 100.29 MWh of liquefied petroleum gas (LPG), 356.44 MWh of extra-light fuel oil, 2,981.07 MWh of diesel, 2,557.56 MWh of petrol, and 53.22 MWh of autogas," plus 12.83 MWh of wood-pellet biomass; Scope 2 comprised 8,518.69 MWh of electricity and 1,322.76 MWh of thermal energy (p.51).

Group totals: total energy consumption rose 7.42% year on year to 20,125.00 MWh; the share from fossil sources rose from 83.42% to 85.93%, while the share from renewable sources fell from 10.93% to 9.22% (p.51-52). The Company attributes part of the change to "the opening of new sales locations and the closure of certain locations," improved data availability, and a move to quarterly data collection in 2025 (p.52). A 2025 VPPA between Adris Group and ENCRO "secured" guarantees of origin for renewable electricity covering "a portion of the CO Group's electricity consumption" (p.52).

Gross Scopes 1, 2, 3 and Total GHG emissions

Reference: pages 52-57.

2025 gross Scope 1 emissions were 2,737.43 tCO2e (up 28.01% year on year); gross location-based Scope 2 was 1,991.00 tCO2e and market-based Scope 2 was 5,770.25 tCO2e (down 25.19% and 12.98% respectively) (p.52). Total gross Scope 3 emissions fell 39.13% to 619,514.93 tCO2e, driven by investments (category 15), which fell from 998,188.97 to 599,888.87 tCO2e after a methodology change: "cash and deposits were excluded from the analysis in accordance with the PCAF Guidelines," and "updated emission factors from the Climatiq database were applied to funds and loans instead of the proxy factors used previously" (p.52).

Total market-based GHG emissions fell 38.82% to 628,022.62 tCO2e (from 1,026,584.10 tCO2e in 2024) (p.52). Several Scope 3 categories (purchased goods and services, capital goods, upstream transport, waste, business travel, commuting, upstream leased assets) are carried forward unchanged from 2024 "as the relevant emission categories are not material to the CO Group's overall emissions profile" (p.52).

Policies related to own workforce

Reference: pages 67-69.

"The Company has not adopted a specific policy addressing its own workforce in relation to sustainability factors; rather, this aspect is largely covered within a broader document–the Code of Ethics," alongside the Collective Bargaining Agreement, Work Organization Rulebook, Disciplinary Procedures Rulebook, Rulebook on Occasional Remote Work, Rulebook on Employee Professional Development, and the whistleblowing and data-protection rulebooks (p.67).

"The Company operates in full compliance with all relevant laws; however, it is not formally aligned with any specific international standard regarding the protection of human and labour rights," and workforce policies "do not explicitly address human trafficking, forced, compulsory, or child labour, but these issues are broadly covered under the Code of Ethics" (p.67). During 2025 the Company "began updating its Code of Ethics, inter alia to align it with relevant internationally recognised instruments in the field of human and labour rights," with adoption expected "in early 2026" (p.68).

Processes for engaging with own workforce and workers' representatives about impacts

Reference: pages 69-70.

"Cooperation takes place directly with the workforce and through employee representatives, such as the Union." Worker representation at Supervisory Board meetings occurs "at least quarterly," and the Trade Union "submit[s] quarterly reports in line with legal obligations and hold[s] ad hoc meetings when escalated issues arise" (p.69). "In accordance with the provisions of the Labour Act, before adopting workforce-related policies, the Company conducts consultations with the union representative" (p.69).

Effectiveness is tracked through "analysis of employee feedback and review of agreements reached with the Trade Union," and an annual employee satisfaction survey. Feedback is "recorded in the reports and documentation of the Human Resources Sector" and communicated back "via intranet announcements and email communications" (p.69-70).

Processes to remediate negative impacts and channels for own workforce to raise concerns

Reference: page 70.

