Sustainability Policy

Pupuk Indonesia has developed a Sustainability Policy that has been approved by the President Director. This policy serves as a guideline to ensure compliance with relevant regulations while promoting long-term value creation for stakeholders through sustainable business practices. The Sustainability Policy addresses Environmental, Social, and Governance (ESG) aspects.

Sustainability Policy

Materiality Topics

Pupuk Indonesia conducts a materiality assessment every year to ensure that its sustainability strategy remains aligned with the most significant issues for the business and its stakeholders. This process applies two approaches: an Internal Review (80% compartment representatives) and an External Review (involving 41 representatives of external stakeholders, including employees, customers, business partners, regulators, and the community).

The methodology employed includes surveys and other quantitative methods to measure:

The review identified 31 material topics, all of which are relevant and aligned with the GRI Topic Standards. These topics are mapped into a materiality matrix, integrated into the Enterprise Risk Management (ERM) process, and adopt the principle of double materiality, which considers both the Company’s impact on society and the environment, as well as external impacts on the Company. This materiality assessment is conducted annually through a review process and has been approved by the Board of Directors.

The materiality assessment serves as an important step to strengthen Pupuk Indonesia’s sustainability strategy in a structured and strategic manner, ensuring that the Company’s sustainability strategy is implemented in a focused and effective way. Pupuk Indonesia is committed to continuously refining its materiality assessment methodology in the future. Further information regarding the Materiality Assessment process is available on pages 44–49 of Pupuk Indonesia’s 2024 Sustainability Report.

Associations and Organizational Engagement

Alignment of Lobbying and Trade Association Memberships with the Paris Agreement

PT Pupuk Indonesia (Persero) is committed to ensuring that its public policy engagement, lobbying activities, and association memberships are conducted ethically, transparently, documented appropriately, and aligned with the Company’s climate strategy and the objectives of the Paris Agreement. This commitment applies to PT Pupuk Indonesia (Persero) and its controlled entities.

Governance and Policy Positions

Pupuk Indonesia implements mechanisms to identify, assess, approve, monitor, and document lobbying activities and association memberships that are relevant to climate-related policies. Oversight is carried out by the Board of Directors, supported by relevant Business Units responsible for managing each association engagement.

In its public policy engagement, Pupuk Indonesia supports policies that promote national climate targets and the transition toward net-zero emissions, including energy efficiency and renewable energy, credible carbon pricing and carbon markets, clean ammonia and low-carbon hydrogen, CCS/CCUS, low-carbon agriculture, as well as transparent and verifiable emissions and climate risk reporting.

Review and Monitoring

Each climate-related policy engagement is reviewed prior to implementation to ensure its alignment with Pupuk Indonesia’s policy positions and the objectives of the Paris Agreement. The outcomes of engagements and follow-up actions are documented and monitored.

Association memberships are reviewed at least annually and whenever there are material changes to an association’s policy positions. The review considers the association’s alignment with the Paris Agreement, positions on energy and emissions, carbon pricing, low-carbon technologies, lobbying transparency, governance practices, and consistency with Pupuk Indonesia’s policy positions.

Addressing Misalignment

Where a material misalignment is identified between Pupuk Indonesia’s position and the position or activities of an association, the Company applies a proportionate escalation process. Actions may include clarification and engagement, escalation to association leadership and Company management, public distancing, restrictions on support or participation, and, where necessary, termination of membership.

Transparency and Disclosure

Pupuk Indonesia periodically discloses information on climate-related lobbying activities and trade association memberships, including the Company’s policy positions, alignment review results, identified areas of potential misalignment, and follow-up actions. Where no climate-related direct lobbying or no cases of misalignment are identified during the reporting period, Pupuk Indonesia will explicitly disclose this status.

During the 2025 reporting period, PT Pupuk Indonesia (Persero) made no direct or indirect political contributions in cash or in kind (IDR 0).

Information Security

Information Security and Personal Data Protection Commitment

PT Pupuk Indonesia (Persero)

PT Pupuk Indonesia (Persero) has established an Information Security Policy that is binding across all operational lines of the company. This policy serves as the foundation for managing, protecting, and overseeing all company information assets in a proactive, measurable, and sustainable manner.

