Our Governance

Effective governance is fundamental to how Enerjisa Üretim creates, protects and sustains long-term value. Our governance framework establishes the structures, responsibilities, systems and standards through which the Company is directed, managed and controlled. By connecting strategic oversight, executive accountability, governance functions, specialized committee structures, enterprise risk and opportunity management and responsible business conduct within a single governance framework, we strengthen informed decision-making, organizational resilience and long-term value creation.

Governance at Enerjisa Üretim is built on clearly defined roles and responsibilities across the Board of Directors, the Leadership Team, governance functions and specialized committee structures. While the Board of Directors provides strategic oversight and supervises the Company’s long-term direction, the Leadership Team is responsible for strategy execution and operational management. Working alongside executive leadership, our governance ecosystem brings together enterprise-wide capabilities, including enterprise risk, compliance, regulatory affairs, sustainability, cybersecurity and corporate communications. This integrated structure strengthens cross-functional collaboration, embeds governance into day-to-day management and supports coordinated decision-making across the organization. Specialized committees complement this structure by providing focused oversight and expertise across strategic, financial, operational, technical, sustainability and innovation matters.

The governance framework is reinforced by enterprise risk and opportunity management, internal audit and internal control processes that support effective oversight, independent assurance and continuous improvement. It is further supported by our corporate policies, compliance framework and responsible business conduct practices. Together, these governance elements strengthen strategic decision-making, enable effective management of risks and opportunities, and support sustainable value creation over the short, medium and long-term.

Our committee structure strengthens governance by bringing together executive leadership and cross-functional expertise to support informed decision-making, effective oversight and coordinated execution across the organization. Operating under clearly defined mandates, our committees oversee strategic priorities, financial and operational performance, innovation, sustainability and enterprise risk management while facilitating collaboration across business functions and supporting the Board of Directors and executive management in fulfilling their responsibilities.

To ensure clear accountability and effective governance, our committee structure is organized across three levels according to reporting lines and decision-making responsibilities: Board Level Committees, Leadership Team Level Committees and Function Level Committees.

Board Level Committees

Audit Committee

The Audit Committee includes two members of the Board of Directors and enhances transparency by overseeing the Company’s financial reporting processes, internal control systems and independent audit activities. The Committee safeguards the independence and objectivity of the internal audit function by overseeing circumstances that could impair auditor independence and reviewing significant audit findings, including ethical and compliance matters. Through its oversight role, the Committee supports the integrity, transparency and effectiveness of the Company’s governance and assurance framework.

Financial Control and Risk Committee

The Financial Control and Risk Committee includes two members of the Board of Directors and supports the Board by overseeing the Company’s financial control framework, enterprise risk management processes and risk governance practices. The Committee reviews the Company’s risk profile, risk appetite, key financial and non-financial risks, as well as the effectiveness of mitigation and adaptation measures. Through its oversight role, it supports risk-informed decision-making, strengthens the Company’s resilience to sustainability- and climate-related risks and opportunities, and enhances the effectiveness of the overall risk management framework.

Leadership Team Committees

Technical Risk Committee

The Technical Risk Committee includes the CEO, the Assistant General Managers responsible for Operations and New Technologies and Operations and Supply Chain, and the Director of Asset Management and Sustainability. The Committee oversees technical risks and opportunities across the lifecycle of the Company’s power plants and the Senkron Remote Operations Center, covering development, construction, operation and decommissioning. It reviews risks related to process safety, occupational health and safety, environmental and social performance, compliance, human rights, reputation, financial performance and project execution. Through its oversight role, the Committee supports risk-informed decision-making and the integration of technical risk management into governance, investment decisions, operational management and long-term asset management.

Risk Leadership Committee

The Risk Leadership Committee provides strategic direction for enterprise-wide risk management by guiding the development of the Company’s organizational structure and risk culture. The Committee identifies systemic risks, evaluates their implications for long-term strategy and supports the continuous development of risk management practices across the organization.

Sustainability Steering Committee

The Sustainability Steering Committee is chaired by the CEO and includes the CFO, the Assistant General Managers responsible for Operations and Technical Functions, Operations and Supply Chain, and Human and Culture, together with one independent member. The Committee defines the Company’s sustainability vision, sets sustainability objectives, allocates resources, oversees sustainability performance and provides strategic direction for sustainability initiatives. Supported by the Sustainability Department, it oversees the implementation of the Company’s sustainability strategy, including social strategy, stakeholder engagement, social investment and sustainability reporting across corporate functions and power plants. Through its oversight role, the Committee supports the integration of sustainability into strategic decision-making and business operations.

Function Level Committees

Innovation Committee

The Innovation Committee coordinates initiatives that maximize organizational value through projects and opportunities beyond conventional procurement processes. Acting as a cross-functional platform, the Committee strengthens collaboration between business units and the New Technologies function, facilitates the evaluation of emerging technologies, startup opportunities and innovation projects, and supports the implementation of innovative solutions across the organization. Committee members monitor technology and industry developments within their areas of expertise, identify operational challenges and innovation opportunities, and contribute to strategic decision-making by evaluating proposed projects and potential collaborations. Following the Committee’s positive evaluation, innovation projects and collaboration opportunities progress through the Company’s internal governance and evaluation processes in coordination with the New Technologies team and relevant business functions.

