Gofore Oyj

The role of the administrative, management and supervisory bodies

Reference: pages 22-23.

The Board of Directors is the highest body responsible for sustainability and approves the Group policies. It has two preparatory committees without independent decision-making power: the Audit Committee and the Remuneration Committee. The Group Management Team supports the CEO, and day-to-day sustainability management is delegated to a Sustainability Management Team (the CEO and other key roles, presented by the Chief Sustainability Officer).

Board composition in 2025 (2024 in brackets): six members, two women and four men (33% women, 67% men); 83% (67%) independent; no member in operational management. The statement says the Board "has received training in sustainability matters and possesses CSRD expertise" independent of operational management (page 22).

The Chief Sustainability Officer reports to the Board at least once a year on sustainability impacts, risks and opportunities, and the Board sets sustainability objectives and monitors their realization (page 23).

Information provided to and sustainability matters addressed by the undertaking's administrative, management and supervisory bodies

Reference: pages 23-24.

The Audit Committee monitors the statutory audit of sustainability reporting, including the reporting process, accuracy and scope, and the level of in-house sustainability expertise. It reports to the Board, typically at the next Board meeting (page 23). Sustainability aspects reach the Board through the Chief Sustainability Officer and the CFO as part of financial and non-financial reporting (page 24).

Governance bodies discuss material impacts, risks and opportunities on an annual planning cycle (page 24). Sustainability topics reviewed by the Board and its committees during the year: regulatory developments, sustainability reporting, the internal control environment and remuneration policies. The Group Management Team reviewed information security and the NIS2 Directive, risk management principles, sustainability objectives and strategy, employee well-being and development, ethical initiatives, and anti-corruption action and policy (page 24).

Integration of sustainability-related performance in incentive schemes

Reference: page 24.

Gofore had no remuneration scheme directly linked to sustainability reporting in the financial year. Under the Remuneration Policy, pay for the Board of Directors and the CEO is linked to short- and long-term profitability. Long-term schemes are meant to commit management and employees to the business strategy, which includes the sustainability objectives.

The Remuneration Committee prepares nominations and remuneration schemes for the CEO, other management and personnel, and presents remuneration reports of governance bodies at the General Meeting. The statement gives no percentage of variable pay tied to sustainability targets.

Statement on due diligence

Reference: pages 24-25.

A table maps the five key elements of the due diligence process to sections of the statement (page 25):

• Integration into governance, strategy and operating model: GOV-2, SBM-3.
• Communication with impacted stakeholders: GOV-2, SBM-2, IRO-1, MDR-P, S1-2, S2-2, S4-2.
• Identifying and assessing adverse impacts: IRO-1, SBM-2.
• Actions to prevent adverse impacts: MDR-A, E1-1, E1-3, S1-4, S2-4, S4-4.
• Monitoring and communicating: MDR-M, MDR-T, E1-4, E1-5, E1-6, S1-5, S1-6, S1-7, S1-9, S1-13, S1-15, S1-16, S1-17, S2-5, S4-5.

The table cites S2-2, S2-4, S2-5 and S1-13. None of them has a section in the statement or an entry in the Appendix 2 reference table (pages 94-96).

Risk management and internal controls over sustainability reporting

Reference: pages 25-26.

Sustainability risks sit inside the general risk management system. The Board confirms the risk management policy, the CEO organizes and oversees risk management, and the Audit Committee monitors it and assesses its effectiveness (page 25). Risks are rated on probability and business impact and reviewed at regular intervals by the people in charge of the relevant functions and the Group Management Team. Business unit managers are primarily responsible for internal control. The company "does not have a separate internal control function"; the Board may hire external professionals to audit the control environment (page 26).

Page 26 lists the most important sustainability risks and their controls: employee well-being (recurring surveys); information security and data protection in client projects ("the most significant financial risk for the company", managed through an ISO 27001-based system); ethical and inclusive use of AI (GenAI Strategy and code of practice); and corruption and bribery in public sector work (anti-corruption policy approved by the Board in December 2025, training planned for 2026).

Strategy, business model and value chain

Reference: pages 27-30.

Gofore's strategy runs to 2027, and sustainability is one of its four focus themes (page 27). It has three business areas: Digital Society, Defence & Space (new with the Huld acquisition on 1 September 2025) and an industry area. It sells digital services and consulting; its only physical products are simulators made by the subsidiary Creanex (pages 29-30). Turnover was EUR 191.4 million (page 60).

