QT Group

The role of the administrative, management and supervisory bodies

Reference: pages 22-23 (content index, page 66).

The Board of Directors prepares Qt Group Plc's short- and long-term strategies; the CEO and the other Management Team members run the business under the Board's instructions and the Finnish Limited Liability Companies Act.

Two gaps are disclosed plainly. "Qt has not separately defined the special competence or expertise of the administrative, management, and supervisory bodies regarding the supervision of different sustainability matters" (external ESG experts were used for the DMA, the climate scenario analysis and reporting). And "responsibilities or processes related to the monitoring and oversight of the progress of impacts, risks and opportunities have not otherwise been separately specified in the company's terms of reference or Board mandates".

There is no employee representation in the administrative or supervisory bodies. All (100%) Board members are independent of Qt; the Chair, Robert Ingman, "is independent of Qt Group, but not independent of its major shareholders". Two committees operated in 2025: Compensation and Nomination, and Audit, which oversees sustainability reporting and therefore supervises sustainability IROs. The Audit Committee and the Board approve the statement.

Gender split at 31 December 2025 (page 23): Board 2 female (40%) and 3 male (60%) of 5; Management Team 2 female (25%) and 6 male (75%) of 8.

Information provided to and sustainability matters addressed by the administrative, management and supervisory bodies

Reference: page 23 (content index, page 66).

An unusually candid negative disclosure. Qt "will review the development of targets, metrics, and measures related to impacts, risks and opportunities as well as the sustainability management model during 2026. This work is still in progress, and the monitoring processes have therefore not yet been defined or their systematic monitoring not yet put on the agenda of the Management Team or the Board of Directors."

It adds: "The administrative, management, and supervisory bodies have not separately considered identified sustainability matters as part of strategic decisions."

What did happen in 2025:

• The Audit Committee discussed sustainability reporting twice, and also had own workforce (S1), business conduct (G1) and data protection on its agenda.
• Identified sustainability risks, "i.e. data protection risks", were integrated into Qt's risk management.
• Due diligence remains unsystematic and "its implementation has not been included in the agenda of the administrative, management, and supervisory bodies", though risk-based supply chain management for technical consultants is being developed during 2026.

No frequency, information package or escalation route beyond the two Audit Committee discussions is described.

Integration of sustainability-related performance in incentive schemes

Reference: page 24 (content index, page 66).

The entire disclosure is one sentence: "Qt does not have incentive or remuneration schemes related to sustainability matters."

There is no sustainability-linked element in short- or long-term incentives, no share of variable pay tied to a climate or social target, and no Board- or Management Team-level sustainability metric anywhere in the statement. Under ESRS 2 GOV-3 a nil return is a complete answer, and Qt gives it flatly rather than describing an intention. The position is unchanged from its FY2024 statement, which carried the same single-line disclosure.

Statement on due diligence

Reference: page 24 (content index, page 66).

Qt states that it "has not yet systematically created or implemented a due diligence process and has not included a due diligence process in its governance model". The process "is applied partially", and the statement maps the core elements to the sections that describe them:

• Engaging with affected stakeholders: ESRS 2 GOV-2, SBM-2, IRO-1, S1-2 and S2-2.
• Identifying and assessing negative impacts on people and the environment: ESRS 2 IRO-1, SBM-3.
• Taking action to address negative impacts: ESRS 2 MDR-A, S1-4, S2-3 and G1-3.
• Tracking the effectiveness of these efforts: ESRS 2 MDR-M, MDR-T, S1-5, S2-5 and the S1, S2 and G1 topic-specific metrics.

GOV-4 is one of the datapoints derived from other EU legislation and appears in the datapoint list starting on page 57, cross-referenced to SFDR Indicator number 10 of Table #3 of Annex 1.

Risk management and internal controls over sustainability reporting

Reference: page 24 (content index, page 66).

The reporting process begun in 2024 continued through 2025. Qt manages the risk to completeness and integrity of sustainability data "by involving employees from the company's various functions, clearly documenting the source of data and date of collection, and validating the data collected internally before external verification".

Sustainability reporting sits outside the formal internal control system for now, and Qt says so: "So far, the company has considered the risk management and internal control of sustainability reporting to be at a sufficiently good level, but the company will assess the need to implement sustainability reporting as part of the internal control system in 2026."

