Elisa Oyj

Reference: pages 39-41.

Elisa's Board of Directors (BoD) has a minimum of five and maximum of nine members; eight were elected at the 12 April 2025 AGM. Two committees were active in 2025: the People and Compensation Committee and the Audit Committee. "The Board has assessed that each member of the Board of Directors is independent of the company and its significant shareholders", with one exception noted for a director tied to shareholder Solidium (p.40).

The Corporate Executive Board (CEB) and Corporate Responsibility Management Board (CRMB) sit below the Board. Employees are not represented on the BoD or CEB; a European Works Council provides employee dialogue instead (p.40).

The Board has assessed its own expertise in material sustainability topics, listing "compliance (including anti-bribery and corruption); climate change; circular economy; consumer and end-user related matters...; cybersecurity and critical infrastructure; human rights...; personnel...; supplier management; and sustainability reporting" (p.41). Board gender composition: 5 male / 3 female (38%, or 40% under the Finnish Limited Liability Companies Act definition) (p.41).

Reference: pages 40-42.

The Audit Committee "is tasked with supervising the proper organisation of the company's sustainability reporting, administration and audits, internal auditing and risk management, including sustainability-related impacts, risks and opportunities" (p.41). Sustainability reporting matters were "monitored, assessed and discussed in two (2) meetings during 2025", and the Audit Committee "reviewed compliance topics in five (5) meetings" (p.41).

The CRMB, comprising executive- and management-level representatives, "held eight (8) meetings during 2025" and monitors DMA preparation, sustainability strategy implementation and progress of sustainability measures (p.41-42).

The key matters and material topics addressed by senior leadership in 2025 were: "Critical infrastructure and security; Climate transition plan and climate reduction target; Digital wellbeing and safety" (p.41). The 2025 DMA results were reviewed by the CRMB in April, the CEB in May, the Audit Committee in July and the Board in November 2025 (p.48).

Reference: page 42.

"Elisa has a share-based incentive plan for the CEO, members of the CEB and specific key personnel, which includes sustainability targets." For the 2025-2027 performance period this carries "a weighting of 5% for employee engagement and 5% for the ESG development target (CO2 reduction)" (p.42).

The 2025 short-term incentive scheme for the CEO "included a 5% weighting for the ESG development target (CO2 reduction) and 5% for the employee engagement score target." The conditions for Elisa's Personnel Fund for 2025 "also included carbon emission reduction targets." Performance against sustainability-related targets is reviewed annually by the Board (p.42).

Reference: page 48.

Elisa maps the ESRS 1 core elements of due diligence to sections of the Statement: (a) embedding due diligence in governance, strategy and business model -> "Sustainability governance; strategy and business model"; (b) engaging with affected stakeholders -> "Interests and views of stakeholders"; (c) identifying and assessing adverse impacts -> "Double materiality assessment"; (d) taking action on adverse impacts and (e) tracking effectiveness -> both "Disclosed as part of each material topic. Table: Stakeholder dialogue and material topics in 2025" (p.48).

The narrative introducing the table states Elisa "seeks to prevent adverse impacts that are directly linked to its operations, products or services through business relationships across the Elisa Group" (p.48), with topic-specific due diligence process descriptions given alongside each material topic elsewhere in the statement.

Reference: pages 42-43.

Elisa operates "a risk management and internal control system for the preparation and reporting of its Sustainability Statement", focused on "the harmonisation, accuracy and quality of ESG data and reporting process" (p.42). FY2025 is "Elisa's 13th consecutive assured report."

Controls include Group-wide competence development and training for reporting participants, up-to-date guidelines/manuals, and "the four eyes principle: the roles of the data filer and approver are separated." The Sustainability function reviews data during consolidation, and final disclosures are shared with data approvers and management before assurance and publication (p.42).

"The sustainability risk reporting assessments and internal control evaluations are monitored annually by the Audit Committee...and by...(CRMB)." Internal Audit "audited Elisa's sustainability reporting processes and systems in 2024," with key recommendations implemented during 2025 (p.42-43).

Reference: pages 43-44.

Elisa "serves approximately 2.8 million consumer, corporate and public administration customers" in Finland and Estonia and internationally, employing 6,744 people across 21 countries with FY2025 revenue of EUR 2,257 million (p.43). Segments: Consumer Customers, Corporate Customers, and Elisa Industriq (international software services).

Sustainability focus areas for the 2025-2027 strategy period are "Climate transition" and "Responsible digital transformation" (p.43). The value-chain overview (p.44) maps material topics across upstream (technology/device resellers, equipment manufacturing, mining/material extraction, maintenance and construction, software consultants, service providers - tagged with Climate change, Workers in the value chain, Resource inflows, Own workforce), own operations (networks/data centres, employees - Climate change, Resource use and circular economy, Own workforce, Business conduct, Critical infrastructure) and downstream (consumers/end users, societies, service providers - Resource outflows including waste, Privacy, Health and safety, Freedom of expression). "The most material upstream impacts and risks are associated with climate change mitigation, resource inflows, and labour and human rights concerning workers" (p.43-44).

