Director Elections and Responsibilities

The Board of Directors is the highest governance unit at PharmaEssentia and adopts a single-track governance framework with each term lasting for 3 years. Board directors are nominated and elected in accordance with Election of Directors, which incorporate shareholder interests, diversity, independence, and director management capabilities.

The current Board directors were elected at the shareholders general meeting held on May 27, 2024. Following the election, the number of independent directors was increased from three to four, including one female independent director. The number of independent directors exceeded one-third of all directors on the Board. Consecutive terms of office should not exceed three terms. The election was conducted in accordance with Financial Supervisory Commission requirements to strengthen Board function and independence. The number of Board members was maintained at eleven directors, and the number of female directors increased from two to three directors. Current Board members will remain in office from May 27, 2024 to May 26, 2027. Board responsibilities include formulating corporate sustainability strategies, supervising managers, and playing an important role in responding to company and shareholder needs. The Audit Committee and Numeration Committee have been established under the Board of Directors, and the Executive Center for Corporate Sustainability reports directly to the general manager. Board functions are shown in the image below.

PharmaEssentia and all major subsidiaries convene at least 1 Board meeting every quarter. All managers and financial directors are required to attend Board meetings, and audit directors report audit results to the Board. PharmaEssentia convened 7 Board meetings in 2025 and achieved a director attendance rate of 100%. For more information on subsidiary directors.

Diversity of Board Members

PharmaEssentia currently has eleven directors (seven directors and four independent directors) aged between 50-90 years old. We have three female directors and three directors who are concurrently serving as company employees. The average tenure of our directors is 8.91 years. Board members possess extensive experience and professional knowledge in biotechnology, finance, education, and financial services industries, and one of our directors is a representative from the National Development Fund. Of our four independent directors, one independent director has served on the Board for more than 7 years and has experience encompassing industry, government, and academic domains, as well as global biotechnology production and manufacturing expertise. We therefore continue to rely on their professional expertise, supervision capabilities, and professional opinions. Another independent director (Jeffrey R. Williams) is a US citizen with expertise in finance and education, so is able to guide PharmaEssentia USA business operations. In future, we plan to ensure that directors of each gender exceed one-third of total directors to strengthen diverse composition of Board members.

Board Performance Evaluations

PharmaEssentia has established the “Rules for Performance Evaluations of the Board of Directors” and “Regulations for the Self-Appraisal or Peer Appraisal of the Board of Directors” to regulate Board performance targets and appraisal systems. To review overall Board operations and performance of duties by Board members, we conduct at least one internal Board performance evaluation each year, and commission external professional institutes to conduct a Board performance evaluation for the year once every 3 years.
Internal evaluation: Results of internal Board and director performance evaluations for 2025 were reported to the Board on March 2, 2026.
External evaluation: Our most recent Board performance evaluation conducted by an external third-party institution was carried out in 2024. We commissioned the Taipei Foundation of Finance to conduct a Board evaluation for the period from January 1, 2024 to October 11, 2024 in accordance with our regulations stipulating that we should conduct one external evaluation every 3 years. The evaluation mainly encompassed seven aspects, and four improvement suggestions were proposed.

Strengthen Board Knowledge

Our directors attend a diverse range of continuing education courses to strengthen Board sustainability knowledge, skills, and expertise. All 11 directors met regulatory continuing education requirements in 2025. We organized a total of three courses over 75 person-hours.

Participation in Public Associations

PharmaEssentia has joined many external biopharmaceutical organizations. We enhance our collaborative relations and influence with government organizations, healthcare providers, and industry peers through information sharing with industry, government, and academic institutes while monitoring industry and regulatory developments.

Public Policy Contributions

Public Policy Influence Expenditure

Public Issue

• Rules of Procedure for Board of Directors’ Meetings
• Election of Directors
• The Rules for Performance Evaluations of the Board of Directors
• Performance Evaluations of the Board and Directors by internal self-evaluation
• Board Member Diversity Policy
• Communication Between the Independent Directors, Internal Audit Executive, and Accountant
• External performance appraisal results of the Board of Directors
• Tax Policy and Commitments

Functional Committees

Two functional committees, the Audit Committee and the Numeration Committee, have been established under the Board, and these committees are all composed of independent directors. To improve Board functions and strengthen management mechanisms, the Numeration Committee hired an external expert (Professor MingChuan Hsieh) to serve as a committee member.