The Audit Committee "discusses the risk management and oversight of sustainability reporting together with the content of the report annually". No risk register, no risk scoring and no results of control testing are disclosed.

Strategy, business model and value chain

Reference: page 25 (content index, page 66).

Qt Group is a global software company whose main products are the Qt development environment and quality assurance and testing solutions, covering a customer's entire product development process. Customers "operate in more than 70 industries", building devices and applications in automotive, medical devices, industrial automation and consumer electronics.

Operations are set out in five parts: research and development, product management, sales and marketing, delivery (management and automation), and after-sales services. These are supported by People and Culture, corporate infrastructure (legal, accounting and finance), technological infrastructure (external servers, databases and data) and procurement.

Value chain. Upstream, Qt buys IT, product development and sales and marketing tools plus employee equipment such as computers and phones. Downstream, products and services are delivered as software, tools and services tailored to customer needs.

Export control is addressed directly: Qt's mass-market products "do not contain any functionality that would make them subject to strict export control regulations"; restrictions relate primarily to sanctions regimes.

IAR was acquired on 17 October 2025 (Uppsala, Sweden; embedded software development tools for safety critical products), described as very similar in nature to Qt's business.

Interests and views of stakeholders

Reference: pages 26-27 (content index, page 66).

A nine-row table gives, for each stakeholder group, the engagement methods, the purpose of engagement, the impact on strategy and stakeholder relations, planned measures, and whether the administrative, management and supervisory bodies are informed. The groups are customers, employees, the Board of Directors, analysts, business and technology partners, the open source community, shareholders, holders of educational institution licenses, and external consultants.

Examples of the disclosed detail:

• Employees: personnel survey, orientation and leadership training, development discussions, team meetings, business reviews, communication tools and remuneration; bodies informed.
• Open source community: the Qt Forum and community, for "thorough testing of releases"; bodies not informed.
• External consultants: e-mail, monthly and quarterly contact calls, office visits and annual procurement expert visits to partners' offices; bodies informed.

The link to the assessment is a single line: "Qt has engaged all of the above-mentioned stakeholders as part of the double materiality analysis." No instance is given where stakeholder feedback changed a materiality conclusion.

Material impacts, risks and opportunities and their interaction with strategy and business model

Reference: page 28 (content index cites pages 28 and 30, page 66).

Material IROs sit in four places: own workforce (S1), external consultants (S2), business conduct (G1) and data protection (entity-specific). "The most significant impacts, risks, and opportunities are related to Qt's own workforce and business conduct in its own operations", and "the failure of data protection is a significant business risk that could have significant effects on the company's business".

The strategy link is incomplete by Qt's own account: "A more detailed assessment of the relationship between impacts, risks and opportunities and the strategy has not been carried out, and they have not yet been taken into account in strategy processes."

Financial effects and resilience. "Qt's material risks or opportunities have not had a significant effect on its financial position, result, or cash flows... Qt has not conducted a separate resilience analysis on the company's capacity to address its material impacts and risks or to take advantage of its material opportunities."

The 2024 DMA "was still valid during the reporting year"; after the IAR acquisition it will be updated in Q1 2026. Climate-specific risk identification and scenario analysis is also presented under E1-2 (2025 ESRS numbering), and the resilience position under E1-3.

Description of the processes to identify and assess material impacts, risks and opportunities

Reference: pages 29-33 (content index, page 66).

Process. The DMA began in late 2023 and was completed in Q2 2024, with a project team from People and Culture, legal, finance, procurement and communications reporting to the Management Team and the Audit Committee. Preliminary impacts were assessed "on the basis of all ESRS sub-topics and sub-sub-topics"; value chain risks and opportunities were assessed second. A stakeholder survey covered E1, S1, S2, G1 and data protection, with "a larger weight assigned to the views of the Management Team".

Scoring. Scale, scope and remediability were each scored 1-5 (maximum severity 15) and likelihood 1-5, "with an actual impact already taking place assigned a value of 15". Materiality was "determined by calculating the total value of the variables and dividing it by the maximum value. The threshold value was defined as 2.0."