Reference: page 45.

Elisa engages stakeholders through "meetings, events and surveys," reviewed within relevant Business Management Boards and used for the DMA (p.45). Named stakeholder groups and expectations include: Employees - expect support for "physical, mental, financial and social wellbeing" and action on "diversity, equity and inclusion"; Customers - expect transparency and responsibility on "critical infrastructure, privacy, cybersecurity and device circularity"; Key partners and suppliers - expect "transparent and ethical business conduct" and collaboration on shared sustainability targets and risk mitigation (p.45).

Government/regulator and civic/non-profit stakeholder groups are engaged on privacy, cybersecurity, resilience and CSRD-related regulation through surveys, meetings, lobbying activity monitoring and project cooperation (referenced table, p.45).

Reference: pages 48-53.

Impact materiality used ESRS-guided scale/scope/irremediability scoring; "the determined materiality threshold yielded a final list of 22 material topics, sub-topics and sub-sub-topics that were assessed as having a score of eight or higher" (p.49). Financial materiality scoring (revised in 2025) yielded "a final list of nine (9) material risks and three (3) material opportunities...assessed as high or very high" (p.49).

Material topics identified: climate change (E1), resource use and circular economy (E5), own workforce (S1), workers in the value chain (S2), consumers and end-users (S4), business conduct (G1), plus the entity-specific topic "critical infrastructure" (p.48, 50-53). "Following the DMA process, the topics of pollution, water and marine resources, biodiversity and ecosystems and affected communities have been determined not to be material for Elisa, as they scored below the established thresholds for both impact and financial materiality" (p.48). Note: SBM-3 is one of the disclosure points for which Elisa applies an ESRS phase-in provision for selected data points in 2025 (p.40).

Reference: pages 48-49.

Elisa's IRO identification and assessment process combines its double materiality assessment (DMA) with structured analyses of "technology-related roadmaps, competitor activities and various market dynamics" and stakeholder engagement (p.48, cross-referenced from the E1 approach section). Impact materiality is scored on "scale, scope and irremediable character or realisation of impact," using irremediable character for negative impacts and realisation of impact for positive impacts, combined with a likelihood matrix (frequency, mitigation procedures, business continuity); "the final score of each impact was calculated as the severity of that impact multiplied by the likelihood of that impact" (p.49).

Financial materiality risk scoring is "based on two key factors: the potential financial impact of the risk on annual profit and the effectiveness of Elisa's mitigation measures," informed by third-party, science-based assessments over a ten-year horizon; opportunities are scored "solely on the potential positive financial impact," with "only opportunities that have high financial impacts...considered to be material" (p.49). Results were reviewed by CRMB, CEB, Audit Committee and the Board through 2025 (p.48).

Reference: pages 92-93 (Appendix 1, ESRS Index).

Elisa's ESRS content index ("Appendix 1 / ESRS Index") lists, for each Standard, the Disclosure Requirements covered and their page Location, e.g. GOV-1 to GOV-5, SBM-1 to SBM-3 and IRO-1 (pp.39-48); E1-1 to E1-7 and E1-9 (pp.61-67, with E1-9 flagged "Phased in"); E5-1 to E5-6 (pp.69-71, with E5-6 flagged "Phased in" and no location); S1-1 to S1-9, S1-13, S1-14 and S1-17 (pp.72-78, with S1-7 flagged "Phased in" and no location); S2-1 to S2-5 (pp.79-81); S4-1 to S4-5 and the entity-specific Critical infrastructure disclosures (pp.82-87); and G1-1 to G1-4 (pp.88-90). This index is the basis on which "reported" status is determined for every other disclosure in this file: a DR omitted from it (E2, E3, E4, S3 topics; E1-8; S1-10 to S1-12, S1-15, S1-16; G1-5, G1-6) is treated as not covered by Elisa's own concordance.

Reference: pages 62-64.

Elisa's transition plan targets "a 42% absolute reduction in Scope 1, 2 and 3 GHG emissions from the 2021 baseline" by 2030, en route to a Net-zero 2040 long-term target; "Climate targets are reviewed by Elisa's BoD and approved by the CEB" (p.62). The Climate Transition Plan (CTP) is supported by a Climate Transition Action Plan (CTAP) for the 2025-2027 strategic period, integrated into Elisa's Environmental (EMS) and Energy (EnMS) Management Systems, overseen by the CRMB and the Environment and Energy Working Group (p.62).

