UPM Annual Report 2024

First page Table of contents Previous page 224-225 Next page Last page

WE ARE UPM

GOVERNANCE

ACCOUNTS AND PERFORMANCE

Report of the Board of Directors

Sustainability Statement

Financial Statements

Auditor's Report

Sustainability Assurance Reports

IMPACTS, RISKS AND OPPORTUNITIES

Results of UPM's human rights due diligence As part of UPM's ongoing human rights due diligence, UPM has identified groups who are at higher risk of experiencing potential adverse human rights impacts. Based on UPM's assessments and dialogue with various stakeholders, UPM has defined migrant workers, women, young workers, and temporary and contractor workers as groups with a higher risk of potential adverse human rights impacts across UPM's value chain. UPM also recognises that indigenous people are often among the most marginalised and vulnerable populations. With an external expert, UPM has identified its salient human rights issues, i.e. human rights that are at risk of the most severe negative impact from UPM's operations or business relationships. UPM regularly analyses the saliency of its human rights impacts based on severity and likelihood, recognising that UPM's impacts on people continue to evolve as its business changes, and its approach to due diligence develops. UPM has identified forced labour as a salient human rights risk in some of UPM's contracted services and global supply chains and recognises migrants as a particularly vulnerable group of workers. UPM does not use or tolerate the use of forced labour in any form in its own operations or in its supply chains. Human rights due diligence is part of UPM's overall sustainability due diligence processes. » Refer to ESRS 2 GOV- 4 Sustainability due diligence The UPM Code of Conduct expresses the Company's respect for people and human rights, the environment, and ethical business practices. The Code is complemented by UPM's Sustainability Policy Statement, which addresses the topic and related processes in more detail. The UPM Supplier and Third-Party Code sets out minimum requirements for the value chain. » Refer to G1-1 Policies In addition, specific aspects are covered in the following policy documents, programmes and supplier requirements: • Supplier Assessment Criteria • UPM Sustainable Supply Chain Programme » Refer to G1-2 Sustainable Supply Chain Programme • Category-specific requirements, e.g. for wood suppliers, pulp, chemicals or logistics • UPM Forest Action Programme • UPM Safety Rules » Refer to S1-1 UPM’s Human Resources & Safety Rules • UPM Safety requirements for contractors The UPM Supplier and Third-Party Code covers all suppliers and third parties (e.g. agents, advisers, representatives, joint ventures, joint venture partners, local partners, and distributors) acting on behalf of UPM). Suppliers are also covered by UPM's Sustainable Supply Chain Programme, which addresses social topics, as well as environment and governance. In addition, wood suppliers and forest contractors are covered by the UPM requirements for wood suppliers and the UPM Forest Action Programme. UPM's Safety Rules cover UPM's own workforce, as well as UPM's business partners and their employees, i.e. POLICIES S2-1

contractors, working on UPM's production sites and forest operations. These Rules are specified in more detail in UPM's Safety requirements for contractors. UPM's human rights policy commitments UPM is committed to respecting human rights in line with the United Nations Guiding Principles on Business and Human Rights. UPM respects the UN Universal Declaration of Human Rights, the ILO Declaration on Fundamental Principles and Rights at Work, and the OECD Guidelines for Multinational Enterprises. UPM also promotes the human-rights-related principles of the UN Global Compact. UPM expects a similar commitment from its suppliers, third parties and joint venture partners, as set out in the UPM Supplier and Third-Party Code. Respect for human rights The UPM Supplier and Third-Party Code states that UPM's suppliers and third parties must: • Treat people (e.g. own employees, employees of contractors and other suppliers, and stakeholders) with dignity. • Respect universal human rights such as access to clean and healthy environment, freedom of thought, opinion, expression, religion, and freedom from any discrimination based on e.g. race, age, nationality, gender or sexual orientation, political or union affiliation, or freedom from any form of harassment. • Identify, prevent, and mitigate adverse human rights impacts in its operations and activities. • Provide adequate wages and respect local laws and applicable industry standards on working time and compensation, freedom of association, and right to collective bargaining. • Respect children's rights and not use or tolerate the use of child labour. Follow minimum age set by local laws or the International Labour Organization’s (ILO) definition of minimum age of 15 years, whichever is higher. Ensure that special protections are in place for young workers (those below the age of 18 and above legal minimum working age). • Ensure no form of forced labour (including, but not limited to, modern slavery and human trafficking) is used or tolerated in any of its operations or activities directly or indirectly. • Ensure the health, safety, and security of its employees, other people working on its sites and premises (e.g. employees of contractors), visitors as well as other people impacted by its operations. • Comply with UPM's safety requirements when working at or visiting UPM sites and carry out necessary safety training. Ensure that the rights and title to property and land of the individual, indigenous people and local communities are respected. UPM strives to ensure compliance with its values and commitments by implementing a Company-wide compliance programme through the UPM compliance system. The compliance system is embedded in UPM's governance model and is designed to enhance Company performance and a culture of integrity at all levels. Risk assessments, including human rights-related risks, are part of the UPM compliance system. » Refer to G1-3 UPM Compliance system UPM has ongoing due diligence processes to identify, prevent, mitigate and account for how UPM addresses its adverse impacts on people or the environment. In terms of human rights and environmental due diligence in its supply chain, UPM uses a risk-based approach that consists of various elements applied before and during the onboarding