Topic-specific IRO-1 sections cover climate (page 31), pollution (page 32), water (page 32), biodiversity (pages 32-33) and resource use (page 33). Each names candidates that failed the 2.0 threshold, and each records that members of affected communities "were not separately consulted for the assessment".

Disclosure requirements in ESRS covered by the undertaking's sustainability statement

Reference: page 33; ESRS content index pages 66-67; EU-legislation datapoint list pages 57-65.

Qt prints a real content index. Pages 66-67 carry a Code / Caption / Page table listing exactly what is covered: BP-1, BP-2, GOV-1 to GOV-5, SBM-1, SBM-2, SBM-3, IRO-1, IRO-2 and MDR-P/A/M/T; S1-1 to S1-6, S1-9, S1-10, S1-14, S1-16, S1-17; S2-1 to S2-5; and G1-1 to G1-4. Under "Environmental information" the index carries one line only: "Taxonomy information". No E1, E2, E3, E4 or E5 disclosure requirement is listed.

The IRO-2 narrative is given over to the climate conclusion: "Climate change (E1) was not identified as a material theme for Qt." The reasons are that management and stakeholders ranked climate change and energy consumption "as the least important among the topics assessed"; that Qt uses only data centre providers "such as Equinix, which have ambitious sustainability targets" and the low-carbon cloud service of Amazon Web Services; and that "although charging Qt's products consumes electricity, it has only a minor impact on the energy consumption of the end-use of the products".

The EU-legislation datapoint list (pages 57-65) adds a "Material to Qt" column, marking every E1 to E5 datapoint and the S3-1, S3-4, S4-1 and S4-4 datapoints "Not material".

Identification of climate-related risks and scenario analysis

Back-filled from ESRS 2 IRO-1, "Description of the processes to identify and assess material climate-related impacts, risks and opportunities" (page 31), and SBM-3 (page 28). This disclosure requirement did not exist under the 2023 ESRS the report was prepared against, and climate change is not a material topic for Qt.

Risks identified and classified. Both categories are named. Physical: "flood, extreme heat, storms, landslides" at production facilities in the value chain, and "logistics problems in supply chains caused by shortages of raw materials due to climate change". Transition: "rising energy prices and stricter climate regulations, which may increase costs related to calculating and reducing the carbon footprint". None passed the 2.0 threshold.

Scenario analysis. For the DMA there was none: "The analysis did not take climate scenarios into account or assess the sensitivity of the business to risks in more detail."

Separately, "Qt Group carried out a climate scenario and resilience analysis in the fourth quarter of 2025. The analysis was based on the TCFD framework and looked at transition risks and physical risks in high and low warming scenarios (IPCC)" (pages 28 and 31). The results are not in this report: "Qt will describe the analysis and its results in more detail in the 2026 Sustainability Statement."

No named scenario, temperature projection or key assumption is available for FY2025.

Resilience in relation to climate change

Back-filled from ESRS 2 SBM-3 (page 28) and the climate IRO-1 section (page 31). This disclosure requirement did not exist under the 2023 ESRS the report was prepared against, and climate change is not a material topic for Qt.

The finding is a plain negative, stated without hedging: "Qt has not conducted a separate resilience analysis on the company's capacity to address its material impacts and risks or to take advantage of its material opportunities" (page 28). The same paragraph records that Qt's material risks and opportunities "have not had a significant effect on its financial position, result, or cash flows" and have not "been identified as involving significant risks concerning the adjustment of assets".

A climate resilience analysis does exist but sits outside this year's disclosure: "Qt Group carried out a climate scenario and resilience analysis in the fourth quarter of 2025... Qt will describe the analysis and its results in more detail in the 2026 Sustainability Statement" (page 31).

Nothing is therefore disclosed against the substance of the requirement for FY2025: no implications for strategy or business model, no areas of uncertainty, and no description of the capacity to adjust or adapt over short, medium and long term.

Policies related to own workforce

Reference: pages 39-41 (content index, page 66).