Internal Controls and Internal Audits

We have established an auditing department under the Board to ensure ethical management and strengthen internal control processes. The auditing department is headed by one chief auditor and two auditors. The appointment and dismissal of the chief auditor must be approved by the Audit Committee and acknowledged by the Board. The auditing department formulates audit plans each year based on current or potential corporate risk issues, and conducts in-house general audits, project audits, and subsidiary supervision operations. The chief auditor reports on audit implementations to the Audit Committee and the Board every quarter, and facilitates independent communications between internal auditors and independent directors to strengthen director supervisor of corporate audits. We track and re-examine all deficiencies discovered during audits to confirm that related units have implemented timely and appropriate corrective actions. In 2025, the auditing department completed a total of 74 audit reports (54 reports for Taipei Office and 17 reports for subsidiaries) and discovered no major deficiencies.
The auditing department also reviews appropriateness and implementations of internal controls based on our “Internal Audit System” through audits encompassing all corporate financial, business, operational processes, as well as subsidiaries that comply with relevant regulatory requirements.

Ethical Management and Business Codes of Conduct

PharmaEssentia has established the Ethical Corporate Management Best Practice Principles, Procedures for Ethical Management and Guidelines for Conduct, and Code of Ethical Conduct, among other policies. These policies are implemented upon approval by the Board of Directors and provide standards of conduct for the Board and all employees to ensure that the Company’s operations are conducted with integrity and in compliance with applicable laws and regulations. No incidents of unethical conduct were identified during the reporting period. The Company’s Japanese subsidiary has separately established its Corporate Code of Conduct to guide employees in their day-to-day activities. Ethical business practices and business conduct procedures have also been incorporated into an employee handbook, enabling employees to access and review the relevant requirements at any time. Relevant corporate governance procedures and policies are also publicly available on the Company’s corporate governance website.
The Company also strengthens employees’ awareness and understanding of relevant topics through regular education and training. In 2025, PharmaEssentia conducted training on “Material Internal Information and Prevention of Insider Trading,” with a total of 222 participants and 666 cumulative training hours. In addition, Panco Healthcare conducted anti-corruption and anti-bribery training in accordance with relevant requirements of the International Research-Based Pharmaceutical Manufacturers Association (IRPMA) in Taiwan.
The Company’s Rules of Procedure for Board of Directors Meetings expressly set forth conflict-of-interest and recusal requirements applicable to the Board of Directors and other relevant parties. The Company also plans to establish a compliance committee and a dedicated unit responsible for overseeing ethical corporate management to further strengthen its governance framework. All employees are required to comply with the Company’s seven business conduct and ethics policies and to uphold fairness and impartiality in performing their duties, without abusing their authority or improperly using internal information. PharmaEssentia has also established reporting channels accessible to both internal and external stakeholders for reporting unlawful conduct, including corruption. New employees are required to complete business ethics training as part of their onboarding process. In 2025, the Company recorded no incidents of non-compliance with its ethical corporate management or corporate conduct standards and received no related complaints.

Legal Compliance

The biopharmaceutical industry is a highly regulated industry. To ensure that PharmaEssentia adheres to global regulations at all stages of drug lifecycles, we referenced domestic and overseas policy and regulation trends to formulate legal compliance strategies and management regulations for global operations. We established a total of 40 regulations, including the “Corporate Governance Code,” “Principles of Ethical Corporate Management,” “Codes of Ethical Conduct,” “Procedures for Ethical Management and Guidelines for Conduct,” “Sustainable Development Best Practice Principles,” “Operating Procedures for Handling Material Nonpublic Information and Preventing Insider Trading,” “Regulations Governing Management and Utilization of Intellectual Property Rights,” and “Regulations Governing Management of Litigation Cases/Major Disputes.” PharmaEssentia has established a MLR department, auditing department, corporate governance officer, legal department, intellectual property department, human resources department, and other functional departments. We require our colleagues in all associated departments and our suppliers to abide by the aforementioned regulations.

Medical, Legal, Regulatory (MLR) Committee

The MLR Committee is an interdepartmental committee composed of committee members from the medical affairs, legal, regulatory, and business departments. The MLR Committee is responsible for reviewing and approving all external materials that may be considered product promotions or product labels by the US FDA, to ensure that the information is scientifically accurate, not misleading, and compliant with all internal policies and applicable regulations. The Committee revisits marketing authorizations and adjusts decisions based on the latest laws/regulations and market needs. We commission external professional institutes to assist with reviewing processes when necessary, but supervision procedures are conducted by in-house experienced professionals. No new legal/regulatory reviewers joined the committee in 2025. PharmaEssentia Japan has established a medical affairs department, a legal and regulatory compliance department, a human resource department, and other related functional departments to ensure that all relevant personnel and suppliers comply with applicable regulations and internal policies.