Three main decarbonisation lever clusters are identified: energy, supply chain and circular economy, partly aligned to EU Taxonomy-eligible activities (electric heat pumps CCM 4.16, distributed energy storage CCM 4.10, device circularity CE 5.1) (p.62). "Elisa has not identified significant harm to external stakeholders from its climate transition planning" (p.64). No locked-in GHG emissions quantification or dedicated CapEx/OpEx transition-plan figure is disclosed.

Back-filled from ESRS 2 IRO-1 / the E1 climate DMA section, where this content is disclosed in the FY2025 report (page 61). This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

"Elisa's scenario analysis, based on various information sources such as the EU, Cicero and IPPC, evaluates how different climate futures (e.g. 1.5 °C to 3 °C warming) could affect its business" (p.61), covering both physical and transitional risks over short-, medium- and long-term horizons. The analysis draws on "flooding, severe storms and wildfire hazards" and finds that "Finland and Estonia...exhibit relatively low exposure and vulnerability to climate change," though "some of Elisa's international offices face higher risks in specific areas" (p.61).

No single named scenario (e.g. SSP5-8.5, IEA NZE 2050), explicit temperature-projection-per-scenario rationale, or stated analysis date is disclosed - the description is qualitative and source-referenced only.

Back-filled from ESRS 2 SBM-3, where this content is disclosed in the FY2025 report (pages 61-62). This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

"Elisa conducts regular climate resilience analysis across its operations and key suppliers to identify vulnerable locations," basing the analysis on "carbon footprint, regional climate projections, supply chain dependencies and regulatory context," and optionally "geopolitical shifts, energy market volatility and new technological developments" (p.61). It can apply to "infrastructure, workforce and service delivery, to identify critical vulnerabilities and prioritise...mitigation actions." "Insights from both scenario and resilience analyses are integrated into the company's DMA process and the climate transition planning" (p.61-62).

No formal ESRS-defined resilience-analysis outcome statement, uncertainty disclosure, or explicit capacity-to-adjust discussion (financial flexibility, asset redeployment) is given.

Reference: pages 61-62.

Elisa maintains "Group-wide policies to support climate change mitigation, adaptation and environmental sustainability," including the Code of Conduct, and the Environmental and Energy Policies (p.61). In 2025 Elisa "reaffirmed its commitment to using 100% renewable electricity," including "87,600 MWh of wind power electricity acquired through a PPA agreement with the Puutikankangas wind farm," and expanded sustainable procurement criteria and supplier reporting expectations (p.61).

These policies "are aligned with international frameworks, such as the CSRD, UN Global Compact and Science Based Targets initiative (SBTi), supporting the goals of the Paris Agreement," are "approved by the Corporate Responsibility Management Board" and "publicly available to all employees and third parties acting on behalf of Elisa" (p.61-62).

Reference: pages 62-64.

Under the CTAP, Elisa names concrete 2025 actions across scopes: energy efficiency and use of energy attribute certificates (EACs) in mobile networks, adoption of energy-efficient technologies, and "the reuse of waste heat from data centres," implemented "during the reporting year across different parts of Elisa's operations and value chain" (p.62). Levers include eliminating fossil fuels in operations (heating modernisation, biofuels, EVs - rated "High impact"), transitioning to renewable energy via EACs/long-term agreements, driving policy-based internal actions, indirect effects from energy efficiency including "green coding" practices, and advancing circular business models (p.63).

"Elisa has estimated the annual financial impact of these actions, and most have been assessed as below Elisa's financial materiality threshold. This aligns with Note 1.2.2 of Elisa's 2025 financial statements" (p.64).

Reference: pages 62-64.

Elisa's near-term target: "a 42% absolute reduction in Scope 1, 2 and 3 GHG emissions from the 2021 baseline" by 2030, feeding a Net-zero 2040 long-term target (p.62), approved by the Science Based Targets initiative (SBTi) (p.43). The gross emissions table sets milestone trajectories against the 2021 base year for Scope 1, Scope 2 (location- and market-based) and Scope 3, with a stated "Annual % target (2030)/base year (2021)" of 5% across categories (p.66-67).

"Elisa is in its near-term climate target for 2030, committed to reducing absolute Scope 1, 2, and 3 GHG emissions by 42% from the 2021 base year. This is also a foundation for Elisa's net-zero target in 2040" (p.64). Emissions were "slightly lower than the previous year for the second year in a row, despite company acquisitions and new service launches" (p.64).

Reference: page 66.

FY2025 total energy consumption was 377,082 MWh (2024: 365,306 MWh). Total fossil energy consumption was 9,034 MWh (2024: 16,010 MWh), 2% of the total (2024: 4%). Total renewable energy consumption was 367,943 MWh (2024: 109,382 MWh), 98% of the total (2024: 30%) - a large year-on-year shift driven by the Puutikankangas wind PPA. Consumption from nuclear sources was 36 MWh (2024: 239,847 MWh) (p.66).