ESRS 2 SBM-3

Overview of material impacts, risks and opportunities

MATERIAL TOPICS IMPACTS, RISKS AND OPPORTUNITIES DESCRIPTION Sourcing Potential negative impact*: Human rights violations affecting people in the supply chain

There is a risk in UPM's multi-tier supply chain related to labour exploitation, forced labour, health and safety, and environmental incidents, for example. UPM's sourcing practices aim to minimise the risk and any potential negative impacts to people or the environment. UPM seizes sustainability-related opportunities to create business value through supplier development and collaboration. UPM's sourcing targets focus on selected environmental, social and governance issues. UPM uses joint development and innovation projects with its suppliers and various sustainability initiatives to promote sustainability in the selected areas. Lack of skilled workforce is a risk for UPM's supply chains and sourcing. Traditional blue collar jobs may not attract new skilled employees e.g. in forest harvesting or traditional manufacturing jobs. Contractor safety is a Group-wide focus area for the Company. All contractor workers receive a general safety induction and detailed safety training focusing on specific risks at their workplace. UPM's Group-wide safety project aims to give a new boost to UPM's safety culture and address the changes needed throughout the organisation. Although several measures are taken to prevent injuries and accidents to employees and contractors at UPM's production sites and forestry operations, a risk remains. The importance of health and safety is also addressed and followed up with contractors, but negative impacts can occur. These negative impacts are related to individual incidents. Failure to maintain a high level of safety management could result in physical injury, illness or liability to UPM's contractors or third parties. These risks are managed through established management procedures, health and safety precautions, and loss prevention programmes. • Workers working on the undertaking site but who are not part of UPM's own workforce: Contractors and their workers or sub contractors who work at UPM's production sites and forestry operations. The workers are controlled by the contractor and perform services such as technical and maintenance services, construction services and forestry services, facility services like cleaning, catering or security, IT services, etc. • Workers working for entities in the undertaking's upstream value chain: Workers and contractors working for UPM's suppliers such as suppliers of raw materials or services. • Workers working for entities in the undertaking’s downstream value chain: Workers and contractors working for UPM's service suppliers such as suppliers for outbound logistics. • Particularly vulnerable workers: UPM recognises young workers, migrant workers, women, indigenous peoples, and temporary and contractor workers as having a higher risk of potentially experiencing adverse human rights impacts. Country- and commodity- and industry-specific risks are assessed and mitigated within the scope of UPM's high sustainability risk supplier framework. These risks may occur beyond the second tier of our supply chains and are commonly linked to primary production (such as agriculture, forestry and mining) and/or countries' contexts where the rule of law is weaker.

Opportunity: Creating business value through supplier development and collaboration

Risk: Disruptions in UPM's supply chain

Positive impact: Increased focus on health and safety measures for contractors working at UPM's operations Negative impact*: Health and safety incidents, including serious accidents and fatalities for contractors working at UPM's operations

Health and safety at UPM sites and forestry operations

Risk: Potential injury to UPM's contractors or third parties working at UPM’s operations

* UPM's identified material potential negative impacts are not seen as widespread or systemic but are related to potential individual incidents.

Relation to UPM's business model and strategy Suppliers are an essential part of UPM's value chain. They also play an important role in UPM's business-specific growth projects. Supplier management, with the required competencies and digitalisation, boosts product development and the commercialisation of new products. » Refer to ESRS 2 SBM-1, Suppliers. UPM buys products, materials and services from some 23,000 B2B suppliers worldwide. Approximately 53,000 contractors' workers provide services, such as maintenance, construction, and logging at UPM's production sites and forestry operations every year. Description of value chain workers in UPM's reporting scope

The following categories of value chain workers could be materially impacted by UPM and are included in the scope of UPM's disclosure: