Global Management System

The Global Management System is based on four fundamental pillars: Risk Management, Quality, Health and Safety, and Environment and Climate Change.

Integrated Management System

Cellnex has implemented an Integrated Management System Model that incorporates the Quality, Environment and Health and Safety Management Systems. In the future, other management systems will be integrated, which are already deployed in some countries, such as the Information Security Management System (ISMS).

The Integrated Management System serves as a framework for:

• Adopting a systematic approach to the implementation of processes to ensure their effectiveness.
• Establishing a protocol to ensure the quality of the services provided.
• Ensuring thatbusiness is conducted in accordance with the requirements set out in the reference standards on quality, environment, health and safety at work and information security, as well as the legislation in force.
• Obtaining ISO standard certifications for Cellnex.

The Integrated Management System enables new business opportunities, facilitates the implementation of the Cellnex Industrial Model, and enables continuous improvement and customer satisfaction.

The Integrated Management System Model is currently applied and certified in Spain, Italy, Ireland and the United Kingdom. An external certification audit is in progress in Portugal, France, Switzerland and the Netherlands as well as at the Corporate level, and certification is expectedin early 2022. Poland, Denmark, Austria and Sweden are the next countries to be incorporated into the Integrated Management System.

Risk Management

The Cellenx Telecom Board of Directors has focused its work on defining the risk management strategy, supervising its implementation and risk control, and fostering best practices in corporate governance.

By delegation from the Board of Directors, the Audit and Risk Management Committee will monitor the effectiveness of the risk management model and the information to be provided to third parties, it must ensure that the risk management model identifies, prioritises, controls, monitors and notifies risks.

Global Risk Management across Cellnex Telecom is configured in line with best international practices. It is a combined assurance around Three Lines, providing an integrated vision of how the different parts of the Organization of Cellnex Group interact in an effective and coordinated manner, making the Cellnex Group’s relevant risk management and internal control processes more efficient.

Risk Management is based on anticipation, independence, commitment to the group's business objectives and the involvement of Senior Management, Audit and Risk Management Committee and the Board of Directors.

For risk management, Cellnex has a methodology approved by the Board of Directors. This risk management methodology has three specific lines:

• First Line: Operational Management. This Line includes all functional areas of Cellnex Group (operational management), both in Corporate and in Business Units, have ownership, responsibility and accountability for assessing, controlling and mitigating risks together with maintaining effective internal controls.
• Second Line: Global Risk Committee and Risk Management department. Risk Management facilitates and monitors the implementation of effective risk management practices and assists in defining the target risk exposure and reporting risk information through the Group. Global Risk Committee has the objective of analyse and evaluate the risks and their action plans defined in each risk map to ensure the adequate coverage of the risks. In the Global Risk Committee is represented all the functional areas of Cellnex.
• Third Line: Internal Audit Department. Internal Audit provides independent assurance to the Board of Directors, Audit and Risk Management Committee and Senior Management on how effectively the Cellnex Group assesses and manages its risks, validating how the first and second lines operate.

Cellnex has approved a Global Risk Management Policy, which is mandatory for all companies controlled by Cellnex Group. This policy establishes the essential principles and commitments in the field of risk management within the organisation, its communication to stakeholders and its progressive integration into all the operational systems and processes of the Cellnex Group.

In this regard, the Global Risk Committee is the body responsible for executing risk management in the Cellnex Group and validating the risks and action plans defined in the risk map. It also acts as the second line. In 2021, the consolidated risk map was drawn up and revised, as was the risk map for all countries except Austria, Denmark, Finland and Sweden, as those countries were integrated during 2021, their risk map will be drawn up in 2022.

For day-to-day operational risk management at Cellnex, the Risk Management Department has implemented a Global Risk Management Master Plan 2021-2022. In 2021, all initiatives planned for the first year of the plan were completed, namely:

• Risk Governance: redesigning the organisational model for risk management, establishing the roles and responsibilities of the risk management function, establishing the country relationship model, adapting the structure and functions of the Global Risk Committee, etc.
• Risk Communication Plan: design and deployment of a risk management communication and awareness plan for the entire Group.
• Risk Assessment: assessment of the Company's main risks, including financial and non-financial risks. It was reviewed with the corporate department during 2021 and will be carried out with the countries in 2022.
• Business Continuity Management System: implementation of a Business Continuity Management System (BCMS) aligned with the best practices of the Business Continuity Institute (BCI) and the ISO 22301 standard. During the first half of 2022, the definition of the BCMS will be finalised at corporate level and it will be rolled out in the countries during 2022.
• SAP GRC: a tool that allows users to employ range of functionalities to monitor of the tasks needed to carry out simple risk management, internal control and internal auditing. In 2022 it will be implemented at corporate level and it will be progressively rolled out in the countries.

