UPM Annual Report 2025

We are UPM

Governance

Accounts and performance

Sustainability Statement

Report of the Board of Directors

Financial Statements

Auditor's Report

Sustainability Assurance Reports

Respect for human rights The UPM Supplier and Third-Party Code states that UPM's suppliers and third parties must: • Treat people (e.g., own employees, employees of contractors and other suppliers, and stakeholders) with dignity. • Respect universal human rights such as access to clean and healthy environment, freedom of thought, opinion, expression, religion, and freedom from any discrimination based on e.g., race, age, nationality, gender or sexual orientation, political or union affiliation, or freedom from any form of harassment. • Identify, prevent, and mitigate adverse human rights impacts in its operations and activities. • Provide adequate wages and respect local laws and applicable industry standards on working time and compensation, freedom of association, and right to collective bargaining. • Respect children's rights and not use or tolerate the use of child labor. Follow the minimum age set by local laws or the International Labour Organization’s (ILO) definition of minimum age of 15 years, whichever is higher. Ensure that special protections are in place for young workers (those below the age of 18 and above the legal minimum working age). • Ensure no form of forced labor (including, but not limited to, modern slavery and human trafficking) is used or tolerated in any of its operations or activities directly or indirectly. • Ensure the health, safety, and security of its employees, other people working on its sites and premises (e.g. employees of contractors), visitors as well as other people impacted by its operations. • Comply with UPM's safety requirements when working at or visiting UPM sites and carry out necessary safety training. Ensure that the rights and title to property and land of the individual, indigenous people, and local communities are respected. UPM strives to ensure compliance with its values and commitments by implementing a company-wide compliance program through the UPM compliance system. The compliance system is embedded in UPM's governance model and is designed to enhance company performance and a culture of integrity at all levels. Risk assessments, including human rights-related risks, are part of the UPM compliance system. Refer to » G1-3 UPM Compliance system UPM has ongoing due diligence processes to identify, prevent, mitigate, and account for how UPM addresses its adverse impacts on people or the environment. In terms of human rights and environmental due diligence in its supply chain, UPM uses a risk-based approach that consists of various elements applied before and during the onboarding of new suppliers and monitoring of business partners. These elements include counterparty screening, enhanced due diligence and Know Your Supplier screenings, forest and other certification systems, third-party sustainability assessments by EcoVadis, and the high sustainability risk supplier framework and model. We also conduct regular supplier audits and contractor reviews. In 2025, UPM carried out 80 (97) supplier audits and reviews globally. In addition, subcontractor workers were interviewed on their terms and conditions of work during the pulp mill maintenance shutdowns in Finland. In Uruguay, about 2000 contractor reviews focusing on working conditions were carried out. Refer to » G1-2 Supplier audits and reviews

Country- and commodity- and industry-specific risks are assessed and mitigated within the scope of UPM's high sustainability risk supplier framework. These risks may occur beyond the second tier of UPM's supply chains and are commonly linked to primary production (such as agriculture, forestry, and mining) and/or countries' contexts where the rule of law is weaker. Results of UPM's human rights due diligence As part of UPM's ongoing human rights due diligence, UPM has identified groups who are at higher risk of experiencing potential adverse human rights impacts. Based on UPM's assessments and dialogue with various stakeholders, UPM has defined migrant workers, women, young workers, and temporary and contractor workers as groups with a higher risk of potential adverse human rights impacts across UPM's value chain. UPM also recognizes that indigenous people are often among the most marginalized and vulnerable populations. UPM has identified its salient human rights issues, i.e. human rights that are at risk of the most severe negative impact from UPM's operations or business relationships. UPM regularly analyzes the saliency of its human rights impacts based on severity and likelihood, recognizing that UPM's impacts on people continue to evolve as its business changes, and its approach to due diligence develops. UPM has identified forced labor and labor exploitation as a salient human rights risk in some of UPM's contracted services and global supply chains and recognizes migrants as a particularly vulnerable group of workers. In the latest saliency assessment, the risk rating of certain on site and forestry services was updated, and particular attention was paid to various business development projects and their assessment of human rights risks. UPM does not use or tolerate the use of forced labor in any form in its own operations or in its supply chains. Human rights due diligence is part of UPM's overall sustainability due diligence processes. Refer to » ESRS 2 GOV- 4 Sustainability due diligence

