4.1. ESRS G1. Business Conduct

• 4.1.1. Governance
• 4.1.2. Incident, risk and opportunity management
• 4.1.3. Parameters and goals

Current and potential IROs

• Improved control of the sustainability strategy thanks to the work of the company's ESG committee.
• Protection of whistleblowers through anonymous communication and reporting channels, allowing free expression of employees and those in the value chain.
• Contribution to the proper compliance with regulations and ethical standards through the implementation of processes for records, documentation, new policies and periodic audits.
• Improving employee development and awareness through employee training on corruption and bribery.
• Building trust with regulatory bodies and authorities, clients and employees through compliance with rules and standards of conduct.
• Improving vision and identifying areas of vulnerability by creating a map of ethics and compliance risks, including criminal ones.

Policies and commitments

The basis of the Regulatory Compliance System is Viscofan's Code of Conduct, complemented by specific policies on matters of good governance, commercial, financial and tax resources, information and systems, people and production.

Sustainability goals, measures and progress

• Audit of compliance with the Supplier Code of Conduct for 100% of the suppliers of the main raw materials by 2030.
• Zero instances of corruption.

Bodies responsible for oversight

• Board of Directors.
• Audit Committee of the Board of Directors.
• Appointments, Remuneration and Sustainability Committee of the Board of Directors.
• Ethics and Regulatory Compliance Committee.
• Legal Department, Secretary to the Board and the Committees.
• Local Compliance Officers

4.1.1. Governance

ESRS G1, ESRS 2 GOV-1

Viscofan's business conduct and regulatory compliance system does not only concern compliance with the law; it is also a matter of values

This attitude reflects a culture of shared values with zero tolerance for actions contrary to the Code of Conduct and integrity in all people who work at Viscofan and who contribute to achieving the objectives and carrying out business conduct in a sustainable manner.

Viscofan believes that integrity and transparency directly contribute to achieving its objectives and managing the business sustainably. To guarantee this, it has an ethics and compliance system whose objectives are to promote an ethical culture within the organisation that strengthens its competitiveness and long-term sustainability, enhances its reputation, and ensures compliance with the regulatory system by all employees.

The Ethics and Regulatory Compliance Committee is the body responsible for ensuring and supervising the proper implementation and monitoring of the Group's compliance system, as defined by the Board of Directors.

The Audit Committee oversees the effectiveness and functioning of the Ethics and Regulatory Compliance Committee and, to that end, receives periodic information from it on compliance with the Internal Regulations of Conduct in matters relating to the Securities Market and the Code of Conduct, and in particular, on the whistleblowing channel.

Regarding training, in accordance with the policy of diversity in the composition of the Board of Directors and the selection of directors, the members of the Audit Committee possess the necessary training and experience for the functions assigned to said committee by the Board of Directors' Regulations. See the CVs described in the Annual Corporate Governance Report, which forms part of the Management Report.

Additionally, the Ethics and Regulatory Compliance Committee has trained and experienced staff in matters of ethics, governance, and regulatory compliance.

Furthermore, each of the Group's companies has a local compliance officer, appointed by the Ethics and Compliance Committee, who is responsible for monitoring and providing ongoing training on the Group's compliance system to employees, managers, and directors at the local level. The system has been widely disseminated and is available to employees on the Group's intranet.

4.1.2. Incident, risk and opportunity management

ESRS 2 IRO-1, ESRS G1-1

Description of the processes for identifying and assessing material impacts, risks, and opportunities

Viscofan has conducted an assessment of impacts, risks, and opportunities (IROs) of relative importance related to corporate conduct, applying the double materiality process described in section IRO-1 of chapters ESRS 1 and 2. The analysis covered the subtopics defined in article 16 of ESRS-1, related to corporate culture, corruption, and bribery. The IROs identified as relevant are detailed at the beginning of this ESRS.

Likewise, in the area of business conduct, and considering Viscofan's activity and positioning, the criteria relating to the location and structure of transactions are significant.