Sustainability Management Committee

Operating under the leadership of the Director of Asset Management and Sustainability, the Sustainability Management Committee coordinates the implementation of sustainability activities across operational regions, evaluates sustainability strategy and policy developments, and integrates sustainability objectives into business planning. Meeting at least six times annually, the Committee oversees the Company’s environmental, social and economic sustainability objectives and is supported by Eastern, Western and Central Working Groups, which coordinate regional sustainability initiatives and project proposals.

Commercial Risk Committee

The Commercial Risk Committee oversees the assessment and management of market, credit, operational and financial risks arising from commercial activities. The Committee evaluates and approves changes to commercial risk procedures, determines risk limits, reviews new product and market entry initiatives, and promotes commercial risk awareness across the organization.

Asset & Liability Committee

The Asset & Liability Committee oversees the monitoring and management of financial risks relating to deposits, borrowings, foreign exchange and interest rate exposures. The Committee evaluates the Company’s financial position and develops action plans aligned with its risk appetite to support sound financial management and financial resilience.

At Enerjisa Üretim, Enterprise Risk and Opportunity Management (ERM) supports long-term value creation, operational resilience and sustainable growth through an integrated and forward-looking approach. We manage risks not only as potential threats but also as strategic inputs that may create value when assessed proactively and systematically. Accordingly, we embed risk management into strategic planning, operational management, financial planning, investment evaluation and sustainability-related decision-making processes across the organization.

The Corporate Risk and Internal Control Department leads our enterprise risk management framework in close coordination with business units and the Technical Risk Management, Sustainability and Environmental Management, and Asset Management functions. These functions identify, assess and monitor risks and opportunities within their respective areas of responsibility. Their assessments are consolidated and integrated into our enterprise-wide risk management process, bringing together technical expertise, sustainability perspectives and enterprise risk disciplines in line with our risk appetite and long-term strategic objectives.

We evaluate operational data, market indicators, regulatory developments, audit findings, stakeholder feedback and management system requirements together to develop a holistic understanding of the Company’s risk profile. Our assessments consider our own operations as well as, where relevant, exposures across the value chain, including upstream activities such as procurement, equipment supply and construction services, and downstream interfaces including grid connections and electricity markets.

We manage risks and opportunities through a structured process covering identification, assessment, prioritization, response, monitoring and continuous improvement. We identify risks through operational monitoring, field observations, structured analyses, periodic assessments, audit activities, market intelligence, regulatory developments and information obtained from external stakeholders, including lenders, insurers and independent technical advisors.

Our Technical Risk Management function applies this process across the entire asset lifecycle, from design and construction through commissioning, operation, maintenance and decommissioning, to identify risks before they materialize and support operational continuity and asset performance. We assess technical risks across multiple impact dimensions, including health and safety, environmental performance, human rights, compliance, reputation, financial performance, asset availability and project delivery, enabling balanced decision-making throughout the lifecycle of our assets.

We record identified risks through a centralized digital platform integrated with technical change management, project management, budgeting and investment planning processes. This enables us to evaluate risks together with their cost, schedule and operational impacts, supporting more holistic and data-driven decision-making.

We assess risks and opportunities using standardized methodologies supported by likelihood-impact evaluations, a 5×5 risk matrix, scenario analyses, stress testing and Monte Carlo simulation methodologies.

We use quantitative analyses to evaluate the potential impacts of uncertainties on EBITDA, net income, cash flow and operational continuity under different market conditions through confidence interval calculations, volatility-based scenarios and P5/P95 outputs. We also perform backtesting to compare previous assumptions with realized outcomes and continuously improve our methodologies and forecasting accuracy.

Based on these assessments, we determine appropriate response strategies by eliminating, mitigating, transferring or monitoring risks. We monitor and evaluate risks regularly in line with our risk appetite, strategic priorities and performance targets, integrating assessment outcomes into strategic planning, budgeting, investment evaluation and operational decision-making processes. We review and update risks and opportunities regularly in response to changing market conditions, operational developments, stakeholder expectations and regulatory changes.

Our integrated framework addresses financial, business continuity, technical, enterprise and commercial risks through a coordinated enterprise-wide approach.

Financial Risks primarily arise from energy market volatility, foreign exchange movements, interest rate changes, liquidity conditions, counterparty exposures and financing requirements. We manage these risks through financial modelling, treasury controls, hedging strategies, cash flow forecasting, continuous market monitoring and quantitative analyses supported by forward curves, implied volatilities, market scenarios and stress assumptions.

Business Continuity Risks support the resilience of critical business processes and organizational continuity against potential disruptions arising from external events, operational interruptions, technical failures, natural disasters, technological incidents, supply chain disruptions and crisis situations.

Technical Risks relate to equipment reliability, process safety, occupational health and safety, environmental and social performance, compliance, operational continuity, project execution and asset availability. We integrate technical risk management with budgeting, investment planning and operational decision-making processes, enabling proactive risk management throughout the asset lifecycle and supporting operational continuity and long-term asset performance.