Employees at year end, 2025 (2024): Finland 1,642 (1,323), Germany 72 (81), Austria 33 (37), Estonia 14 (17), Spain 14 (13), Czechia 16 (none), total 1,791 (1,471) (page 27).

Value chain (pages 27-29): upstream are nature and society, energy providers, device suppliers, subcontractors and investors; downstream are clients and the end users of their services, mainly citizens and client employees. The company's most significant impacts on nature and society arise at the downstream end, through client projects. It is not active in the fossil fuel, chemicals, controversial weapons or tobacco sectors (page 30).

Interests and views of stakeholders

Reference: pages 30-32.

Gofore names six primary stakeholder groups (employees, management, consumers and end users, investors, nature and society, legislators and regulators) and three secondary groups (partners and subcontractors, device and goods suppliers, energy suppliers). Nature and society is described as a "quiet stakeholder group" and was not consulted directly (pages 31, 38).

Engagement and views recorded in the double materiality assessment (pages 31-32):

• Employees: open roundtables and the Ethics Desk team; climate change and circular economy came up on the financial side.
• Clients and end users: client account teams and satisfaction surveys twice a year; cyber security and employee availability were seen as the highest risks.
• Investors: regular meetings with analysts and shareholders and monthly financial reporting; Gofore is seen as a stable investment with low vulnerability to transition risk.
• Subcontractors and suppliers: the GoforeGigs ecosystem; all suppliers must follow the Supplier Code of Conduct, and supplier audits, not yet carried out, are to start in 2026 (page 32).

Material impacts, risks and opportunities and their interaction with strategy and business model

Reference: pages 33-37.

Pages 34-37 list the material impacts, risks and opportunities by standard and sustainability aspect, and tag each by where it sits: strategy or business model, and operation or business relationships (page 33).

• E1 Climate change: positive impacts and opportunities from client projects on mitigation, adaptation and energy efficiency (page 34).
• E5 Resource use and circular economy: positive impacts through client projects on resource efficiency, equipment lifecycles and client waste, plus a business opportunity (page 34).
• S1 Own workforce: working conditions, equal treatment and opportunities, other work-related rights (page 35).
• S4 Consumers and end users: information security and data protection, social inclusion (accessibility), ethical and inclusive use of AI (page 36).
• G1 Business conduct: corporate culture, whistleblower protection, supplier relationships and payment practices, corruption and bribery (page 37).

The statement says no material financial effects on financial position, performance or cash flow were identified as directly attributable to sustainability matters, and it publishes no quantitative anticipated financial effects (page 33). Gofore has decided not to take defense projects where significant ethical risks or negative impacts are identified (page 33).

Description of the processes to identify and assess material impacts, risks and opportunities

Reference: pages 38-42.

The double materiality assessment was launched in 2023 and completed in early 2024 with an external consultant, run by the Group Management Team with staff from other functions (page 38). A baseline analysis used the strategy, business model, client base, emissions calculations and earlier employee surveys. A management workshop rated financial risks and opportunities against the impacts found across the value chain. All primary stakeholder groups except nature and society were consulted by interview or survey, plus partners, subcontractors and suppliers.

Items scoring at least 7 on probability and impact (scale 0 to 12) were defined as material. The Sustainability Management Team validated the result and the Board gave final approval. Risks feed into general risk management. The assessment is to be repeated if the business changes significantly or within five years (page 38).

Topic screening: climate used two workshops, stakeholder hearings and a scenario analysis (pages 39-40); pollution, water and biodiversity were judged non-material in the preliminary analysis and dropped from later phases (pages 40-41); resource use and circular economy has a positive impact and a financial opportunity but no material negative impact or risk (page 42).

Disclosure requirements in ESRS covered by the undertaking's sustainability statement

Reference: page 42; Appendix 1, pages 92-93; Appendix 2, pages 94-96.

IRO-2 says the statement covers ESRS sustainability aspects that exceed the materiality threshold values for impact or financial materiality, and that individual data points of a topical standard are included if they represent a material aspect found in the assessment (page 42). The list of requirements is Appendix 2 (Reference table); EU-legislation data points are in Appendix 1 (page 42).

