Cegal AS Transparency Act

26.06.2025 Due Diligence Report 2025

Contents

1	Management assertion	2

2	Description of Cegal	3

3	Introduction	3

4	Due diligence self- assessment	4

5	Supplier due diligence	7

6	Internal operations due diligence	7

7	Continual monitoring and improvement	9

Management assertion

The accompanying description has been prepared according to the requirements in the Norwegian transparency act.

The due diligence has been carried out in accordance with the OECD Guidelines for Multinational Enterprises limited to human rights and decent working conditions.

The report is available on the Cegal website - Cegal.com Cegal AS confirms that:

The accompanying description fairly presents the description of how Cegal promotes respect for fundamental human rights and decent working conditions in connection with the production of goods and the provision of services and how we address adverse impacts on fundamental human rights and decent working conditions.

Sandnes, June 25th, 2025

Dagfinn Ringås Chief Executive Officer Cegal AS	Trym Gudmundsen Chairman of the Board Cegal AS
Svein Torgersen Board member Cegal AS	Emilia Katarzyna Probst Board member Cegal AS

Description of Cegal

A global tech powerhouse, specializing in energy.

Cegal is a technology company that delivers IT and software services to the energy sector. We combine industry knowledge, technical expertise, and efficient delivery to help customers solve complex challenges. Our goal is to make technology work in practice and support a more sustainable future.

We have around 900 employees across ten countries and are growing internationally. Our headquarters is in Stavanger, Norway, and we also have offices in Sweden, Denmark, the UK, the US, the UAE, Malaysia, Estonia, and Australia.

Cegal provides a full range of services: specialized software for the energy industry, expert IT consulting, and secure cloud solutions.

More information about Cegal is provided on www.cegal.com.

Introduction

The objective of the Norwegian Transparency Act is to promote enterprises' respect for fundamental human rights and decent working conditions in connection with the production of goods and the provision of services and ensure public access to information regarding how enterprises address adverse impacts and fundamental human rights and decent working conditions.

The Norwegian Transparency Act establishes requirements for enterprises to carry out due diligence of fundamental human rights and decent working conditions within their enterprise, in their supply chain, and with their business partners; and to report on the due diligence activities they have carried out.

Cegal AS including all subsidiaries will be subject to the Norwegian Transparency Act.

Human rights

Cegal respects human rights and has a clear policy in place through our Code of Conduct and ethical guidelines, which are publicly available and well known internally. We have conducted internal due diligence to assess whether our own operations, products, or services could cause or contribute to human rights violations. In addition, we have carried out external due diligence to evaluate the risk of human rights violations among our suppliers and business partners.

Based on these assessments, we categorize risks as high, medium, or low to ensure appropriate measures are taken. If a risk is identified, we implement documented actions to reduce it. Should we find that we have caused or contributed to harm, we take steps to remedy the situation. We report regularly and publicly on our human rights efforts. Our supplier contracts include clauses that allow us to verify and audit human rights practices, and we work actively to influence our suppliers to follow the same principles.

Decent working conditions

Cegal ensures that all employees have written and signed employment contracts, available in their native language. Everyone working at Cegal is free to join trade unions or other organizations of their choice and can engage in collective bargaining where legally permitted. Our management takes part in collective negotiations related to working conditions and wages. We share business information regularly and maintain a constructive dialogue with employees. We have clear measures in place to prevent child labor, forced labor, and discrimination, and we work to ensure that we are not involved in any such practices. Health and safety are a priority, and we provide training to employees and keep records to ensure that the training is documented. Our salaries and compensation are aligned with industry standards. We have an established process for whistleblowing, including an anonymous channel that allows employees to report concerns about working conditions without fear of retaliation. We also encourage our suppliers and partners to follow the same standards for decent working conditions.

Certifications

Our approach is supported by certified management systems which are reviewed and renewed annually to ensure continuous improvement. These systems help us structure our work with quality, environmental impact, information security, and health and safety, and they contribute to our ability to identify and manage risks related to human rights and working conditions in both our own operations and the supply chain.

These include:

ISO 9001 Ǫuality Management System

ISO 14001 Environmental Management System

ISO 27001 Information Security Management System

ISO 45001 Occupational Health and Safety Management System

Responsible business code of conduct is embedded in Cegal management system.

