Metro Service A/S

Denmark · www.metroservice.dk · 16 vendors

Resilience scores

Technology vendors

Services catalogue

2 services in catalogue across 2 categories; runs on 16 sub-vendors.

Insights

Last updated 2026-09-13 · revision 2

16 direct vendors, 288 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 4/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Metro Service A/S faces significant challenges in migration readiness due to the highly specialized and deeply integrated nature of its core operational technologies such as "Driverless Metro Operations (Automatic Train Operation – ATO)," "Control Room Management Systems (SCADA / Operations Control Centre)," and "Rolling Stock Maintenance Systems." These systems are likely monolithic and on-premise, with no indication of cloud-native architecture, containerization, or microservices, making a direct migration complex and costly. The regulatory environment for critical public transport infrastructure is typically stringent, and data residency requirements are not specified but could impose further constraints. Financial stability (ability to fund migration) is unknown. The vendor lock-in risk is unknown, but given the 18 services and the specialized nature of the operations, there is a potential for high lock-in if these services are provided by a limited number of vendors. The internal tech stack includes more standard platforms like "SAP SuccessFactors," "Google Tag Manager," "Google Analytics," and "Umbraco CMS," which are generally more amenable to cloud migration or are already cloud-based. However, the core business systems present substantial migration hurdles due to their specialized, likely legacy, and integrated nature, combined with several critical unknowns.

Compliance

10 in-scope frameworks identified; showing 3.

Danish Railway Safety Regulation — Compliant

Metro Service A/S holds both a Safety Approval (Sikkerhedsgodkendelse) and a Safety Certificate (Sikkerhedscertifikat) from Trafikstyrelsen (the Danish Transport Authority), both valid through 2026. These are mandatory regulatory approvals for railway operators in Denmark, implementing EU Railway Safety Directive requirements. Risk is Low because current valid certifications are confirmed with documentary evidence publicly available on the company's website.

Evidence: https://www.metroservice.dk/om-os/sikkerhed-og-certifikater/, https://www.metroservice.dk/media/2apefmrv/sikkerhedsgodkendelse-2026.pdf, https://www.metroservice.dk/media/3hbbn4nx/sikkerhedscertifikat-2026.pdf, https://www.trafikstyrelsen.dk

GDPR (source) — Compliant

Metro Service A/S is headquartered in Denmark (EU) and processes substantial personal data including passenger CCTV footage, employee records, job applicant data, and commercial partner data. GDPR is unambiguously applicable. Risk is assessed as Medium rather than High because the company has demonstrably implemented compliance measures: a published privacy policy referencing GDPR legal bases (Art. 6.1.b, 6.1.c, 6.1.f), a formally appointed DPO (dpo@metroservice.dk), documented data retention schedules, and data subject rights procedures. The Danish Data Protection Authority (Datatilsynet) actively enforces GDPR, and the company's scale (370,000 daily passengers, CCTV across all stations and trains) means any lapse could attract regulatory scrutiny. Residual risk remains due to the volume and sensitivity of data processed (CCTV, employee data, incident/insurance records) and the fact that the privacy policy was last updated in August 2021, potentially not reflecting all subsequent regulatory guidance.

Evidence: https://www.metroservice.dk/juridiske-dokumenter/privatlivspolitik/, https://www.metroservice.dk/en/juridiske-dokumenter/privacy-policy/, https://www.datatilsynet.dk, https://www.metroservice.dk/om-os/sikkerhed-og-certifikater/

ISO 9001 — Compliant

Metro Service A/S holds a current ISO 9001 certification (issued 2024-04-16), publicly available on their website. This demonstrates third-party audited quality management system compliance. Risk is Low due to confirmed active certification with documentary evidence.

Evidence: https://www.metroservice.dk/om-os/sikkerhed-og-certifikater/, https://www.metroservice.dk/media/puojo1pl/certificate-fc-9001-17127-1-uk-metro-service-a-s-2024-04-16.pdf

Financials

Three-year financials

Financial Resilience Score: 7/10

Metro Service A/S benefits from a highly predictable, contract-based revenue model with long-duration operations and maintenance contracts for the Copenhagen Metro, and from 2025 also the Hovedstadens Letbane light rail. Its customers are public-sector entities (Metroselskabet I/S and Hovedstadens Letbane I/S), both jointly owned by the Danish state and municipalities, resulting in very low counterparty credit risk. The company has a 25-year operational track record with high passenger satisfaction (95% in 2025) and strong backing from industrial parents Hitachi Rail STS and ATM Milano. However, resilience is constrained by extreme customer concentration—essentially two contracts—and by periodic retendering under EU public procurement rules, which creates renewal risk. Fixed-price O&M contracts also expose the company to wage and energy cost inflation unless indexation clauses are robust, and KPI-linked bonus/malus mechanisms create operational penalty risk. As a service company owned by industrial parents, it likely does not hold large cash buffers, limiting financial flexibility. Overall, the stable public-sector revenue and expanding contract scope support a moderately strong resilience profile.

Key strengths: Long-duration O&M contracts with public-sector counterparties, Very low customer credit risk (state/municipality-owned clients), 25-year operational track record with 95% passenger satisfaction, Contract expansion in 2025 with Hovedstadens Letbane light rail, Strong industrial parent backing (Hitachi Rail STS and ATM Milano), Predictable, contracted revenue and cash flow

Risk factors: Extreme customer concentration on two contracts, Contract renewal/retendering risk under EU procurement rules, Cost inflation risk on fixed-price contracts (wages, energy), KPI-linked bonus/malus penalty exposure, Limited financial flexibility as service company owned by industrial parents, 100% geographic concentration in Denmark

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report