In addition, to promote a risk culture throughout the Cellnex Group, a Risk Communication Plan has been defined to integrate risk management and control into the Company's standard practice and into the daily decision-making process across all Cellnex departments. This Plan is incorporated into the Global Risk Management Master Plan, adapting the messages to the level of maturity of the plan and the initiatives deployed.

To deploy and consolidate the risk culture among all Cellnex employees, Risk Partners have been identified in the countries with the aim of fostering in the process of disseminating the risk culture throughout the Cellnex Group. Working sessions are also being held to explain the new risk management model to key stakeholders.

Below is a list of the main risks that may affect Cellnex Group business and the achievement of its objectives.

Quality and certifications

Quality

Managing Quality is a strategic priority and a transversal commitment at Cellnex, as it is the leading neutral operator of wireless telecommunications infrastructures in Europe and these telecommunications services require high availability and high quality, and this quality is implicit in the services provided by Cellnex.

Through Quality, Cellnex contributes to its sustainable development and is consistent with the company'sCompany's mission, vision, values, objectives and strategy. Quality enhances Cellnex's brand and reputation, protects it against risks, increases its efficiency, boosts its profits and positions it to continue growing in an excellenta strong and sustainable way, all focused on the customer experience and the confidence of Cellnex's stakeholders.

The Quality objectives are as follows:

• To promote a Quality Culture through Cellnex values, awareness and training at all levels.
• To achieve the highest levels of quality and commitment to the customer.
• To enhance the perception of stakeholders by innovating and improving products and services.
• To ensure quality throughout the value chain and supply chain.
• To promote a culture of Continuous Improvement by guaranteeing methodologies and procedures to ensure the appropriate management of the improvement opportunities that arise.
• To lead exemplary practices to commit to all the Sustainable Development Goals.

Cellnex focuses on stakeholder needs and expectations, offers high quality services, satisfies customers and continuously improves.

In 2021, the Board of Directors of Cellnex Group, S.A. updated the Global Quality Policy. In the exercise of these functions, the Board of Directors establishes the Quality and Certifications strategy and its commitment to the application of best practices in the countries in which the Company operates and on the basis of international reference standards.

In accordance with the basic principles of the Quality policy, Cellnex's main strategy is to make investments to drive transformation and internationalisation, offering customers a range of innovative products and services that guarantee high quality while focusing on promoting satisfaction and meeting stakeholder expectations.

A Company-wide two-year Quality Master Plan (2021-2022) has been defined, based on the Cellnex Global Quality Policy. This Quality Master Plan is defined in five strategic lines, being Continuous Improvement. Regarding the strategic priorities, seven initiatives have been defined which contain specific actions to drive and promote quality throughout the organisation. One of the actions under the Quality Master Plan is the development of a Cellnex Global Continuous Improvement Model.

The Global Continuous Improvement Model was defined for 2021. This Global Model is deployed using the Deming Cycle methodology (Plan-Do-Check-Act), is based on Kaizen, contains certain Lean Six Sigma practices and adopts an Agile methodology.

The Model is fully aligned with the Cellnex Industrial Model and pivots on four principles:

• Start small.
• Encourage everyone to participate.
• Leave room for mistakes.
• Involve senior management.

Cellnex considers continuous improvement to be part of the Company's way of doing things and a permanent habit among all staff in order to obtain results that help to make the organisation more efficient, competitive and innovative. In other words, Cellnex is able to grow in an excellent and sustainable manner.

In 2021, the Global Continuous Improvement Model began to be deployed in Spain, Italy and the United Kingdom and will continue to be implemented in the other business units during 2022. Looking ahead to 2022, work is also under way to design and implement the Global Customer Service Model, and to review the global Customer Complaints model for the whole of Cellnex. In addition, the aim is to identify and measure the contribution of quality initiatives to the SDGs, specifically SDGs 1, 8, 9, 12 and 17.

