UPM Annual Report 2025

We are UPM

Governance

Accounts and performance

Sustainability Assurance Reports

Report of the Board of Directors

Sustainability Statement

Financial Statements

Auditor's Report

ASSURANCE REPORT ON THE SUSTAINABILITY STATEMENT (Translation of the Finnish original) To the Annual General Meeting of UPM-Kymmene Oyj

Description of the Procedures That Have Been Performed The procedures performed in a limited assurance engagement vary in nature and timing from, and are less in extent than for, a reasonable assurance engagement. The nature, timing and extent of assurance procedures selected depend on professional judgment, including the assessment of risks of material misstatement, whether due to fraud or error. Consequently, the level of assurance obtained in a limited assurance engagement is substantially lower than the assurance that would have been obtained had a reasonable assurance engagement been performed. • We have interviewed the management of the group as well as key personnel responsible for collecting and reporting of the information included in the group sustainability statement. • Through interviews, we gained an understanding of the group's control environment related to the group sustainability reporting process. • We evaluated the implementation of the company's double materiality assessment process in relation to the requirements of the ESRS standards, as well as whether the information provided from the double materiality assessment is in material respects in accordance with the ESRS standards. • We assessed whether the group sustainability statement in material respects meets the requirements of the ESRS standards regarding material sustainability topics: – We have tested the accuracy of the information presented in the group sustainability statement by comparing the information on a sample basis to the documentation and records prepared by the company and assessed whether they support the information included in the group sustainability statement. – We have on a sample basis performed analytical assurance procedures and related inquiries, recalculations and inspected documentation, as well as tested data aggregation to assess the accuracy of the group sustainability statement. Our procedures included for ex. the following:

We have performed a reasonable assurance engagement of Scope 1 and Scope 2 GHG emissions (the “GHG emissions”) contained in the group sustainability statement of UPM-Kymmene Oyj (1041090-0) that is referred to in Chapter 7 of the Accounting Act and the sustainability reporting standards (ESRS) (the “Criteria”) and that is included in the report of the Board of Directors for the reporting period 1.1.–31.12.2025. Other than as described in the preceding paragraph, which sets out the scope of our engagement, we did not perform reasonable assurance procedures on the remaining information included in the group sustainability statement and accordingly, we do not express an opinion on this information. Opinion In our opinion, Scope 1 and Scope 2 GHG emissions for the financial year 1.1-31.12.2025 are presented, in all material respects, in accordance with the requirements laid down in Chapter 7 of the Accounting Act and the sustainability reporting standards (ESRS). Our opinion does not cover the tagging of the group sustainability statement with digital XBRL sustainability tags in accordance with Chapter 7, Section 22, Subsection 1(2), of the Accounting Act, because sustainability reporting companies have not had the possibility to comply with that requirement in the absence of requirements for the tagging of sustainability information in the ESEF regulation or other European Union legislation. Basis for Opinion We performed the assurance of the group sustainability statement as a reasonable assurance engagement in compliance with good assurance practice in Finland and with the International Standard on Assurance Engagements (ISAE) 3000 (Revised) Assurance Engagements Other than Audits or Reviews of Historical Financial Information . Our responsibilities under this standard are further described in the Responsibilities of the Authorized Group Sustainability Auditor section of our report. Authorized Group Sustainability Auditor's Independence and Quality Management We are independent of the parent company and of the group companies in accordance with the ethical requirements that are applicable in Finland and are relevant to our engagement, and we have fulfilled our other ethical responsibilities in accordance with these requirements. The Authorized Group Sustainability Auditor applies International Standard on Quality Management ISQM 1, which requires the Authorized Sustainability Audit Firm to design, implement and operate a system of quality management including policies or procedures regarding compliance with ethical requirements, professional standards and applicable legal and regulatory requirements. Responsibilities of the Board of Directors and the Managing Director The Board of Directors and the Managing Director of UPM-Kymmene Oyj are responsible for: We believe that the evidence we have obtained is sufficient and appropriate to provide a basis for our opinion.

• We conducted site visits at selected locations.

• Regarding the EU Taxonomy data, we gained an understanding of the process by which a company has defined taxonomy eligible and taxonomy-aligned economic activities, and we assessed the compliance of the information provided.

Helsinki 12.2.2026 Ernst & Young Oy Authorized Sustainability Audit Firm

Heikki Ilkka Authorized Sustainability Auditor

UPM Financial Report 2025

352

UPM Financial Report 2025

353

352

353

UPM Annual Report 2025

UPM Annual Report 2025