UPM Annual Report 2025

We are UPM

Governance

Accounts and performance

Sustainability Statement

Report of the Board of Directors

Financial Statements

Auditor's Report

Sustainability Assurance Reports

Sustainable Supply Chain Program UPM's responsible sourcing practices and priorities are formulated in the cohesive, overarching Sustainable Supply Chain Program. Each element contains clear instructions regarding the relevant sourcing and supply chain management practices and impacts at UPM, as well as tangible

A total of 715 (621) of UPM's suppliers completed and have valid sustainability assessments through EcoVadis in 2025. The results of the assessment show that 97% (95%) of UPM's suppliers assessed with EcoVadis have a low sustainability risk by supplier count. All suppliers that do not meet the low sustainability risk requirements are supported in developing their practices. Suppliers and UPM are able to monitor and benchmark suppliers' sustainability performance against industry averages through EcoVadis. Supplier compliance UPM is committed to responsible sourcing practices in accordance with the UPM Code of Conduct. The minimum requirements for suppliers are defined in the UPM Supplier and Third-Party Code. UPM requires its suppliers to ensure that their own suppliers and contractors, who provide products or services related to the agreement between the supplier and UPM, comply with the UPM Supplier and Third-Party Code or similar standards. In 2025, 86% (91%) of UPM's total spend was with suppliers who are committed to the Supplier and Third-Party Code. Additional category-specific requirements apply to wood, chemicals, pulp, packaging materials, and logistics, for example. The requirements cover environmental performance, social responsibility, and reporting. Contractors working on UPM's production sites must comply with UPM's safety requirements. UPM seizes sustainability-related opportunities to create business value through supplier development and collaboration. UPM actively participates in various development and innovation projects with suppliers and joins different sustainability initiatives when feasible. Sourcing objectives focus on selected environmental, social, and governance issues (illustrated on the previous page). In 2025, UPM continued to work closely with Together for Sustainability (TfS) on supply chain compliance and sustainability topics.

-30 by 30 Program for CO 2 reduction The Group-wide -30 by 30 Program to reduce CO 2 emissions in the supply chain focuses on cooperation in climate actions. Refer to » E1-3 Responsible sourcing: UPM's -30 by 30 Program, for more information Communication and training UPM offers capacity building sessions on its supply chain compliance and sustainability topics to its employees and suppliers. Throughout 2025, various internal trainings and awareness sessions on supplier engagement and status were held. Training for internal stakeholders regarding the updated UPM Supplier and Third-Party Code was organized in 2025. A total of 597 UPMers completed the internal training on the UPM Supplier and Third-Party Code, while the UPM Supplier and Third-Party Code training for external stakeholders was developed and launched in 2025. So far, 248 UPM employees completed e-learning training on the Sustainable Supply Chain Program since the launch. Individual supplier meetings were held during the year to support and raise awareness of the program's expectations and means of collaboration with suppliers. For 2026, both internal and external capacity building sessions will continue with an increased focus on external stakeholder engagement. In connection with the -30 by 30 Program for CO 2 emission reduction in the supply chain, UPM provides capacity building programs for its employees and suppliers. Supplier meetings were held to ensure awareness of climate actions related to UPM's Scope 3 CO 2 emissions, support on product carbon footprint calculation methodology, and collaboration on decarbonization. Internal trainings on supply chain decarbonization, e.g. on the –30 by 30 Program and the calculation of a product carbon footprint, were provided via an e-learning solution and were completed by 110 employees so far.

guidelines, requirements, and expectations for UPM's suppliers. Effective implementation is managed and tracked through UPM's 2030 sustainability targets, performance indicators, and capacity building programs.

Risk mitigation UPM identifies suppliers with the greatest business relevance and supply chains with a high risk of potential negative environmental and social impacts. Risk management contingency plans have been created for identified high sustainability risk suppliers. The evaluation is based on the country of origin, the sourced material or service, and the UPM supply chain ESG risk register, which includes country-, commodity-, and sector specific sustainability risk insights. The UPM Sourcing Risk Management Steering Group evaluates the development of all sourcing and supply chain risks and oversees the implementation of risk management strategies and actions EcoVadis and other assessments, supplier audits and reviews, and joint development plans are used to conduct more detailed evaluations of suppliers' activities. All suppliers are regularly screened using a counterparty risk management tool. If non-conformities are identified, the supplier is required to take corrective measures. UPM monitors the implementation of these measures and provides support to improve the suppliers' operations if necessary. Some contracts may have to be terminated due to insufficient measures or the seriousness of UPM's findings.

Supplier audits and reviews Supplier audits and reviews are defined based on, but not limited to, identified risks related to social and environmental topics, including human rights. In 2025, UPM carried out 80 (97) supplier audits and reviews globally. 56 (62) were conducted by UPM's own trained auditors and 24 (35) were carried out by external auditors from independent accredited auditing bodies. 347 (376) sustainability-related findings were identified in these audits. In 2025, none of the findings were considered critical with regard to actual or potential significant environmental or social impacts. All findings are followed up with corrective potential further audits in close collaboration with the suppliers. In addition, about 2,000 (3,200) contractor reviews focusing on working conditions were carried out in Uruguay. UPM has a comprehensive contractor assurance system in Uruguay. Assurance consists of compliance reviews covering labor and other document audits and field audits focusing on security, safety, and working standards. The information gathered in field audits is cross-examined against the pre-existing data.

UPM Financial Report 2025

240

UPM Financial Report 2025

241

240

241

UPM Annual Report 2025

UPM Annual Report 2025