ESRS S2 Workers in the value chain

voestalpine sources a wide range of materials, products, and services from a large number of suppliers around the globe. It supplies its products—mostly semi-finished products—to companies from various sectors and countries. The analysis and management of indirect impacts along the value chain remains primarily focused on the upstream sector, specifically on the supply chain.

The purchasing principles are based on the Group Strategy 2030+ and the sustainability strategy. The aim is to minimize (potential) negative impacts in the supply chain and associated risks for the company.

As part of its supply chain management, voestalpine documents social and environmental impacts associated with the activities of suppliers—including potential adverse affects on their workforce. The company adopts a risk-based approach that takes into account sector-specific and country-specific risks. As part of preparations for the Corporate Sustainability Due Diligence Directive (CSDDD) requirements, the current due diligence process is to be continuously expanded, and a Group-wide due diligence management system is to be implemented.

Violations of labor or human rights—child or forced labor, for example—may result in financial risks and reputational damage. These risks have increased: on the one hand due to stricter legal requirements arising from the Supply Chain Due Diligence Act (LkSG) and the planned EU Directive CSDDD, and on the other hand due to higher demands voiced by stakeholders with regard to transparency and responsibility.

Violations may result in sanctions, reputation damage, and the consequent loss of customers. This risk has been classified as material as part of the double materiality assessment (see ESRS 2, IRO-1 disclosure). For an overview of all material IROs, see SBM-3 in chapter ESRS 2. The following table provides specific information on SBM-3:

Impact, risk, and opportunity management

S2-1 – POLICIES RELATED TO VALUE CHAIN WORKERS

As an undertaking, voestalpine is committed to respecting human and labor rights throughout its value chain. This obligation applies not only to its own companies but also to its business partners. Requirements for voestalpine companies and business partners are laid down in the mandatory Code of Conduct for Business Partners (CoC-BP), which together with the Due Diligence User Manual, the Human Rights Policy, the Group Procurement Policy, the General Terms and Conditions of Purchase (GPO), and the Sustainable Supply Chain Roadmap forms the basis for responsible cooperation and the fulfillment of due diligence in the value chain.

These voestalpine policies for reducing (potential) negative impacts in the supply chain take into account both legal requirements and international frameworks such as the UN Guiding Principles on Business and Human Rights, the principles of the UN Global Compact, the International Charter of Human Rights, and the UN Convention against Corruption.

The table below lists the main internationally recognized frameworks for the implementation of human rights and environmental due diligence frameworks with which the specified policies are consistent.

The Code of Conduct for Business Partners (CoC-BP) and the voestalpine General Conditions of Purchase, which apply to all suppliers, set out a number of criteria for promoting sustainable sourcing and, in particular, ensuring human rights are respected. Any deviation from or failure to comply with internationally recognized frameworks, such as the UN Guiding Principles on Business and Human Rights or the ILO Declaration on Fundamental Principles and Rights at Work, can be reported using the established grievance process.

Due to increased legal requirements and the associated reporting obligations, voestalpine standardized its approach to the obligation to prove compliance with human rights and environmental standards for all purchasing activities in 2024 and set forth corresponding requirements in its Procurement Policy. Monitoring compliance with the above-mentioned international frameworks therefore also takes place on the basis of the Group’s Procurement Policy.

The current version of the CoC-BP was adopted by the Management Board of voestalpine at the end of the business year 2022/23. This Code defines voestalpine’s principles and requirements, and is designed to ensure that the practices of business partners conform to both voestalpine’s values as well as the pertinent laws and regulations. Based on voestalpine’s Human Rights Policy and General Code of Conduct, the CoC-BP addresses the following issues, with a particular focus on the concerns of value chain workers, which are outlined in the section entitled “Corporate Social Responsibility.”