Cegal’s management system sets the framework for how we operate responsibly and in line with laws and expectations. It ensures that our policies, procedures, and practices are documented, implemented, and regularly reviewed. Responsible business conduct is embedded into this system through key governing documents, including:

Code of Conduct and Ethical Guidelines Policy

Environmental, Social and Governance (ESG) Policy

Workplace health and safety policy (WHS)

Anti-corruption policy

Procurement policy

Supplier - Standard terms and conditions - ESG supplier requirements

Annual Sustainability report

Due diligence self- assessment

Methodology

The due diligence is conducted regularly and follows a risk-based and proportionate approach, in line with the OECD Guidelines for Multinational Enterprises. The process involves identifying and assessing potential and actual human rights risks linked to our own operations, products, services, and business relationships.

We prioritize areas and suppliers where the risk of negative impact is higher, and we focus on in-depth assessment of a limited number of suppliers at a time. This is a conscious choice to ensure depth and quality in each assessment, rather than spreading efforts too thin.

At this stage, our initial screening is based on the full list of registered suppliers from the previous financial year. However, we are aware that our current supplier register has limitations. Any entity we pay an invoice to is automatically registered as a supplier, which means the list appears larger than it is and includes many that are not relevant for follow-up.

We are in the process of acquiring a new system to better support supplier management and risk mapping going forward. By working closely with selected suppliers, we can better understand their practices, address issues effectively, and follow up on improvements over time. We acknowledge that human rights due diligence is an ongoing process. We continue to strengthen our internal systems, improve how we map risks, and take the necessary steps to prevent, mitigate, and address any adverse impacts identified.

Sources and score for assessments

Topic	Source	Description	Measurement	Limit value	Evaluation
Human Rights	Freedom House	Freedom House is a non- profit, majority U.S. government-funded organization in Washington, D.C., that conducts research and advocacy on democracy, political freedom, and human rights.	Measures political freedom and the freedom of the individual, including political diversity, freedom of expression, fair justice, and that there is no economic oppression	35	Countries with less than 35 points are considered as "Non-Freedom Countries". Countries above 35 points have partial or complete freedom.
Decent Working Conditions	International Trade Union Confederation	The International Trade Union Confederation (ITUC) is the global voice of the world's working people. The ITUC's primary mission is the promotion and defense of workers' rights and interests, through international cooperation between trade unions, global campaigning, and advocacy within the major global institutions.	Summarizes data from trade unions internationally about being an employee in the individual country. Measures, among other things, the right to establish and join trade unions, the right to collective bargaining, and the right to strike.	5	Countries are assessed as red, yellow, orange, or green. Red and dark (>5) red are not accepted.
Environmental	Environmental Performance Index (EPI)	The 2022 Environmental Performance Index (EPI) provides a data-driven summary of the state of sustainability around the world. Using 40 performance indicators across 11 issue categories, the EPI ranks 180 countries on climate change performance, environmental health, and ecosystem vitality.	Measures the environmental performance of a country's policies. Environmental health (40%): Pollution in air, water, and pollution from heavy metals. Ecosystem (60%): Biodiversity, deforestation, fisheries, sewage management, greenhouse gas emissions, and emissions of nitrogen from agriculture.	50	The points scale is ranked from red to green per country. Red is ranked from 0 to 50.

Results of the 2025 Due Diligence

Sustainable Business Practices and Ethical Trading

Suppliers assessed	300
Suppliers in high-risk countries	3 (4)
Cegal Office Locations in high-risk countries	2
2024 Due Diligence overview

Supplier 1

Supplier 1 is partly owned by a company based in a high-risk country. As this supplier is important to Cegal, a detailed assessment has been carried out. The assessment concluded that there are no unacceptable risks at this time. Cegal will continue to monitor the situation.

Supplier 2

Supplier 2 is subject to the requirements of the Transparency Act. Cegal has conducted a detailed assessment to verify compliance and found the responses satisfactory at this stage. No further action is considered necessary at this time.

Supplier 3

Supplier 3 operates in a high-risk country but plays a minor role in Cegal’s operations. A detailed assessment concluded that companies in the software development sector generally present low risk of contributing directly to human rights violations or environmental harm in their direct operations.

We have still reviewed other relevant risk areas, such as the supplier’s whistleblowing system, their own due diligence system in their sustainability reporting. At this stage, we consider the responses satisfactory, as the sustainability report is also verified by a third party. No further action is considered necessary at this time.

Supplier 4 and 5

Suppliers 4 and 5 are registered as operating in high-risk countries. Through our assessments and due diligence, we found that these are not active suppliers to Cegal but rather remain in the system from previous years. As there is no current business relationship, no further action is considered necessary at this time.