The Company "has appointed individuals authorized to receive and handle complaints related to the protection of employee dignity, ensuring that two individuals of different genders have been designated for this role." Additional channels include the Confidential Person for whistleblowing, an email address for reporting Code of Ethics breaches, and an anonymous channel to the Management Board via the internal network "Jenz" (p.70).

These mechanisms "incorporate whistleblower protection principles to ensure privacy and prevent retaliation," and records are accessible "only to designated authorized personnel (the Employee Dignity Protection Officer, the Confidential Person for whistleblowing and the Ethics Committee)," who report proceedings and findings to the Management Board (p.70-71).

Taking action on material impacts on own workforce

Reference: pages 71-72.

"The Company ensures that its business practices do not cause or contribute to significant negative impacts on its own workforce," with salaries revalued continually "using the MERCER methodology" against external benchmarks (p.71). Hybrid and flexible working was formalised following a remote-work pilot, with requests and approvals "supported by a digital solution within the employee application" (p.71).

In 2025 the Company "signed a new three-year Collective Agreement," which "increased [financial benefits] by EUR 1 million on an annual basis," granted "250 awards for excellence and contribution... in the amount of EUR 290,000," and saw "more than EUR 800,000 invested in employees' education and training" (p.71-72). The Company has held the Employer Partner Certificate "for five years," with its 2025 score "two percentage points higher than in 2024" (p.72).

Targets related to own workforce

Reference: page 72.

"CO Group has not defined targets related to its own workforce, as no significant negative impacts have been identified. Although targets have not been established, the Company monitors the effectiveness of measures related to positive impacts on its own workforce" (p.72). No quantified target values, base years or target dates are given; monitoring instead relies on the engagement and certification mechanisms described under S1-2 and S1-4.

Characteristics of the undertaking's employees

Reference: pages 72-73.

CO Group headcount rose 4.51% to 4,055 employees in 2025 (1,484 men, 2,571 women) (p.72). By country: Croatia 2,992, Bosnia and Herzegovina 271, North Macedonia 271, Serbia 521; Slovenia operations "ceased... in May 2025" (p.72). Employee-turnover context is given separately: turnover "is in line with expectations for the insurance industry, where there is a significant number of employees hired in sales... who do not remain with the Company for an extended period" (p.73).

Diversity metrics

Reference: page 73.

At the highest management level (Management Board, Supervisory Board, Sector Directors, key-function holders and affiliate directors), the 2025 gender split was unchanged from 2024 at 22 men (55%) and 18 women (45%) (p.73). By age group, 16.32% of CO Group employees were under 30, 56.21% were 30-50, and 27.47% were over 50 in 2025, with the over-50 share up 18.76% year on year (p.73).

Social protection

Reference: page 74.

"All employees within CO Group are covered by social protection as prescribed by the relevant laws," including "compulsory health insurance, compulsory pension insurance, contributions to the state unemployment fund, sick leave compensation... severance pay in case of termination... parental and paternity leave" (p.74).

Collective Agreement benefits exceeding statutory minimums include "financial solidarity support in cases of long-term illness, severe disability... and severe financial hardship," voluntary pension (third-pillar) contributions, "extended notice periods for employees with disabilities," and additional leave for parents of children with disabilities and for humanitarian activities (p.74).

Training and skills development metrics

Reference: pages 74-75.

"The Company has an implemented talent management and career development process," supported by the CORE competency evaluation, individual Personal Development Plans, and the Total X knowledge portal with the "digital assistant PomagAI" (p.74-75). Sales employees complete "a minimum duration equivalent to 44 hours" of mandatory annual e-learning (p.74).

"In 2025, the average number of training hours per employee within CO Group was 29.7 hours (in 2024: 29.4 hours)." By gender, men averaged 29.1 hours and women 30.1 hours. "All (100%) of CO Group's employees participated in regular performance and professional development reviews" (p.75).

Health and safety metrics

Reference: pages 75-76.