The Code of Conduct is the single policy instrument, and Qt lists what it regulates: "work-life balance, social dialogue (job satisfaction), health and safety, gender equality and equal pay, measures against violence and harassment, and the diversity of the personnel". It commits Qt to equal opportunities "regardless of ethnic origin, religion, age, nationality, regardless of gender identity, disability, sexual orientation, political opinions, or other personal characteristics", with no tolerance of violence, harassment, discrimination, abuse, intimidation or workplace bullying. Qt states: "Qt has not separately defined vulnerable groups. Instead, the principles apply to everyone."

Supporting instruments, each with a named owner:

• Career framework covering all employees, specifying competencies and pay per position "to promote equal pay for equal work regardless of the employee's background and gender". Management Team owned.
• Hybrid work guidelines published in 2025 (remote two days a week; 4-5 office days recommended in a new employee's first three months), owned by People and Culture.
• Employee Privacy Note; Qt's General Counsel is responsible for implementation.

Secure employment is pursued through contracts "valid until further notice (93% in 2025)". Occupational safety management systems are "based on local laws and regulations in each country".

Processes for engaging with own workforce and workers' representatives about impacts

Reference: page 41 (content index, page 66).

Engagement runs through an annual survey and a quarterly pulse. The "extensive personnel survey (employee Net Promoter Score eNPS & engagement survey)" asks how employees perceive "communication and giving feedback, well-being at work, the meaningfulness of work, workload, learning and self-development opportunities, leadership, and work ergonomics". Results go to the Group Management Team and each function's management team, "where they are reviewed and action plans are drawn up at both the company level and the team level", then to employees at a company-wide briefing. A pulse survey runs three times a year.

Formal representation is disclosed by country: "Qt has statutory employee representatives in Finland, Norway, France, Germany, and Japan. Discussions with the employee representatives are carried out in accordance with local legislation."

Two 2025 changes are described. Internal communications were reformed in spring and early summer 2025 with employees "extensively involved", and "the latest measurements show a slight increase in satisfaction with communications". Training was added for middle management "to strengthen managers' communication skills, such as listening leadership, constructive feedback".

Operational responsibility sits with the SVP of People and Culture, a Management Team member.

Processes to remediate negative impacts and channels for own workforce to raise concerns

Reference: page 42 (content index, page 66).

Qt starts from an admission: it "has recognized that negative impacts on employee health, such as mental health and work ergonomics, are likely". Prevention runs through training supervisors to identify the impacts, regular personal discussions between employees and managers, and "assigning a dedicated People & Culture representative for each business unit, who can be contacted with a low threshold". In every operating country employees have "either occupational health services or insurance, as well as separate mental health services and/or an early support model".

Channels are plural: shop stewards, unit People and Culture representatives, the occupational health provider, and an anonymous whistleblowing channel managed by a third party. Reports "are immediately communicated to the General Counsel, the CFO and the SVP of People & Culture, and the processing of all whistleblower reports starts within seven days".

Awareness is built through manager briefings, the intranet, occupational health care, shop stewards and the Qurious platform. Qt discloses the limit: "The employees' awareness of the existence of the various structures and channels is not assessed separately." No effectiveness measure of the channels is given.

Taking action on material impacts on own workforce

Reference: pages 43-44 (content index, page 66).

Actions are organised by material sub-topic, with 2025 activity for each:

• Secure employment: manager training increased "for both basic and advanced manager levels", with systematisation continuing in 2026.
• Work-life balance: hybrid work guidelines published and implemented in 2025; flexible hours; "shortened working hours can also be negotiated at the employee's initiative in special situations".
• Health and safety: training on the early support model and mental health tools for managers in EMEA; the mental health discussion aid "has received good feedback, and its use was increased during 2025".
• Gender equality and equal pay: the career framework, plus preparation "for the implementation of the EU's Wage Transparency Directive in 2025 by, for example, clarifying the definitions of different wage categories".
• Employee diversity: recruitment revised and harmonised in 2025, a new system, inclusive advertisement templates, role-specific assessment forms, expanded channels and bias training; deepening in 2026.
• Employee data protection: a Data Governance project launched in 2025 covering access rights management and documents containing personal data.

No monetary resources are attached to any of these actions.

Targets related to own workforce

Reference: pages 44-45 (content index, page 66).