Total energy produced was 9,867 MWh, all renewable (2024: 6,565 MWh). Energy intensity from activities in high-climate-impact sectors was 0.0002 MWh/EUR in both years (p.66). Contractual instruments used for Scope 2 include Power Purchase Agreements (PPAs), Renewable Energy Certificates (RECs) and Guarantees of Origin (GoO) (p.68).

Reference: pages 66-67.

FY2025 gross emissions (tCO2eq, 2024 comparative in brackets): Scope 1: 1,035 (925); Scope 2 location-based: 53,510 (44,026), market-based: 2,328 (1,432); Scope 3: 238,690 (240,458), 99% of the location-based total. Largest Scope 3 categories: purchased goods and services 140,944 (124,520); capital goods 40,699 (30,085); use of sold products 28,959 (49,289) (p.66-67).

Total GHG emissions (location-based): 293,235 tCO2eq (285,409); (market-based): 242,053 tCO2eq (242,815). GHG intensity (market-based) was 0.00011 tCO2eq/EUR, flat year on year (p.67). Six Scope 3 categories - upstream leased assets, downstream transportation, processing of sold products, downstream leased assets, franchising and investments - are excluded "due to not being material" (p.68).

Reference: pages 64-66.

"While Elisa has not developed projects within its own operations or value chain for GHG removal or storage, the company is exploring such opportunities as part of its CTP." Instead, Elisa has "built a diversified carbon credit portfolio," used for retirement, comprising 2025 removal-type projects (Oxford Categories 4 and 5: Canadian forestry, Republic of Congo biochar) and reduction-type projects (Oxford Category 2: Indonesian and Cambodian forest protection) (p.65).

Of carbon credits retired: 17% from removal projects, 83% from reduction projects (2024: 16%/84%); by standard, 83% Verified Carbon Standard (p.65-66). Elisa "has so far purchased carbon credits through the voluntary carbon market without entering into multi-year contractual agreements" and expects to keep retiring credits equivalent to remaining direct-operations emissions, "preparing for the neutralisation phase beyond 2040" (p.66).

Reference: page 64. Note: this disclosure requirement is one Elisa flags as using an ESRS phase-in provision for selected data points in 2025 (p.40), alongside SBM-3, E5-6, S1-7 and three S1-14 sub-datapoints.

"Elisa has estimated the annual financial impact of these [climate transition] actions, and most have been assessed as below Elisa's financial materiality threshold. This aligns with Note 1.2.2 of Elisa's 2025 financial statements." "Elisa has not identified significant harm to external stakeholders from its climate transition planning but remains committed to implementing remedial action, should such cases arise" (p.64).

No monetary quantification of anticipated financial effects from physical or transition risks, and no separate breakdown of climate-related opportunities' financial effects, is given in the body text - consistent with the phase-in flag.

Reference: page 69.

Elisa "complies with all applicable laws and regulations in the countries where it operates, alongside Group-level Environmental policy and practices that supports the company's goals for resource efficiency, circularity and responsible waste management." It "promotes the use of circular design and prioritises alternatives that reduce dependence on virgin materials," working "to extend product lifespans, minimise landfill use and reduce non-energy waste incineration," and supports customers via "device repair, refurbishment and reuse" (p.69).

Elisa "follows a hierarchy of waste prevention, reuse, refurbishment, recycling and recovery before disposal." Further implementation detail is cross-referenced to the "Climate change" section (p.69).

Reference: pages 69-70.

Elisa's Group-level "Zero Waste 2030" target sits under three sub-targets, each with 2025 key actions: (1) Zero waste in capital goods deliveries (upstream) - continued supplier engagement on climate transition planning, initial focus on logistics in Finland; (2) Zero waste to landfill or non-energy incineration (direct) - active reuse of network equipment in Finland/Estonia, broadened assessment of waste-stream processes in offices; (3) Zero waste until customer handover (downstream) - improved device circularity aligned with EU Taxonomy requirements in Finland (p.69).

Elisa has "streamlined its device exchange program, with continued integration of refurbishing and recycling to extend product life and recover valuable materials," and reuses network equipment where feasible, recycling hardware where reuse is not viable (p.69-70).

Reference: page 69.

"As circular economy, including resource inflows and outflows (waste), has been assessed as material for Elisa, the company has reaffirmed its Group-level Zero Waste 2030 target as part of its climate transition." This is "a voluntary target, not mandated by legislation" (p.69).

