NNIT

The role of the administrative, management and supervisory bodies

Board of Directors and Group Management

The work with Sustainability in NNIT is anchored in the NNIT Board of Directors and the NNIT Management Group. The sustainability policy, which applies to NNIT's management and employees globally, is approved by the Board of Directors.

ESG and sustainability priorities are embedded in the Board of Directors' decision-making processes. The Board receives annual updates on our sustainability progress and a comprehensive report on the year's achievements, and the board is responsible for utilizing the result of the double materiality assessment to guide the process of setting targets in relation to material impacts, risks and opportunities where relevant. Targets set are tracked using appropriate indicators, both qualitative and quantitative. Environmental targets are managed through our ISO14001 EMS certification, which is anchored in our ISO9001 QMS certification.

Our Board of Directors possesses the competences related to sustainability as below:

• Relevant knowledge and experience in respect of social, environmental, political, regulatory and business matters in the geographic markets in which NNIT's business activities are conducted. • Relevant knowledge and experience within Environmental, Social and Governance (ESG)

• Environmental: Climate change, climate adaptation, energy, resource use and circular economy
• Social: Own workforce, workers in the value chain, Diversity
• Governance: Corporate culture and business conduct.

The Board of Directors undergoes an annual evaluation, which is further disclosed in the Corporate Governance section on page 20-23, where the performance, success and competencies of the Board are evaluated. The composition of the Board ensures that the needed competencies are available to effectively oversee sustainability matters and initiatives.

The Group Management team is responsible for ensuring the implementation of the ESG strategy and overseeing targets, and the annual review process of the DMA is anchored through group management in our CFO office.

Information provided to and sustainability matters addressed by the undertaking's administrative, management and supervisory bodies

ESG and sustainability priorities are embedded in the Board of Directors' decision-making processes. The Board receives annual updates on our sustainability progress and a comprehensive report on the year's achievements, and the board is responsible for utilizing the result of the double materiality assessment to guide the process of setting targets in relation to material impacts, risks and opportunities where relevant.

Sustainability Committee

There is a sustainability Committee headed by Senior VP, Commercial excellence & sustainability and includes our Group CFO. The Committee comprises of sustainability ambassadors appointed from each region where NNIT has office and also includes stakeholders from facility management, HR, Finance, Legal. The Committee meets once every quarter to discuss the ESG strategy, impacts, risks and opportunities, targets and action plans for each of the parameters of E, S and G. The Group CFO who is a member of the Sustainability Committee reports to the Audit Committee for matters related to sustainability. The Sustainability Committee provides quarterly updates to the Group CFO ensuring regular monitoring and oversight.

Audit Committee

The Audit Committee oversees the Enterprise Risk Management (ERM) process and the handling of the overall sustainability related activities on behalf of the board. The Audit Committee (AC) consist of at least two members, elected among the members of the Board of Directors. The AC is responsible for the on-going dialogue with the external auditor and facilitates exchange of information between the Board of Directors and NNIT's external auditor. In addition, the Audit Committee is also responsible for oversight of impacts, risks and opportunities for sustainability reporting as per CSRD and make suggestions to the Board. The Audit Committee reports to the Board which serves as managing, supervisory and administrative body for reporting outcomes.

Integration of sustainability-related performance in incentive schemes

NNIT group has not yet included sustainability-related performance in the incentive schemes for the Executive Management, or other incentive schemes. Historically sustainability-related metrics have not been at a sufficiently high maturity level to link incentives with performance. We will evaluate this again in 2025.

Diversity in the Board of Directors and Management

As of December 31, 2024, five out of six shareholder-elected board members were male, and one was female (83/17%), and four of the six shareholder-elected members are considered independent (44% of the board).

Three members of the board are employee elected board members out of which two were males, and one was female (67/33%).

In total, the Board of Directors has seven male and two female (78/22%) members.

The Board of Directors remains committed to having international members of the Board. Currently, two shareholder-elected board members are non-Danish.

The 2025 target of having at least 30% of the underrepresented gender on the Board of Directors as well as in management levels is fulfilled for the management group. We are still committed to working towards the target for the Board of Directors.

New targets will be set in 2025.

¹ 2023 figure does not include SCALES, SL Controls and Excellis.

Statement on due diligence

The table provides a mapping of where in our Sustainability Statements we provide information about our due diligence process, including how we apply the main aspects and steps of our due diligence process.

Risk management and internal controls over sustainability reporting

As part of the annual risk assessment performed by the NNIT Group Management in 2024, any identified ESG risks were subsequently assessed by the Board of Directors. As part of Double materiality assessment, NNIT has identified risks related to each of the parameters of Environment, Social and Governance. Please refer to page 47-52 for information on material risks identified.

Risks related to reporting

NNIT's sustainability reporting is susceptible to the risk of material misstatement caused by human error or incomplete data. ESRS aligned accounting principles have been adopted to manage this risk, in addition to external auditing providing limited assurance. Our annual risk management process is designed to manage the risks associated with NNIT's operations. During that process, we also monitor risks related to sustainability reporting. In 2024, the risk management and reporting included risks related to sustainability reporting, governance and compliance reporting.

Successfully Managing E and S Risks

NNIT has comprehensive emergency response plans in place across all geographies and works diligently to ensure sustainable consumption to the extent possible (Please refer to page 24-26 in Risk Management, ESRS 2 GOV-2)

Our enterprise risk management process is part of the Company Performance Management Process and includes the methods and processes used to collect and consolidate a complete risk picture of NNIT. Finance in collaboration with responsible person from quality and security undertakes a process of risk re-evaluation and risk assessment. Risks are evaluated and top 20 risks are presented to NNIT Group Management along with how they can be managed and their mitigating actions. Following, NNIT Group Management report top 10 risks to the Board along with their risk mitigation plan. This process also includes risks related to sustainability and ESG.

Controls over sustainability reporting

Reported data and descriptions in the Sustainability Statements are reviewed and validated by relevant owners of the different functional areas. In connection with the review process, KPI figures are controlled and documentation reviewed. Reviews are carried out in connection with the annual preparation of the Sustainability Statements.

Strategy, business model and value chain

NNIT is a highly specialized IT consultancy focusing on life sciences internationally and the public and private sectors in Denmark. We provide IT and business solutions in Asia, Denmark, Europe and the US. We focus on high complexity industries and thrive in environments where regulatory demands and complexity are high. Our focus is internationally exclusively on the life sciences industry, helping customers digitalize key parts of their value chain.

From the Danish headquarters, we also focus on the public and private sectors. We advise on and develop sustainable digital solutions that serve end-users, customers and employees effectively. The NNIT Group consists of parent company NNIT A/S and subsidiaries including SCALES, Excellis Health Solutions and SL Controls, who together employ over 1,700 people.

1,851m Total revenue. 1,736 Total headcount.

Region breakdown:

• 818 Headcount Region Denmark
• 181 Headcount Region US
• 297 Headcount Region Asia
• 440 Headcount Region Europe

Region: Europe, US and Asia | Region: Europe, US and Asia

Strategy

NNIT's overall aspiration is to make a mark in business and society, bringing digital transformation to life. We want to build a successful business while contributing with our expertise and capabilities towards creating a sustainable future.

NNIT has for many years worked on reducing carbon emissions, including setting Science-Based targets for reducing our carbon footprint. Moving forward, NNIT will continue to develop our sustainability reporting processes for future CSRD reporting.

These initiatives are taken to support the political initiatives, and customer wishes to reduce environmental impact. As a highly specialized consulting company, where the ability to attract the right people to the organization is key to delivering the strategic targets, NNIT have a strong focus on providing good working conditions, treating all employees fairly and respectfully as well as supporting political and societal initiatives and agendas on diversity and inclusion.

2024 represents our first year as a pure IT consultancy, with a complete legal, technical and operational split from our former infrastructure operations. During 2024, we continued our strategical focus on growing in Life Sciences globally and in the Danish public sector.

Business Model

Deploying strategic assets to address business potential and plans → Value creation

Strategic Assets:

• Customer experience & Digital solutions that work & Industry mastery
• Talented people with a business first approach & Superior quality & Domain knowledge

Value Creation:

• Customers
• Employees
• Investors

People: the right people + good work environment = strong business Environment: reduce emissions to support climate targets
Governance: Strong governance to manage risks and operations

For more details on business model and strategy, refer to the Management Review on pages 5-7 and 14, and more information on the Carbon Reduction Plan, see page 54 in E1 Climate Change. For information on material impacts, risks and opportunities and their relationship to NNIT's business model and value chain, refer to SBM-3.

For more details on our value chain, refer to IRO-1 on page 47-49.

Interests and views of stakeholders

Stakeholder engagement plays a crucial role in identifying material issues and serves as the foundation for developing initiatives and solutions that support more sustainable operations. This engagement remains a dynamic process, fostering ongoing dialogue between NNIT and key stakeholders to continuously refine strategies based on the insights gained from these interactions.

Employee engagement and collaboration with their representatives are central to shaping our human resources strategy. Feedback from employees is integrated into the planning and execution of HR initiatives, while consultations with workers' representatives ensure alignment on employment conditions and terms. The Board of Directors, informed by input from across the organization, takes the lead in setting our strategic direction.

To date, no adjustments to our strategy or business model have been deemed necessary because of stakeholder feedback.

There is no formal collection of stakeholder input for NNIT from stakeholders on sustainability matters, however information is derived from NNIT Project teams, sustainability ambassadors (appointed employees), managers and management team as input to NNIT's sustainability committee. The committee process information in regular meetings, and build an understanding of stakeholder views, considering how this relates to the business model and strategy of NNIT.

For more information on stakeholders, refer to IRO-1 on page 48.

Material impacts, risks and opportunities and their interaction with strategy and business model

Overview

NNIT has identified material impacts, risks and opportunities (IROs) through a double materiality assessment conducted in accordance with ESRS requirements. The assessment identified material sustainability matters in E1 (Climate change), S1 (Own workforce), S4 (Consumers and end-users), and G1 (Business conduct).

Material IROs mainly relate to NNIT's core business activities and own operations, and the ability to deliver and perform IT services and products, impacting or being influenced by clients, end-users and employees. Given their close connection to the business model, most are actively managed within operations.

Material IROs by Topic

E1 - Climate change

S1 – Own Workforce

S4 – Consumers and end-users

G1 – Governance

Interaction with Strategy and Business Model

NNIT's material IROs are closely integrated with the business strategy and model:

• Climate change: The Carbon Reduction Plan is incorporated into annual business strategy updates and financial planning. Near-term SBTi-validated targets guide decarbonization efforts aligned with the Paris Agreement.

• Own workforce: As a people-driven organization reliant on highly qualified workforce, material workforce risks are integrated into the Enterprise Risk Management Process. The ability to attract and retain talent is essential to execute strategic growth objectives.

• Consumers and end-users: Given NNIT's role as IT solutions provider to Life Sciences industry and public sector, responsibility for impact on customers and end-users is central to corporate aspiration to "bring digital transformation to life, making a mark on business and society."