Appendix 2 lists, with page numbers: ESRS 2 BP-1, BP-2, GOV-1 to GOV-5, SBM-1 to SBM-3, IRO-1, IRO-2; E1-1 to E1-7 and E1-9; E5-1, E5-2, E5-3 and E5-6; S1-1 to S1-7, S1-9, S1-10, S1-11 and S1-14 to S1-17; S4-1 to S4-5; G1-1, G1-2, G1-3, G1-4 and G1-6. E2, E3 and E4 appear only as IRO-1 process entries (pages 94-96).

Not listed: E1-8, E5-4, E5-5, S1-8, S1-12, S1-13, G1-5, and all of S2 and S3. Appendix 1 marks the EU-legislation datapoints for E2, E3, E4, S2 and S3 "Not material" (pages 92-93).

Transition plan for climate change mitigation

Reference: pages 52-53.

Gofore says its climate objectives are in line with the 1.5°C global target and aim at "carbon neutrality by the year 2035". Scope 1 and 2 emissions are to fall to zero by 2030. The Scope 3 objective depends on the rest of society reaching the Paris targets; the company says it cannot meet it if that assumption fails (page 52).

Levers (page 52): 100% renewable energy for office electricity, heating and cooling; electric company vehicles; low-emission choices in Scope 3 purchases; less travel; green ICT and green coding; climate as a criterion for cloud providers. Remaining Scope 3 emissions, up to 10% of base-year emissions, would be offset by 2035 at the latest.

Funding: no investment assessment has been made, because the targets are not expected to need significant investment. Offsetting is likely to be the largest cost. Capital and operating expenditure allocated to the plan is EUR 0.00 thousand for 2025 and 2024 (page 53). The plan was approved by the Sustainability Management Team (page 53). Reductions "have progressed almost according to the transition plan": Scope 1 and market-based Scope 2 fell more than planned, and the Scope 3 target was not fully met (page 53).

Identification of climate-related risks and scenario analysis

Back-filled from ESRS 2 IRO-1, climate section (pages 39-40), and E1.SBM-3 (pages 53-55), where this content is disclosed in the FY2025 report. This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

Risk identification (pages 39-40). Climate risks were discussed in two workshops, with senior management at one, and in stakeholder hearings during the double materiality assessment, then specified through a climate scenario analysis. Physical risks were judged not material. The scenario analysis rated extreme weather and changing climatic conditions as medium significance. Transition risks, mainly adapting to global market changes, were not considered material either. The company says it has no property items or operations seriously exposed to climate hazards or transition risks.

Scenarios (pages 40, 53). "Gofore's scenario analysis included 1.5°C and 4°C scenarios", set for the year 2030 and described as in line with the TCFD recommendations. It covered the whole Group and its value chain. No named scenario family (SSP, RCP, IEA) is cited.

Time horizons (pages 40, 55): short is under 5 years, medium 5 to 10 years, long over 10 years. Page 39 words the horizons differently.

Timing (page 55): completed 20 Nov 2024 and confirmed by the Sustainability Management Team on 10 Dec 2024.

Resilience in relation to climate change

Back-filled from E1.SBM-3 (pages 53-55), where this content is disclosed in the FY2025 report. This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

Method (page 53). The resilience analysis took the high and medium-level climate risks and opportunities from the double materiality assessment and tested them against two scenarios, 1.5°C and 4°C warming, set for 2030. Two political and legal and two physical items were added to follow the TCFD recommendations. Because the company estimates it has no significant physical or transition risks, "the scenario evaluation did not include financial impacts or resources related to these risks".

Result (pages 54-55). Gofore found relatively strong capacity to adapt under both scenarios, and business continuity stays fairly stable even at 4°C. The 1.5°C scenario is clearly more favorable. At 4°C it sees possible difficulty adapting to extreme weather that could threaten ICT infrastructure, and weaker client investment.

Uncertainty (page 54). Economic effects of climate change are hard to assess, regulatory direction is uncertain, and technology development is hard to predict.

High-priority items (page 55). Two, both opportunities: climate objectives and energy prices, and regulation and value chain transparency. No high-priority physical risks were found. Climate risk is not in strategic planning for now (page 54).

Policies related to climate change mitigation and adaptation

Reference: page 56.

Climate policy for internal activities sits in the company's environmental guidelines, which are addressed to employees and include responsible sourcing, so they also reach the upstream value chain. They cover energy efficiency of office premises, the move to green energy where possible, environmentally friendly traveling and purchases, and waste recycling. The Chief Sustainability Officer is responsible for implementation and for monitoring adherence.