1. Ensuring Data Integrity and Protection

We are committed to ensuring the integrity and protection of all data under our management, including company data and the personal data of customers, employees, and business partners, based on three key principles:

• Confidentiality: Ensuring that sensitive customer and company data can only be accessed by authorized parties.
• Integrity: Ensuring that the data we manage is accurate, complete, protected from unauthorized modification, and remains trustworthy throughout its lifecycle.
• Availability: Ensuring that our digital systems and services remain available whenever required by the public and customers.

2. Monitoring and Response to Information Security Threats

We are committed to monitoring, detecting, and responding to information security threats in a timely and measured manner. Our system and network security is continuously monitored around the clock through the Security Operations Center (SOC), while incident handling is carried out by the company’s cyber incident response team (PI-CSIRT) based on established incident response procedures. We maintain clear incident reporting and escalation mechanisms, ensure that service recovery is carried out as quickly as possible, and conduct post-incident evaluations so that each incident can serve as a basis for strengthening future security controls.

3. Establishment of Individual Responsibilities for All Employees

We emphasize that information security is the responsibility of every individual, not solely the responsibility of the information technology unit. Our Information Security Policy applies to all personnel of PT Pupuk Indonesia (Persero). Each individual is required to understand and comply with the provisions governing the use of company information assets and systems, maintain the confidentiality of credentials and information under their responsibility, and report any suspected incidents, vulnerabilities, or suspicious activities through the available reporting channels. We ensure that this understanding is reinforced through periodic information security awareness programs for the entire workforce, and we stipulate that any violation of this policy will be followed up in accordance with applicable employment provisions and company regulations.

4. Establishment of Information Security Requirements for Third Parties

We are committed to ensuring that the information security standards we apply also extend to all third parties working with the company, including suppliers, vendors, technology service providers, and business partners. Information security and data confidentiality requirements are established as part of the procurement process and incorporated into cooperation agreements. These requirements include obligations to maintain information confidentiality, provisions for processing personal data in accordance with the Personal Data Protection Law, and reporting obligations in the event of a security incident involving a third party.

5. Management Commitment & Cybersecurity Governance

As a demonstration of top management’s commitment to safeguarding business continuity and cybersecurity, PT Pupuk Indonesia (Persero) has strengthened its organizational governance through the establishment of the following strategic units and roles:

6. Policy Framework & Operational Guidelines

We develop and periodically update internal regulations to ensure alignment with evolving international standards and applicable national regulations:

• Personal Data Protection (PDP) Guidelines: Govern personal data protection by requiring the preparation of a Record of Processing Activities (ROPA) and a Data Protection Impact Assessment (DPIA) for every digital system development initiative.
• Information Security Management System (ISMS) Guidelines: Serve as the overarching provisions for information security management and as a mandatory reference for all company work units.
• Information Technology (IT) Security Procedures: Provide technical requirements governing user access management, password/credential use, system updates, and the security of end-user devices.

7. Implementation of Technical Security Controls

To provide layered protection (defense-in-depth) for the company’s critical infrastructure and applications, we implement the following security technologies:

• 24/7 Security Operations Center (SOC): A centralized function for continuously monitoring network traffic and suspicious activities 24 hours a day, 7 days a week.
• Data Loss Prevention (DLP): Monitoring and data leakage prevention solutions designed to prevent unauthorized transfer of or access to sensitive data.
• Data Encryption: Implementation of strong encryption for both data stored in databases (data at rest) and data transmitted across networks (data in transit).
• IAM & PAM (Identity and Access Management / Privileged Access Management): Systems for strictly controlling and restricting user access rights, particularly for privileged accounts, supported by the implementation of Multi-Factor Authentication (MFA).

