UPM Annual Report 2023

GOVERNANCE

UPM

BEYOND FOSSILS

BUSINESSES

RESPONSIBILITY

ACCOUNTS FOR 2023

INDEPENDENT PRACTITIONER’S LIMITED AND REASONABLE ASSURANCE REPORT ON UPM KYMMENE CORPORATION’S CORPORATE RESPONSIBILITY INFORMATION

Regarding Inclusivity: UPM-Kym mene Corporation has processes in place for stakeholder inclusivity both at the group and at the business level. We recommend to keep assessing opportunities for extended stakeholder cooperation. Regarding Materiality: UPM-Kym mene Corporation has a systematic process in place to evaluate and determine the ma teriality of corporate responsibility topics. We recommend to continue to periodically assess both material topics and the process to determine materiality. Regarding Responsiveness: UPM-Kymmene Corporation has process es in place for responding to stakeholder needs. We recommend to continue using stakeholder inquiries and engaging with the stakeholders as sources of feeding information into the periodical materiality assessment process. Regarding Impact: UPM-Kymmene Corporation has a process in place to mon itor and measure the economic, environ mental and social impacts of its business activities. Financial impact has been incor porated further into materiality assessment in anticipation for reporting requirements of the Corporate Sustainability Reporting Directive (CSRD) (2022/2464/EU).

To the Management of UPM-Kymmene Corporation We have been engaged by the Man agement of UPM-Kymmene Corporation (business identity code 1041090-0, here inafter also the “Company”) to perform a limited assurance engagement on selected economic, social and environmental corpo rate responsibility indicators for the report ing period 1 January to 31 December 2023 as identified in the Company’s GRI Content Index 2023 and disclosed in the Company’s Annual Report 2023 and on the Company’s website in section “Responsibility” (herein after the “Selected Indicators”). Furthermore, the limited assurance engagement has covered the Company’s adherence to the AA1000 AccountAbility Principles (2018) with moderate (limited) level of assurance. We have been engaged by the Man agement of the Company to perform a reasonable assurance engagement on the Company’s direct and indirect (scope 1 + 2) fossil CO 2 emissions and on the Company’s partial value chain CO 2 emissions (Scope 3, Category 4: Maritime logistics) for the reporting period 1 January to 31 December 2023 as identified in the Company’s GRI Content Index 2023 and disclosed in the Company’s Annual Report 2023 and on the Company’s website in section “Re sponsibility” (hereinafter the “Selected Emissions”). Our limited and reasonable assurance report has been prepared in accordance with the terms of our engagement. We do not accept, or assume responsibility to anyone else, except to UPM-Kymmene Corporation for our work, for this assur ance report, or for the conclusions and the opinion that we have reached. Management’s responsibility The Management of UPM-Kymmene Cor poration is responsible for preparing the Selected Indicators and the Selected Emis sions in accordance with the Company’s

does not adhere, in all material respects, to the AA1000 AccountAbility Principles (2018) and that the Selected Indicators and the Selected Emissions are not reliable, in all material respects, based on the Report ing Criteria. In a limited assurance engagement, the evidence-gathering procedures are more limited than for a reasonable assurance engagement, and therefore less assurance is obtained than in a reasonable assurance engagement. A limited assurance engage ment involves performing procedures to obtain evidence about the amounts and other information in the Selected Indica tors and Selected Emissions, and about the Company’s adherence to the AA1000 AccountAbility Principles. The procedures selected depend on the practitioner’s judg ment, including an assessment of the risks of material misstatement of the Selected Indicators and the Selected Emissions and an assessment of the risks of the Company's material nonadherence to the AA1000 AccountAbility Principles. In conducting our limited assurance en gagement, our work consisted of, amongst others: • Interviewing of senior management of the Company and employees responsible for collecting and reporting the Selected Indicators and the Selected Emissions at the Group level and at selected sites. • Visiting the Company’s Head Office as well as two sites in Europe and South-America. • Interviewing employees from various or ganisational levels of the Company with regards to materiality, stakeholder expec tations, meeting of those expectations, as well as stakeholder engagement. • Assessing stakeholder inclusivity and responsiveness based on employee in terviews, company’s documentation and internal communication. Summary of the work performed for limited assurance conclusion

