ORGANIZATIONAL, MANAGEMENT AND CONTROL MODEL

PAUL WURTH INTERNATIONAL SITE SERVICES S.R.L. ORGANIZATIONAL, MANAGEMENT AND CONTROL MODEL pursuant to Italian Legislative Decree No. 231 of 8 June 2001 ADOPTED BY RESOLUTION OF THE BoD ON 25 SEPTEMBER 2017 Paul Wurth International Site Services Organizational, management and control model

CONTENTS 1. ITALIAN LEGISLATIVE DECREE NO. 231/2001 AND THE REFERENCE LEGISLATION... 6 1.1 The system of administrative liability of juridical persons... 6 1.2 Sanctions... 7 1.3 Attempted crimes and crimes committed abroad... 8 1.4 Court's crime investigation procedure and verification of appropriateness... 8 1.5 Actions exempt from administrative liability... 8 2. ADOPTION OF THE MODEL BY PAUL WURTH INTERNATIONAL SITE SERVICES SRL... 9 2.1. Reasons for adopting the Model... 9 2.2 Purpose of the Model... 10 2.3 The Model preparation process... 10 2.4 Layout of the Document... 11 2.5 Parts of the Model... 11 2.6 Amendments to the Model... 12 3. SUPERVISORY COMMITTEE... 13 3.1 Identification of the Supervisory Committee... 13 3.2 Functions and powers of the Supervisory Committee... 13 3.3 Disclosure by the Supervisory Committee to the Managing Director... 14 3.4 Information flow to the Supervisory Committee... 14 3.4.1 Flagging by members of PWIS or by third parties... 15 3.4.2 Disclosure obligations... 15 3.4.2.1 Specific disclosure obligations... 15 3.4.2.2 Periodic disclosure obligations... 15 3.4.2.3 Identification of Internal Managers, Statements of Compliance and Periodic Declarations... 16 3.4.3 Collection, storage and access to the SC archive... 16 4. STAFF TRAINING AND DISSEMINATION OF THE MODEL... 16 4.1 Staff training... 16 Paul Wurth International Site Services Organizational, management and control model 1

4.2 Information to external business associates and partners... 16 5. DISCIPLINARY SYSTEM AND MEASURES IN THE EVENT OF FAILURE TO COMPLY WITH THE PROVISIONS OF THE MODEL... 17 5.1 General principles... 17 5.2 Sanctions applied to employees... 17 5.2.1 Office workers, Manual workers and Middle Management... 17 5.2.2 Executives... 18 5.3 Measures against seconded workers in the PWIS sites... 18 5.4 Measures against business associates, consultants, partners, counterparts and other third parties. 18 5.5 Procedure for applying sanctions... 18 5.5.1. Disciplinary procedure applicable to Office workers, Manual workers and Middle Management... 19 5.5.2. Disciplinary procedure applicable to executives... 19 5.6 The procedure applicable to seconded workers... 20 5.7 The procedure applicable to third-party recipients of the Model... 20 6. GENERAL RULES OF CONDUCT... 20 SPECIAL SECTION A... 22 A.1 THE TYPES OF CRIMES AGAINST THE PUBLIC ADMINISTRATION (ARTICLES 24 AND 25 OF THE DECREEE) AND OF THE CRIME OF CORRUPTION IN THE PRIVATE SECTOR (ARTICLE 25-TER(S-BIS) OF THE DECREE)... 23 A.1.1 Embezzlement against the Italian State (Article 316-bis, Criminal Code)... 23 A.1.2 Undue receipt of funds disbursed by the Italian State (Article 316-ter, Criminal Code)... 23 A.1.3 Fraud (Article 640(2)(1), Criminal Code)... 23 A.1.4 Aggravated fraud to obtain public funds (Article 640-bis, Criminal Code)... 23 A.1.5 Cybercrimes (Article 640-ter, Criminal Code)... 24 A.1.6 Notion of public official and public servant (Articles 357 and 358, 322-bis, Criminal Code)... 24 A.1.7 Extortion (Article 317, Criminal Code)... 26 A.1.8 Corruption (Articles 318, 319, 320, Criminal Code)... 26 A.1.9 Corruption in legal proceedings (Article 319-ter, Criminal Code)... 26 A.1.10 Unlawful incitement to give or promise benefits (Article 319-quater, Criminal Code)... 26 A.1.11 Incitement to corruption (Article 322, Criminal Code)... 27 Paul Wurth International Site Services Organizational, management and control model 2