• Compliance and responsible business conduct
  • Compliance with laws
  • Prohibition of active and passive corruption
  • Prohibition of bribery (e.g., sending gifts to employees)
  • Money laundering
  • Fair competition
  • Protection of information, intellectual property, and data
  • Trade restrictions and sanctions
• Social responsibility
  • Respect for human rights and working conditions
  • Prohibition of child labor
  • Prohibition of forced and bonded labor, human trafficking, and modern slavery
  • Collective bargaining and the right to freedom of association
  • Diversity, equal opportunity, and prohibition of discrimination
  • Compensation and working hours
  • health & safety in the workplace
  • Training of security staff
  • Local communities and indigenous peoples
• Environment and climate change mitigation
  • Carbon footprint
• Supply chain management
  • Raw materials and source minerals
• Reporting of misconduct
• Cooperation and participation

Business partners are required to inform their employees and direct suppliers that they can also report wrongdoing and violations of CoC-BP requirements using the voestalpine whistleblower system.

As a Group-wide directive, the Due Diligence User Manual governs the due diligence procedures in supply chain management and outlines measures for awarding contracts in procurement. Supply chain management at voestalpine follows a risk-based approach. The identification, assessment, and prioritization of risks is based on the OECD guidelines for fulfilling the due diligence requirements for responsible business conduct. This approach ensures that resources are employed in a targeted manner and that the most important and urgent issues are addressed first. In practice, this risk-based approach is implemented in a three-stage process (see figure below). In the first step, supplier prioritization, any risk exposure of suppliers on the basis of country and product group-specific risks is identified. This analysis and categorization must be carried out every year for all active suppliers, including those that were added as new suppliers in the year in question. In the second step, performance review measures are conducted for all suppliers previously classified as high or medium risk, in order to understand their individual sustainability performance and specify the actual risks. The third step aims to achieve continuous supplier development to improve their sustainability performance and awareness of their responsibility with regard to human rights and the environment, and ultimately to avoid and mitigate risks. Here too, action is based on the actual requirements.

Risk-based approach for sustainable supplier management

The analysis of product group-specific risks focuses on product groups that are purchased on a regular basis by voestalpine and that are associated with potential sustainability risks. Sustainability risks are defined as potential violations of laws and guidelines on human rights and environmental protection (see table below). This also includes the risk of potential violations of human and labor rights that may affect workers in the supply chain. These human rights risks are at the heart of the analysis and are summarized in the table below.

The country-specific risk assessment is carried out using public indices that encompass governance and sustainability. Two widely available sources are used by voestalpine to this end: the Worldwide Governance Indicators (source: World Bank) and the CSR Risk Check (source: MVO Nederland). A total of 213 countries and territories are covered by these indices. The combination of the two indices results in an overall risk assessment for each country and region. The following table shows the result of this risk assessment in the business year 2024/25. The data was based on all active suppliers in the business year. Internal value-added orders were not taken into account.

On the basis of the initial risk assessment, voestalpine specifically requests additional evidence from business partners at risk to verify the extent to which they meet the requirements of the CoC-BP. This takes place in the form of a Supplier Assessment Questionnaire (SAQ).

Tasks, responsibilities, strategies, management systems, and performance indicators (KPIs) related to the content of the CoC-BP are requested and reviewed by voestalpine. If required, voestalpine assists its business partners with implementing the requirements. Where necessary, training for suppliers or on-site visits are carried out in order to improve their understanding and ensure the implementation of effective improvement measures. The cooperation and participation of the business partners is required in this regard. voestalpine reserves the right to take appropriate action in the event of violations and an unwillingness to cooperate on the part of suppliers, which may ultimately lead to suspension or termination of the supply relationship.

A user-friendly IT system is used to collaboratively communicate with suppliers to collect their responses, analyze the questionnaires, and draw up action plans.

S2-2 – PROCESSES FOR ENGAGING WITH VALUE CHAIN WORKERS ABOUT IMPACTS

As an undertaking, voestalpine does not currently have a standardized process in place for engaging with value chain workers, apart from the whistleblower system, which can also be used by value chain workers. A corresponding procedure is currently being developed in preparation for the requirements of the CSDDD. In the absence of a formal procedure, value chain workers will be engaged in the event of an incident, such as suspected violations.