• Business conduct: Strong corporate culture and ethical conduct are fundamental to earning and maintaining trust of customers, users, and stakeholders, particularly given NNIT's operations in regulated pharmaceutical industry.

No significant investments are required to implement the sustainability aspects of the strategy, and the operating model is fully aligned with it. No adjustments to strategy or business model have been deemed necessary because of stakeholder feedback.

Resilience to Material IROs

Physical climate risks: No physical risks referring to direct impacts of climate change on NNIT's operations and business model have been identified as material. No NNIT locations are under material risk due to climate-related weather events, and NNIT employs a highly flexible remote work policy, with all IT infrastructure being cloud driven.

Transition risks: NNIT is actively engaging in reducing emissions and energy consumption and seizing the identified opportunity to alleviate the financial risk related to customer expectations on decarbonization.

Workforce risks: Material risks related to workforce primarily revolve around working conditions and equal treatment and opportunities. These are managed through global policies, regular employee engagement, and integration into risk management processes.

NNIT considers itself resilient to climate-related impacts, but acknowledges fewer insights into potential risks in the value chain that could have indirect consequences. However, this risk is considered low to strategy and business model. Future assessments will continue to evaluate physical and transition risks and their anticipated financial effects.

Time Horizons

NNIT defines time horizons as follows:

• Short term: less than one year
• Medium term: 1-2 years
• Long term: 2-5 years

Description of the processes to identify and assess material impacts, risks and opportunities

Double materiality assessment & outcome

Impact, risk and opportunity management

In 2024, NNIT Group conducted its first double materiality assessment (DMA) in accordance with the requirements of the ESRS. This included identifying and objectively scoring impacts, risks, and opportunities (IROs), as a basis for the materiality decision of the sustainability matters, resulting in a double materiality assessment.

Output from the materiality assessment

We have identified our impacts on the environment and society (impact materiality assessment) as well as the sustainability-related risks that we are exposed to (financial materiality assessment). The outcome is aggregated per ESRS topic, showing that E1, S1, S4, and G1 are our material sustainability matters. Sustainability matters have been assessed for materiality not only on a topic level, but also on a sub- and sub-sub topic level. On a sub- and sub-subtopic level, the following matters are deemed material:

NNIT's materiality matrix

[Matrix showing Impact material vs Financial material with following positioning:]

• Double material: E1 Climate change mitigation, S1 Working Conditions
• Impact Material: E1 Energy, S1 Working time, Work-life balance, Health and safety, Training and skills development, S4 Non-discrimination, Access to products and services, G1 Corporate culture
• Financial Material: S1 Gender equality and equal pay for work of equal value, Diversity, G1 Protection of whistleblowers, Corruption and Bribery

Index of sustainability matters

Double material:

• E1: Climate change mitigation, E1-1
• S1: Working Conditions, S1-1

Impact Material:

• E1: Energy, E1-2
• S1: Working time S1-1-2
• S1: Work-life balance, S1-1-7
• S1: Health and safety, S1-1-8
• S1: Training and skills development, S1-2-2
• S4: Non-discrimination, S4-3-1
• S4: Access to products and services, S4-3-2
• G1: Corporate culture, G1-1

Financial Material:

• S1: Gender equality and equal pay for work of equal value, S1-2-1
• S1: Diversity, S1-2-5
• G1: Protection of whistleblowers, G1-2
• G1: Corruption and Bribery, G1-6

Non-material (0): Climate change adaptation, Pollution, Water and marine resources, Biodiversity and ecosystems, Circular economy, Secure Employment (OW), Adequate Wages (OW), Social dialogue (OW), Freedom of Association (OW), Collective bargaining (OW), Employment and inclusion of persons with disabilities (OW), Measures against violence and harassment in the workplace (OW), Other

## IRO-2: Disclosure requirements in ESRS covered by the undertaking's sustainability statement

The tables below provide an overview of all ESRS disclosure requirements included in ESRS 2 and the topical standards that are material to NNIT. These standards have informed the preparation of our Sustainability statements.

Disclosure requirements from topical standards E, E3, E4, E5, S2, and S3 have been excluded, as they were deemed immaterial based on our materiality assessment.

The tables serve as a guide to locate specific disclosure requirements within the Sustainability Statements. Additionally, they indicate where information outside the Sustainability Statements - referenced in the management's review or financial statements within this annual report - can be found. For disclosure requirements where no information is available, no reference is provided.

| Disclosure requirement | | Section/report | Page(s) |
|---|---|---|---|
| **ESRS 2** | **General Disclosures** | **General Disclosures** | **35-52** |
| BP-1 | General basis for preparation of the sustainability statement | BP-1 | 37 |
| BP-1 | Disclosures in relation to specific circumstances | BP-1 | 37 |
| BP-1 | Datapoints that derive from other EU legislation | BP-1, Appendix III | 38, 107-109 |
| GOV-1 | The role of the administrative, management and supervisory bodies | Corporate Governance (MR), GOV-1, GOV-2, GOV-3 | 20-23, 39-40 |
| GOV-1 | Number of executive members | Corporate Governance (MR), GOV-1, GOV-2, GOV-3 | 20-23, 39-40 |
| GOV-1 | Information about representation of employees and other workers | Corporate Governance (MR), GOV-1, GOV-2, GOV-3 | 20-23, 39-40 |
| GOV-1 | Information about identity of administrative, management and supervisory bodies or individual(s) within body responsible for oversight of impacts, risks and opportunities | Corporate Governance (MR), GOV-1, GOV-2, GOV-3 | 20-23, 39-40 |
| GOV-1 | The undertaking shall disclose the composition of the administrative, management and supervisory bodies, their roles and responsibilities and access to expertise and skills with regard to sustainability matters | Corporate Governance (MR), GOV-1, GOV-2, GOV-3 | 20-23, 39-40 |
| GOV-1 | Disclosure of how body's or individuals within body responsibilities for impacts, risks and opportunities are reflected in undertaking's terms of reference, board mandates and other related policies | Corporate Governance (MR), GOV-1, GOV-2, GOV-3 | 20-23, 39-40 |
| GOV-1 | Description of how oversight is exercised over management-level position or committee to which management's role is delegated to | GOV-1, GOV-2, GOV-3 | 39-40 |
| GOV-1 | Information about reporting lines to administrative, management and supervisory bodies | GOV-1, GOV-2, GOV-3 | 39-40 |
| GOV-1 | Disclosure of how dedicated controls and procedures are integrated with other internal functions | GOV-1, GOV-2, GOV-3 | 39-40 |
| GOV-2 | Information provided to and sustainability matters addressed by the undertaking's administrative, management and supervisory bodies | Corporate Governance (MR) | 20-23 |
| GOV-3 | Integration of sustainability-related performance in incentive schemes | Corporate Governance (MR) | 20-23 |
| GOV-4 | Statement on sustainability due diligence | GOV-4 | 42 |
| GOV-5 | Risk management and internal controls over sustainability reporting | Risk Management (MR), SBM-3 | 24-26, 50 |
| SBM-1 | Strategy, business model and value chain (products, markets, customers) | Strategy (MR), E1-1, SBM-3, IRO-1 | 14, 47, 50, 54 |
| SBM-2 | Interests and views of stakeholders | IRO-1 | 47 |
| SBM-3 | Material impacts, risks and opportunities and their interaction with strategy and business model | SBM-3 | 50 |
| SBM-3 | Significant risk of incidents of forced labour or compulsory labour | S1-1 | 73 |
| SBM-3 | Countries or geographic areas with operations considered at significant risk of incidents of forced labour or compulsory labour. | S1-1 | 73 |
| SBM-3 | Type of operations at significant risk of incidents of child labour | S1-1 | 73 |
| SBM-3 | Countries or geographic areas with operations considered at significant risk of incidents of child labour | S1-1 | 73 |
| IRO-1 | Description of the process to identify and assess material impacts, risks and opportunities | GOV-1 | 48 |
| IRO-1 | Description of extent to which and how process to identify, assess and manage opportunities is integrated into overall management process | IRO-1 | 47 |
| IRO-2 | Disclosure requirements in ESRS covered by the undertaking's sustainability statement | Appendix III | 107-109 |
| **E1-1** | **Transition plan for climate change mitigation** | **E1-1** | **54** |
| ESRS 2 SBM-3 | Material impacts, risks and opportunities, and their interaction with strategy and business model | E1 ESRS , SBM-3 | 43, 55 |
| ESRS 2 IRO-1 | Description of the processes to identify and assess material climate-related impacts, risks and opportunities | Risk assessment (MR) | 24-26, 43, 55 |
| E1-2 | Policies related to climate change mitigation and adaptation | E1-2 | 56 |
| E1-3 | Actions and resources in relation to climate change policies | E1-3 | 57 |
| E1-4 | Targets related to climate change mitigation and adaptation | E1-4 | 58 |
| E1-5 | Energy consumption and mix | E1-5, E1 Accounting Policies | 59, 62-63 |
| E1-6 | Gross Scopes 1, 2, 3 and total GHG emissions | E1-6, E1 Accounting Policies | 60, 62-63 |
| ESRS 2 SBM-2 | Interests and views of stakeholders | S1-2 | 75 |
| ESRS 2 SBM-3 | Material impacts, risks and opportunities and their interaction with strategy and business model | S1 ESRS 2, SBM-3 | 72 |
| S1 SBM-2 | Explanation of how the undertaking's strategy and business model impact its workforce, including whether they create, worsen, or reduce significant material impacts, and how the strategy and business model are adjusted to address these impacts. | S1 ESRS 2 SBM-3 | 72 |
| S1-1 | Policies related to own workforce | S1-1 | 73-74 |
| S1-2 | Processes for engaging with own workers and workers' representatives about impacts | S1-2 | 75 |
| S1-3 | Processes to remediate negative impacts and channels for own workers to raise concerns | S1-3, G1-1, G1-3 | 72, 76, 101, 103 |
| S1-3 | Policies regarding protection against retaliation for individuals that use channels to raise concerns or needs are in place | S1-3, G1-1, G1-3 | 76, 101, 103 |
| S1-4 | Taking action on material impacts on own workforce, and approaches to mitigating material risks and pursuing material opportunities related to own workforce, and effectiveness of those actions | S1-4 | 77-78 |
| S1-4 | Considerations of external developments when dependencies turning into risks | S1-4 | 77-78 |
| S1-4 | Process(es) to manage material risks related to own workforce are integrated into its existing risk management process(es). | S1 ESRS 2 SBM-3 | 72 |
| S1-5 | Targets related to managing material negative impacts, advancing positive impacts, and managing material risks and opportunities | S1-5 | 79-80 |
| S1-6 | Characteristics of the undertaking's employees | S1-5, S1-6 | 79-80, 81 |
| S1-6 | The most representative number of headcount in the financial statements | Results for the year | 131 |
| S1-8 | Collective bargaining coverage and social dialogue | S1-8 | 82 |
| S1-9 | Diversity metrics | S1-9 | 83 |
| S1-10 | Adequate wages | S1-10 | 84 |
| S1-14 | Health and safety metrics | S1-14 | 84 |
| S1-16 | Compensation metrics (pay gap and total compensation) | S1-16 | 85 |
| S1-17 | Disclosure of the number of work-related incidents and/or compliants and severe human rights impacts within its own workforce, and any related material fines, sanctions or compensation for the reporting period. | S1-17 | 85 |
| S1-17 | Number of incidents of discrimination , including harassment | S1-17 | 85 |
| S1-17 | Number of compliants filed through channels for people in own workforce to raise concerns | S1-17 | 85 |
| S1-17 | Number of compliants filed to National Contact Points for OECD Multinational Enterprises | S1-17 | 85 |
| S1-17 | Amount of fines, penalties, and compensation for damages as result of incidents of discrimination, including harassment and compliants filed | S1-17 | 85 |
| S1-17 | Number of severe human rights issues and incidents connected to own workforce | S1-17 | 85 |
| S1-17 | Number of severe human rights issues and incidents connected to own workforce that are cases of non respect of UN Guiding Principles and OECD Guidelines for Multinational Enterprises | S1-17 | 85 |
| S1-17 | No severe human rights issues and incidents connected to own workforce have occurred | S1-17 | 85 |
| S1-17 | Amount of fines, penalties, and compensation for severe human rights issues and incidents connected to own workforce | S1-17 | 85 |
| ESRS 2, SBM-3 | Material impacts, risks and opportunities and their interaction with strategy and business model | ESRS 2 SBM-3 | 89-90 |
| S4-1 | Policies related to consumers and end-users | S4-1, G1-1 | 90-91, 99-101 |
| S4-2 | Processes for engaging with consumers and end-users about impacts | S4-2, G1-3 | 92, 102 |
| S4-3 | Processes to remediate negative impacts and channels for consumers and end-users to raise concerns | S4-3, G1-1 | 93, 99-101 |
| S4-4 | Taking action on material impacts on consumers and end-users, and approaches to mitigating material risks and pursuing material opportunities related to consumers and end-users, and effectiveness of those actions | S4-4, G1-4 | 94-95, 103 |
| S4-5 | Targets related to managing material negative impacts, advancing positive impacts, and managing material risks and opportunities | S4-5 | 96 |
| ESRS 2, GOV-1 | The role of the administrative, supervisory and management bodies | G1-1, GOV-1, GOV-2, GOV-3 | 39-41, 99-101 |
| ESRS 2, IRO-1 | Description of the processes to identify and assess material impacts, risks and opportunities | ESRS 2 SBM-3, IRO-1 | 47-52 |
| G1-1 | Business conduct policies and corporate culture | G1-1 | 99-101 |
| G1-3 | Prevention and detection of corruption and bribery | G1-3 | 102-103 |
| G1-4 | Incidents of corruption or bribery | G1-4 | 103 |