Legal Compliance and Specific Actions in Product Lifecycles

Risk Management Mechanism and Corporate Governance Structure

PharmaEssentia is committed to establishing a comprehensive enterprise risk management (ERM) framework. Through risk identification, assessment, monitoring, and improvement mechanisms, the Company continuously strengthens its risk governance capabilities, mitigates the potential impact of risks on its operations, and enhances corporate resilience and its capacity for sustainable business operations.

Risk Issues and Responses

PharmaEssentia referenced the 2018 COSO Enterprise Risk Management guidelines as well as biopharmaceutical industrial characteristics and requirements to classify risks into nine categories. We adopted corresponding response measures for different risks to reduce corporate impacts.

Emerging Risks and Mitigation Measures

Risk Identification and Assessment Mechanism

The Company regularly identifies and assesses internal and external risks that may affect its operations and integrates risk management into its day-to-day operations and decision-making processes. For each type of risk, corresponding management mechanisms and assessment procedures are established based on its nature, and the relevant risk items and management measures are reviewed at least once a year.

The key risk identification and assessment mechanisms include:

• Operational and Internal Control Risks: The Internal Audit Office prepares an annual audit plan each year based on the Company's existing and potential risk issues and conducts risk-based audits accordingly.
• Occupational Safety and Health Risks: Hazard identification and risk assessments are conducted annually to systematically evaluate environmental, health, and safety risks.
• Supply Chain Sustainability Risks: Supplier sustainability risk assessments and ESG self-assessment questionnaires are conducted annually to identify potential supply chain risks and opportunities for improvement.
• Climate and Environmental Risks: The Company continuously identifies material climate and environmental risks and regularly conducts climate risk assessments and related management activities.

Risk Incident Reporting and Response Mechanism

PharmaEssentia has established clear procedures for risk incident reporting and response, with employees across all departments serving as the first line of defense in risk management. When employees identify any material irregularities or potential risk incidents during their day-to-day operations, they are required to immediately report them to their supervisors and the relevant responsible units, enabling the Company to promptly implement control and corrective measures.
For information security incidents, the Company has established the Policy on Cybersecurity Control , which set out mechanisms for incident reporting, response, handling, and follow-up. In 2025, the Company established the position of Chief Information Security Officer (CISO) and formed an Information Security Management Team to oversee information security risk management, incident handling, and continuous improvement.
Where an incident involves personal information protection or privacy risks, the Company has also established mechanisms for privacy incident classification, reporting, and response, along with dedicated channels for complaints and the exercise of data subject rights, to ensure compliance with the Personal Data Protection Act and other applicable regulatory requirements.

External Audits and Third-Party Assurance

In addition to its internal risk management and audit mechanisms, the Company continuously reviews the effectiveness of its risk management practices and the robustness of its systems through third-party audits and external assurance.

Key audit and assurance results for 2025 included:

• Completed the second annual surveillance audit of the ISO 27001 Information Security Management System.
• The Sustainability Report and ISO 14064-1 Greenhouse Gas Inventory information underwent third-party verification and assurance by AFNOR Asia Ltd.
• or pharmaceutical quality management, the Company completed an inspection by Taiwan's regulatory authority, the Taiwan Food and Drug Administration (TFDA), with no major deficiencies involving non-compliance with GMP requirements identified.

Mechanism Linking Risk Management Targets to Performance

The Company has established Management Targets and performance indicators for material risks and sustainability issues, covering key areas such as climate change, occupational safety and health, product quality, supply chain management, and information security, and regularly tracks implementation progress and results.

Key management targets include:

• Management targets for waste and energy use intensity
• Zero major occupational accidents involving employees or contractors
• Zero product recalls
• Zero material regulatory violations
• Supply chain sustainability risk management targetss

To strengthen accountability for risk management, the Company also incorporates sustainability- and risk management-related indicators into its performance management system. The performance evaluation indicators for the Chairman, CEO, and General Manager cover areas including innovation and R&D, global supply chain management, operational resilience, and corporate sustainability. Employees may incorporate ESG indicators into their individual performance targets based on the nature of their roles. Long-term incentive mechanisms, including performance bonuses, employee stock options, and restricted shares issued to employees, are also used to encourage all employees to participate in risk management and sustainability initiatives.