S2-3 – PROCESSES TO REMEDIATE NEGATIVE IMPACTS AND CHANNELS FOR VALUE CHAIN WORKERS TO RAISE CONCERNS

EXISTENCE OF A GRIEVANCE PROCESS

In addition to the risk-based due diligence process, voestalpine has set up a whistleblowing system on its website for raising grievances and, if necessary, takes situation-specific action to remedy and compensate for any violations. The whistleblower system is available not only to internal employees, but also to workers in the value chain and other stakeholders groups to report possible violations of legal requirements or internal guidelines—such as voestalpine’s Code of Conduct for Business Partners (CoC-BP).

Business partners also undertake, over and above the General Terms and Conditions of Purchase (GPO) and the Code of Conduct for Business Partners (CoC-BP), to inform their own employees and direct suppliers about the option of using the voestalpine whistleblower system. The system thus helps to identify potential negative impacts on value chain workers.

Unless there is a legal obligation to set up a whistleblower system, voestalpine recommends that its business partners establish an appropriate system that allows both open and anonymous reporting.

The whistleblower system has established itself as a trusted point of contact within the voestalpine workforce, and is actively used by whistleblowers. In light of its high level of acceptance and the effectiveness of the remediation measures, there are plans to inform the workforce in the value chain of its availability, allowing them also to raise grievances or to point out irregularities. All reports are treated confidentially.

No further action is currently being pursued to inform value chain workers about the ways in which they can report concerns or complaints. At present, no assessment takes place to determine whether value chain workers are familiar with and trust these grievance mechanism structures or practices. voestalpine is working to establish a general mechanism for working with value chain workers to strengthen dialogue and communication in the long term.

For more information on the whistleblower system, see chapter G1 Business Conduct under G1-1 Corporate culture and business conduct policies.

In the business year 2024/25, no reports of violations pertaining to workers in the value chain (e.g., labor and human rights violations) were received via the whistleblower system or other communication channels.

SUPPLIER DEVELOPMENT

The engagement and active participation of suppliers and business partners is key to ensuring compliance with the voestalpine Code of Conduct for Business Partners. The due diligence process specifically helps vulnerable suppliers with inadequate sustainability performance to resolve identified shortcomings and taking corrective action. Following up on the performance evaluation helps to better understand and implement necessary changes. This process forms part of voestalpine’s broader Supplier Development Program, which aims to continuously improve sustainability performance.

As shown in the table below, supplier training, capacity building, cooperation, and engagement complement suppliers’ sustainable development activities.

S2-4 – TAKING ACTION ON MATERIAL IMPACTS AND APPROACHES TO MANAGING MATERIAL RISKS, AND PURSUING MATERIAL OPPORTUNITIES RELATED TO VALUE CHAIN WORKERS AND THE EFFECTIVENESS OF THOSE ACTIONS AND APPROACHES

Key policies related to value chain workers are implemented as part of the CSDDD project realization. The expansion of the due diligence process, including a change policy for procurement governance and supplier screening, is to be actively promoted.

The conditions required for the expansion of the due diligence process, which was previously limited to companies subject to the Supply Chain Due Diligence Act (LkSG), to the whole group and all suppliers are currently being established by voestalpine. A key prerequisite for the Group-wide management of due diligence is the introduction of a comprehensive database that permits systematic risk analysis and management. In a second step, the global harmonization and consolidation of due diligence actions takes place in order to ensure uniform implementation within the Group.

One starting point is voestalpine’s existing Supplier Lifecycle Management system. This system involves a multi-stage process to establish, maintain, and develop relationships with suppliers. The focus is on the following aspects:

• Ensuring supplier and delivery quality
• Preventing and managing risks and threats
• Establishing a transparently assessed pool of qualified suppliers
• Complying with ESG and sustainability criteria

New suppliers are added to the database on the basis of risk and on a gradual basis. Supplier development is evaluated using a conventional supplier assessment. All relevant suppliers are classified as A, B, C, or D suppliers once a year. Depending on the product group, different criteria are included in the evaluation, such as environmental and quality management, innovative strength, flexibility, and adherence to deadlines. A and B suppliers enjoy preferential treatment in the procurement process. C and D suppliers are used to define targeted corrective actions that are to be implemented within a defined period of time. The corresponding implementation of the corrected actions is reviewed, for example, in follow-up assessments or in correspondence with the responsible procurement functions.