A.1.12 Corruption in the private sector (Article 2635, Civil Code)... 27 A.2 CRIME-RISK AREAS... 27 A.2.1 Job contract sales and management... 28 A.2.2 Management of relations with institutions and public bodies... 29 A.2.3 Workplace health and safety management... 29 A.2.4 Environmental management... 30 A.2.5 Procurement and supply tenders... 30 A.2.6 Staff recruitment, management, motivation and development... 31 A.2.7 Cash flow management... 32 A.3 RECIPIENTS OF THE SPECIAL SECTION GENERAL RULES OF CONDUCT AND OF IMPLEMENTATION OF THE DECISION-MAKING PROCESS IN CRIME-RISK AREAS... 33 A.4 SINGLE CRIME-RISK OPERATIONS: IDENTIFYING INTERNAL MANAGERS AND STATEMENTS OF COMPLIANCE... 36 SPECIAL SECTION B... 37 B.1 THE TYPE OF OFFENCES COMMITTED WITH REGARD TO WORKPLACE HEALTH AND SAFETY REGULATIONS (ARTICLE 25-SEPTIES OF THE DECREE)... 38 B.1.1 Manslaughter (Article 589, Criminal Code)... 38 B.1.2 Serious or grievous bodily harm (Article 590(3), Criminal Code)... 38 B.2 CRIME-RISK AREAS... 39 B.2.1 The organization... 40 B.3 RECIPIENTS OF SPECIAL SECTION B: GENERAL RULES OF CONDUCT AND OF IMPLEMENTATION OF THE DECISION-MAKING PROCESS IN CRIME-RISK AREAS... 40 SPECIAL SECTION C... 50 C.1 THE TYPE OF CRIMES COMMITTED WITH REFERENCE TO RECEIVING STOLEN GOODS, MONEY LAUNDERING, SELF-LAUNDERING AND USING ILLEGALLY OBTAINED MONEY, GOODS OR BENEFITS... 51 C.1.1 Foreword... 51 C.1.2 Receiving stolen goods (Article 648 Criminal Code)... 51 C.1.3 Money laundering (Article 648-bis)... 52 C.1.4 Using illegally obtained money, goods or benefits (Article 648-ter, Criminal Code)... 52 Paul Wurth International Site Services Organizational, management and control model 3

C.1.5 Self-laundering (Article 648-ter. (1), Criminal Code)... 53 C.2 CRIME-RISK AREAS... 53 C.3 RECIPIENTS OF SPECIAL SECTION C: GENERAL RULES OF CONDUCT AND OF IMPLEMENTATION OF THE DECISION-MAKING PROCESS IN CRIME-RISK AREAS... 54 SPECIAL SECTION D... 55 D.1 TYPES OF ORGANIZED CRIME OFFENCES... 56 D.1.1 Foreword... 56 D.1.2 Criminal conspiracy (Article 416, Criminal Code)... 56 D.1.3 Mafia-style crime syndicates, also outside Italy (Article 416-bis, Criminal Code)... 57 D.2 CRIME-RISK AREAS... 58 D.3 RECIPIENTS OF SPECIAL SECTION D GENERAL RULES OF CONDUCT AND OF IMPLEMENTATION OF THE DECISION-MAKING PROCESS IN CRIME-RISK AREAS... 58 SPECIAL SECTION E... 59 E.1 TYPES OF ENVIRONMENTAL CRIMES (ARTICLE 25-UNDECIES OF THE DECREE) AND THE CRIME OF ILLEGAL INCINERATION OF WASTE.... 60 E.1.1 Foreword... 60 E.1.2 Regulations pursuant to the Criminal Code... 60 E.1.3 Regulations regarding the discharge of wastewater, atmospheric emissions, waste management and rehabilitation of polluted sites envisaged by the Consolidated Environmental Act (Italian Legislative Decree no. 152/2006)... 62 E.2 CRIME-RISK AREAS... 66 E.3 ENVIRONMENTAL PROTECTION... 66 E.4 RECIPIENTS OF SPECIAL SECTION E - GENERAL RULES OF CONDUCT... 66 SPECIAL SECTION F... 70 F.1 TYPES OF CORPORATE CRIMES (ARTICLE 25-TER OF THE DECREE)... 71 F.1.1 False corporate disclosures (Article 2621, Italian Civil Code)... 71 F.1.2 False reports or disclosures of auditing firms (Article 2624, Italian Civil Code)... 71 F.1.3 Obstruction of auditing activities (Article 2625, Italian Civil Code)... 72 F.1.4 Transactions to the detriment of creditors (Article 2629, Italian Civil Code)... 72 Paul Wurth International Site Services Organizational, management and control model 4

F.1.5 Failure to disclose conflict of interest (Article 2629-bis, Italian Civil Code)... 73 F.1.6 Exerting unlawful influence on Shareholder Meetings (Article 2636, Italian Civil Code)... 73 F.1.7 Obstructing the activities of public regulatory authorities (Article 2638, Italian Civil Code)... 73 F.1.8 Unlawful transactions involving the shares or quotas of the company or its parent company (Article 2628, Italian Civil Code)... 74 F.2 CRIME-RISK AREAS... 74 F.2.1 Management of relations with public institutions and bodies... 74 F.2.2 Bookkeeping, preparation of the financial statements and tax management... 74 F.2.3 Management of corporate affairs... 75 F.3 RECIPIENTS OF THE SPECIAL SECTION GENERAL RULES OF CONDUCT AND OF IMPLEMENTATION OF THE DECISION-MAKING PROCESS IN CRIME-RISK AREAS... 75 Paul Wurth International Site Services Organizational, management and control model 5

