Annual Report 2025 – ÖBB-Infrastruktur AG

ÖBB-Infrastruktur Aktiengesellschaft Group Management Report | Consolidated Financial Statements 24 Changes to legislation and regulations can lead to increased system costs, for example due to new technical or organisational requirements. This applies at both the national and international level. Consequently, developments are carefully assessed for their potential implications so that we can respond at an early stage – for example, to the EU Buildings Directive (Directive [EU] 2024/1275) or the draft National Building Renovation Plan, which could, under certain circumstances, entail a significant financial and organisational burden. On the other hand, violations of specific legislation can also lead to significant fines – e.g. REMIT II (Regulation on Wholesale Energy Market Integrity and Transparency), which came into force on 07.05.2024, provides for stricter penalties for violations [possible fines: up to EUR 5.0 million for natural persons and maximum penalties of at least 15% of total annual revenue for legal entities]). Accordingly, specific training courses are held for specific target groups in the specialist areas and internal control systems are also regularly updated. In accordance with the Corporate Liability Act, a company can be held liable and punished for criminal offences committed by its employees or decision-makers. This risk is to be countered. As part of legal risk management, areas that are significant under criminal law are identified. In addition, the current situation in the areas of negligence, environmental offences and corruption is assessed and measures are taken to avoid risks. Preventive measures have been adopted by way of introduction of control and reporting systems, as well as with the issuance of general behavioural guidelines through the Code of Conduct. Appropriate training and the creation of clear areas of responsibility also serve to minimise risk. Purchasing and procurement Risks continue to arise from the uncertainties on the energy markets, which can develop at very short notice due to geopolitical tensions and dynamics – price risks, credit risks and valuation risks are countered not only by expanding in- house generation but also by risk-minimising procurement and market strategies in the energy sector, which are thoroughly evaluated in the context of price developments and volatilities. This focuses, in particular, on contractual arrangements with customers – high and highly volatile electricity prices require binding purchase volumes. Otherwise, the consumption risk caused by customers (volume and price components) would not be acceptable for ÖBB- Infrastruktur AG. Possible effects of geopolitical tensions on the availability of construction products and components are evaluated on an ongoing basis and anticipated as best as possible, for example to assess any scheduling and financial consequences for construction projects at an early stage and to compensate for them as best as possible. Price increases on the energy markets may, in some cases, only affect other price indices with a time lag, meaning that risks of price escalations deviating from plan cannot be ruled out — particularly in the case of persistently high inflation in energy- and material-intensive construction segments. Observing and analysing the markets makes it possible to draft contracts accordingly to minimise risk. Complex infrastructure projects are subject to ongoing risk management, which includes monetary risk provisions to cover any additional costs and is incorporated into the updating of cost forecasts. During project realisation, circumstances may arise in which additional costs incurred by suppliers (construction companies and planners etc.) are claimed as construction progresses. These claims for additional costs are assessed by internal experts, in the case of complex issues also with the assistance of external experts, in terms of reason and amount and recognised accordingly as a liability, provision or contingent liability in the accounts. Data processing System failures can lead to both additional costs and a loss of revenue, as well as legal consequences. To mitigate this risk, a wide range of measures are being implemented on an ongoing basis. In addition to availability, the focus is also on ensuring that other information security objectives are met: Confidentiality and integrity. The comprehensive information security strategy is being implemented in a structured and cross-functional manner. This takes place as part of our day-to- day operations, but also within the framework of programmes and projects. Similarly, ÖBB has placed the topics of “Generative Artificial Intelligence (AI)” and “safety” on its agenda. As a result, awareness-raising measures regarding the use of generative AI were implemented, and corresponding governance frameworks were established in line with the European Union (EU) AI Regulation 2024/1689. The examples of the measures and initiatives mentioned illustrate part of the broad spectrum within which strategic and operational measures are implemented and information security is planned and systematically managed. In the context of potential information security risks, the Group-wide identification of key potential threat scenarios should be highlighted separately. Potential impacts were specifically identified, assessed and addressed through appropriate measures.