IBERSOL | Integrated Management Report | 2025

INTEGRATED MANAGEMENT REPORT 2025 Therefore, for the purpose of reporting irregularities, under the aforementioned Law No. 93/2021, of 20 December, which establishes the General Protection Regime for Whistleblowers, as well as the Decreto- Lei n.º 109-E/2021, of 9 December, which establishes the General Corruption Prevention Regime, the Group companies have their own whistleblowing channel available through an email address that is duly informed on the Company’s website at: https://www.ibersol.pt/investidores/canal- de-denuncias/”. I. Internal Control and Risk Management 50. Individuals, bodies or committees responsible for internal audit and/ or implementation of internal control systems. Ibersol does not have autonomous internal audit and compliance services. Risk management, as part of the company’s culture, is present in all processes and is the responsibility of all managers and employees at the different organization levels. Risk management is undertaken with the goal of creating value by managing and controlling uncertainties and threats that may affect the Group companies, with a view to the continuity of operations, to take advantage of business opportunities. As part of strategic planning are identified and evaluated the risks of the existing businesses portfolio and the development of new businesses and relevant projects and defined those risks management strategies. At the operational level, are identified and evaluated the risks management objectives of each business and planned actions to manage those risks that are included and monitored in the plans of business and functional units. With regard to security risks of tangible assets and people are defined policies and standards, and the self- control of its application is made, being conducted external audits to all units and implemented preventive and corrective actions for the identified risks. In order to ensure compliance of the established procedures is performed regularly assessing of the main internal control systems of the group, which have proven to be adequate and efficient taking into account the size of the company and the risks inherent to its activity. 281