Metroselskabet I/S

Denmark · owned by City of Copenhagen and Municipality of Frederiksberg (jointly owned public entity) (Denmark) · m.dk · 29 vendors

Metroselskabet is a Danish public transport company responsible for operating and developing the Copenhagen Metro, serving approximately 135 million passengers annually across four metro lines (M1–M4). The company also constructs and manages major urban rail infrastructure projects, including the Cityringen circular line, the M4 Harbour Line, and the Hovedstadens Letbane light rail. It operates 24/7, 365 days a year, with trains running at intervals as short as 95 seconds during peak hours.

Resilience scores

Technology vendors

Insights

Last updated 2026-09-15 · revision 28

29 direct vendors, 350 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 4/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Metroselskabet I/S demonstrates a medium level of migration readiness, leaning towards the lower end, primarily due to the inherent complexity of its core operational technology (OT) systems and stringent data residency requirements, despite a modern customer-facing IT stack and strong financial backing. **Strengths:** * **Modern Customer-Facing IT:** The adoption of Next.js, Umbraco Cloud CMS (euwest01.umbraco.io), and native mobile app development (Swift/Kotlin) for its web and mobile platforms indicates a modern, cloud-aware approach for these segments. These components would be relatively easier to migrate, re-platform, or refactor for cloud-native environments. * **Strong Financial Position:** Consistent revenue growth (DKK 1.61B in 2024 to DKK 1.82B in 2025) and gross profit (DKK 1.91B in 2023) provide the financial capacity to invest in significant and complex migration initiatives, which are often costly. **Weaknesses/Challenges:** * **Highly Specialized Operational Technology (OT) Stack:** The core of Metroselskabet's operations relies on highly specialized, deeply integrated, and likely proprietary systems such as SCADA, Automated Train Control Systems (ATC), Communications-Based Train Control (CBTC), and Driverless Train Operation (DTO). Migrating these critical infrastructure components would be extremely complex, costly, and carry high operational risk. Such systems are typically not easily moved to generic cloud platforms and often require extensive re-engineering, vendor-specific solutions, or a hybrid approach with on-premise components. * **Strict Data Residency and Sovereignty Requirements:** The regulatory environment imposes significant constraints on data migration: * **GDPR Chapter V:** Mandates EU/EEA processing by default, requiring specific safeguards (e.g., SCCs, DPF) for any international data transfers. * **CPR Register Data:** Access to the Danish Central Person Register (CPR) for neighbour notifications is subject to strict Danish law, requiring processing within Danish/EU systems. * **NIS2 Security Requirements:** While not explicit data localization, the security requirements for critical OT systems effectively necessitate secure, auditable environments, in practice, within Denmark or the EU. * **Public Sector Data Sovereignty:** As a publicly owned entity, Danish government guidelines recommend prioritizing EU-based cloud solutions. These combined requirements severely limit cloud provider options and increase the complexity and cost of any cloud migration, particularly for sensitive data. * **Regulatory Compliance Overhead during Migration:** * **NIS2 Directive:** Any migration involving critical systems would need to strictly adhere to NIS2's stringent risk management and security measures, adding significant planning, implementation, and audit overhead. This could slow down or complicate cloud adoption for OT systems. * **GDPR:** Requires careful data mapping, impact assessments, and compliant data processing agreements for any personal data moved or re-architected during migration. * **Vendor Lock-in for OT Systems:** While the overall vendor geographic diversity is good (9 unique countries for HQ, assuming the

Compliance

9 in-scope frameworks identified; showing 3.

GDPR (source) — Partially Compliant

Metroselskabet is established in Denmark (an EU member state) and processes the personal data of individuals in the EU, making it directly subject to the GDPR.

The company processes personal data of employees, customers (e.g., for control fees), and residents near construction sites. A data breach could lead to significant fines and reputational damage.

Evidence: https://metroselskabet.dk/en/policies-and-declarations/privacy-and-personal-data-policy/, https://m.dk/da/politikker-og-erklaeringer/privatlivs-og-persondatapolitik/

NIS2 (source) — Assessment Required

Metroselskabet operates in the transport sector, which is classified as an essential entity under the Danish implementation of the NIS2 Directive. The Danish Transport Authority (Trafikstyrelsen) is the designated competent authority.