8. Audit, Assessment & Information Security Performance Results

The performance and effectiveness of PT Pupuk Indonesia (Persero)’s information security controls are periodically evaluated by both internal and independent external parties, with the following key results:

9. Enhancing Human Resource Capabilities and Security Culture

We believe that human resources serve as the primary line of defense (human firewall) in safeguarding the organization’s information security:

• Cybersecurity Individual Development Plan (IDP): A specialized competency development program for IT personnel in the field of cybersecurity.
• International IT Professional Certification: Facilitating the company’s IT practitioners in obtaining globally recognized professional certifications in information security.
• In-House Security Awareness Webinar: Regular education and awareness sessions for all PT Pupuk Indonesia (Persero) personnel to foster a strong culture of cybersecurity risk awareness across all areas of work.

10. Continuous Improvement of the Information Security System

We are committed to continuously improving the maturity of our information security system. Our information security policies, procedures, and controls are periodically reviewed and updated by considering developments in the cybersecurity threat landscape, regulatory changes, and business needs. Any findings identified through vulnerability assessments and penetration testing (VA/PT), internal audits, certification audits, or cybersecurity maturity assessments are followed up through measurable improvement plans with monitored completion. We also conduct periodic information security and information technology maturity assessments to ensure that the improvements implemented are consistent and can be measured over time.

Tax Compliance

Pupuk Indonesia consistently upholds the principles of sound tax governance, emphasizing integrity in every aspect of tax management and ensuring full compliance with all applicable tax laws and regulations in Indonesia.

The company views tax compliance not merely as a legal obligation, but as a vital contribution to national development. Accordingly, Pupuk Indonesia continues to strengthen its tax management system to ensure transparency, accountability, and alignment with the principles of Good Corporate Governance.

Through a proactive and integrity-driven approach, Pupuk Indonesia—via the Joint Agreement of the 2024 Tax Working Group Agenda of Pupuk Indonesia Group—reaffirms its commitment to being a trusted partner to the government and all stakeholders in fostering a healthy and sustainable tax ecosystem.

Responsible Artificial Intelligence

Commitment to the Implementation of Artificial Intelligence (AI) Governance

Responsible AI Program

Pupuk Indonesia is committed to implementing a responsible AI program by applying sound governance through concrete operational practices. The Company ensures that responsible AI use gives due regard to the principles and ethics of AI implementation, and applies these at every stage of the AI program lifecycle, from initiation through to decommissioning. This commitment serves as the general foundation for AI use across Pupuk Indonesia and as a form of transparency to the public regarding the Company’s implementation of AI governance.

Regulatory References

The use and implementation of AI technology across Pupuk Indonesia must comply with applicable regulations in Indonesia, including:

1. Circular Letter of the Minister of Communication and Informatics Number 9 of 2023 concerning Artificial Intelligence Ethics.
2. Law Number 27 of 2022 concerning Personal Data Protection (PDP Law).
3. Law concerning Electronic Information and Transactions (ITE Law).
4. Government Regulation on the Implementation of Electronic Systems and Transactions (GR PSTE).
5. Minister of Communication and Informatics Regulation on Electronic System Operators (Permen PSE).

Principles and Ethics of AI Implementation

In implementing AI systems, Pupuk Indonesia is committed to applying the following principles and ethics of AI implementation, among others:

1. Reliable and Secure
   AI systems are designed, tested, operated, and maintained to produce output that is reliable and secure, and protected from misuse and cyber threats.
2. Accountable
   Parties responsible for AI systems must be able to ensure that operating AI systems are trustworthy and accountable.
3. Full Human Control
   AI is positioned as an enabling tool to increase productivity, not as a replacement for human critical judgment and common sense, such that humans remain the authority for the Company’s critical decision-making and retain the ability to intervene in or halt the AI system when necessary (Human-in-the-Loop).
4. Respecting Privacy and Data Protection
   The use of AI must give due regard to the principles of personal data protection and information security in accordance with applicable provisions.

Access Control & Transparency

Pupuk Indonesia applies strict access controls over the AI models/tools it develops. Access to AI tools is currently restricted to designated personnel through an approved management mechanism. This is done to ensure that AI tools are implemented with adequate governance, oversight, and usage limitations. As a form of transparency regarding AI’s involvement in generating content and decisions, the Company is committed to providing clear labeling, so that every stakeholder can understand the Company’s commitment to transparency in decision-making that involves AI.