For processes related to engagement with value chain workers and measures to provide and/or enable remedy for human rights, refer to » S2-2 and » S2-3. Processes Processes for engaging with value chain workers Stakeholder engagement is an essential part of UPM's business operations and activities and is implemented as appropriate to the topic and the nature and scale of the activities. Occupational health and safety is one of UPM's salient human rights issues in the supply chain. UPM's internal H&S audit program includes engagement with contractors’ employees. Contractors and their employees on UPM's sites are required to adopt UPM's safe working practices and to comply with the rules and standards established by UPM. UPM also expects them to participate in hazard identification and proactive safety reporting. Before entering a UPM production site, contractors are required to attend UPM's safety induction and training, which covers the company's safety requirements. In UPM's wood sourcing and forestry operations a continuous dialogue with stakeholders is also essential. The FSC Controlled Wood requirements are the minimum requirements that UPM applies to all its sourced wood (100% coverage). The requirements include a wide range of criteria related to the legality of the wood, respect for traditional and civil rights (including the rights of indigenous and tribal people), protection of areas of high conservation values, maintaining or improving the social and economic well-being of workers, and stakeholder engagement and dialogue. Processes are in place for providing feedback or submitting concerns to UPM. Refer to » S2-3 Processes for raising and handling concerns . Feedback and concerns are handled promptly in accordance with the chain-of-custody, forest certification and ISO 14001 environmental management systems. Stakeholders are informed of the actions taken by UPM in response to their feedback. There is also an annual stakeholder consultation process related to UPM's FSC forest management certificates. The focus of the consultation process is to identify forests with high conservation values and the actions required to maintain them. During the consultation process, stakeholders are also invited to express their other views on forest certification. In general, UPM's human rights due diligence processes include steps and measures to gain insight into the perspective of workers. These include forest certification systems and related audits and worker engagement, supplier audits, and contractor reviews, including respective worker interviews and continuous dialogue with suppliers by UPM sourcing professionals or through collaboration forums such as the Together for Sustainability (TfS) initiative or UN Global Compact. In Uruguay, UPM conducts social monitoring involving contractor workers. UPM also promotes local and global grievance mechanisms. S2-2

Policies

S2-1

The UPM Code of Conduct expresses the Company's respect for people and human rights, the environment, and ethical business practices. The Code is complemented by UPM's Sustainability Policy Statement, which addresses the topic and related processes in more detail. The UPM Supplier and Third-Party Code sets out minimum requirements for the value chain. Refer to » G1-1 Policies In addition, specific aspects are covered in the following policy documents, programs and supplier requirements: • Supplier Assessment Criteria • UPM Sustainable Supply Chain Program, Refer to » G1-2 Sustainable Supply Chain Program • Category-specific requirements, e.g. for wood suppliers, pulp, chemicals, on-site contractors, or logistics • UPM Forest Action Program • UPM Safety Rules, Refer to » S1-1 UPM’s Human Resources & Safety Rules • UPM Safety requirements for contractors • UPM Standard for Community Engagement and the Share and Care Program The UPM Supplier and Third-Party Code covers all suppliers and third parties (e.g. agents, advisers, representatives, joint ventures, joint venture partners, local partners, and distributors) acting on behalf of UPM. Suppliers are also covered by UPM's Sustainable Supply Chain Program, which addresses social topics, as well as environment and governance. In addition, wood suppliers and forest contractors are covered by the UPM requirements for wood suppliers and the UPM Forest Action Program. UPM's Safety Rules cover UPM's own workforce, as well as UPM's business partners and their employees, i.e. contractors, working on UPM's production sites and forest operations. These Rules are specified in more detail in UPM's Safety requirements for contractors. UPM's human rights policy commitments UPM is committed to respecting human rights in line with the United Nations Guiding Principles on Business and Human Rights. UPM respects the UN Universal Declaration of Human Rights, the ILO Declaration on Fundamental Principles and Rights at Work, and the OECD Guidelines for Multinational Enterprises. UPM also promotes the human-rights-related principles of the UN Global Compact. UPM expects a similar commitment from its suppliers, third parties, and joint venture partners, as set out in the UPM Supplier and Third-Party Code.

UPM Financial Report 2025

224

UPM Financial Report 2025

225

224

225

UPM Annual Report 2025

UPM Annual Report 2025