Sopra Steria

The role of the administrative, management and supervisory bodies

Reference: pages 131-135; 210.

Sopra Steria sets out a four-tier sustainability governance structure (page 131): the Board of Directors and its three standing committees; the Chief Executive Officer and Executive Committee; the CSRD & Sustainability Performance Strategy Committee; and the Sustainability & Corporate Social Responsibility (SCSR) Department, "headed by a member of the Executive Committee, [which] reports directly to the Chief Executive Officer" (page 133).

Board committees (page 132). The Audit Committee is responsible for "monitoring the process of preparing the sustainability information", supervising internal control over it, and periodically examining the double materiality matrix; it also "has the same responsibilities in relation to the sustainability auditors as it has in relation to the statutory auditors". The Nomination, Governance & Corporate Responsibility Committee issues an opinion on the identification and prioritisation of IROs and reviews Executive Management's proposals on multi-year social and environmental priorities. The Compensation Committee reviews the CSR objectives attached to the CEO's variable and long-term incentive plans.

Composition (page 134). Board of Directors: 18 members, 1 executive and 17 non-executive, 3 representing employees and employee shareholders, 50% women, 73% independent (11 of 15 under the AFEP-MEDEF Code). Executive Committee: 16 members, 19% women.

Expertise (pages 134-135). CSR training was given in 2024 to the two most affected committees and a CSR module offered to all directors. Chief Sustainability Officers are appointed in every country and subsidiary; "implementation of this system was finalised in 2025" (page 133).

Business conduct governance is separately anchored in the Internal Control Department, supported by a network of 16 Internal Control & Compliance Officers (G1 GOV-1, page 210).

Information provided to and sustainability matters addressed by the undertaking's administrative, management and supervisory bodies

Reference: page 135.

The Board and its committees "rely on the work of the SCSR Department and its partner departments". Two categories of information flow are described. Framework guidelines subject to Board approval: "The Group's double materiality matrix presenting the analysis of sustainability matters, which is subject to their approval each time it is updated; The Group's Sustainability Report, which is subject to their approval; Documents detailing substantial updates to the sustainability policy."

Committee-level reporting: sustainability matters, policies and key achievements plus a benchmarking summary of the DMA and the Sustainability Report go to the Nomination, Governance & Corporate Responsibility Committee; the internal control system and the process for preparing sustainability information go to the Audit Committee.

Frequency in 2025 (page 135 table). The Executive Committee received "10 presentations specifically on sustainability topics", covering training and priority focus on skills (notably AI), international mobility, gender equality, metrics for monitoring sustainability performance and sovereign technology partnerships. The CSRD & Sustainability Performance Strategy Committee met on 4 occasions, addressing benchmarking of the Sustainability Report and the DMA, review of actual or perceived performance on priority matters, and improving the 2025 report.

The disclosure gives counts and topics but does not state how impacts, risks and opportunities were addressed in specific decisions or trade-offs.

Integration of sustainability-related performance in incentive schemes

Reference: page 136.

Two ESG criteria were integrated into the Group's performance index in 2025, "together account[ing] for 10% of the total value of the index", approved by the Chief Executive Officer. Since 2021 the CEO's variable compensation has included social and environmental objectives, updated in 2025 to align with the performance index and approved by the Board.

Proportion of annual variable compensation tied to sustainability (page 136):

• Chairman of the Board: not applicable
• Members of the Board: not applicable
• Chief Executive Officer: 10%
• Managers: between 1.5% and 4%, varying by business line and management grade

The two 2025 criteria, with threshold, target and outcome:

• Proportion of women in the Group's senior management positions (Level 5+): threshold 21.4%, target 22.4%, result 22.4%
• Reduction in travel-related emissions (business travel and commuting) relative to 2024: threshold -2.0%, target -2.5%, result -5%

For 2026 the Group again plans two ESG criteria: the proportion of women in management positions at Level 3 and above, and the reduction in total GHG emissions. The transport criterion is stated elsewhere to represent 5% of the CEO's and managers' variable compensation (page 156).

Statement on due diligence

Reference: pages 216-217.

Section 4.2.2 carries the due diligence statement with a mapping table of the four due diligence components to the disclosure requirements and sections covering them (page 216): embedding due diligence in governance, strategy and business model (GOV-2, GOV-3, SBM-3); engaging with affected stakeholders (GOV-2, SBM-2, IRO-1, MDR-P, S1-2, S4-2); identifying and assessing negative impacts (IRO-1, E1 IRO-1); and tracking the effectiveness of these efforts (SBM-3, MDR-M, MDR-T).

Page 217 completes the statement. On stakeholder engagement: dialogue runs with employees through social dialogue, with local communities "notably through public institutions and non-profit organisations", and with end-users "indirectly, through its clients". The Group states plainly that "Outside the whistleblowing channels accessible to all stakeholders, Sopra Steria does not have a mechanism for direct dialogue with end-users or local communities."

On remediation: "The process for raising and remediating concerns is included in Sopra Steria's whistleblowing procedure, which is accessible to all stakeholders."

The statement is supported by the French duty-of-vigilance plan (pages 215-216), which is built on risk mapping, mitigation and prevention plans, a reporting system and an effectiveness monitoring system, and whose conclusions "showed no significant change in 2025".

Risk management and internal controls over sustainability reporting

Reference: page 137.

Internal control over sustainability reporting follows "the 2010 French Financial Markets Authority (AMF) reference framework on risk management and internal control systems", with five components: control environment, control activities, risk management, information and communication, and permanent monitoring. The Group also reviewed the COSO framework for internal control over sustainability reporting (ICSR) published in March 2023; "an action plan for its implementation was presented to the Audit Committee in April 2024. Progress against this plan is regularly monitored."

The reporting protocol was updated for CSRD requirements and is accompanied by "metric factsheets" for each priority, containing metric definitions, calculation methodologies and procedures, the method for gathering and producing information, a "risk analysis matrix for risks liable to affect the quality of information (reliance on estimates, complexity of calculation, manual data collection, reliance on third parties, degree of harmonisation within the Group)", a responsibility assignment matrix, and a description of first- and second-level controls.

A dedicated collection platform has incorporated environmental data on suppliers, business travel and energy since 2024, with the Internal Control Department ensuring "appropriate controls and end-to-end audit trails were introduced right from the design phase". The Internal Audit Department has added sustainability reporting to its audit cycle, and the Audit Committee reviews the Sustainability Report to verify the reliability of gathering and checking procedures.

Strategy, business model and value chain

Reference: pages 123-124.

Sopra Steria's mission is stated as "Together, building a positive future by putting digital to work for people", with the Group positioning itself "on the market as a trusted independent operator" against global tech giants (page 123).

Scale (page 124). 51,275 employees, 164 sites, 26 countries. The value chain diagram sets out three stages:

• Upstream: "a relatively limited volume of physical goods, mainly IT hardware and sourced services", covering extraction and use of raw materials (primarily for IT equipment and buildings), performance of sourced services (primarily intellectual services), and manufacturing of purchased goods (primarily PCs and servers), split into a Tier N indirect interaction zone and a Tier 1 direct interaction zone.
• Own operations: skills and career development for 51,275 employees, implementation of client projects, development of local and sector-specific solutions and expertise, and employee travel and office operations.
• Downstream: clients' digital transformation and use of services, end-users' use of clients' finished products, and reuse, recycling, recovery and treatment of waste, "primarily WEEE and upstream waste".

The Group states it "does not generate any revenue directly from fossil fuels, chemicals production, controversial weapons or tobacco-growing and production" (page 124). Revenue by geography, business and vertical is cross-referenced to Chapter 1 rather than repeated in the sustainability statement.

Interests and views of stakeholders

Reference: pages 125-126.

A single table (page 125) maps five stakeholder groups across the value chain: suppliers and subcontractors (upstream); Sopra Steria employees, financial partners and local communities (own operations); clients and end-users (downstream). For each it gives the stakeholders covered, the types of dialogue, whether the group was consulted for the double materiality assessment, principal expectations, examples of information presented to Executive Management or the Executive Committee, and examples of responses.

All five groups are marked as consulted for the DMA, with two qualifications: local communities "Yes - through in-house Solidarity Officers" and clients and end-users "Yes - through business clients". Dialogue channels named include the Annual Customer Voice survey with "Interviews with over 650 clients", the Great Place To Work employee survey, EcoVadis assessments of suppliers, and the Annual General Meeting.

Concrete responses in 2025 (page 126): signature of a new collective bargaining agreement on gender equality in France (UES scope, 84% of the scope excluding acquisitions) and a new jobs and career management agreement; launch of a support channel dedicated to sustainable procurement; an international call for projects to support local non-profit initiatives; and launch of a Client Advisory Board.

Works Council consultation on the 2024 report was conducted in April 2025 under Articles L. 2312-17 and L. 2312-25 of the French Labour Code, and will be repeated in April 2026. An Independent Expert Group of three external members met once in 2025 (page 126).

Material impacts, risks and opportunities and their interaction with strategy and business model

Reference: pages 127-130.

The double materiality matrix (page 127) plots 13 material matters across four groupings: Environment (ESRS E1, E5), Sopra Steria employees (ESRS S1), Society (ESRS S3 and S4), Business conduct (ESRS G1) and matters specific to Sopra Steria. The named matters are: employee protection and trust; priority placed on training and skills; equal opportunities and diversity; reducing and mitigating the carbon footprint; resource and waste management; cybersecurity and digital sovereignty; developing responsible digital technology; social dialogue; solidarity and volunteering; climate change adaptation; regional presence; contribution to essential public services; and business conduct and compliance.

Two statements bear directly on financial effects (page 128). The matrix "is based on 'gross' impacts", so it "does not account for prevention and mitigation actions taken by the Company". And: "To date, the method applied to assess the Company's material sustainability matters has not brought to light any current financial effects. As appropriate to changes in EU legislation and efforts by the financial centre in the field of sustainability accounting, a more in-depth assessment of financial materiality may be undertaken in the future."

Geographic differentiation is limited but stated: "certain sites in the south of France, in Spain and in India require special attention with regard to climate change adaptation", and defence and security clients are "particularly sensitive to cybersecurity and digital sovereignty issues" (page 128).

Integration into strategy is described in two steps, monitoring the link between strategic action areas and material matters (table, pages 128-129) and prioritising projects, with 2025 being "a first assessment and prioritisation exercise". Climate-specific risk identification and scenario analysis is also presented under E1-2 (2025 ESRS numbering), and climate resilience under E1-3.