1. ITALIAN LEGISLATIVE DECREE NO. 231/2001 AND THE REFERENCE LEGISLATION 1.1 The system of administrative liability of juridical persons The Italian Legislative Decree no. 231 of 8 June 2001 introduced a system of administrative liability to Italian law. This basically holds companies and associations, whether incorporated or not ( Organizations ) criminally liable for some offences committed to their benefit or in their interests by: - natural persons who are representatives, or hold administrative or senior executive positions in those Organizations or in one of their financially and operationally independent organizational units, as well as natural persons who actually (de facto) manage and control the same Organizations; - natural persons managed or supervised by one of the foregoing parties. The administrative liability of the juridical person joins the criminal liability of the natural person who actually committed the offence and they are both subject to investigation during the same proceedings before the criminal court. Before the Decree entered into force, the principle of the criminal liability of personhood posed by Article 27 of the Italian Constitution precluded the possibility of criminally judging and sentencing Organizations for offences committed in their interests. Only joint civil liability could exist for any damages caused by their employee or for their civil obligation to pay any fine or penalty the employee is sentenced to pay if the employee is insolvent (Articles 196 and 197, Italian Code of Criminal Procedure). Today, the Organization is liable only if the following types of offences expressly named in the Decree are committed: i) crimes against the Public Administration (Articles 24 and 25, Italian Legislative Decree 231/2001); ii) counterfeiting of currency, legal tender, revenue stamps and distinctive signs (Article 25-bis, Italian Legislative Decree 231/2001); iii) corporate crimes (Article 25-ter, Italian Legislative Decree 231/2001); iv) crimes committed for the purposes of terrorism and subverting the democratic order envisaged by the criminal code and special laws (Article 25-quater, Italian Legislative Decree 231/01); v) offences against the person (Article 25-quinquies, Italian Legislative Decree 231/01); vi) market abuse crimes (Article 25-sexies, Italian Legislative Decree 231/01); vii) cross-border crimes (Article 10, Law 146/06); viii) female genital mutilation (Article 25-quater.1, Italian Legislative Decree 231/01); ix) manslaughter and serious or grievous bodily harm committed in breach of workplace health and safety regulations (Article 25-septies, Italian Legislative Decree 231/01); x) receiving stolen goods, money laundering, self-laundering and using illegally obtained money, goods or benefits (Article 25-octies, Italian Legislative Decree 231/01); xi) cybercrimes and unlawful processing of data (Article 24-bis, Italian Legislative Decree 231/2001); xii) organized crime (Article 24-ter, Italian Legislative Decree 231/2001); xiii) crimes against industry and trade (Article 25-bis.1, Italian Legislative Decree 231/2001); xiv) Offences relating to breach of copyright (Article 25-novies, Italian Legislative Decree 231/2001); xv) xvi) incitement to not testify or to bear false testimony before the courts (Article 25-decies, Italian Legislative Decree 231/2001); environmental crimes (Article 25-undecies, Italian Legislative Decree 231/2001) also with reference to sanctions only, illegal incineration of waste (Article 256-bis, Italian Legislative Decree 152/2006); Paul Wurth International Site Services Organizational, management and control model 6

xvii) employing foreign nationals who are illegal immigrants (Article 25-duodecies, Italian Legislative Decree 231/2001). 1.2 Sanctions The sanctions envisaged for administrative offences relating to crimes committed are: - fines; - disqualification; - confiscation; - publication of the ruling. In particular, the object of the disqualification that is of no less than three months and no more than two years is the specific business activity the Organization's crime refers to and is formed of: - disqualification from doing business; - ban from entering into contracts with the Public Administration, unless these are to obtain a public service; - suspension or cancellation of authorizations, permits or concessions serving to commit the offence; - exclusion from benefits, loans, contributions or subsidies and cancellation of those already granted, if applicable; - ban on advertising goods or services. Disqualification is applied in the hypothesis strictly indicated in the Decree only if one of the following conditions exists: 1) the Organization gained considerable profit from the crime and the crime was committed by - senior management; or - persons managed or supervised by others when serious organizational shortcomings made it possible or easier to commit the offence; 2) in the event of repeat offences. The type and duration of the disqualification is established by the courts, taking into account the seriousness of the crime, the extent of the Organization's liability and the actions taken by the Organization to eliminate or mitigate the consequences of the crime and to prevent other offences from being committed. In place of application of the sanction, the court may order the Organization to continue operating under a courtappointed administrative receiver. The Organization may also be disqualified as a precautionary measure if there is strong evidence of its liability in committing the crime and there are reasonable grounds and specific elements that would seem to indicate the likelihood that crimes of the same kind as the one before the courts may be repeated (Article 45). In this case too, instead of the sanction, the court may appoint an administrative receiver. Noncompliance with the disqualification constitutes an independent crime under the Decree, as the source of possible administrative liability of the Organization (Article 23). The fines applicable to all crimes are determined through a system based on units of no less than one hundred and no more than one thousand, amounting to a minimum of EUR 258.23 through to a maximum of EUR 1,549.37. The courts set the number of units, taking into account the seriousness of the crime, the extent of the Organization's liability and the actions taken by the Organization to eliminate or mitigate the consequences of the crime and to prevent other offences from being committed. The amount of the unit is established on the basis of the economic position and equity of the Organization, with the purpose of assuring effectiveness of the fine (Article 11 of the Decree). In addition to the foregoing sanctions, under the Decree the price or profit made from the crime must always be confiscated. This may also take the form of assets or other benefits of the same value, as well as publication of the conviction where there is a disqualification. Paul Wurth International Site Services Organizational, management and control model 7

