Digia

Governance roles

Reference: pages 26-27, 64.

Responsibility sits with the Shareholders' Meeting, the Board of Directors and the President & CEO assisted by the Group Management Team (page 26).

Board and committees (page 26):

• Articles of Association require 4-8 members. After Martti Ala-Harkonen's resignation on 16 May 2025 the Board consists of five members until the end of the current term.
• Three committees in 2025: Audit, Compensation and Nomination. They hold no powers of decision or execution unless separately authorised.
• "It is the Audit Committee's role to monitor impacts and risks", including the sustainability report, internal control and risk management effectiveness.
• Independence: Santtu Elsinen, Sari Leppanen, Henry Nieminen, Outi Taivainen and Martti Ala-Harkonen (to 16 May 2025) are independent of the company and its major shareholders; Robert Ingman is independent of the company but not of major shareholders.
• Gender diversity at 31 December 2025: Board 60% men (3) / 40% women (2); Management Team 80% men (8) / 20% women (2). The EU-legislation datapoint list maps the Board gender diversity ratio and the percentage of independent members to page 26 (page 68).

The Management Team consists of ten people: CEO, CFO, General Counsel and CTO, the SVP of HR, Culture and Sustainability, the SVP of Sales and Marketing and the SVPs of four business areas. "There were no employees or employee representatives in Digia's Management Team during the 2025 reporting year" (page 27).

On sustainability expertise, the Board, its committees and the Management Team regularly discuss reviews presented by Group experts and operational management; "There are no other special controls or procedures in place" (page 27). The G1 chapter repeats GOV-1 for business conduct (page 64).

Information provided to the administrative, management and supervisory bodies

Reference: pages 27-28.

The Board, supported by its committees, "holds ultimate responsibility for sustainability within the Group". Sustainability is part of the Board-approved business strategy; the Board approves the sustainability focus areas and targets for each strategy period, and the sustainability targets included in the management incentive scheme "complete with their relative weightings" (page 27).

Frequency (page 27): the Audit Committee reviews topical sustainability issues "as a rule ... on a quarterly basis" and "discussed sustainability at three of its meetings in 2025". Risk management outcomes, including sustainability risks, are presented to the Audit Committee twice a year alongside any whistleblowing reports.

Matters reviewed in 2025 are tabulated by type (page 27):

• Impacts - updating the double materiality assessment; the overview of focus areas and objectives for the strategy period; monitoring the Green Omnibus initiative; trends in Digia's CO2 emission targets and the measures to achieve them.
• Risks - the status and development of risk management; information security risks and measures; cybersecurity and cyber strategy and development projects; risks associated with new regulations such as NIS2 and CSRD, and the management model.
• Opportunities - customer satisfaction (NPS) feedback; new customer and business development needs arising from increased regulation; the company's attractiveness as an employer and its current resources.

In 2025 the Management Team formed a separate Sustainability Steering Group, with the Head of Sustainability as presenter; it "met five times in 2025" (page 28).

Sustainability in incentive schemes

Reference: pages 28-29, 44.

Remuneration of governing bodies follows Digia Plc's Remuneration Policy, published on the company website; the 2025 Remuneration Report covers Board and CEO pay and remuneration in relation to performance in 2021-2025 (page 28).

Long-term share-based incentive scheme 2023-2025 (established May 2023; target group the CEO, senior executives and, potentially, other individual key personnel): net sales 50%, cumulative earnings per share for 2023-2025 40%, and Digia's sustainability target 10% (page 28).

Short-term target bonus scheme for 2025 (senior executives and other people in demanding specialist roles, approved by the Board): net sales 50%, EBITA operating profit 40%, sustainability target 10% (page 28).

"Both the long-term share-based incentive scheme and the short-term target bonus scheme have the same sustainability targets: a reduction in CO2 emissions (weighting 20%), eNPS (weighting 40%), and NPS (weighting 40%)" (page 29). Climate therefore carries 20% of the 10% sustainability component, i.e. 2% of the scheme weighting in each plan.

The E1 chapter cross-refers to this disclosure rather than repeating it, and points to E1-4 for the emission reduction targets behind the CO2 element (page 44).

Statement on due diligence

Reference: page 28.

Digia presents the required mapping table, listing the five key elements of the due diligence process against the sections of the Sustainability Statement that carry the corresponding information (page 28):

• (a) Embedding due diligence in governance, strategy and business model - ESRS 2 General Disclosures (Governance, Business model and strategy, Policies adopted); ESRS G1 Corporate culture and business conduct policies; ESRS S1 Processes; ESRS S2 Actions and approach; ESRS S4 Material impacts and policies; ESRS E1 Integration of performance in incentive schemes, and Transition plan.
• (b) Engaging with affected stakeholders at all key stages - ESRS 2 Interests and views of stakeholders and the Double materiality assessment methodology; ESRS G1 Relationships with suppliers; ESRS S1 Engaging with own workforce; ESRS S2 Engaging with value chain workers; ESRS S4 Engaging with consumers and end-users; ESRS E1 Identification and assessment process, and Targets.
• (c) Identifying and assessing adverse impacts - ESRS 2 Risk management and internal control with regard to sustainability reporting and the DMA methodology; ESRS S1, S2 and S4 Processes and Actions; ESRS E1 Identification and assessment process, and Targets.
• (d) Taking actions to address those adverse impacts - the same ESRS 2 references; ESRS S1, S2, S4 Actions and engagement; ESRS E1 Actions.
• (e) Tracking effectiveness and communicating - ESRS 2 Governance, Business model and strategy, Interests and views of stakeholders; ESRS G1 Remediation and Whistleblowing channel; ESRS S1, S2, S4 Actions and Targets; ESRS E1 Actions and Targets.

The EU-legislation datapoint list maps GOV-4 paragraph 30 to page 28 (page 68). This is a change from FY2024, where the statement on due diligence was not given.

Risk management and internal controls over sustainability reporting

Reference: page 29.

Risk management is "a continuous process by which Digia determines, lists, and assesses its major risks, appoints key persons to take charge of risk management, and prioritizes risks according to an assessment scale". Risks are classified as strategic, financial, operational and sustainability risks; the assessment model "is based on the COSO model and the applicable sections of ISO 31000", and risks are prioritised on their consequences, financial impact and probability. The process is supported by centralised risk management software (page 29).

"During its double materiality assessments and updates, Digia always checks whether any changes to the management of sustainability risks are required. The latest update was made during the reporting year" (page 29).

Oversight (page 29): the Audit Committee supervises implementation and assesses effectiveness, focusing on risks classified as high risk, and receives an overview comprising the most significant risks and their distribution along the probability-effect axis. Changes in risk status are reported to the Audit Committee twice a year; the Group Management Team monitors risk status at its regular meetings. Sustainability risks are also addressed as necessary by the Sustainability Steering Group and the Quality Steering Group.

Internal audit: "Digia has not yet established a separate function responsible for internal auditing. The company regularly assesses the need for an internal audit function. With the company's current business volume, its existing functions are able to handle internal auditing tasks" (page 29).

A table names the identified sustainability risks by theme (page 29): E1 digital infrastructure incidents and achieving emission reductions; S1 employee wellbeing and the need for specialists; S2 working conditions in the supply chain; S4 information security and data protection; G1 ethical conduct and good governance.

Strategy, business model and value chain

Reference: page 30.

Digia is "a trusted European partner in intelligent business", providing consulting, software and services. It reports one segment under IFRS 8; combined net sales of all market areas in 2025 were EUR 217 million. Sustainability-related projects are not itemised in segment reporting (page 30).

Footprint (page 30): the main market is Finland; Digia also operates in Sweden, Poland and the Netherlands. The Group has two subsidiaries in Finland, three in Sweden, two in Poland and one in the Netherlands. "Poland became a new market area for Digia through the acquisition of Savangard." Customers span the private and public sectors, with no significant change in customer groups during the period.

Value chain (page 30) is divided into upstream, own operations and downstream. Upstream "consists of Digia's subcontractor and technology partner networks, through which the company acquires the necessary expertise and services to conduct its business", together with equipment, software, and cloud and datacenter services. Own operations cover the service and maintenance business, project business and specialised service areas, with people, tools, processes and systems as resources. Downstream covers customers and society: digital solutions and services, sustainable customer value, digital security and non-discrimination, and "a digitalizing society". "Digia's role in the value chain is a provider of solutions and services ... The company is a major social operator in its role as a provider of digital solutions."

Sustainability targets are set at Group level and cover E, S and G. The EU-legislation datapoint list marks the SBM-1 paragraph 40(d) datapoints on involvement in fossil fuels, chemicals, controversial weapons and tobacco as "Not material" (page 68).

Interests and views of stakeholders

Reference: page 31.

"Digia's most important stakeholders are customers, personnel, investors, technology partners, subcontractors, and communities." Materiality and stakeholder expectations are built up "through a combination of routine management and regular meetings, surveys, and analyses", with communication methods varying by stakeholder (page 31).

The engagement table pairs each stakeholder with its channels and the purpose served (page 31):

• Customers - close cooperation in product and service development and project work; continuous dialogue through sales, marketing and customer service; regular customer surveys; interviews and assessments. Purposes include further development of services and the customer experience, secure systems and services, and "Helping customers to solve sustainability challenges".
• Personnel - supervisor cooperation and discussions based on cultural and leadership principles; target and development discussions; regular personnel surveys; the early intervention model and wellbeing communications; tribal activities, meetings, training and staff events.
• Investors - regular dialogue with shareholders and the investor community, reports and publications, investor meetings and events, feedback surveys.
• Technology partners - participation in partner programmes, training and events; collaboration programmes; regular meetings and workshops.
• Subcontractors and other suppliers - maintaining and developing the Digia Hub subcontractor network; commitment to the Supplier Code of Conduct; annual surveys of subcontractors and selected suppliers; audits of selected suppliers as necessary.
• Organizations and communities - cooperation with Technology Industries of Finland, TIEKE and the Global Compact, including green coding and calculating the carbon footprint of software.