Management and Communication of Tax Policies

Unit: NT$ thousands

Unit: NT$ thousands

Note1: Average Effective Tax Rate of Pharmaceuticals, Biotechnology & Life Sciences is 7.89%; Average Cash Tax Rate of Pharmaceuticals, Biotechnology & Life Sciences is 9.97%.

Note2: The Group's effective tax rate and cash tax rate may differ from the applicable statutory tax rate due to the recognition and reversal of deferred tax assets and liabilities, the utilization of tax loss carryforwards, differences in tax legislation and tax incentives across jurisdictions, and periodic income tax estimate adjustments.

In accordance with the 'Guidelines for Information Security Governance for TWSE/TPEx-Listed Companies,' the Company has established an enterprise risk management mechanism and procedures for handling information security incidents. These include clearly defined reporting processes, the assignment of dedicated personnel to handle major incidents, assessment of potential losses and impacts, and the formulation of corresponding response measures. Additionally, the Company strengthens employees’ awareness of information security and integrates it into daily operations. Through a feedback mechanism, we ensure the comprehensive implementation of information security responsibilities.

Information Security Incident Reporting and Response Mechanism

• Employee Frontline Risk Reporting and First Line of Defense Mechanism: PharmaEssentia considers employees across all departments to be the "first line of defense" in risk management. When employees identify any risks or signs of material irregularities during their day-to-day operations (such as suspected information security threats or risks of a data breach), their primary responsibility is to promptly report them to their immediate supervisors and the relevant responsible units.
• Initiate Response Measures in Accordance with the Policy on Cybersecurity Control : The Company has established the Policy on Cybersecurity Control, which clearly set out the standard mechanism for Information Security Incident Reporting and Response. Once an employee reports a suspected information security incident, the Company initiates the necessary security controls, incident reporting, and response procedures in accordance with these procedures.
• Directed and Supervised by the Chief Information Security Officer and Dedicated Team: In 2025, the Company established the position of Chief Information Security Officer (CISO) and formed an Information Security Management Team. One of the primary responsibilities of the Chief Information Security Officer is to direct and oversee information security incident reporting and response. Upon receiving a report of an irregularity, the dedicated team takes over incident handling and risk management to ensure the stability of the Company's operations and the security of its information assets.

Classification and Handling of Personal Data and Privacy Incidents: If an information security incident identified by an employee involves personal data or customer privacy, the Company has also established a Privacy Incident Classification, Reporting, Response, and Disciplinary Management Mechanism to ensure that such incidents are promptly addressed in compliance with applicable regulatory requirements. The Company also provides a clearly designated point of contact for data subject rights requests.

Third-party ISO 27001 Verifications every year

Information Security Training

Secondary Purposes USE

The Company continuously monitors whether user data is used for secondary purposes. In 2025, the proportion of user data used for secondary purposes was 0%.

Responsible Artificial Intelligence Program

PharmaEssentia is committed to promoting the responsible use of artificial intelligence (AI) and has established relevant management measures in accordance with the principles of information security, privacy protection, and risk management to ensure that the use of AI technologies aligns with corporate governance requirements and operational needs while safeguarding information security, data protection, and the rights and interests of stakeholders.

AI Access Controls and Data Protection

The Company does not use artificial intelligence to collect sensitive personal data. For the use of AI tools, the Company applies the principle of least privilege. Employees are required to submit access requests based on business needs, and department heads approve appropriate access rights based on business requirements and information confidentiality levels to reduce the risks of information leakage and misuse.

AI Transparency and Human Oversight

The Company currently uses AI tools primarily to support information gathering, document organization, report preparation, and improvements in operational efficiency. All AI-generated content must undergo human review and professional judgment before use and may not serve as the sole basis for major operational decisions or official external communications. For publicly disclosed content produced with AI assistance, the Company will disclose the use of AI where appropriate to enhance transparency and credibility.

AI Risk Management and Continuous Review

The Company incorporates AI-related risks into its emerging risk management framework and continuously monitors potential information security, data protection, and operational risks arising from AI applications.
The Company currently does not develop its own AI models and is therefore not exposed to model drift risks associated with internally developed models; however, for the AI knowledge management system and related applications planned for future implementation, the Company will establish regular review and update mechanisms to continuously verify the accuracy and applicability of knowledge content and mitigate potential risks through anomaly monitoring and reporting mechanisms.

AI Fairness and Ethical Principles

The Company places great importance on the fairness and appropriateness of AI applications. All AI-generated content must be reviewed and assessed by personnel before use to reduce the risks of inaccurate information or inappropriate use.
As the Company's current AI applications do not involve automated decision-making based on patient information and are not used to make autonomous decisions affecting individual rights and interests, the potential impact of algorithmic bias or unfair decision-making on stakeholders is effectively reduced.