Description of the processes to identify and assess material impacts, risks and opportunities

Reference: pages 138-140.

The DMA process is set out in four steps (page 138): integration of the regulatory framework (ESRS 1 AR 16 topics plus sector-specific topics); identification and assessment of IROs across the value chain, scored 1 to 4 for both impact and financial materiality; determination of material IROs against a threshold; and grouping of IROs into material sustainability matters.

Criteria (page 139). Impact materiality uses scale, scope, remediability and likelihood; financial materiality uses "financial effect by level of impact on operating profit (loss or gain); operational disruptions or improvements; reputational impact; likelihood of occurrence". Each is scored on a four-point scale and averaged. The Group states that "financial materiality assessment is mainly qualitative in nature. The Company aims to reinforce the quantitative analysis of the financial impacts of the risks and opportunities associated with each sustainability matter over a two-year period."

Threshold (page 140). "IROs with scores strictly greater than 2.5 (on a scale of 1 to 4) are considered material. The same threshold is used for both impact materiality and financial materiality." Time horizons are less than one year, one to five years, and more than five years.

Consultation (page 140). Nearly 30 internal stakeholders were surveyed across three workshops with support from a specialist consulting firm, and six interviews were held with external stakeholders (clients, suppliers and investors).

2025 review (page 140). The assessment is reviewed annually with an in-depth update every three years. With no major changes to operations, the Group ran a market analysis and signed off the 2025 matrix, adding "Employment and inclusion for people with disabilities" to "Equal opportunities and diversity". Descriptions were simplified and combined, which "reduced the total number of IROs from 44 to 37 without changing the scores or materiality of each IRO".

Disclosure requirements in ESRS covered by the undertaking's sustainability statement

Reference: pages 141-142; index at pages 235-236.

Section 1.3.2 describes the method for identifying mandatory disclosures, applied "in accordance with the expectations in the CSRD (ESRS 1, Section 3.2)" using "the list of requirements supplied by EFRAG (IG 3: 'List of ESRS Datapoints')". Step 1 excluded topical standards with no material matter: "This exercise excluded the following ESRSs: ESRS E2, ESRS E3, ESRS E4 and ESRS S2." Step 2 defines policy, action, target and metric disclosures as mandatory "whenever they are relevant to an understanding of at least one matter that is material for Sopra Steria".

Coverage table (page 142). Each ESRS sub-topic is marked Covered, Not covered, "Covered by another topic" or "Covered beyond materiality". E1 climate mitigation and adaptation are covered and energy is covered by another topic; E2, E3 and S2 are not covered; E4 is "covered beyond materiality"; within E5, resource inflows and waste are covered while "Resource outflows related to 'Products and services'" are not; within S1, health and safety at work is "covered beyond materiality" while job security, adequate wages, freedom of association and other work-related rights are not covered; within S3 only communities' economic, social and cultural rights are covered; within G1, corporate culture and corruption and bribery are covered while whistle-blower protection, animal welfare, political dialogue and lobbying, and "management of relationships with suppliers, including payment practices" are not.

The content index itself is Section 7.1, "Mapping of CSRD disclosure requirements covered" (pages 235-236), listing each covered requirement against a chapter and section number. Only one change was made in 2025: "certain disclosures on the topic 'Employment and inclusion for people with disabilities' were identified as material" (page 141).

Note an internal inconsistency worth checking: G1-2 appears in the Section 7.1 index (mapped to 4.1.3) although the page 142 coverage table marks supplier relationship management as not covered.

Transition plan for climate change mitigation

Reference: pages 149-151.

The climate transition plan is "aligned with the aforementioned objectives laid down by the United Nations (SDGs), the Paris Agreement (compatibility with the target of limiting global warming to 1.5C) and the European Union. Its goal - validated by SBTi - is to achieve net-zero emissions by 2040."

Validated targets by scope (page 149), 2019 baseline:

• Scopes 1+2: -54% by 2030, -90% by 2040
• Scope 3: -37.5% by 2030, -90% by 2040

From 2040 the Group "plans to offset the remaining 10% of residual GHG emissions arising from its entire value chain", but states that "the current priority is to reduce emissions. Consequently, the Group has not yet put in place a structured approach guiding its contribution to carbon neutrality."

Decarbonisation levers and action plans (page 150) are set out by scope: for Scopes 1+2, reduce energy consumption, prioritise renewable sources and prevent fugitive emissions; for Scope 3-1 and 3-8, streamline purchasing and ensure purchased services are carbon-efficient; for Scopes 3-6 and 3-7, optimise travel and replace the most emissions-intensive modes; across multiple scopes, raise awareness and act beyond the value chain.

Locked-in emissions (page 150). Three sources are identified: "data centres, clients' IT infrastructure and property/travel". The assessment is qualitative; no figure is given. The Group notes that "the transition context may be constrained by unforeseeable new regulations, costs arising from purchases of assets in this category or unpredictable market developments."

Financial resources (page 151). 2025 OpEx of EUR 4.74m and CapEx of EUR 25.12m, against EUR 5.66m and EUR 49.06m in 2024, broken down across six action plans. The fall is explained by three new buildings in France not being recognised until 2026, a smaller volume of vehicle acquisitions, and the replacement of 2024 estimates with actual ISO 14001 data.

The plan is "fully embedded in the sustainability governance framework", was submitted in its entirety to the Board of Directors, and "Sopra Steria is not excluded from the benchmarks aligned with the European Union's Paris Agreement".

Identification of climate-related risks and scenario analysis

Back-filled from ESRS 2 IRO-1 and the E1 SBM-3 / IRO-1 section, where this content is disclosed in the FY2025 report (pages 146-148). This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

Reference: pages 146-148.

Risk classification (page 146). Six climate IROs are tabulated with time horizon and value chain stage, and the risks are explicitly typed: (A) Political and Regulatory Risk, (B) Market Risk, (C) Reputational Risk, and (D) Physical risk, "Inability to manage major disruption linked to the effects of climate change on the value chain, in particular in the event of a natural disaster". Two negative impacts (upstream GHG emissions from digital infrastructure "with an impact enhanced by the increased use of AI"; and deteriorating employee working conditions or health) and one opportunity complete the table.

Methodology (page 147). "Sopra Steria identifies and categorises climate-related risks in accordance with the guidelines of the TCFD, distinguishing physical risks and transition risks. The Company's resilience analysis covers its entire value chain (operations, Tier 1 suppliers and clients) and assesses transition risks (Political, Regulatory, Market, Technological and Reputational risk) and physical risks (both acute and chronic). ... This analysis is reviewed annually."

Scenarios used (page 147). Three: "Net-Zero Emissions by 2050 scenario, a sustainable development scenario and the IPCC's pessimistic scenario (RCP 8.5 or SSP5-8.5)", identified elsewhere in the table as the IEA NZE 2050 and the IEA Sustainable Development Scenario. A high-emission scenario and a 1.5C-aligned scenario are therefore both present. No global average temperature projection is stated for any scenario, which is a gap against the requirement.

Time horizons are short (under one year), medium (one to five years) and long (over five years), "in line with the Net-Zero 2040 target approved by SBTi". Scenario effects are described qualitatively per risk sub-category rather than quantified. Key assumptions are given as narrative (carbon regulation intensity by region, demand for low-carbon services, harmonisation of regulatory frameworks, fossil fuel taxes). The date the analysis was first carried out is not stated, only that it is reviewed annually.

Resilience in relation to climate change

Back-filled from ESRS 2 SBM-3 and the E1 resilience statements, where this content is disclosed in the FY2025 report (pages 147-148, 161). This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

Reference: pages 147-148; 161.

Results of the analysis (page 147). Under a "Results of the resilience analysis" table, each material risk is described under the scenarios. Market: under RCP 8.5 "demand for low-carbon services and solutions falls in countries and regions where carbon is weakly regulated", while under IEA NZE 2050 and the SDS demand grows "in the majority of countries where the Group operates - representing an opportunity". Policy and regulation: harmonised frameworks under NZE and SDS "expand markets and facilitate compliance", while "increases in fossil fuel taxes, new regulatory constraints and increased non-financial reporting requirements push up costs"; under RCP 8.5 "inconsistent requirements across geographical areas make compliance more complex". Reputation: the Group's positioning "gives Sopra Steria a commercial edge" under NZE and SDS. Acute physical: "Under all scenarios: more frequent and severe extreme weather events can affect the accessibility and use of the Group's offices and data centres", with heat waves and floods affecting employees and suppliers under SSP5-8.5.

Uncertainties (page 148) are disclosed explicitly and split between physical risks (climate projections give "only a range of possible future climate conditions"; data gaps and inaccuracies) and transition risks (unknown future regulation, fluctuating economic conditions, uncertain stakeholder reactions).

Capacity to adapt. The adaptation programme (page 161) is the operative response: 2025 gross risk analysis on 100% of sites and data centres using the OCARA method, with a consolidated adaptation plan to be articulated in 2026; targets of in-depth net-risk assessment by 2027 and site-specific adaptation plans plus updated business continuity plans by 2030 for all sites confirmed as high-risk. Actions include prioritising modern, resilient buildings, auditing sites for robust services such as efficient air conditioning, and maintaining "a comprehensive insurance programme covering property damage and operating loss should the risks linked to climate change materialise".

Strategy resilience is addressed only by cross-reference to Sections 1.1.1 and 1.1.3.2 (page 148); no quantified financial resilience analysis is given.

Policies related to climate change mitigation and adaptation

Reference: page 148.

Section 2.1.2.1 sets out the climate policy under [E1-2 including MDR-P]. "Sopra Steria's climate policy provides a framework covering both climate change mitigation and adaptation. This policy is designed to manage material impacts, risks and opportunities identified in the double materiality assessment."

Scope. "The policy's scope extends to all of Sopra Steria's operations and covers all countries, relevant stakeholders and the entire value chain, from offices and data centres to suppliers, partners and clients."

Accountability. "Climate policy is signed off at the Company's highest level of governance, with responsibility for implementation falling to the Sustainability & Corporate Social Responsibility (SCSR) Department, supported by Chief Sustainability Officers present in the Group's countries and subsidiaries."

Third-party standards referenced: SBTi, SDG 13, SDG 7 and SDG 9, ISO 14001, and the Verified Carbon Standard for contributions to carbon neutrality.

Three objectives: supporting the transition to a low-carbon economy with a net-zero 2040 target; adapting effectively to climate change; and developing low-carbon solutions to support clients and society. These translate into two programmes, the transition plan and the adaptation plan, structured around five principles of action: decarbonising the entire value chain; continuously assessing exposure to climate risk and bolstering adaptability; incorporating environmental concerns into the value proposition; raising awareness and training employees; and "strengthening the Group's impact beyond its value chain by financing projects that positively contribute to combating and adapting to climate change".

Stakeholder interests taken into account are listed as employee protection and safety, contribution to clients' sustainability objectives, suppliers' involvement, regulatory compliance and transparency to investors.

Actions and resources in relation to climate change policies

Reference: pages 153-159; 161.

Six transition action plans plus an adaptation programme are tabulated with key actions, scope, time horizon and 2025 advances (page 153), then detailed individually.

a. Sustainable procurement (page 154). "Purchases account for 82% of Sopra Steria's total carbon footprint, with IT purchases representing 39% share of total purchases." In 2025 "over EUR 894 million of supplier expenditure was assessed via the EcoVadis platform, representing 773 suppliers", covering 79% of supplier spend incurred and 66% of eligible suppliers. 100% of new contracts include environmental, social and human rights requirements. An IT impact-reduction plan covering 2026-2028 has been drawn up.

b. Energy efficiency and renewables (pages 155-156). Targets: keep renewable electricity at a minimum 95% and cut office energy consumption 20% by 2030 against 2021. Actions cover heating and cooling set points, LED and motion-sensor lighting, BREEAM and HQE certified buildings, data centre PUE improvement, free cooling at the main data centre (ISO 14001 and ISO 50001 certified, signatory of the EU Code of Conduct for Data Centres), and sourcing green electricity, "accounting for around 20% of overall electricity consumption. The remaining 80% of consumption is covered by guarantees of origin."

c. Sustainable transport (page 156). Employee transport "accounts for 13% of Sopra Steria's total emissions". Targets against a 2024 base: -15% by 2027, -20% by 2030, -40% by 2040. The share of new electric and low-emission vehicles in the fleet rose "from 30% in 2024 to 80% in 2025".

d. Environmental management, ISO 14001 (pages 157-158). 40% of sites and 69% of the workforce were certified at 31 December 2025, up from 24% and 50%; targets of 70% of employees by 2026, 80% by 2028 and 95% by 2030.

e. Employee awareness and training (page 158). 3,346 employees and 275 workshop trainers trained on climate issues in 2025 (2,537 and 195 in 2024); a 7,000-employee target by 2027 from a 2022 base.

f. Taking action beyond our value chain (page 159). Two innovative projects financed at EUR 100k each through the sustainability-linked loan programme.

Adaptation (page 161). OCARA-based gross physical risk analysis completed on 100% of sites and data centres in 2025; consolidated adaptation plan to follow in 2026.

Targets related to climate change mitigation and adaptation

Reference: pages 149; 152; 160.

Targets are disclosed under Section 2.1.2.3 [E1-4 including MDR-T] with a decarbonisation trajectory chart (page 152) and repeated in the emissions table (page 160).

SBTi-validated targets, 2019 baseline (page 149):

The page 160 table restates these alongside an "annual objective" column of -65% for Scopes 1+2 and -33% for Scope 3 relative to the 2019 baseline, which is the reduction achieved to date rather than a further target.

Trajectory (page 152). The chart runs from a 2019 total of 389,272 tCO2e through 347,719, 294,202 and 258,106 tCO2e, to target points of 38,927 tCO2e (Scope 3) and 657.6 tCO2e at the 2040 horizon, splitting Scopes 1 and 2 (6,576 / 3,110 / 2,392 / 2,326 / 3,025 tCO2e) from Scope 3.

Net zero. Net-zero by 2040 is the headline target, with the residual 10% of value chain emissions to be offset from 2040 onward (page 149).

Action-plan level targets sit under MDR-T within Section 2.1.2.4 rather than under E1-4: renewable electricity at or above 95% and office energy -20% by 2030 versus 2021; transport emissions -15% by 2027, -20% by 2030 and -40% by 2040 versus 2024; ISO 14001 coverage of 70%, 80% and 95% of employees by 2026, 2028 and 2030; and 7,000 employees trained on climate issues by 2027.

Energy consumption and mix

Reference: page 156; pages 257.

Energy metrics are disclosed under Section 2.1.2.4 as "Metrics related to 'Energy efficiency and renewables' [E1-5 including MDR-M]". "Energy consumption covers electricity, fuel (fuel oil, diesel and natural gas) and district heating."

Group table (page 156), both lines carrying the reasonable-assurance tick:

"In 2025, energy consumption fell compared to 2024. The decrease was mainly attributable to efforts made under the energy efficiency and renewables action plan. The sale of SBS in 2024 resulted in a 4% energy-related reduction in 2025, independently of other action levers."

The Section 8.2 metrics table (page 257) disaggregates by geography and adds two further consumption streams for the Group in 2025: on-site data centres 2,626 MWh and off-site data centres 11,829 MWh, against 4,034 MWh and 17,154 MWh in 2024. Water consumption is reported in the same table at 138,481 m3 for the Group in 2025, down from 164,457 m3.

The disclosure does not present the ESRS E1-5 breakdown of fuel consumption by source, and gives no energy intensity per net revenue figure; the Group is not in a high climate impact sector.

Gross Scopes 1, 2, 3 and Total GHG emissions

Reference: pages 160-161; page 260.

Group emissions (page 160), 2019 / 2024 / 2025 with year-on-year change:

"Proportion of Scope 1 GHG emissions from regulated emission trading schemes (%)" is 0.

Significant Scope 3 categories, 2025: products and services purchased 211,068 tCO2e (-15%); property, plant and equipment 3,523 tCO2e; waste 35 tCO2e; business travel 11,374 tCO2e (-7%); employee commuting and remote working 22,091 tCO2e (-4%); off-site data centres 108 tCO2e; goods transport downstream 275 tCO2e; investments 7,306 tCO2e (+281%). Categories 3-2, 3-4, 3-9, 3-10, 3-11, 3-12 and 3-14 are stated as excluded (page 260).

The +281% movement in category 15 is explained: Sopra Steria held an 11.07% stake in 74Software, whose Scopes 1, 2 and upstream 3 emissions were "estimated at around 66,000 tCO2e", so the attributed share is 7,306 tCO2e.

Data quality. "For Scopes 1 and 2, 85% of the data presented is actual data. As regards the main categories of Scope 3, the amount under Category 1 is an estimate based on financial data, while the amounts under other categories are mostly based on the collection of physical data." The share of primary data for purchases rose from 4% in 2024 to 14% in 2025 (page 154).

Intensity (page 161): 5.03 tCO2e per employee (2024: 5.77) and 45.70 tCO2e per EUR million of revenue (2024: 50.93).

GHG removals and GHG mitigation projects financed through carbon credits

Reference: page 159; page 161.

E1-7 is listed in the Section 7.1 index against Section 2.1.2.4, where it is tagged as "Metrics related to 'Taking action beyond our value chain' [E1-7 including MDR-M]".

Removals and mitigation projects outside the value chain (page 159). Two metrics are given. First, "Number of innovative projects with an environmental impact financed via the sustainability-linked loan programme: in 2025, two innovative projects received financing of EUR 100k each in the form of donations. The first project centres on environmental impact and the second on social impact; in 2024, two projects with a focus on environmental impact received financing." Second, "the amount of GHG emission reductions or removals in relation to direct activities (offices, data centres, and business travel) resulting from climate change mitigation projects outside the value chain", which "corresponds to Scopes 1, 2 (market-based), 3-6 and 3-8" and stood at 5.3% of the Group's total emissions in both 2025 and 2024.

Carbon credits. "Since 2020, the Group has been contributing to an afforestation project under the banner of the UN's Climate Neutral Now programme. As part of this project, its direct activities achieved Climate Neutral Now certification in 2021. The GHG emissions sequestered under this project are checked by the Verified Carbon Standard (VCS) and have obtained Compliance Certification Board (CCB) certification." In 2026 the Group "will continue to pursue its approach aimed at contributing to carbon neutrality", participating "only in contribution projects displaying a high level of integrity", in particular Gold Standard projects, and "plans to reconsider the relevance of carbon offset schemes".

The reduction targets themselves are stated to be independent of offsetting: the residual 10% is only to be offset from 2040 (page 149).

The disclosure does not present the ESRS E1-7 breakdown of credits by removal versus reduction project, by standard or by vintage, and gives no volume of credits retired in tCO2e. Note that the adaptation metrics on page 161 are also tagged [E1-7 including MDR-M], which appears to be a labelling error in the report.

Internal carbon pricing

Reference: page 157.

E1-8 is listed in the Section 7.1 index against Section 2.1.2.4, where the internal carbon pricing table appears under the heading "Metrics related to 'Sustainable transport' [E1-8 including MDR-M]".

Table (page 157):

A footnote records that "the portion of Scope 3 covered by internal carbon pricing is 3-6, business travel."

Narrative. "In 2025, Sopra Steria continued to make limited use of internal carbon pricing as a tool for raising awareness about sustainable transport issues. However, pilot testing on the use of internal carbon pricing for business travel in France and the United Kingdom over the last few years has not at this stage demonstrated a sufficient impact to justify implementing the Sustainable Transport Plan. Sopra Steria plans to adjust the trials carried out in order to continue to evaluate the potential of internal carbon pricing as an additional tool for raising awareness and changing behaviour."

This is effectively a nil return for 2025: coverage falls to N/A across all scopes, after 4.17% of Scope 3 in 2024 and 5.29% in 2023. No carbon price per tonne, no price-setting approach and no description of how the price is applied in decision-making are given, so the ESRS E1-8 content elements are only partly addressed.

Policies related to resource use and circular economy

Reference: page 163.

Section 2.2.2.1 sets out the policy under [E5-1 including MDR-P]. "Sopra Steria's policy in this area is aimed at reducing the environmental impact of its direct and indirect activities. The Group seeks to optimise resource use, manage the life cycle of equipment and solutions and responsibly manage waste."

Scope. "The scope of the policy encompasses all of Sopra Steria's value chain, covering key stakeholders, in particular suppliers, clients, partners, investors and employees, with no major exclusions."

Accountability. Monitored "at the highest governance level of the Group", with the SCSR Department responsible for implementation, supported by the Purchasing Department, the IT Department and country and entity Chief Sustainability Officers.

Regulatory anchoring. Alignment with EU waste management objectives, compliance with RoHS and REACH, and contribution to SDG 12, SDG 6 and SDG 11.

Four principles: optimising resource consumption across the value chain, including through the G4IT measurement tool; managing the life cycle of equipment by extending its life and encouraging reconditioned purchases; managing waste, in particular WEEE, by encouraging reuse and recycling; and raising awareness and training employees.

2025 change. "The resource management policy was expanded in 2025 to take account of increased vulnerability to shortages of critical resources, illustrated by difficulties with the procurement of laptop computers. Faster growth in artificial intelligence and the associated need for RAM ... has created difficulties for equipment manufacturers and triggered a sharp rise in prices as demand exceeds supply. Sopra Steria has implemented a set of business continuity measures based on extending the lifespan of digital equipment used, lifting the internal reuse rate and expanding its supplier base."

Actions and resources related to resource use and circular economy

Reference: pages 163-164.

Actions are disclosed under Section 2.2.2.3 [E5-2 including MDR-A], following "Directive 2012/19/EU" on waste electrical and electronic equipment and covering all Group entities.

Upstream resource management (page 163):

• "Gradually increase environmental reporting covering equipment and data centre operators, with monitoring of water and electricity consumption optimisation and of improvement in the PUE ... and WUE ... metrics"
• Purchase from suppliers committed to reducing their environmental impact through the Supplier & Partner Code of Conduct
• Roll out a guide to responsible digital technology
• Increase the proportion of FSC-certified paper
• "Encourage purchase of laptop computers with environmentally certified IT equipment (TCO, EPEAT Gold) and a high level of repairability (>8) at Group level"
• "Make greater use of equipment by extending its useful life to 5 years and placing a major emphasis on internal reuse"
• Draft the plan to reduce the Group's IT-related environmental impact in 2025 (page 164)

Waste management actions (page 164): awareness campaigns to cut printing and extend equipment life; a guide to eco-friendly digital behaviours; circular economy and waste guidelines for suppliers via the Supplier & Partner Code of Conduct; and responsible management of WEEE through reuse and recycling.

Medium term: "Roll out the plan to reduce the Group's IT-related environmental impact between 2026 and 2028" and "systematise internal reuse across all the Group's geographies."

Governance of the action plan has been managed since 2020 by the SCSR Department with the other functional departments concerned. No monetary resources are quantified specifically for this plan; the financial resources table on page 151 covers the climate transition plan action plans only.

Targets related to resource use and circular economy

Reference: page 163.

Section 2.2.2.2 sets out targets under [E5-3 including MDR-T]. "The Group has set itself the following targets to be achieved by 2030:

• Reuse, recycle or recover 100% of WEEE (reuse, raw materials recovery for recycling, heat recovery);
• Reuse, recycle or recover 100% of paper and cardboard waste (raw materials recovery for recycling, heat recovery);
• Maintaining the internal reuse rate for laptop computers in France above 30%."

"These targets were set by the IT Services & Infrastructure Department and the Purchasing Department, with the support of the Internal IT Systems Department."

Baselines. "For waste, the baseline year adopted is 2020, with the Group monitoring progress towards its targets since 2020. For the internal reuse rate, the baseline year adopted is 2024. The Group has monitored progress towards its targets since 2025."

The laptop reuse target is new: "A third target concerning the reuse rate for laptop computers in France was set in 2025 alongside the two initially set targets. Over the next few years, Sopra Steria will be looking to intensify its efforts in relation to this target to ensure that internal reuse is put into practice more systematically across all the Group's geographies."

Progress against the third target is reported at 41% for 2025 against 34% in 2024, on a rolling three-year basis (page 164), comfortably above the 30% floor. No target is set for resource inflows, for the share of secondary or biological materials, or for the recyclable content of products.

Resource inflows

Reference: page 164; page 259.

E5-4 is listed in the Section 7.1 index against Section 2.2.2.4, which is headed "Metrics related to 'Resource and waste management' [E5-4 and E5-5 including MDR-M]" and states that "volumes of waste generated, the proportion reused, recycled or recovered, and the volume of certified paper purchased are the main key performance indicators. Data are collected every quarter."

Inflow metrics actually given. The statement provides one direct resource inflow figure, in the Section 8.2 environmental metrics table carrying the reasonable-assurance tick: purchases of certified paper from sustainable sources, Group total 21,578.6 kg in 2025 against 23,794.0 kg in 2024, of which 82.6% came from sustainable sources against 73.0% in 2024, equal to 0.42 kg per employee against 0.47 kg (page 259).

Reuse as an inflow substitute. "Internal reuse rate in France (%)" was 41 in 2025 against 34 in 2024, over a rolling three-year period. "The internal reuse rate shows the portion of laptop computer requests met with an item of equipment that had already been assigned over a rolling three-year period" (page 164).

Qualitative inflow management is described through the IT procurement plan for 2026-2028, life cycle assessments of IT assets based on internal inventories, extension of equipment useful life to five years, and preference for TCO and EPEAT Gold certified equipment with a repairability index above 8 (pages 154, 163-164).

Gap. No total mass of technical and biological materials used is reported, no percentage of secondary reused or recycled components in products and services, and no absolute weight of the IT hardware purchased. The metrics presented answer the Group's own KPI list rather than the full ESRS E5-4 datapoint set.

Resource outflows

Reference: page 164; pages 258-259.

E5-5 is listed in the Section 7.1 index against Section 2.2.2.4. The coverage table on page 142 is explicit that only part of the sub-topic is addressed: "Resource inflows, including resource use; Waste" are covered, while "Resource outflows related to 'Products and services'" is marked Not covered.

What is disclosed. Outflows are reported as waste streams rather than as product outflows. For 2025 the recovery split given on page 164 is:

• WEEE: 73.2% collected and recycled; 26.7% collected and reused, recycled or recovered for energy generation
• Paper and cardboard: 95.2% collected separately and recycled; 4.6% collected separately and reused, recycled or recovered for energy generation

The Section 8.2 tables add tonnages and destinations by geography, all carrying the reasonable-assurance tick (pages 258-259). Group totals for 2025: WEEE 79,885.9 kg (2024: 83,582.0 kg), of which 33.6% reused; paper and cardboard 277,090.1 kg (2024: 273,598.0 kg); plastic waste 37,367.7 kg, 100% used for heat recovery or raw material recovery; metal waste 10,336.0 kg, 100% used for heat recovery or raw material recovery.

"All the data consolidated for the purpose of monitoring and reporting these metrics come from the Group's suppliers", and "the sale of SBS in 2024 led to a 3.6% reduction in waste generated (in kg) in 2025, independently of the other action levers" (page 164).

Gap. Consistent with the coverage table, there is no disclosure of durability, reparability, recyclability or recycled content of the services and solutions the Group sells, which is the products-and-services limb of E5-5.

Waste

Reference: page 164; pages 258-259.

Waste is one of the two E5 sub-topics Sopra Steria assessed as material ("Resource inflows, including resource use; Waste - Covered", page 142), and is reported within Section 2.2.2.4.

Hazardous waste position (page 164). "Sopra Steria does not produce any hazardous waste under the definitions set out in the RoHS and REACH regulations. In the course of its activities, the Group produces WEEE classified as hazardous under Commission Decision 2000/532/EC of 3 May 2000 and Directive 75/442/EEC on waste, and reuses wherever possible such electrical and electronic equipment once it has been retired. In 2025, the portion of hazardous WEEE not given a second life stood at 0.001% of the total amount of WEEE and paper, cardboard, plastic and metal waste."

Group volumes for 2025 (pages 258-259), all reasonable-assurance ticked:

For WEEE in 2025 the Group reports 33.6% reused and 26.7% recycled at Group level, with 0.1% incinerated without heat recovery and none sent to landfill. Plastic and metal waste are reported as 100% used for heat recovery or raw material recovery. Waste is also carried in the GHG inventory as Scope 3 category 5, at 35 tCO2e in 2025 (page 160).

Waste is collected quarterly and consolidated from supplier data. Targets of 100% reuse, recycling or recovery for WEEE and for paper and cardboard by 2030 sit under E5-3 (page 163).

Policies related to own workforce

Reference: pages 174; 179; 182; 186; 196.

The Section 7.1 index maps S1-1 to five sections, one general and four matter-specific.

General HR policy (page 174). "Sopra Steria's general human resources policy supports the corporate plan by providing a common reference framework at Group level, covering all business areas, entities and countries." It is built on the Core Competency Reference Guide and the Compensation Reference Guide, non-discriminatory recruitment leveraging the Employee Value Proposition, career management, skills management and training, specific development plans, and employee engagement. It "is regularly updated by the Group's Human Resources Department, with support from the Sustainability and Corporate Social Responsibility Department", is shared with those deploying it and is "accessible to all employees via the intranet".

Training and skills (page 179). Aligned to SDG 4 and SDG 8, aimed at anticipating skills needs, maintaining employability, promoting in-service training, maintaining a shared culture and strengthening the Employee Value Proposition, and built on a "learning company" model.

Employee protection and trust (pages 182-183). Anchored in the Code of Ethics and ILO standards, with undertakings to "combat child labour and exploitation, human trafficking, and forced labour", comply with occupational health and safety law, "create a safe, respectful and inclusive working environment. Combat all forms of discrimination and harassment", and "uphold the freedom of expression and of association and the exercise of trade union rights in each country".

Equal opportunities and diversity (pages 186-187). The "DEI by Design" approach was structured in 2025 into four Group programmes: gender equality, disability inclusion, non-discrimination (with LGBTQIA+ and age diversity action plans), and compensation and employee share ownership. An external firm audited recruitment processes in July 2025 across the SmartRecruiters scope "to ensure that no discriminatory practices are applied".

Social dialogue (page 196). Commitments to freedom of association, trade union rights and collective bargaining, embedded in the Code of Ethics, with responsibility resting on the CEO and each country's Head of Human Resources.

Processes for engaging with own workforce and workers' representatives about impacts

Reference: page 217; pages 125-126; 176-177; 196.

The Section 7.1 index maps S1-2 to Section 4.2.2, the due diligence statement. Page 217 states under "Processes for engaging with affected stakeholders [S1-2, S3-2 and S4-2]" that dialogue runs with "employees, through social dialogue (see Section 3.1.6, 'Social dialogue', of this chapter)".