The policy topics listed are climate change mitigation and energy consumption; adaptation is not listed as a policy topic.

The 2024 materiality assessment found the key climate impact to be client work that helps mitigate and adapt to climate change. This is part of the strategy as one of four enablers of business and growth. The company supports customers through its service offering and the Environmental Digitalisation Toolkit, which guides the design of systems that use little energy. It also aims to cut vehicle emissions by 2030; CO2 emissions from vehicles fell 45% in 2025.

Actions and resources in relation to climate change policies

Reference: page 56.

Actions under way:

• Phasing out internal combustion engine vehicles (electrification), goal 2030.
• Transition to renewable energy: the aim is to use only renewable energy and electricity from renewable sources by 2030. Market-based Scope 2 emissions fell 21% in 2025 as a result.
• Green coding: continuous work with no defined time horizon, guided by the Environmental Digitalisation Toolkit.

Planned (page 56):

• Requiring climate objectives from subcontractors, with a carbon-neutral value chain as the goal by 2035.
• Reducing travel and moving to lower-emission transport, by 2035.

On resources, the company says it "does not have significant operational or capital expenditure related to the climate actions" (page 56). The transition plan table shows EUR 0.00 thousand of capital and operating expenditure allocated in 2025 and 2024 (page 53).

Targets related to climate change mitigation and adaptation

Reference: pages 57, 61-62.

Targets use a 2024 base year, chosen because the 2024 calculation covers all significant emission categories (page 57). From the targets table (page 61):

• Scope 1: -100% by 2030 (annual target -16.67% of base year).
• Scope 2, location-based and market-based: -100% by 2030 (-16.67% a year).
• Scope 3: -49% by 2030 and -90% by 2035 (-8.18% a year), for purchased goods and services, capital goods, waste, business travel, employee commuting and upstream leased assets.

Progress against the 2024 base year in 2025: Scope 1 -32%, market-based Scope 2 -21%, location-based Scope 2 -11%, Scope 3 -4% (page 57). The company splits the objective into about 10% from renewable energy and electric vehicles and about 90% from supply chain reductions. It assumes it can buy carbon-neutral energy by 2030 in a 1.5°C world.

A second target is to raise each year the number of client projects that meet the EU Taxonomy climate mitigation criteria; the share of net sales from such projects was unchanged from 2024 (page 57). No adaptation targets are set, as no significant adaptation risks were identified (page 57).

Energy consumption and mix

Reference: page 58.

Total energy consumption in own operations was 4,713,961 kWh in 2025 (2024: 1,355,672 kWh). Renewable energy backed by guarantees of origin was 3,895,234 kWh (2024: 322,090 kWh), about 83% of the 2025 total (share calculated from the two reported figures).

Apart from renewable energy, Gofore has not split consumption by energy source for 2025 and says it aims to do so for the next reporting period (page 58). No fossil-source breakdown is given. The page does not explain the near-tripling of total consumption between the two years.

Gross Scopes 1, 2, 3 and Total GHG emissions

Reference: pages 58-62.

GHG emissions in tCO2eq (pages 59, 61-62):

Scope 3 by category, 2025 (2024): purchased goods and services 1,989.10 (1,940.05); capital goods 67.87 (79.74); waste 23.18 (72.95); business travel 122.41 (53.80); employee commuting 106.28 (339.74); upstream leased assets 316.72 (257.85). Categories 3, 4 and 9 to 15 are marked not material.

Intensity on turnover of EUR 191.4 million: 15.21 tCO2eq/MEUR location-based and 14.38 market-based (2024: 16.55 and 15.65) (page 60). Method: GHG Protocol Corporate Standard (2004), Defra as the main emission factor source, 19% (15%) of Scope 3 from primary data (page 59). Business travel now includes employees' own-car trips paid by mileage allowance; 2024 was not restated, and the company says this partly explains the missed Scope 3 target (pages 53, 58).

GHG removals and GHG mitigation projects financed through carbon credits

Reference: page 63.

Gofore commits to offsetting the Scope 1 and 2 emissions it has produced from 2021 onward, with credits from projects outside its value chain. It does not offset within the value chain. Credits are meant to meet nine criteria from the Finnish Ministry of the Environment's recommendations, including additionality, permanence, independent verification, no double counting and do-no-significant-harm.