AI Supplier Management

When adopting cloud-based AI tools or third-party AI services, the Company considers not only information security and technical capabilities but also suppliers' ESG management measures and sustainability practices as part of its supplier assessment, thereby supporting the development of responsible AI.

User Feedback Mechanism

The Company has established a feedback mechanism for the use of AI. Employees and relevant stakeholders who have concerns about AI-generated content or the results of AI use may provide feedback through existing communication channels or submit their concerns to the relevant responsible units. Such feedback serves as an important reference for the continuous improvement of AI management mechanisms and usage processes.

AI Education, Training, and Capacity Building

To enhance employees' capabilities in applying artificial intelligence and strengthen their risk awareness, the Company regularly conducts AI-related education and training and awareness activities covering topics such as AI applications, information security, protection of confidential information, prevention of information leakage, and principles for the responsible use of AI.
In addition, the Company encourages employees to participate in external professional training and certification programs, such as the AWS Certified AI Practitioner certification, to strengthen their knowledge and practical capabilities in AI technologies, risk management, and AI ethics.

Benefits of AI Applications and Sustainability Value

The Company uses AI tools to support the collection of publicly available information, report preparation, information organization, and cross-departmental collaboration and communication, thereby improving information processing efficiency and work quality while reducing the burden of repetitive administrative tasks.
For example, in report preparation and the collection of publicly available information, the Company uses AI tools to assist with information organization, content summarization, and cross-departmental communication, significantly improving the efficiency of information gathering and document organization. Compared with traditional work processes, the use of AI can reduce the time required for report preparation and information gathering by approximately 40%, further enhancing operational efficiency and knowledge management effectiveness.
Going forward, the Company will continue to assess the impact of AI applications on operational efficiency, resource use efficiency, and sustainability management outcomes, with AI serving as an important tool for advancing digital transformation and sustainable development.

• Corporation Privacy Policy

Patents and Trademarks

Intellectual Property Education and Training

Supplier Sustainability Standards and Management Processes

PharmaEssentia has established the “Group Supplier Code of Conduct,” signed by the Chairperson, covering key areas including ethics, labor and human rights, health and safety, the environment, and management systems. The Code serves as a core framework for the Company’s responsible supply chain management and is intended to provide a practical benchmark for the industry. To work together with supply chain partners toward shared goals of ethical business practices and sustainable development, the Procurement Department continues to promote the Code through day-to-day business interactions, purchase order notifications, and links to the Supplier Code of Conduct embedded in email signatures. These efforts are designed to strengthen suppliers’ awareness of the Company’s expectations regarding corporate social responsibility and regulatory compliance, while ensuring transparency and high ethical standards throughout the course of business relationships. In the fourth quarter of 2025, PharmaEssentia launched a Supplier Code of Conduct acknowledgment and signing initiative, achieving a 100% completion rate. This ensures that suppliers formally commit to principles including business integrity, labor and human rights, occupational health and safety, and environmental sustainability, thereby further embedding sustainability into supply chain management.
To advance paperless operations and process digitalization, PharmaEssentia introduced a globally synchronized digital procurement platform in 2024. The platform digitalizes and reengineers requisition, procurement, and acceptance processes that previously relied heavily on paper-based workflows, transforming supplier management into a systematic and traceable framework supported by auditable records. For further details, please refer to the “Featured Story: Advancing Paperless Operations.”
PharmaEssentia has established the “Outsourcing Activities Policy” and “Supplier Management Procedures” as the approval procedures and operating standards for suppliers and outsourced service contractors. These policies and procedures govern the screening, evaluation, and approval of suppliers of raw materials, production materials, instruments, and equipment, ensuring that supplied materials and equipment meet the Company’s requirements for quality, delivery, and Good Manufacturing Practice (GMP). The Company also enters into Quality Agreements with outsourced service providers to ensure mutual alignment on product and quality requirements. In 2025, Quality Agreements were completed with 126 vendors, representing a signing rate of 98.41%. Of the eight vendors newly engaged during the year, agreements with two vendors remain in progress, while the other 124 vendors have completed the signing process.

Evaluation of Supplier Risks

Supplier Sustainability Management Actions

Results of Supplier ESG Self-Assessment Surveys for 2025

Number of Suppliers Included in PharmaEssentia Internal Reviews and On-Site Audits in 2025

• Supplier Code of Conduct