Certifications

Cellnex has implemented a management system based on the company's organisational model and Process Management. Based on the Integrated Management System, the Quality and Certifications Department has focused in 2021 and until 2023 on implementing global certifications in non-certified countries.

Implementing a management system that encompasses all of Cellnex's geographical areas makes the maintenance and renewal of certifications more efficient because it involves a single certification for all companies and business units. In addition, it is more cost-effective to manage global certifications than local ones, as synergies are identified and redundancies are eliminated.

In this regard, Cellnex has a Certification CatalogCatalogue, updated in 2021. The catalogcatalogue is a tool that allows the company to knowindicates the exact certification status of all business units in terms of certifications.. The certifications obtained by Business Unitbusiness unit and their date of validity are presentedgiven below. In this regard, it is worth highlighting that the first time that the 2021Note that Water Footprint certification was obtained under the ISO 14046 standard for the first time in 2021.

In 2021, Cellnex started the certification process for ISO 9001, ISO 14001 and ISO 45001 in Portugal, Ireland, France, Switzerland, the Netherlands and at corporate level under the Global Integrated Management System. With these certifications Cellnex is certified in eight countries (Italy, Spain, United Kingdom, Portugal, Ireland, France, Switzerland and the Netherlands) and at corporate level.

In the case of countries that are being integrated, the process begins with a GAP analysis to determine the percentage of compliance with the requirements of the three ISO standards (ISO 9001, ISO 14001 and ISO 45001). Based on the results of the GAP analysis, an action plan is drawn up for each country to ensure certification in the shortest possible time. In 2022, GAP analyses will start for Poland, Denmark, Austria and Sweden. Countries already certified (Spain, Italy and United Kingdom) will be gradually included in the Global Integrated Management System.

Italy: the EASI model

With the Integrated Sustainable Corporate Ecosystem (EASI®) Cellnex Italia has positioned itself as one of the leading companies in the market by having an operational process in which sustainability has been integrated into each and every step of operations within the Company.

EASI® is an innovative path developed by Consulnet Italia and Rodl & Partner as part of the SIrcle project, it incorporates the international standards and fundamental principles that govern the evolutionary phases of environmental social and economic sustainable development such as the 17 SDGs of UN’s 2030 Agenda, the ESG criteria and the GRI standards (environmental, social, economics) integrating them into strategies and business processes.

Cellnex commitment to human rights

Cellnex is committed to respecting human rights in its daily activities and throughout its global value chain, incorporating them as an integral part of the Company's fundamental values and asstandard practice for the legitimate development of its business activities.

The company operates under the international framework that provides a robust approach to address the risks for people related to its products and services. This is especially valuable because it will lead to a regular review and decision-making process regarding products and services that can be used at scale, almost anywhere, and by a large number of different key stakeholders, be they private, public or individual.

As part of the ESG agenda, in 2021 Cellnex carried out a Due Diligence process and Risk Impact Assessment on Human Rights with the aim of updating the business strategy and providing it with greater depth and scope.

In order to identify and assess relevant risk events and measure the nature and scope of risks to human rights, the methodology has been inspired by the "Human Rights Business Approach" (HRBA), a normative working methodology based on internationally recognized Human Rights, the UN Guiding Principles Interpretive Guide, and the OECD Due Diligence Guidance for Responsible Business Conduct.

The HRBA is the process by which Cellnex collects the basic information it needs to identify which human rights risks can be avoided, mitigated or remedied. This allows the company to model the impact throughout the global value chain, highlighting the needs and expectations of stakeholders as well as involving the different areas of the company. The assessment process helps build a shared responsibility to address the potential impacts of the underlying and structural causes of human rights non-compliance in accordance with stakeholder and community engagement activities. For Cellnex, it is not just a form of compliance, in which the risks do not necessarily have legal consequences, but rather it implies a very high impact on the reputational and social license to operate.

Based on the due diligence study, the risk of Human Rights breach have been identified as a corporate risk for the Company, thus becoming a priority on Cellnex's corporate agenda, guaranteeing a direct channel for reporting irregular situations and protecting people against events that may affect their normal development and quality of life.

In this regard, Cellnex signed in 2018 a Corporate Human Rights Policy as an expression of its strong commitment to the internalisation of Human Rights in the fundamental operations of the business, which, following these premises of due diligence, has been updated early 2022 Under this roadmap, Cellnex is committed to promoting and disseminating the ESG policy and best practices based on the principles promoted by the United Nations (UN).