"The Audit Committee receives biannual reports on developments in stakeholder-related risks, and sustainability risks are monitored during the Group's Management Team meetings" (page 31).

Material impacts, risks and opportunities

Reference: pages 32-34 (topic chapters repeat SBM-3 at pages 45, 50-51, 57-58 and 59-60).

Digia carried out its first double materiality assessment in 2023 and updated it in 2025 as part of its strategy work. "During the update, Digia found that five of the ten sustainability themes specified in the Directive were material to the company, and also noted that theme E5 (Resource use and circular economy) no longer meets the company's materiality criteria. The material themes are E1 Climate change, S1 Own Workforce, S2 Workers in the value chain, S4 Consumers and end-users, and G1 Business conduct. All of the material themes were reassessed during the update" (page 32).

The materiality matrix plots Own workforce, Consumers and end-users, Climate change, Business conduct and Workers in the value chain on impact and financial materiality axes (page 32).

The IRO table (pages 33-34) sets out 32 rows, each carrying an ESRS sub-topic, value chain position, time frame, an explicit type label and grounds: E1 7 rows, S1 9, S2 3, S4 10, G1 3. Examples: "The highest emissions from Digia's operations and value chain arise from energy consumption" (actual negative impact, downstream and own operations, all time frames); "Digia is dependent on the public electricity grid, major cloud service providers, and telecommunication connections" (potential business risk); "Absences related to mental health remain high in the IT sector" (potential business risk); "Information security violations have the potential to cause significant negative impacts on both Digia's customers and their customers" (potential negative impact).

Financial effects (page 32): "Significant changes have occurred in the IT market, with hourly rates falling as a result of the market situation, and this may affect the company's financial performance. Digia did not otherwise identify any significant financial impacts relating to material risks or opportunities during the current reporting period." Digia "has no planned investments or divestments associated with the aforementioned sustainability themes", and "has not identified any business risks or opportunities that would not be covered by the ESRS disclosure requirements".

Processes to identify and assess material IROs

Reference: pages 35-36.

The assessments "cover the company's own operations, as well as all upstream and downstream operations from direct and indirect suppliers to customers and solution end-users" and are based on the CSRD and the ESRS. "Digia's business model is based on expert work and the provision of IT services. The company does not operate in high-risk countries or sectors in which, for example, human rights or environmental risks would be higher than usual" (page 35).

Method (page 35):

• The ESRS 1 AR 16 list of sustainability matters is used to draw up a preliminary list of material topics, alongside existing data, plans and external sector information.
• Stakeholder background material includes customer interviews, online customer surveys, a reputation survey and an employer image survey; external experts are used as required.
• "The assessments use a scoring system in which each topic is individually assessed in terms of its scale, scope, remediation, and probability. Risks, dependencies, and opportunities are scored on the basis of their financial significance and probability." Probability is assessed on a scale of one to five.
• "Topics with a score above a predetermined threshold are defined as material. This threshold is defined as topics with a score of moderate or higher."
• "A total of 11 material topics were identified", corresponding to the 11 sub-topic rows in the SBM-3 table (pages 33-34).
• "the material impacts of upstream operations only cover direct suppliers, while downstream operations include customers and solution end-users."
• "On the basis of preparatory work carried out by the Management Team, the Audit Committee reviews and approves the final material sustainability topics."

Change in 2025 (page 35): "Digia deepened its double materiality assessment by examining the themes in greater detail at sub-sub-topic level. Some topics had previously been grouped together, which may have partially obscured the importance of their individual impacts." Review takes place "at least once per strategy period".

Climate-specific risk identification and scenario analysis is also presented under E1-2 (2025 ESRS numbering).

Disclosure requirements covered

Reference: page 36; index of contents pages 66-67; EU-legislation datapoint list pages 68-69.

Digia prints a real ESRS content index. IRO-2 itself states: "A list of reported disclosure requirements and a list of data points based on other EU legislation are presented on pages 68-69 of this Sustainability Statement" (page 36), while BP-2 and MDR-M point readers to pages 66-67 for the same index (pages 25, 37) - the index of contents is in fact on pages 66-67 and the EU datapoint list on pages 68-69.

What the index lists (pages 66-67):

• ESRS 2 - BP-1, BP-2, GOV-1 to GOV-5, SBM-1, SBM-2, SBM-3, IRO-1, IRO-2, MDR-P, MDR-A, MDR-M, MDR-T (pages 25-38).
• E1 - GOV-3, E-1 transition plan, SBM-3, IRO-1, E1-2, E1-3, E1-4, E1-5, E1-6, E1-8 and E1-9 (pages 35-36 and 44-49). E1-7 is not listed.
• S1 - SBM-3 and S1-1 to S1-11 and S1-13 to S1-17 (pages 50-57). S1-12 is not listed.
• S2 - SBM-3, S2-1 to S2-5 (pages 57-59).
• S4 - SBM-3, S4-1 to S4-5 (pages 59-63).
• G1 - GOV-1, G1-1 to G1-6 (pages 64-65).

E2, E3, E4, E5 and S3 do not appear in the index at all, consistent with the DMA outcome (page 32).

The EU-legislation datapoint list (pages 68-69) gives a page reference or the word "Not material" for each datapoint; E1-7 paragraph 56 (GHG removals and carbon credits) and the E1-9, E2-4, E3-1, E3-4, E4 and E5-5 datapoints are all marked "Not material".

Transition plan for climate change mitigation

Reference: pages 44-45.

There is no completed transition plan. "Digia is developing a transition plan to mitigate climate change to align its strategy and business model with the goals of the Paris Climate Agreement. The plan will be integrated into Digia's new strategy in 2026. The final transition plan will be published in the 2026 Sustainability Statement" (page 44).

Targets and alignment (page 44): "The current strategy period's target of a 60 percent reduction in CO2 emissions in operations in Finland by 2025 (compared to the 2019 baseline) does not meet the Paris Agreement's emission reduction target of 1.5C. Digia committed to Science Based Targets (SBTi) in 2024, and launched a process to set its science-based emission reduction targets in 2025. Digia has now submitted its emission reduction targets to the SBTi for assessment, but has not yet received formal validation of its targets." The baseline for the updated targets is the 2024 carbon footprint, which covers the entire Group.

Levers (page 44): "Improving energy efficiency and switching to renewable energy sources, such as fossil-free electricity and heating, are key elements of the plan. Digia will also employ digitalization and automation to improve resource efficiency." Supplier work targets low-carbon purchased services and products, with "particular attention ... paid to the emissions, lifespan and recyclability of IT equipment".

Locked-in emissions (page 45): "Carbon lock-ins are unlikely, as Digia's business is based on software and services. Carbon lock-ins typically arise from physical infrastructure and long-term investments in carbon-intensive technologies. Digia is not excluded from the EU's Paris-aligned Benchmarks."

Funding and approval (page 45): "Investments related to implementing the transition plan will be taken into account in regular financial planning and the necessary funding will be included in the annual budget. The transition plan will be discussed by the Sustainability Steering Group and Board of Directors in spring 2026" - so no governing-body approval of the plan has yet taken place.

Identification of climate-related risks and scenario analysis

Back-filled from ESRS 2 IRO-1 and the E1 SBM-3 section, where this content is disclosed in the FY2025 report (pages 35-36, 45). This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

"Digia carried out its first climate scenario and resilience analysis in conjunction with an update of the double materiality assessment. During this update, Digia identified the physical and transitional climate risks that will affect Digia's operations over different time frames" (page 35). The analysis "was carried out in accordance with the guidelines issued by the TCFD".

Scenarios (pages 35-36): four alternative operating environment scenarios were developed, of which two contrasting ones were taken forward, supported by two IPCC AR6 SSP scenarios. Scenario 1 is "A low-carbon scenario with sustainable digital development ... corresponds to the IPCC scenario SSP1-2.6 (warming limited to around 2C)"; Scenario 2 is "A carbon-intensive digital growth scenario ... corresponds to the IPCC scenario SSP5-8.5 (warming of more than 4C)". The narrative on page 35 describes SSP1-2.6 as limiting warming "to around 1.5-2C" and writes the high-emission scenario as "SSP5-8.6" before using SSP5-8.5 on page 36.

Physical risks (pages 36, 45): "extreme heat, heavy rainfall and snowfall, floods, droughts, forest fires, severe storms, a rise in sea levels, water shortages, and air pollution", scoped to "relevant risks at Digia's locations and in its value chain", using European Environment Agency risk descriptions and IPCC material "to assess physical risks in the year 2040", over ESRS short-, medium- and long-term horizons. Chronic and acute risks are listed separately on page 45.

Transition risks (page 36): "The SSP1-2.6 scenario was mainly used to identify and assess transition risks and opportunities". "Neither Digia's business nor its assets are particularly exposed to transition risks, as it has no physical products, production facilities, or energy-intensive processes."

Risks are classified as physical or transition throughout. Scope covers own operations, critical infrastructure and key sections of the value chain (page 45).

Resilience in relation to climate change

Back-filled from the E1 SBM-3 section, where this content is disclosed in the FY2025 report (page 45). This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

"A resilience analysis was carried out in 2025 in conjunction with a climate scenario analysis. In the resilience analysis, Digia investigated whether any of its locations were particularly vulnerable to the risks posed by climate change, and how the company can adapt to and cope with them" (page 45). This was Digia's first such analysis (page 35).

Scope and method (page 45): it "covered its own operations, critical infrastructure, and key sections of the value chain. The analysis looked at their resilience and the value chain's adaptability, as well as these areas' exposure to climate and transition risks. Evolving factors include technological developments, regulation and policy action, changes in energy markets, and the role played by digitalization in society." Short-, medium- and long-term changes were considered "and used the same time frames as the IPCC climate scenarios (2040)".

Results (page 45): "Due to the nature of the company's business, Digia can be considered a resilient and low-carbon company. Its services are based on digital solutions and professional services, which significantly reduces the company's exposure to traditional climate risks, such as infrastructure damage or issues with the availability of raw materials. The resilience analysis shows that no significant physical or transition risks that would directly jeopardize business continuity have been identified in Digia's own operations. The risks are mainly related to critical sections of the value chain on which Digia's service provision is dependent, such as datacenters, cloud services, and telecommunications connections."

