Description of material fields of risk

The significant risk areas and related preventive measures presented in the previous year’s annual report remain valid:

Geopolitical conflicts, political uncertainties, and their impact

The 2025/26 business year continued to be shaped by geopolitical conflicts and tensions. Geopolitical developments are continuously monitored in order to identify potential impacts on the voestalpine Group at an early stage and to proactively counteract possible risks with a robust and sustainable organization in a constantly changing geopolitical environment. For example, the measures established in the wake of the war in Ukraine to maintain or secure the supply of relevant raw materials and gas remain in effect; these are listed in the chapter “Availability of Raw Materials and Energy Supply.” Furthermore, in light of the war in Iran, which has been ongoing since the end of February 2026, existing measures for supply security are continuously reviewed for effectiveness and adjusted as necessary.

In addition to geopolitical conflicts, politically motivated market interventions such as tariffs, retaliatory tariffs, and sanctions also influence economic growth. For example, the voestalpine Group was affected by U.S. tariffs on steel imports when exporting from the EU to the U.S. (an increase in Section 232 tariffs on steel from 25% to 50% and the additional introduction of reciprocal tariffs (IEEPA tariffs) of 15% on steel products). In the 2025/26 business year, the resulting total negative EBITDA impact amounted to a high double-digit million-euro figure. Seamless tubes for the oil and gas industry were particularly affected, where the tariffs, combined with weak U.S. demand, led to lower capacity utilization in some cases. Other industrial sectors (such as hot-dip galvanized materials for the automotive industry) were less impacted. In many areas, tariff-related costs could to a large extent be passed on to buyers. Revenue generated through local production in the U.S. (“local for local”) was not subject to tariffs; therefore, this strategy significantly limited the direct financial impact of the tariffs. Since the U.S. Supreme Court ruled IEEPA tariffs invalid in February 2026, the affected companies file for a refund through a simplified customs procedure (“protest filing”) via their customs broker. However, the amount is immaterial from a risk management perspective. Should the EU’s efforts to reach a trade deal with the U.S. not be successful, an annual burden of a similar magnitude to that described above is still to be expected. In a continuing challenging economic environment, potential consequences of global trade conflicts and changing geopolitical conditions are being continuously monitored. In this context, U.S. customs policy is also being taken into account to the greatest extent possible. Reorganization programs and general efficiency measures are also being consistently pursued in light of these factors.

Risks of decarbonization/climate protection program greentec steel

voestalpine is committed to the Paris Agreement on climate and aims to achieve net-zero emissions by 2050, in line with the trajectory of the EU Emissions Trading System. To address the challenge of decarbonizing steel production while maintaining economic viability and competitiveness, voestalpine has developed the greentec steel climate protection program as a core element of the Group’s climate transition plan, which provides for a gradual transition to new technologies.

The technical conversion of existing production processes to low-emission technologies and impending cost increases due to CO₂ pricing mechanisms in the EU represent significant transitional risks for voestalpine. Further details can be found in the consolidated sustainability reporting in the Group Management Report (chapters “ESRS2 SBM-3-E1 Climate Change” and “ESRS E1 Climate Change”).

Availability of raw materials and energy supply

In order to ensure the long-term supply of raw materials and energy in the required qualities and quantities, the voestalpine Group has for many years been pursuing a diversified procurement strategy in response to the heightened political and economic risks associated with globalized markets. This strategy is further reinforced by various decarbonization initiatives, as well as by geopolitical developments (such as the protracted war in Ukraine and the current conflict in Iran) and the lessons learned from the COVID-19 pandemic.

• For example, since the beginning of the war in Ukraine, alternative sources of supply and transport routes have been activated to ensure the supply of relevant raw materials (such as iron ore, ore pellets, blast furnace coal, and alloys) to the Group’s production plants (especially the steel mills in Austria). Maintaining inventories of critical raw materials (such as iron ore and coal) also helps to bridge short-term supply bottlenecks in general.