This assessment has resulted in the identification of incidents of relative importance related to corporate culture, stakeholder engagement and activities, supplier relationship management, including payment practices, corruption and bribery.

Elements of the ethics and regulatory compliance system

With the aim of preventing inappropriate conduct, mitigating risks and effectively protecting people and the organisation, Viscofan promotes the continuous development of its regulatory compliance system.

It constitutes an essential pillar of the Group's sustainability strategy, ensuring that all business activities are carried out in accordance with current legislation, international standards and the ethical principles set out in the Code of Conduct.

This system has implemented elements in order to prevent, detect and respond to potential risks with a negative impact on the Group.

At the proposal of the Ethics and Compliance Committee and following a report from the Audit Committee, the Board of Directors approves the Group's compliance plan, which includes action plans in various areas: improvement of internal regulations, annual update of the compliance risk map, specific actions, a training plan, and plans to improve internal controls. Regarding training plans, the Group works across departments with the Human Resources Department to ensure the dissemination of the Code of Conduct, which in turn participates in the implementation of the annual compliance training plans.

A compliance monitoring and tracking plan is defined periodically, based on a risk assessment to identify, analyse, and prioritize those risks that should be included in the plan. This is a dynamic plan, reviewed by management and the Audit Committee to ensure it aligns with the organisation's priorities. Comprehensive communication and integration of all compliance risks is essential, in collaboration with all functional units that perform specific compliance risk supervision and control tasks.

Thus, the identification, assessment, and updating of compliance and business ethics risks consider aspects such as geographic location and the scope of transactions carried out by the various Viscofan departments, based on a business model that manufactures and markets casings to customers through direct sales or distributors. According to this business model, the sales, purchasing, and management areas are considered to be at higher risk.

Furthermore, the regulatory compliance system covers specific matters such as market abuse regulations, data protection, conflicts of interest and corruption, and import and export trade operations with sanctioned countries.

The goal is to have all relevant ethical and compliance risks of the company monitored at least once a year.

Finally, Viscofan's compliance system includes a reporting process whereby the Ethics and Compliance Committee reports at least twice a year to the Audit Committee on the progress of the compliance plan, including the operation of the Ethics channel and the handling of significant complaints received through it. The committee, in turn, reports to the Board of Directors on the system's performance and improvement plans to enhance its effectiveness.

Within the Ethics and Regulatory Compliance Committee, in addition to the experience discussed in the previous section, specific training is promoted for the people in charge of receiving complaints in the form of specific qualifications in compliance matters, or in specific subjects such as money laundering.

Business conduct policies and corporate culture

The prevention system is based on internal regulations, consisting of a Code of Conduct, which indicates the ethical principles and behavioural guidelines, complemented by internal operating policies and procedures.

At the suggestion of the Audit Committee, the Code of Conduct was updated in 2025 by the Board of Directors in order to incorporate guidelines for conduct in the face of new risks.

Also, in 2025, at the proposal of the Audit Committee, the Board of Directors approved a new general compliance policy for the Viscofan Group with the main objective of serving as an essential standard for structuring the Group's Ethics and Compliance System.

Code of Conduct

It contains a set of principles and guidelines that are binding on each person in the Viscofan Group, guiding actions and behaviours within the company and in relation to shareholders, customers, suppliers and society in general, in accordance with Viscofan's corporate ethics, as well as local, national and international laws and regulations.

The Board of Directors has among its functions ensuring the correct application of the same and for this purpose it has the collaboration of the Ethics and Regulatory Compliance Committee which carries out the work of supervision and monitoring of its compliance.

Internal regulations

Regulations governing corporate bodies and committees:

The internal regulations governing the operation of the governing bodies and complementing the applicable regulations in order to guarantee an adequate corporate governance system in the Viscofan Group are available on the Company's website in the Corporate Governance section, in addition to the required publications and registration on the CNMV website and in the Mercantile Registry of Navarra.