The assessment "found the vast majority of these risks to be low, although some risks were classified as medium. Medium risks include heatwaves, water scarcity, heavy rainfall, floods, and soil degradation." Physical risks "remain moderate in the low-carbon scenario (SSP1-2.6)" and in SSP5-8.5 "will increase significantly in the 2030s and could become critical in the 2040s".

Not disclosed: the statement gives no separate account of the significant areas of uncertainty in the resilience assessment, and no financial-flexibility or asset-redeployment analysis of adaptive capacity beyond the statement that Digia has no significant physical assets directly exposed to climate risks (page 36).

Policies related to climate change mitigation

Reference: page 45.

"Digia's environmental policy contains the company's most important policies related to climate change mitigation. It helps to ensure that the environment is taken into account in all of the company's operations, and thereby supports the achievement and fulfillment of environmental targets and requirements" (page 45).

Content and scope (page 45): "The environmental policy sets out Digia's policies on climate change mitigation, energy efficiency, and the transition to renewable energy. These policies steer Digia's own operations in particular, with the aim of ensuring that activities such as travel and procurement are conducted in an energy- and material-efficient manner that generates the lowest possible emissions. Digia also uses renewable energy whenever possible."

Basis and governance (page 45): the policy "is based on Finnish national legislation, the UN Sustainable Development Goals, and recommendations and practices in the field". It "applies to the entire Group and has been approved by Digia's Management Team". Implementation is the responsibility of the Head of Sustainability and the sustainability unit, working with financial, legal and business units; the Management Team supervises it. The policy is publicly available on the company's website.

It is supported by the Code of Conduct, which "encourages environmentally friendly solutions both in business operations and the workplace environment, and requires contractors and partners to do the same", and by the Supplier Code of Conduct and Sustainable Supplier program for the supply chain (page 45). The MDR-P policy table lists exactly these four instruments against E1 (page 37).

Climate change adaptation is not covered by a separate policy; the E1 chapter and the index of contents both label this disclosure "Policies related to climate change mitigation" (pages 45, 66).

Actions and resources in relation to climate change policies

Reference: page 46.

"The six major actions that Digia is taking to mitigate climate change are detailed below. It is estimated that these climate change mitigation and decarbonization measures will enable the company to achieve a total reduction of about 312 tCO2e, of which premises-related changes and purchases of renewable energy have resulted in an annual emission reduction of about 264 tCO2e" (page 46).

The chapter is organised by emission source (page 46):

• Purchased goods and services - developing supplier management "to enable the collection of primary emissions data from suppliers", active dialogue with major suppliers, and seeking reductions through fewer purchases or supplier changes; supported by the Supplier Code of Conduct.
• Purchased energy - "Digia aims to use zero-emission or renewable energy in its premises. As Digia leases all of its premises, the company is dependent on its landlords' efforts to transition to zero-emission or renewable energy." At the end of 2025 Digia operated 11 locations in Finland, three permanent locations in Sweden, two in Poland and one in the Netherlands. The Helsinki headquarters was reduced in size, a second Helsinki lease given up and new central Helsinki premises occupied in early 2025 that "use carbon-neutral electricity". "One successful example is the Oulu office, which switched its electricity contract to zero-emission electricity in 2025."
• Capital goods and upstream leased assets - purchase of recyclable office furniture and IT equipment, with devices "properly recycled after the leasing period"; circular economy partners support the Finnish companies.
• Vehicles - the company car benefit favours low-emission vehicles, "and sets a maximum emission limit for acquired vehicles on an annual basis", applying to Digia's companies in Finland.
• Fuel and energy-related activities - indirect energy-related emissions fall as premises move to zero-emission or renewable energy and the leasing fleet is electrified.
• Business travel and employee commuting - personnel encouraged to favour public transport and avoid unnecessary travel; new premises chosen for public transport access.
• Green coding - a Green Coding guide and accompanying online training "to help employees adopt these practices in their daily work", complementing the environmental policy, plus participation in research projects.

Resources: "The aforementioned actions do not require significant operating or capital expenditure, and the company's ability to implement such actions is not therefore dependent on the availability and allocation of resources" (page 46). No monetary CapEx or OpEx amount is attached to the actions.

Targets related to climate change mitigation

Reference: pages 46-47.

"The goal for Digia's 2023-2025 strategy period is to reduce CO2 emissions (Scope 1-3 combined) by 60 percent by 2025 (compared to the 2019 baseline). No separate scope-specific targets were set for the strategy period. Achievements were monitored on an annual basis ... However, the alignment of the strategy period's emission reduction target with the Paris Agreement has not been separately verified. Digia's internal stakeholders, the Management Team, and the Audit Committee were all involved in setting the target" (page 46).

Baseline (pages 46-47): "Digia's carbon footprint was 3,055 tCO2eq in 2019. It covered the Scope 1 and Scope 2 emissions of the company's then-current Finnish operations, as well as selected procurements and other Scope 3 emissions. Scope 2 was calculated on a market basis, and Scope 3 emissions accounted for around 89 percent of total emissions in 2019. 2019 was chosen as the baseline for the target, as it was Digia's first CO2 calculation year".

Because the company has grown by acquisition, "Digia has used two parallel boundaries for calculating its carbon emissions. The first boundary is based on that of the 2019 calculation, while the second boundary has expanded the calculation to cover all of Digia's locations and all material procurements at Group level." E1-6 uses the broader boundary; the target is tracked on the 2019 boundary (page 47).

Outcome (page 47): on the 2019 boundary the entire value chain footprint (Scope 1-3) fell from 3,055 tCO2eq in 2019 to 1,832 in 2024 and 1,112 in 2025, a 64% reduction on 2019 against a 60% target, with intermediate years of 1,511 (2020), 1,214 (2021), 1,703 (2022) and 1,944 (2023). "The largest reduction was achieved in the last year of the strategy period, with changes in premises contributing to this" (page 46).

Forward targets: "Digia defined its science-based climate targets during 2025 on the basis of its 2024 baseline ... However, these targets have not yet been validated by the SBTi" (page 47). No 2030 or 2050 target value is published. The EU-legislation datapoint list maps E1-4 paragraph 34 GHG emission reduction targets to page 47 (page 68).

Energy consumption and mix

Reference: page 47.

"Digia's energy consumption covers the fuel consumption of leased vehicles and the energy consumption of its offices. The energy producer and production method have been obtained from the company's landlords. The fuel consumption of leased vehicles mainly consists of non-renewable sources. District heating, district cooling, and the electricity used at offices mainly comes from renewable sources" (page 47).

Table (MWh, 2024 then 2025, page 47):

Total energy consumption fell 28% while the renewable share rose from 56% to 94%. The table also splits renewable energy between fuel from renewable sources including biomass and purchased or acquired renewable electricity, heat, steam and cooling; the printed figures for those two lines are 423.19, 494.68, 966.52 and 1,614.74, and their year assignment cannot be read unambiguously from the extracted table, so they are not restated here.

"If no information on energy sources was available, the allocation was made using the same principle as for Scope 1 and Scope 2 calculations - the energy was allocated to default energy sources. In 2025, all energy consumed in Digia's offices in Finland was certified through guarantees of origin or renewable energy certificates. Energy consumption and energy sources have not been verified by anyone other than the Group Sustainability Auditor" (page 47).

Digia is not in a high climate impact sector: the EU-legislation datapoint list marks the paragraph 38 fossil-fuel disaggregation and the paragraphs 40-43 energy intensity datapoints "Not material", and maps paragraph 37 to page 47 (page 68).

Gross Scopes 1, 2, 3 and total GHG emissions

Reference: pages 48-49.

Emissions follow the GHG Protocol using the operational control approach; since 2023 the calculation covers the entire Group, and the 2024 and 2025 figures use the same boundary. Scope 1 is fuel from the leased company cars (DEFRA factors); Scope 2 covers heating, cooling and electricity at leased premises, with market-based figures built from landlord data and energy-company specific factors and location-based figures from country-average factors. "82 percent (28%) of market-based energy consumption is certified with guarantees of origin or renewable energy certificates" (page 48).

Results (tCO2eq, 2024 / 2025 / change, page 49):

• Gross Scope 1: 25.4 / 23.9 / -6%; share from regulated emission trading schemes 0%.
• Gross location-based Scope 2: 232.4 / 113.8 / -51%. Gross market-based Scope 2: 296.9 / 35.9 / -88%.
• Total gross Scope 3: 5,788.4 / 5,871.2 / +1%, comprising category 1 purchased goods and services 4,553.6 / 4,911.2 (+8%, of which cloud computing and datacenter services 75.6 / 94.3, +25%); 2 capital goods 483.1 / 347.8 (-28%); 3 fuel and energy-related activities 183.4 / 172.0 (-6%); 5 waste 23.2 / 26.0 (+12%); 6 business travel 292.5 / 273.9 (-6%); 7 employee commuting 250.1 / 134.4 (-46%); 8 upstream leased assets 2.6 / 5.9 (+130%).
• Total location-based 6,718.8 / 6,009.8 (-11%); total market-based 6,783.3 / 5,930.9 (-12.6%).
• The 2025 split is Scope 1 0.4%, Scope 2 0.6% and Scope 3 (upstream) 99.0% of 5,931 tCO2e.

A reconciliation point worth checking: the 2024 total rows (6,718.8 and 6,783.3) do not equal the sum of the 2024 scope rows shown alongside them (6,046.2 and 6,110.7). The difference of 672.6 tCO2eq is exactly the Scope 3 restatement disclosed under BP-2, where 2024 Scope 3 was corrected from 6,461.0 to 5,788.4 tCO2eq (page 25). So the total rows and the year-on-year changes of -11% and -12.6% appear to be measured against the uncorrected 2024 totals while the Scope 3 line uses the corrected base.