• In addition, for several years, the voestalpine Group has contractually secured its own natural gas storage facilities to secure the natural gas supply (particularly for heat treatment and for the rolling mills at the Austrian sites). With gas storage reserves of approximately 0.75 TWh available as of March 2026, full operations can be maintained for nearly two months in case of a complete failure of external supply, or partial operation for several months, depending on the specific production methods. In addition, a new natural gas procurement concept was developed and implemented, whereby, in addition to major suppliers active in our own market area, international third-party suppliers were contractually bound, and voestalpine Rohstoffbeschaffungs GmbH itself can supply the voestalpine companies via its own natural gas balance group and direct procurement from the relevant gas exchanges CEGH and THE. For example, gas supplies of non-Russian origin from Norway or from LNG sources outside the conventional Russian/Ukrainian transport routes are being transported onward to Austria. In the event of a potential gas shortage, emergency plans would also come into effect, under which, after exhausting the company’s own natural gas storage capacity, production could be gradually adjusted to the available energy volumes in a worst-case scenario. Last but not least, the Group’s international orientation—with 500 companies and locations worldwide—and thus numerous unaffected locations outside Europe—would help partially offset production bottlenecks. By adapting supply and logistics processes to new challenges, bottlenecks can be avoided.

• Long-term supplier relationships and supply contracts, the strategic expansion of the supplier portfolio, and optimizations in self-sufficiency and the circular economy (e.g., in the scrap metal sector, opportunities for a circular economy have been and continue to be further intensified through the expansion or establishment of supply options with customers, suppliers, and process partners; the potential for a circular economy along the entire value chain is being further intensified) form the core elements of a diversified procurement strategy, which remains of great importance in light of geopolitical events and the current volatility in the raw materials markets (for more details, see the “Raw Materials” section of this Group Management Report).

Developments regarding raw material and energy supply continue to be monitored on an ongoing basis, especially with regard to geopolitical developments, and are evaluated through regular exchanges between experts and the Executive Board. From the current perspective, and particularly in light of the ongoing war in Iran, no physical supply bottlenecks are anticipated in the global markets. Specifically regarding natural gas supply—which is relevant to voestalpine—earlier projections assumed overcapacity in LNG supply and, consequently, a general downward trend in price levels. While—despite the war in Iran—it is still assumed that demand will be met in terms of volume, projected price trends under current conditions are subject to increased uncertainty. This also suggests that price increases in the transportation sector are to be expected. Further medium- and long-term effects of the current war in Iran (including effects on price trends and the overall economic situation) are difficult to assess due to the duration and outcome of the conflict and are the subject of ongoing analyses and market observations. Based on the current assessment, the war involving Iran is currently expected to be a time-limited event.

In the area of energy supply, the development of alternative energy resources continues to be actively explored and consistently pursued. In addition to expanding our own renewable energy capacities and procuring renewable energy through long-term PPAs (Power Purchase Agreements), numerous research and demonstration projects are being pursued in the fields of hydrogen, biogas, and biomass, as well as initiatives in alternative iron and steel production technologies (such as “H2FUTURE” [hydrogen pilot plant], Hy4Smelt—a further development of the HYFOR [Hydrogen Based Fine Ore Reduction] technology combined with smelter technology—and “SuSteel” [Sustainable Steelmaking]). The ongoing optimization of energy efficiency in production processes is also being continuously investigated and advanced. In addition, research activities in the field of carbon capture, utilization, and storage (CCUS) are being continued. Industrial energy storage represents a potential area of focus for the future; initial evaluations are underway.

Additional information on individual aspects can be found in the consolidated sustainability reporting in the Group Management Report (chapters “ESRS2 SBM-3-E1 Climate Change,” “ESRS E1 Climate Change,” and Chapter “I, R&D Innovation and Research & Development”).

Hedging the price of raw materials and energy

Objectives, principles, responsibilities and accountabilities, as well as methods, procedures, and decision-making processes for dealing with commodity and energy price risks are set out in an internal guideline. Based on this and taking into account the specific characteristics of each Group company’s business model, prices are hedged by means of short-term supply contracts with a fixed-price agreement or by means of derivative financial instruments. PPAs (Power Purchase Agreements) are used to partially hedge against long-term fluctuations in electricity prices. In addition to electricity, long-term hedges for CO₂ allowances have also been established. Depending on the business model of the relevant Group company, changes in energy and commodity prices may be passed on to customers either largely or with a time lag. In this case, the goal of risk management is to secure the calculated contribution margins of the sales contracts. Raw material and energy risk management covers iron ore, HBI, coke, coking coal, zinc, nickel, CO₂, cobalt, and energy (electricity, natural gas). The goal is to reduce earnings fluctuations resulting from the volatility of raw material and energy prices to a level consistent with the principle of conservative financial policy as defined in the voestalpine Group’s financial constitution. The topic of supply security (procurement risk) has already been addressed under “Raw Material Availability, Energy Supply.” These comprehensive measures help ensure financial stability, strengthen the company’s resilience to volatile markets, and manage relevant risks with the necessary flexibility.

Disruptions in logistics and supply chains

In general, global supply chains can be disrupted by geopolitical conflicts (such as the current war in Iran or the ongoing war in Ukraine), trade disputes, including resulting production relocations, and other events (such as pandemics or epidemics). This can lead to restrictions or diversion effects, for example, on the customer or supplier side, or due to disruptions in transport routes, as well as potential sanctions, embargoes, or trade barriers. The focus on less vulnerable supply chains and the simultaneous expansion of logistical options has already significantly increased reliability (e.g., in raw material transport) and the resilience of our logistics and supply chains in the past and continue to do so today. Depending on the duration and outcome of the war in Iran, price increases in the logistics and transportation sector are to be expected. These and other knock-on effects are difficult to assess from today’s perspective. At present, the war involving Iran is not causing any disruptions to voestalpine’s transport chain. Diversified procurement strategies and supply chains strengthen resilience against unforeseen events. Current developments are being continuously monitored and assessed, particularly with regard to geopolitical conflicts and existing or emerging global trade conflicts, in order to derive appropriate measures at an early stage.

Failure of production facilities, additional operational risks

To minimize the risk of failure in critical facilities, necessary modernization and replacement investments are planned and implemented on a long-term basis. Additionally, targeted and extensive investments have been made in the technical optimization of sensitive units. To continuously improve the reliability and performance of the facilities and further minimize the risk of failure, supplementary measures have been implemented, such as consistent, systematic, and preventive maintenance, risk-based stockpiling of critical spare parts, and corresponding job-specific training for affected employees. Furthermore, appropriate emergency plans have been established for key facilities to minimize potential risks.

In the event of a sudden, unplanned interruption of the power supply (“blackout”), critical systems and processes at key locations are largely protected by emergency power generators. These can be used for limited operations, for emergency operating modes, or, in extreme cases, for a controlled shutdown of the systems. In addition, for example, the Linz site operates its own power plant, including black-start capability. Internal special networks (separate, self-contained, isolated areas) are available for this purpose. Regular drills are conducted for various scenarios (such as testing the emergency generators, testing emergency and communication plans under different failure scenarios) to ensure the highest possible level of preparedness in the event of an incident. Potential damage to facilities resulting from various blackout scenarios is regularly analyzed and assessed, and appropriate preventive measures are taken. Existing measures are reviewed for effectiveness and adjusted as necessary. Existing emergency plans are regularly evaluated by the respective experts for various scenarios and adapted to new or changed circumstances as needed.

At the voestalpine Stahl GmbH site in Linz, a new production planning system is scheduled to go live in the 2026/27 business year, replacing the system currently in use. This central system is essential for all planning and processes in the production area. If a certain threshold is exceeded during the gradual commissioning or transition phase, it will no longer be possible to revert to the previous system. The residual risk of a potential production outage during the commissioning of the new production planning system is mitigated through a variety of measures, such as prioritizing actions to be implemented, considering different scenarios, and comprehensive test management.

In the area of large-scale projects and construction initiatives (such as in the course of decarbonization activities at the sites in Linz and Donawitz), external contractors are increasingly engaged. This entails a residual risk of potential compliance violations by contracted external firms, and in particular of violations of the Foreign Nationals Employment Act by these firms. This residual risk and the associated reputational risk are mitigated through appropriate measures such as contractual safeguards, instruction and training, and monitoring.