Enterprise Risks include strategic, operational, legal, regulatory, reputational, procurement, information technology and human capital-related risks that may affect the Company’s long-term objectives and overall performance.

Commercial Risks mainly arise from electricity trading activities, market price volatility, counterparty credit exposures and regulatory developments. We manage these risks through established governance processes, defined risk limits and quantitative analytical methodologies.

We integrate sustainability and climate related risks and opportunities into our enterprise risk management framework rather than managing them separately. Our Sustainability and Environmental Management functions evaluate environmental, social and governance related risks and opportunities by considering both the impacts of external developments on the Company’s strategy, operations and financial resilience, and the impacts of our activities on the environment and society.

We incorporate these assessments into strategic planning, investment evaluation, financial planning and operational management processes to support long-term resilience and value creation. We assess sustainability-related risks and opportunities across our operations and, where relevant, throughout the value chain using operational data together with information derived from regulatory developments, market indicators, technical standards and other internal and external sources.

We evaluate climate related risks and opportunities within our broader enterprise risk management framework. Physical risks include floods, water stress, heatwaves, extreme weather events and hydrological variability, while transition risks include carbon pricing mechanisms, evolving regulatory requirements, technology transformation, market developments and sustainable finance conditions. Where relevant, we apply scenario analyses and stress testing methodologies to evaluate resilience under different climate and market assumptions.

We also evaluate opportunities associated with the energy transition, including renewable energy growth, battery storage systems, hybrid generation solutions, energy efficiency improvements and climate resilient infrastructure investments. We assess these opportunities together with risks within our enterprise risk management framework and consider them in strategic planning and investment evaluation processes where applicable.

The Corporate Risk and Internal Control Department operates as a second-line function supporting the effectiveness, consistency and comparability of our enterprise risk management framework across the organization. The department oversees the implementation of risk methodologies, consolidates enterprise-wide risk assessments and supports alignment with our risk appetite and reporting structure. Internal control activities are integrated into the risk management process to strengthen governance, monitoring and reporting reliability.

Our risk management framework is further supported by Risk Partners, Risk Representatives and relevant business units, strengthening risk awareness, accountability and consistent implementation across the organization. We also consider stakeholder expectations when identifying, assessing and prioritizing risks and opportunities, supporting a comprehensive understanding of our risk profile across operations and the value chain.

The Risk Leadership Committee, chaired by the CEO, evaluates systemic risks, emerging risk areas and the overall risk environment from an enterprise-wide perspective. The Technical Risk Committee reviews critical technical risks and their organization-wide impacts, while the Sustainability Steering Committee considers sustainability and climate-related risks within strategic planning and capital allocation processes. Material risks and opportunities, together with related mitigation actions and strategic implications, are consolidated through the established governance structure and reported to senior management and the relevant Board-level governance bodies.

Through this integrated approach, we manage financial, business continuity, technical, enterprise, commercial and sustainability-related risks through coordinated risk management functions and governance mechanisms. We position risk management not merely as an operational process, but as one of the core elements of governance, accountability and corporate performance, strengthening enterprise resilience, enhancing decision-making quality and supporting long-term value creation.

At Enerjisa Üretim, internal audit provides independent and objective assurance to Senior Management, the Audit Committee and the Board of Directors by evaluating the design and operating effectiveness of governance, risk management and the system of internal control. Operating with an independent, objective and value-adding approach, internal audit supports the achievement of our strategic, operational, financial, regulatory and sustainability-related objectives by assessing whether key risks are appropriately identified, managed and monitored and whether controls are designed and operating effectively.

The Internal Audit Department operates under an internal audit strategy that defines its direction beyond the annual audit cycle. This strategy aligns assurance priorities with our strategic agenda, stakeholder expectations, changing business conditions and evolving risks. Internal audit also coordinates closely with Risk Management, Compliance and other assurance providers under a combined assurance approach.

The Internal Audit Department functionally reports to the Audit Committee, which consists of two members of the Board of Directors. The Audit Committee convenes periodically throughout the year to review completed audit engagements, monitor the execution of the annual audit plan, assess significant findings and oversee other matters within its remit.

Internal audit activities are conducted in conformance with the Global Internal Audit Standards issued by The Institute of Internal Auditors (IIA). This approach is supported by formal internal audit methodology, documented policies and procedures, as well as internal and external quality assessments.

Internal audit activities are driven by a risk-based annual audit plan. The plan is derived from an audit universe that maps Enerjisa Üretim’s business processes to risks and provides a structured view of the areas that may be subject to assurance. This enables the Internal Audit Department to prioritize its resources based on relative risk exposure and assurance needs.

The annual audit plan is prepared through a structured risk assessment process. This assessment considers strategic, financial, operational, regulatory, environmental, health and safety, information technology, cybersecurity, market, third-party and governance-related risks. Input is obtained from Senior Management, the Audit Committee, Risk

Management and Compliance functions. The approved audit plan is reviewed throughout the year and may be revised when emerging risks, regulatory developments or significant business events require reprioritization.

Each audit engagement is performed in accordance with a defined lifecycle consisting of planning, fieldwork, reporting and follow-up. Audit findings are shared with the relevant function managers, who develop corrective action plans while auditor opinions regarding the effectiveness of internal controls are presented as part of the reporting process. Action plans are tracked in real time through the system-based Internal Audit Module by the relevant managers and employees, while the results of follow-up studies are periodically reported to the Audit Committee.