In 2025 the company bought 169 tCO2e of Verra-certified credits from reduction projects, generated through methane capture, to cover its 2024 Scope 1 and 2 emissions (2024: 140 tCO2e from removal projects). The method for offsetting 2025 emissions (126.64 tCO2e pending) is to be decided in 2026. Existing contractual arrangements are zero; 100% of credits meet recognized quality standards.

Credits do not replace reductions: the company offsets only emissions it cannot yet reduce, such as purchased district heating and cooling where carbon-neutral supply is unavailable. E1-1 also allows offsetting of up to 10% of base-year Scope 3 emissions by 2035 (page 52).

Anticipated financial effects from material physical and transition risks and potential climate-related opportunities

Reference: page 64.

Gofore says its business operations "are not connected to material physical or transition risks". The estimate rests on the double materiality assessment and the climate scenario analysis. Two tables give the share of assets exposed to material risks before adaptation measures:

• Physical risk: 0.00% for acute and for chronic risk in each of the short, medium and long term.
• Transition risk: 0.00% in each of the short, medium and long term.

Climate-related opportunities are described under SBM-3 (page 64). The statement publishes no quantitative anticipated financial effects (page 33), and Appendix 1 marks two E1-9 datapoints, assets exposed to physical climate risks and property by energy-efficiency class, "Not material" (page 92).

Policies related to resource use and circular economy

Reference: page 65.

Gofore's approach covers the downstream end of its value chain. Its policies aim to raise the share of client projects that promote the circular economy and sustainable resource use, which it identifies as a material business opportunity. The materiality assessment found that Gofore positively influences clients' move to a circular economy, resource-efficient design and better waste management through its digital services.

The main vehicle is the Digitalised Product Lifecycle (DPL) service package. It supports the collection and management of product data, which enables more sustainable product design and manufacturing in terms of resource use and circular economy, and extends product lifecycles by improving maintenance activities. It is offered in Finland and the DACH region. Promotion of the circular economy is part of the strategy and is carried out through service development and marketing. The service development director is responsible.

Gofore reports no policies on circular economy or resource use within its own operations: it has no direct material impact there, and its operations and value chain face no material risks from it.

Actions and resources related to resource use and circular economy

Reference: page 65.

Gofore's main action is to increase positive impacts in client projects, which acts on the downstream end of its value chain. The DPL service package supports the collection and management of product-related data. That data enables more sustainable product design and manufacturing, and extends product lifecycles through improved maintenance.

During 2025 circular economy and resource use themes were worked further into the overall offering, and mechanisms were set up to measure the revenue from services that promote the circular economy and resource efficiency. DPL will be one of the company's key development themes in 2026.

On resources, the company says it is "not feasible to separately specify the resources allocated to this service", because the work is part of general service and product development and client management.

Targets related to resource use and circular economy

Reference: pages 66, 48.

The main target is to grow revenue that meets the EU Taxonomy circular economy objective (Section 4.1). The company says its activities that promote circular economy and sustainable resource use at the downstream end of the value chain correspond closely to those criteria, so growth in this revenue share reflects its impact. Clients, investors and employees gave input during the materiality assessment. Taxonomy-aligned circular economy turnover was EUR 8,093,720, 4% of turnover (page 48).

For 2025 and 2026 there are also qualitative objectives: identify all activities that promote circular economy and resource efficiency, and match experts in this field with client projects that let them build their skills. Progress is measured through an internal survey.

Gofore sets no targets for its own resource inflows and outflows, as "they are not material to the company's business operations" (page 66).

Anticipated financial effects from resource use and circular economy-related impacts, risks and opportunities

Reference: page 66.

Projects related to resource use and circular economy accounted for 4% (4%) of Gofore's revenue in 2025. The company expects the share to stay at least at the current level, with potential for growth.

The estimate assumes that tighter environmental regulation, rising raw material prices and falling resource availability will push clients to invest more in digital projects for the circular economy and for extending the life of machinery and equipment (page 66). No monetary effect on financial position, performance or cash flow is reported; the statement says no material financial effects were identified as directly attributable to sustainability matters (page 33).

Policies related to own workforce

Reference: pages 70-72.