Supply chain due diligence obligations and the associated actions to prevent negative impacts on workers are to be implemented within the existing procurement structures. Human and organizational resources are continuously available to assist with this process. Resources earmarked specifically for this undertaking are not currently reported separately.

A clearly defined governance framework has been established for corporate procurement (see figure below), which regulates the dissemination principles and responsibility for implementation within the organization.

Governance framework for the Group procurement structure

Procurement governance follows a cascade principle: The Group defines binding minimum standards and specifications at the overarching level. Subordinate organizational units must operate within this framework and comply with the requirements of the respective superordinate level.

The executive management of the respective Group company is responsible for implementing Group-wide and divisional procurement guidelines, adjusting them if necessary to account for local circumstances or legal requirements, and for creating the necessary organizational framework. In addition, each Group company must contain written documentation of the form in which procurement is structured and regulated.

SUPPLIER ASSESSMENT QUESTIONNAIRE (SAQ)

Suppliers classified as potentially high or medium risk are subject to further risk assessment conducted in the form of the Supplier Assessment Questionnaire (SAQ). The SAQ reflects the requirements outlined in voestalpine’s CoC-BP and is designed to:

• Identify actual human rights and environmental risks
• Obtain information and evidence on compliance with the voestalpine CoC-BP
• Determine targeted supplier development actions including further reviews of supplier risk such as on-site audits.

The SAQ is used to collect information on the following topics:

• Compliance
• Human rights and working conditions
• Environmental protection and climate change mitigation
• Management of the supply chain and reporting of misconduct

The structure of the questionnaire is based on the requested information and evidence (see table below). This includes: policy documents (e.g., guidelines), documentation on existing management systems (e.g., various ISO certifications), communication information (content and channels), KPIs, and other information on specific issues (e.g., the sourcing of conflict minerals and climate targets).

In accordance with the requirements of the Supply Chain Due Diligence Act (LkSG), the voestalpine Group has set up the new role of Human Rights Officer at each affected German voestalpine company. In addition, at Group level, the Head of Corporate Sustainability has been appointed human rights officer of the voestalpine Group.

Another key measure related to value chain workers is the integration of the sustainability topic block into the training program of the Group procurement structure (Purchasing Power Academy). For further information see chapter S1-4 Taking action on material impacts on own workforce, and approaches to managing material risks and pursuing material opportunities related to own workforce, and effectiveness of those actions.

Metrics and targets

S2-5 – TARGETS RELATED TO MANAGING MATERIAL NEGATIVE IMPACTS, ADVANCING POSITIVE IMPACTS, AND MANAGING MATERIAL RISKS AND OPPORTUNITIES

The voestalpine Group has initially set itself the target of reviewing at least 70% of its total procurement volume—including 100% of all relevant raw material deliveries—in line with a defined process for the application of established sustainability criteria by the end of the calendar year 2025. By the end of the business year 2024/25, 35% of the additional procurement volume had already been achieved in line with the sustainability criteria.

The aim of verifying the procurement volume using sustainability criteria is to prevent (potential) negative impacts on value chain workers, for example in the form of violations of fundamental labor rights.

Target: Increasing the share of sustainable suppliers

The aim behind this is to reduce risks related to compliance, hazards, or human rights infringement, and environmental impacts while achieving the specified sustainability criteria.

The review includes assessing whether suppliers meet the voestalpine sustainability criteria (e.g., acceptance of the Code of Conduct for Business Partners). The sustainability criteria were determined and pursued on the basis of internal analyses and regulatory requirements. Direct engagement of value chain workers or their representatives is not yet envisaged.

A strategic plan has been consistently pursued in recent business years in an attempt to ensure transparency and sustainability in the supply chain, thereby achieving important milestones (see figure) on the roadmap. The strategic plan is regularly reviewed and, where necessary, adapted.

voestalpine roadmap of sustainability activities and actions in the supply chain