Data analytics is embedded throughout the internal audit cycle with a view to obtaining audit coverage, assurance depth, efficiency and value-creating insights on business processes. Various data analytics tools and methodologies, including rule-based continuous monitoring scripts, machine learning and deep learning libraries, and GenAI tools, are utilized in line with engagement objectives.

Beyond audit engagements, the Internal Audit Department also acts as a strategic partner, contributing to Enerjisa Üretim’s decision-making processes through consultancy services. Throughout the year, the Board of Directors, the Audit Committee and the Leadership Team may request deeper analyses of specific business processes or assessments of internal control effectiveness. In such cases, the Internal Audit Department conducts the relevant work, offering valuable insights and supporting process efficiency.

At Enerjisa Üretim, we place great importance on aligning with international standards in line with our principles of sustainable growth, operational excellence and corporate governance. In this context, the governance and coordination of certification processes relating to management systems defined by the International Organization for Standardization (ISO) are conducted by the Internal Audit Department in full compliance with the Global Internal Audit Standards.

In 2025, the Internal Audit Department conducted 20 internal audit engagements and two consultancy studies. During the year, the governance and coordination of certification activities covering seven ISO management system standards were ensured, including ISO 9001 Quality

Management System, ISO 14001 Environmental Management System, ISO 22301 Business Continuity Management System, ISO 27001 Information Security Management System, ISO 45001 Occupational Health and Safety Management System, ISO 50001 Energy Management System and ISO 55001 Asset Management System. Throughout the year, 7 external audits conducted by accredited organizations were successfully completed with zero major or minor nonconformities identified during these reviews.

These results underscore our full compliance with management systems and demonstrate the effective implementation of our continuous improvement approach.

At Enerjisa Üretim, responsible business conduct is embedded into the way we govern our operations, make decisions and engage with our stakeholders. Beyond complying with applicable laws and regulations, we are committed to conducting our business with integrity, accountability and respect for people while protecting the interests of our employees, contractors, suppliers, business partners, customers, shareholders and the communities in which we operate.

Our responsible business conduct framework integrates compliance, human rights, business ethics, anti-bribery and anti-corruption, and data protection and privacy within a consistent governance approach. These commitments are implemented through corporate policies, management systems, due diligence processes, training and awareness programs, reporting mechanisms and ongoing monitoring activities that support the consistent implementation of responsible business practices across our operations and value chain.

Together, these elements strengthen transparency, accountability and stakeholder trust while supporting compliance with evolving regulatory requirements, alignment with internationally recognized standards and long-term value creation.

Our responsible business conduct framework is supported by a comprehensive framework of Corporate Policies that establishes common principles across the organization while providing a consistent foundation for governance, ethics, compliance, human rights, sustainability, enterprise risk management, information security, business continuity, privacy and our people and culture. Developed in alignment with the policy principles and compliance expectations established by our shareholders, Sabancı Holding and E.ON, these policies are regularly reviewed and updated to reflect changes in legislation, regulatory expectations, international standards and evolving business needs.

Our publicly available Corporate Policies communicate our commitments relating to governance, ethics, human rights, sustainability, enterprise risk management, information security, business continuity, privacy and our people and culture. They include our Environmental, Social and Governance Policy, Enterprise Risk Management Policy, Integrated Management Systems Policy, Human Rights Policy, People and Culture

Policy, Social Responsibility Policy, Code of Business Ethics, Compliance Rules, Privacy Policy, Protection and Processing of Personal Data, Information Security Management Policy, Business Continuity Policy, Open Door Policy, Policy on Zero Tolerance Against Violence and Harassment, and Informative Text on Security Cameras.

These Corporate Policies are supported by more detailed manuals, policies, procedures, operating standards and implementation guides governing specific topics, including competition law compliance, anti-money laundering, anti-bribery and anti-corruption, sanctions and export controls, procurement, communication, non-retaliation, gifts, donations and sponsorships, intellectual property, personal data protection, records retention and destruction, supplier due diligence and other responsible business practices. The following sections explain how these governance instruments are implemented through our Compliance, Human Rights, Business Ethics, Anti-Bribery and Anti-Corruption, and Data Protection and Privacy frameworks.

For detailed information about each policy, please click on the headline of the relevant policy.

At Enerjisa Üretim, we maintain a robust and structured compliance framework designed to ensure full adherence to applicable laws, regulations and internal policies across all areas of our operations. Our compliance function is managed by the Legal and Compliance Department, which proactively identifies, assesses and mitigates compliance risks across our value chain and reports material compliance matters to Senior Management. Our compliance program is built around three complementary pillars: Regulatory Compliance, Ethical Compliance and Sanctions Compliance.

The Enerjisa Üretim Compliance Manual serves as the foundation of our compliance framework. Prepared in line with the policy and rule sets established by our shareholders, Sabancı Holding and E.ON, it establishes the overarching compliance principles governing our operations and provides the framework for all supporting compliance policies and procedures. The Compliance Manual is periodically reviewed and updated to reflect changes in applicable legislation, regulatory expectations and international best practices and is disseminated across the organization to ensure consistent understanding and application of our compliance standards. It is publicly available in both Turkish and English on our website.

