
Financial Statements for January 1 - December 31, 2025
____________________________________________________________________________________________________________________________________________
GomSpace A/S
Description Impact Mitigation Risk assessment 2025
6. Risks relating to suppliers
The Group’s ability to deliver in
accordance with market demand
and contractual commitments
depends on obtaining a timely and
adequate supply of materials and
components.
If this risk materialises, the Group
may experience delayed revenue,
increased cost of goods sold, and
higher inventory levels. In
addition, higher reliance on
external suppliers increases the
risk of quality issues on outsourced
products, which can disrupt
production schedules and require
rework or replacement.
The Group seeks to avoid single-
source supplier solutions where
possible, although this is not always
feasible. Key components are
procured in advance to reduce
production delays. Importantly,
GomSpace-designed inventory
continues to be produced internally,
reducing reliance on external parties
for critical items. Longer-term
forecasting has been implemented,
and advance payment arrangements
with customers support earlier
procurement of components.
The Group’s mitigation measures remain effective;
however, the significant increase in activity during the
year has resulted in greater exposure to third-party
suppliers. While internal production of GomSpace-
designed items reduces part of the risk, the higher
activity level increases the likelihood of quality issues or
mistakes occurring at outsourced suppliers. As a result,
the overall level of risk has increased compared to the
prior year.
Description Impact Mitigation Risk assessment 2025
7. Risk related to non-recurring
engineering in project execution
The Group’s ability to execute
customer-specific and product
development projects in accordance
with planned scope, cost, and
timelines is critical to achieving
expected financial performance.
If projects are not executed as
planned, this may result in delayed
revenue, increased cost of goods
sold, delayed customer payments,
and increased investment costs.
Project progress is monitored and
evaluated against approved budgets
and schedules. Forecasting processes
are used to assess cost-to-complete,
cash flow implications, and the
potential impact on the Group’s
ability to meet financial targets.
In 2025, fewer projects were delayed or experienced
cost overruns compared to earlier periods, reflecting
improved project governance and monitoring. The
overall customer demand has increased, strengthened
internal controls and improved project execution have
slightly reduced the probability of significant deviations
within NRE projects. However, as a substantial portion
of the Group’s revenue continues to be derived from
customer-specific work, the risk remains significant. If it
materialises, it could still have a notable impact on the
Group’s financial performance.
Description Impact Mitigation Risk assessment 2025
8. IT Security
The Groups operations rely on
secure and reliable IT systems
across multiple locations. A
significant breach or outage could
compromise proprietary and
customer information, harm
reputation, disrupt project
execution, and lead to contractual,
financial, and regulatory
consequences.
Cyber incidents may trigger
legal/regulatory exposure,
reputational harm, loss of
customer trust, and delays in
delivery. Supply-chain and
outsourced-service failures can
escalate impact by affecting
availability, integrity, or
confidentiality of information and
services.
The Group operates with a
low/minimal appetite for
cybersecurity risk and therefore
enforces strict tolerances across
identity and access management,
data protection, supplier and cloud
assurance, incident response, and
business continuity. The Group has
established all foundational
safeguards – including a IS2-aligned
policy framework, strengthened
governance of privileged access,
robust technical controls, and
organisation-wide cybersecurity
awareness – and continues to
mature these in line with ISO 27001
requirements. Our priority is
maintaining a resilient, well-
governed control environment that
ensures ybersecurity risk remains
consistently within the Board-
approved tolerance level.
The Group has further strengthened its cybersecurity
posture through outsourced monitoring services and the
implementation of Managed Detection and Response
(MDR) capabilities, providing faster detection and
response to potential threats. These enhancements,
combined with the continued maturation of ontrols,
have improved the overall risk position compared to the
prior year. While cyber threats remain structurally high,
the strengthened monitoring setup and external support
mean that the likelihood of a significant incident has
decreased, and the overall level of risk is therefore
assessed as lower than the prior ear.
Management’s review (continued)
12