17 March 2023 : Report of the Statutory Auditors appointed as independent third 2022

4.7. Statutory Auditor's Reports

4.7.1. Report of one of the Statutory Auditors, appointed as independent third party, on the verification of the consolidated non-financial performance statement

Year ended December 31, 2022

This is a free English translation of the report by one of the Statutory Auditors issued in French and is provided solely for the convenience of English-speaking readers. This report should be read in conjunction with, and construed in accordance with, French law and professional standards applicable in France.

L'OREAL

14, rue Royale

75008 Paris

To the Shareholders' Meeting,

In our capacity as Statutory Auditor of L'Oréal SA(hereinafter the "Company"), appointed as independent third party ("third party") and accredited by the French Accreditation Committee (Cofrac), under number 3-1886 rév. 0 (Cofrac Inspection Accreditation, scope available at www.cofrac.fr), we have conducted procedures to express a limited assurance conclusion on the historical information (observed or extrapolated) in the consolidated non-financial performance statement, prepared in accordance with the Company's procedures (hereinafter the "Guidelines"), for the year ended December 31, 2022 (hereinafter the "Information" and the "Statement", respectively), presented in the Group management report pursuant to the legal and regulatory provisions of Articles L. 225-102-1, R. 225-105 and R. 225-105-1 of the French Commercial Code (code de commerce).

Conclusion

Based on our procedures as described in the section "Nature and scope of procedures" and the evidence we have obtained, no material misstatements have come to our attention that cause us to believe that the non-financial performance statement does not comply with the applicable regulatory provisions and that the Information, taken as a whole, is not fairly presented in accordance with the Guidelines.

Preparation of the non-financial performance statement

The absence of a generally accepted and commonly used reference framework or established practices on which to base the assessment and measurement of the Information enables the use of different but acceptable measurement techniques that may impact comparability between entities and over time.

Accordingly, the Information must be read and interpreted with reference to the Guidelines, summarised in the Statement and available on the Company's website or on request from its headquarters.

Limits inherent in the preparation of the information relating to the Statement

The Information may be subject to uncertainty inherent to the state of scientific and economic knowledge and the quality of external data used. Some information is sensitive to the choice of methodology and the assumptions or estimates used for its preparation and presented in the Statement.

Responsibility of the Company

Management is responsible for:

• selecting or determining the appropriate criteria for the preparation of the Information;
• preparing a Statement pursuant to legal and regulatory provisions, including a presentation of the business model, a description of the main non-financial risks, a presentation of the policies implemented with respect to these risks as well as the outcomes of these policies, including key performance indicators and the information set-out in Article 8 of Regulation (EU) 2020/852 (Green taxonomy);
• implementing such internal control as it determines is necessary to enable the preparation of Information that is free from material misstatement, whether due to fraud or error.

The Statement has been prepared by applying the Company's Guidelines as referred to above.

244 L'ORÉAL - UNIVERSAL REGISTRATION DOCUMENT 2022

Based on our work, our responsibility is to express a limited assurance conclusion on:

• the compliance of the Statement with the requirements of Article R. 225-105 of the French Commercial Code;
• the fairness of the information provided pursuant to part 3 of sections I and II of Article R. 225-105 of the French Commercial Code, i.e. the outcomes of policies, including key performance indicators, and measures relating to the main risks, hereinafter the "Information."

As it is our responsibility to issue an independent conclusion on the information prepared by management, we are not authorised to participate in the preparation of the Information, as this could compromise our independence.

It is not our responsibility to provide a conclusion on:

• the Company's compliance with other applicable legal and regulatory provisions (particularly with regard to the information set-out in Article 8 of Regulation (EU) 2020/852 (Green taxonomy), the duty of vigilance and the fight against corruption and tax evasion);
• the fairness of information set-out in Article 8 of Regulation (EU) 2020/852 (Green taxonomy);
• the compliance of products and services with the applicable regulations.