Transition plan for climate change mitigation

Scope of the plan

NNIT has established a Carbon Reduction Plan for 2030, incorporating near-term targets validated by the Science Based Targets initiative (SBTi) and aligned with the goals of the Paris Agreement. While the current transition plan is not yet fully aligned with CSRD requirement, NNIT is committed to enhancing our approach to ensure compliance and transparency before 2025.

Our commitments to carbon reduction – as outlined in the Carbon Reduction Plan – is considered as part of the annual business strategy update process, and consequently our financial planning and operation.

Target years for net zero / carbon neutral

NNIT is committed to setting long-term targets and to reach net-zero no later than 2050.

Scope 1, 2, 3 reduction milestones with baseline years

SBTi validated targets

Baseline emissions (2023)

NNIT commits to reduce absolute scope 1 GHG emission 90% by 2029 from a 2023 base year. NNIT also commits to reduce absolute scope 2 GHG emissions 42% by 2030 from a 2023 base year. NNIT further commits to reduce absolute scope 3 GHG emissions from purchased goods and services and upstream transportation and distribution 47% within the same timeframe. A location-based approach is used to account for scope 2 emissions and to track performance.

Alignment with 1.5°C / SBTi validation status

In 2024, the Science Based Targets Initiative validated the emission reduction targets submitted by NNIT, with official near-term targets for scope 1 and 2 in line with a 1.5C trajectory.

SBTi has approved three near-term targets based on relevant sector-specific guidance, in line with the IPCC special report 1.5C trajectory.

The SBTi's Target Validation Team has classified NNIT A/S' scope 1 and 2 target ambition and determined it is in line with a 1.5C° trajectory.

An important sustainability milestone this year was the submission of our near-term plan to the Science Based Targets initiative (SBTi), and we now have SBTi-validated and approved near-term targets as a further testament to our commitment to climate action.

Key levers / decarbonization pillars

The Carbon Reduction plan highlights the following areas and key actions for decarbonization:

Higher accuracy with activity-based reporting instead of spend-based reporting

NNIT will focus on making GHG accounting more accurate to track progress on emission reduction targets.

Transformation of fossil fueled company car fleet from fossil fueled to purely electric

As the main direct emission source, the company car fleet will be reduced and transitioned to purely electric. This action is expected successful completion in 2025, and will reduce emissions from business travel.

Enforcing stronger demands on our upstream supply chain

This decarbonization lever is regarding our scope 3 emissions, committing NNIT to reduce absolute scope 3 GHG emissions from purchased goods and services and upstream transportation and distribution by 47%. This action is founded in the policy Responsible Sourcing Standards.

Energy optimization of office sites

NNIT is and will purchase green energy from certified green sources for all locations in Denmark, and continuously works to explore opportunities for optimized processes leading to less energy consumption.

CapEx / investment commitments

These key actions are embedded into NNIT business strategy and are not currently assessed as dependent on additional resource allocation.

No significant investments are required to implement the sustainability aspects of the strategy, and our operating model is fully aligned with it.

Target review and revalidation

NNIT is committed to reporting on the progress against these targets on an annual basis, through GHG emission reporting. In addition, NNIT is committed to review our targets within five years, and if necessary, recalculate and revalidate for continued recognition by the SBTi.

We will continue to align our reduction targets with the inventory boundaries if any significant changes are made to our business/inventory.

Approach not yet fully CSRD-aligned

While the current transition plan is not yet fully aligned with CSRD requirement, NNIT is committed to enhancing our approach to ensure compliance and transparency before 2025.

Policies related to climate change mitigation and adaptation

NNIT's policies related to climate change mitigation and adaptation are anchored in its Sustainability and ESG Policy and supported by a Global Facilities Policy. As part of NNIT's UN Global Compact commitment, the company focuses on Sustainable Development Goal 12, Responsible Consumption and Production, continuously looking for ways to minimize environmental impact.

Sustainability and ESG Policy

Key content and principles:

• Describes how NNIT works with material impacts, risks and opportunities
• Covers topics including CO2 emission reductions, renewable energy consumption, environmental protection, carbon footprint and Science Based Targets
• Addresses labor rights, labor practices, working environment, and anti-corruption
• Instructs all NNIT employees to make the right decision in their roles as part of a conscious-driven company
• Supports NNIT in addressing material impacts, risks and opportunities

Scope:

• Applies to NNIT's management and employees on all NNIT locations globally

Governance:

• Approved by the NNIT Board of Directors and the NNIT Management group

Public availability:

• All sustainability and ESG policies are publicly available on NNIT's website
• All reports on Sustainability and ESG from NNIT are publicly available on the website

Link to international standards:

• UN Global Compact commitment
• Science Based Targets initiative
• Sustainable Development Goal 12 (Responsible Consumption and Production)

Purpose:

The purpose of the Sustainability and ESG Policy is to instruct all NNIT employees to make the right decision in their roles as part of a conscious-driven company, and supports NNIT in addressing material impacts, risks and opportunities.

Global Facilities Policy

Key content and principles:

• Governs investments in and management of NNIT office buildings
• Aims to continually optimize energy and water consumption
• Provides optimal working conditions for employees
• Energy-saving initiatives to be implemented wherever possible
• Initiatives depend on the building in question, its location and use

Governance:

• Approved by the NNIT Board of Directors and the NNIT Management group

Public availability:

• Publicly available on NNIT's website

Responsible Sourcing Standards

NNIT also references Responsible Sourcing Standards as a policy foundation for enforcing stronger demands on the upstream supply chain, including suppliers complying with the same principles as NNIT.

Environmental Management System Certification

NNIT's commitment to best practice environmental management is demonstrated by ISO 14001:2015 certification obtained in January 2023. This certification relates to the Environmental Management System implemented into the Quality Management System, focusing on behavior, processes, and policies to ensure responsible action and reduce footprint over time. Certificates are obtained for HQ in Copenhagen, Denmark and head office in Tianjin, China.

Actions and resources in relation to climate change policies

In 2023, NNIT divested its infrastructure operations business and data centers, leading to a significant change and decrease in emissions. Moving forward as a pure consulting company, NNIT will continue to focus on reducing emissions from own operations.

As described in relation to the transition plan (see E1-1), the Carbon Reduction plan highlights the following areas and key actions for decarbonization with target years 2029 and 2030:

1. Higher accuracy with activity-based reporting instead of spend-based reporting

What: NNIT will focus on making GHG accounting more accurate to track progress on emission reduction targets.

Scope: Own operations

Time horizon: 2029-2030 (aligned with Carbon Reduction Plan)

Resources: Not quantified; embedded into NNIT business strategy and not currently assessed as dependent on additional resource allocation

Link to targets: Supports tracking of SBTi-validated targets for scope 1, 2, and 3 emissions

2. Transformation of fossil fueled company car fleet from fossil fueled to purely electric

What: As the main direct emission source, the company car fleet will be reduced and transitioned to purely electric.

Scope: Own operations (Scope 1 emissions)

Time horizon: Expected successful completion in 2025

Resources: Not quantified; embedded into NNIT business strategy and not currently assessed as dependent on additional resource allocation

Expected outcome: Will reduce emissions from business travel

Link to targets: Largest quantitative contribution to reduce scope 1 emissions; supports 90% reduction in absolute scope 1 GHG emissions by 2029

3. Energy optimization of office sites

What: NNIT is and will purchase green energy from certified green sources for all locations in Denmark, and continuously works to explore opportunities for optimized processes leading to less energy consumption.

Scope: Own operations (Scope 2 emissions)

Time horizon: Ongoing through 2029-2030

Resources: Not quantified; embedded into NNIT business strategy and not currently assessed as dependent on additional resource allocation. 52% of electricity consumption (Danish NNIT locations) is covered by Renewable Energy Certificates.

Link to policy: Founded in NNIT Global Facilities Policy, which applies on all NNIT locations globally. Measures to support reductions in energy consumptions are to be implemented wherever possible.

Link to targets: Supports 42% reduction in absolute scope 2 GHG emissions by 2030

4. Enforcing stronger demands on our upstream supply chain

What: This decarbonization lever is regarding scope 3 emissions, committing NNIT to reduce absolute scope 3 GHG emissions from purchased goods and services and upstream transportation and distribution by 47%.