1.3 Attempted crimes and crimes committed abroad The Organization is also liable for offences connected to attempted crimes or crimes committed abroad. In the event the crimes listed in Section I of the Decree are attempted, the fines and disqualification are reduced by from one third to one half. Fines shall not be imposed if the Organization deliberately prevents the action or event from being completed. In that case, the fine is not applied because of the interruption of every relationship whereby the Organization identifies with the individuals that assume they are acting in its name and on its behalf. This is a particular hypothesis, so-called active termination, pursuant to Article 56 (4), Italian Criminal Code). On the basis of the provisions of Article 4 of the Decree, any Italian-based Organization may be made liable for crimes - included in the same Decree - committed abroad, in order to cover with a sanction criminal conduct of frequent occurrence, and to avoid easy circumventions from the entire regulatory system in question. The basis for liability of the Organization for crimes committed abroad are: a) the crime must be committed abroad by an individual who is operationally connected to the Organization, pursuant to Article 5(1) of the Decree; b) the Organization must have its headquarters in the territory of Italy; c) the Organization may be liable only in the cases and under the conditions envisaged in Articles 7, 8, 9, 10, Italian Criminal Code. If the cases and conditions under the foregoing articles of the criminal code exist, the Organization is liable as long as it is not prosecuted by the country where the crime was committed. 1.4 Court's crime investigation procedure and verification of appropriateness The liability of Organizations for administrative offences relating to crimes is investigated as part of a criminal procedure. The verification of the company's liability, attributed to the criminal judge, takes place by: - making sure the predicate crime exists due to the company's liability; - verifying that the crime committed by any of the Organization's employees or senior management is in its interests or to its benefit; - verification of appropriateness of the organizational models adopted. The judge's verification of the hypothetical appropriateness of the organizational model to prevent the crimes pursuant to the Decree is conducted according to the criteria of the so-called posthumous prognosis. In other words, the judgment of appropriateness is formulated according to a substantially exante criteria, where the judge ideally puts themselves in the company at the moment the offence was committed in order to test the congruency of the model adopted. 1.5 Actions exempt from administrative liability Under Articles 6 and 7 of the Decree, Organizations may be exempt from criminal liability for offences committed in their interests or to their benefit by both senior management and employees. In particular, for crimes committed by senior management, under Article 6 the Organization may be exempt if it proves that: a) prior to the crime being committed, the executive body adopted and effectively implemented an appropriate Organizational, Management and Control Model to prevent offences of the kind that occurred ( Model ); b) the organization has set up a committee to supervise the functioning and observance of the Model and to keep it updated (the Supervisory Committee or Committee or SC ) and is vested with powers to act and monitor compliance on its own initiative; c) the people who committed the crime acted by fraudulently avoiding the foregoing Model; Paul Wurth International Site Services Organizational, management and control model 8

d) there was no failure or oversight to supervise by the SC. With regard to the employees, under Article 7, the Organization is exempt if, prior to the crime being committed, it adopted and effectively implemented an appropriate Model to prevent offences of the kind occurred. Furthermore, under the Decree, the Model must meet the following requirements: - identify the activities where there is a possibility of crimes being committed; - envisage specific procedures to schedule training and implement the resolutions of the Organization concerning offences to be prevented; - determine appropriate methods to manage financial resources to prevent those offences from being committed; - provide for the obligation of disclosure to the SC; - introduce an appropriate in-house disciplinary system to sanction noncompliance with the measures specified in the Model. Under the Decree itself, the Models may be adopted, guaranteeing the foregoing requirements, on the basis of codes of conduct prepared by trade associations, communicated to the Ministry of Justice that, together with the competent Ministries, may formulate their observations on the appropriateness of the models to prevent the crimes, within 30 days. With reference to the crimes and administrative offences as regards market abuse, the Ministry of Justice makes this assessment of appropriateness after consultations with CONSOB (Commissione Nazionale per le Società e la Borsa), the Italian public authority responsible for regulating the financial markets. 2. ADOPTION OF THE MODEL BY PAUL WURTH INTERNATIONAL SITE SERVICES SRL Paul Wurth International Site Services srl (PWIS) is headquartered in Genoa, Via di Francia 1 and all its management and commercial functions are located here. The Company's purpose is to supply all services in Italy and abroad relating to the construction, assembly, installation, commissioning, use, inspection, revamp and repair of industrial or other equipment in the field of steelmaking. PWIS is an associate company of Paul Wurth Italia and the two companies have a service agreement in place for administration, travel arrangements, visa applications, project management, preparation of procurement requests and purchase orders, sales estimates and contracts, accounting and tax matters, treasury, payroll control, human resources, quality and statutory assurance. The company's organizational structure is based on the implementation of keeping the duties, roles and responsibilities of the operational functions separate from those of the control functions. 2.1. Reasons for adopting the Model To guarantee that everyone who operates on behalf of or in the interests of the company always conforms to the principles of integrity and transparency in conducting its business and activities, PWIS decided it was appropriate to adopt the Model in line with the provisions of the Decree and with the applicable case law. This initiative, including the adoption of a Code of Ethics (Annex I) was implemented in the view that adoption of this Model would be a valid tool to raise awareness with whoever acts in the company's interests or to its benefit even though under the provisions of the Decree, the actual Model is optional and not obligatory. In particular, the Recipients of this Model are listed below and, as such and as part of their designated competences, the following are required to know and observe the Model: Paul Wurth International Site Services Organizational, management and control model 9