This internal regulation is mainly composed of the regulations of social bodies and committees:

• - Articles of Association: the basic rules governing the company and all its bodies. They set out the main characteristics and operating principles of the General Shareholders' Meeting, the Board of Directors, and its committees.
• - Regulations of the General Shareholders' Meeting: basic principles governing the General Shareholders' Meeting to promote transparency, guarantee shareholders' rights, and ensure their access to company information. These regulations govern the convening, attendance, holding, minutes, and shareholders' access to information prior to and during the General Meeting.
• - Regulations of the Board of Directors: These establish the Board's operating principles, including an evaluation mechanism, its rules of organisation and operation, the code of conduct for its members, the duties of the directors, and the general principles governing its actions. They also regulate the committees within the Board of Directors, their rules of organisation and operation, their mission, and their powers.
  In 2025, the Board's Regulations have been amended with the objectives of regulatory adaptation, alignment with good governance recommendations, and technical and structural improvements.
• - Regulations of the Audit Committee and Regulations of the Appointments, Remuneration and Sustainability Committee: establish the scope and functions of each Committee, its composition and operation, relations with governing bodies and other entities.
  In 2025, both Regulations have been modified with the objectives of regulatory adaptation, alignment with good governance recommendations, and technical and structural improvements.
• - Internal Regulations on Conduct in Matters Relating to the Securities Market: establishes the behavioural guidelines required to ensure that the institutional and personal actions of the directors and staff of the Viscofan Group are carried out in strict compliance with current legislation to promote transparency in the markets and to preserve, at all times, the interests of investors.

Sustainability policies

ESRS 2 MDR-P

Additionally, within the framework of the General Sustainability Policy, Viscofan has specific policies that formalize the Group's approach to material aspects in the following areas in accordance with ESRS 2 MDR-P:

ESRS E1. Climate Change Policy

ESRS E2. Pollution control and reduction policy and Occupational health and safety policy.

ESRS E5. Environmental Policy.

ESRS S1. People management policy, Human rights respect policy and Occupational health and safety policy.

ESRS S4. Food Regulation Policy.

These policies have the following scope of application:

• They apply to all Viscofan Group companies and bind all its staff, regardless of their position and function.
• Additionally, they state that Viscofan will promote the application of its principles and bases to any natural and/or legal person linked by a relationship other than employment when possible and convenient, in such a way that they follow principles and guidelines consistent with those established in the policies.

On the other hand, the monitoring and supervision of these policies is the responsibility of the Board of Directors, which exercises this through:

• The Appointments, Remuneration and Sustainability Committee, responsible for overseeing the development and implementation of sustainability policies and strategies.
• The Audit Committee is responsible for ensuring the integrity of the non-financial information included in the management report and for monitoring the non-financial risks arising from the Group's actions in relation to policies.

Furthermore, the Group has executive bodies that reinforce this commitment:

• Executive Sustainability Committee, whose main function is to promote sustainability plans and programs in line with approved policies.
• Ethics and Regulatory Compliance Committee, under the functional dependence of the Audit Committee, which ensures compliance with the Code of Conduct and manages the Group's whistleblowing channel or Ethics Channel, allowing employees and third parties to report possible breaches confidentially and even anonymously.

Compliance system policies

The Viscofan Group's regulatory compliance system is broader. It encompasses the general sustainability policies described above, which formalize the Group's approach to material matters in accordance with ESRS 2 DR-P, as well as other specific policies in various areas, as detailed below:

Ethics and Compliance Risk Map

Within the framework of its global risk management system, Viscofan develops an ethics and compliance risk map with a special focus on the prevention, control, and monitoring of criminal risks due to the importance of the protected asset and the impact of the consequences and penalties associated with such breaches. This map is based on the following:

• Identification of risks, crimes especially of a criminal nature and other breaches that affect the legal entity.
• Grouping into blocks in order to design common measures to combat criminal groups and other breaches.
• Identification of the conduct that may result in crimes and breaches being committed and the groups that may be involved.
• The Viscofan Group associates the details of offenses and breaches in each sector, especially those of a criminal nature, in accordance with Spanish law, as the Group's parent country. However, each Viscofan Group company analyzes the applicable regulations in the different countries in which it operates and develops local regulations for compliance where necessary, informing and reporting these to the Ethics and Compliance Committee.
• Identification of internal and external mechanisms for controlling and detecting crimes and other non-compliance. Preventive controls have been identified, distinguishing between policies and procedures that address the prevention of the aforementioned conduct, and specific controls.
• The estimation of the impact and both inherent and residual probability of each behaviour is represented, obtaining the ethics and compliance heat map of the Viscofan Group that allows guiding compliance risk management.

The ethics and compliance risk map is reviewed and assessed annually in working meetings of the Ethics and Compliance Committee, led by the Group's compliance department. Additionally, the Compliance List Assessment (CLA) is prepared annually, gathering perceptions of compliance both at the company level within the Group and at the functional area level regarding risk perception. The resulting assessment is provided to the Senior Management and the Audit Committee for their review.

Ethical channel – Integrity line

The Ethics channel is a fundamental pillar of the system. For Viscofan, it is essential to quickly detect any potential crime or breach of internal regulations in order to investigate it and implement the necessary measures to put an end to illegal or non-compliant conduct. In this way, the aim is to minimize the negative impact that such actions could have on stakeholders.

Employees and anyone with a legitimate interest can access the ethics channel on the Viscofan website in the corporate governance section, on the employee intranet, or by email to officeofethics@viscofan.com or by mail to the Ethics Committee at Viscofan's headquarters (Polígono Industrial Berroa, C/Berroa 15-4ª planta, 31192 Tajonar-Navarra, Spain), to report any indication of conduct that they consider a possible risk.

The Ethics and Compliance Committee is the body responsible for initiating, either on its own initiative or at the request of a third party, investigations into actions or practices that may constitute a breach of the Code of Conduct and current regulations within the Viscofan Group, which could pose a risk to the Group. Upon receiving a report, it acts in accordance with the Information management procedure.

The established process that follows completed investigations pursues several objectives:

• To provide redress and assistance to those who may have been affected by any breach or irregularity, especially by breaches or irregularities with criminal relevance.
• Identify possible improvements in the implementation of the ethics and compliance system so that new measures can be established that would have prevented the risks from materializing.
• Provide support to the Group's companies and monitor the implementation of recommendations to ensure the identified improvements.
• Conduct global case tracking. Information submitted to the company-wide ethics committee regarding potential violations is recorded for unified monitoring, enabling the identification of trends and areas for improvement in the compliance system.

Viscofan has a general Internal Information and Whistleblower Protection Policy that guarantees the right of employees and third parties to report information about the violations outlined therein through an internal reporting channel. This Policy establishes the obligation to process reports according to a procedure that provides due guarantees for whistleblowers and other affected parties.

It establishes that the informant will have the guarantees provided for in the laws and in particular:

1. Decide whether you wish to submit your communication anonymously or not.
2. Formulate the communication in writing and, upon request, in person or by videoconference.
3. Please provide an address, email address or secure location where you can receive communications, or opt out of receiving communications.
4. Appear on his own initiative or when required, being assisted, if appropriate and at his own expense, by a lawyer of his choosing.
5. To exercise the rights conferred upon you by the legislation on the protection of personal data.
6. To know the status of the processing of your complaint and the results of the investigation.

Likewise, individuals who report or disclose reportable information are entitled to the protection provided by law. In particular, acts constituting retaliation, including threats of retaliation and attempted retaliation against whistleblowers and third parties protected by current regulations, are expressly prohibited.