Scope: Upstream supply chain (Scope 3 emissions)

Time horizon: 2029-2030

Resources: Not quantified; embedded into NNIT business strategy and not currently assessed as dependent on additional resource allocation

Link to policy: Founded in the policy Responsible Sourcing Standards

Link to targets: Supports 47% reduction in absolute scope 3 GHG emissions from purchased goods and services and upstream transportation and distribution by 2030

Note on emission reductions: Achieved CO2e-emission reductions are not available, as comparable numbers from prior reporting are not disclosed due to difference in CO2e-reporting scope.

Targets related to climate change mitigation and adaptation

NNIT has established SBTi-validated near-term targets for climate change mitigation aligned with limiting global temperature rise to 1.5°C.

SBTi-validated near-term targets

*Note: The document shows both 2029 and 2030 for Scope 3 target year in different sections (page 58 shows "by 2030" while page 54 shows "by 2029").

Target tracking approach

• Scope 2 accounting method: Location-based approach is used to track performance against SBTi targets
• Long-term commitment: NNIT commits to setting long-term targets and reaching net-zero no later than 2050
• Target review: Committed to review targets within five years and recalculate/revalidate if necessary for continued SBTi recognition

Progress to date

No progress data disclosed for 2024 as baseline year is 2023. NNIT commits to reporting progress annually through GHG emission reporting.

Decarbonization levers

Key actions identified in the Carbon Reduction Plan to achieve targets:

1. Higher accuracy with activity-based reporting instead of spend-based reporting
2. Transformation of fossil fueled company car fleet to purely electric (expected completion 2025)
3. Enforcing stronger demands on upstream supply chain
4. Energy optimization of office sites (purchase of green energy from certified sources)

Energy consumption and mix

Reporting year: 2024
Scope: NNIT is a pure IT consulting company (following divestment of infrastructure operations/data centers in May 2023). Energy consumption primarily includes electricity and heating for office premises, plus direct fuel consumption from the company car fleet. Energy data covers NNIT locations globally; data for January–October 2024 is direct, with November–December extrapolated based on the average of the first 10 months. Locations with fewer than 100 employees have been extrapolated based on headcount and geography.

Renewable energy purchases: 52% of electricity consumption (Danish NNIT locations) is covered by Renewable Energy Certificates (GoO and REC). A location-based approach is used (national grid mix data from IEA) to estimate the share of renewable and non-renewable energy in NNIT's global consumption.

Energy consumption and mix (MWh)

Note: The table does not disaggregate fossil sources by type (coal, oil, natural gas, other) or renewable sources by subtype (biomass, solar, wind, etc.). Self-generated non-fuel renewable energy is not separately disclosed. Fuel consumption from the company car fleet is included in total fossil energy consumption but not separately broken out. No energy intensity metric per revenue is disclosed for E1-5/E1-7.

Gross Scopes 1, 2, 3 and Total GHG emissions

Greenhouse gas emissions

GHG intensity per net revenue

Net revenue used to calculate GHG intensity amounts to 1,851 million DKK in 2024.

Biogenic CO2 emissions

Biogenic emissions of CO2 from the combustion or biodegradation of biomass have been estimated for scope 1, 2 and 3.

Baseline year data for SBTi targets

NNIT has set near-term targets validated by the Science Based Targets initiative (SBTi) with 2023 as the baseline year.

Methodology notes

Organizational scope and comparative figures:
Since May 2023, NNIT has been a pure IT consulting company following the divestment of infrastructure operations (data centers). The organizational scope included in emissions reporting has changed from previous Sustainability Statements. As a result, comparable emissions from prior reporting years are unavailable and not presented. NNIT has updated its baseline year for SBTi-validated emission reduction targets to 2023 to include the full group.

Scope 1:
Scope 1 emissions refer to direct emissions from sources owned or controlled by NNIT, primarily company car fuel consumption. Company cars are identified in procurement and HR systems. Scope 1 CO2e is calculated as combusted fuel type × conversion factor per fuel type. Conversion factors from DEFRA (2024) were applied by CEMAsys.

Scope 2:
Scope 2 emissions are indirect GHG emissions from the generation of power and heat purchased and consumed by NNIT. Both location-based and market-based approaches are calculated. NNIT's SBTi targets are based on the location-based approach. Location-based emissions use average emission factors for the regional or national energy grid (IEA 2024 factors). Market-based emissions consider purchases of renewable energy using IEA 2024 market-based factors.

Direct data on energy use is collected from office facilities from locations with more than 100 employees. Smaller locations are extrapolated based on relevant assumptions using headcount and geographical location.

Scope 3:
Scope 3 includes indirect emissions from NNIT's activities in the value chain. NNIT reports on 7 of the 15 GHG Protocol categories. Data is a mix of spend-based and activity-based. Data is collected for NNIT's locations in Denmark (excl. subsidiaries), Czech Republic, the Philippines and China, representing 59% of total headcount. The remaining 41% is covered by extrapolation. Extrapolations assume highly similar business activities across locations but account for regional preferences and consumption patterns.

• Category 1 (Purchased goods and services): Procurement data collected from major locations; extrapolation based on geographical regions (Asia vs. Europe/US).
• Category 2 (Capital goods): Not reported. NNIT uses personal computers and other digital devices but has not been able to collect data for 2024.
• Category 3 (Fuel-and-energy-related activities): Calculated using IEA country factors and DEFRA factors based on Scope 1 and 2 data in CEMAsys.
• Category 4 (Upstream transportation and distribution): Not reported directly; included under SBTi targets as accounted for under Scope 3.1.
• Category 5 (Waste generated in operations): Waste data collected from major locations; extrapolation based on headcount for each waste category.
• Category 6 (Business travel): For major locations, emissions reported based on supplier-specific data from travel agencies or calculated using flight records with DEFRA emission factors. For other locations, extrapolation based on assumption of similar travel activity. Direct data coverage: 69%.
• Category 7 (Employee commuting): Estimated using country-specific average per employee. Calculation based on a CEMAsys template incorporating transportation modes, daily commuting distance, number of working days, percentage distribution of transportation mode usage, and total number of employees. Since no direct commuting data is available, NNIT relies on extrapolated figures based on CEMAsys assumptions and internal research.
• Category 8 (Upstream leased assets): Emissions related to assets NNIT leases from another entity not included in Scope 1 and 2. Covers warehousing, machinery and leased electrical equipment. Only relates to Danish location. Spend-based data calculated with EPA (2024) emission factors in CEMAsys.
• Category 13 (Downstream leased assets): Comprises NNIT's sublease of the previous headquarter location to other entities. Data relates to electricity and water consumption from Danish location only with direct data. Activity data processed in CEMAsys using DEFRA and Energinet emission factors. This activity ceased during 2024; NNIT expects to omit reporting on this category in future reporting.

Data collection and quality:
All figures for own operations are based on utility activity data and documentation from suppliers, in addition to estimations. Data is manually collected and reported into the third-party system CEMAsys and categorized across variables such as scope, country, unit, currency, and notes on how many months the original, un-extrapolated data covers. CEMAsys applies appropriate emission factors for each data point to calculate CO2e emissions.

Scope 1 and 2 data is available for January through October 2024. Energy and fuel consumption for November and December 2024 has been calculated based on the average from the first 10 months. NNIT commits to prioritize collecting data from vendors and suppliers for future reporting to improve data accuracy and obtain market-based energy data for all locations, reducing reliance on location-based estimates.

Biogenic emissions:
To calculate biogenic emissions, the UK Government's emission factors for company reporting (DEFRA) on biogenic emissions have been used. Scope 1 and 2 are calculated by applying biogenic emission factors for diesel usage, electricity, and district heating. Scope 3 biogenic emissions are estimated based on their proportional share of total biogenic emissions from Scope 1 and 2.

Other:
NNIT does not have any emissions related to CH4, N2O, HFC, PFC, SF6, or NF3. NNIT carbon footprint is reported in CO2-e equivalents. For 2024 GHG emissions, all figures have been audited by external auditors with limited assurance.

Anticipated financial effects from material physical and transition risks and potential climate-related opportunities

Phase-in exemption

NNIT is using the phase-in provision allowed under ESRS 1:137 for E1-9. As stated in the disclosure requirements table:

Methodology and approach

As stated in BP-2:

"For the first year of reporting according to CSRD, the provision in ESRS 1:137 allows a phase-in option for certain disclosure requirements, that have been applied specifically for E1 (E1-9) S1 (S1-7, S1-13, S1-15)."

Regarding climate risk assessment methodology:

"Although a formal climate-related scenario analysis was not performed, the evaluation of physical risks and identification of transition risks relied on NNIT's internal expertise and knowledge. This process was guided by principles from the GHG Protocol and SBTi."

"The method for assessing financial impact will be further developed for future reporting in 2025, to align further with our risk assessment and management system."

"We acknowledge the need for continuous evolution of our ESG metrics data and assessments going forward as we strive to reduce the associated uncertainties. We will continue to develop our methodology to ensure we are capturing our exposure to climate risk as accurately as possible, while further exploring ways to integrate climate change considerations into our existing processes."

Policies related to own workforce

NNIT has implemented several policies related to its own workforce, which are regularly reviewed and updated by NNIT Management Group and approved by the NNIT Board of Directors. The Board of Directors includes three employee-elected members who provide the employee perspective when discussing business matters and updating policies. All policies of interest are available on the company's website at www.NNIT.com.

Sustainability and ESG Policy

Scope: Applies to NNIT's management and employees globally.

Governance: The policy is approved by the Board of Directors.

Key content/principles: The policy addresses NNIT's approach to human rights and employee care, rooted in a commitment to fostering a respectful, inclusive, and supportive work environment. NNIT adheres to international standards including:

• United Nations Global Compact
• International Labor Organization's convention no. 155
• Focus on human rights, labor standards, environmental sustainability, and anti-corruption efforts

The policy commits to providing fair working conditions, including reasonable working hours, fair wages, non-forced labor, no child labor, and the right to collective bargaining. All employment within NNIT and its supply chain must be voluntary, with workers being at least 15 years old or meeting minimum age requirements set by national laws.

Public availability: Available on the company's website at www.NNIT.com.

Link to international standards: UN Global Compact, ILO Convention No. 155, UN Guiding Principles on Business and Human Rights (UNGPs), OECD Guidelines for Multinational Enterprises.

Monitoring: The Senior Vice President of HR, who is part of group management, is ultimately responsible for conducting and analyzing biannual eVoice surveys that track employee opinions and the effectiveness of policies.

Business Ethics Code of Conduct

Scope: Applies to all individuals who work for or represent NNIT, including directors, officers, managers, employees, and associates worldwide, as well as all NNIT business units and subsidiaries.

Governance: The policy is overseen by the Senior Vice President, Legal & Contract Management, who has overall responsibility for administration of the policy. The Board of Directors is responsible for developing and approving the policy. The group CFO is responsible for compliance with the policy.

Key content/principles: The policy defines expected ethical behavior in the workplace, business practices, and stakeholder interactions. It outlines NNIT's corporate values and fosters a culture of integrity. The policy does not tolerate violations, which may result in disciplinary actions ranging from warnings to dismissal or criminal prosecution. Failure by an employee to report a violation is itself considered a breach of the Code.

