UPM Annual Report 2025

We are UPM

Governance

Accounts and performance

Sustainability Statement

Report of the Board of Directors

Financial Statements

Auditor's Report

Sustainability Assurance Reports

topics (IROs), prepares the Remuneration Policy for adoption at the AGM, oversees procedures related to executive remuneration, reviews and recommends sustainability targets in executive remuneration for Board approval, and regularly reviews executive performance against remuneration-related sustainability targets and prepares proposals for payout. Reflection of responsibilities in charters and policies Charter of the Board of Directors The Board’s responsibilities, outlined in the Charter of the Board of Directors, include strategic oversight, risk management, compliance and governance. Additionally, the Board monitors and assesses the company's financial reporting and the statutory sustainability reporting processes, ensuring the integrity of their reporting. The Board also oversees the assessment and management of risks related to the company's strategy and operations, including material sustainability risks. It monitors the company's audit and assurance related to statutory sustainability reporting and assesses the performance and independence of the sustainability report assurer. Charter of the Audit Committee The Audit Committee assists the Board in overseeing financial reporting, statutory sustainability reporting, internal control, internal audit and risk management. The Committee's responsibilities are detailed in the Charter of the Audit Committee. Charter of the Nomination and Governance Committee The Nomination and Governance Committee is responsible for identifying individuals qualified to serve as the President and CEO and for identifying candidates for election or re-election to the Board. The Committee also develops and recommends to the Board a set of corporate governance principles and reviews overall corporate governance of the company. These responsibilities are outlined in the Charter of the Nomination and Governance Committee. Charter of the Remuneration Committee The Remuneration Committee assists the Board with responsibilities related to the preparation of the company's remuneration principles and practices, including remuneration schemes and plans. The Committee's responsibilities are detailed in the Charter of the Remuneration Committee. Policies The UPM Code of Conduct sets out the principles that help UPM employees make ethical decisions and maintain high standards of integrity in UPM's daily operations. It applies to all UPM employees globally and serves as the basis for the company's corporate responsibility and compliance programs, policies, and procedures. Additionally, various Group policies outline specific responsibilities and procedures for managing risks and ensuring compliance with legal and regulatory requirements. These policies provide guidance on, for example, anti-corruption, risk management, and stakeholder engagement. The UPM Sustainability Policy Statement ensures that risks and impacts on people and the environment are considered throughout UPM's

operations. It requires UPM's businesses and functions to perform sustainability-related due diligence, conducting regular assessments of their impacts, and prioritizing the most severe issues for further focus and

action. It also defines the double materiality assessment (DMA) process to be carried out regularly to assess UPM's sustainability-related impacts, risks and opportunities. Refer to » G1-1 Policies

Oversight and management of impacts, risks and opportunities Board of Directors The Board of Directors approves the company strategy in the annual strategy session, oversees the Impact, Risk, and Opportunity (IRO) management with the assistance of the Board committees, and oversees the double materiality assessment (DMA) process with the assistance of the Audit Committee. The Board proposes the Remuneration Policy for adoption at the Annual General Meeting (AGM), approves the UPM Code of Conduct and UPM Group Policies in accordance with the policy management structure. It also approves the appointments and remuneration of members of the Group Executive Team and some senior management representatives, approves Group-level sustainability targets for the remuneration of members of the Group Executive Team and some senior management representatives, oversees key Group-level actions related to strategy implementation and progress against key Group-level sustainability targets, and oversees the independence of the Board. Nomination and Governance Committee The Nomination and Governance Committee regularly reviews governance matters and assesses how these interact with the strategy and business model. It prepares the Diversity Policy of the Board of Directors for Board approval and oversees its implementation, reviews the structure, size, composition, diversity, and successional need of the Board as a whole and prepares proposals to the Annual General Meeting (AGM) for director elections, and their remuneration. The committee also prepares the succession plan and appointment of the President and CEO, and oversees Board skills and expertise in sustainability and business conduct matters. Audit Committee The Audit Committee regularly reviews material sustainability topics (IROs) and assesses how they interact with the strategy and business model. It assists the Board in the oversight of the DMA process, monitors compliance with applicable legal and regulatory requirements, the UPM Code of Conduct, and other corporate policies, monitors and assesses the effectiveness of internal controls and audit, as well as risk management, regularly reviews assurance matters, including risk management, internal controls, compliance, internal and external audits, and regularly reviews sustainability matters and information in the report of the Board of Directors including the statutory Sustainability Statement. In addition to undertaking the assigned matters and regular reports listed above, the Audit Committee also reviewed reports on and discussed ESG and cybersecurity, reviewed the Disclosure Policy amendment and the share buyback program conducted in 2025. The Board is informed, as part of the Audit Committee Chair’s regular reporting to the Board, of any submissions received by the Committee from stakeholders that have a material impact on the economy, the environment or people. Remuneration Committee The Remuneration Committee regularly reviews selected material social sustainability topics (IROs) related to the company's own workforce and assesses how they interact with the strategy and business model. It regularly reviews how remuneration is linked to material sustainability

Management's role in sustainability UPM's governance structure

Group Executive Team The Group Executive Team (GET), led by the President and CEO, is responsible for managing sustainability, determining course of action and guiding development. The GET is responsible for managing impacts, risks and opportunities at Group level and approves the Group's double materiality assessment, the sustainability focus areas, targets and key performance indicators, sustainability actions and sustainability-related policies and rules. The President and CEO reports to the Board on relevant decisions and progress. Strategy Team Among other matters, the Strategy Team assists the President and CEO in integrating sustainability into the Group's strategy for the Boards' approval. The Strategy Team prepares proposals for updating UPM's strategy and strategic plans and is responsible for identifying and managing UPM's key strategic risks.

Businesses and functions The role of the Business Area Boards is to make decisions at the business area level on, among other things, sustainability issues and to oversee the implementation of Group-level policies, rules, guidelines and procedures in the business area. In practice, sustainability efforts, including managing impacts, risks and opportunities, implementing targets and actions, reporting on progress and compliance status, and contributing to the double materiality assessment, take place in businesses and functions. Compliance controls and procedures As part of the Audit Committee’s compliance review, the Committee receives a quarterly report from the company's Chief Compliance Officer and a report from the SVP of Internal Audit on the submissions made through the UPM Report Misconduct channel. With the support of UPM's Compliance Team, each business area, function and unit is responsible for identifying and managing compliance risks related to its own

UPM Financial Report 2025

140

UPM Financial Report 2025

141

140

141

UPM Annual Report 2025

UPM Annual Report 2025