The substance sits in the social dialogue section (page 196). Channels open to employees are listed as "committees involving employee representatives (in the form of information, consultation or participation meetings, depending on the issue at hand); surveys commissioned by employee representatives; employee satisfaction surveys at the employer's initiative (via Great Place To Work); internal communications and direct employee feedback". Meeting frequency is stated: monthly in France, "quarterly" elsewhere. "Expectations relayed by employee representatives are recorded during periodic meetings with the employee representative bodies and collective bargaining meetings. Feedback is formally recorded in meeting reports, opinions or statements."

European Works Council. Created by a 2022 agreement and established in 2023, it "met twice in 2025 to guarantee the right to information regarding cross-border subjects", covering eleven countries representing "62.5% of the 'Group' scope" (page 196).

Survey engagement (pages 176-177). 47,781 employees were invited to the Great Place To Work survey, with an 81% participation rate; the findings fed a three-part improvement plan and each country appointed a team leader for a local action plan.

Responsibility sits with the CEO and country Heads of Human Resources. Works Council consultation on the Sustainability Report itself took place in April 2025 for the 2024 report (page 126).

Processes to remediate negative impacts and channels for own workforce to raise concerns

Reference: page 217; pages 184; 211-212.

The Section 7.1 index maps S1-3 to Section 4.2.2. Page 217 states under "Processes for raising and remediating concerns [S1-3 and S4-3]" that "the process for raising and remediating concerns is included in Sopra Steria's whistleblowing procedure, which is accessible to all stakeholders. It is described in detail in Section 4.1.3."

The channel (pages 211-212). The procedure was rolled out for all Group entities and "is open at all times to all employees and external stakeholders". Employees may raise a concern with "their line manager, their line manager's manager, their entity's Compliance Officer, the Compliance Officer of their local functional division or the Group Compliance Officer", or use the whistleblowing procedure itself, including directly at ethics@soprasteria.com. "Concerns can be raised anonymously."

Coverage. Key areas include "corruption and influence peddling, fraud, financial offences, breaches of competition law and risks relating to human rights and fundamental freedoms, health and safety and environmental damage", and the procedure "applies more specifically to all forms of discrimination, in particular discrimination based on gender identity, appearance, sexual orientation, religion, nationality or assumed origin".

Timescales. Receipt acknowledged within seven business days; validity confirmed within a reasonable time frame; "initial feedback on action that has been or will be taken in response to reports is provided within three months of the date on which receipt of the report was acknowledged".

Protection. "Whistleblowers are protected against reprisals, discrimination and disciplinary sanctions of any kind related to their whistleblowing. This protection extends to any person related to the whistleblower."

Remediation. "Each whistleblowing report is followed up with an investigation. If the investigation proves conclusive, punitive measures can range from disciplinary action up to dismissal" (page 184). Internal and external local systems also operate in line with local regulations. The report does not state how the Group assesses employee awareness of or trust in the channel.

Taking action on material impacts on own workforce

Reference: pages 176-177; 180-181; 183-193; 196.

Actions are disclosed matter by matter, each with a table of actions against 2025 achievements.

Training and skills (pages 180-181). In 2025 the Group "stepped up the development of core competencies in AI": a new AI training programme for all employees delivering "31,537 hours of training, 14,897 employees trained", plus digital-platform modules totalling "17,642 hours of training, 29,005 modules completed"; new platforms for Solution Builders (15,000 licences, 17,546 hours) and Solution Architects (1,500 licences, 5,099 hours); 2,203 NextGen cloud certifications in France; and GoFluent language training opened to all employees (55,000 licences, more than 20,000 hours). In-house trainers numbered 2,304, delivering 140,592 hours of professional training.

Employee protection and trust (pages 183-185). Two days' remote working per week across all geographies; signature of the "Right to Disconnect" Charter in eleven countries; a gender equality collective agreement signed in January 2025 in France introducing paid leave for a child's illness and maintained wages during paternity leave; shortened hours from the third month of pregnancy in France; childcare support in France and India; "an independent psychological support unit that is always available, anonymous, confidential and free of charge in France and India"; and the InnerConnect webinar series, "five hour-long webinars ... for 7,000 managers". The TechCare programme covers health and safety, well-being and hybrid working.

Equal opportunities and diversity (pages 188-193). 7,329 employees completed gender equality training (6,188 in 2024) and 2,130 completed sexual harassment prevention training; 7,519 completed disability training; 4,143 completed LGBTQIA+ training (2,309 in 2024); 1,675 completed age diversity training. 254 women were supported through career development programmes (431 in 2024). Business/Employee Resource Groups had 7,589 members. In France, 100% of recruiters are trained on disability, and the Mission Handicap made 2,150 active adjustments for 467 employees.

Social dialogue (page 196). 208 agreements in force in France, with 32 signed in 2025.

Effectiveness is tracked through the Great Place To Work survey (page 176). No remediation actions are described, the Group stating that "to date, no negative impact has been observed, so no specific corrective actions have been required" for training and skills (page 181).

Targets related to own workforce

Reference: pages 175-176.

Section 3.1.2.2 gives two target tables under [S1-5 including MDR-T].

Progress towards the 2025 objectives set in 2021 (page 175), with 2021 baseline:

• 100% of employees attend at least one training session every year: 100% in 2025 and 2024, from a 10% baseline
• Management & Leadership programme fully rolled out at Group level: 100%, from 41.7% of scope
• Proportion of women on the Executive Committee: 18.7% in 2025 and 2024, from 17.6%
• Women in the 3% most senior positions (Level 5+): 22.4%, up from 21.4%, baseline 17.7%
• Women in the 10% most senior positions (Level 4+): 22.8%, up from 22.3%, baseline 19.4%
• Women managers (Level 3+): 26.6%, up from 26.3%
• Employees with disabilities, France: 4.14% against a 3.30% target, up from 3.94%, baseline 2.96%
• Access to a non-discrimination training module: 100%
• Access to a workplace well-being programme: 100%
• Overall satisfaction rate: 71%, against 75% in the 2023 baseline year; no survey was run in 2024
• Employees covered by collective bargaining: 55.7% of the Group scope, up from 55.1%

Board-set objectives. The Group met the objective of women holding at least 22% of Level 5 and above positions. It missed the Executive Committee objective: "the actual percentage achieved is 18.7% (3 women out of a total of 16 members), below the expected threshold of 30%. This situation is mainly due to the stability of the Executive Committee's composition and limited opportunities to replenish its membership over recent governance cycles" (page 175).

New 2026-2028 objectives (page 176) with 2025 baselines: at least 5 training days (35 hours) per employee per year, from 25.1 hours; at least 1 day of AI training, from 7 hours; at least 2 days on leadership and technological developments for top management, from 3.5 hours; plus continuation of the diversity, well-being, satisfaction and collective bargaining objectives.

Targets are set with Executive Management, HR, the SCSR Department and employee representatives, and "the findings are presented to the stakeholders annually".

Characteristics of the undertaking's employees

Reference: pages 177-178.

Headcount (page 177). "At 31 December 2025, the Group employed 51,275 people from over 26 countries." 8,313 new employees were recruited, against 7,436 in 2024. Aurexia (acquired 30 April 2025) and Neocase (30 November 2025) "are only included in the scope used to calculate the total workforce for 2025".

Key employment figures (page 178), reasonable-assurance ticked:

By gender (page 178). 16,873 women and 34,402 men including acquisitions; 16,431 women and 33,532 men on permanent contracts excluding acquisitions; 346 women and 733 men on temporary contracts; "number of non-guaranteed hours employees" nil for both. Full-time: 87.1% of women and 97.4% of men.

Turnover method. "Excluding transfers between companies, 82.3% of departures were voluntary (versus 84.4% in 2024)", with 8,281 departures against 8,177. The calculation "includes departures of employees who joined the Company less than 6 months ago".

Two stated limitations. No figure is available for the "Other" gender category required by AR 55, "but the Group is taking steps to provide it in future years" (page 177). And "Sopra Steria has chosen not to report metrics relating to the proportion of full- and part-time employees on temporary contracts for this second year of CSRD reporting" (page 178).

Collective bargaining coverage and social dialogue

Reference: page 197.

Section 3.1.6.3 reports collective bargaining and social dialogue metrics under [S1-8 including MDR-M], using the ESRS reporting thresholds: "countries with more than 50 employees and accounting for more than 10% of the total workforce", which for Sopra Steria are France, India and the United Kingdom.

Coverage bands (page 197). For employees in the EEA, France falls in the 80-100% band for collective bargaining coverage and for workplace representation. For employees outside the EEA, India and the United Kingdom fall in the 0-19% band. No country sits in the intermediate bands.

Headline figures. "Scope covered by a collective bargaining agreement: 55.7% of employees covered in 2025 according to the thresholds set by the CSRD for countries with > 50 employees representing > 10% of the total workforce (France, United Kingdom, India)". Separately, "In total, 75.2% of Group employees are covered by collective bargaining agreements (compared with 78.4% in 2024)."

France detail, described as 39.1% of the Group scope: "32 agreements signed (compared with 29 in 2024)" and "208 agreements in force (compared with 203 in 2024)".

The Group notes that other countries below the CSRD thresholds are also covered by social dialogue arrangements: Germany, Italy, Belgium and Spain. Social dialogue is one of the four material S1 matters, and the report states that "a quantitative objective related to social dialogue will be set in the coming years" (page 196), so the coverage rate currently serves as the tracked metric in place of a target.

Diversity metrics

Reference: pages 189-190; 193-194.

Diversity metrics are reported under [S1-9 including MDR-M] in two places: gender (page 190) and age (pages 193-194).

Proportion by gender (page 190), with the top-management line reasonable-assurance ticked:

Age distribution (page 194), reasonable-assurance ticked: under 30, 26.7% in 2025 against 27.5% in 2024; 30 to 50, 53.2% against 52.9%; over 50, 20.1% against 19.6%. "The average age of employees on permanent contracts was 39.6 in 2025, compared to 39.4 in 2024" (page 193).

Context. The Group cites the World Economic Forum's 2024 Global Gender Gap Report that "women account for only 28.2% of positions in technology and engineering" (page 187), and reports a French statutory gender equality index score of 89/100 for the UES scope (page 188). Certification is recorded through the Gender Equality European & International Standard, re-obtained in 2024, and UNI/PdR 125:2022 accreditation in Italy since 2023 (page 189).

Persons with disabilities

Reference: page 192.

Disability metrics are reported under [S1-12, including MDR-M]. This is the one area where the 2025 double materiality review changed the scope of disclosure: "certain disclosures on the topic 'Employment and inclusion for people with disabilities' were identified as material" (page 141), and the topic was folded into "Equal opportunities and diversity" (page 140).

