ESRS S2 Workers in the value chain

voestalpine sources a wide range of materials, products, and services from a large number of suppliers around the globe. It supplies its products—mostly semi-finished products—to companies from various sectors and countries. The analysis of indirect impacts and management of risks along the value chain remains primarily focused on the upstream sector, specifically on the supply chain.

The purchasing principles are based on the Group Strategy 2030+ and the sustainability strategy. voestalpine aims to minimize (potential) negative impacts in the value chain and associated risks for the company.

As part of its supply chain management, voestalpine documents impacts related to labor and human rights, along with other impacts, associated with the activities of suppliers. The company adopts a risk-based approach that takes into account sector-specific and country-specific risks. The focus is on suppliers that produce raw materials and input materials such as ores, alloys and other metals. As part of preparations for the Corporate Sustainability Due Diligence Directive (CSDDD) requirements, the current due diligence process is to be continuously expanded, and a Group-wide due diligence management system is to be implemented. This includes the development of roles, competencies and responsibilities.

Violations of labor or human rights, such as child or forced labor, can lead to inappropriate or abusive working conditions. Violations may result in penalties, loss of reputation, and the consequent loss of customers. This risk has been classified as material as part of the double materiality assessment (see ESRS 2, IRO‑1 disclosure). For an overview of all material IROs, see SBM‑3 in chapter ESRS 2. The following table provides specific information on SBM‑3:

Impact, risk, and opportunity management

S2‑1 – Policies related to value chain workers

As an undertaking, voestalpine is committed to respecting human and labor rights throughout its value chain. This obligation applies not only to its own companies but also to its business partners. Requirements for voestalpine companies and business partners are laid down in the Code of Conduct for Business Partners (CoC-BP), which together with the Due Diligence User Manual (see G1‑2), the Human Rights Policy (see S1‑1), the Group Procurement Policy, the General Terms and Conditions of Purchase (GOP), and the Sustainable Supply Chain Roadmap forms the basis for responsible cooperation and the fulfillment of due diligence in the value chain.

These voestalpine policies for reducing (potential) negative impacts in the supply chain take into account both legal requirements and international frameworks such as the UN Guiding Principles on Business and Human Rights, the principles of the UN Global Compact, the International Bill of Human Rights, and the UN Convention against Corruption.

The table below lists the main internationally recognized frameworks for the implementation of human rights and environmental due diligence frameworks with which the specified policies are consistent.

Code of Conduct for business partners and general conditions of purchase (GOP)

The Code of Conduct for Business Partners (CoC-BP) and the voestalpine General Conditions of Purchase (GOP), which apply to all suppliers, set out a number of criteria for promoting sustainable sourcing and, in particular, ensuring human rights are respected. Any deviation from or failure to comply with internationally recognized frameworks, such as the UN Guiding Principles on Business and Human Rights or the ILO Declaration on Fundamental Principles and Rights at Work, can be reported using the established grievance process.

Due to increased legal requirements and the associated reporting obligations, voestalpine standardized its approach to the obligation to prove compliance with human rights and environmental standards for all purchasing activities in 2024 and set forth corresponding requirements in its Procurement Policy. Monitoring compliance with the above-mentioned international frameworks therefore also takes place on the basis of the Group’s Procurement Policy.

The current version of the CoC-BP was adopted by the Management Board of voestalpine at the end of the business year 2022/23. This Code defines voestalpine’s principles and requirements, and is designed to ensure that the practices of business partners conform to both voestalpine’s values as well as the pertinent laws and regulations.

• Compliance with laws
• Social responsibility
• Environment and climate change mitigation
• Supply chain management
• Reporting of misconduct
• Cooperation and participation

Business partners are required to inform their employees and direct suppliers that they can also report wrongdoing and violations of CoC-BP requirements using the voestalpine whistleblower system.

Procurement policy

Supply chain due diligence obligations and the associated actions to prevent negative impacts on workers are to be implemented within the existing procurement structures. Human and organizational resources are continuously available to assist with this process. Resources earmarked specifically for this undertaking are not currently reported separately.

A clearly defined governance framework has been established for corporate procurement (see figure below), which regulates the dissemination principles and responsibility for implementation within the organization.

Governance framework for the Group procurement structure

Procurement governance follows a cascade principle: the Group defines binding minimum standards and specifications at the overarching level. Subordinate organizational units must operate within this framework and comply with the requirements of the respective superordinate level.