The headline is a nil return with a reason: "Qt has not set measurable result-oriented targets related to the management of material impacts, risks, and opportunities related to its own workforce. Qt's plan was to set targets in the second half of 2025, but due to the IAR acquisition that began in July 2025, the company decided to postpone the setting of targets. The aim is to set targets in accordance with the minimum disclosure requirements by the end of 2026."

In place of targets, page 45 carries a monitoring table with columns for the topic, the monitoring method, the target level and the base period. Examples:

• Adequate wages: wage survey against market data; target level "All employees (100%) are already paid adequate wages"; annually.
• Social dialogue: annual and pulse surveys; "General satisfaction index as a guiding reference"; quarterly.
• Work-life balance and working hours: hybrid work instructions and contractual weekly hours; target level "Local legislation regarding working hours".

Three rows carry no target level: secure employment, measures against violence and harassment, and diversity. Gender equality and equal pay for equal work is the weakest row, with a dash in every column: no monitoring, no target level, no base period.

Characteristics of the undertaking's employees

Reference: page 46 (content index, page 66).

Headcount at 31 December 2025 by contract type and gender: 1,136 in total (286 female, 849 male, 1 other), of which 1,061 permanent, 75 temporary and 7 non-guaranteed hours employees, defined as having "no minimum or fixed number of working hours in the contract". The 2024 comparatives are 834, 765, 65 and 6.

Average headcount for the period by region: EMEA 659 (2024: 564), APAC 175 (2024: 120), North America 124 (2024: 151), total 958 (2024: 834). The regional and contract-type totals differ because the regional figures are period averages while the contract-type table is the year-end position, which includes IAR from 17 October 2025.

Countries with at least 10% of employees, same basis: Finland 288, Germany 217, United States 124.

Turnover: 116 employees left in 2025 (2024: 92), a rate of 12.1% (2024: 11%).

Qt notes elsewhere (page 39) that individual freelancers and temporary agency workers "are not included in the reporting of information on the company's own workforce".

Diversity metrics

Reference: page 46 for age distribution and page 23 for the top management split (content index, page 66).

Age distribution of employees at 31 December 2025: under 30 years old 158 (14%), 30 to 50 years old 756 (67%) and over 50 years old 222 (20%), total 1,136. The 2024 comparatives are 131 (15%), 603 (69%) and 135 (16%), total 869. The over-50 band is the one that moved, up 87 people and four percentage points, which is consistent with the IAR acquisition landing in the year-end population.

Gender distribution at top management level is given in the GOV-1 section (page 23) rather than here. At the end of 2025 the Board of Directors was 2 female (40%) and 3 male (60%) of five members, against 2 female (33%) and 4 male (67%) of six in 2024, with the gender distribution ratio rising from 0.5 to 0.67. The Management Team was 2 female (25%) and 6 male (75%) of eight, against 3 female (30%) and 7 male (70%) of ten in 2024, so the female share of the Management Team fell year on year during a period of turnover in which three members left and one joined.

Gender distribution across the whole workforce is given in the S1-6 table (page 46) rather than as an S1-9 percentage.

Adequate wages

Reference: page 47 (content index, page 66).

A short but complete disclosure with the benchmark method named: "Adequate wages are paid to all (100%) employees."

The comparison basis is set out: "The wages of employees in all of Qt's operating countries have been compared to either the country's minimum wage level or the minimum wage specified in the applicable collective agreement if a national minimum wage has not been established. If the minimum wage varies within the country, the highest minimum wage level is used as the reference value."

Taking the highest applicable minimum where a country has several is the conservative choice, and Qt states it rather than leaving the reader to assume it. Adequate wages is also one of the material sub-topics in the DMA table (page 30, positive impact, short term, materiality value 2.8), and the S1-5 monitoring table (page 45) records an annual wage survey against market data as the monitoring method, with "All employees (100%) are already paid adequate wages" as the target level.

No country-by-country wage ratios and no data on non-employee workers are given.

Health and safety metrics

Reference: page 47 (content index, page 66).

The accident rate almost halved, from 6.3 to 3.4 per million hours worked, on five recordable accidents against nine. Days lost moved the other way, from zero to three.

Two scope limits are disclosed. The management system coverage figure is qualified: systems are "based on legal requirements and/or recognized standards. IAR is not included in the reported figures for occupational health and safety management systems." And the whole table covers employees only: "Aside from employees, Qt's own workforce only includes a small number of freelancers or temporary agency workers. The relevant information on these individuals is not available."