Coverage and estimation (page 48): Scope 3 categories 1-3 and 5-8 are reported; category 4 upstream transportation and distribution and downstream categories 9-15 are omitted as no significant emission sources were identified. "Six percent (6%) of Digia's Scope 3 emissions in 2025 have been calculated using primary data". From 2025 Digia no longer reports remote working emissions. Intensity: total GHG per net sales fell from 0.033 to 0.028 tCO2eq/EUR 1,000 location-based (-15.3%) and 0.033 to 0.027 market-based (-17.3%), on net sales of EUR 217.0 million (EUR 205.7 million) (page 49).

Internal carbon pricing

Reference: page 49.

A nil return: "Digia does not apply internal carbon pricing systems in its operations" (page 49).

The disclosure is listed in the index of contents against page 49 (page 66), so the company treats it as covered rather than omitted. No shadow carbon price, internal carbon fee or implicit price is disclosed anywhere in the statement, and no carbon price is applied in investment appraisal - consistent with the statement that the climate actions "do not require significant operating or capital expenditure" (page 46).

Two related facts sit alongside it. The share of Scope 1 emissions from regulated emission trading schemes is 0% (page 49), so no external carbon price applies to Digia's own emissions either. And the climate element of executive incentives is handled through a CO2 reduction weighting in the bonus and share schemes rather than through a price on carbon (pages 28-29).

Policies related to own workforce

Reference: pages 51-52.

"Digia's Group-wide guiding principles for its own workforce include its Codes of Conduct and human rights commitment" (page 51). The Code of Conduct "prohibits the use of child or forced labor in the company".

Human rights commitment (page 51): Digia "analyzed the human rights risks and impacts of its business activities in accordance with UN principles, taking into account both its own operations and those of its supply chain and customers". The risks identified in the value chain were "the right to health and safety; the right to non-discrimination; the right to decent work; the elimination of labor exploitation and forced labor; the right to organize and collective bargaining; the right to privacy". Digia commits to the UN Guiding Principles, the UN Universal Declaration of Human Rights, the ICCPR and ICESCR, and the ILO Declaration on Fundamental Principles and Rights at Work, and to the Ten Principles of the UN Global Compact. The commitment "covers the entire Group and is publicly available on Digia's website", was approved by the Management Team, is implemented by HR and supervised by the HR Director and General Counsel.

Group company policies applying in Finland (pages 51-52):

• Preventing accidents in the workplace - regular workplace surveys by occupational healthcare and annually approved occupational health and safety action plans covering health risks, health checks, ergonomics and early intervention, plus emergency first-aid training at each site.
• Equality and non-discrimination program - "Digia does not tolerate discrimination or harassment of any kind." The programme and plan are updated every strategic period and approved by the Management Team; 2023-2025 focus areas are "an inclusive culture and psychological safety, making the use of English commonplace, increasing the proportion of women working at Digia, and increasing inclusivity and career opportunities for women". A diversity tribe supports the topic.
• Eliminating discrimination in employment - hiring trainees, recent graduates and career changers; hiring professionals over 60 and running the Konkarit (Veterans) programme; signing the Women's Empowerment Principles; a Pride partnership; and a salary and remuneration manual describing career paths, task families and competence levels.

The datapoint list maps S1-1 paragraphs 20-23 (human rights policy commitments, ILO due diligence, trafficking prevention, occupational risk prevention) to page 51 (page 69).

Engaging with own workforce and workers' representatives

Reference: page 52.

Digia lists the direct channels it uses with employees and their representatives (page 52):

• "Digia's personnel survey, which covers companies in Finland and is conducted twice a year, and regular pulse surveys (subsidiaries have their own survey processes)"
• other targeted studies as required
• "Digia's equality and non-discrimination survey of companies in Finland, every 2-3 years"
• regular target and learning discussions and their feedback discussions
• routine management and one-on-one conversations with supervisors
• project and team feedback
• open Teams discussion channels.

Representatives (page 52): "Elected employee representatives, such as shop stewards and members of the growth team and health and safety organization, seek improvements by engaging in continuous dialogue within their area of authorization. Employees' views are taken into account in areas such as Digia's cultural focus, strategic HR choices, and sustainability targets." Shop stewards and representatives from the growth team, the occupational safety committee and the equality and non-discrimination team meet regularly, covering legislative matters, strategy, and topic-specific actions and indicators.

Cadence (page 52): personnel briefings four times a year alongside business unit briefings and team meetings; one-on-one target and development discussions held one to two times a year in a process-driven manner. Communications and surveys are provided in both Finnish and English.

Accountability and effectiveness (page 52): "Operative responsibility for communications is held by Digia's HR Director, who is a member of the Management Team. Digia assesses the effectiveness of its communications by monitoring the results and response rates of its surveys and following other internal metrics." Survey background variables are gender, age and role, so that "more detailed information may be gained about the experiences of different employee groups". The equality survey investigates "experiences of inclusiveness, discrimination, and sexual harassment" in teamwork, recruitment, salary decisions and career development.

Remediation processes and channels to raise concerns

Reference: pages 52-53.

"Digia is committed to taking action based on due diligence processes, so that the company does not cause or contribute to any adverse human rights impacts in its business activities" (page 52). Supervisors are directed to hold regular open conversations; target and development discussions run yearly, and other discussions on a needs basis, with supervisors playing "a key role in addressing and resolving challenges associated with coping or performance at work and issues concerning conflicts or inappropriate behavior".

Early intervention (page 52): "Supervisors receive automatic wellbeing alarms that direct them to hold early intervention discussions." Support may take the form of "a change in workload, working hours, or tasks, or competence development in the form of personalized training, coaching, or mentoring".

Inappropriate behaviour (page 52): incidents "will be resolved in accordance with the remediation model for inappropriate behaviour", primarily through a discussion between the parties facilitated by a supervisor and HR if necessary, with appropriate action and follow-up then determined.

Whistleblowing (page 52): "If other reporting methods do not feel safe, Digia employees can also report harassment and inappropriate behavior anonymously through the Whistleblowing channel", whose process is described under G1-1.

Feedback and monitoring (page 53): open verbal feedback is possible in all personnel surveys; a peer feedback model in Workday and an open Teams feedback channel support continuous feedback. "The HR unit conducts an internal, biannual analysis of any reports and cases of inappropriate behavior and discrimination ... including how they were handled and resolved. These incidents will also be discussed with employee representatives, the occupational health and safety organization, and the equality and non-discrimination team". Digia states that it "receives very few reports, but each one is taken seriously and thoroughly investigated".

The datapoint list maps the S1-3 paragraph 32(c) grievance mechanism datapoint to pages 52-53 (page 69).

Taking action on material impacts on own workforce

Reference: pages 53-54.

Actions are set out as a set of Group and Finnish-company instruments; "Development work to harmonize Digia's policies and international operating model is currently ongoing" (page 53).

• Cultural and leadership principles (page 53) - the cultural principles "learning, sharing, courage, and professional pride", adopted in 2018, and new leadership principles introduced in 2025: "respect", "trust and verify", "be present", "own it" and "think ahead", created in collaboration with the Digia community.
• Hybrid work model (page 53) - most work is site-independent with remote arrangements agreed with the supervisor; in 2025 "the company focused on strengthening its sense of community, both virtually and face-to-face".
• Salary and remuneration manual (page 53) - approved by the Compensation Committee and the Management Team, covering salary formation, structures, the salary review process and salary management; "During the reporting year, the company has also been preparing for the Payroll Directive's entry into force in 2026."
• Collective agreement (page 53) - Digia negotiated its own agreement for Digia Plc and Digia Finland Ltd employees, drawing on the general collective agreement for the IT service sector.
• Guidelines on inappropriate behaviour and the early intervention model (page 53) - supervisors and employee representatives have received training to intervene; the early intervention model aims to provide support "before problems escalate".
• Wellbeing (pages 53-54) - occupational healthcare, flexible hours, mental health services and support methods. "In 2025, the main competence development targets were once again related to artificial intelligence and leadership."
• Diversity (page 54) - the Konkarit programme, Pride partnership, salary training for supervisors, analysis and development of equal pay at organisational level, and participation in the Women in Tech and Mimmit koodaa networks.

Effectiveness (page 54): "The impacts of Digia's actions are monitored and measured annually using a broad range of internal and external metrics. Competence is monitored via feedback, the number of training hours, and a variety of targets. The eNPS is the main indicator of employee wellbeing and satisfaction", with particular attention to mental-health-related sickness absences. Management of material own-workforce impacts sits with the HR unit, comprising the HR Director, the Head of Sustainability and HR experts. Digia links this work to SDGs 4, 5, 8 and 10.

Targets related to own workforce

Reference: pages 54-55.

The 2023-2025 HR strategy ran on four focus areas - "learning, goal-orientedness, wellbeing, and a sense of community" - with four measurable targets set for the end of 2025 (page 54).

Two of the four were missed, one materially. On eNPS: "The 2025 eNPS was -80 percent (+60%) in comparison to the 2022 baseline. The results reflect the challenging market situation in the IT sector and the efficiency measures implemented in 2025. At the same time, several other internal indicators of employee satisfaction have remained consistent with 2024 level" (page 54).

On diversity: "In 2025, the proportion of women in executive positions was 14 percent (16%). This objective has proved challenging to achieve due to male dominance in the IT sector. Women accounted for 35 percent (34%) of those in supervisory roles in 2025 ... The company is also aiming to increase the number of women in architectural roles, which was six percent (7%) in 2025" (page 54).

On mental health, the target of fewer than 1.0 days of absence per person per year was met at 1.0 days (1.3), and learning targets were recorded for 58% (52%) of personnel against a 75% goal (pages 54-55).

Process (page 55): "Targets are formulated during discussions with employee representatives in order to gain a better understanding of employees' general and specific needs ... The targets have been reviewed and decided on by the Management Team, and have also been approved by the Board of Directors." Attainment is monitored by the HR unit, the Sustainability Working Group, the Sustainability Steering Group, the Management Team and the Audit Committee.