The executive management of the respective Group company is responsible for implementing Group-wide and divisional Procurement Policy, adjusting them if necessary to account for local circumstances or legal requirements, and for creating the necessary organizational framework. In addition, each Group company must contain written documentation of the form in which procurement is structured and regulated.

Another key measure related to value chain workers is the integration of the sustainability topic block into the training program of the Group procurement structure (Purchasing Power Academy). For more information, see S1‑4.

In accordance with the requirements of the Supply Chain Due Diligence Act (LkSG), voestalpine has set up the new role of Human Rights Officer at each affected German voestalpine company. In addition, at Group level, the Head of Corporate Sustainability has been appointed Human Rights Officer of the voestalpine Group.

Sustainable supply chain roadmap

A strategic plan has been consistently pursued in recent business years in an attempt to ensure transparency and sustainability in the supply chain, thereby achieving important milestones (see figure) on the roadmap. The strategic plan is regularly reviewed and, where necessary, adapted.

voestalpine roadmap of sustainability activities

S2‑2 – Processes for engaging with value chain workers about impacts

As an undertaking, voestalpine does not currently have a standardized process in place for engaging with value chain workers, apart from the whistleblower system, which can also be used by value chain workers. A corresponding procedure is currently being developed in preparation for the requirements of the CSDDD. In the absence of a formal procedure, value chain workers will be engaged in the event of an incident, such as suspected violations.

S2‑3 – Processes to remediate negative impacts and channels for value chain workers to raise concerns

Existence of a grievance process

In addition to the risk-based due diligence process, voestalpine has set up an anonymous whistleblower system on its website for raising grievances and, if necessary, takes situation-specific action to remedy and compensate for any violations. The whistleblower system is available not only to internal employees, but also to workers in the value chain and other stakeholder groups to report possible violations of legal requirements or internal guidelines—such as voestalpine’s Code of Conduct for Business Partners (CoC-BP).

Business partners also undertake, according to the General Conditions of Purchase (GOP) and the Code of Conduct for Business Partners (CoC-BP), to inform their own employees and direct suppliers about the option of using the voestalpine whistleblower system. The system thus helps to identify potential negative impacts on value chain workers.

Unless there is a legal obligation to set up a whistleblower system, voestalpine recommends that its business partners establish an appropriate system that allows both open and anonymous reporting.

All reports are treated confidentially.

No further action is currently being pursued to inform value chain workers about the ways in which they can report concerns or complaints. At present, no assessment takes place to determine whether value chain workers are familiar with and trust these grievance mechanism structures or practices. voestalpine is working to establish a general mechanism for working with value chain workers to strengthen dialogue and communication in the long term.

Further information on the whistleblower system can be found in G1‑1.

In the business year 2025/26, as in the previous year, no reports of violations pertaining to workers in the value chain (e.g., labor and human rights violations) were received via the whistleblower system or other communication channels.

S2‑4 – Taking action on material impacts and approaches to managing material risks, and pursuing material opportunities related to value chain workers and the effectiveness of those actions and approaches

Supplier assessment questionnaire (SAQ)

Suppliers classified as potentially high or medium risk are subject to further risk assessment conducted in the form of the Supplier Assessment Questionnaire (SAQ). The SAQ reflects the requirements outlined in voestalpine’s CoC-BP and is designed to:

• Identify actual human rights and environmental risks
• Obtain information and evidence on compliance with the voestalpine CoC-BP
• Determine targeted supplier development actions including further reviews of supplier risk such as on-site audits

The SAQ is used to collect information on the following topics:

• Compliance
• Human rights and working conditions
• Environmental protection and climate change mitigation
• Management of the supply chain
• Reporting of misconduct

The structure of the questionnaire is based on the requested information and evidence (see table below). This includes: policy documents (e.g., guidelines), documentation on existing management systems (e.g., various ISO certifications), communication information (content and channels), KPIs, and other information on specific issues (e.g., the sourcing of conflict minerals and climate targets).

If required, voestalpine assists its business partners with implementing the requirements. Where necessary, training for suppliers or on-site visits are carried out in order to improve their understanding and ensure the implementation of effective improvement measures. This requires the cooperation and participation of the business partners.

Supplier development

The engagement and active participation of suppliers and business partners is key to ensuring compliance with the voestalpine Code of Conduct for Business Partners. The due diligence process specifically helps vulnerable suppliers with inadequate sustainability performance to resolve identified shortcomings and taking corrective action. Following up on the performance evaluation helps to better understand and implement necessary changes. This process forms part of voestalpine’s broader Supplier Development Program, which aims to continuously improve sustainability performance.

