ÖBB Annual Report 2023

319 8 Report on the independent assurance of the consolidated non-financial reporting 2023 Attention : This letter has been translated from German to English for referencing purposes only. Please refer to the officially legally binding version as written and signed in German. Only the German version is the legally binding version. We have completed a limited assurance engagement on the consolidated non-financial report 2023 (hereafter “assurance”) of Österreichischen Bundesbahnen-Holding Aktiengesellschaft, (hereafter “ÖBB Holding”), Vienna. The non-financial reporting is carried out in accordance with § 267a UGB (NaDiVeG) and the requirements of Article 8 of the EU Taxonomy Regulation, as well as in accordance with the GRI Universal Standards 2021 as a “non-financial statement” in this Group Management Report 2023 for the consolidated financial statements of Österreichischen Bundesbahnen-Holding Aktiengesellschaft as of December 31, 2023. Responsibilities of the Legal Representatives ÖBB Holding’s legal representatives are responsible for the proper compilation of the non-financial report 2023 in accordance with the requirements of Section 267a UGB 1 (NaDiVeG), the requirements of Article 8 of the EU Taxonomy Regulation 2 , as well as in accordance with GRI Universal Standards 2021 3 . The legal representatives have signed the Letter of Representation, which we have added to our files. Responsibilities of the Assurance Providers Based on our assurance procedures deemed necessary and our evidence we have obtained, it is our responsibility to assess whether any matters have come to our attention that cause us to believe that the consolidated non-financial reporting for 2023 has not been presented, in all material respects, in accordance with the legal requirements of § 267a of the Austrian Commercial Code (NaDiVeG) and the requirements of Article 8 of the EU-Taxonomy Regulation, as well as in accordance with the GRI Universal Standards 2021. Our assurance engagement has been conducted in accordance with the “International Federation of Accountants’ ISAE 3000 (Revised)” Standards. Our professional duties include requirements in relation to our independence as well as planning our assurance engage- ment based on the materiality considerations in order to allow us to obtain a limited level of assurance. According to the “General Conditions of Contract for the Public Accounting Professions” our liability is limited. An accountant is only liable for violating intentionally or by gross negligence the contractual duties and obligations entered into. In cases of gross negligence, the maximum liability towards the client and any third party together is EUR 726,730 in the aggregate. Our procedures have been designed to obtain a limited level of assurance on which to base our conclusions. The extent of evidence gathering procedures performed is less than for that of a reasonable assurance engagement (such as a financial audit) and therefore a lower level of assurance is provided. 1 https://www.ris.bka.gv.at/Dokumente/Bundesnormen/NOR40189009/NOR40189009.pdf 2 https://eur-lex.europa.eu/eli/reg/2020/852/ 3 https://www.globalreporting.org/standards