Impact of technology substitution

Any substitution of existing technologies, such as the replacement of existing materials, manufacturing processes, or equipment with new technologies and potential impacts (such as technical, procedural, or economic impacts) are continuously monitored, and the manufacturing processes and procedures used, including the products manufactured, are continuously further developed and optimized.

IT security, failure of it systems, unavailability of essential IT services

Services for business and production processes, which are primarily based on complex IT systems, are provided at most Group locations by IT subsidiaries wholly owned by voestalpine AG. These are voestalpine group-IT GmbH in Austria and its sister companies in Germany, Brazil, and China, with approximately 25 branches worldwide. Given the critical importance of IT security and IT availability, and to further minimize potential IT outage and security risks, minimum IT security standards—including guidelines for business continuity management—are in place. These standards are regularly updated to reflect new circumstances, and compliance is verified annually through internal and external audits. voestalpine’s highly qualified Security Operation Center (SOC) ensures the ongoing detection and resolution of security-related incidents, thereby also contributing to prevention. To reduce the risk of unauthorized access to IT systems and applications, supplementary penetration tests are conducted. In the past business year, broad-based online campaigns were once again conducted to further raise awareness among employees regarding IT security issues, particularly the dangers posed by phishing attacks. Furthermore, an IT Security Roadmap is being implemented to continuously enhance security through technical measures. This includes, among other things, the continuation of network segmentation between production IT and office IT. An internal working group regularly collects information on potential cyber fraud attacks (such as social engineering, CEO fraud, payment and/or delivery redirection, and phishing) and develops preventive measures, or reviews existing measures for their effectiveness and adjusts them as necessary. To prevent potential cyber fraud attacks, corresponding online campaigns on these topics are also conducted (including simulated phishing awareness programs), and specialized e-learning courses are offered, which also help raise employee awareness. Risks arising from the use of artificial intelligence (AI) are mitigated as effectively as possible through usage and security guidelines (such as an AI corporate policy, a Group-wide AI organization, topic-specific and mandatory training sessions and e-learning courses, as well as an AI system review and approval process as part of the IT demand process).

All of these measures aim to reduce or minimize the risks of failure and downtime, as well as the unavailability of IT systems and essential IT services, due to causes such as cyberattacks, human error, manipulation, hardware defects, and similar factors.

Personnel risks

Within the voestalpine Group, employees, with their expertise and dedication, represent a key factor in the company’s success. Both positioning voestalpine AG as an attractive employer and implementing targeted employee retention measures are intended to ensure the availability of qualified skilled workers to the extent required. Ongoing training and education, fair working conditions and terms, a modern working environment, and a wide range of development opportunities are some of the key aspects in this regard. Internal apprentice training is another focal point.

Knowledge management/project management

To safeguard the Group’s knowledge over the long term, and especially to prevent the loss of existing expertise, complex projects have been initiated, which are consistently implemented, further developed, and adjusted as needed. Besides permanently documenting all available knowledge, new insights from key projects as well as from lessons learned as a result of unplanned events are incorporated where appropriate. Detailed process documentation, particularly in IT-supported areas, also contributes to preserving existing knowledge.

Potential risks arising from projects (such as large-scale projects or investments) are mitigated through the use of a wide variety of project management tools, appropriate project monitoring, and—depending on the project’s size—regular project oversight meetings involving top management. This applies in particular to potential ramp-up or cost escalation risks. Insights gained from past activities are also compiled as lessons learned and form the basis for ongoing enhancements of existing tools to ensure that they are consistently applied in future projects.

Compliance risks

Compliance violations (such as breaches of antitrust and anti-corruption regulations) pose a significant risk and can lead to adverse consequences in terms of financial losses and reputational damage. A Group-wide compliance management system is designed to counteract these risks and, in particular, any potential antitrust and corruption violations. Topic-specific in-person training sessions as well as e-learning modules are part of this system. Additional information can be found in the consolidated sustainability reporting in the Group Management Report (chapters “ESRS2 SBM-3 Material Impacts, Risks, and Opportunities and Their Interaction with Strategy and Business Model” and “ESRS G1 Corporate Governance”).