The policies apply to everyone in the workforce, including non-employees. The Code of Ethics sets ethical principles on social, environmental and financial sustainability, aims to prevent misconduct and guides the reporting of violations; the Chief Sustainability Officer holds ultimate responsibility for it (page 70). Human rights commitments cover training on key themes, regular impact surveys, reporting channels and immediate corrective action. The company opposes forced and child labor. Its Supplier Code of Conduct requires suppliers to respect the ILO Declaration on Fundamental Principles and Rights at Work; compliance has not yet been monitored through audits or surveys, and that will start in 2026 (page 70).

An equity and inclusion plan (the head of human resources is responsible) bars unequal treatment based on background, origin, gender, parenthood or personal characteristics. Management reports to the Board on pay equality indicators, including the pay gap between women and men; equivalent reporting for Huld follows its integration (pages 70-71). Discrimination, bullying and harassment are prohibited, and a separate guidance document covers handling inappropriate behavior (page 71). Occupational health organizations exist in all countries except Spain (page 72).

Taking action on material impacts, risks and opportunities related to own workforce

Reference: pages 73-74.

Human resource management acts in four areas: employee well-being and ability to work, professional development, equal treatment, and employee wealth creation (page 73).

• Well-being: personal immediate leadership (about 120 managers); extensive occupational health collaboration with the pension provider; real-time workload monitoring and surveys several times a year (pages 73-74).
• Wealth creation: a wage increase model that ties universal wage increases to quarterly company results, with no wage cuts if performance falls, and a share saving scheme to buy shares at a discount (pages 73-74).
• Professional development: project work across industries, Gofore Academy training paths and a recommended competence development plan (page 74).
• Equal treatment: diversity targets, regular measurement of inclusion, pay equality work and an accessibility team (page 74).

Gofore also requires partners to commit to its Code of Ethics before any agreement, and its Ethics Desk oversees compliance in sales (page 74).

Targets related to managing material negative impacts, advancing positive impacts, and managing material risks and opportunities concerning own workforce

Reference: pages 74-75.

Well-being targets cover the number of ability-to-work cases, quality monitoring, sick leave (days per person and duration, by unit and diagnosis group) and regular employee surveys. The company aims to hold sick leave at its current level, which it calls typical for the sector (page 74). Pay equity, equal pay for equal work, is also a goal (page 75). HR sets the goals, the Group Management Team approves them and the Board monitors those in the strategy. Huld joins the objectives in 2026.

2025 targets and outcomes (page 75):

• Over 90% feel they can be their authentic selves: 85.2% of respondents.
• Over 60% feel they belong to the community: 66.4%.
• Women at least 33% of employees, with the management team at least matching that share, and 33% on the Board: women were 30% of employees, 25% of the management team and 33% of the Board.
• At least 35% of new hires women: 19%. At least 20% of new hires aged 20-29: 15% were under 30.
• Harassment cases 0: the occupational health survey was not conducted in 2025.
• Equality information session watched by 90% of new employees and 60% of others: training to be updated and a monitoring system set up.

Characteristics of the undertaking's employees

Reference: page 76.

At year end 2025 Gofore had 1,791 employees (2024: 1,471), taken from the HR system and matching the financial statements: 534 women, 1,257 men, none recorded as other or not disclosed. Permanent employees were 1,763 (530 women, 1,233 men), temporary 28 (5 women, 23 men) and non-guaranteed hours 6 (2 women, 4 men). In 2024 there were 487 women and 984 men; 1,310 permanent, 153 temporary and 8 on non-guaranteed hours.

About 92% (90%) of employees are in Finland and 8% (10%) in other EU countries. Finland is the only country with at least 50 employees and 10% of the total, at 1,642 (1,323).

Leavers in 2025 (2024): voluntarily 149 (118), termination 94 (15), retirement 5 (0), other reasons 36 (0). Employee turnover was 15.9% (9.0%).

Characteristics of non-employees in the undertaking's own workforce

Reference: page 77.

At the end of 2025, 360 non-employees worked on Gofore assignments (2024: 238). The count comes from the enterprise resource planning system. According to contractual partners, most were freelancers, either independent contractors or contracted through hubs (freelance brokers and agencies); a small portion were subcontractors on temporary assignments. Exact proportions are not available because the boundaries between groups are unclear and the same people may work under different contract types during the year. People also move between employee and contractor status in both directions.

Non-employees mainly did the same consulting work as employees. The Gofore Gigs partner portal connects open assignments with the partner network, and all partners are committed to the Supplier Code of Conduct.

Diversity metrics

Reference: pages 77, 23.