"The Company prepares a risk assessment that identifies work-related risks for each position," with measures implemented to reduce or eliminate identified risks and continuous monitoring "by occupational health and safety specialists" (p.75). The disclosure is anchored to ESRS paragraphs on fatalities, work-related accident rates and days lost (footnote "S1-14 88. a), b), c), d), e)", p.75), consistent with the Rulebook on Occupational Health and Safety described under S1-1.

Compensation metrics (pay gap and total compensation)

Reference: page 76.

Salaries are set using "the Mercer IPE methodology, which evaluates positions systematically based on five factors and 12 dimensions," alongside individual performance and external benchmarks, "ensuring that employees receive adequate wages" (p.76). "As at 31 December 2025, the ratio of the total annual earnings of the highest-paid individual to the median annual earnings of other employees is 29:1 (2024: 25:1)" (p.76).

The Company explains the ratio's drivers: salaries in Serbia, Bosnia and Herzegovina and North Macedonia (25% of the workforce) are "considerably lower than in Croatia"; 60% of employees are in commission-based sales roles with "below-average salaries regardless of gender"; and top agents' commissions are uncapped, though too few in number to move the median (p.76-77).

Incidents, complaints and severe human rights impacts

Reference: page 77.

"In 2025, the Company conducted four proceedings for the protection of employee dignity (in 2024: three proceedings)." "In no case was harassment on any discriminatory ground or workplace bullying established; however, in three proceedings a form of inappropriate conduct on the part of the reported persons was established, and appropriate measures were taken" (p.77). All proceedings were completed within the statutory eight-day period and none reached external court proceedings (p.77).

"No fines, sanctions or compensation payments were made for cases resulting from past incidents or complaints," and "no severe breaches of the UN Guiding Principles on Business and Human Rights, the ILO Declaration... or the OECD Guidelines... were identified" (p.77).

Policies related to affected communities

Reference: pages 79-80.

"In 2025, the Company adopted the Strategy on Strengthening Financial Literacy in Insurance, in accordance with HANFA's Guidelines... The Strategy covers a three-year period (2026-2028)" with objectives to raise understanding of insurance and "strengthen trust in the insurance sector" (p.80). Croatia mirovinsko društvo separately adopted "a Financial Literacy Strategy for the period 2025-2027," with emphasis on pension savings (p.80).

"The Company's Code of Ethics is not formally aligned with internationally recognised standards referring specifically to communities and indigenous peoples; however... an update aimed at achieving such alignment is in progress" (p.80). Product-related community impact is managed via the Insurance Distribution Strategy Policy and Product Monitoring and Management Policy (p.80).

Processes for engaging with affected communities about impacts

Reference: pages 81, 78-79.

"Communication channels are open to the public in form of e-mail addresses available on the Company's website, including an address for reporting irregularities; an address where interested persons can file their grievances and complaints; and an address for data protection inquiries" (p.81). Engagement also runs through "employees' humanitarian and volunteering activities such as afforestation campaigns, blood donations," sponsorships ("over 70 local sports clubs" in 2025) and collaboration with industry associations such as the Croatian Insurance Bureau (p.81).

CO Group also participates in the EU-funded "Climate Insurance Solutions project," which established "a Risk Data Hub for recording, collecting and sharing data on climate-related risks and losses" and runs "thematic workshops, for example for local farmers" (p.78-79).

Processes to remediate negative impacts and channels for affected communities to raise concerns

Reference: page 81.

Remediation and complaint-raising channels for affected communities are the same public e-mail addresses described under S3-2 – "including an address for reporting irregularities" and "an address where interested persons can file their grievances and complaints" (p.81, footnote "S3-3 27."). The Company "continuously monitors and tracks submitted and processed complaints through established procedures within the complaint resolution mechanisms" (p.81). No community-specific remediation case data or outcomes are disclosed separately from this channel description.

Taking action on material impacts on affected communities

Reference: pages 81-83.