Risks of noncompliance with data protection requirements

A violation of data protection regulations can result in financial losses and reputational damage. Based on the Group-wide data protection guidelines, a data protection organization has also been established to support the management of Group companies in fulfilling their responsibilities and complying with legal and internal Group data protection regulations. A topic-specific e-learning course serves as a supplementary measure.

Risks from natural hazards, physical climate risks

The physical risks associated with climate change arising from natural disasters are outlined in the consolidated sustainability reporting within the Group Management Report (chapters “ESRS2 SBM-3-E1 Climate Change” and “ESRS E1 Climate Change”). The precautionary measures implemented in response to the identified risks are regularly reviewed for current relevance and completeness and, if necessary, adapted to new circumstances or expanded (for example, through regular drills, testing of existing emergency plans, as well as site inspections and “risk surveys” with insurance companies). The existing insurance coverage for natural disasters and other risks is regularly reviewed for its current status in collaboration with our internal insurance company (voestalpine Insurance Broker GmbH). The effectiveness of the implemented measures is continuously monitored to ensure appropriate risk management and to counteract the progression of climate change as effectively as possible.

Other sustainability risks

Potential additional sustainability risks, including issues such as climate and environmental protection, social and employee matters, respect for human rights, and anti-corruption, are considered in terms of their potential impact at all levels and in line with the Group’s sustainability strategy. Further details can be found in the consolidated sustainability reporting in the Group Management Report (chapter “ESRS2 SBM-3 Material Impacts, Risks, and Opportunities and Their Interaction with Strategy and Business Model” as well as in the topic-specific chapters).

Activities required to comply with the German Supply Chain Due Diligence Act have been initiated. Process requirements for affected sites have been rolled out and are being addressed on an ongoing basis. Initial implementation measures have been launched in preparation for the European Supply Chain Due Diligence Act. These legal developments result in increased additional costs, as the responsibility for implementation has been shifted to large companies without a specified minimum standard. Legal developments continue to be monitored and evaluated on an ongoing basis, and planned measures are being consistently implemented.

Structural change in european industry (Deindustrialization of Europe)

High energy and labor costs, strict environmental requirements, bureaucratic barriers, and regulatory uncertainties are placing pressure on Europe’s competitiveness and could lead, for example, to an increasing shift of production and investments abroad, a decline in sales volumes and margins, a further rise in insolvencies, and competitive disadvantages due to one-sided regulations. In this environment, protective measures to safeguard the competitiveness and stability of European industry are of considerable importance. Developments continue to be closely monitored and assessed, existing measures are being consistently implemented (see, for example, the discussion below on default and credit risk), and additional measures are being taken where necessary.

Risks from the financial sector

Financial risk management is centrally organized with regard to policy-making, strategy formulation, and goal-setting. The existing framework includes objectives, principles, responsibilities, and authorities for both Group Treasury and the finance departments of the individual Group companies. Financial risks are continuously monitored and hedged where appropriate. The strategy for foreign currency risk management focuses in particular on achieving natural hedges, while the strategy for other risks (interest rates and commodities) aims to reduce fluctuations in cash flows and revenues and to hedge contribution margins. Market risks are hedged to a large extent using derivative financial instruments, which are used exclusively in connection with an underlying transaction.