Supplier due diligence

High-level risk assessment

We regularly carry out high-level assessments to identify the risk of human rights violations and poor working conditions in the supply chains relevant to our industry. As part of this, we consider factors such as political unrest or instability in supplier countries, along with other risk indicators.

Suppliers are assessed and categorized as low, medium, or high risk based on the likelihood of human rights or labor rights violations. Depending on the risk level, suppliers are subject to targeted onboarding and follow-up measures.

The due diligence covers Cegal’s direct suppliers, sub-suppliers, and other business partners who provide goods or services to the company. For suppliers in higher-risk categories, especially those involved in direct purchases where there may be a risk of human rights or labor rights violations,we apply extra caution.

This includes background checks, assessments, and in some cases, audits. We conduct spot checks and audits of selected suppliers to verify compliance. Human rights and decent working conditions are an integrated part of these evaluations. Cegal’s primary suppliers deliver hardware, software as a service, and facility-related services such as offices and data centers.

Suppliers in high-risk countries – risk assessment overview

Based on the high-level risk assessment, Cegal has identified three vendors operating in high-risk countries. One of the vendors is a significant and strategically important supplier to Cegal. The company is registered in Norway and is therefore subject to Norwegian legislation, including the Transparency Act.

However, it is owned by foreign stakeholders based in a country associated with documented human rights violations and ongoing armed conflict. Cegal has carried out a detailed assessment to ensure that the supplier has no direct or indirect links to such violations. Based on the information currently available, no evidence of involvement has been identified. The situation will continue to be monitored closely.

The other identified vendors are software suppliers located in high-risk countries and are used in the deployment of Cegal’s products. These suppliers have been subject to regular assessments, and no indications of breaches related to human rights or decent working conditions have been identified to date.

Internal operations due diligence

Cegal's legal structure consists of a combination of investment ownership and employee participation. Norvestor SPV I Holding AS holds a majority share of 58.3%, while employees and Credo own 41.7%. The operational structure is organized under Cegal Group AS and Cegal AS, with subsidiaries in multiple regions, including Sweden, the UK, the US, Canada, Australia, and others.

General workplace health and safety

All Cegal offices conduct annual risk assessments related to workplace health, safety, and the environment. In addition, Cegal has implemented global processes for whistleblowing and for reporting deviations and incidents related to Workplace Health and Safety (WHS).

No serious workplace accidents resulting in significant injury or damage were reported during the year. The overall working environment is considered good, with ongoing efforts to identify and implement improvements. As of the end of 2024, the Group employed 830 people, up from 796 in 2023.

Cegal aims to be a workplace that does not discrimante and promotes gender equality. The Board and management are aware of societal expectations and legal requirements under the Anti-Discrimination Act, which promotes equality and prohibits discrimination based on gender, ethnicity, national origin, language, religion or belief.

We have prepared a separate statement under the Equality and Anti-Discrimination Act, which provides detailed information related to our own operations. In addition, we have published an ESRS report that covers internal governance in detail.

Both documents are available on our website under Cegal and Sustainability. All Cegal offices operate in line with the ISO 45001:2018 Occupational Health and Safety Management System.

Implemented action on offices in high-risk countries

Two of our offices is placed in high-risk countries. Cegal high standards on fundamental human rights and decent working conditions apply to all employees, and Management performs the same management training that is based on Nordic welfare principles.

The offices are regularly reviewed during the ISO 450001 audit, and the risk of any breach of fundamental human rights and decent working is regarded as low.

Continual monitoring and improvement

Implement suitable measures to cease, prevent, or mitigate adverse impacts based on Cegal priorities and assessments.

Cegal has instigated several preventive and mitigating measures based on the risk assessment.

Background checks of medium and high-risk suppliers with subsequent follow-up actions and dialogue with suppliers

Cegal will acquire an adequate ESG due diligence system covering the supply chain to strengthen our ability to identify, manage, and follow up on risks related to human rights and responsible business conduct.

Continue performing regular in-depth audits of the supply chain, minimum two who have been identified in the due diligence process.

Track the implementation and results of measures.

Risk-relevant information about high-risk suppliers is shared internally across relevant parts of the organization to ensure that future risk assessments are based on all available and up-to-date insights. Where appropriate, risk-related information may also be exchanged with industry peers to strengthen collective understanding and response.

In cases where human rights violations are suspected, Cegal will consider consulting with local authorities, local communities, and relevant NGOs to help assess the situation and determine appropriate action.