In 2025, CO Group "supported the 'A Safer Tomorrow' industry initiative," ran educational social-media posts and student lectures, and continued two formal study-programme collaborations: the postgraduate "INSURTECH" programme with the Faculty of Electrical Engineering and Computing (since 2020), and the new "Economic Analytics" module with the University of Zagreb Faculty of Economics (p.82).

"A total of EUR 107,263.57 was spent at CO Group level on financial literacy projects in 2025 (in 2024: EUR 127,833.50)" – a decrease the Company attributes to "a change in the definition of the activities included in this amount," not reduced investment (p.83). "CO Group implemented a total of 22 collaboration projects with faculties in 2025" (2 formal study programmes, 20 other projects, up from 17 in 2024) (p.83). Insurance revenue from non-life insurance excluding motor third-party liability – the Company's metric for community economic-stability impact – was "EUR 447,607 thousand (in 2024: EUR 383,234 thousand)" (p.83).

Targets related to managing material negative impacts, advancing positive impacts, and managing material risks and opportunities

Reference: page 83.

"At the CO Group level, no quantitative target values related to the above-mentioned positive impacts are currently defined. The Company manages them through its existing strategies, policies and operational processes" (p.83). CO Group states it "will consider the possibility of setting measurable target values in future reporting periods, particularly in the area of strengthening community resilience and access to insurance coverage" (p.83), but no figures, baselines or dates are set for FY2025.

Policies related to consumers and end-users

Reference: pages 86-87.

Key policies include the "Policy on the System for Managing Personal Data and Protecting the Privacy of Individuals," the "Rulebook on Handling Grievances and Complaints Filed by Interested Persons," the "Rulebook on Brand Management, Marketing Communication and Promotion," the Insurance Distribution Strategy Policy, and a "Product Oversight and Governance Policy (POG Policy)" ensuring products "take into account the clients' goals, interests and characteristics" and have "no negative impact on the clients" (p.86).

"At this time, the Company has not formally aligned its rulebooks relating to consumers' and end-users' human rights protection with the UN's Guiding Principles on Business and Human Rights... the ILO Declaration... and the OECD Guidelines," though it complies with national regulatory requirements (p.87). "No human rights incidents or cases of non-compliance with" those frameworks "that would involve consumers and/or end-users... occurred in 2025" (p.87).

Processes for engaging with consumers and end-users about impacts

Reference: pages 88-89.

The Company uses "NPS, analysis of complaints and customer journey mapping" to manage clients' "economic stability and resilience," "UX analysis, focus groups, workshops with distributors" to check marketing clarity, and GDPR-compliant research practices for data-privacy risk (p.88). Results are presented quarterly "to the relevant departments (product development, risk management and marketing)" (p.88).

Grievances can be filed "in person at a branch office, by post, by e-mail, by telephone via the contact centre and website, as well as through social media," with a written response provided "no later than 15 days from the date of receipt" (p.88-89). A semi-annual report on grievances and complaints is submitted to HANFA and the Croatian National Bank (p.89).

Processes to remediate negative impacts and channels for consumers and end-users to raise concerns

Reference: page 89.

The Company "maintains an electronic register of the received grievances and complaints," with documentation "stored on a durable medium for three years." It "analyses the causes of individual grievances and complaints and identifies the primary cause" across types (p.89). For privacy/data-security complaints specifically, "appropriate corrective procedures are initiated in cooperation with the competent organizational units, including the information security and compliance functions" (p.89).

Third-party channels are also available: petitioning the regulator HANFA (response within 30 days), the Croatian Insurance Bureau's out-of-court dispute resolution, and its Mediation Centre, where "the cost of mediation is borne by the insurance company" (p.89).

Taking action on material impacts on consumers and end-users

Reference: pages 89-91.

On the data-privacy risk: the Company "continually works on improving and modernising the business processes that involve the collection and processing of personal data," supported by the Information Security Management System described under G1 (p.89). On irresponsible-marketing risk: "internal controls... include the mandatory review of all marketing communication and promotional materials... first by the Product Development and Underwriting Sector and then by the Compliance Sector," to ensure information is "clear, truthful, complete and based on verifiable data" (p.90).