Top management was 25% women and 75% men in both 2025 and 2024: six men and two women in 2025, nine men and three women in 2024 (page 77).

Employees by age group, 2025 (2024) (page 77):

The Board has two women and four men (33% and 67%, unchanged from 2024) (page 23). Employees are 30% women and the management team 25% women, against an internal target of at least 33% for employees (page 75).

Adequate wages

Reference: page 78.

Gofore pays all employees at least the minimum wage set by its collective agreement or by law in the country concerned. In Finland the collective agreement minimums are tied to those of the national collective agreement for the IT services industry, which is widely applied across the country. Huld uses the general collective agreement for the design and consulting industry for senior employees, where a minimum wage is defined.

The number of employees paid below the sufficient wage level is 0 in both 2025 and 2024.

Social protection

Reference: page 78.

All Gofore employees live in the EU and are covered by statutory social security in their country of residence. Gofore has employees in Finland, Estonia, Germany, Austria, Spain and the Czech Republic. The company assesses the level of protection in these countries as comparatively high and says it covers life events such as illness, unemployment, work-related injury and disability, parental leave and retirement.

The page lists four measures in place: all employees in the own workforce are covered, through public programs or provided benefits, against loss of income from retirement, unemployment, work-related injury or disability, and parental leave.

Health and safety metrics

Reference: page 78.

All of Gofore's employees, 100% in both 2025 and 2024, are covered by the company's occupational health and safety management system. For non-employees the share is 0%, because they are covered by the management system of their own company. Gofore requires suppliers to provide a safe and healthy working environment that complies with national health and safety legislation, as set out in the Supplier Code of Conduct.

The page gives no counts of work-related injuries, fatalities or ill health, and no days lost.

Work-life balance metrics

Reference: page 79.

All employees are entitled to parental leave under social security policies or collective agreements: 100% in both 2025 and 2024.

Share of eligible employees who took parental leave, by gender: men 5.0% and 4.9%; women 2.4% and 1.6% (2025 and 2024).

Elsewhere the company says it encourages employees to find a healthy work-life balance, monitored through immediate leadership and through surveys run several times a year (page 73).

Compensation metrics (pay gap and total compensation)

Reference: page 79.

• Pay gap between female and male employees: 2% in 2025 (6% in 2024).
• Pay ratio, the annual total earnings of the highest-paid employee against the median of all other employees: 5.3 in 2025 (4.8 in 2024).

Method: the pay gap uses salary data for the whole Group and covers fixed salaries and variable pay, which is an essential part of total remuneration at Gofore. For Finnish companies the taxable income paid comes from the payroll system; for foreign subsidiaries gross salary is used. Gross salary is annualized for people not employed all year, and the calculation does not adjust for part-time work or unpaid absence. Appendix 1 points to page 76 for the pay gap and CEO pay ratio (page 93), but the figures are on page 79.

Incidents, complaints and severe human rights impacts

Reference: page 79.

Gofore reports that no incidents of discrimination were reported in the period, and that no serious complaints were filed through the channels available to its own workforce relating to Gofore's performance of its employer obligations. It also states that no severe human rights impacts or incidents related to its own workforce have occurred.

No fines, penalties or compensation figures are given. Appendix 1 points to page 77 for discrimination incidents and for non-compliance with the UN Guiding Principles and OECD Guidelines (page 93), but the statement is on page 79.

Policies related to consumers and end-users

Reference: pages 81-82.

Gofore commits to the OECD Guidelines for Multinational Enterprises, mainly the consumer protection and privacy principles, and is a member of the Global Compact Network Finland. Its principles on consumers and end users follow the UN Declaration of Human Rights on non-discrimination, equality, safety and social inclusion (page 81).

The statement names vulnerable groups, the elderly, people with disabilities and others with special needs, and says services essential for taking part in society must consider them in design. Ethical reviews of projects run before a project starts where negative impacts or ethical risks are possible, and can end in a decision to abandon the project (page 81).

Key documents (page 82): the information security policy (ten principles), data protection guidelines, the Ethical design booklet and accessibility guidelines for web service design following WCAG 2.1. The Chief Information Officer is responsible for implementation. All consumers and end users likely to be materially affected are included in the ESRS 2 disclosures (page 81).

Taking action on material impacts, and approaches to managing material risks and pursuing material opportunities related to consumers and end-users, and effectiveness of those actions and approaches

Reference: page 84.