Public availability: Available to all employees and those of interest on the website www.NNIT.com.

Link to international standards: Not explicitly stated in the excerpts.

Monitoring: All employees are required to read, understand, and accept the Business Ethics Code of Conduct annually through the internal training system, Qpoint. All NNIT employees undergo mandatory regular training as part of onboarding. The policy includes processes for investigating incidents promptly, independently, and objectively.

Working Environment Policy (Working Environment Process)

Scope: Addresses both physical and psychological conditions for all employees in NNIT.

Governance: Key roles include the CEO (who oversees resources), Working Environment Representatives (who handle inquiries and assessments), and managers (who ensure safe working conditions and educate employees).

Key content/principles: The policy complies with local regulatory requirements and aims to minimize work barriers and organize work to prevent physical and psychological issues. It includes inputs like the Workplace Assessment Questionnaire (APV - in Denmark only), two annual eVoice surveys, and reports of working accidents. Activities involve conducting workplace assessments, handling accidents promptly, performing regular inspections, and holding quarterly Working Environment Council meetings.

Public availability: Not explicitly stated.

Link to international standards: Not explicitly stated.

Monitoring: All employees are covered by a health and safety management system (100% coverage) based on legal requirements. The system tracks work-related incidents and monitors the working environment through regular assessments and surveys.

Diversity and Inclusion Policy

Scope: Applies across the entire NNIT organization globally.

Governance: The Board of Directors is responsible for approving the policy and has established gender diversity targets.

Key content/principles: The policy guides NNIT's commitment to diversity and inclusion, aiming to create a work environment where all employees feel respected and valued, free from discrimination, bullying, or harassment. It addresses diversity involving demographic factors, cultural diversity, and varied educational and professional backgrounds. NNIT does not tolerate discrimination based on age, religious beliefs, ethnicity, race, skin color, national and social origin, sexual orientation, disability, political views, education, professional competencies, and other personal attributes.

Conditions in connection with employment must be in accordance with:

• Act on Equal Treatment of Men and Women
• Act on Equality of Women and Men

Targets: By 2030, NNIT aims for:

• At least 30% representation of both genders in the Board of Directors and Top Management Group
• The underrepresented gender to hold at least 40% of positions at all management levels
• Gender balance across the workforce to reach 40% representation for both men and women

Public availability: The policy is mentioned in board committee charters and available on the company's website.

Link to international standards: Not explicitly stated in the excerpts.

Monitoring: Employees are asked bi-annually (anonymously) to assess their experiences regarding fair treatment, equal opportunities, and the inclusiveness of the work environment through eVoice surveys. The management level participates in trainings and leadership networks with specific focus on avoiding biases in policy development and implementation. A Diversity & Inclusion awareness community was launched in 2024 to educate employees, offering quarterly sessions and a self-learning platform.

Anti-Harassment Policy

Scope: Covers all NNIT employees globally.

Governance: NNIT Human Resources receives and investigates all complaints of harassment and/or discrimination.

Key content/principles: The policy outlines the company's social and collegial values. NNIT does not tolerate violations of the policy. All complaints will be taken seriously, documented, investigated promptly and thoroughly by Human Resources. Confidentiality will be maintained throughout the investigative process to the extent practicable. Managers or company officials who receive complaints must report them promptly to NNIT Human Resources.

Public availability: Not explicitly stated.

Link to international standards: Not explicitly stated.

Monitoring: If investigation confirms conduct contrary to the anti-harassment policy, NNIT will take immediate, appropriate, corrective action, including discipline up to and including immediate termination, while adhering to national laws.

Whistleblower Policy

Scope: Covers all NNIT employees, management, Board of Directors, business partners, advisors, and anyone in the value chain or external persons.

Governance: The Board of Directors is responsible for oversight over material Business Ethics issues and implementation of the policy. Head of Legal reviews notifications and monitors complaints. The Compliance Function provides quarterly reports to the Audit Committee.

Key content/principles: The policy enables secure and confidential reporting of concerns regarding illegal or fraudulent behavior, business ethics misconduct, and security breaches. The whistleblower system is hosted by an external independent third party. The system is designed to secure whistleblowers from retaliation, and their identity will only be disclosed to the person(s) investigating the report. The policy fulfills the EU Whistleblower Directive and national implementation legislation.

Public availability: Available on the company's website (whistleblower mailbox address is published).

Link to international standards: EU Whistleblower Directive, Danish Act No. 1436 of June 24, 2021, on Whistleblowing.

Monitoring: All NNIT employees undergo mandatory annual training in the Whistleblower Policy and must document understanding of it. The Compliance Function provides quarterly reports to the Audit Committee with a list of all reports made, information on preliminary screening results, and status on reports being investigated. In 2024, no reports were submitted in the whistleblower system.

Remuneration Policy

Scope: Covers members of the Board of Directors and Executive Management.

Governance: The Remuneration Committee, established by the Board of Directors, is responsible for assisting the Board with overseeing the policy, including guidelines on incentive pay to Executive Management and preparation of the annual remuneration report. In 2024, the Remuneration Committee conducted two meetings with full member participation.

Key content/principles: The policy provides guidelines on remuneration for Board members, committee members, and Executive Management members.

Public availability: Not explicitly stated.

Link to international standards: Not explicitly stated.

Monitoring: The Remuneration Committee oversees the policy and prepares annual remuneration reports.

Remote Work Guidelines

Scope: Applies to all employees in relevant job functions globally.

Governance: All leaders follow the remote work guidelines and offer clear guidance for their teams.

Key content/principles: Created in 2021, the guidelines allow employees to work from home, reflecting the organization's recognition of employees' need for flexible working conditions. The guidelines ensure employees can accommodate their work life with their privacy and personal needs. All employees are given the opportunity to ask their leader for more flexibility in their working conditions, applicable to all employees, not just parents or caregivers. Employees in relevant job functions can access necessary IT equipment to fulfill their position working from home.

Public availability: Not explicitly stated.

Link to international standards: Not explicitly stated.

Monitoring: NNIT tracks the effectiveness of flexible working arrangements through the eVoice survey. Leaders discuss results within their teams and engage HR and other departments to ensure meaningful follow-up and action.

Responsible Sourcing Standards Policy

Scope: Applies to NNIT's supply chain and suppliers.

Key content/principles: The policy addresses safety of workers, precarious work, human trafficking, forced labor, and child labor in line with ILO standards. All employment within NNIT's supply chain must be voluntary, and workers must be at least 15 years old or meet minimum age requirements set by national laws in the country of operation.

Public availability: Not explicitly stated.

Link to international standards: ILO standards.

Monitoring: Not explicitly stated in the excerpts.

Data Ethics Policy

Scope: Covers data processing on behalf of customers and within NNIT's own organization.

Governance: The Board of Directors approves the Data Ethics Policy, which is updated annually. NNIT reports on the work with Data Ethics and GDPR to the Audit Committee on a regular basis.

Key content/principles: The policy embodies three key principles:

1. Security: Appropriate technical and organizational security measures are implemented to prevent accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to data.
2. Fairness: Handling personal data only in ways that people would reasonably expect and not using it in ways that have unjustified adverse effects.
3. Transparency: Being transparent about data processing activities and being clear, open, and honest about how and why personal data is used. NNIT does not sell any data to third parties or profit from it in any way.

Public availability: Available from the company's website at: nnit.com/about-us/sustainability-esg/policies

Link to international standards: Not explicitly stated.

Monitoring: The Board of Directors approves the policy annually. NNIT reports on the work with Data Ethics and GDPR to the Audit Committee on a regular basis.

Tax Policy

Scope: Applies to NNIT Group.

Key content/principles: The policy outlines the Group's stance on tax and describes the governing principles for tax management.

Public availability: Available from the company's website at: nnit.com/about-us/sustainability-esg/policies

Link to international standards: Not explicitly stated.

Monitoring: Not explicitly stated in the excerpts.

Additional information:

NNIT commits to equal pay for equal positions and competencies, with constant focus on this principle during hiring and promotion processes. The company reviews its entire organization bi-annually, including salaries, with the intention of ensuring fair salaries for all and closing potential gender pay gaps across NNIT.

NNIT offers a comprehensive training and education program, including a wide range of courses, certifications, and leadership training to support professional development through both internal and external training opportunities.

Taking action on material impacts on own workforce

Overview

NNIT's top priority is to continue being an attractive workplace for both current workforce and potential candidates. The company emphasizes fostering an appealing work environment to attract highly skilled candidates, retain talents, manage material risks, and pursue IT solutions to Life Sciences internationally.

Time horizon: All actions described are continuous work with no specific time horizon for completion.

Resources allocated: No specific financial or non-financial resources are quantified. The company states that "no specific resources are allocated for managing material impacts. Instead, the aforementioned functions will be activated to address impacts if they occur."

Key Actions and Initiatives

1. Learning and Development Programs

Actions taken:

• Individual development plans for each employee in collaboration with their nearest leader
• "GROW-sessions" facilitated by local departments focusing on knowledge sharing about specific business areas
• Learning, career planning, job rotation, certifications, advanced education and leadership development programs

Expected outcomes:

• Support skill development and ensure equitable access to career growth opportunities
• Improve career pathways to enable employees to take charge of their career advancement

2. Equal Pay and Fair Compensation

Actions taken:

• Dedicated to ensuring equal pay for equal positions and competencies, with constant focus during hiring and promotion processes
• Bi-annual review of entire organization, including salaries with intention of ensuring fair salaries for all and closing potential gender pay gaps across NNIT

Effectiveness: In 2024, a global gender pay gap of 19% persists across locations (ranging from -25% in Ireland to 28% in Czech Republic)

3. Diversity and Inclusion Initiatives

Actions taken:

• Ensuring policies do not favor any group(s) of employees
• Ensuring diverse representation among candidates for talent and leadership development programs and management succession
• Assessing new leadership candidates based on potential as a leader, not just experiences
• Offering mentor- and sponsorship programs where employees at all levels can seek advice and inspiration
• Launched new Diversity & Inclusion awareness community in 2024 offering quarterly sessions and self-learning platform
• Integration of initiatives into recruitment processes to reduce bias and promote diversity and inclusion

Effectiveness: In 2024, 46% of all vacant positions were filled by female candidates (compared to 39% in 2023)

Key focus area for 2025: Improving career development and opportunities based on eVoice survey feedback

4. Inclusive Recruitment Practices

Actions taken:

• Ensuring all candidates are treated with respect
• Ensuring recruitment process is driven by professional assessment criteria focusing on candidate's competencies, experiences, and potential
• Striving for balanced representation in recruitment committees regarding gender, age, and other characteristics
• Writing job ads in language that appeals to broad and diverse field of candidates
• Ensuring spokespersons, images and material in external communication, job ads and PR reflects diverse workplace
• Stating clearly in job ads that all candidates are encouraged to apply regardless of gender, age, religious beliefs, sexual orientation, national and social origin, political opinion, disability, race, skin color, and ethnic origin
• Spreading awareness of how unconscious bias can be recognized and reduced, and how to avoid prejudices

5. Flexible Working Conditions

Actions taken:

• All employees given opportunity to ask their leader for more flexibility in working conditions (applies to all employees, not just parents or caregivers)
• Employees in relevant job functions can access necessary IT equipment to fulfill their position working from home
• All leaders follow remote work guidelines and offer clear guidance for their team
• Required accurate time recording for all hours worked and leave on NNIT timesheet to ensure accurate time records and timely payment

Monitoring: NNIT monitors employees' experience with work-life balance and flexible working through eVoice survey and feedback each leader receives from employees

6. Continuous Improvement Based on Employee Feedback

Actions taken:

• Bi-annual eVoice survey providing space for employees to suggest improvements while tracking effectiveness and impact of current actions
• All managers expected to discuss survey results within their teams, engaging HR and other departments for meaningful follow-up and action
• Committed to continually reviewing policies to drive performance while better aligning with employees' expectations

Areas for improvement identified in 2024:

• Global bonus model
• Building trust in decision-making processes
• Clear communication of decisions
• Greater clarity on career development and opportunities (key focus area for 2025)

Integration with Risk Management

Material risks related to workforce are integrated into Enterprise Risk Management Process. Head of Global HR provides input to Enterprise Risk Assessment, with CFO responsible for the overall process (last conducted November 2024).