The Compliance Manual establishes standards covering compliance and business ethics in our internal and external relations, the protection of corporate assets and information, the prevention of conflicts of interest, anti-bribery, anti-money laundering and anti-corruption, competition law, international sanctions and compliance with applicable legislation, including personal data protection requirements. It also provides guidance on the proper use of Company resources, the handling of confidential and proprietary information, the conduct of business with public authorities and government entities, and the management of third-party relationships in accordance with applicable legal and ethical standards. In addition to defining our legal obligations, the Compliance Manual establishes our responsibilities towards customers, employees, shareholders, suppliers and business partners, competitors, society and the environment, providing a comprehensive ethical and legal framework for our business activities.

Regulatory Compliance

Through our Regulatory Compliance framework, the Legal and Compliance Department continuously monitors legislative and regulatory developments relevant to our operations through the systematic review of official gazettes, regulatory announcements and sector-specific publications. Amendments and new regulations affecting our activities are communicated to the relevant business units through dedicated regulation meetings, while legal guidance and informatory notes are prepared where necessary to support timely implementation. The Department also promptly responds to legal inquiries raised by other departments to facilitate compliance with evolving regulatory requirements.

To strengthen regulatory oversight, the Compliance Catalog is circulated on a semi-annual basis to assess compliance with applicable legislative and regulatory obligations across the organization. Any identified instances of non-compliance are reported to the Enerjisa Üretim Compliance Board, whose decisions and directives are communicated to the relevant business units to support timely implementation and remediation. Regulatory monitoring is further supported through weekly regulatory bulletins distributed across the organization and weekly regulation meetings conducted with business-unit managers.

We place particular emphasis on compliance with competition law and antitrust regulations. Comprehensive competition law compliance rules are made available to all employees, providing guidance on the prohibition of anti-competitive agreements, the prevention of concerted practices, interactions with competitors, the management of commercially sensitive information and obligations arising under applicable merger control regimes. These requirements are supported through regular competition law training programs incorporating practical case studies and scenario-based learning, while compliance with competition law obligations is subject to ongoing monitoring by the Legal and Compliance Department.

Ethical Compliance

Ethical Compliance constitutes one of the three pillars of our compliance framework and promotes a culture of integrity, transparency and responsible business conduct across our operations. We have established comprehensive policies, procedures, workflow diagrams and process maps governing ethical conduct across all business activities. These governance instruments define the standards of behavior expected from our people and provide structured guidance for the identification, escalation and resolution of ethical issues.

Our ethical compliance framework is reinforced through a multi-layered training and awareness program designed to embed a culture of integrity throughout the organization. Compliance training is mandatory and refreshed annually, while every employee periodically re-signs the Code of Ethics Compliance Statement to reaffirm individual responsibilities and commitment to our ethical principles. Detailed information regarding our business ethics framework, including our Code of Business Ethics, anti-bribery and anti-corruption practices, reporting mechanisms, investigation procedures and employee awareness activities, is provided in the following section.

Sanctions Compliance

Our Sanctions Compliance framework addresses obligations arising from applicable international and national sanctions regimes, export control regulations and related restrictions. Before establishing a business relationship, all customers and suppliers are screened against applicable sanctions lists, restricted party lists and adverse media databases through dedicated risk center applications as a mandatory element of our counterparty due diligence process.

Beyond this initial assessment, regular monitoring and automated screening processes continue throughout the business relationship to identify changes in the sanctions status of existing counterparties and ensure that sanctions-related risks are continuously assessed and managed. Where a counterparty is determined to be non-compliant or becomes subject to applicable sanctions, export controls or other relevant restrictions, the business relationship is terminated in accordance with our internal procedures and contractual provisions.

Our contractual framework incorporates compliance undertaking clauses requiring counterparties to comply with applicable sanctions regimes, anti-money laundering requirements and compliance standards throughout the term of the relevant agreement, while granting Enerjisa Üretim the right to terminate contractual relationships in the event of non-compliance.

Compliance Governance

Where non-compliance with the Compliance Manual or related policies is identified, the matter is reported to the Enerjisa Üretim Compliance Board. The Board evaluates reported matters, commissions investigations where necessary, determines appropriate corrective measures, monitors the implementation of remedial actions and supports the continuous improvement of our compliance framework.

We maintain Compliance Violation Reporting Channels enabling employees and business partners to report suspected non-compliance with the Compliance Manual and related policies by telephone, e-mail or through dedicated reporting mechanisms. Reports are managed independently by the Legal and Compliance Department and reviewed by the Compliance Board. Access to the reporting channels and the information received is restricted to the Chief Legal and Compliance Counsel and the Compliance Counsel. Following a preliminary assessment, matters relating to ethical conduct are referred to by the Internal Audit Department for further investigation.

ESG Compliance

In addition to our traditional compliance framework, we operate an ESG Compliance framework that supports alignment with international standards and responsible business practices. ESG Compliance includes assessments undertaken before investment and design decisions to identify potential environmental and social risks, establish appropriate management procedures and evaluate the effectiveness of mitigation measures. Continuous internal monitoring is conducted across multiple functions to support compliance with established commitments and procedures, while new policies and procedures are developed where necessary to address identified improvement areas and reflect evolving international standards.