No lost time injury frequency rate as such, and no breakdown by region or site, is given.

Compensation metrics (pay gap and total compensation)

Reference: page 48 (content index, page 66, where it is captioned "Remuneration metrics (pay gap and total compensation)").

The gender pay gap widened by one point, from 17.2 to 18.2, in a year in which gender equality and equal pay is a material sub-topic (page 30, materiality value 3.3) and the S1-5 monitoring table carries a dash in every column for it: no monitoring method, no target level, no base period (page 45). Qt offers no commentary on the movement.

Both formulas are given. The pay gap is the "average gross annual salary of men minus average gross annual salary of women, divided by the average gross annual salary of men x 100", including part-time employees, temporary employees and trainees, with the hourly wages of temporary employees converted to annual salaries. The remuneration ratio is the "ratio of the highest paid individual to the median annual total remuneration for all employees. This includes the basic salary, bonuses, and some fringe benefits."

Scope limit: "IAR is not included in the reported figures."

Note that the ESRS S1-16 formula is expressed as a percentage; Qt presents the gap as a bare number without a percent sign.

Incidents, complaints and severe human rights impacts

Reference: page 48 (content index, page 66).

One incident of discrimination or harassment was reported in each year, with no financial consequence in either.

The source is stated, and the scope note matters for comparability: the figures cover "Qt Group's anonymous whistleblowing channel reports for the entire year and IAR's anonymous whistleblowing channel reports from October 17 to December 31, 2025", so IAR contributes only from the acquisition date.

No breakdown of the incident, no description of the remedy applied and no severity classification is given.

Policies related to value chain workers

Reference: pages 49-50 (content index, page 66).

Qt defines the population narrowly. Workers in the value chain "refer to external consultants acting as employees of consulting companies who work remotely, and occasionally at Qt's offices or at the end customer's office, but who do not belong to the company's own workforce". There were "cooperation agreements with approximately 10 service providers in 2025".

The Code of Conduct is the policy instrument. It "guides the impacts on workers in the value chain, meaning external consultants, as regards health and safety and sustainable working conditions". Service providers must commit to it, and "for contracts lasting longer than one month, consultants are required to complete training on the Code of Conduct". A framework agreement "requires that the service provider commits to respecting human rights and taking care of the health and safety of its employees". Signing is the responsibility of "the director in charge of professional services and a procurement specialist".

Qt closes with the international instruments datapoint: "Qt has not received any reports of incidents of non-compliance with the UN Guiding Principles on Business and Human Rights, the ILO Declaration on Fundamental Principles and Rights at Work or the OECD Guidelines for Multinational Enterprises."

Processes for engaging with value chain workers about impacts

Reference: page 50 (content index, page 66).

Engagement is indirect and contractual rather than direct with the workers. "The terms of the work performed (including pricing, start dates, and terms of payment) are negotiated between Qt and the employers of the external consultants."

There is nonetheless a defined meeting rhythm at two levels. "Qt's project manager has monitoring meetings with external consultants on a weekly basis, while the procurement specialist has similar meetings on a monthly and quarterly basis with the consultants' representative. In the meetings, the participants review feedback from the consultants regarding the personnel and projects." Qt's procurement specialist "acts as the primary contact person for the suppliers", and the meetings "also aim to find ways to resolve any problems".

The boundary of Qt's responsibility is stated flatly: "The occupational health of the consultants is the responsibility of their employer."

No consultation with worker representatives or trade unions on the consultants' side is described, no survey of consultants is run, and no measure of the effectiveness of the engagement is given. This is an improvement on FY2024, where S2-2 was not disclosed at all.

Processes to remediate negative impacts and channels for value chain workers to raise concerns

Reference: page 50 (content index, page 66).

Access to the grievance channel is delivered through training. "Contracts continuing for more than one month require consultants to complete Qt's Code of Conduct training. If the contract lasts longer than one year, the training must be repeated." As part of that course, "consultants also receive information on the whistleblowing channel, which they can also use to anonymously report misconduct or shortcomings". It is the same third-party channel used for own workforce, with reports processed within seven days (G1-1, pages 52-53).

