UPM Annual Report 2025

We are UPM

Governance

Accounts and performance

Sustainability Statement

Report of the Board of Directors

Financial Statements

Auditor's Report

Sustainability Assurance Reports

The Senior Vice President of the Sourcing function and the Executive Vice Presidents of the business areas have the operational responsibility for ensuring engagement with value chain workers. Processes for raising and handling concerns

• During pulp mill maintenance shutdowns in Finland, UPM interviewed subcontractor employees to assess their working conditions. These interviews were followed by feedback sessions with contractors. • UPM introduced training for its renewed Supplier and Third-Party Code both for its employees and suppliers. • Further advances were made in the supply chain collaboration program between UPM and its direct starch suppliers, which focuses on improving the working conditions of the farm workers in Thailand (UPM's tier 2-3 suppliers). Building on the previous program stages of farm auditing, identification of improvement areas, target setting and action planning, the program introduced Sustainable Agriculture Initiative's (SAI) Farm Sustainability Assessment (FSA) as a means of establishing and verifying adequate labor conditions at farms. • A Corporate Human Rights Saliency Assessment was carried out. • Implementation of the Sustainable Supply Chain Program continued. Planned actions • Continue development work and actions to achieve the targets set for 2030. • Continue the contractor management project in 2026. Refer to » S2-4 Responsible sourcing, Actions in 2025 • Drive the implementation of the sustainable supply chain program in sourcing categories: The most relevant program themes for each sourcing category will be identified and integrated into category plans and strategies to guide everyday supplier management activities. Health and safety of contractors working on UPM sites and forest operations UPM's safety work is based on long-term planning, effective communication, and leadership. Safety is integrated into all daily operations, and measures and standards cover UPM's own workforce, as well as contractors working on UPM's production sites and forest operations. For more information on key actions, actions in 2025 and planned actions, Refer to » S1-4 Safe and healthy working environment UPM's actions, » S2-4 Actions, and targets , » S2-5 Targets, address the material risk which UPM identified related to workers in the value chain, » S2-1 Overview. The effectiveness of actions is tracked by a regular follow-up of targets. At the same time, the actions support the identified material opportunity by creating business value through supplier development and collaboration. Refer to » S2-1 Overview

Incidents and remediation In 2025, no severe human rights incidents were reported in connection with UPM's value chain that were caused or contributed to by UPM's activities. UPM monitors and works to remedy adverse human rights impacts of which it is aware, and which its activities have caused or contributed to. Remediation is specified case by case, based on verified impacts. The UPM compliance system covers remedy practices and ensures the adequacy of the process. Resources In general, activities related to workers in the value chain are included in UPM's investment and resource planning.

Actions

S2-4

UPM's identified material topics have been defined as a result of a double materiality assessment, including UPM's Corporate Human Rights Saliency Assessment, considering impacts, risks, and opportunities related to workers in the value chain. The following UPM focus areas are relevant for workers in the value chain: • Responsible sourcing (with a target on spend covered by UPM Supplier and Third-Party Code); • Forestry (with a target for certified fibre share) • Safe and healthy working environment (with targets for fatalities, serious accidents and injury frequency) Action plans have been established to achieve the Group-level targets, as well as other relevant areas for continuous improvement. The key actions, previous year's key actions, planned key actions and overarching concepts are presented below. UPM monitors the effectiveness of its actions to manage material impacts by tracking and reporting on the progress of its sustainability targets for 2030. Refer to » S2-5 Targets. Furthermore, UPM reviews the effectiveness of its risk management procedures quarterly through its Compliance system. Refer to » G1-3 UPM compliance system Responsible sourcing Key action UPM's responsible sourcing practices and priorities are formulated in the cohesive overarching Sustainable Supply Chain Program. Refer to » G1-2 Sustainable Supply Chain Program for a general description of the program and the risk mitigation approach . The program defines prioritized ESG topics. In the social area, these are labor and human rights, as well as health and safety. Based on systematic risk assessment, UPM engages in informed risk mitigation activities. UPM sourcing professionals promote respect for people and human rights among their suppliers. This means understanding the relevant risks associated with their sourcing categories, integrating these considerations into category strategies, and planning and implementing appropriate management activities. These activities can entail further supplier assessments, audits, and relevant corrective actions. • UPM continued its efforts in contractor management, focusing on contractors operating at UPM's production sites and in forestry. Limitations on the use of subcontractors were introduced, and the contractual requirements related to social responsibility and labor rights, specifically for on-site work, were strengthened. Furthermore, the subcontractor approval and due diligence processes were developed and internal trainings were organized to identify and address social responsibility risks in subcontracting chains. Actions in 2025 • Refer to » G1-2 Supplier audits and reviews

S2-3

UPM monitors and works to remediate negative human rights impacts of which it becomes aware, and which the company's activities have contributed to or caused. Remediation is specified case by case, based on verified impacts. UPM establishes channels for reporting concerns, reviews reports carefully, handles personal data appropriately, ensures protection against retaliation, and treats all reports in strict confidence. Investigations are conducted by designated people with the necessary competences. If a report is substantiated, UPM takes appropriate disciplinary and/or legal action, and lessons are learned. Refer to » G1-1 Reporting and identifying concerns Local stakeholders can report their concerns directly to UPM representatives at the mills and other sites and through locally provided channels such as email and telephone. In addition, UPM has other local grievance channels for specific business contexts and local needs such as the “how am I driving” solution in Uruguay, which focuses on road safety. UPM Report Misconduct channel SpeakUp® is communicated to the suppliers as part of the UPM Supplier and Third-Party Code. Suppliers are also informed about the existing grievance mechanisms, e.g. during supplier audits and other interactions such as contractor safety induction. The forest certification systems also have existing grievance mechanisms.

UPM Financial Report 2025

226

UPM Financial Report 2025

227

226

227

UPM Annual Report 2025

UPM Annual Report 2025