reporting instructions and GRI Standards of the Global Reporting Initiative (both together hereinafter “Reporting Criteria”). The Management of UPM-Kymmene Corporation is also responsible for the Company’s adherence to the AA1000 Ac countAbility Principles of inclusivity, mate riality, responsiveness and impact as set out in AccountAbility’s AA1000 AccountAbility Principles Standard 2018. The Management of UPM-Kymmene Corporation is also responsible for such internal control as the management determines is necessary to enable the preparation of the Selected Indicators and the Selected Emissions that are free from material misstatement, whether due to fraud or error. Inherent limitations When reading our limited and reasonable assurance report, the inherent limitations to the accuracy and completeness of corpo rate responsibility information should be taken into consideration. Practitioner’s independence and quality management and competence We have complied with the independence and other ethical requirements of the In ternational Code of Ethics for Professional Accountants (including International Independence Standards) issued by the International Ethics Standards Board for Accountants (IESBA code), which is found ed on fundamental principles of integrity, objectivity, professional competence and due care, confidentiality and professional behavior. PricewaterhouseCoopers Oy applies International Standard on Quality Man agement (ISQM) 1, which requires the firm to design, implement and operate a system of quality management including policies or procedures regarding compliance with ethical requirements, professional stand ards and applicable legal and regulatory requirements.

Our multi-disciplinary team of sustain ability and assurance specialists possesses the requisite skills and experience within financial and non-financial assurance, cor porate responsibility strategy and manage ment, social and environmental issues, as well as the relevant industry knowledge, to undertake this assurance engagement. Practitioner’s responsibility Our responsibility is to express a limit ed assurance conclusion on the Selected Indicators and on the Company’s adherence to the AA1000 AccountAbility Principles, and a reasonable assurance opinion on the Selected Emissions based on the proce dures we have performed and the evidence we have obtained. We conducted our limited assurance engagement and our reasonable assurance engagement in accordance with Inter national Standard on Assurance Engage ments (ISAE) 3000 (Revised) “Assurance Engagements Other than Audits or Reviews of Historical Financial Information” and, in respect of greenhouse gas emissions, International Standard on Assurance Engagements (ISAE) 3410 “Assurance En gagements on Greenhouse Gas Statements” . These standards require that we plan and perform the limited assurance engagement to obtain limited assurance about wheth er the Selected Indicators are free from material misstatement, and that we plan and perform the reasonable assurance en gagement to obtain reasonable assurance about whether the Selected Emissions are free from material misstatement. In addition, we have conducted our work in accordance with the AA1000 Assurance Standard v3. For conducting a Type 2 assurance engagement as agreed with the Company, the AA1000AS v3 requires planning and performing of the assurance engagement to obtain moderate (limited) assurance on whether any mat ters come to our attention that cause us to believe that UPM-Kymmene Corporation

• Testing the accuracy and completeness of information from original documents and systems on a sample basis. • Testing the consolidation of informa tion and performing recalculations on a sample basis • Considering the presentation and disclo sure of the Selected Indicators and the Selected Emissions. Limited Assurance Conclusion Based on the procedures we have per formed and the evidence we have obtained, nothing has come to our attention that causes us to believe that UPM-Kymmene Corporation’s Selected Indicators for the reporting period 1 January to 31 Decem ber 2023 are not properly prepared, in all material respects, in accordance with the Reporting Criteria, or that the Selected Indicators are not reliable, in all material respects, based on the Reporting Criteria. Furthermore nothing has come to our attention that causes us to believe that UPM-Kymmene Corporation’s Selected Emissions are not reliable, in all material respects, based on the Reporting Criteria or that UPM-Kymmene Corporation does not adhere, in all material respects, to the AA1000 AccountAbility Principles. Reasonable Assurance Opinion In our opinion, UPM-Kymmene Corpora tion’s Selected Emissions for the reporting period 1 January to 31 December 2023 are prepared, in all material respects, in accord ance with the Reporting Criteria. Observations and recommendations Based on the procedures we have per formed and the evidence we have obtained, we provide the following observations and recommendations in relation to UPM-Kym mene Corporation’s adherence to the AA1000 AccountAbility Principles (2018). These observations and recommendations do not affect the conclusions and the opin ion presented above.

Helsinki 16 February 2024 PricewaterhouseCoopers Oy

Tiina Puukkoniemi Partner, Authorised Public Accountant (KHT) Sustainability Reporting & Assurance Mikko Nieminen Partner, Authorised Public Accountant (KHT) Lead Financial Audit Partner

118

119

UPM ANNUAL REPORT 2023

UPM ANNUAL REPORT 2023