Our ESG compliance practices are implemented through corporate policies and management systems, employee training programs, monitoring and reporting mechanisms, and grievance and incident reporting processes. We conduct our activities in alignment with internationally recognized frameworks, including the OECD Guidelines for Responsible Business Conduct for Multinational Enterprises, the Ten Principles of the United Nations Global Compact, the United Nations Sustainable Development Goals, the IFC Performance Standards and the EBRD Environmental and Social Policy.

Compliance management is supported through continuous monitoring, regular reporting and review mechanisms under the Environmental and Social Management System (ESMS). Policy implementation and ESG targets are monitored under the supervision of the Sustainability Management Committee and Senior Management, while stakeholders are able to report potential ESG-related violations through established grievance and reporting mechanisms. Our ESG policies and procedures are regularly reviewed and updated to remain aligned with evolving regulatory requirements, international standards and emerging best practices.

At Enerjisa Üretim, respect for human rights, ethical business practices and social responsibility are integral to how we conduct business and create long-term values. Guided by the principle of equality, we seek to manage our activities fairly, inclusively and responsibly while respecting the dignity and fundamental rights of individuals throughout our value chain. Our commitment extends across employees, contractors, suppliers, business partners and local communities and is embedded into our policies, management systems and decision-making processes.

As a signatory to the United Nations Global Compact, we are committed to upholding internationally recognized principles relating to human rights and responsible business conduct. Our approach is guided by the United Nations Guiding Principles on Business and Human Rights, the OECD Guidelines for Responsible Business Conduct for Multinational Enterprises, the ILO Declaration on Fundamental Principles and Rights at Work, the Worst Forms of Child Labor Convention (No. 182) and the Women’s Empowerment Principles.

The Company respects the constitutional rights to unionize and bargain collectively. All employees are free to join a union and exercise these rights of their own free will.

Our Human Rights Framework

Our Human Rights Policy establishes the principles through which we respect, protect and promote human rights across our operations and value chain. Human rights considerations are embedded into our governance, management systems and business processes, while implementation is supported through training and awareness programs, stakeholder engagement, grievance mechanisms, regular reviews and ongoing monitoring. We periodically review our policies and practices to respond to evolving human rights expectations and emerging risks.

Human Rights in the Workplace

Human rights considerations begin with recruitment and continue throughout the employment lifecycle, supporting equal opportunity, fair treatment and respect in the workplace. Through our zero-tolerance approach to violence and harassment, we seek to ensure a workplace that is equitable, inclusive and free from all forms of violence. Inclusion and psychological safety are embedded through structured diversity, equity and inclusion initiatives, inclusive communication practices and employee voice mechanisms that enable individuals to express ideas and contribute fully. At Enerjisa Üretim, GBVH (Violence, Harassment and Discrimination Prevention) and Human Rights training programs are key instruments for building a safe, inclusive and respectful work environment. GBVH training focuses on raising awareness around violence, harassment, discrimination and gender-based risks while strengthening a respectful, equality-based communication culture and a shared understanding of prevention and reporting mechanisms. Human Rights training complements this approach by addressing non-discrimination, equal opportunity, the prevention of forced and child labor and fundamental workplace rights, reinforcing our ethical standards. In 2025, employees completed 2,242 hours of Diversity and Inclusion training.

Human Rights Across Our Value Chain

Respect for human rights extends across our value chain and guides our relationships with suppliers, contractors, business partners and local communities. Our Human Rights Policy establishes the principles governing these relationships, while our Sustainable Procurement Principles (Supplier Code of Conduct) translates these principles into expectations for suppliers and business partners relating to human rights, fair labor practices, prevention of child and forced labor, non-discrimination, safe working conditions and respect for local communities. These expectations are reinforced through supplier engagement, supplier development and training activities.

Human rights considerations also inform our project development, social investment and community engagement activities. Expectations regarding human rights assessments under the Equator Principles and IFC Performance Standards are considered where relevant, while our approach also supports responsible supply chain management, social risk management and the implementation of the Tufanbeyli Energy Base Just Transition Roadmap. Further information on responsible supply chain management, supplier engagement, supplier development, Social Impact Assessments, community engagement, strategic social investments and Just Transition implementation is provided in the Supply Chain and Social Impact sections of the 2025 Performance & Outlook chapter.

During 2024, we updated policies and procedures relating to gender equality and the prevention of sexual violence and discrimination, further strengthening awareness among employees and stakeholders. Throughout 2025, no legal or criminal proceedings related to human rights cases were recorded.

Through this integrated approach, we strengthen responsible business conduct, foster trust with our stakeholders and contribute to a fair, inclusive and sustainable ecosystem across our value chain.

At Enerjisa Üretim, our ethical values are one of the cornerstones of our corporate culture and guide how we conduct business, make decisions and engage with employees, shareholders, customers, suppliers, business partners and other stakeholders. We are committed to maintaining the highest standards of ethical business conduct across all levels of our organization through full compliance with applicable laws and regulations, internal policies and procedures, and business ethics principles. We adopt a zero-tolerance approach towards bribery, corruption and any form of unethical behavior in all of our business dealings, whether involving public officials, private counterparties or any other third parties.