Applicable regulatory provisions and professional guidance

We performed the work described below in accordance with our audit verification programme in application of Articles A. 225-1et seq. of the French Commercial Code, the professional guidance issued by the French Institute of Statutory Auditors (Compagnie Nationale des Commissaires aux Comptes) relating to this engagement and with the international standard ISAE 3000 (revised - Assurance engagements other than audits or reviews of historical financial information).

Independence and quality control

Our independence is defined by Article L. 822-11-3 of the French Commercial Code and French Code of Ethics for Statutory Auditors (Code de déontologie). In addition, we have implemented a system of quality control including documented policies and procedures aimed at ensuring compliance with applicable legal and regulatory requirements, ethical requirements and the professional guidance issued by the French Institute of Statutory Auditors (Compagnie Nationale des Commissaires aux Comptes) relating to this engagement.

Means and resources

Our work engaged the skills of nine people between September 2022 and February 2023 and took a total of twenty-four weeks.

To assist us in conducting our work, we referred to our corporate social responsibility and sustainable development experts. We conducted around thirty interviews with people responsible for preparing the Statement.

This work involved the use of information and communication technologies allowing the work and interviews to be carried out remotely, without hindering the good execution of the verification process.

Nature and scope of procedures

We planned and performed our work taking account of the risk of material misstatement of the Information.

We consider that the procedures conducted in exercising our professional judgement enable us to express a limited assurance conclusion:

• We familiarized ourselves with the activities of all companies in the consolidation scope and the description of the principal risks.
• We assessed the suitability of the Guidelines with respect to their relevance, completeness, reliability, neutrality and clarity, taking into account, where appropriate, best practices within the sector.
• We verified that the Statement covers each category of information stipulated in section III of Article L. 225-102-1 governing social and environmental affairs, respect for human rights and the fight against corruption and tax evasion.We verified that the Statement provides the information required under Article R.225-105 II of the French Commercial Code where relevant with respect to the principal risks, and includes, where applicable, an explanation for the absence of the information required under Article L.225-102-1 III, paragraph 2 of the French Commercial Code.
• We verified that the Statement presents the business model and a description of the principal risks associated with the activities of all the consolidated entities, including where relevant and proportionate, the risks associated with their business relationships, their products or services, as well as their policies, measures and the outcomes thereof, including key performance indicators associated to the principal risks.
• We referred to documentary sources and conducted interviews to:
• • assess the process used to identify and confirm the principal risks as well as the consistency of the outcomes, including the key performance indicators used, with respect to the principal risks and the policies presented; and
  • corroborate the qualitative information (measures and outcomes) that we considered to be the most important - disclosed in Annex 1 - ; for certain risks or information, (human resources, health and safety, human, social and environmental rights, etc.), our work was carried out on the consolidating entity, while for other risks, our work was carried out on the consolidating entity and on a selection of entities.

• We verified that the Statement covers the consolidated scope, i.e. all companies within the consolidation scope in accordance with Article L. 233-16, with the limits specified in the Statement.
• We obtained an understanding of internal control and risk management procedures implemented by the Company and assessed the data collection process aimed at ensuring the completeness and fairness of the Information.
• For the key performance indicators and other quantitative outcomes - disclosed in Annex 1 - that we considered to be the most important, we implemented:
• • analytical procedures that consisted in verifying the correct consolidation of collected data as well as the consistency of changes thereto;
  • substantive tests, on a sample basis and using other selection methods, that consisted in verifying the proper application of definitions and procedures and reconciling data with supporting documents. These procedures were conducted for a selection of contributing entities - disclosed in Annex 2 - and covered between 15% and 23% of the consolidated data selected for these tests

We assessed the overall consistency of the Statement in relation to our knowledge of the entire Company.

The procedures conducted in a limited assurance review are substantially less in scope than those required to issue a reasonable assurance opinion in accordance with the professional guidelines of the French National Institute of Statutory Auditors (Compagnie Nationale des Commissaires aux Comptes); a higher level of assurance would have required us to carry out more extensive procedures.

246 L'ORÉAL - UNIVERSAL REGISTRATION DOCUMENT 2022

Social:

Societal:

248 L'ORÉAL - UNIVERSAL REGISTRATION DOCUMENT 2022