Characteristics of employees

Reference: page 55.

Headcount at the end of the reporting period (page 55): 1,592 employees (2024: 1,576) - men 1,133 (1,121), women 459 (455), other 0 (0), not reported 0 (0).

By country (page 55): Finland 1,409 (1,444), Sweden 120 (122), Poland 53 (0) and the Netherlands 10 (10). Poland enters the workforce for the first time following the Savangard acquisition.

By contract type, Group totals (page 55):

• Permanent 1,566 (1,564); fixed-term 26 (12); variable working hours 13 (18).
• Full-time 1,457 (1,445); part-time 135 (131).

The gender split of contract types is given as well: permanent contracts 1,116 men and 450 women in 2025 (1,114 and 450 in 2024); fixed-term 17 men and 9 women (7 and 5); variable hours 10 men and 3 women (11 and 7); full-time 1,048 men and 409 women (1,046 and 399); part-time 85 men and 50 women (75 and 56).

The country-level contract table excludes the Netherlands "due to their small number", giving a total of 1,582 (1,566), of which permanent 1,556 (1,555), fixed-term 26 (11), variable hours 13 (18), full-time 1,454 (1,439) and part-time 128 (127). Poland accounts for 41 permanent, 12 fixed-term and 46 full-time employees in 2025 (page 55).

"In 2025, the total number of employees leaving the Digia Group was 177 (146) and the turnover rate was 6.2% (7.7%)" (page 55). "The figures indicate the number of employees at the end of the reporting period", and the headcount by country is cross-referenced to section 4 Personnel of the Financial Statements.

Characteristics of non-employee workers

Reference: page 56.

"The operating model used by Digia's subsidiary Savangard differs from other countries, as it is a well-established practice in the Polish IT sector in particular to utilize a B2B contract model in addition to a company's own employees. This model employed 86 (N/A) people during 2025" (page 56). The 2024 comparative is not available because Poland entered the Group through the Savangard acquisition during 2025 (page 30).

"Digia defines employees working under this model as subcontractors", so they are covered in the S2 chapter rather than treated as own-workforce employees (page 56).

Digia also reports the wider subcontracting population: "In 2025, an average of 355 (374) subcontractors per month worked on various projects through the Digia Hub network" (page 56). The Digia Hub network itself "consists of over 5000 freelancers and hundreds of subcontracting companies in Finland", alongside the PeopleVibe network of around 30 freelance professionals serving Savangard (page 57).

The disclosure gives headcounts only. No breakdown of non-employee workers by gender, by type of engagement (self-employed versus supplied by an employment agency) or by country is presented, and no methodology note explains how the 86 and 355 figures are compiled.

Collective bargaining coverage and social dialogue

Reference: page 56.

"82 percent (85%) of the Digia Group's employees are covered by collective bargaining agreements. Digia has its own collective agreement in Finland, which entered into force in May 2023. This collective agreement covers employees of Digia Plc and Digia Finland Ltd. Digia Plc's subsidiary Productivity Leap Oy uses the Collective Agreement for the IT Service Sector as an unorganized employer. Digia Sweden AB, Climber AB, Top of Minds AB, and Savangard Sp. z o.o. are not covered by a collective agreement. Most Digital Sweden AB does not have any employees. Subcontractors are not covered by Digia's collective agreements, as they are not employed by Digia" (page 56).

The three-percentage-point fall from 85% to 82% coincides with the addition of 53 employees in Poland through the Savangard acquisition, which the same paragraph records as not covered by a collective agreement (pages 55-56).

Digia also presents the ESRS banded table, showing coverage bands from 0-19% to 80-100% for EEA employees, non-EEA regions and workplace representation (EEA only), in each case for countries with at least 50 employees accounting for more than 10% of the total. Finland is placed in the highest band and Sweden (2024) and Sweden and Poland (2025) in the lowest band for both employee coverage and workplace representation (page 56).

No global framework agreement or works council arrangement covering employees is described.

Diversity metrics

Reference: page 56.

"The gender distribution of Digia's senior executives and the age distribution of employees during 2025 is presented below. Digia's definition of a 'senior executive' is a member of the Group Management Team" (page 56).

Gender distribution of the Management Team at 31 December 2025: men 8 (8), 80%; women 2 (2), 20% (page 56). The same split is shown on page 26 under GOV-1, alongside the Board of Directors at 60% men (3) and 40% women (2).

Distribution of employees by age group at 31 December 2025 (page 56):

The three bands sum to the 1,592 total headcount reported under S1-6. The over-50 group grew by 27 people year on year while both younger bands shrank.

Related diversity data appears under S1-5 rather than here: women held 14% (16%) of executive positions against a 25% target, 35% (34%) of supervisory roles and 6% (7%) of architectural roles (page 54). Digia reports gender in the categories women, men and other, with zero employees in the "other" and "not reported" categories (pages 50, 55).

Adequate wages

Reference: page 56.

"Digia always pays at least the minimum wage specified in the collective agreement. If a company is not covered by a collective agreement, the minimum wage will be the one specified in the general collective agreement for the sector. As part of the human rights survey conducted in 2023, Digia also reviewed the remuneration practices of its subcontractors' nearshore and offshore operations to ensure that adequate wages were being paid" (page 56).

The disclosure is a qualitative assurance rather than a quantified one. Digia gives no percentage of employees paid below an applicable adequate wage benchmark, and names no benchmark against which adequacy was tested in the countries where it operates - Finland, Sweden, Poland and the Netherlands. Where collective agreements do not apply, the fallback described is the sector's general collective agreement minimum rather than a living wage reference.

The reach of the statement is worth reading against S1-8, which records that Digia Sweden AB, Climber AB, Top of Minds AB and Savangard Sp. z o.o. are not covered by a collective agreement, and that 82% (85%) of Group employees are covered (page 56).

Pay data itself is reported separately under S1-16, where the gender pay gap of 7% (6%) and the total earnings ratio of 4% (4%) are given for Finland only (page 57).

Social protection

Reference: pages 56-57.

"Digia wants to be a family-friendly employer that takes diverse life situations into account. All Digia Group companies are entitled to family-related leave. Digia supports the varying life situations, working capacity, and care responsibilities of its employees by offering flexible, location-independent working hours and providing occupational healthcare services. These services may vary from country to country and company to company. At Digia Plc and Digia Finland Oy, employees have access to a care service for sick children" (page 56).

"In addition to statutory occupational accident, life, and pension insurance, Digia companies also offer a range of additional insurance, such as medical expense insurance and travel insurance for both working hours and leisure time" (page 57).

The disclosure describes provision qualitatively. It does not present the ESRS breakdown by major life event - sickness, unemployment from the reporting date, employment injury and acquired disability, parental leave, and retirement - nor identify the countries in which employees are not covered by public programmes for each event, nor give the number of employees not covered.

Related figures appear under S1-14 and S1-15: 100% (100%) of the Group's own workforce is covered by occupational healthcare, 100% (100%) of employees are entitled to family-related leave, and 6.5% (6%) took such leave in 2025 (page 57).

Training and skills development metrics

Reference: page 57.

"Competence and its continuous development are essential if Digia is to serve its customers in the best possible way, based on the latest technologies and knowledge. The company wants the value of Digia personnel's expertise to increase during their term of employment" (page 57).

Performance and career development reviews (page 57): 100% (100%) of all personnel participated, with the same 100% figure for men and for women in both 2024 and 2025; the "other" gender category is 0% in both years, consistent with there being no employees in that category (page 55).

Average training hours per person, by gender (page 57):

Average training hours rose 4.2 hours overall, but the movement is in opposite directions by gender: men's average rose 9.2 hours to 62.0 while women's fell 7.7 hours to 47.0, reversing the 2024 position in which women averaged more training than men. Digia does not comment on the divergence.

The metrics are not broken down by employee category, only by gender. Related target data sits under S1-5: learning targets were recorded for 58% (52%) of personnel against a 75% goal, and the 2025 competence development focus was "once again related to artificial intelligence and leadership" (pages 54-55).

Health and safety metrics

Reference: page 57.

"100 percent (100%) of the Digia Group's own workforce is covered by occupational healthcare. The scope of occupational healthcare services may vary between companies. There were two (six) work-related accidents in 2025. There were no fatalities as a result of work-related injuries and work-related health issues at Digia" (page 57).

Recorded accidents fell by two-thirds year on year, from six to two, in a workforce of 1,592 (page 55).

The disclosure covers the datapoints that the EU-legislation list maps to page 57 - S1-14 paragraph 88(b) and (c), the number of fatalities and the number and rate of work-related accidents - while marking paragraph 88(e), the number of days lost to injuries, accidents, fatalities or illness, as "Not material" (page 69). Accordingly no days-lost figure is published.

Digia gives the absolute accident count but no rate per million hours worked, and no separate figure for work-related ill health cases or for the percentage of own workers covered by a health and safety management system. Nor is the coverage of non-employee workers in its own workforce reported here.

The underlying management arrangements are described under S1-1: regular workplace surveys by occupational healthcare, annually approved occupational health and safety action plans covering identified health risks, health checks, ergonomics and early intervention, emergency first-aid training at each site, and HR monitoring of accident statistics (page 51).

Work-life balance metrics

Reference: page 57.

"100 percent (100%) of the Digia Group's employees are entitled to take family-related leave. 6.5 percent (6%) of Digia personnel took family-related leave in 2025; 8.0 percent (6.4%) of all women and 5.8 percent (5.8%) of all men took family-related leave" (page 57).

The disclosure gives the two datapoints ESRS S1-15 asks for - entitlement and take-up, split by gender. Entitlement is universal across the Group. Take-up rose half a percentage point overall, driven entirely by women, whose take-up rose 1.6 percentage points from 6.4% to 8.0% while men's take-up was unchanged at 5.8%. The gap between women's and men's take-up widened from 0.6 to 2.2 percentage points.

The figures are given as percentages of each gender's headcount rather than as numbers of employees, and no breakdown by country or by type of leave is presented.