Three sub-targets, all Elisa Group scope, all by 2030: "Zero waste in capital goods deliveries" (2025 performance assessment initiated, to be finalised in 2026); "Zero waste to landfill or non-energy incineration"; "Zero waste until customer handover" (p.69). Performance is monitored through Elisa's sustainability reporting systems and the Corporate Responsibility Management Board.

Reference: page 70.

Resource inflows 2025: total weight of resource inflow products, including packaging, was 6,723,845 kg (2024: 5,180,302 kg). Percentage of biological materials, including packaging: 5% (2024: 6%). Absolute weight and percentage of secondary reused/recycled components: 0 in both years, "estimated to be negligible and reported as zero due to the lack of adequate and accurate data to support reliable calculations" (p.70).

Data covers "Elisa Corporation (Finland), Elisa Eesti AS and Elisa Polystar, as resource inflows are most relevant to these parts of the business," sourced from the procurement system with supplier-provided data where available and researched estimates otherwise; 2024 data "has been corrected after revisiting the weight of products" (p.70).

Reference: pages 70-71.

"As Elisa does not manufacture or produce the products it offers, it operates primarily as a retailer... the volumes of resource inflows and outflows - (including products and packaging) are nearly equivalent." Outflows "mainly consist of electronic waste, including network equipment, other electronics and batteries..., as well as packaging materials"; office waste is minor (p.70).

Elisa "operates under Extended Producer Responsibility," with replaced network equipment "either reused internally, sold on the second-hand market or recycled through third-party partners." Retail shops in Finland and Estonia have "WEEE collection receptacles," and Elisa "offers monetary compensation for phones eligible for reuse" (p.70-71).

Reference: page 71.

Total waste generated 2025: non-recycled waste 234,260 kg (2024: 219,803 kg; 21% of total vs 26%); total hazardous waste 589,944 kg (356,435); total waste 1,125,013 kg (838,763). Waste diverted from disposal: 913,082 kg (675,699 kg), comprising hazardous waste recycling of 586,528 kg, non-hazardous recycling 304,224 kg and other recovery 22,329 kg. Waste directed to disposal: 211,932 kg (163,065 kg), almost entirely non-hazardous incineration (208,516 kg) (p.71).

"The majority of waste consists of battery waste, WEEE, metal, and packaging waste," with office paper/cardboard/biowaste a small share. Where actual data is unavailable "Elisa applies estimates based on office headcount," accounting for "less than 5% of the total reported waste volume" (p.71).

Reference: pages 72-74.

Elisa's Human Rights Policy states the company "does not tolerate any form of human trafficking, forced or bonded labour, or modern slavery within its operations or value chain," and has "zero tolerance for any form of discrimination, abuse, bullying and harassment" (p.73). Elisa "safeguards employee working conditions through appropriate social protection measures" (p.73).

Policy commitments cover fair recruitment, career development, compensation and termination; workplace free from harassment and discrimination. Occupational health and safety (OHS) is managed through "structured programmes integrated into daily operations," with occupational healthcare following "recognised best practices" (p.73-74). Assessments "pay attention to vulnerable or marginalised groups, such as individuals with disabilities, those in different age groups, people with minority gender identities or sexual orientations, and those engaged in high-risk roles" (p.72-73).

Reference: pages 73-74.

Elisa engages own workforce through "regular Learning and Objectives Discussions (LOD)" (at least annually) and a twice-yearly, externally-managed, confidential "Employee Engagement Survey," which also includes non-employee agency workers and considers "geography, gender, age, role and length of employment relationship," with "participation rates consistently exceed[ing] 80%" (p.73-74).

The European Works Council (EWC) - covering Finland, Estonia, Germany, Sweden and Romania - "facilitates cross-border dialogue and information sharing" (p.74). In Finland, CEO meetings are held three to four times per year with chief shop stewards and negotiating shop stewards; monthly Chief Shop Steward Group meetings and weekly unit-level meetings also occur. During the 2025 transformation programme, "employee representatives were consulted, and employees were kept appropriately informed" (p.73-74).

Reference: page 74.

Employees can report suspected misconduct - "including breaches of law, the Code of Conduct or internal guidelines" - via supervisors, Legal, HR, Corporate Security, Sustainability or Internal Audit; reports are investigated impartially, with corrective measures potentially including "formal workplace mediation, organisational adjustments, disciplinary actions as well as psychological support" (p.74).

Elisa also provides "a secure, anonymous whistleblowing channel managed by an independent third party, accessible to both employees and non-employee workers," with awareness promoted through onboarding, internal communication and mandatory Code of Conduct training. "Elisa has not currently identified any significant gaps in its grievance mechanisms" but continues to evaluate effectiveness and is exploring trust/awareness metrics (p.74).

Reference: pages 74-75.