- the members of the Board of Directors who decide the activities, propose investments and take all decisions and actions with regard to the performance of PWIS; - the employees, seconded personnel and all consultants who have contractual relations with the company of any kind whatsoever, including casual and/or temporary; - anyone with whom PWIS has business and/or financial dealings of any kind. 2.2 Purpose of the Model The PWIS Model is founded on a structured, organized system of documents and on control activities that: - identify the areas and/or processes of possible risk in the company's business, in other words the activities where there is the conceivable potential for crimes to be committed; - define an internal regulatory system aimed at preventing crimes, inter alia comprising: o o o a Code of Ethics that lays down the commitments and the ethical responsibilities of the Recipients of the Model in conducting their activities and business; a system of proxies, signatory powers and powers of attorney for signing acts that assures clear, transparent representation of the process for producing and implementing decisions; a system of sanctions; - are based on an organizational structure in keeping with the activities, aimed at inspiring and controlling appropriate conduct, assuring clear, systematic allocation of duties, applying proper separation of functions, considering the size of PWIS, assuring that the arrangements of the organizational structure are actually implemented, by the following means: o o the formalization of roles and responsibilities; a system of proxies of internal functions and powers of attorney to represent PWIS externally, which assures a clear and consistent separation of functions; - identify the management and control processes for the financial resources in the crime-risk activities; - allocate to the SC the task of supervising the functioning and observance of the Model. Therefore, the Model has the following purpose: - to prepare a structured and organized prevention and control system aimed at reducing the risk of commission of the crimes connected to the PWIS business activity; - to make aware all parties who operate in the name and on behalf of PWIS in the areas of crime-risk activities that if they breach the provisions governing those activities, punishable sanctions at the criminal and administrative level apply not only to them but also against PWIS; - to inform everyone who operates for any reason whatsoever in the name, on behalf or in any case in the interests of PWIS that any breach of the provisions contained in this Model will lead to the application of specific sanctions that may go so far as termination of the contractual relationship; - to stress that PWIS does not tolerate unlawful conduct, in no way identifying with the purpose pursued, namely the mistaken conviction that parties are acting in the interests or to the benefit of the company, because that conduct is in any case contrary to the ethical principles that PWIS intends to observe and is therefore against the interests of PWIS itself; - to proactively censure any conduct that breaches the Model by imposing disciplinary and/or contractual sanctions. 2.3 The Model preparation process PWIS created a specific project to prepare the Model. This project took into due consideration the fact that, in line with the Confindustria Guidelines, PWIS is considered a small undertaking in light of the essential nature of its internal hierarchical and functional structure. Paul Wurth International Site Services Organizational, management and control model 10

The Model preparation project followed the steps below: 1) Risk Assessment Mapping. The goal of this step was to analyse the context of PWIS in order to map all the areas of its activities and use these to identify those activities where there is the conceivable potential for the crimes envisaged in the Decree to be committed. The activities and crime-risk processes/activities were identified first of all by examining documents then by interviewing the key parties in the PWIS structure. 2) Analysis of potential risks. The crimes that could be potentially committed as part of the PWIS business activity were identified with reference to the risk assessment mapping, and for each crime, the occasions, purposes and methods of committing the unlawful conduct were identified. 3) Proposals for improvement. On the basis of the results obtained in the prior step and the comparison with the hypothetical benchmark model (consistent with the Decree, with case law, with the Confindustria guidelines and with national and international best practices), PWIS identified a series of areas for incorporation and/or improvement in the system of controls, against which appropriate actions to take were defined. 4) Preparation of the Model. PWIS prepared the Model considering the results of the foregoing steps. The layout is described in the next paragraph. This Model and the Code of Ethics were adopted as a consequence of the results of the project described above. 2.4 Layout of the Document The Model is formed of a General Section and of five Special Sections. The first part of the General Section references the principles of the Decree and the reasons for adopting this Model. It is followed by a description of: - the essential components of the Model, particularly with reference to the SC; - staff training and dissemination of the Model; - the disciplinary system and measures to adopt in the event of failure to comply with the provisions of the Model; - the general rules of conduct applicable to all crime-risk areas. For each crime-risk area identified during the Risk Assessment, the Special Sections showcase the: - description of the potential risk profile; - crime-risk activities; - specific control protocols. Moreover, the annexed documents listed below are an integral part of the Model: - Code of Ethics (Annex I) specifies the values the Recipients are required to adhere to when accepting responsibilities, structures, positions and regulations. - Statement of Compliance and Periodic Declaration (Annex II): prepared to inform the SC of the initiatives/activities performed in the areas sensitive to the risk of crime. 2.5 Parts of the Model As stated above, the components of the preventive control system to assure effectiveness of the Model are: 1. Organizational System. This System also issues and disseminates in-house communications and memos, whose object is specific organizational and operational aspects of the company. 2. Authorization System. This System is structured in keeping with the following requirements: o proxies and powers of attorney that associate the power with the corresponding area of responsibility; Paul Wurth International Site Services Organizational, management and control model 11

