Universal Registration Document 2024

4 SUSTAINABILITY REPORT GOVERNANCE MATTERS

4.4 GOVERNANCE MATTERS INTRODUCTION TO GOVERNANCE TOPICS The conduct of Groupe ADP's business is in line with: u its corporate purpose: “to welcome passengers, operate and design airports, in a responsible manner and throughout the world”; u its "Responsibility and Hospitality" values: u hospitality means welcoming passengers, operating and designing airports, in a responsible manner and throughout the world, 4.4.1.1 Identifying purchasing risks The risks posed by Groupe ADP's purchasing are assessed through the following practices: 1. mapping of operational and CSR risks, using the Kraljic methodology for purchasing and supply risks and Groupe ADP reference framework for business and CSR risks. These guidelines are based on the reference framework of the French financial markets authority ( Autorité des marchés financiers – AMF) and the recommendations of French Association for the Management of Corporate Risks and Insurance (Association pour le Management des Risques et des Assurances des Entreprises – AMRAE). Our method was reinforced by the vision provided by the CSRD and its structuring of risk analysis into double materiality; it was deployed in each entity and for each country in which the seven subsidiaries operate, with the risk maps covering the three CSR pillars addressed by the CSRD; 2. mobilising the experience of the purchasing teams (extended to other functional departments where necessary) within these subsidiaries; 3. use of recognised public sources to obtain more general information on the social and societal context in each country where subsidiaries are located, as perceived by internationally-recognised non-governmental organisations (NGOs) in particular. The Impacts, Risks and Opportunities (IROs) are assessed and weighted by also taking into account the relative contributions in terms of size of procurement spend for each entity within Groupe ADP. The activities outsourced by Groupe ADP to its value chain are mainly located in France (around 85% of the Group's expenditure is accounted for by ADP SA, Extime & Hub One), in a changing legislative context and with a very strong local footprint (around 96%), which means that country risks are relatively low in the rest of the consolidated operating scope. In the main countries concerned by the rest of the expenditure (Turkey, Jordan), the Supplier and Partner CSR Charter, as adapted by the subsidiaries, takes account of specific local conditions and is signed by the contract holders. A detailed assessment of 'country risks ' specific to workers in the value chain: the CSRD exercise gave the Group the opportunity to analyse all the social issues concerning workers in the value chain in the countries where the consolidated subsidiaries and their main supply regions operate. In 2024, the mapping of procurement risks was therefore revised and supplemented by the dimensions of positive impacts and opportunities, in addition to the risk

u responsibility enriches the notion of hospitality by incorporating the professionalism of the Group's employees, and the way in which the Group commits itself on a daily basis and takes into account the challenges of tomorrow. This policy is applied to suppliers and subcontractors in the Group's value chain (section 4.1), in the ethical conduct of its business (section 4.2) and in its tax policy (section 4.3).

4.4.1 GENERAL APPROACH TO SUPPLIER AND CONTRACTOR DUTY OF VIGILANCE

and adverse impact analyses previously carried out under duty of vigilance principles (see details below). It has also been shared with all subsidiaries (consolidated and non consolidated), so that it can be updated by the Purchasing Directors, and so that they can take ownership of the methodology and implement it in their own specific contexts (local regulations and ecosystems of suppliers and service providers differ depending on the country in which they are based and in which they operate). We were thus able to confirm the analysis of the value chains of the Group's airport managers (consolidated scope) according to two main circles of proximity and influence concerning more specifically, the risks to which the workers in the value chain are exposed (upstream for purchasing, downstream for commercial activities): 1. contractors and partners working on site, i.e. , on the airport scope: these are the companies for which there are numerous constraints linked to the technical and administrative qualifications required of their employees ( e.g. , access badges for the various security zones), various risks linked to joint activities, but also numerous representatives of the decentralised and deconcentrated State services who are able to detect or report any apparent malfunctions; 2. suppliers and service providers of deliverables produced or manufactured outside airports: these are subdivided into two types according to the depth of the requirements demanded by Groupe ADP: 2a) those providing products or services for Groupe ADP's specific business needs at the request of order givers, enabling the Group to exercise a minimum level of influence up the value chain (in proportion to its market share), 2b) those purchased "off the shelf" or as standardised products and services, and for which Groupe ADP has no significant influence up the value chain, generally representing only a tiny proportion of these distributors' markets and customers.

486

AÉROPORTS DE PARIS w UNIVERSAL REGISTRATION DOCUMENT 2024