Information security and data protection. The company names these its most significant risk category and says it provides critical or essential services to society, so the EU NIS2 Directive applies. Through 2025 it continued measures to improve risk management, incident detection and registration, and resilience and response in exceptional situations, extending to procurement and the supply chain. A service processes automatic security alerts and starts actions as agreed, and its operation is monitored and developed regularly.

Social inclusion. The materiality assessment found no significant accessibility risks but found accessibility services to be a business opportunity. Gofore aims to build awareness of accessibility inside and outside the company; accessibility training is part of induction for new employees, and more extensive training is designed for different roles.

The statement says no serious human rights issues or cases concerning consumers or end users were reported "in 2024 or in previous years".

Targets related to managing material negative impacts, advancing positive impacts, and managing material risks and opportunities

Reference: page 85.

Information security target: zero serious security breaches. In 2025 there were no serious security breaches. A serious incident has a broad impact on business operations, service usage, data security or personal data. The target covers internal operations, client systems Gofore maintains and related functions under its control. The incident classification developed in 2024 was implemented in 2025 and sorts incidents by financial impact and type, such as phishing, data leak or lost device. Passwordless, certificate-based authentication was introduced in 2025 against phishing, seen as the most likely single largest threat. All employees must complete annual information security training, which the company monitors.

Gofore tracks effectiveness through the annual number of serious incidents, and agrees project-specific information security and data protection targets with clients for each service. Its general AI guidelines aim to prevent unethical use of AI in internal operations and in services for consumers and end users; no AI target figure is given.

Business conduct policies and corporate culture

Reference: pages 87-88.

Gofore's ethical business principles are set out in its Code of Conduct, and its Code of Ethics encourages employees to raise ethical problems or illegal activity. The principles include openness, respect for people as individuals, an obligation to care for society and not putting more strain on the environment than necessary. Gofore has anti-corruption and anti-bribery policies in line with the United Nations Convention against Corruption and commits to investigating business conduct cases promptly, independently and impartially (page 87). The Ethics Desk, a working group of senior management representatives and experts, oversees compliance with the Code of Ethics and advises employees (page 87).

The whistleblowing channel follows the Whistleblower Protection Act, is open to key stakeholders on the website, and protects reporters from retaliation. In 2025 two reports were handled; neither fell within the channel's scope or alleged misconduct by the company. Anti-corruption guidelines were updated in 2025 and approved by the Board at year end, and training for employees in the most exposed functions starts in early 2026. Customer and partnership management are seen as the areas most exposed to corruption risk (page 88).

Targets related to business conduct

Back-filled from the business conduct chapter, where targets are covered by MDR-T rather than a numbered disclosure requirement. G1-3 became a standalone DR only in the 2025/2026 ESRS, and this statement was prepared under the 2023 ESRS.

Gofore states no measurable or dated business conduct target. Effectiveness is tracked through monitoring and incident review:

• The Ethics Desk oversees compliance with the Code of Ethics (page 87).
• An ethical review tool, in use since 2021, screens all projects for corruption risk before they start (page 89).
• Whistleblowing reports go to an independent team, and substantiated findings are reported to the Board and the Group Management Team (page 89). Two reports were handled in 2025, neither alleging misconduct by the company (page 88), and there were no corruption or bribery incidents or legal proceedings (page 90).

Planned steps with dates: the Board approved the anti-corruption policy in December 2025, training for the most exposed employee groups starts in 2026, and anti-corruption content joins new-employee orientation from early 2026 (pages 26, 88).

Incidents of corruption or bribery

Reference: page 90.

The statement says there were no reported incidents of corruption, bribery or other breaches of ethical business practices (the sentence also refers to preceding years of operation), and no legal proceedings against Gofore in relation to unethical or illegal practices. Actions to take on suspected corruption are described under G1-3. Appendix 1 points to page 90 for the datapoint on fines for violations of anti-corruption and anti-bribery laws (page 93).

Payment practices

Reference: page 90.

The average time Gofore takes to pay an invoice, from the start of the contractual or statutory payment term, is 26 days (2024: 25 days). The standard payment term is 30-60 days net, assessed case by case with regard to the payment terms of the main contract. The company says it is financially stable with enough liquidity to meet its obligations, and has no ongoing legal proceedings related to payment delays. Due invoices are paid twice a week (page 89). No breakdown by supplier category or share of payments within standard terms is given.