Throughout the year 2025, the Ethics and Compliance Committee met on 4 occasions and followed up on 21 communications received through the Ethics Channel - Integrity Line, of which 15 were admitted for processing, and in 6 of the cases after processing the corresponding file and its investigation, violations contrary to the internal regulations or the principles of the Code of Conduct (not constituting a criminal or administrative offense) of the Group were confirmed, with the necessary measures being proposed and adopted by the competent bodies.

Promoting corporate culture. Training and dissemination

Training and communication are key strategic elements for building a corporate culture aligned with the Viscofan Group's ethical principles and Code of Conduct. Their aim is to prevent non-compliance and empower individuals to act ethically and proactively.

The Code of Conduct states that managers and supervisors must emphasize the importance of ethical and compliance-oriented conduct, integrating it into daily management and promoting its practice through personal leadership and continuous training.

The Ethics and Compliance Committee plays a vital role in managing the system and defining specific training plans. However, the cultural diversity and local needs of the various countries in which the Group operates make the work of local managers equally crucial. They plan and implement training and communication activities in each region, always with the support and monitoring of the Committee.

They are organized into different categories, designed to reinforce knowledge of ethical and compliance risks, as well as the policies and procedures intended to prevent them:

• Basic training for all employees: This includes distribution of the Code of Conduct and a general explanation of the key elements of the System. It highlights how to access available information and the existence of the Ethics Channel – Integrity Line for reporting any act or indication of non-compliance. In 2025, new employees received training on the Code of Conduct as part of their onboarding manual.
• General refresher training activities: At least once a year, all Viscofan Group employees participate in refresher activities designed to increase awareness of ethical practices and compliance risks, reinforcing the company's commitment and the resources made available. This year, training has been provided on internal fraud, personal data protection, and know-how protection.
• Specific training and updates covering 100% of managers and employees at risk, according to their area of responsibility, with the aim of keeping their knowledge of the Ethics and Compliance System up-to-date and ensuring appropriate conduct in the long term. In this category, training on personal data protection and compliance was provided to the management team in 2025, as well as to local compliance officers. No specific training on corruption and bribery was provided to these groups during the year.

Furthermore, Viscofan understands that human rights training is a fundamental tool for raising awareness among its employees on this matter.

The breakdown of training hours in this subject is as follows:

Supplier relationship management

ESRS G1-2

Viscofan expects suppliers to comply with applicable laws and to follow recognized standards in the areas at environment, social and governance.

Furthermore, the Group is globally committed to its suppliers and establishes relationships with them based on respect and trust, and on the quality of products and services.

As a result of this objective and commitment, Viscofan has implemented noteworthy elements in supplier management:

Codes, policies and commitments

Supplier Code of Conduct: This code aims to extend Viscofan's culture to its suppliers of goods and services, emphasizing compliance with applicable laws and generally accepted standards, ethical behaviour, labor practices, environmental responsibility, legality of goods and raw materials, and respect for the communities in which they operate. Implied acceptance of the code is included in the Group's general terms and conditions of purchase.

Sustainability policy: establishes commitments and actions for the responsible management of the supply chain from the perspective of Human Rights, respect for the environment and the fight against climate change.

Code of Conduct and Human Rights Policy: Viscofan rejects all forms of child labor and, accordingly, suppliers are required to make a similar commitment to that included in our code of ethics.

Anti-corruption policy that reflects the company's commitment against bribery and corruption and establishes the treatment and commercial relationship that is maintained with third parties.

Ethics Channel - Integrity Line: Allows for anonymous reporting and is open to third parties so that any current or potential supplier can report facts or situations that may be contrary to the code of conduct or current legislation.

Selection, approval and verification of compliance with the Supplier Code of Conduct

Viscofan has established a supplier approval system that allows for non-discriminatory treatment in the selection processes of suppliers and contractors, while also seeking to ensure compliance by them with quality, safety and cost criteria.

In particular, the system for approving raw material and packaging suppliers includes a declaration of conformity regarding their commitments to act in accordance with internationally accepted ethical principles and human rights.