Our Code of Business Ethics (EnEtik)

Our business ethics framework is built around the Enerjisa Üretim Code of Business Ethics (EnEtik), which serves as a guide to ensure that our ethical principles and values are consistently applied in a sustainable manner. The purpose of the Code is to define the business ethics rules and principles governing the relationships and working practices of employees, customers, shareholders and all other stakeholders across Enerjisa Üretim and its subsidiaries, together with the policies supporting these principles, while establishing responsibilities and providing guiding principles for ethical decision-making. It is based on a corporate structure developed to ensure ethical compliance in all our relationships with internal and external stakeholders.

Our ethical compliance framework is supported by a comprehensive set of policies, established procedures, workflow diagrams and process maps that provide clear and practical guidance to all employees on expected standards of behavior. Together, these governance instruments cover conduct areas that are critical to sound governance, including the protection of Company assets and confidential information, the prevention and disclosure of conflicts of interest, compliance with legal obligations, fair and respectful workplace conduct, responsible relationships with suppliers and business partners, the prevention of bribery, corruption and money laundering, the regulation of gifts, hospitality and entertainment, third-party due diligence and the proper handling of facilitation payments. All policies are regularly reviewed and updated to reflect changes in applicable legislation, international best practices and the evolving risk landscape of our operations.

These rules are binding for both our employees and business partners and apply across all internal and external interactions, strengthening the understanding of ethical management throughout our operations and value chain. Accordingly, we require our business partners to commit to ethical compliance through contractual arrangements and ensure the implementation of ethical compliance principles throughout our business processes. As stated in our Anti-Money Laundering, Anti-Corruption and Anti-Bribery Policy, we embrace the anti-corruption and anti-bribery principles of the United Nations Global Compact and the OECD Guidelines for Responsible Business Conduct for Multinational Enterprises.

Training and Awareness

Employee awareness is a central element of our ethics and compliance framework. To promote and reinforce awareness of ethical standards, we provide mandatory ethics and compliance training through our e-learning platform, covering key topics such as the Code of Business Ethics, anti-bribery and anti-corruption, conflicts of interest, gifts and hospitality policies, whistleblowing procedures, reporting obligations and the practical implications of ethical decision-making. These training programs are complemented by annual ethics and compliance training sessions organized by our shareholders, Sabancı Holding and E.ON, which all employees are required to complete within the designated timeframes.

To strengthen ethical judgement, we provide interactive e-learning training series incorporating role-playing exercises and scenario-based case studies designed to enhance practical understanding of ethical dilemmas employees may encounter in their day-to-day activities. These scenario-based modules simulate real-world situations, including interactions with public officials, procurement processes and supplier relationships, enabling employees to apply ethical principles in a controlled learning environment. Throughout the year, periodic reminders are issued and training modules are reassigned to reinforce our ethical culture. In addition, in-class training sessions are conducted at our operational sites, including power plants and field offices, to ensure that field-based employees are equally engaged in the ethical compliance program. In 2025, employees completed 154 hours of Compliance, 285 hours of Business Ethics, 418 hours of Anti-Bribery and Anti-Corruption training. Completion rates of all training programs are tracked and reported to Senior Management, and employees who do not complete mandatory training within the prescribed period are subject to follow-up measures.

To reinforce accountability, employees periodically renew their commitment to our ethical principles by completing assigned training programs and signing the Code of Ethics Compliance Statement. This confirmation supports company-wide adoption of ethical standards, reinforces individual responsibilities and creates a recurring control point through which participation can be monitored, expectations reinforced and awareness gaps addressed.

Reporting Channels

In addition to the Compliance Board’s oversight function, Enerjisa Üretim fosters a culture that consistently strives to act in a responsible and ethical manner, adhering to the principles of respectability and reliability throughout our business processes and decision-making mechanisms. In accordance with our Code of Business Ethics, employees and other stakeholders, including shareholders, customers, suppliers, business partners and public institutions, may report possible ethical violations and unethical actions through either the dedicated Enerjisa Üretim Ethics Hotline Channels or the Compliance Violation Reporting Channels.

Enerjisa Üretim provides employees and other stakeholders with multiple channels to report actual or suspected ethical misconduct, including the dedicated Ethics Hotline. Ethical notifications may be submitted anonymously, and individuals are not required to provide personal data when making a report. Where a notification contains personal data, it is examined in accordance with the Personal Data Protection Law No. 6698 (PDPL).

Review Mechanisms

Where a potential ethical violation is reported through the Ethics Hotline Channels, the matter is reviewed impartially and confidentially in accordance with the applicable procedures. Where a potential ethical violation is reported through the Compliance Violation Reporting Channels, the matter is referred to the Internal Audit Department, which assumes responsibility for conducting an independent and confidential ethical review and investigation. Upon completion of its review, Internal Audit reports its findings and recommendations to the Compliance Board for determination of the appropriate course of action.