Targets related to own workforce

Gender diversity targets for Board of Directors and Group Management

Target metric: Gender distribution - minimum representation of the underrepresented gender (women)

Target value: At least 30% women among Board of Directors and NNIT Group Management

Target year: End of 2025

Baseline year: 2023

Baseline values (2023):

• Board of Directors: 67/33 (male/female)
• Top management (Group Management): 87.5/12.5 (male/female)
• All management levels: 64/36 (male/female)

Scope: Own operations - applies to members of the Board of Directors as well as Group Management

Type: Absolute percentage target

Validation: Internal target (not externally validated or science-based)

Progress to date (2024):

• Board of Directors: 78/22 (male/female) - decreased from baseline
• Top management (Group Management): 75/25 (male/female) - improved from baseline
• All management levels: 64/36 (male/female) - unchanged from baseline
• Graduate program: 62.5% men and 37.5% women (improved from 66% men and 34% women in 2023)
• Young Professionals: 56% men and 44% women in 2023

Additional context: NNIT acknowledges having "some distance to cover when it comes to achieving our 30% target in 2025" but remains "confident that we will achieve a better gender balance before the end of 2025." The company states it will "adjust our targets accordingly year by year."

Working conditions targets

NNIT conducts annual eVoice surveys to identify areas for improvement in working conditions. Specific targets are set on an as-needed basis following survey results, discussed among relevant managers and SVPs, with subsequent surveys used to track improvements. No specific quantified targets for working conditions are disclosed in the excerpts.

Characteristics of the undertaking's employees

Total headcount and FTE

Average headcount:

• 2024: 1,736 employees
• 2023: 1,974 employees (total), 1,773 (continuing operations)

Average full-time employees:

• 2024: 1,704 FTE
• 2023: 1,974 FTE (total), 1,773 FTE (continuing operations)

Headcount by gender

Contract type by gender (October 2024):

Headcount by country/region

Average headcount in countries with >50 employees or >10% of total:

Headcount by region (segment reporting, October 2024):

Headcount by employment contract type

Contract type by region (October 2024 headcount):

Summary:

• Permanent employees: 1,692
• Fixed-term (temporary) employees: 44
• Non-guaranteed hours employees: 0

Headcount by employment type (full-time/part-time)

Not separately disclosed. Average FTE of 1,704 compared to average headcount of 1,736 suggests predominantly full-time employment.

Employee turnover

2024:

• Total leavers: 333
• Turnover rate: 19.7%

2023:

• Turnover rate: 13.6% (referenced in narrative)
• 2024 narrative notes: "Throughout 2024, we saw a positive development in our overall attrition rate, which reduced from 13.6% in 2023 to 11.0% in 2024" (this appears to refer to voluntary attrition specifically, while the table shows total turnover of 19.7%)

The relatively high turnover in 2024 is noted as primarily due to structural adjustments in China and the US. Without structural adjustments, the number is stated as 11%.

New hires

Not disclosed.

Age distribution

Overall age distribution:

Age distribution by country:

Accounting methodology

Numbers are based on a combination of data from NNIT's BI-system and HR system. Data is calculated as the average number of employees during 2024 rounded to the nearest integer. Gender is based on input from the employee during the hiring process.

Data from Excellis, SL Controls, and Scales (Group companies) have been extrapolated into the total figures, assuming organizational structures align with NNIT in each country. Employee distribution for these companies has been proportionally allocated based on NNIT's country-by-country distribution.

41% of total headcount is covered by extrapolation, while the remaining 59% is based on direct data.

Collective bargaining coverage and social dialogue

Overview

In NNIT, all employees are allowed to join a trade union and other workers' organizations to negotiate their working conditions.

Neither trade unions nor employer organizations negotiate working conditions on behalf of employees. Each employee has individual terms of employment, as they are considered specialists in their respective fields.

There are no workers' representatives in any of NNIT's geographies (0%). However, workers in Denmark are represented in the Board of Directors by the employee-elected board members.

There are no agreements with employees for representation by European Works Council (EWC), Societas Europaea (SE) Works Council, or Societas Cooperativa Europaea (SCE) Works Council.

Collective bargaining coverage

A relatively low number of employees in NNIT are covered by collective bargaining agreements and all covered employees are located in Denmark:

• Total coverage: 0.75%
• Denmark coverage: 1.85%
• Number of covered employees: 14

The 14 covered employees belong to the same organization, which represents workers in trade and office roles (HK – Handel og Kontor).

Table: Percentage of employees covered by collective agreements

Methodology note: The calculation is based on all employees who are registered as being covered by a collective agreement divided by the headcount for 2024.

Diversity metrics

NNIT aims to be a diverse workplace where people with different attributes feel welcome. However, women have traditionally been underrepresented in the IT sector, and NNIT has set ambitious targets on gender distribution across the organization.

Gender distribution

Table 66: Headcount 2024 by gender

Top management gender distribution

The top management in NNIT is defined as the CEO, CFO and SVPs who together form NNIT Group Management.

Table 66a: Gender distribution in top management

Board of Directors gender split (narrative)

In 2023, the gender split in the Board was 67/33 (male/female), while it decreased in 2024 to 78/22 (male/female). In the top management, the gender split was 87.5/12.5 (male/female) in 2023, and in 2024 it was 75/25 (male/female). For all management levels, the gender split was 64/36 (male/female) in 2023 and this was unchanged in 2024.

Age distribution

Most employees are mid-career professionals with extensive experience, reflecting NNIT's commitment to meeting customers' demand for highly specialized consultants.

Table 66b: Overall age distribution

Table 66c: Age distribution by country

Methodology notes

Gender identification is based on input from the employee in the hiring process, which is stored in the HR system. Age data is based on the total population in 2024 and the employee's age at that time, gathered from NNIT's BI-database. All members of top management have been part of management throughout 2024.

Adequate wages

S1-10 Disclosure

NNIT states: "NNIT rely on highly skilled employees in all positions, and no employees are paid below national minimum requirements in countries of operation."

Benchmark used: National minimum wage requirements in countries of operation.

Coverage: 100% of own workforce (implicit - stated as "no employees are paid below national minimum requirements").

Geographic scope: All countries of operation (Asia, Europe, and the United States mentioned elsewhere in the report).

Methodology (from Accounting Principles section):

• "National authorities determine minimum salary benchmarks for each country, and for the countries that do not have one, the minimum wage established by collective agreements."
• "National authorities include agencies, national statistics, Eurostat and similar."
• "In the US, there is no national minimum; it varies by state. Therefore, the highest state minimum was used as the general benchmark."
• "In each country, the lowest paid employee is compared to the country benchmark."
• "Data on the lowest salary is based on monthly extract from HR system, and is based on the basic wage plus any fixed additional payments."
• "Data excludes hourly paid, student assistants and trainees under collective agreement."
• "Salaries in Denmark, Poland and Czech Republic have been converted to Euro due to match EU statistics."

Living wage benchmark: No living wage benchmark is disclosed or applied. The company benchmarks against national minimum wage requirements only.

Targets: No forward-looking targets or commitments disclosed.

Value chain: Not addressed.

Health and safety metrics

Coverage

The entire workforce is covered by a health and safety management system (100% coverage), which is based on legal requirements.

Work-related incidents and fatalities (2024)

No work-related ill health as per ILO's list of Occupational Diseases has been identified in 2024.

Methodology note

A work-related incident is defined as an unplanned event that doesn't result in injury but has enough significant risk to merit recording. The rate was calculated by dividing the number of cases by total hours worked and multiplying by 1,000,000. There is no automatic system for reporting incidents and/or fatalities; each incident is reported directly to the HR department for further handling.

Work-life balance metrics

NNIT acknowledges work-life balance as a material sustainability matter under S1, as identified in the double materiality assessment. The company states that "work-life balance and overall job satisfaction enhance employee performance and increase future employees' willingness to join NNIT" and notes that "employee stress and illness can be greatly affected by working conditions."

Policy and monitoring approach

NNIT reports that employees are entitled to flexible working arrangements, including working from home. Exempt and non-exempt employees are required to accurately record all hours worked and leave on an NNIT timesheet.

The company states: "NNIT is ongoingly monitoring the employees' experience with their own work-life balance."

NNIT uses the annual eVoice survey to identify areas for improvement in working conditions.

Quantitative metrics

No quantitative metrics are disclosed for S1-15 work-life balance metrics, including:

• Percentage of employees entitled to family-related leave
• Percentage of entitled employees who took family-related leave (by gender)
• Return-to-work rates after parental leave (by gender)
• Multi-year comparisons

The excerpts note that NNIT is applying phase-in provisions under ESRS 1:137 for the first year of CSRD reporting in 2024, with phase-in options applied "specifically for E1 (E1-9) S1 (S1-7, S1-13, S1-15)."

Compensation metrics (ESRS S1-16)

Pay gap

NNIT reports an overall 19% unadjusted gender pay gap for 2024.

The gender pay gap is broken down by location:

Remuneration ratio

The annual remuneration ratio in NNIT is 12:1, indicating that the annual total remuneration of the highest paid individual is 12 times higher than the median annual total remuneration for all employees (excluding the highest-paid individual).

Methodology

Gender pay gap: The calculation is based on all employees in NNIT during 2024. Gender identification is based on input from the employee in the hiring process stored in the HR system. The data represents the raw difference per country with no consideration of level or seniority. The calculation is: (Average gross hourly pay level of male employees - average gross hourly pay level of female employees) / average gross hourly pay level of male employees × 100. Gross hourly pay includes base salary, bonus, pension, overtime payment, allowances and insurance.