Headline figures (page 192). "In total, there are 1,533 people with disabilities within the Sopra Steria Group." For France, "people with disabilities accounted for 4.14% of Sopra Steria France's workforce, up 0.20 points from 2024 (3.94%)", against a target of 3.30% and a 2021 baseline of 2.96% (page 175). "Overall, women make up 41.2% and men 58.8% of the population."

Method and its limits. "Data used to calculate this metric are collected in accordance with local legislation. In countries where data collection is prohibited by legal standards, it is obtained on a voluntary self-reporting basis guaranteeing respondents' anonymity, as part of the Great Place To Work satisfaction surveys for example." The French rate is defined on a full-time equivalent basis "with an uplift applied for workers aged 50 and over ... Workforce numbers used are also calculated according to the rules defined by Agefiph."

Stated obstacle to a Group-wide rate. "The wide range of legal definitions of disability within the different countries made collecting consistent and comparable data at Group level relatively complex. Further progress was made with rolling out an action plan to produce consolidated data in the medium term" (page 190).

Supporting commitments include membership of the ILO Global Business and Disability Network since 2021, Disability Confident Leader accreditation at Level 3 in the United Kingdom, and a French company-level agreement for 2024-2026 (page 191).

Training and skills development metrics

Reference: page 182.

Training metrics are reported under Section 3.1.3.3, "Performance measures [S1-13 including MDR-T]".

Employee training (page 182), reasonable-assurance ticked:

The year-on-year fall is explained by economic conditions: "Following a year of economic contraction, which notably affected training hour volumes, the Group has established new steering committees including the Heads of Human Resources from the various entities, alongside dedicated KPIs for managers effective from the start of 2026" (page 181).

Performance reviews. "In 2025, 90% of employees were assessed. This corresponds to 96.6% of the Group scope (CIMPA entities outside France; Bulgaria; Sweden; Denmark; and acquisitions made in 2025 are excluded from the scope)." Reviews cover "employees on permanent contracts who joined the company before 1 July 2025" and follow the Core Competency Reference Guide. The Group notes that "assessment methods and criteria may still vary between countries".

Promotion and mobility. "3,550 employees promoted, including 34.6% of women (vs 4,146 employees promoted in 2024, including 34.7% of women). The number of promotions represents 7.1% of the permanent contract workforce who were with the Group throughout the year (vs 8.6% in 2024), covering 97.9% of the 'Group' scope." International transfers fell to 13 across six destinations, from 40 across ten.

Training spend is quantified only partially: "In 2025, training expenditure for the SSG entity in France came to 6.63% of the Group's total payroll, covering 26.3% of the 'Group' scope" (page 181).

Work-life balance metrics

Reference: pages 185-186.

Work-life balance metrics are reported under Section 3.1.4.3, "Metrics related to 'Employee protection and trust' [S1-15 and S1-17 including MDR-M]".

Entitlement (page 185). "Employees eligible for family leave in the Group: 100%", covering 100% of the Group scope.

Take-up (page 185). Reported for a partial scope, described as 53.7% of the Group workforce, being France, Norway and Spain (Sopra Steria Espana only):

Stated reason for the partial scope (page 186). "To ensure that the information reported is of high quality and representative, Sopra Steria has chosen not to report metrics relating to the proportion of employees who have taken family leave for the entire 'Group' scope in this second year of CSRD reporting. This reflects the Group's commitment to standardising reporting practices in the long term ... The Group is currently implementing an action plan to collect information throughout the rest of the countries where it operates."

Scope coverage improved year on year, "compared to 31% for data reported in 2024". Definitional variation is acknowledged: "The duration and compensation arrangements may vary in accordance with applicable national legal frameworks and collective bargaining agreements."

Supporting arrangements described under S1-4 include two days' remote working per week Group-wide, the Right to Disconnect Charter in eleven countries, and voluntary part-time working at 6.0% of permanent contracts (page 183).

Compensation metrics (pay gap and total compensation)

Reference: page 195.

Compensation metrics are reported under [S1-16 including MDR-M], with an unusual amount of methodological candour.

Gender pay gap, CSRD method (page 195): Group 14.1% in favour of men; France 7.2%. "The gender pay gap calculated with the CSRD methodology is based on full-time equivalent annual compensation (for permanent and temporary contracts, excluding work-linked training students). At present, for the reasons outlined previously, the calculation does not include variable components of compensation. The Group is collecting the necessary data so that it can, in the future, report a metric encompassing all components of compensation."

Adjusted pay gap, voluntary disclosure (page 195): Group -0.9%, France 0.0%, where the sign convention indicates a marginal gap in favour of men at Group level. The adjusted ratio uses "multiple linear regression applied at country and entity level", controlling for "level, business line, segment, location, performance and length of service", and was built "drawing on external expertise specialising in pay equity". The Group is explicit that the two figures are not comparable: the adjusted gap "cannot be interpreted in the same way as the pay gap calculated under the CSRD method".

Annual total compensation ratio: not reported. "With the Group's Executive Management still in transition, consolidated data on the annual pay ratio could be reported once the approach set out above has been completed" (page 195). This is a stated gap against the S1-16 datapoint requiring the ratio of highest-paid individual to median employee compensation.

Context on the wider programme is given at page 194: fixed compensation set against the Core Competency Reference Guide, variable compensation partly based on CSR criteria, and an employee share ownership programme in which "all the investments managed on behalf of employees accounted for 6.0% of the share capital ... and 8.2% of voting rights", with "around 96% of the total workforce ... eligible".

Incidents, complaints and severe human rights impacts

Reference: pages 186; 217.

Metrics (page 186), for the France, Norway and Spain scope representing 53.7% of the workforce:

"It should be noted that no social alerts were reported for Norway or Spain in 2025."

Stated reason for the partial scope (page 186). "Sopra Steria has chosen to report metrics related to whistleblowing reports and investigations for a partial scope for this second year of CSRD reporting ... methods for collecting and processing whistleblowing reports may vary from one entity and/or subsidiary to another. These differences may be due to varying legislative frameworks or the use of external service providers ... there is no global tool for consolidating such data at Group level." Coverage improved from 39.1% in 2024. In France the process "is overseen by the country's HR and Legal Department, through a regularly updated report monitoring file".

Severe human rights impacts (page 217). A Group-level nil return is given: "No serious human rights violations or non-compliance with any of the United Nations or OECD guidelines in connection with Sopra Steria employees, end-users or local communities were identified or reported through the Group's whistleblowing channel. No complaints were filed against Sopra Steria with the various national contact points for OECD multinational enterprises during financial year 2025 or previous financial years. As a result, no fine, penalty or compensation for damages was recorded."

Page 184 corroborates: "No fine, penalty or compensation for damages relating to an incident of discrimination or harassment or due to a complaint was paid during 2025."

Policies related to affected communities

Reference: pages 200-201; 204-205.

S3 covers two material matters, each with its own policy section.

Solidarity and volunteering (pages 200-201). "Since 2024, the Group's solidarity policy has focused on 'supporting disadvantaged young people and their relatives in their digital lives'", through digital inclusion ("facilitating access to equipment, connectivity and basic skills") and digital education ("the prevention of online violence, efforts to combat disinformation, and the development of critical thinking"). Coverage is near-universal: "The vast majority of Sopra Steria countries and entities (representing 99% of the Group's workforce) are involved in this collective solidarity approach." Accountability sits with the SCSR Department, "which is represented on the Group's Executive Committee", with "Executive Management and the Executive Committee approv[ing] the policy's priorities and resources"; a Solidarity & Volunteering team of two FTE coordinates a network of Solidarity Officers meeting "at least once every two months". "All donations made by the Group or by its entities, either financial or in kind, are subject to compliance checks and ethical scrutiny to prevent all forms of conflicts of interest."

Regional presence (pages 204-205). Here the Group is explicit that no policy exists: "The Group has not yet drawn up a formal general policy related to 'Regional presence'. Each entity's approach is organised according to its operating model, through decision cycles and the usual management bodies." The approach "is aimed at supporting regional development and resilience through job creation in local job markets and links forged with external stakeholders within local ecosystems". In France it has been overseen since 2024 by regional management reporting to the Managing Director of the France reporting unit, involving eight regional directors and covering links with schools, local authorities and professional federations.

Sopra Steria has 56 sites in mainland France across 45 cities in 12 regions, managed by eight regional offices, and operates in 20 towns in the United Kingdom, 16 in Germany and Austria, 15 in Scandinavia and 11 in Benelux (pages 204-205).

Processes for engaging with affected communities about impacts

Reference: page 217; pages 200-203.

The Section 7.1 index maps S3-2 to Section 4.2.2. Page 217 states under "Processes for engaging with affected stakeholders [S1-2, S3-2 and S4-2]" that Sopra Steria engages with "local communities, notably through public institutions and non-profit organisations".

The same page carries an unusually direct limitation: "Outside the whistleblowing channels accessible to all stakeholders, Sopra Steria does not have a mechanism for direct dialogue with end-users or local communities."

Engagement therefore runs through intermediaries, and the report describes what that looks like in practice. "Sopra Steria maintains a regular and direct dialogue with the non-profit ecosystem. Its teams participate in events centred on philanthropy, meet with representatives from non-profits and stay up to date on how supported projects are progressing over the long term. These exchanges are useful in enhancing understanding of the needs on the ground and within the structures supported, which have seen funding streams come under serious threat in recent years. For example, the Group has opted to shift its solidarity policy towards providing multi-year financial support, also taking into account operating costs" (page 201).

Project-level tracking includes "regular monitoring committee meetings with the heads of the non-profit projects and/or the Sopra Steria employees who act as solidarity policy ambassadors", "regular written reports by the non-profits", and "informal conversations with the non-profits supported and in some cases with the people they assist" (page 202).

For the double materiality assessment itself, local communities were consulted "through in-house Solidarity Officers" rather than directly (page 125). No process for engaging communities affected by the Group's own site operations is described separately.

Taking action on material impacts on affected communities

Reference: pages 201-203; 205-206.

Solidarity and volunteering (pages 201-203). Three international programmes are described. The Sustain.forGood philanthropy programme covers long-term local partnerships financed by countries and subsidiaries, a new international call for projects, multi-year cross-functional support (for example a partnership with Emmaus Connect combining financial support, corporate volunteering and equipment collection drives), and the India Yogdaan Scholarships. "For this first call for projects, 15 projects were put forward by 10 Group countries and subsidiaries", from which a jury of eight Executive Directors and two employees selected three: the Global Digital Library run by Curious Learning; the InCV mobile app backed by Fundacion Randstad, UNIR and Caritas; and the STOP Cyberviolences programme run by Centres Relier.