AI Model Integrity

Pupuk Indonesia regularly carries out maintenance and updates to its AI systems to maintain their reliability and fairness. This is done to detect and improve AI model performance in order to ensure accuracy and avoid bias in information generated by the AI system. Ensuring the integrity of AI models requires direct human participation/involvement, in line with the concept of human oversight, under which the use of AI for manipulation, exploitation, or social scoring is strictly prohibited.

AI Implementation at Pupuk Indonesia

Pupuk Indonesia is committed to building, developing, and operating Artificial Intelligence (AI) systems that are ethical, reliable, secure, transparent, and accountable in support of the Company’s business processes, including in the areas of production and maintenance, supply chain and logistics, fertilizer demand forecasting, and improving employee work productivity. Every AI implementation must have a clear purpose, clearly defined usage limitations, and adequate human oversight so that the resulting output remains relevant, trustworthy, and aligned with the interests of the Company and its stakeholders.

To implement the principle of privacy protection, every AI implementation is required to apply the following mechanisms:

• Data Masking: All data elements pointing to personal identity (PII – Personally Identifiable Information) must be masked or converted into an anonymized format before entering the AI data pipeline.
• Data Aggregation: Information used by AI is prioritized in the form of aggregated data (grouped/trend-based) for macro-level analysis, rather than individual-level data.

In its implementation, Pupuk Indonesia is committed to protecting data and information security, mitigating potential bias and vulnerabilities, and providing adequate transparency regarding AI’s involvement in the content, decisions, or recommendations produced. Pupuk Indonesia also prohibits the use of AI for manipulative actions, exploitation, or other uses that contravene the law, ethics, or the Company’s values, and takes environmental sustainability into consideration in the use of AI infrastructure and its supporting services.

AI Lifecycle

The implementation of AI systems at Pupuk Indonesia follows the lifecycle below:

1. Initiation
   In initiating the development of an AI system, the Company must establish clear objectives and ensure alignment with business goals and strategy.
2. Design and Development
   The design and development of AI systems must give due regard to the Company’s principles of AI implementation ethics.
3. Testing
   The reliability and security of the AI system under development must be verified through a testing stage prior to implementation.
4. Implementation
   The implementation of the AI system must ensure compliance with applicable regulations and the adequacy of its infrastructure to guarantee satisfactory AI system performance.
5. Monitoring and Evaluation
   The operating AI system is monitored and evaluated to ensure that its use remains relevant and accurate.
6. Decommissioning
   The discontinuation of an AI system’s operations must be based on the results of an evaluation of the AI system’s performance, together with the identification of related operational risks to the Company.

Environmental Responsibility

Currently, all AI implemented at Pupuk Indonesia runs on several Cloud services managed by the Company. As part of the Company’s commitment to sustainability initiatives under the Environmental, Social, and Governance (ESG) framework, Pupuk Indonesia applies a number of considerations in selecting Cloud service providers that are committed to efficiency and to reducing the environmental impact of their operational infrastructure.

AI Impact on Sustainability

PreciX (Precision Agriculture Platform) is one of the Company’s implementations of artificial intelligence (AI). The platform was developed by IARI, Agtech, Data Science, and the Company’s subsidiaries, in line with the national agricultural transformation agenda under the Agtech Roadmap 2034 and the Company’s Digital Transformation & World Class Capability initiatives. PreciX processes data from satellite technology, multispectral drones, and proximal sensors to produce spatial analyses of soil and plant nutrient status and levels. Its main outputs are nutrient status information and fertilization recommendations that adapt to the characteristics of each commodity and the size of the land. Through these recommendations, landowners can apply fertilizer at rates based on the nutrient needs of the soil and plants. As a result, fertilizer use becomes better targeted in line with the 4R Nutrient Stewardship principles (Right Source, Right Rate, Right Time, and Right Place), so that fertilization efficiency improves, fertilization costs are optimized, and commodity productivity can be increased sustainably.

PreciX implementation covers rice, corn, sugarcane, and oil palm, with a coverage area that continues to grow. Its impact is quantified through three performance indicators, each with an annual target. Two indicators measure implementation coverage, namely the area of soil nutrient mapping and the area of PreciX deployment. The third indicator measures the impact on the average increase in commodity productivity. Throughout 2025, soil nutrient mapping reached 290,944.7 hectares, or 103.2% of the 282,000-hectare target. PreciX deployment reached 30,173.1 hectares, or 107.0% of the 28,200-hectare target. The average productivity increase was recorded at 13.3%, exceeding the 5% target.