Three 2025 workforce targets and their key actions: employee engagement (refined hybrid work model, change-management training for supervisors, top management site visits); individual learning plans via LOD (continuous-improvement methods, strengthened supervisor support); and women in supervisory positions (piloted competency-based recruitment in front-line roles, activated the "Elisa Women" community) (p.74-75).

"Equality, health and safety, and working conditions are reviewed annually by Elisa's Human Resources Management Board and Corporate Executive Board," informed by Employee Engagement Survey results. Equality plans for Elisa Corporation and Elisa Santa Monica are "processed in accordance with legal requirements and monitored through cooperative bodies and the Equality and Equity Working Group" (p.74-75). In 2025, "OHS-related metrics and targets were reviewed, and the evaluation process is ongoing" (p.75).

Reference: pages 74-75.

Three targets, all Elisa Group scope: employee engagement "among the best 10% globally" (2025 survey score: 72); "100% of our employees involved in LOD process have individual learning plans" (2025: 86%); "Share of women in supervisory positions 33.5% by 2029" (2025: 29%) (p.74-75).

Targets for engagement and gender diversity "are embedded in Elisa's strategic planning and approved by the Corporate Executive Board"; the learning-plans target is overseen by the competence-development process owner. "While employees and their representatives are not directly involved in setting these targets, they participate in and contribute to the performance and provide feedback, particularly through the Employee Engagement Survey" (p.75).

Reference: pages 75-76.

Headcount by gender, 2025: male 4,627, female 1,961, other 156, total 6,744 (2024: 4,609 / 2,021 / 93 / 6,723). Headcount by country, 2025: Finland 4,674, Estonia 946, Italy 393, Sweden 142, Germany 142, and smaller populations elsewhere, total 6,744 (p.75).

By contract type, 2025: 6,660 permanent employees, 84 temporary; 5,577 full-time, 1,167 part-time (p.75-76). Employee turnover 2025: 1,196 employees left (rate 0.18), unchanged from 2024's rate (p.76). "The fluctuations in the number of employees are mainly due to the acquisition of companies made during the reporting period" (p.76).

Reference: page 77.

Collective bargaining coverage 2025: Employees EEA 78% (2024: 77%), Employees non-EEA 0% (2024: 3%), Total 75% (2024: 74%) (p.77). By coverage band, 80-100% coverage applies in Finland, Estonia, Germany, Romania and Sweden; 20-39% in Belgium, France and Italy; 0-19% social-dialogue estimate applies to Indonesia.

"Collective bargaining agreements are either at the level of the organisation, at the industry level..., or both," covering negotiation, consultation and information exchange on economic and social policy; employees not covered rely on "local national laws." "Social dialogue includes employees having country representations in the European Works Council" (p.77).

Reference: page 78.

Distribution of employees by age group, 2025: under 30 years 1,535; 30-49 years 3,689; over 49 years 1,520; total 6,744 (2024: 1,550 / 3,714 / 1,459 / 6,723) (p.78). Gender headcount data (reported under S1-6, p.75) and top-management diversity data (disclosed in the "Sustainability governance" section, p.41) are cross-referenced as further diversity metrics: "Diversity data for top management is disclosed in the section 'Sustainability governance'" (p.78).

Reference: pages 77-78.

Employees participating in regular performance and career development reviews, 2025: male 3,631, female 1,564, other 129; overall participation 79% (2024: 77%) (p.78). Average training hours per employee, 2025: male 9h, female 10h, other 9h, total 9h (2024: total 12h) (p.78).

Reviews follow the Learning and Objectives Discussion (LOD) process, undertaken "with the knowledge of the employee at least once per year." Training hours cover vocational training, paid educational leave and external training "paid for in whole or in part," excluding on-site coaching such as onboarding (p.78).

Reference: page 78. Three sub-datapoints (S1-14-08, S1-14-09 and S1-14-12) are flagged by Elisa as phased in for 2025 (page 40).

2025 health and safety data: 99% of employees covered by a health and safety management system (2024: 96%); 0 fatalities; 71 recordable work-related accidents (rate 7 per the disclosed metric, 2024: 76 / rate 8); 0 recordable work-related ill-health incidents; 165 days lost to work-related injuries and fatalities (2024: 79, following an updated calculation method applied retrospectively) (p.78).

"Non-employee data are not reported in this metric" (p.78) - consistent with the S1-7 phase-in noted elsewhere in this file.

Reference: page 78.

2025 incidents data: 9 work-related discrimination incidents, including harassment (2024: 7); 9 complaints filed through whistleblowing channels (2024: 7); 0 fines, penalties or compensation for the above; 0 severe human rights incidents connected to own workforce (forced labour, human trafficking, child labour); 0 cases of non-respect of UN Guiding Principles/OECD Guidelines connected to own workforce (p.78).

"The number includes confirmed cases of work-related discrimination incidents filed through Elisa's official notification mechanisms, including whistleblowing channel" (p.78).