An internal escalation path is described. "Topics, including views highlighted by consultants, are discussed in weekly meetings and in management meetings held at two-week and one-month intervals in the Professional Services unit." Project managers report to area directors, who report to the head of Professional Services. For service partner contracts, "the effectiveness of the cooperation and satisfaction are assessed in monthly and quarterly monitoring meetings".

No remedy has been applied because none has been sought: S2-5 records that the number of consultant reports was 0 in 2025 (0 in 2024). Qt does not assess whether consultants are aware of or trust the channel. This is an improvement on FY2024, where S2-3 was not disclosed.

Taking action on material impacts on value chain workers

Reference: page 51 (content index, page 66).

A deliberate nil return, with the reasoning given in full rather than left blank.

"Qt has not identified any material business risks related to workers in the value chain. No serious human rights violations have been reported in relation to Qt's value chain."

On actions: "Aside from supplier agreements and terms of contract concerning working hours, for example, Qt has not implemented, and is not planning to implement, any particular measures relating to the health of external consultants. No separate resources have been allocated to managing negative impacts (mental health) related to consultants, because the impacts have been assessed to be potential rather than actual, and they are neither severe nor extensive in scale."

The contractual mechanisms that do exist are in SBM-3 and S2-1 (pages 49-50): a maximum of eight working hours per day under time and material contracts, the right to days off and national holidays planned in advance, and hybrid or remote working agreed before signature.

Readers should note that the material negative impact Qt identified for this group is consultant mental health, and the response is contractual working-time limits rather than any health measure.

Targets related to managing material negative impacts, advancing positive impacts, and managing material risks and opportunities

Reference: page 51 (content index, page 66).

Another explicit nil return with a stated reason: "Qt has not set any targets related to the health of external consultants, nor is the company planning to set such targets for the time being. Setting result-oriented targets is challenging, as Qt does not have visibility due to reasons related to the protection of the privacy of consultants in occupational health."

That reason is worth reading carefully. The barrier Qt names is data privacy in the consultants' own occupational health, which sits with their employer, not with Qt. It is a coherent explanation of why an outcome target on consultant health is hard for a client company to set, and it is more specific than the usual statement that targets are under development.

In place of targets, Qt reports the mechanisms and one metric: "Qt requires the service provider to commit to respecting human rights and looking after the health and safety of its employees. Consultants can raise concerns through the whistleblowing channel. In 2025, the number of reports was 0 (0 in 2024)."

So the only quantified S2 indicator on the page is a two-year run of zero whistleblowing reports from roughly ten service providers' consultants, which is reported without any assessment of whether zero reflects the absence of problems or the absence of reporting.

Business conduct policies and corporate culture

Reference: pages 52-53 (content index, page 66).

The Code of Conduct was updated at the end of 2025, and "Qt's previously separate human rights policy was integrated into Qt's Code of Conduct". It commits Qt to business "in accordance with internationally recognized human rights standards, including the UN Guiding Principles on Business and Human Rights (UNGP)", and covers laws and regulations, fair competition, anti-corruption and anti-bribery, human rights, a safe and equal working environment, information security and environmental responsibility. It applies to all employees, suppliers and partners in all regions.

Whistleblowing. The third-party channel is public and anonymous; reports are "taken into processing within 7 days" with a response within 30 days, and are accessible only to the Group's CFOs, General Counsel and SVP of People and Culture. A separate Anti-Bribery and Corruption Policy carries "zero tolerance", and in 2025 Qt "updated its anti-corruption policy to be aligned with the UN Convention against Corruption (UNCAC)". Retaliation is addressed: "The whistleblower will not be retaliated against even if the concerns prove unfounded."

Corporate culture project. Launched in summer 2024, it brought "more than 300 employees and members of the Management Team" into workshops during 2025 and produced a Culture Handbook published in October 2025.

Management of relationships with suppliers

Reference: page 54, under the heading "Supplier relations (G1-2)" (content index, page 67).

The section is short and contains one clear gap statement: "Qt has not yet established requirements for suppliers relating to sustainability topics."

