Metroselskabet I/S

Denmark · owned by City of Copenhagen and the Danish State (via the Ministry of Transport) (Denmark) · metroselskabet.dk · 26 vendors

Metroselskabet is a Danish public transport, development, and construction company responsible for operating and expanding the Copenhagen Metro network. It oversees four metro lines carrying approximately 135 million passengers annually, running 24/7 with trains departing as frequently as every 95 seconds during peak hours. The company also serves as an experienced developer of major infrastructure projects, including the construction of the Cityringen (M3), the M4 Sydhavn/Valby extension, and the Hovedstadens Letbane (Capital Region Light Rail).

Resilience scores

Technology vendors

Insights

Last updated 2026-09-13 · revision 12

26 direct vendors, 334 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 2/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Metroselskabet's migration readiness is assessed as low, primarily due to the highly specialized and deeply integrated nature of its core operational technology stack and a complex regulatory environment. The "ATC, ATS, ATO, ATP" systems, along with the ongoing "CBTC" implementation, are critical, real-time control systems for a fully automated, driverless metro. These systems are typically proprietary, vendor-specific, and tightly coupled with physical infrastructure, making them extremely challenging, if not impossible, to migrate to generic cloud platforms or refactor into cloud-native architectures (containerization, microservices are not mentioned for these core systems). The regulatory landscape further complicates migration efforts. As a Danish public entity operating critical infrastructure, Metroselskabet is subject to stringent "GDPR" and "NIS2" directives. "NIS2" in particular, classifies them as an Essential Entity, imposing strict cybersecurity and incident reporting requirements that would heavily influence any cloud migration strategy, potentially requiring specific certifications or data localization within the EU/EEA, as highlighted by "Data Residency Requirements." This significantly limits flexibility in choosing cloud providers and deployment regions. While the company demonstrates financial stability with strong passenger growth, which could fund migration, and uses modern frameworks for its public-facing website (Next.js, Umbraco), these do not offset the challenges posed by the core operational systems. "Vendor Lock-in Risk" is explicitly "Unknown," but for highly specialized transport systems, significant lock-in with a few key technology providers is highly probable, which would add substantial complexity and cost to any migration away from current solutions. The lack of explicit mention of cloud-native architectures for core systems further indicates a traditional deployment model for critical infrastructure. Therefore, given the inherent difficulty in migrating highly specialized critical infrastructure control systems, coupled with strict regulatory and data residency constraints and likely vendor lock-in for core technologies, the migration readiness score is assessed as 15.

Compliance

4 in-scope frameworks identified; showing 3.

GDPR (source) — Compliant

GDPR is applicable as the company is headquartered in Denmark (EU) and processes extensive personal data including passenger data, employee data, customer service data, video surveillance, and neighbor communications. The company has implemented comprehensive privacy policies, appointed a DPO, and established proper data processing procedures. Risk is Medium due to the high volume of personal data processing and potential for significant fines (up to 4% of annual turnover), but the company shows evidence of compliance measures.

Evidence: https://metroselskabet.dk/da/politikker-og-erklaeringer/privatlivs-og-persondatapolitik/

ISO 27001 (source) — Assessment Required

ISO 27001 is highly recommended for organizations processing significant personal data and operating critical infrastructure. Given Metroselskabet's role in critical transport infrastructure, extensive data processing, and cybersecurity requirements under NIS2, ISO 27001 certification would demonstrate information security management maturity. Risk is Medium as lack of certification could indicate security gaps and affect stakeholder confidence, though it's not legally required.

NIS2 (source) — Assessment Required

NIS2 is highly likely applicable as Metroselskabet operates critical transport infrastructure in the EU (Copenhagen Metro system with 135M annual passengers). Transport sector entities are classified as Essential Entities under NIS2. The company clearly exceeds size thresholds with significant operations and revenue. Non-compliance could result in severe penalties including fines up to €10M or 2% of annual turnover, plus potential operational restrictions. High risk due to critical infrastructure status and enforcement focus on transport sector.

Evidence: https://metroselskabet.dk/da/om-os/om-metroselskabet/

Financials

Three-year financials

Financial Resilience Score: 9/10

Metroselskabet I/S demonstrates very high financial resilience despite reporting structurally negative equity and recurring net losses. The company is jointly owned by the Danish State (~41.7%), the City of Copenhagen (~50%), and the City of Frederiksberg (~8.3%), and benefits from sovereign-backed financing through Danish State re-lending (genudlån) at low rates with implicit/explicit guarantees. This effectively gives the company sovereign-quality credit, eliminating refinancing risk in a way that would be impossible for a typical commercial entity. The negative equity position (multi-billion DKK) is by design under the legislated financial model: heavy upfront debt to build metro infrastructure is repaid over 40–50+ years through fare revenue, owner operating contributions, and property value capture via By & Havn. The economic model is therefore measured against a long-term budget (langtidsbudget) rather than annual profitability. Operating EBIT has trended from negative toward break-even as ridership has recovered post-COVID (130+ million passengers by 2023) and as Cityringen (M3), Nordhavn (M4), and the Sydhavn extension have come into service. Resilience was stress-tested during the COVID-19 ridership collapse, which the company absorbed with no solvency concern. Its monopoly position as the sole metro operator in Copenhagen and the absence of meaningful counterparty risk on the owner side further reinforce its stability. Key risks remain interest rate exposure on the large debt stock (~DKK 25–27 billion), ridership undershooting plan, construction cost overruns on extensions, and political risk on fare regulation.

Key strengths: Sovereign-backed financing via Danish State re-lending (genudlån), Public ownership by Danish State and two municipalities — essentially zero counterparty risk, Monopoly position as sole operator of Copenhagen metro infrastructure, Long-term 40–50+ year economic model absorbs short-term variability, Survived COVID-19 ridership collapse without solvency concern, Growing revenue base from line expansions (M3 Cityringen, M4 Nordhavn, M4 Sydhavn)

Risk factors: Interest rate exposure on large long-term debt stock (~DKK 25–27 billion), Ridership undershooting long-term plan, Construction cost overruns on extensions, Political risk on fare regulation, Structurally negative equity position, High supplier concentration on Metro Service A/S and Hitachi Rail, 100% geographic concentration in Copenhagen/Frederiksberg area

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report