o o o each proxy and power of attorney clearly defines the powers of the representative and specifies the limits to those powers; the management powers assigned with the proxies and/or powers of attorney are consistent with the corporate objectives; everyone who acts in the name and on behalf of PWIS vis-a-vis third parties, and the Public Administration must possess a formal power of attorney and/or specific authorization to represent the company. In detail, the system is centred on the assignment of: o o permanent representation powers, conferred by means of registered powers of attorney drawn up by a notary relating to the performance of activities connected with the permanent responsibilities existing in the corporate organization; powers for single business operations, conferred by means of powers of attorney or other forms of proxy depending on their content. These powers are assigned according to the law, which defines the forms of representation consistent with the types of single acts to be executed. Under the services agreement in place, the Legal Affairs Organizational Unit of Paul Wurth Italia handles the notary formalities for conferring the power of attorney, lists the act executed sequentially and sends a letter of instructions notifying the new proxy of the conferment, the regulations and any other limits to their powers. If the powers are cancelled, again the Legal Affairs Organizational Unit of Paul Wurth Italia handles the legal and/or implementation phases. 3. Governance. The governance system adopted by PWIS is structured in the phases of preparation of the annual budget, the interim and final financial statements and the preparation of revised budgets. The system assures that: o o a number of parties are involved so that the functions for processing and transmitting information can be appropriately separated as much as possible, in consideration of the size of PWIS. any actual or potential critical situations can be promptly flagged, through a suitable and prompt information flow and reporting system. 4. Cash flow management. This is based on principles where functions are separated in order to assure, as much as possible, in consideration of the size of PWIS that expenditure is requested, made and controlled by independent functions or people who are as distinct as possible, who have also not been assigned any other responsibilities that may determine potential conflicts of interest. Lastly, cash is managed according to the criteria of preserving equity, so crime-risk financial operations are disallowed. 5. Document management. All in-house and external documents are managed using procedures that govern, on a case-by-case basis, the update, distribution, recording, filing and safety management of documents and records. See Annex 1 and the dedicated special sections below with regard to the Code of Ethics, the SC, the disciplinary system and the staff information and training system. 2.6 Amendments to the Model This Model is a document issued by the executive body in compliance with the provisions of Article 6(1)(a) of the Decree, so the Board of Directors is responsible for its adoption and for any amendments and additions made to it. However, the Supervisory Committee may directly make any minor amendments or additions to this Model. The SC is also empowered to independently and promptly approve the annexes to the Model, with the exception of the Code of Ethics. Paul Wurth International Site Services Organizational, management and control model 12

3. SUPERVISORY COMMITTEE 3.1 Identification of the Supervisory Committee Under Article 6(4) of the Decree, in small undertakings, the executive body may directly perform the duties specified in section 1(b). Considering this regulatory specification, given the size and simplicity of the organizational structure and since it does not have a function (or person) with the duties of monitoring the internal control system, the Board of Directors of PWIS conferred the title of Supervisory Committee to a single party outside the company, pursuant to Article 6(4)(b) of the Decree. In line with the Confindustria Guidelines, taking into account the many responsibilities and activities the executive body addresses every day, in performing its duties, the Committee may avail itself of: - external consultants who, on a case-by-case basis are deemed appropriate to perform the activities indicated. The SC reports to the Managing Director. 3.2 Functions and powers of the Supervisory Committee The mission of the Supervisory Committee is to: - verify and supervise the Model and its updates; - promote information and training activities vis-a-vis the Model; - manage information flow and reporting. More specifically, the Supervisory Committee has the task of: - periodically auditing the activities of PWIS with the goal of identifying the areas sensitive to the risk of crime pursuant to Italian Legislative Decree 231/01 and recommending to the Board of Directors any updates and/or amendments deemed necessary; - pursuant to Italian Legislative Decree 231/01, making sure the Model is effective at preventing the commission of the crimes under the foregoing Decree, recommending any applicable updates to the Model; - monitoring and assessing whether or not the Model continues to meet the soundness and efficiency requirements over time, recommending all actions necessary to assure its effectiveness; - in the scope of the areas assessed as being sensitive to the risk of crime, verifying: o o that the activities are executed in conformity with the Model adopted; compliance of the existing authorization and signatory powers and their consistency with the organizational and governance responsibilities defined; - defining and addressing information flow in application of the Model, so the SC is kept up to date vis-a-vis activities assessed as being sensitive to the risk of crime, and laying down communication procedures to be apprised of any breaches of the Model; - with the assistance of the Human Resources Organizational Unit of Paul Wurth Italia, promoting an adequate staff training process by means of suitable initiatives to disseminate awareness and understanding of the Model; - promoting and coordinating the initiatives aimed at facilitating awareness of the Model and of its corresponding procedures by anyone who operates on behalf of PWIS. To execute the foregoing provisions, the Committee is vested with the following powers: - unrestricted access to documents and/or information in order to perform the functions the Committee has been assigned pursuant to the Decree; - avail itself of the services of external consultants with proven professionalism if this becomes necessary to perform its activities; Paul Wurth International Site Services Organizational, management and control model 13

- if necessary, have direct contact with employees and with the Managing Director; - ask associates, external consultants and partners for information. As already underscored, in order to improve and make more effective the execution of the duties and functions assigned to it, the Committee may avail itself of Paul Wurth Italia resources to carry out its operations, on the basis of the agreement in place. 3.3 Disclosure by the Supervisory Committee to the Managing Director The Supervisory Committee of PWIS will report to the Board of Directors by sending: - an annual written report whose object is: o o o o o all activities executed in the period; critical situations that emerged both in terms of in-house conduct or events and in terms of effectiveness of the Model; alerts received during the year and actions taken by the Supervisory Committee and by the other parties concerned vis-a-vis these reports; activities it was not possible to execute for lack of time and/or resources; implementation status of the Model, indicating the necessary and/or appropriate corrective actions for this and their level of implementation; - the plan of activities for the following year. The Committee is required to promptly report to the Board of Directors in the following cases: - for any breach of the Model deemed founded and flagged to the Committee by employees or that it ascertained itself; - organizational or procedural shortfalls that may determine the real danger of commission of the crimes as defined by the Decree; - regulatory amendments relevant for implementation and effectiveness of the Model; - lack of collaboration by employees; - existence of criminal proceedings against parties who operate on behalf of PWIS, or proceedings against the organization itself in relation to crimes as defined by the Decree; - result of assessments ordered as a consequence of inquiries initiated by the courts vis-a-vis crimes as defined by the Decree; - any other information deemed appropriate for urgent decisions to be made by the Board of Directors. 3.4 Information flow to the Supervisory Committee Under Article 6(2)(d) of the Decree, the Model must include whistle-blowing obligations to the Supervisory Committee. This obligation is conceived as a tool to assure supervision of the effectiveness and efficiency of the Model, and for any subsequent assessment of how and why it was possible to commit any of the crimes defined in the Decree; it also has the purpose of empowering the Committee's requests for documents during its audits. It is possible to contact the Supervisory Committee by sending communication to Organismo di Vigilanza di PWIS, Via di Francia n. 1 Genoa. A dedicated electronic mail address has been created to facilitate the flow of alerts and information to the SC. Paul Wurth International Site Services Organizational, management and control model 14

