Universal Registration Document 2024

4 SUSTAINABILITY REPORT GENERAL DISCLOSURES

[2-GOV-5-36-(b)] → Description of risk assessment approach followed In order to assess the risks inherent in the preparation of the Sustainability Report, Groupe ADP set up a CSRD project team, as described in BP-1-3, which includes representatives from all the Group's departments [2-GOV-5-36-(c)] → Description of the main risks identified and their mitigation strategies See the Risk factors and internal control chapter of this document, particularly risk factor 5. B "Risks related to regulatory changes", particularly non-financial, and the mitigation strategy. [2-GOV-5-36-(d)] → Description of how the findings of the risk assessment and internal controls as regards the sustainability reporting process have been integrated into relevant internal functions and processes In 2024, the second line of control carried out awareness raising campaigns among the business lines, whilst also ensuring that first level controls were carried out. For example, the internal control team at ADP's head office was able to follow the Group's HR teams as they carried out controls at ADP SA and its subsidiaries on social issues. Internal control has also used the findings of the double materiality assessment to target the metrics/data that require the closest attention. [2-GOV-5-36-(e)] → Description of the periodic reporting of the findings of risk assessments and internal controls to the administrative, management and supervisory bodies Internal control and the Group Risk Manager take part in monthly CSRD Task Forces to keep the teams involved in the process abreast of progress. In addition, a presentation of the internal control system and associated risks was given at a joint CSR-Audit and Risk Committee meeting at the end of October 2024. In addition to periodic reviews, the existing risk management system, which includes governance and tools, enables sensitive data to be collected from all the Group's airports, whether controlled or not. This information is used to maintain a map of the Group's risks, making it possible to monitor control of identified risks. This is presented to the Board of Directors of Aéroports de Paris, as well as to the boards of TAV, GMR and the Group's international holdings through the Board of Directors of ADP International (Liège, Madagascar and Santiago de Chile).

GOV – 5 – Risk management and internal controls over sustainability reporting [2-GOV-5-36-(a)] → Description of the scope, main features and components of risk management and internal control processes and systems in relation to sustainability reporting The risk management and internal control system used in the Sustainability Report is in line with the Group's overall approach to controlling its activities and achieving its objectives. Groupe ADP's risk management system makes it possible to qualify and assess all types of risk, including those relating to corporate social responsibility (CSR), both within ADP's operations and throughout its value chain. As part of the process of adapting reporting to the CSRD, the Audit, Security and Risk Management department has adapted existing processes to meet its requirements. In order to guarantee the reliability of this Sustainability Report, Groupe ADP's internal control procedures cover the first (business line) and second (independent controls) lines of control. In particular, the system aims to: u ensure compliance with the economic, legal, social, environmental and international environments; u ensure that governance instructions are correctly applied; u protect and safeguard the assets of its component companies; u protect employees; u contribute to the Group's economic performance. Groupe ADP's internal control procedures apply to ADP SA and the Group's controlled entities. Groupe ADP introduced key control manuals for administrative, accounting and financial processes in 2021. Since 2024, work has been undertaken in non-financial areas (by identifying ethics and compliance controls; drafting manuals on personal safety in 2024 and cybersecurity in 2025, etc.). In this context, regular exchanges are organised between corporate internal control and the departments in charge of sustainable development, both in France and abroad, within its fully consolidated entities. As far as non-financial internal control is concerned, the Group is currently carrying out a risk analysis with a view to implementing internal control processes for sustainability data reporting in the future, in the same way as for administrative, financial and accounting processes, and then developing the current approach. In 2024, on sustainability-related issues, the second line of control primarily concerned communication and raising awareness of the need for reliable data, and exchanging views with the relevant departments on the methods for collecting and calculating information and on the development of protocols for compiling this data. Lastly, on the strength of the results achieved by this system, Groupe ADP is working on the introduction of CSRD key control manuals.

222

AÉROPORTS DE PARIS w UNIVERSAL REGISTRATION DOCUMENT 2024