The supporting arrangements are set out under S1-4 and S1-11: a hybrid work model in which most work is site-independent, flexible and location-independent working hours, occupational healthcare, a care service for sick children at Digia Plc and Digia Finland Oy, and an early intervention model that "may also involve providing long periods of sick leave or family leave" (pages 53, 56).

Compensation metrics (pay gap and total compensation)

Reference: page 57.

Digia reports both metrics for Finland only (page 57):

"The pay gap and total earnings ratio are currently reported only for Finland. Ongoing data integration efforts will allow these metrics to be reported for the entire Group in future years" (page 57). Finland accounted for 1,409 of 1,592 employees at year end, so roughly 11% of the workforce sits outside the reported perimeter (page 55).

The gender pay gap widened by one percentage point year on year. Digia defines it as "the percentage pay gap between male and female employees" and does not state whether it is calculated on gross hourly pay as ESRS S1-16 requires, nor whether it is unadjusted.

The second metric is presented as a percentage: "Total earnings measure the ratio between the median earnings of the person with the highest earnings and the median earnings of other employees in the company" (page 57). A ratio defined that way would normally be expressed as a multiple rather than as 4%, so the figure is hard to read against the ESRS paragraph 97(b) annual total remuneration ratio and is worth checking against the Remuneration Report.

"Digia also analyzes the realization of pay equality with respect to task profiles and the competence classification of positions" (page 57). The datapoint list maps S1-16 paragraphs 97(a) and 97(b) to page 57 (page 69).

Incidents, complaints and severe human rights impacts

Reference: page 57.

"During 2025, Digia did not receive any reports of discrimination as specified in the Equality Act, nor any reports of serious cases of human rights violations. A total of seven (four) whistleblowing reports were received via the Whistleblowing channel. After investigation and requests for additional information, none of these reports were found to require further action" (page 57).

Whistleblowing reports nearly doubled year on year, from four to seven, with none substantiated. The channel is operated by a third party under the EU Whistleblower Directive (EU2021/1937) and is open to employees and external parties, anonymously or by name; reports are handled by a processing team made up of the Chair of the Board's Audit Committee, the General Counsel and a lawyer, and the General Counsel informs the Audit Committee twice a year (page 65).

The disclosure is a nil return on incidents. Digia gives no monetary amount of fines, penalties or damages, and no separate count of complaints filed through other channels such as the internal remediation model for inappropriate behaviour, although HR "conducts an internal, biannual analysis of any reports and cases of inappropriate behavior and discrimination" and states that "Digia receives very few reports" (page 53).

The EU-legislation datapoint list maps S1-17 paragraph 103(a) incidents of discrimination and paragraph 104(a) non-compliance with the UN Guiding Principles on Business and Human Rights and the OECD guidelines to page 57 (page 69).

Policies related to value chain workers

Reference: page 58.

"Digia has developed a Supplier Code of Conduct that is based on Digia's own Code of Conduct. In addition to its Code of Conduct, Digia has an anti-bribery and anti-corruption policy that is based on the UN Convention against Corruption. The company requires its subcontractors to ensure that their suppliers uphold internationally recognized human rights, labor rights, and standards (the UN Universal Declaration of Human Rights, the UN Global Compact, and the ILO Declaration on Fundamental Principles and Rights at Work). It contains rules for suppliers, and prohibits them from using forced or child labor. The Management Team approves the Supplier Code of Conduct, and the legal unit and General Counsel are responsible for implementing and supervising it" (page 58).

"The IT subcontractors in the Digia Hub network are contractually obliged to adhere to the Code of Conduct. Digia's aim is to gradually extend the Code of Conduct to all procurements, so that it covers the entire value chain. ... Digia has not been made aware of any violations of the above-mentioned policies by companies in its value chain. ... Every subcontractor working on a Digia-led project will receive training in the Code of Conduct, and Digia Hub subcontractors will also receive security training" (page 58).

Sustainable Supplier program (page 58): "A risk assessment of subcontractors is carried out as part of the procurement process, and their implementation of responsible sourcing principles is checked before any contracts are signed. This includes an analysis of potential and existing human rights violations. The process applies only to Digia Hub subcontractors, and PeopleVibe subcontractors do not currently fall within its scope." The Management Team approves and supervises the programme, which is coordinated by the risk management and sustainability units with the finance and procurement units.

The datapoint list maps S2-1 paragraphs 17-19 - human rights policy commitments, policies related to value chain workers, non-compliance with the UN Guiding Principles and OECD guidelines, and ILO due diligence policies - to page 58 (page 69).

Engaging with value chain workers

Reference: page 58.

"Collaboration and communication between Digia and its subcontractors takes place both directly (between employees) and indirectly (between their legal representatives). Applicants undergo extensive interviews before they are permitted to join Digia Hub network. Although each customer project has its own processes, engagement is both regular and managed. Digia stays in regular contact with members of its subcontracting network, and also requests feedback from members. ... After a project has ended, discussions will be held with the subcontractor, and they will be directed toward the next project. In the case of subcontracting, operational responsibility for implementing these actions lies with Digia Hub and PeopleVibe business leads" (page 58).

Surveys and audits (page 58): "Digia conducts an annual survey of key subcontractors according to the company's risk classification. The survey aims to ensure compliance with Digia's Code of Conduct. Supplier surveys provide a comprehensive understanding of workers in the subcontracting network. Digia will also carry out audits whenever they are deemed necessary. The effectiveness of these activities is assessed annually as part of Digia's Sustainable Supplier program and business unit management. The program does not currently cover PeopleVibe's subcontractors."

Higher-risk geographies (page 58): "Regular discussions are held with subcontractors in India, and workers' rights are an integral aspect of these conversations. Digia is proactively expanding its supplier management, and is seeking to increase dialogue with all of its key suppliers."

A stated limit (page 58): "Digia has no framework or other agreements with trade unions concerning workers in the value chain." Engagement is therefore with the subcontracting companies and individual subcontractors rather than with their representatives, and S2-5 records that the target-setting process "has not involved any direct contact with value chain workers or their representatives" (page 59).

Remediation and channels for value chain workers

Reference: page 58.

"Subcontractors can raise concerns by directly contacting their Digia project manager or the senior vice president of the business area. Subcontractors will have the opportunity to provide feedback during the one-on-one discussions that are arranged after a project has ended" (page 58).

"By signing Digia's Supplier Code of Conduct, the supplier agrees to immediately report any violations of the code so that the situation can be promptly addressed. Everyone has access to the Whistleblowing channel, and the link is available in the Supplier Code of Conduct and on the websites of both Digia and its subsidiaries" (page 58).

The whistleblowing channel is the same third-party operated channel described under G1-1: available under the EU Whistleblower Directive (EU2021/1937), usable anonymously or by name, with Digia "committed to ensuring that no retaliatory measures will be taken against whistleblowers"; reports are handled by a processing team of the Chair of the Board's Audit Committee, the General Counsel and a lawyer (page 65). Digia's subsidiary Savangard operates its own separate channel (page 65).

Seven whistleblowing reports were received in 2025 across all channel users, none of which required further action (page 57), and "No significant human rights issues or violations were identified in the supply chain in 2025" (page 59).

The disclosure does not state whether Digia has assessed value chain workers' awareness of, or trust in, these channels, and no separate count of concerns raised by subcontractors is given.

Taking action on material impacts on value chain workers

Reference: pages 58-59.

"Digia seeks to prevent negative impacts on value chain workers by ensuring that all Digia Hub subcontractors comply with the Supplier Code of Conduct. This is accomplished with annual monitoring to check how many subcontractors have signed the Code of Conduct" (page 58). "No significant human rights issues or violations were identified in the supply chain in 2025" and "No risks were identified during the reporting year" (page 59).

Due diligence in practice (page 59): "A background check and risk assessment will be performed for new subcontractors as part of the Sustainable Supplier program. Any detected risks will be sent for processing and follow-up measures in accordance with Digia's risk management process. A separate report is required for companies with the highest risk rating. Supplier reports may lead to the termination of cooperation. Corrective action may also be agreed upon, and its implementation will then be monitored. No such cases have occurred to date. PeopleVibe is not in the Sustainable Supplier program."

"All new subcontractors must complete a questionnaire about their sustainability policies and processes. The program also includes annual surveys, and audits of selected suppliers are performed as necessary" (page 59). Feedback is reviewed by the Digia Hub management team; one worked example is given - "the company has implemented a subcontractor's suggestion concerning access to certain Digia forums, such as tribal activities, and the industry training offered by the company". Digia Hub's business lead sits on the Corporate Responsibility Working Group, so identified risks reach management (page 59).

Named impacts and responses (page 59): "The potential negative impacts that may occur during subcontracting include health concerns or fatigue, which increase absenteeism. In such situations, Digia will attempt to discuss alternative solutions, such as reduced daily working hours." On equal treatment: "The male dominance seen in the IT sector is also reflected in the subcontracting network. Digia is working to increase the proportion of women in a variety of roles, including subcontracting, but competence requirements do not always allow this." Digia links the work to SDG 8.

No number of audits performed in 2025 is given, and the datapoint list maps S2-4 paragraph 36 on upstream and downstream human rights issues and incidents to pages 58-59 (page 69).

Targets related to value chain workers

Reference: page 59.

"Digia's goal was for 100 percent of Digia Hub subcontractors to commit to the Supplier Code of Conduct by the end of 2025. The aim is to ensure that human rights and fair working conditions are realized for value chain workers in Digia's subcontracting. The target was set for the 2023-2025 strategy period, and progress was monitored on an annual basis during this period. The target level of 100 percent (89%) was achieved in 2025" (page 59).

The same target appears in the strategy-period objectives table under S2 Workers in the value chain, with the objective "Digia's subcontractors are committed to Digia's Code of Conduct", the indicator "Percentage of subcontractors who are committed to Digia's Supplier Code of Conduct", 89% in 2024 and 100% in 2025 (page 38).