3.4.1 Flagging by members of PWIS or by third parties The Recipients of the Model are required to flag all information of any kind that they have obtained, also from third parties in relation to the breach of the Model in the areas of crime-risk activities, as well as any other irregularities. Namely: - the commission of crimes or the performance of actions intended to facilitate crimes; - conduct not in line with the rules of conduct pursuant to this Model; - particularly significant operations or operations with risk profiles that may lead to the recognition of the reasonable possibility of commission of crimes. The Committee will: - take into consideration all alerts submitted as long as they are not anonymous, making sure that whistle-blowers are protected from any retaliation; - assess the alerts received and any subsequent initiatives at its own reasonable discretion and under its responsibility. It may interview the whistle-blower and/or the person accused of the presumed breach and shall give written motivation for any decision made. 3.4.2 Disclosure obligations In addition to the flagging obligations under paragraph 3.4.1, other information must be sent to the SC specifically or periodically. 3.4.2.1 Specific disclosure obligations The following information must be sent to the SC when the event occurs: - measures and/or notices issued by the courts or by any other authority that refer to investigations/assessments for any crimes or administrative offences set out in the Decree, also against persons unknown; these shall be sent by the Legal Affairs Organization Unit of Paul Wurth Italia - requests for legal assistance made by executives and/or by employees and/or by former executives and/or by former employees if criminal proceedings have been initiated against them for the crimes as defined by the Decree (for former executives and/or former employees if the proceedings refer to actions taken at the time they were executives and/or employees in the company); these shall be sent by the Legal Affairs Organization Unit of Paul Wurth Italia - the reports prepared by the Managing Director as part of their control activities and that may generate elements with critical profiles vis-a-vis compliance with the Decree provisions (Statements of Compliance); - disciplinary proceedings executed and any sanctions imposed, or the dismissal of these proceedings with relative grounds; these are sent by whoever is empowered to decide on imposing the sanction or not in the disciplinary procedure (see Section 5 for more details). 3.4.2.2 Periodic disclosure obligations The following information must be periodically disclosed to the Committee: - structure of powers and system of proxies adopted by PWIS; - reports relative to disputes, as follows: o criminal, civil and administrative disputes in place are under the responsibility of the Legal Affairs Organizational Unit of Paul Wurth Italia; - six-monthly report relating to the consulting relations launched during the period; Paul Wurth International Site Services Organizational, management and control model 15

- six-monthly report pertaining to workplace health and safety by the Health and Safety Officer (HSM- RSPP). 3.4.2.3 Identification of Internal Managers, Statements of Compliance and Periodic Declarations To complete the periodic disclosures specified in the paragraph above, the Statements of Compliance and the Periodic Declarations are to be considered. The Managing Director is the in-house Manager responsible for crime-risk operations performed directly by them or performed in the sphere of the crime-risk areas. In the sphere of the crime-risk activities, Managers must notify the Supervisory Committee of liaison with the Public Administration by filling in a Statement of Compliance to be sent every six months (Annex II A). Internal Managers are also required to send Declarations to the SC every six months, specifying the exercise of the powers vested in line with the operating procedures and the provisions of the Model and of the Code of Ethics. This Declaration discloses all crimes considered a potential risk and must be signed by the empowered representatives. 3.4.3 Collection, storage and access to the SC archive The SC shall store all information, flagged alerts and reports envisaged in the Model in a special archive, which is only accessible under the terms and conditions specified in the Regulations of the Supervisory Committee. 4. STAFF TRAINING AND DISSEMINATION OF THE MODEL 4.1 Staff training PWIS promotes knowledge of its adoption of the Model and of the Code of Ethics, of the protocols contained therein and their updates among all employees and seconded workers (Personnel) who are, therefore, required to be familiar with its contents, comply with them and contribute to their implementation. In this context, PWIS arranges information and training activities as follows: - publication of the Model and of the Code of Ethics on the company's intranet and on its website; - consignment of the Model and of the Code of Ethics to Staff members and to new hires and/or seconded personnel at the time of employment/secondment; - training courses on the contents of Italian Legislative Decree 231/01, of the Model and of the Code of Ethics; - e-mails or update notices describing amendments to the Model and/or to the Code of Ethics. The training activities are managed by the Human Resources Organization Unit of Paul Wurth Italia, together with the SC. 4.2 Information to external business associates and partners PWIS also promotes familiarity of and compliance with the Model and the Code of Ethics among its partners, consultants, suppliers and any other business associates of any kind. This information is provided by means of a memo communicating the existence of the Model and of the Code of Ethics, with a request to consult them on the website. Paul Wurth International Site Services Organizational, management and control model 16