As critical infrastructure, a significant cybersecurity incident could cause major disruption to Copenhagen's transport system. The transport sector is a known target for cyberattacks. Non-compliance can lead to substantial fines.

Evidence: https://doratms.com/en/knowledge/nis2-direktiv-transport/, https://www.trafikstyrelsen.dk/nis2, https://nis2directive.eu/transport/, https://www.metroservice.dk/media/qleoqsu2/metroservice_csr-rapport2023_uk_k9.pdf

EU Passenger Rights in Rail Transport — Assessment Required

As a public transport provider, Metroselskabet is subject to regulations concerning passenger rights, although the direct applicability of the EU's main rail passenger rights regulation to urban metro systems can vary.

While major disruptions are infrequent, failure to adhere to passenger rights regulations could lead to customer dissatisfaction and potential claims. The risk is low due to the high reliability of the service.

Evidence: https://metroselskabet.dk/en/contact-and-press/contact-us/, https://www.burohappold.com/news/denmark-sets-stricter-co2-emissions-rules-for-construction-what-you-need-to-know/, https://www.rejsekort.dk/-/media/dms/flr/2022/Joint-National-Travel-Regulations-01122022.ashx, https://metroselskabet.dk/en/, https://lawthek.eu/detail/3c2da055-0986-44d5-9d8a-aedbc73c3421/en/SINGLE, https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2004:220:0016:0039:EN:PDF

Financials

Three-year financials

Financial Resilience Score: 9/10

Metroselskabet I/S enjoys exceptionally strong financial resilience due to its unique ownership structure. The Danish State, City of Copenhagen, and Frederiksberg Municipality are directly, unconditionally, and jointly and severally liable for all of the company's obligations, giving it implicit AAA/Aaa credit standing and access to borrowing via Danmarks Nationalbank on government terms. In 2025, owners contributed DKK 1,843M of new equity in connection with the M4 Ydre Nordhavn financing, with an additional ~DKK 11B expected upon M5 construction act approval in 2026. Operationally, the company achieved a record 135 million passengers in 2025 (+7% YoY) with best-in-class 99.3% punctuality and NPS of +66. Fare revenue grew 13.3% to DKK 1,822M and EBITDA rose 38.9% to DKK 338M. Approximately 80% of expected maximum net debt is hedged with fixed-rate or inflation-linked swaps, providing budget certainty. Adjusted interest coverage stood at 1.20 in 2025. However, the company carries a very large and long-lived debt burden, with net debt expected to peak at ~DKK 46.9B in 2039 and full repayment now pushed out to 2074. Recurring impairment charges (DKK 1.77B in 2025, DKK 3-4B expected in 2026) reflect the capital-intensive expansion program. Sensitivity to passenger volumes and interest rates is significant, but the sovereign backing effectively eliminates default risk.

Key strengths: Sovereign backing from Danish State, Copenhagen and Frederiksberg municipalities with joint and several liability, Access to borrowing via Danmarks Nationalbank on government terms (implicit AAA/Aaa), Record 135M passengers in 2025 (+7% YoY) with 99.3% punctuality, DKK 1,843M new equity contributions from owners in 2025, ~80% of expected maximum net debt hedged with fixed-rate/inflation-linked swaps, Fare revenue growth of 13.3% to DKK 1,822M in 2025, EBITDA growth of 38.9% to DKK 338M in 2025, Adjusted interest coverage of 1.20 in 2025

Risk factors: Very large debt burden peaking at ~DKK 46.9B in 2039 with repayment extended to 2074, Recurring impairment write-downs (DKK 1.77B in 2025; DKK 3-4B expected in 2026), High sensitivity to passenger volumes (10% shortfall delays debt repayment by 24 years), Interest rate sensitivity (1% higher discount rate delays repayment by 11 years), Ongoing CMT arbitration on DKK 2.9B claim (rejoinder due March 2026), Airport passenger growth below expectations due to taxi competition, Cyber and physical-security risks flagged as top-priority external threats, Volatile net profit driven by non-cash market value adjustments on interest-rate hedges

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report