A Workplace Conduct Review Board reviews the outcomes of investigations and determines appropriate disciplinary actions where necessary. This governance structure supports the consistent evaluation of business ethics concerns, fair treatment of all parties involved and timely remediation of confirmed issues.

We maintain a clear non-retaliation approach for employees and third parties who, in good faith, report suspected violations of law, the Code of Business Ethics, internal policies or other compliance concerns. No employee or stakeholder shall be subject to retaliation, discrimination or any adverse consequence as a result of making a good-faith report. All reports are treated with the utmost confidentiality, and the identity of the reporting individual is protected to the fullest extent permitted by applicable law. Access to the reporting channels and the information received is strictly restricted to the Chief Legal and Compliance Counsel and the Compliance Counsel, ensuring the independence and integrity of the investigation process.

External Commitments

Through the processes managed by the Legal and Compliance Department, Enerjisa Üretim is a member of the Ethics and Reputation Society (Etik ve İtibar Derneği), an organization dedicated to promoting ethical business practices and corporate integrity in Türkiye.

We are also a signatory to the United Nations Global Compact through the Global Compact Network Türkiye. In this capacity, we uphold the UN Global Compact’s ten principles across human rights, labor standards, environment and anti-corruption, and report annually on our progress through the Communication on Progress framework.

These memberships and commitments reflect our dedication to embedding ethical conduct and responsible business practices not only within our own operations but also across our broader value chain and stakeholder ecosystem.

Through our Code of Business Ethics and related business ethics and compliance policies, training programs, reporting channels, investigation procedures, non-retaliation safeguards and governance bodies, we promote responsible and transparent business conduct. The overall framework is designed to prevent misconduct, detect and address violations, strengthen employee awareness and embed ethical decision-making into our daily business activities.

At Enerjisa Üretim, protecting personal data and ensuring information security are fundamental to maintaining the trust of our employees, customers, suppliers, business partners and other stakeholders. We manage personal data responsibly, safeguard information assets throughout their lifecycle and continuously strengthen our governance framework to ensure compliance with applicable legislation and evolving regulatory requirements.

Our Data Protection Framework

Our data protection framework is built around the Personal Data Protection and Processing Policy, which defines the principles governing the collection, processing, transfer and retention of personal data. The framework is further supported by the Data Retention and Destruction Policy, which establishes the principles for deleting, destroying or anonymizing personal data once the purpose of processing no longer exists, and the Special Categories of Personal Data Protection Policy, which sets out additional security measures and authorization mechanisms for processing sensitive personal data, including health and biometric data.

We process personal data in accordance with the principles of lawfulness and fairness, accuracy, purpose limitation, data minimization and storage limitation. Where appropriate, Personal Data Processing Necessity and Proportionality Tests are conducted to assess data processing activities and ensure that the collection and processing of personal data remain necessary and proportionate to legitimate business purposes.

Governance and Oversight

Data protection governance is supported through a multi-level responsibility structure led by the Personal Data Protection Commission, comprising representatives from the Legal, Human Resources and Information Technologies departments. The Commission is responsible for determining, implementing and monitoring the Company’s data protection strategy and convenes twice a year.

Departmental data protection representatives monitor the compliance of data processing activities within their respective functions, maintain up-to-date data processing inventories and coordinate with the Legal and Compliance Department where necessary. Based on these inventories, the Legal and Compliance Department fulfills Enerjisa Üretim’s registration obligations with the Data Controllers Registry Information System

(VERBIS). The effectiveness of data protection processes is regularly evaluated through internal audits, enabling areas for improvement to be identified and addressed.

Information Security and Data Protection

We implement comprehensive technical and administrative measures to protect personal data and information assets while ensuring the confidentiality, integrity and availability of information. Technical measures include data encryption, access controls, firewalls, penetration testing, log recording and regular backup processes, while administrative measures include periodic employee training, confidentiality agreements, data processing agreements and data protection provisions incorporated into agreements with third parties.

We protect the personal, commercial and financial information of our Company, employees and stakeholders by implementing preventive measures against unauthorized access and data leakage. We define information security roles and responsibilities with management support and cross-functional coordination, regularly assess information security risks and opportunities, implement corrective and improvement actions, maintain business continuity plans for critical systems and processes, and ensure that information security incidents are reported and appropriate measures are taken to prevent recurrence. In line with our legal obligations regarding personal data protection, we collect personal data for specific and legitimate purposes and process it securely while prioritizing user privacy.

Data Subject Rights

We provide structured mechanisms through which data subjects may exercise their rights under the Turkish Personal Data Protection Law (KVKK), including the rights to access, correct, delete or request information relating to the processing of their personal data. Applications submitted through the Company’s official channels are evaluated and responded to within the statutory timeframes established under the KVKK. Application processes are documented and reported to the Personal Data Protection Commission in accordance with the relevant procedures.

Continuous Improvement

We regularly review our data protection policies, procedures, privacy notices and explicit consent texts to maintain alignment with evolving legislation and regulatory guidance. Decisions and guidance published by the Personal Data Protection Board are monitored and the necessary updates are implemented accordingly. Through continuous awareness activities, employee training and ongoing governance reviews, we strengthen our data protection culture while pursuing the highest standards of privacy, information security and regulatory compliance across the organization.