At the field level, the nutrient status information and fertilization recommendations from PreciX support data-driven decision-making in cultivation practices. Strategically at the corporate level, achievement against these targets serves as the basis for evaluating the effectiveness of the Company’s precision agriculture model in supporting productivity optimization.

Awareness and Security of AI Use

As part of Pupuk Indonesia’s commitment to responsible AI implementation, the Company actively carries out several programs aimed at strengthening the security of AI use. Through its employee competency development program, the Company has conducted specialized training for personnel who develop and manage AI tools. To raise awareness of responsible AI use, the Company also conducts webinars on AI use for all employees. In addition, the Company provides dedicated channels (such as an e-learning platform) for independent learning, available to all employees wishing to expand their knowledge of AI.

External Assessment of AI Governance

PT Pupuk Indonesia (Persero) has conducted a Responsible AI Maturity Assessment through a third party as part of its commitment to the responsible implementation of AI. The assessment was carried out through document review and interviews with process owners, AI managers, data owners, and other related parties.

The assessment covers 22 aspects, consisting of 2 environmental aspects, 8 social aspects, and 12 governance aspects. These aspects include, among others, AI accountability and risk classification, human oversight of AI decisions, data privacy and security, pre-deployment validation, system monitoring, and incident handling. The assessment criteria refer to recognized standards and frameworks, namely ISO/IEC 42001:2023 on AI management systems, NIST AI RMF 1.0, ISO/IEC 42005:2025, COBIT 2019, CMMI, and GRI Standards. The assessment report contains maturity levels, gaps, and improvement recommendations for each aspect.

Sustainable Products

Commitment to Hazardous Substance Management

Pupuk Indonesia consistently prioritizes product safety and environmental protection across the entire fertilizer and chemical production value chain. As a manifestation of this commitment, Pupuk Indonesia has established a policy to continuously reduce, substitute, and potentially phase out the use of hazardous substances in both products and production processes, going beyond mere regulatory compliance. This commitment applies to all product lines manufactured by Pupuk Indonesia and its subsidiaries, spanning from raw material selection and production processes to product end-use by customers. As part of these efforts, Pupuk Indonesia continues to transform its product portfolio toward more environmentally friendly options. All products are ensured to meet Pupuk Indonesia’s compliance with sustainable industry principles through Green Industry Standard (SIH) certifications established by the Ministry of Industry, which encompass evaluations of raw materials, auxiliary materials, production processes, as well as waste and hazardous and toxic material (B3) management.

Pupuk Indonesia’s commitment to product stewardship is also reflected through obtaining Environmental Product Declaration (EPD) certifications referencing ISO 14025, which are grounded in Life Cycle Assessment (LCA) studies compliant with ISO 14040/14044. Through EPDs, product environmental impact data regarding toxicity aspects and potential exposure to hazardous substances throughout the life cycle are verified by an independent third party and transparently disclosed to customers, regulators, and other stakeholders. In practice, hazardous substance reduction and substitution efforts are backed by dedicated research and development resource allocations. The Indonesia Agrichemical Research Institute (IARI) division actively develops product formulations with lower contaminant levels, including bio-based fertilizers and products with higher nutrient uptake efficiency as safer environmental alternatives. During procurement, every raw material supplier is required to provide a Material Safety Data Sheet (MSDS) and a Certificate of Analysis (CoA) for all supplied materials, and material specification reviews are meticulously conducted to ensure that utilized materials are not only safe but also eco-friendly. Pupuk Indonesia also implements the Globally Harmonized System (GHS) for chemical classification and labeling in accordance with Ministry of Industry regulations, ensuring every product is equipped with clear labels and safety markings for all parties interacting with the product. Comprehensive evaluations of product safety aspects from raw materials to application methods are conducted periodically to guarantee that products remain safe for use while meeting customer expectations and applicable regulatory standards.