The corporate volunteering programme was given "a formal reference framework ... drawn up in 2025", covering pro bono work, Business/Employee Resource Groups, reservist and volunteer firefighter service, and blood donation. The 2025 International Volunteer Days campaign "involved 12 countries ... and three subsidiaries. Over 600 employees across the Group got involved, supporting close to 80 non-profit organisations. More than 8,400 pro bono hours were donated, benefiting almost 20,000 vulnerable people at risk of social and/or digital exclusion."

Longevity is evidenced: support for the Balia Foundation since 2015, Die Arche since 2018, Child Focus since 2020, and the Sopra Steria-Institut de France Foundation since 2001.

Regional presence (pages 205-206). Actions are decentralised, with each country selecting initiatives. Examples given for 2025 include the UIIP training programme in Italy, the LIFE Hamburg Campus in Germany, CRIMSON crisis management ("in 2025, 70% of SDISs in France were clients of CRIMSON"), and the FloodCARE flood management service, "triggered for the first time in late January 2025 as a result of the severity of Storm Herminia", where teams "produced 13 rapid monitoring maps in 4 days".

Metrics (page 203). Non-profits supported fell from 994 to 295, deliberately: "Sopra Steria wishes to provide its partner non-profits with more substantial, sustained support, which reduces the overall number". People supported rose from 50,890 to 75,535; employee volunteers fell from over 1,910 to over 1,508, but the pro bono share rose from 49.5% to 67%.

Targets related to managing material negative impacts, advancing positive impacts, and managing material risks and opportunities

Reference: pages 201; 205.

Targets are disclosed separately for the two S3 matters, and both disclosures are candid about what has not been set.

Solidarity and volunteering (page 201). "Sopra Steria has set qualitative objectives related to social impact, which guide the solidarity policy, in particular in favour of digital education and digital inclusion. For each initiative undertaken, progress is evaluated at least once a year, in comparison with the launch of the project and/or the progress made during the previous year. Each entity is responsible for setting impact objectives for the initiatives implemented locally. The lack of a consolidated target is partly due to the difficulty of recording the social and societal impact of supported projects in a uniform, quantitative and objective way while taking into account each local context and each type of initiative implemented."

One quantitative target is set: "the Group has set a target starting in 2026 of involving by 2028 at least 10% of its employees in social, societal or environmental issues during working time or with the Company's backing. Sopra Steria still needs to implement or strengthen a series of internal processes to identify and showcase all the employee-led solidarity initiatives." A further commitment under the beyond-value-chain plan is to finance "annually ... at least one innovative project that generates measurable positive social impacts, via the sustainability-linked loan programme".

Regional presence (page 205). "To date, Sopra Steria has not established any targets or unified monitoring systems focused on the optimisation of the Group's positive impact. Quantitative measurement is not used for this matter due to the difficulty of objectively quantifying regional presence, taking into account: the interests of local communities; regional diversity; and each region's social and economic context." Four areas are named for possible future monitoring: support for training and the local education system; solutions for local authorities' economic and social challenges; supporting market momentum through local centres of expertise and job creation; and development of local partnerships.

Affected communities were not directly involved in setting either set of objectives; consultation ran through in-house Solidarity Officers (page 125).

Policies related to consumers and end-users

Reference: pages 207-208.

The S4 material matter is framed as "Contribution to essential public services", grounded in the NIS Directive definition: a digital service is essential when "the service is essential for the maintenance of critical societal and economic activities; the provision of this service depends on network and information systems; and an incident on these networks and systems would have significant disruptive effects on the provision of that service" (page 207).

What is disclosed as policy (pages 207-208). "Sopra Steria's role is to understand its clients' information systems and guide clients in their technological choices to improve their efficiency while taking into account client-specific constraints and end-users." Sensitivity is assessed on three dimensions: "characteristics of client sectors; continuity challenges and societal implications in the event of disruption; the criticality of client projects in which Sopra Steria is involved. In particular, criticality takes into account potential cybersecurity and data protection impacts."

Delivery is organised into verticals: Public sector; Defence, Space & Security; Transport; and Energy. A specific approach exists for government and public-sector bodies covering "taxation, public finances, customs, education, agriculture, ecological transformation, employment, occupational training, health, retirement and family matters", and an Institutional Relations team set up in 2024 was extended in 2025.

An explicit limitation. "The approach integrates the Group's operating model through decision cycles and the usual management bodies, in particular in each vertical. The Group has not formalised a general policy on essential public services" (page 208). Three objectives are stated in place of one: participating in the continuity and quality of essential public services; ensuring the development of the skills needed; and using new technologies and data analysis to multiply the benefits of digital technology.

Regulatory anchors named are GDPR, the NIS 2 Directive, the Cybersecurity Act, DORA and the AI Act. Human rights commitments for end-users are cross-referenced to the introduction to Section 3 and to Section 4.2 (page 208).

Processes for engaging with consumers and end-users about impacts

Reference: page 217; pages 125; 176.

The Section 7.1 index maps S4-2 to Section 4.2.2. Page 217 states under "Processes for engaging with affected stakeholders [S1-2, S3-2 and S4-2]" that the Group engages with "end-users, indirectly, through its clients (see Section 1.1.2, 'Interests and views of stakeholders [SBM-2]' of this chapter)", and adds the limitation that "outside the whistleblowing channels accessible to all stakeholders, Sopra Steria does not have a mechanism for direct dialogue with end-users or local communities."

The indirect route is set out in the stakeholder table (page 125). Clients and end-users are described as "public- or private-sector clients, clients of clients (businesses or consumers)". Dialogue types are "consultation and project tracking committees" and the "annual Customer Voice survey: interviews with over 650 clients". For the double materiality assessment the group is marked as consulted "Yes - through business clients". Principal expectations recorded are to "continue providing quality services and solutions tailored to client and industry demands while accounting for end-user satisfaction", and the Group's responses include a "process for escalating project alerts via the Industrial Department", the "launch of a Client Advisory Board", and a group "to share information and facilitate dialogue on sustainable procurement with our clients' purchasing departments" (page 126).

The disclosure is honest about the structural constraint but does not identify which end-user groups are most vulnerable to being missed by an indirect approach, nor how the Group assesses whether client-mediated feedback reaches it. Effectiveness is tracked qualitatively, "drawing on existing governance and relationships with clients directly in connection with its projects" (page 209).

Processes to remediate negative impacts and channels for consumers and end-users to raise concerns

Reference: page 217; pages 211-212.

The Section 7.1 index maps S4-3 to Section 4.2.2. Page 217 states under "Processes for raising and remediating concerns [S1-3 and S4-3]" that "the process for raising and remediating concerns is included in Sopra Steria's whistleblowing procedure, which is accessible to all stakeholders. It is described in detail in Section 4.1.3, 'Policies related to Business conduct [G1-1]' of this chapter."

The channel (pages 211-212). The procedure "is open at all times to all employees and external stakeholders, including in particular the Group's clients, suppliers, subcontractors and business partners. It may be used to flag up any situations that could be contrary to the law, the Code of Ethics or the Code of Conduct or that could harm the Group's reputation. It also covers situations that could pose a threat to the public interest." Reports may be made anonymously, to a designated entity email address or directly to ethics@soprasteria.com, which "is also available on the Ethics and Compliance page of the Group's website".

Service levels. Acknowledgement within seven business days, validity confirmed within a reasonable time frame, initial feedback within three months, and closure "within a reasonable time frame based on the complexity and severity of the matters reported". Confidentiality of the whistleblower's identity is guaranteed and access to report details is restricted and pre-approved by the Internal Control Department.

Coverage of end-user harm. Page 209 adds that "in application of the Group's due diligence and human rights commitments, Sopra Steria has in place systems to identify and prevent severe negative impacts on end-users."

The disclosure covers availability and process but does not report how end-users are made aware of the channel, whether they trust it, or how many reports originated from end-users. The Group's nil return on severe human rights impacts covers end-users explicitly (page 217).

Taking action on material impacts on consumers and end-users, and approaches to managing material risks and pursuing material opportunities related to consumers and end-users, and effectiveness of those actions

Reference: pages 208-209.

Actions are decentralised by vertical: "Each vertical implements and monitors its projects and initiatives independently, taking into account the challenges of each of the essential services to which it contributes. The Group is also rolling out cross-functional actions and resources ... All entities, and in particular the verticals concerned, are responsible for deploying financial and human resources needed to ensure the success of these projects" (page 208).

Named 2025 projects and initiatives (pages 208-209):

• Public services, health and employment (United Kingdom): digital support for the Department for Work and Pensions, Defra, the Health and Safety Executive, the Home Office, the Ministry of Justice and the Office for Nuclear Regulation. "This new agreement builds on a 12-year partnership between SSCL and 22 government departments and agencies. This partnership ... has already generated in excess of GBP 950 million in savings for the public sector."
• Education (France): an HR platform for the Ministry of Education for recruiting contractual agents and tenured staff. "The platform has already generated a 36% increase in applications, resulting in Sopra Steria Next winning the Syntec Conseil Grand Prix and gold medal."
• Defence, Security and Space: CRIMSON solutions for critical infrastructure protection, which "won the Security Innovation Award at the Security Research Event 2025, an event supported by the European Commission"; and a highly resilient inertial navigation system for amphibious helicopter carriers, delivered with CS Group, CNN MCO and Thales.
• Transport: data analysis solutions for LETEC in Wallonia; capacity management solutions for SNCF, RATP and European infrastructure managers.
• Energy and Utilities: Telecoms Sustainability Day; a transformation programme for Goteborg Energi in Sweden.
• Group-wide: core training on essential services for employees.

For 2026 the Group "plans to continue with its financial and human investments to maintain and strengthen local relationships with these essential sectors", and "will begin working to strengthen its ability to manage and monitor its impact across its scope of consolidation".

No monetary resource figure is attached to the S4 actions, and effectiveness is tracked qualitatively (page 209).

Targets related to managing material negative impacts, advancing positive impacts, and managing material risks and opportunities

Reference: page 208.

Section 3.3.2.2, "Targets and objectives related to 'Contribution to essential public services' [S4-5 including MDR-T]", records qualitative objectives and states plainly why no quantitative target exists.