Specifically, financing risks are hedged through the following measures:

Liquidity Risk

Liquidity risks generally arise from the possibility that a company may be unable to meet its financial obligations. The company’s existing liquidity reserves enable it to meet its obligations on time, even in times of crisis. In addition to the liquidity reserve, a key tool for managing liquidity risk is precise liquidity planning, which is prepared on a quarterly, rolling basis. Based on the consolidated results, the Group’s central treasury determines the need for financing and credit lines from banks. The planned liquidity requirement for the next twelve months consists of scheduled cash outflows for the repayment of bonds, loans, and other financial liabilities, dividends, investments, and the identified working capital requirement. When considering uncommitted working capital financing programs, a distinction is made between asset-side structured programs (e.g., factoring) and liability-side programs (e.g., supplier finance). While the latter must be backed almost entirely by liquidity reserves due to their dependence on the Group’s creditworthiness, the coverage requirement for factoring programs is lower. This results from the broad risk diversification across numerous debtors, a structure comparable to collateralization, and the ability to continue the programs even under stress conditions. The liquidity reserve required to meet liquidity needs consists of short-term available cash balances held by Treasury, unused committed credit lines with maturities of more than one year, planned positive free cash flows, contractually fixed asset sales, and, where applicable, highly liquid securities positions. The liquidity reserves must cover the identified liquidity requirements for the coming 12 months. Furthermore, the banking policy emphasizes a broad diversification of financial partners to avoid concentration risks. Particular importance continues to be placed on increasing internal financing capacity.

Credit Risk

Credit risk refers to financial losses that may arise from the failure of individual business partners to fulfill their contractual obligations. The credit risk of the underlying transactions is largely hedged by a high proportion of credit insurance and banking collateral (guarantees, letters of credit). The default risk for the remaining residual risk is managed through defined processes for credit assessment, risk evaluation, risk classification, and credit monitoring. Due to the current war in Ukraine, there have been no significant reductions in credit insurance limits or increases in bad debt across the individual customer segments in the past. The credit risk of counterparties to financial contracts is managed through daily monitoring of the ratings and changes in the CDS (credit default swap) levels of the counterparties. Investment limits, weighted by the probability of default (PD), are allocated on that basis.

Currency Risk

The primary objective of foreign currency risk management is to achieve a natural hedge (cross-currency netting) within the Group by pooling cash flows. Hedging is carried out centrally through the use of derivative hedging instruments by Group Treasury. voestalpine AG hedges its budgeted foreign currency cash flows (net) with maturities of up to twelve months. Longer-term hedging is carried out only for contracted project transactions, such as deliveries to the aerospace industry. The hedging ratio ranges between 25% and 100% of the budgeted cash flows over the next twelve months, with the level of the hedging ratio depending on the business model of the respective Group company concerned. Furthermore, the hedging ratio generally decreases with the term.

Interest Rate Risk

Interest rate risk is assessed centrally for the entire Group at voestalpine AG. Here, cash flow risk (the risk that interest expense or interest income will change to the Group’s disadvantage) is managed in particular. As of March 31, 2026, a one-percentage-point increase in interest rates would result in a decrease in net interest expense from bank loans and capital market liabilities of EUR 3.9 million in the subsequent business year. However, this is a point-in-time assessment that may fluctuate over time.

Price Risk

Price risk assessment is also conducted at voestalpine AG. Scenario analyses are primarily used to quantify interest and currency risks.

Risk of economic crime

To prevent fraudulent acts as effectively as possible, the voestalpine Group has established a comprehensive internal control system (ICS) aimed at minimizing risks associated with business processes, preventing potential errors, and supporting the Group in achieving its objectives to the greatest extent possible. The ICS is designed to prevent financial and reputational losses caused by acts detrimental to the Group’s assets. Those include, for example, unlawful enrichment in the form of theft, fraud, embezzlement, forgery of documents, and misappropriation, as well as the taking of undue advantage or favoritism, for the purpose of obtaining personal or other benefits.

The internal control system comprises guidelines and requirements adopted by the Executive Board of voestalpine AG that are binding across the Group and must be applied by all Group companies, along with key control measures.

Furthermore, in line with the decentralized structure of the voestalpine Group, the local management of each Group company is obligated to design a supplementary ICS that meets the requirements of the respective company, while complying with Group guidelines and any mandatory external requirements.

The ICS structure within the voestalpine Group extends across all organizational units, all hierarchical levels, and all business divisions and is integrated into all business processes.

Like risk management, the internal control system at the voestalpine Group is based on the internationally recognized frameworks of COSO (Committee of Sponsoring Organizations of the Treadway Commission).