Reference: page 79-80.

Elisa's approach is guided by the Supplier Code of Conduct, "based on international labour standards set out in the...(ILO) Conventions, the United Nations' Universal Declaration of Human Rights, the...Guiding Principles for Business and Human Rights, and the Convention on the Rights of the Child," covering working conditions, health and safety, and prohibition of child/forced/bonded labour - "Children under 18 must not perform hazardous work" (p.79-80).

Elisa's Human Rights Policy "reinforces expectations for suppliers on labour rights." A new Procurement Policy was introduced in 2025 "to establish a consistent operating model, clarify conduct principles and define procurement responsibilities," approved by the CFO. "Elisa does not tolerate any form of forced labour, bonded labour, modern slavery or illegal child labour in its operations or supply chain" (p.80).

Reference: pages 80-81.

Elisa engages value chain workers "directly through supplier site visits and audits, and indirectly through supply chain relationship management practices, co-operation meetings, 'Supplier Day' events." In 2025, Elisa "organised its first ever Supplier Day event, bringing together nearly 70 representatives from key suppliers" to discuss sustainable procurement, customer needs and information security (p.80-81).

As a member of the Joint Alliance for CSR (JAC), Elisa participates in "a coordinated audit and supplier development programme," including third-party worker surveys and site engagement "several times per year." Elisa acknowledges "the need to further develop its approach to gather insights from vulnerable or marginalised groups" and has no formal global framework agreement specific to workers' rights (p.80).

Reference: pages 80-81.

Suppliers and their workers can report violations via "direct communication with the responsible vendor manager, Elisa's publicly available whistleblowing channel and JAC audit processes," anonymously and confidentially. During supplier onboarding Elisa "checks whether suppliers have their own grievance mechanisms," though it "has not assessed whether its whistleblowing channel is accessible or trusted by all value chain workers" (p.81).

JAC audits identify and address negative impacts through Corrective Action Plans (CAPs), regularly followed up. "To date, no material negative impacts requiring remediation have been identified, and therefore the effectiveness of remedial actions has not yet been assessed" (p.81).

Reference: pages 79, 81.

Elisa "actively engages with suppliers to assess and mitigate risks," reserving "the right to terminate supplier relationships" where issues are unresolved (p.79). Supply chain impact assessments and audits "prioritise occupational safety, the presence of a written code of conduct and the availability of anonymous reporting channels for workers," with added scrutiny (security screenings) for infrastructure subcontractors (p.79).

"As of the end of the reporting period, Elisa has not identified any confirmed cases of non-compliance with the UN Guiding Principles, ILO Declaration or OECD Guidelines involving value chain workers" (p.79). Effectiveness is measured via "supplier assessments, audit reports and CAP follow-ups" (p.80).

Reference: pages 80-81.

Three 2030 targets, scoped to Elisa Corporation (Finland) and Elisa Eesti AS: 100% of targeted suppliers to have signed the Supplier Code of Conduct or similar terms (2025: 46%); 100% of targeted suppliers assessed on sustainability factors (2025: 75%); 100% of Vendor Managers to complete Supplier Code of Conduct training (2025: 43%) (p.81).

Targets "are aligned with the UN Global Compact principles...aiming to promote labour and human rights, ensure safe working conditions and contribute to...UN Sustainable Development Goals," particularly SDG 3 and SDG 8. "While value chain workers and their representatives have not yet been directly involved in the target-setting process, Elisa recognises this as an important area for future development" (p.81).

Reference: pages 82-83.

Policies are "guided by Elisa's Code of Conduct, Human Rights Policy, and Ethical Principles for Data and AI," aligned with the UN Guiding Principles, OECD Guidelines and UN Global Compact (signatory since 2015), with no explicit exclusions for vulnerable consumer groups (p.83). Data protection is governed by Elisa's Data Protection Policy, "binding on Elisa, its subsidiaries and suppliers through contractual agreements" (p.83).

On child safety, "Elisa has published a commercial age guideline, advising that children under nine should not be given smartphones for independent use," with internal guidelines to keep age recommendations visible "in all customer encounters and materials" (p.82). Dedicated Data Protection Officers are appointed for Finland and Estonia (p.83).

Reference: page 84.

Elisa gathers feedback via "the Net Promoter Score...customer satisfaction surveys, different topic-specific customer and non-customer surveys, and focus group interviews," reviewed monthly by senior leadership of the Consumer Customers unit (p.84).

For vulnerable groups, Elisa partners with the Mannerheim League for Child Welfare, runs "Digital security schools" events and school visits, and supports "Digitutkijat" ('Digital Detectives'), which "reaches over 75% of fourth-grade students in Finland." Annual parent surveys assess concerns about children's digital device use, and Elisa contributes to a national initiative (with the Finnish Institute for Health and Welfare and National Board of Education) on children's digital lives, running "2025-2026" (p.84-85).