"At the CO Group level, no significant actual negative impacts related to consumers and/or end-users have been identified, and no serious issues or cases related to human rights violations have been reported" (p.90). Effectiveness is monitored via competent-sector processes and "annual internal control system reports... in the report of the Internal Control Committee" (p.90-91).

Targets related to managing material negative impacts, advancing positive impacts, and managing material risks and opportunities

Reference: page 91.

"No targets relating to consumers and/or end-users have been defined at the CO Group level. However, activities aimed at better understanding the specific needs and expectations of consumers and end-users are implemented continually," with CO Group stating that "defined targets will be aligned with the latest regulatory requirements and industry standards" once set (p.91). No figures, baselines or dates are given for FY2025.

Business conduct policies and corporate culture

Reference: pages 92-93.

"The Code of Ethics represents the overarching policy on business conduct and corporate culture, which is applied in all countries where CO Group's subsidiaries operate" (p.93). "The policies described in this disclosure requirement are not at present aligned with the United Nations Convention against Corruption, and the Company plans to align them in the medium term" (p.93).

The Code "establishes the obligation to report any breach or potential breach of the Code, including cases of bribery and corruption," with review routed through line managers, HR, Legal or, ultimately, the Ethics Committee, which "periodically reviews cases without disclosing personal data and reports to the Management Board on ethical proceedings initiated against individuals who have violated the Code" (p.93). Ethics training, including a knowledge assessment, runs via the e-learning platform, with a mandatory module for insurance distributors (p.93).

Management of relationships with suppliers

Reference: pages 93-94.

"The Company has not established a separate policy for preventing late payments; however... it ensures timely payments to all suppliers," settling invoices "within 60 days from the date of goods delivery or service execution," with "no separate payment practices for small and medium-sized enterprises" (p.93). A "signalling mechanism (traffic light system)" in the DMS automates payment-deadline monitoring (p.93).

In 2025 the Supplier Code of Conduct (part of the General Terms and Conditions) was updated "through a more detailed elaboration of suppliers' obligations with regard to sustainability," covering "human and labour rights... the prohibition of forced labour and child labour, environmental protection and the fight against corruption" (p.93). An internal desk-research analysis of a sample of strategic suppliers was carried out in 2025, with annual monitoring planned going forward (p.93-94).

Targets related to business conduct

Reference: pages 93-94 (part of MDR-T/GDR-T disclosures).

No quantified target is stated for business conduct. Effectiveness is instead tracked in the absence of one, through two mechanisms disclosed under the topical G1 requirements. First, the Ethics Committee "periodically reviews cases... and reports to the Management Board on ethical proceedings initiated against individuals who have violated the Code," and "monitors ethics training, conducts ethics proceedings, supports the implementation of the Code" (G1-1, p.93).

Second, supplier payment practices are tracked quantitatively: "the average time required to settle an invoice from the start of the contractual or statutory payment term is nine days" in 2025, monitored through an automated "traffic light system" triggered by due dates (G1-6, p.94). Together these constitute effectiveness tracking of business-conduct policies in the absence of a stated numeric target, consistent with the MDR-T "other limb."

Payment practices

Reference: page 94.

"All invoices from the Company's suppliers are paid upon maturity, subject to prior approval by the certifier in the system, and the same conditions apply to all suppliers, including small and medium-sized enterprises" (p.94), and this "does not cover insurance claims payments." "The average time required to settle an invoice from the start of the contractual or statutory payment term is nine days," calculated from invoice receipt to due date because "some suppliers submit invoices that are already due" (p.94).

"During contract negotiations, standard payment terms are agreed upon, and all payments are executed in accordance with the contractual terms... applying equally to all suppliers." "Currently, there are no ongoing legal proceedings related to delayed payments" (p.94).