Target setting and monitoring (page 59): "The target was set in collaboration with Digia Hub as part of Digia's strategy work. It was decided on by Digia's Management Team and approved by the Board of Directors. The target-setting process has not involved any direct contact with value chain workers or their representatives. Development measures and target attainment were monitored at the Sustainability Working Group's quarterly meetings. In its biannual meetings, Digia Hub's strategy working group discussed these measures in greater detail and reviewed the sustainability targets."

Two limits are visible from the disclosure itself. The target measures signature of a code rather than an outcome for workers, and its scope is the Digia Hub network only - the PeopleVibe network of around 30 freelance professionals serving Savangard is outside the Sustainable Supplier program (pages 57-59). No successor target for the next strategy period is disclosed.

Policies related to consumers and end-users

Reference: pages 60-61.

"Systems and guidelines relating to Digia's consumers and end-users include the Code of Conduct, the ISO 9001 quality management system, the ISO 27001 information security management system and its compliant information security and privacy policies, the AI policy and AI management model, and Digia's human rights commitment. No significant changes were made to the Code of Conduct during the 2025 reporting year. Development work to harmonize Digia's international operating model and policies is currently ongoing" (page 60).

Quality (page 60): the ISO 9001 quality management system "covers the entire Group, but the ISO 9001 quality certificate applies only to Digia Finland Ltd and the Group's support functions"; the quality unit implements it, supervised by the Quality Steering Group and the Management Team.

Information security (page 60): "Some of the Group's businesses have ISO 27001 certification. The certificate covers the Financial Products and Services unit and the following units in the Managed Services business area: Integration and Data, Secure Development and Operations, Managed Services, MOST Digital Finland, Productivity Leap Oy. It also covers all of the Group's support functions and its offices in Helsinki, Tampere, Jyvaskyla, Turku, Oulu, and Rauma. Savangard Sp. z o.o. ... is also ISO 27001 certified. All of Digia's businesses comply with the ISO 27001 standard's guidelines and security controls." The CSO Office is responsible Group-wide.

Data protection (page 60): the internal privacy policy "is applied throughout the Group and covers all Digia employees, including executives"; a Data Protection Officer ensures implementation, the Management Team supervises, and the policy "covers both Digia's own systems and operations and those implemented for customers".

Artificial intelligence (pages 60-61): "During the reporting year, the company introduced an updated AI policy based on the company's ethical principles and ISO 27001 requirements. Digia also adopted an AI management model to minimize the risks associated with AI use". It "applies to all Digia personnel and subcontractors who use artificial intelligence in customer projects"; the legal unit and General Counsel implement and supervise it.

Accessibility (page 61): Digia promotes "accessibility and digital equity in its services", referencing Design for All, the Web Content Accessibility Guidelines, the Digital Services Act and EN 301 549. "There have been no identified or reported cases of non-compliance at Digia concerning end-users" under the UN Guiding Principles, the ILO fundamental principles or the OECD Guidelines.

Engaging with consumers and end-users

Reference: page 61.

"Digia's engagement with end-users is indirect, and occurs through its customers as part of operational and strategic cooperation with customers. Digia's customers act as trustworthy agents who have an understanding of their own customers' and end-users' situations and needs. The methods and frequency of engagement between Digia and its customers will vary depending on both the project in question and the specific characteristics of the customer relationship" (page 61).

Accountability (page 61): "Account managers are in charge of engaging with the company's customers in accordance with the customer care model. The effectiveness of this engagement is monitored by regularly collecting customer feedback through a variety of channels and reviewing the outcomes of collaboration."

How views reach decisions (page 61): "To ensure that services meet the needs of different user groups, customer and end-user perspectives will be taken into account in decision-making and impact management through, for example, close customer collaboration, feedback, and assessments of usability and accessibility requirements. The company is also continuously developing its processes and services on the basis of customer feedback to ensure that impact management is based on real customer needs and expectations."

Vulnerable groups (page 61): "Special attention is paid to end-users who may be particularly vulnerable to the potential negative effects of digital services, such as the elderly, children and young people, people with disabilities, or other vulnerable groups. Some of the services provided by Digia fall under the scope of the Digital Services Act, which sets clear requirements for accessibility and security."

Digia does not identify detailed end-user demographics, stating that it "does not have any detailed information about end-user demographics, as they vary between customers and customer projects" (page 59). The Net Promoter Score, reported under S4-5, is the main measure of customer satisfaction and trust (page 63).

Remediation and channels for consumers and end-users

Reference: pages 61-62.

"The most important processes for remediating negative impacts on end-users are related to potential breaches of data security or privacy. Digia's security measures are mainly preemptive ... If a data breach does occur in spite of these measures, Digia has a Major Incident Management (MIM) process in place to handle the situation and minimize any damage and its consequences. This process aims to restore normal service as quickly as possible ... The process includes instructions for communicating the situation to customers, individuals affected by the breach, and any other stakeholders, such as the data protection officer" (page 61).

Escalation (page 61): "Data security and protection officers monitor the positive and negative impacts of the company's operations. They report directly to the director in charge of security, who in turn reports to the CEO."

Training (page 61): "All employees working in Digia's operations in Finland must familiarize themselves with the company's information security policies and guidelines during the onboarding process, and they also complete an annual information security and data protection training package. The same goes for every subcontractor who works on the company's projects. The Board of Directors has not completed the training. ... A Group-wide operating model is currently being developed."

Data protection contact (page 62): "Digia has appointed a data protection officer whose contact details are publicly available on the company's website, and who can be contacted directly."

Accessibility (page 62): "Digia actively seeks to identify any potential accessibility needs or gaps in its customer interactions, and assesses if any action is required on a customer-by-customer basis. The aim is for solutions to be accessible by default. If accessibility requirements are not being met, any required measures will be agreed upon in cooperation with the customer. Digia has not received any complaints about accessibility from either its customers or their end-users during the reporting period."

The Whistleblowing channel described under G1-1 is also available (page 62). No direct end-user grievance channel operated by Digia is described, consistent with its stated indirect relationship with end-users.

Actions on material impacts on consumers and end-users

Reference: page 62.

"The quality management system and its processes help Digia ensure that the company meets both its customers' expectations and the specified requirements. Systematic monitoring enables continuous improvement and quality enhancements. Maintaining a high level of information security and data protection is an integral part of this package. It is therefore supported by personnel training, administrative and technical controls, internal and external audits, and continuous improvements to processes" (page 62).

Information security (page 62): "During the reporting year, Digia focused on company-wide AI security issues and new EU regulations: NIS2 (measures to ensure a common, high level of cybersecurity), CER (to ensure the resilience of critical entities) and DORA (to strengthen the digital resilience of financial entities). An internal NCD project was launched in 2024 to assess compliance with these requirements and take any necessary corrective action. This project continued into 2025. Corrective action was taken during the project, and Digia achieved compliance with these regulations by the time the project ended in early 2025." A new SOC (Security Operations Center) service has been introduced at Digia's companies in Finland, "integrated into internal systems and processes to anticipate a variety of cybersecurity threats and attacks, and ensure a rapid response".

Data protection (page 62): "In 2025, the data protection unit and legal unit collaborated on a training module about personal data processing agreements for Digia's companies in Finland."

Artificial intelligence (page 62): "AI use cases, the risks associated with them, and their compliance (with respect to the AI Act, data protection and information security) are managed with the aid of use case assessments, which identify risks and enable the required mitigating action to be taken. Digia designs its AI solutions to be non-discriminatory, transparent, and respectful of privacy. AI decision-making must be supervised, and data must be processed in accordance with EU data protection legislation." The AI management model "will be mobilized throughout the Group in 2026".

Accessibility (page 62): Digia trains personnel and raises accessibility with customers; "Accessibility audits of customers' online services help Digia to determine a customer's current situation, identify any areas for improvement, and offer the necessary action". The work is linked to SDG 10. No count of accessibility audits performed in 2025 is given.

Targets related to consumers and end-users

Reference: pages 62-63.

Two targets are reported for the 2023-2025 strategy period.

Security training (pages 62-63): "One of the company's strategic sustainability themes is to maintain a high level of information security and data protection, as this is closely connected to the end-users of Digia's services. The goal for the strategy period was for at least 90 percent of Digia employees to have completed security training in 2025. Progress has been monitored on an annual basis. 95 percent (94%) of personnel completed this training in 2025. The company has updated its security training to reflect the revisions made to its ISO 27001-certified security management system ... In the future, everyone working for the Group (including its subsidiaries) will be required to complete the training."

Customer satisfaction (page 63): "The Net Promoter Score (NPS) is Digia's main measure of customer satisfaction, customer experience, and trust in customer partnerships ... Digia's goal for 2025 was to improve its NPS by 25 percent compared to 2022. This target was set for the 2023-2025 strategy period, and progress has been monitored and reported since the beginning of the period. In 2025, the NPS improved by 34 percent (+18%) compared to 2022, which exceeded the set target. The Net Promoter Score is calculated by subtracting the percentage of detractors from the percentage of promoters."

Both targets were met. The strategy-period objectives table places the security training target under S4 with the objective "Safe partner", located at pages 62-63, and the NPS target under the "Reliable partner (G)" heading with the objective "A visionary, reliable, and secure partner", located at page 63 (page 38).

Process (page 63): "Both goals were set in conjunction with the company's strategy work. They were decided on by Digia's Management Team and approved by the Board of Directors. Digia's internal stakeholders were involved in setting these targets, and information gathered through customer feedback processes was also utilized." No end-users or their representatives were involved in setting the targets, and no successor targets for the next strategy period are disclosed.

Business conduct policies and corporate culture

Reference: pages 64-65.

"Digia's Corporate Governance guidelines set out the basic principles of the company's corporate governance for the entire Group. The guidelines are approved by the Board of Directors and supervised by the General Counsel" (page 64).