Remuneration ratio: To make a fair comparison between hourly paid employees, employees receiving overtime pay and employees receiving bonus, the total salary package has been divided by the individual total recorded hours in 2024. Due to quality reasons, employees with a total of less than 250 hours registered have been excluded from the calculation. Furthermore, employees who didn't time register for their entire active period of 2024 were also excluded. A large part of the exclusion is due to the movement from several ERP-systems into one mid-2024. Furthermore, especially internal functions didn't time register correctly the entire year. In 2025 all global data is in one system making the calculation more accurate.

Incidents, complaints and severe human rights impacts

In 2024, no complaints or incidents of discrimination or harassment were reported. Furthermore, no severe human rights issues occurred. Nor were any complaints filed to National Contact Points for OECD Multinational Enterprises. Consequently, no fines, penalties, or compensation for damages were issued.

Incidents and Complaints Metrics (2024)

Methodology

Incidents and human rights issues can be reported through various channels, including the Whistleblower system, HR, the nearest leader, or the National Contact Points for OECD Multinational Enterprises. Regardless of the reporting channel, the HR department will be notified and involved in addressing adverse impacts and identifying appropriate actions to mitigate negative effects. To calculate the number of reported complaints, severe human rights issues, and corresponding fines and penalties, data has been retrieved from HR and Legal.

Policies related to consumers and end-users

NNIT is committed to integrity and moral responsibility in all activities, with values that permeate its policies. The company's DNA emerges from the regulated pharmaceutical industry and significantly reflects its approach to business ethics. When representing NNIT, employees act with professionalism, honesty and integrity. Conduct is always fair and transparent and perceived as fair and transparent by third parties.

Responsible Sourcing Standard

Scope: All of NNIT's business relations

Key content and principles:

• NNIT relies on conceptualizations of responsibility and sustainability provided by:
  • United Nations (UN) Global Compact
  • UN Declaration of Human Rights
  • Sustainable Development Goals
  • ESG principles
• NNIT expects its suppliers to uphold these fundamental principles and obligations to ensure responsible and sustainable conduct toward customers and end-users

Links to international standards:

• UN Global Compact
• UN Declaration of Human Rights
• Sustainable Development Goals (SDGs)

NNIT Values

The company's values are deeply anchored and guide conduct toward customers and end-users:

Open and honest:

• Listen to customers and challenge them
• Communicate quickly and openly about changes affecting customers or the company
• Trust each other and question things that don't make sense
• Believe in clear and understandable agreements that benefit customers and NNIT

Conscience driven:

• Take responsibility for customers' challenges as if they were NNIT's own
• Accessible to customers and act promptly when they need help
• Work with passion to add quality to everything
• Make decisions based on rational financial judgement

Value adding:

• Utilize domain expertise to create business results for customers and NNIT
• Proud of work and continually ask: Does it add value?
• Stand together as One NNIT across cultures and international locations
• Always strive to optimize performances
• Get things done

Compliance Policies

Key content:

• All employees must at all times comply with applicable laws, rules and regulations
• NNIT complies with all antibribery and anti-corruption laws as applicable wherever the company does business

Governance:

• Management of the Legal department is responsible for implementing the policy and updating it

Data Ethics Policy

Approval and oversight:

• NNIT Board of Directors approves the Data Ethics Policy
• Updated annually
• NNIT reports on the work with Data Ethics and GDPR to the Audit Committee on a regular basis
• Executive Management is responsible for implementation within NNIT's daily operations and activities through establishment of relevant processes and routines
• Group Management is responsible for integrating the Data Ethics Policy in daily operations and ensuring relevant and ethical handling of data within business areas and units
• NNIT Data Protection Officer is responsible for overseeing overall compliance with Data Ethics Policy, including the Data Privacy Policy, and issuing guidance and counselling on related matters

Key content and principles:

• Take legal and ethics aspects into account when developing new solutions that process data through a formalized process
• Ensure diversity when creating user-groups for solution development of systems to process data
• Take measures to ensure use of data is unbiased and without discrimination
• Consider the impact of individuals' reasonable expectations
• When working with AI, consider data protection and data ethical matters at an early stage to mitigate risks and eliminate or limit possible damage to individuals
• Strive to make sure that any use or development of AI solutions are fair, reliable, and explainable

Monitoring:

• Policies are evaluated once a year to ensure accuracy and relevance of information provided to potential and existing consumers or end-users

Public availability:

• Available at www.nnit.com

Data Privacy Policy

Scope: All entities and employees of the NNIT group

Key content and principles:

• Sets out standards and principles when NNIT collects, uses, stores and processes Personal Data
• Based on European Union General Data Protection Regulation 5419/16 (GDPR) and in accordance with data protection laws in the United States
• Minimum standard applicable to all entities and employees of the NNIT group with the purpose of protecting consumers' and end users' privacy
• Personal Data must be processed in accordance with these standards and principles as well as in accordance with instructions and requirements set out by NNIT's customers to ensure the safety of the data and the integrity of individual data subjects
• Data subjects will always be informed about the purpose/reasoning for using their data
• Data subjects have, upon request, the right to access, delimit, modify and delete their data

Data subject rights:

• Right of Access (confirmation that Personal Data is processed, access in form of a copy of the data)
• Right of Rectification (right to change data)
• Right to be Forgotten (right to have data deleted)
• Right to Restriction of Processing (right to have certain processing activities suspended)
• Right to Data Portability (right to have data delivered in machine-readable format)
• Right to Objection (right to have certain processing activities limited)
• Right to Limit Automated Decision-making
• Right to withdraw consent (if processing is based on consent as the legal basis)

Governance:

• NNIT Data Protection Officer is responsible for overseeing overall compliance with data privacy, including the Data Privacy Policy, and issuing guidance and counselling on matters of data privacy

Links to international standards:

• European Union General Data Protection Regulation (GDPR)
• UN Global Compact (referenced in broader context)
• UNGPs on Business and Human Rights (referenced in index)
• OECD guidelines (referenced in index)

Supplier requirements:

• NNIT requires its suppliers to comply with international and local law regarding the processing and handling of personal data that pertains to NNIT or NNIT's deliveries and/or services

ISO 9001 Quality Management System

Key content:

• Ensures that engagement with customers and end-users is structured and of high quality
• Provides a variety of options for customers to raise concerns
• Each raised concern is taken seriously and appropriate actions are taken
• Includes regular reviews allowing ongoing refinement of the quality of the management system

Taking action on material impacts on consumers

Customer Feedback Program

What it does:
Monitors and improves customer satisfaction and experiences through systematic feedback collection.

Components:

• Customer Satisfaction Survey (annual) – Targets senior management (major contract holders), provides 360-degree evaluation of NNIT covering the full customer journey. Includes individual debriefings with participating companies.
• EvalGO (quarterly) – Targets project, middle, and senior management responsible for NNIT's projects and SLAs, assessing specific deliveries. Runs every three months with debriefings provided to relevant customer contacts after each cycle.

Outputs:
Feedback on quality, collaboration, time efficiency and corrective actions. Results are documented and made available for project delivery teams and NNIT Management for corrective actions and learning.

Turning feedback into actions:
Surveys trigger automated actions based on customer responses in the lower end of the scale (ratings 1-5). Actions are taken to avoid further negative impacts and are identified on an ongoing basis. NNIT actively encourages customers to complete surveys with reminders if input is not received within a specified timeframe.

Expected outcomes:
High satisfaction levels achieved – average score of 4.5 out of 5 across quarterly EvalGO surveys in 2024.

Information Security and Data Protection (ISO/IEC 27001)

What it does:
Protects valuable information, including information on customers and end-users, through the ISO/IEC 27001 international standard on information security.

Resources allocated (non-financial):

• Full-time Data Protection Officer (DPO)
• Full-time FTE and student assisting the DPO in the Data Protection Office (2024)
• Legal department support when needed
• Full-time Chief Information Security Officer (CISO) (2024)

Training:
All NNIT employees required to complete annual online data privacy training, achieving minimum score of 70% to pass. Employees continuously trained in NNIT Methodology, which embodies data protection security through guidelines, tools, and templates.

Data breach response:
Each data breach case assessed individually to determine how to stop it quickly and identify mitigating actions. Necessary internal and external legal and technical resources allocated based on the breach's specifics.

Quality Management (ISO 9001)

What it does:
Prevents material negative impacts on consumers and end-users through implementation of ISO 9001 standard.

Expected outcomes:
Meets customer expectations and demonstrates commitment to quality. Includes Performance Evaluation Procedure that monitors, measures, analyzes, and evaluates performance and effectiveness of quality management systems. Enables customers to submit complaints, which are addressed promptly.

External Audits

What it does:
DNV (independent expert in assurance and risk management) oversees and audits processes on an ongoing basis, assessing whether goals and visions align with practices. Customers occasionally conduct quality assurance visits to ensure compliance with high standards.

Collaborative Solution Design

What it does:
All consultancy and solutions designed in close collaboration with customers to address their needs. NNIT provides advice to identify potential blind spots and optimize solutions while customers communicate requirements. Ensures practices have positive impact on customers and end-users. NNIT guides customers on who should test solutions to prevent negative impact on potential end-users.

Market Outlook Analysis

Time horizon:
At least once annually.

What it does:
Examination of trends that may impact Life Sciences and other relevant industries, identifying new needs. Provides indication of how NNIT can support customers better in the future.

2024 Performance

Remediation actions:
No specific actions were taken to remediate negative impacts or incidents related to customers in 2024, since no cases of non-compliance with the UN Guiding Principles on Business and Human Rights, the ILO Declaration on Fundamental Principles were identified.

Targets related to consumers

Customer Satisfaction Target

Target metric: Total average score in quarterly satisfaction survey

Target value: 4.5 out of 5

Target year: 2025 (and ongoing)

Baseline year: 2023

Baseline value: 4.4

Scope: Own operations (customer satisfaction survey)

Type: Fixed target (absolute score)

Validation: Internal target, set as part of annual business target setting process aligned with ISO 9001 and ISO/IEC 27001 standards

Progress to date (2024): Achieved an average score of 4.5, successfully meeting the target

Data Privacy and Data Breach Handling

Target metric: Handle any data breach within deadlines in relevant legislation and contracts with customers

Target value: Compliance with legal and contractual deadlines

Target year: Ongoing (fixed goal)

Baseline: Fixed goal with no changes since 2023

Scope: Own operations and data processing activities

Type: Compliance target

Validation: Internal, aligned with ISO/IEC 27001 standard and data ethics principles

Business conduct policies and corporate culture

NNIT has established several policies governing business conduct and corporate culture. These policies are foundational to the company's ethical standards and sustainability governance.