As shown in the table below, supplier training, capacity building, cooperation, and engagement complement suppliers’ sustainable development activities.

voestalpine reserves the right to take appropriate action (remedial and retaliatory) in the event of violations or an unwillingness to cooperate on the part of suppliers, which may ultimately lead to suspension or termination of the supply relationship.

A user-friendly IT system is used to collaboratively communicate with suppliers to collect their responses, analyze the questionnaires, and draw up action plans.

CSDDD – Project implementation

Other key actions related to value chain workers are implemented as part of the CSDDD project realization. The expansion of the due diligence process, including change management for procurement governance and supplier screening, is to be actively promoted.

The conditions required for the expansion of the due diligence process, which was previously limited to companies subject to the Supply Chain Due Diligence Act (LkSG), to the whole group and all suppliers are currently being established by voestalpine. A key prerequisite for the Group-wide management of due diligence is the introduction of a comprehensive database that permits systematic risk analysis and management. In a second step, the global harmonization and consolidation of due diligence actions takes place in order to ensure uniform implementation within the Group.

One starting point is voestalpine’s existing Supplier Lifecycle Management system. This system involves a multi-stage process to establish, maintain, and develop relationships with suppliers. The focus is on the following aspects:

• Ensuring supplier and delivery quality
• Preventing and managing risks and threats
• Establishing a transparently assessed pool of qualified suppliers
• Complying with ESG and sustainability criteria

New suppliers are added to the database on the basis of risk and on a gradual basis. Supplier development is evaluated using a conventional supplier assessment. All relevant suppliers are classified as A, B, C, or D suppliers once a year. Depending on the product group, different criteria are included in the evaluation, such as environmental and quality management, social engagement, innovative strength, flexibility, and adherence to deadlines. A and B suppliers enjoy preferential treatment in the procurement process. C and D suppliers are used to define targeted corrective actions that are to be implemented within a defined period of time. The corresponding implementation of the corrected actions is reviewed, for example, in follow-up assessments or in correspondence with the responsible procurement functions.

On the basis of the initial risk assessment, voestalpine specifically requests additional evidence from risk-prone business partners as to the extent to which they meet the requirements of the Code of Conduct for Business Partners. This evidence is provided in the form of the Supplier Assessment Questionnaire (SAQ). Tasks, responsibilities, strategies, management systems, and performance indicators (KPIs) related to the content of the CoC-BP are requested and reviewed by voestalpine.

Metrics and targets

S2‑5 – Targets related to managing material negative impacts, advancing positive impacts, and managing material risks and opportunities

voestalpine set itself the sub-target of reviewing at least 70% of the Group’s total procurement volume—including 100% of all relevant raw material deliveries—in line with a defined process for the application of established sustainability criteria by the end of 2025. By the end of the business year 2025/26, it was confirmed that the Code of Conduct had been adopted for 72.5% of the procurement volume (2024/25: 35%). In addition, other suppliers were reviewed in accordance with the sustainability criteria, but are not yet included in specific targets. The overall target for increasing the proportion of sustainable suppliers stems from the sub-target explained above.

Due diligence focuses on suppliers that are more relevant to potential negative impacts to workers in the value chain. These include those at-risk suppliers that are classified as medium or high risk on the basis of the risk analysis, as well as recurring suppliers taking into account the purchase volume. The purpose of reviewing these suppliers is to systematically identify potential negative impacts, for example in relation to respect for fundamental labor rights and human rights. Targeted prioritization of these supplier groups enables effective management of corporate due diligence actions and supports the continuous improvement of sustainability performance in the supply chain.

Target: increasing the share of sustainable suppliers

The aim is to reduce risks associated with compliance with regulations, the infringement or violation of human rights, and environmental impacts, while at the same time meeting the defined sustainability criteria.

The review includes the assessment of whether suppliers accept the Code of Conduct for Business Partners and therefore meet the specified sustainability criteria. The sustainability criteria were defined and monitored on the basis of internal analyses and regulatory requirements. Direct engagement of value chain workers or their representatives is not yet envisaged.

voestalpine is aware that simply accepting the Code of Conduct does not imply actual compliance with its requirements. The target is therefore to be understood as a basic prerequisite for management and admittance and will be supplemented in the future by in-depth due diligence measures.