Code of Conduct (page 64): "Digia's sustainability is based on the company's Code of Conduct, which is approved by the Board of Directors, and the UN Sustainable Development Goals ... The Code of Conduct defines the principles that help Digia personnel make ethically sustainable decisions in their work. The Code of Conduct is permanent in nature, but will be updated as necessary. The code focuses on conducting sustainable business, protecting the environment, a healthy workplace community, respecting human rights, data protection, and ethical practices. Compliance with the Code of Conduct applies not only to Digia employees but also to subcontractors and partners. The Code of Conduct is publicly available on Digia's website in both Finnish and English. The legal unit is responsible for implementing the Code of Conduct under the supervision of the General Counsel."

Anti-bribery policy (page 64): "Digia also has a supplementary anti-bribery and anti-corruption policy that is based on the UN Convention against Corruption. It applies to everyone working at or for Digia ... The policy is publicly available on the company's website ... approved by the Management Team and Board of Directors."

Training (page 65): mandatory annually for all Digia employees throughout the Group including senior executives, in Finnish and English. "The Board of Directors has not completed the training. The goal is for 90 percent of personnel to complete annual training. 96 percent of personnel (84%) completed this training in 2025. Employees with long absences have been excluded from the figures."

"Digia has not identified any internal activities that would be particularly vulnerable to corruption and bribery" (page 65).

Whistleblowing (page 65): a third-party operated channel under the EU Whistleblower Directive (EU2021/1937), open to employees and external persons, anonymously or by name, with no retaliation and compliance with the Finnish Whistleblower Act. Savangard has its own channel. The processing team is "the Chair of the Board of Directors' Audit Committee, the General Counsel, and a lawyer", escalating where necessary to an appointed Group Management Team member; "Twice a year, the General Counsel informs the Audit Committee of any reports that have been received via the whistleblowing channel and how they have been handled."

The datapoint list maps G1-1 paragraphs 10(b) and 10(d) - the UN Convention against Corruption and protection of whistleblowers - to pages 64-65 (page 69).

Management of relationships with suppliers

Reference: page 65.

"Digia's relationships with its suppliers are described in more detail in section S2 Workers in the value chain. Digia treats all of its suppliers equally, and has processes and guidelines in place to ensure that invoices are processed in accordance with payment terms" (page 65).

Invoice process (page 65): "Digia's invoice payment process has been described as part of a larger process description. Upon receipt of an invoice, the Group's financial administration will process the invoice and forward it to the recipient of the invoice for registration and approval. The invoice processing system will automatically remind the invoice handler of any unpaid invoices. The Group's financial administration will also send reminders about unpaid invoices as necessary."

The substantive supplier-management content sits in the S2 chapter that this disclosure cross-refers to: the Supplier Code of Conduct approved by the Management Team and supervised by the legal unit and General Counsel; the Sustainable Supplier program, under which "a risk assessment of subcontractors is carried out as part of the procurement process, and their implementation of responsible sourcing principles is checked before any contracts are signed", covering Digia Hub but not PeopleVibe; annual surveys of key subcontractors by risk classification; and audits as necessary (page 58).

Two elements ESRS G1-2 asks for are not addressed. Digia does not describe its policy on preventing late payments to small and medium-sized enterprises specifically, and it does not state whether social and environmental criteria are applied in the selection of suppliers beyond the Supplier Code of Conduct commitment and the risk assessment. Payment performance itself is reported separately under G1-6 (page 65). This is a change from FY2024, where G1-2 was not covered by the index.

Prevention and detection of corruption and bribery

Reference: page 65.

"Digia has zero tolerance for all forms of bribery and corruption. Digia's anti-bribery and anti-corruption policy defines rules and guidelines for promoting ethical and legal activities throughout the company. The anti-bribery and corruption policy is included in Code of Conduct training, which is mandatory for all Digia employees" (page 65).

Reporting routes (page 65): "All employees are encouraged to report any suspected cases of corruption and bribery to their manager or the General Counsel. The company also has a Whistleblowing channel whose reporting process is described in Disclosure Requirement G1-1 ... All reported cases will be handled according to this process."

That process, set out under G1-1, is investigator-independent by design: reports go to a processing team comprising the Chair of the Board's Audit Committee, the General Counsel and a lawyer, escalating where necessary under an appointed Group Management Team member, and the General Counsel reports to the Audit Committee twice a year (page 65). Reports may be filed anonymously and Digia commits to no retaliation.

Risk assessment (page 65): "Digia has not identified any internal activities that would be particularly vulnerable to corruption and bribery", so no functions-at-risk are named.

Training coverage is reported through the Code of Conduct completion rate - 96% of personnel in 2025 against a 90% target (84% in 2024), with the Board of Directors not having completed the training (page 65). Digia does not report separate anti-corruption training statistics by function at risk, nor break training delivery down for members of the administrative, management and supervisory bodies as ESRS G1-3 contemplates. Outcomes are reported under G1-4.

Targets related to business conduct

Back-filled from the business conduct chapter and the strategy-period objectives table, where targets are addressed as part of the MDR-T disclosures rather than as a numbered disclosure requirement. G1-3 Targets became a standalone DR only in the 2025/2026 ESRS.

Digia does set a measurable business conduct target. The sustainability objectives table for the 2023-2025 strategy period gives, under G1 Business conduct, the objective "Entire organization has adopted ethical ways of working", the key indicator "Percentage of employees who have completed annual Code of Conduct training" and the target level "90% of Digia employees have completed annual Code of Conduct training", located at pages 64-65. Results: 84% in 2024 and 96% in 2025 (page 38).

The target is restated in the G1 chapter: "The goal is for 90 percent of personnel to complete annual training. 96 percent of personnel (84%) completed this training in 2025. Employees with long absences have been excluded from the figures" (page 65). The Board of Directors has not completed the training (page 65).

MDR-T frames the target-setting basis: "The company's sustainability program and its targets cover the strategy period 2023-2025", built on strategic policies, stakeholder expectations, the characteristics of the IT service market, the impacts of operations, and the UN SDGs and Global Compact; "The importance of these objectives is underlined by the fact that sustainability targets are integrated into management incentive schemes" (page 37).

Effectiveness is also tracked in the absence of outcome targets, the other limb of MDR-T: the General Counsel informs the Audit Committee twice a year of whistleblowing reports and how they were handled, sustainability risks including "ethical conduct, good governance" are reported to the Audit Committee twice a year, and outcomes are reported under G1-4, where Digia "had no confirmed cases of bribery or corruption in 2025" (pages 29, 65).

No target is set for supplier commitment under G1; the equivalent 100% Supplier Code of Conduct target is reported under S2-5 (page 59), and no successor business conduct target for the next strategy period is disclosed.

Incidents of corruption or bribery

Reference: page 65.

A nil return: "Digia had no confirmed cases of bribery or corruption in 2025" (page 65).

The EU-legislation datapoint list maps both G1-4 datapoints - paragraph 24(a) fines for violations of anti-corruption and anti-bribery laws, and paragraph 24(b) anti-corruption and anti-bribery norms - to page 65 (page 69). No monetary amount of fines is stated, consistent with there being no confirmed incidents, and no convictions are reported.

Related figures appear elsewhere in the statement. Seven (four) whistleblowing reports were received through the third-party channel in 2025 and "After investigation and requests for additional information, none of these reports were found to require further action" (page 57). In the supply chain, "Digia has not been made aware of any violations of the above-mentioned policies by companies in its value chain" and "No significant human rights issues or violations were identified in the supply chain in 2025" (pages 58-59).

Digia does not break the nil return down into the ESRS categories - convictions and fines for violation of anti-corruption and anti-bribery laws, incidents in which own workers were dismissed or disciplined, and incidents relating to contracts with business partners that were terminated or not renewed - but each of those would be zero on the face of the disclosure. The absence of any identified functions at particular risk of corruption is stated under G1-1 (page 65).

Political influence and lobbying activities

Reference: page 65.

"Digia does not itself participate in any political or other lobbying activities through donations or sponsorship. The company has no legal obligation to be a member of any lobbying organization. Digia is a member of Technology Industries of Finland. Members appointed to administrative, management or supervisory bodies in the reporting period have not held a similar position in public administration during the preceding two years" (page 65).

The disclosure is a nil return on the two quantitative limbs of ESRS G1-5: no financial or in-kind political contributions are made, so no total is given and no breakdown by country or recipient is needed; and the revolving-door datapoint on the representation of members of the administrative, management and supervisory bodies who held comparable positions in public administration in the two preceding years is answered as none.

The one affiliation named is Technology Industries of Finland. Digia describes cooperation with that body elsewhere in the statement, alongside TIEKE Finnish Information Society Development Center and the Global Compact, for purposes including "Influencing the development of the IT sector and information society, including green coding and calculating the carbon footprint of software" (page 31).

Digia does not disclose registration in the EU Transparency Register or an equivalent national register, and does not name the main topics on which it engages with policymakers. Its own account of regulatory engagement is receptive rather than advocative: the Board and its committees monitored the Green Omnibus initiative and risks associated with new regulations such as NIS2 and CSRD during 2025 (page 27), and Digia "is actively monitoring regulatory developments, such as the EU AI Act" (page 61).

Payment practices

Reference: page 65.

"The average time that Digia takes to pay an invoice, its average payment terms, and a breakdown by main categories of suppliers are shown in the table below. Digia has not defined any category-specific standard payment terms for its suppliers. ... The category All supplier groups contains information about all of the invoices paid by the Group. Digia is not currently involved in any ongoing legal proceedings for late payments" (page 65).

Group-wide average payment time improved by one day to 24 days against unchanged average terms of 22 days, so Digia pays on average two days beyond its own terms. The pattern holds in each category: payment time exceeds payment terms by two days for subcontracting (29 versus 27), by two for software and cloud services (32 versus 30) and by one for IT service providers (21 versus 20).

Two ESRS G1-6 elements are not given. Digia states it has no category-specific standard payment terms, so no standard terms figure is disclosed, and no percentage of payments aligned with standard terms is reported. The number of outstanding legal proceedings for late payments is answered as none.

Supplier-relationship management, including the Supplier Code of Conduct and the Sustainable Supplier program, is cross-referred to G1-2 and the S2 chapter (pages 58, 65).