"The Group's overall approach is geared towards its qualitative objectives in order to ensure that essential services run without interruption and effectively meet the needs of clients, end-users and partners. This approach and its monitoring apply to the whole Group and are based, as a minimum, on comparing the satisfaction level of the clients, end-users and partners involved in the projects."

"Sopra Steria has not set quantitative targets for its contribution to essential public services. Quantitative measurement has not been adopted at this stage due to the difficulty of quantifying the positive impacts in a uniform and faithful manner, taking into account: the portion attributable to Sopra Steria, the interests of all parties affected and the different types of projects."

Effectiveness in the absence of a target is tracked qualitatively: "In the same way as for targets, Sopra Steria Group tracks the effectiveness of its approach in relation to its impact on essential services on the basis of qualitative information. For this, it draws on its existing governance and relationships with clients directly in connection with its projects. However, as part of a restructure set to begin in 2026, the Group will be reassessing the feasibility and relevance of producing quantitative metrics" (page 209).

The client satisfaction instrument referred to is the annual Customer Voice survey, involving "interviews with over 650 clients" (page 125). End-users were not directly involved in setting the objectives; the S4 stakeholder group was consulted for the DMA "through business clients" (page 125).

Business conduct policies and corporate culture

Reference: pages 211-213.

Section 4.1.3 sets out the business conduct policies under [G1-1, G1-2, G1-3 including MDR-P]. "The policies described below cover the Group's entire scope of consolidation. They are revised as often as necessary and in any event at least every three years, under the responsibility of the Internal Control Department. They may notably be updated as a result of regulatory developments, internal audit findings or internal whistleblowing alerts."

Code of Ethics (page 211). Sopra Steria has been a UN Global Compact signatory since 2004. The Code "constitutes the reference framework within which the Group operates. It applies to all Sopra Steria employees and company officers and is supported by Group management, which ensures that it is duly observed." Accountability is individualised: "Managers who sit on the Group Management Committee and entity-level (country and subsidiary) management committees sign an annual digital declaration renewing their commitment to abide by and enforce the Code of Ethics within their scope of responsibility." The Code is published on the Group's website and extended by expectation to clients, partners, suppliers and subcontractors.

Supporting instruments: an Anti-Corruption Code of Conduct, a Code of Conduct for Stock Market Transactions, a Supplier & Partner Code of Conduct, and "a common core of rules, procedures and checks applicable to the entire Group".

Whistleblowing (pages 211-212). Described in full, with a process diagram, anonymous reporting, seven-day acknowledgement, three-month initial feedback and protection against retaliation extending "to any person related to the whistleblower or their whistleblowing". Whistle-blower protection is not itself a material sub-topic (page 142), but the mechanism is disclosed.

Other policies (pages 213). Tax transparency, with a commitment that "the Group does not operate in tax havens ... It has no bank accounts in such territories"; personal data protection (cross-referenced to Section 5.1); fair competition; inside information and insider trading; anti-money laundering, where "a system to automate and reinforce procedures for verifying third-party bank details continued its roll-out in 2025"; and international sanctions and export controls.

Management of relationships with suppliers

Reference: pages 211; 214.

G1-2 is listed in the Section 7.1 index against Section 4.1.3. Note a documented inconsistency: the page 142 coverage table marks "Management of relationships with suppliers, including payment practices" as Not covered, yet the index claims the disclosure requirement. Substantive content does exist in Sections 4.1.3 and 4.1.4.

Supplier & Partner Code of Conduct (page 211). "As it applies to its upstream chain, Sopra Steria requires agreement to the ethical principles set out in the Supplier & Partner Code of Conduct. The purpose of the Code of Conduct is to define requirements in terms of business ethics, respect for fundamental human rights, and the environment ... It requires suppliers and partners to abide by the principles of the UN Global Compact in respect of, inter alia, human rights and fundamental freedoms, labour law, the environment and anti-corruption measures. The Code of Conduct also includes provisions designed to ensure that suppliers' and partners' own supply chains abide by these commitments, as well as a declaration concerning conflicts of interest."

Contractual mechanics (page 214). "The Supplier & Partner Code of Conduct is included in all invitations to tender sent out to suppliers. It must be signed before any contract can be entered into with Sopra Steria. It is attached to each contract and each purchase order issued by the Group. If a supplier refuses to sign up to the Group's Code of Ethics on the basis that it has its own such code, Sopra Steria requires the latter to include principles equivalent to the Group's."

Assessment results for 2025 (page 214). 773 suppliers assessed by EcoVadis, covering more than EUR 894 million of expenditure, "79% of target expenditure for 2025 (up by 2 points compared to 2024)". Average supplier score 63 out of 100, "nearly 13.7 points higher than the average score for all suppliers assessed via the EcoVadis platform"; average improvement on reassessment 4.4 points; "no suppliers scored less than the Group's alert threshold of 24/100"; 88% scored at least 45/100 against 61.5% platform-wide; 67% earned an EcoVadis medal against 41% platform-wide.

Escalation. Below 45/100 a supplier "is considered non-compliant with expectations" and must produce a corrective action plan; at or below 24/100 an alert is triggered and reassessment is required within three months.

No payment practice metrics are given; those sit under G1-6, which is not material.

Prevention and detection of corruption and bribery

Reference: page 212; page 214.

Framework (page 212). "Sopra Steria has implemented a compliance programme to safeguard against risks associated with corruption and influence peddling ... The Group applies a zero-tolerance policy with respect to corruption and influence peddling." Executive Management commitment is reiterated annually to all employees "on UN International Anti-Corruption Day, which takes place on 9 December", and the programme is overseen directly at Internal Control Department steering meetings with Executive Management.

Eight pillars are named (page 212):

• Corruption and influence-peddling risk mapping, "updated every two years or as soon as is necessary following a major Group-level event. This risk mapping was updated as planned in the first half of 2024 and will be updated again in 2027"
• A specific Anti-Corruption and Influence-Peddling Code of Conduct with a foreword by the Chairman and CEO, "translated into five languages"
• A disciplinary system enforceable through the Group's internal rules
• Formal procedures for hospitality and gifts, conflicts of interest, recruiting former public agents and countries under vigilance
• A third-party assessment procedure covering suppliers and subcontractors, tied to the Sapin II Act and the duty of vigilance
• A guide to preventing conflicts of interest
• The whistleblowing procedure
• Employee training, and strengthened control and audit procedures, with the Internal Audit Department "running through some 30 specific checks"

Training (page 214). A mandatory e-learning course for all employees "must be completed within 3 months of their arrival. It is available in five languages" and comprises "eight interactive modules covering the legal framework, the Code of Conduct and key contact points, hospitality and gifts, conflicts of interest, public agents, commercial intermediaries and countries under vigilance, donations, patronage, sponsorship, facilitation payments and the whistleblowing procedure", ending in a mandatory quiz. Refresher training runs every three years for at-risk roles: management including the Executive Committee, sales, finance and purchasing.

A stated gap. "Sopra Steria does not provide Directors with specific training on this topic" (page 214).

The function is separate from the business: investigators and the compliance network sit under the Internal Control Department, with 16 Internal Control & Compliance Officers across entities (page 210).

Targets related to business conduct

Back-filled from the business conduct chapter, where targets are addressed as part of the MDR-T/GDR-T disclosures rather than as a numbered disclosure requirement. G1-3 became a standalone DR only in the 2025/2026 ESRS.

Reference: page 213; page 214.

Sopra Steria states three business conduct objectives with quantified thresholds (page 213), applicable to all Group entities:

1. "Put the Group's corporate culture and ethical principles at the heart of its relationships with stakeholders by maintaining a training completion rate of >=90% for employees and an EcoVadis score of >=80/100 in the ethics area."
2. "Work with suppliers and partners who meet the Group's ethical requirements by ensuring that over 80% of target expenditure obtains a positive EcoVadis assessment."
3. "Ensure regulatory compliance in a fast-changing international environment, with a target of zero major incidents."

Performance against them (page 214), disclosed under G1-4:

• EcoVadis ethics score: 88/100 in 2025, against 90/100 in 2024, so the >=80 threshold was met with a two-point decline
• Compliance e-learning completion, all employees: 90% at end-December 2025, against 93% in 2024, exactly at the >=90% threshold
• Compliance e-learning completion, at-risk roles: 90% at end-December 2025, against 92% in 2024
• Share of 2025 target expenditure receiving a positive EcoVadis assessment (>45/100): 73%, down 4 points from 2024, so the "over 80%" objective was missed
• Confirmed corruption incidents: zero recorded via the whistleblowing procedure in 2025

Effectiveness is also tracked through the wider EcoVadis assessment of Sopra Steria itself, which reached the Platinum rating with an overall score of 94/100, "among the top 1% for the past six years" (page 215).

Three of the four measurable thresholds were met; the supplier assessment coverage objective was not, and the report gives no explanation for the four-point fall.

Incidents of corruption or bribery

Reference: page 214.

Section 4.1.5, "Performance measures related to 'Business conduct' [G1-4 including MDR-M]", carries both the incident return and the programme metrics.

Confirmed incidents. "To the best of the Company's knowledge at the time of writing this sustainability statement, neither Sopra Steria, nor its subsidiaries nor any member of an administrative or management body have been found guilty of or been fined for corruption or influence peddling at any time in the last five years. Furthermore, no confirmed corruption incidents (0) were recorded via the Group's whistleblowing procedure in 2025."

This is a complete nil return covering both convictions and internally confirmed incidents, and it extends back five years for the entity and its officers.

Programme metrics disclosed alongside it:

• EcoVadis "Ethics" category score: 88/100 in 2025, against 90/100 in 2024. The Group's overall EcoVadis score is 94/100, "up 2 points compared to last year"
• Completion rate of the mandatory all-employee compliance e-learning: 90% at end-December 2025, against 93% in 2024
• Completion rate for the most at-risk roles, being management, sales, finance and purchasing: 90% at end-December 2025, against 92% in 2024
• Share of 2025 target expenditure receiving a positive EcoVadis assessment above 45/100: 73%, down four points from 2024

Related nil returns elsewhere. "No fine, penalty or compensation for damages relating to an incident of discrimination or harassment or due to a complaint was paid during 2025" (page 184), and "no complaints were filed against Sopra Steria with the various national contact points for OECD multinational enterprises during financial year 2025 or previous financial years" (page 217).

Not disclosed: any breakdown of incidents by function or region, since the count is zero, and no separate figure for incidents relating to breaches of other business conduct procedures.