Business Ethics Code of Conduct

Scope:

• Covers the entire group and is applicable to all employees including subsidiaries
• Addresses ethical conduct in the work environment, business practices, and dealings with stakeholders, customers, citizens and others
• Extends to all persons doing business with and/or advising NNIT such as suppliers, customers, business partners, lawyers or auditors

Governance and oversight:

• Overseen by the Senior Vice President, Legal & Contract Management, who has overall responsibility for administration and investigation of business conduct incidents
• Board of Directors is responsible for developing and approving the policy
• Group CFO is responsible for compliance with the policy
• Board of Directors serves as the ultimate oversight body for material business ethics issues
• Audit Committee receives quarterly reports from the Compliance Function on all reports made, preliminary screening results, and investigation status

Key content:

• Defines expected ethical behavior in the workplace, business practices, and stakeholder interactions
• Includes process for investigating incidents promptly, independently and objectively
• Covers reporting mechanisms for unlawful behavior through whistleblowing and dedicated mailbox
• Employees can report concerns to managers, HR/Legal, senior management, or through the biannual eVoice survey

Training and monitoring:

• All NNIT employees undergo mandatory regular training as part of onboarding
• All employees are annually obligated to read, understand and approve the policy on the internal training system (Qpoint)
• Training automatically covers 100% of functions-at-risk and management at all levels
• Target of 100% completion for the training, with reminders sent and escalation to line managers for non-completion
• Implementation monitored through eVoice surveys for all employees including management twice yearly, which include questions about evaluating corporate culture and raising concerns
• Results evaluated by group management with necessary steps taken to address issues
• Individual managers discuss results with their own teams

Public availability:

• Policy is available online and accessible to potentially affected stakeholders
• Mailbox address for reporting concerns is published on the company website

Links to international standards:

• NNIT endorses the principles of the UN Guiding Principles on Business and Human Rights (UNGPs) and the OECD Guidelines for Multinational Enterprises
• Adheres to principle 10 in the UN Global Compact (anti-corruption)
• Implementation via Code of Conduct and other internal policies and procedures

Whistleblower Policy

Scope:

• Covers employees, management, Board of Directors, business partners, advisors, and anyone in the value chain or external persons
• Enables reporting of illegal or fraudulent behavior, business ethics misconduct, and security breaches
• Subject to overarching legislation for whistleblowing directive and equal legal requirements

Governance and oversight:

• Whistleblower system is hosted by an external independent third party
• Head of Legal reviews all notifications and reports
• Compliance Function designates appropriate investigators and informs the Chairman of the Audit Committee when investigation is initiated
• Audit Committee receives quarterly reports on all reports made, preliminary screening results, and investigation status
• Board of Directors has ultimate responsibility for oversight

Key content:

• Designed to secure whistleblower protection from retaliation
• Whistleblower's identity only disclosed to person(s) investigating the report
• System does not log IP addresses or Machine IDs and does not use cookies
• Investigation responsibilities assigned by area: Financial fraud (Finance/CFO), severe Business Ethics misconduct (Legal/CEO or CFO), severe Security breaches (Q&S/SVP), severe Data Protection breaches (Legal or Q&S)
• Can report incidents including internal breaches of EU legislation listed in the Whistleblower Directive, severe breaches of other EU law or national law, including financial fraud, bribery and forgery

Training:

• All NNIT employees undergo regular training in the Whistleblower Program
• All employees annually obligated to read and understand the Whistleblower Policy and document it
• Board is also required to take this training
• Target of 100% completion for the training

Public availability:

• Policy safeguards are included in the publicly available whistleblowing policy

Links to international standards:

• Complies with Danish Act No. 1436 of June 24, 2021, on Whistleblowing
• Fulfills the EU Whistleblower Directive and national implementation legislation

Anti-Corruption and Anti-Bribery Policy

Scope:

• Covers all employees which means 100% of employees working in high-risk functions are covered
• Functions at risk identified as: Sales enabling functions across regions; Procurement in China and Philippines
• Extends to suppliers as stated in the Responsible Sourcing Standards Policy

Governance and oversight:

• Board along with Group CFO is responsible for prevention and detection of corruption and bribery
• Head of Legal is involved in investigation of reported incidents
• Legal Department oversees and updates the training to ensure alignment with national and international legislation
• NNIT Group Management is overall responsible to ensure business is conducted per the Business Code of Ethics policy
• Investigators or investigating committee are separate from chain of management involved in prevention and detection

Key content:

• NNIT rejects all forms of bribery, facilitation payments, corruption, extortion, or embezzlement
• Complies with UN convention against corruption and all regulations on corruption and prohibited business practices applicable in all countries where NNIT operates
• Training focuses on policy in general terms and how corruption and bribery is understood in NNIT
• Addresses bribery, facilitation payments, gifts, hospitality, entertainment, and conflicts of interest
• Includes guidance about reporting cases of concern

Training:

• Mandatory anti-corruption and anti-bribery training for all employees once a year
• Part of onboarding process for new employees
• Board is also required to take this training

Monitoring:

• NNIT monitors incidents of corruption and bribery on an ongoing basis through the whistleblower channel and other reporting channels
• In 2024, no reports were submitted in the whistleblower system, thus no fines for violating anti-corruption and anti-bribery laws were given
• No confirmed incidents reported related to corruption or bribery
• No public legal cases related to corruption or bribery
• Ultimate goal is to have zero cases of corruption or bribery

Links to international standards:

• Adheres to UN Global Compact principle 10
• Complies with UN Convention against Corruption
• References UN Guiding Principles on Business and Human Rights (paragraph 10(b))

Tax Policy

Scope:

• Outlines the Group's stance on tax and describes governing principles for tax management

Public availability:

• Available from the company's website at: nnit.com/about-us/sustainability-esg/policies

Key content:

• NNIT adheres to established tax risk management process to ensure compliance with tax laws

Data Ethics Policy

Scope:

• Applicable to processing of large amounts of data on behalf of customers and within own organization
• Board of Directors approves the policy, which is updated annually

Governance and oversight:

• NNIT Data Protection Officer is responsible for overseeing overall compliance with Data Ethics Policy, including the Data Privacy Policy
• Executive Management is responsible for implementation within daily operations and activities
• Group Management is responsible for integrating the policy in daily operations and ensuring relevant and ethical handling of data within business areas and units
• NNIT reports on work with Data Ethics and GDPR to the Audit Committee on a regular basis

Key content:

• Embodies three key principles: Security, Fairness and Transparency
• Security: Appropriate technical and organizational security measures to prevent accidental or unlawful destruction, loss, alteration or unauthorized access
• Fairness: Doing what is right and only handling personal data in ways people would reasonably expect; considers whether use of personal information is justified and compatible with expectations
• Transparency: Being transparent about data processing activities and being clear, open and honest about how and why personal data is used
• Type of data processed is part of data ethical considerations
• Privacy-by-design and privacy-by-default considered from the beginning in software development
• NNIT does not sell any data to third parties or profit from it
• When working with AI, data protection and data ethical matters are considered at an early stage to mitigate risks and eliminate or limit possible damage to individuals
• Use or development of AI solutions must be fair, reliable, and explainable

Public availability:

• Available from the company's website at: nnit.com/about-us/sustainability-esg/policies

Data Privacy Policy

Scope:

• Sets out standards and principles when NNIT collects, uses, stores and processes Personal Data
• Minimum standard applicable to all entities and employees of the NNIT group
• Extends to suppliers: NNIT requires suppliers to comply with international and local law regarding processing and handling of personal data

Governance and oversight:

• NNIT Data Protection Officer is responsible for overseeing overall compliance with data privacy, including the Data Privacy Policy, and issuing guidance and counselling on matters of data privacy

Key content:

• Based on European Union General Data Protection Regulation 5419/16 (GDPR) and in accordance with data protection laws in the United States
• Purpose is protecting consumers' and end users' privacy
• Personal Data must be processed in accordance with standards and principles as well as instructions and requirements set out by customers
• Data subjects have rights including: Right of Access, Right of Rectification, Right to be Forgotten, Right to Restriction of Processing, Right to Data Portability, Right to Objection, Right to Limit Automated Decision-making, Right to withdraw consent
• Access to data must be limited to personnel resources that need access to perform their services
• For specific types of data, specific restrictions may apply preventing or limiting access to locations outside EU/EAA or even to specific countries
• Databreaches and potential databreaches are raised, tracked electronically and addressed by internal legal and technical resources

Links to international standards:

• Based on EU GDPR and US data protection laws

Sustainability and ESG Policy

Scope:

• Covers management and employees globally
• Approved by the Board of Directors

Governance and oversight:

• ESG and sustainability priorities are embedded in the Board of Directors' decision-making processes
• Board receives annual updates on sustainability progress and comprehensive report on year's achievements
• Board is responsible for utilizing the result of double materiality assessment to guide the process of setting targets
• Targets are tracked using appropriate indicators
• Sustainability Committee headed by Senior VP, Commercial excellence & sustainability and includes Group CFO
• Committee comprises sustainability ambassadors from each region and stakeholders from facility management, HR, Finance, Legal
• Committee meets quarterly to discuss ESG strategy, impacts, risks and opportunities, targets and action plans
• Group CFO reports to Audit Committee for matters related to sustainability
• Audit Committee oversees Enterprise Risk Management (ERM) process and handling of overall sustainability related activities on behalf of the board
• Audit Committee is responsible for oversight of impacts, risks and opportunities for sustainability reporting as per CSRD

Key content:

• Material sustainability matters identified as E1 (Climate change), S1 (Own workforce), S4 (Consumers and end-users), and G1 (Business conduct)
• Focus areas include: Climate change mitigation and adaptation, Energy consumption, use and circular economy, Own workforce, Workers in the value chain, Diversity, Corporate culture and business conduct

Links to international standards:

• Adheres to UN Global Compact principle 10

Responsible Sourcing Standards Policy

Scope:

• Applies to suppliers

Key content:

• Requires suppliers to comply with applicable laws, regulations, and internal procedures
• Includes requirement for suppliers to comply with international and local law regarding processing and handling of personal data

Other policies mentioned

The company also references having an anti-harassment policy that outlines social and collegial values, though detailed content is not disclosed in the excerpts provided.

Incidents of corruption or bribery

Confirmed incidents and convictions

NNIT monitors incidents of corruption and bribery on an ongoing basis through the whistleblower channel and reported incidents through other channels.

There have been no confirmed incidents reported related to corruption or bribery in 2024. There have been no public legal cases related to corruption or bribery.

Fines and penalties

NNIT has not paid any fine for violation of anti-corruption and anti-bribery laws in the year 2024.

Disciplinary actions and contract terminations

No information disclosed regarding employees dismissed or disciplined, or contracts with business partners terminated due to corruption or bribery.

Investigation procedures and speak-up mechanisms

NNIT has established a whistleblower function enabling employees, management, Board of Directors, business partners, advisors, and external persons to report concerns of illegal or fraudulent behavior, business ethics misconduct and security breaches in a secure and confidential way. The whistleblower system is hosted by an external independent third party. All data reported through the whistleblower system is encrypted and stored safely.

The system is designed to secure the Whistleblower from any retaliation and the Whistleblower's identity will only be disclosed to the person(s) investigating the report. In 2024, no reports were submitted in the whistleblower system, thus no fines for violating the anti-corruption and anti-bribery laws were given.

The Compliance Function provides the Audit Committee quarterly with a list of all reports made, information on the result of the preliminary screening and status on reports being investigated.

All NNIT employees undergo mandatory annual training in the Business Ethics Code of Conduct policy, which covers anti-corruption and anti-bribery principles. The training covers 100% of employees working in high-risk functions.

Target

The ultimate goal is to have zero cases of corruption or bribery.