Suppliers must pass an internal approval procedure consisting of a verification, either in person or by completing a questionnaire.

In both cases, the following systems are evaluated, among other things: quality management (ISO 9001, IFS), food safety management in the case of raw material suppliers (FSSC 22000, BRCGS Food Safety, BRCGS Packaging Materials), occupational health and safety management (OHSAS 18001/ISO 45001), environmental management (ISO 14001), energy management (ISO 50001) and human rights management (UN Global Compact, BSCI).

In the specific case of collagen production, it is necessary to acquire animal hides (mainly bovine) which in Europe must comply with European animal welfare regulations at the time of slaughter.

Prevention and detection of corruption and bribery

ESRS G1-3

As stated in Principle 10 of the United Nations Global Compact, which Viscofan has signed, “businesses should work against corruption in all its forms, including extortion and bribery.” In this regard, we are committed to the United Nations Convention against Corruption (UNCAC).

This principle governs Viscofan, is reflected in the Code of Conduct and the General Compliance Policy, and has been developed and reinforced by the Anti-Corruption Policy, the Crime Prevention Policy, and the Policy on the Prevention of Money Laundering and Terrorist Financing, which, framed within the regulatory compliance system, demonstrate the Group's commitment to the permanent monitoring and sanctioning of fraudulent acts and conduct and the development of a corporate culture of ethics and honesty.

Both the Code of Conduct and these policies are available on the Viscofan website or internal intranet, and training on them is encouraged.

To prevent any type of corruption, the regulations establish guidelines, promote communication and training on this subject regarding actions that are not permitted and that may be subject to corruption: bribery, extortion, facilitating payments and influence peddling, gifts, commercial favours, donations and sponsorships, and relationships with third parties.

Additionally, the Ethics and Compliance Committee carries out more specific management of ethics and compliance risks, including the prevention and detection of corruption and bribery. This management is described in section 4.1.2, Incident, Risk, and Opportunity Management.

Training on the prevention and detection of corruption and bribery has been detailed in the subsection "Promotion of corporate culture. Training and dissemination of this ESRS".

Furthermore, the global risk committee conducts a fraud risk analysis, the potential forms of which are regulated in various policies, while also establishing specific controls and mechanisms to reduce the likelihood of their occurrence. The identified risks are: conflict of interest and internal fraud; corruption between private individuals; and fraud and deceptive advertising. In particular, the sales, purchasing, and management functions are at the highest risk of corruption and bribery. The definition and assessment of these risks are reviewed and evaluated, and the controls established within the organisation to reduce their probability of materializing are identified. The identification and assessment of risks and controls are compiled in the ethics and compliance risk map, specifically identifying those risks of a criminal nature.

4.1.3. Parameters and goals

ESRS 2 MDR-T

Goals

Supplier Audits under the Supplier Code of Conduct

As a signatory to the United Nations Global Compact, Viscofan is committed to SDG 12: Responsible Consumption and Production. This commitment has been voluntarily formalized through the Supplier Code of Conduct, which establishes a supplier audit target.

The goal is to audit 100% of the suppliers of the main raw materials (cellulose, collagen skins, abaca paper, polyamides) by 2030, representing approximately 50% of total purchases. This target was set in 2022, the year in which the Board of Directors approved the Supplier Code of Conduct.

There has been no stakeholder involvement in setting this goal. Nor have there been any changes to the goal or the methodology since its definition.

The Sustainability Executive Committee monitors performance against this goal on a quarterly basis, identifying the factors that explain any variations. This Committee also reports regularly to the Board of Directors' Appointments, Remuneration and Sustainability Committee.

The evolution of this goal is as follows:

Zero cases of corruption or bribery

ESRS G1-4

It should be noted that, in 2025, there were no acts that led to legal action for breaches of anti‑corruption or anti‑bribery laws, nor were any actions taken to address infringements in the procedures and rules for fighting corruption and fighting bribery.