Reference: pages 84-85.

Consumers can raise concerns via "Elisa's whistleblowing channel," and separately through "customer service portals, website contact forms and dedicated data protection inquiry forms," supported by trained staff (p.85). Elisa's remediation approach: "investigating the issue, assessing whether Elisa has caused, contributed to or is directly linked to the impact, and taking corrective or preventive action," which "may include adjusting services, updating policies or communicating directly with affected individuals" (p.85).

Reference: pages 82, 85.

"No material negative impacts affecting customers or end users were identified in the reporting period." During 2025 there were "4 inquiries from data protection authorities or other competent bodies regarding data breaches," addressed through "established incident response protocols," with lessons learned fed into risk management (p.82).

Effectiveness of the two S4 targets is tracked and "results and key actions taken are communicated annually in Elisa's Sustainability Statement" (p.85); the Security Governance Board evaluates measures supporting training completion.

Reference: page 85.

Two 2025 targets: "100% of employees have completed security certificate training by 2030" (2025: 82%), with actions including targeted employee guidance, preparedness exercises and security testing; and "increasing the number of minors participating in Elisa's online or physical digital wellbeing and digital security events to 100,000 by 2026" (Elisa Corporation, Finland; 2025: 95,000 minors), via a national campaign encouraging delay of children's first phone purchase to age nine and digital security school sessions for 5th-9th graders (p.85).

"While consumers and end users were not directly involved in setting the target, the results and key actions taken are communicated annually" (p.85).

Reference: page 88.

"Elisa's standards for ethical business conduct are defined in the Elisa Code of Conduct...formally approved by Elisa's Board of Directors," forming the basis of the Group compliance programme overseen by the Compliance Steering Group (Legal, Sustainability, HR, Corporate Security, Finance, Investor Relations, Communications), which "conducts an annual review of the Code of Conduct" and reports to the Audit Committee (p.88).

"Code of Conduct training is mandatory for all employees and forms part of the onboarding process for new hires. By the end of the reporting period, 98% of Elisa employees had completed this training" (p.88). "In 2025, Elisa started the process of updating its Code of Conduct" (p.88). Elisa's Internal Audit function independently assesses the compliance framework (p.88).

Reference: page 90.

Elisa has "appointed dedicated contacts for 364 suppliers to ensure ongoing dialogue and improvement, particularly with key suppliers, which represent over 81% of total spend." Purchasing is guided by the Code of Ethical Purchasing and the Finnish Act on Contractor's Obligations and Liability (p.90).

Supplier risk assessment "is embedded in Elisa's double materiality process, addressing climate-related risks, human rights, corruption and material procurement risks," with mitigation via "supplier audits, corrective action plans and collaboration mostly through...the Joint Alliance for CSR (JAC)." A 2025 updated procurement policy strengthened sustainability integration and risk management (p.90).

Reference: pages 88-89.

The Anti-Bribery and Corruption (ABC) Policy "outlines the company's expectations and applies to all employees, directors, officers and third parties acting on behalf of the company," approved by the Board and reviewed at least annually by the Compliance Steering Group (p.88). Special attention applies to interactions with public officials; tailored training targets higher-exposure roles (international sales, procurement) (p.88-89).

2025 disclosures: "No confirmed violation of anti-corruption or anti-bribery laws"; "No fines for violation of anti-corruption or anti-bribery laws"; "No confirmed incidents of corruption or bribery" (p.89). Training completion 2025: 96% of employees (2024: 86%); 100% of at-risk functions covered by training, 93% completing it (2024: 64%/58%) (p.89).

Reference: page 89.

Target (part of MDR-T/GDR-T disclosures): "100% of employees have completed anti-bribery and corruption training by 2030," Elisa Group scope. 2025 performance: 96% of employees completed the training (2024: 86%) (p.89).

2025 key actions supporting the target: risk assessments at Elisa Industriq, tailored training for specific teams in the Consumer Customers business unit based on a risk survey, strengthened anti-bribery practices in the ethical sales procedure, and ABC policy/mandatory training implementation in SedApta (p.89).

Reference: page 89.

2025 anti-corruption and anti-bribery disclosures: "No confirmed violation of anti-corruption or anti-bribery laws"; "No fines for violation of anti-corruption or anti-bribery laws"; "No confirmed incidents of corruption or bribery"; nature of confirmed incidents - "Not applicable"; workers dismissed/disciplined for corruption or bribery - "Not applicable"; contracts terminated/not renewed for corruption or bribery violations - "Not applicable"; public legal cases regarding corruption or bribery - "Not applicable" (p.89).