5. DISCIPLINARY SYSTEM AND MEASURES IN THE EVENT OF FAILURE TO COMPLY WITH THE PROVISIONS OF THE MODEL 5.1 General principles In order to assure effectiveness of the Model, it is essential to prepare an adequate system of sanctions if the provisions contained therein are breached. In this respect, according to Article 6(2)(e) of the Decree, Models must introduce an appropriate disciplinary system to sanction noncompliance with the measures indicated in the Model. For the purposes of this disciplinary system, and in compliance with the provisions pursuant to collective bargaining agreements, where applicable, any actions or conduct that breach the Model shall be liable to sanctions. Disciplinary sanctions are applied regardless of the initiation and/or outcome of any criminal proceedings, because PWIS takes on board the rules of conduct imposed by the Model in full autonomy, irrespective of the type of wrongdoing that may be determined by noncompliance with the Model. The principles of proportion and adequacy vis-a-vis the alleged breach must be considered when identifying and applying sanctions. To this end, the following circumstances are significant: - type of alleged wrongdoing; - actual circumstances in which the wrongdoing occurred; - means of committing the conduct; - seriousness of the breach, also taking into account the subjective attitude of the offender; - whether more than one breach is generated by the same conduct; - whether more than one person have committed the same breach; - whether the wrongdoer is a repeat offender. The disciplinary system shall be continuously monitored by SC and by the Human Resources Organizational Unit of Paul Wurth Italia. 5.2 Sanctions applied to employees 5.2.1 Office workers, Manual workers and Middle Management Conduct by employees in breach of the single rules of conduct specified in this Model constitute disciplinary offences. The sanctions imposed against these employees fall within those set forth in the National Collective Bargaining Agreement provisions, in compliance with the procedures under Article 7 of the Workers' Statute and special legislation, where applicable. With regard to the foregoing, the Model refers to the categories that may be sanctioned on the basis of the existing sanctioning system. These categories describe the conduct sanctioned, according to the significance of each case considered, and the actual sanctions envisaged for committing those wrongdoings, depending on their seriousness. In particular, in compliance with the Criteria of correlation between employee misconduct and the disciplinary measures contained in the applicable National Collective Bargaining Agreement for the Metalworking Industry, the following is envisaged: - workers who breach the procedures of the Model or whose conduct is not in compliance with the actual provisions of the Model when performing activities in crime-risk areas shall be subject to a verbal reprimand, a written warning, a fine or suspension from work without pay, depending on the seriousness of the breach, said misconduct being construed as a breach of the agreement that causes regulatory and non-material damage to PWIS; Paul Wurth International Site Services Organizational, management and control model 17

- workers whose conduct when performing activities in crime-risk areas does not comply with the provisions of this Model and is univocally aimed at committing a crime sanctioned by the Decree shall be dismissed with notice, said misconduct being construed as insubordinate conduct vis-a-vis the requirements laid down by PWIS; - workers whose conduct when performing activities in crime-risk areas clearly breaches the provisions of this Model, giving rise to administrative liability pursuant to the Decree, said misconduct being construed as exposing PWIS to serious non-material and/or material harm, as well as constituting a criminal offence under law shall be summarily dismissed. 5.2.2 Executives Any executives who breach any of the internal procedures pursuant to this Model or whose conduct, when performing activities in crime-risk areas, does not comply with the provisions of this Model shall be subject to the application of the most suitable measures in compliance with the provisions of the National Collective Labour Agreement for Executives in industry. In particular: - for non-serious breach of one or more rules of procedure or conduct pursuant to the Model, executives are subject to written warning to comply with the Model, a condition which is necessary to maintain the relationship of trust with PWIS; - for serious breach of one or more provisions of the Model that constitutes relevant noncompliance, executives are subject to dismissal with notice; - for breach of one or more provisions of the Model that is serious enough to irreparably compromise the relationship of trust, thereby making it impossible to continue the employment relationship, even temporarily, the worker shall be summarily dismissed. 5.3 Measures against seconded workers in the PWIS sites The SC shall notify the Company of any breach of the Model by seconded workers in PWIS sites and the Company will take whatever action is required and is consistent with the seriousness of the breach. 5.4 Measures against business associates, consultants, partners, counterparts and other third parties Any conduct effected as part of a contractual relationship by associates, consultants, partners, counterparts and other third parties in contrast with the lines of conduct indicated in this Model and in the Code of Ethics may determine the termination of the contractual relationship under the appropriate clauses. 5.5 Procedure for applying sanctions The procedure for applying sanctions resulting from breach of the Model and of the procedures differs according to each category of recipients with regard to the stage of: - allegations of the breach against the party concerned; - determining and applying the sanction. In any case, the application procedure begins after receiving notification from the SC of breach of the Model. More specifically, any time the SC is alerted to a breach of the Model (as long as this is not anonymous), or if, in the course of its supervisory activities, it suspects the danger of a breach, it is required to carry out any assessments and controls falling within the scope of its activity. After it has completed its audit, the SC uses the elements in its possession to decide whether or not to initiate the disciplinary procedure. Paul Wurth International Site Services Organizational, management and control model 18