What is in place:

• Payment terms. "At Qt, the primary term of payment for all purchase invoices is 30 days (net). Invoices are paid on the due date without delay, provided that they have been approved by the appropriate employees, are justified, and have been sent to the company in accordance with the relevant instructions."
• Training. "External consultants operating in customer projects are required to complete ISO27001 training, which includes a module on Qt's Code of Conduct."

Related supplier content sits in S2-1 (pages 49-50): the framework agreement requires the service provider to respect human rights and look after its employees' health and safety, and Qt's procurement specialist meets the providers monthly and quarterly. GOV-2 adds that "Qt is developing systematic risk-based supply chain management for technical consultants during 2026" (page 23).

Two things to note. Qt discloses G1-2 for the first time in FY2025; it was not disclosed in FY2024. And it places its payment-terms disclosure here rather than under G1-6, which it does not disclose at all.

Prevention and detection of corruption and bribery

Reference: page 54 (content index, page 67).

The mechanism is training plus the whistleblowing channel, and nothing else. "To prevent allegations or incidents of corruption and bribery, all Qt employees and external consultants working in customer projects complete a section on the prevention of corruption and bribery as part of the training on the Code of Conduct. The whistleblowing practice is applied in the detection and processing of incidents of corruption and bribery."

Coverage is spelled out: the themes "are mandatory training in the Code of Conduct for part-time employees", the Code "is incorporated into supplier agreements concerning customer projects", and "all members of the Management Team and Board of Directors are required to complete the Code of Conduct training".

Board reporting is narrow: "The incidents are reported to the Board of Directors as part of financial statements information. The reporting to the Board of Directors concerns the number of incidents leading to an investigation by the public authorities."

The gap is stated by Qt itself, twice: "Qt has not separately determined functions-at-risk with regard to corruption and bribery". ESRS G1-3 asks for that identification, and Qt's own DMA scores corruption prevention at 3.8, the highest value in the G1 block (page 30).

Targets related to business conduct

Back-filled from the "Targets and metrics" subsection of the G1 business conduct chapter (page 53). G1-3 became a standalone targets disclosure requirement only under the 2025/2026 ESRS; in a statement prepared under the 2023 ESRS this content sits under MDR-T, which the content index lists at pages 44, 51, 53 and 56 (page 66).

Qt sets one quantified business conduct target: "Qt's goal is that from 2026 onwards, 100 percent of employees and external consultants working on customer projects will have completed the training during the reporting year."

Performance is given: "In 2025, 92 percent of employees completed the training." The basis changed year on year, and the footnote says so: the 92% counts "employees who joined the training system by December 16, 2025, and are still employed on December 31, 2025, in proportion to employees employed at the end of the year", excluding employees without an obligation to work, whereas "in 2024, all employees who had completed the training during their employment were included".

Coverage of the external consultant leg is not yet in place: "Qt intends to develop the process and monitoring of external consultant training during 2026 and will report the completion rate of ISO 27001 training for external consultants from 2026 onwards."

So the target is measurable but evidenced for employees only, on a basis not comparable with FY2024, and no target attaches to the corporate culture sub-topic.

Incidents of corruption or bribery

Reference: page 54 (content index, page 67, captioned "Confirmed incidents of corruption or bribery").

A nil return, with the company's own assessment of why: "Qt has not been subject to any convictions or fines for violation of anti-corruption and anti-bribery laws, and has therefore not had to implement any remedies. The existing preventive processes, such as agreements and training, have been sufficient."

The two G1-4 datapoints that derive from other EU legislation are carried in the datapoint list at page 65, both marked material to Qt with page references: "Fines for violation of anti-corruption and anti-bribery laws, paragraph 24 (a)" at page 54, and "Standards of anti-corruption and anti-bribery, paragraph 24 (b)" at pages 52-54.

Qt reports no number of confirmed incidents as such, and no count of convictions, only the statement that there were none and no fines. The nearest quantified incident data in the statement sits under S1-17 (page 48), which records one reported incident of discrimination and harassment in each of 2024 and 2025 with zero fines, penalties or compensation, drawn from the whistleblowing channel.

There is no disclosure of the number of whistleblowing reports received in total for 2025, of how many concerned corruption or bribery, or of how many led to an investigation by public authorities, which is the measure G1-3 says is reported to the Board.