Lonely to the beat of digitalization

My employees came back from the DSAG annual congress in Leipzig with one laughing and one crying eye: an SAP cloud exit strategy seems to be within reach - not voluntarily and not on SAP's initiative, of course, but on the initiative of the EU. There is a passage in the Data Act that is intended to regulate a possible change of cloud provider. There are no sample contracts for this yet; they are not due until September 2025. Whether SAP will now wait and adopt an adaptation of the EU model contracts in the Cloud T&Cs or offer its own version by the fall of next year, SAP did not want to or could not say to my employees in Leipzig. However, the SAP community's wish for a consistent cloud exit strategy has obviously been heard by the EU in Brussels.

I also spoke to our legal advisor about the EU Data Act and he pointed out an interim step and a bridging aid: if you don't want to or can't wait until September 2025, you should take a look at the supplementary contractual terms for cloud services (EVB-IT Cloud AG) from the digital association Bitkom in Germany.

The following helpful definition in Bitkom's EVB-IT-Cloud model contract is also interesting: "In the public cloud, resources are provided for a large number of unspecified customers, whereas in a private cloud, a cloud solution is offered specifically for one customer. However, there are also various other models, such as the hybrid cloud. The EVB-IT covers the public cloud as standard. No. 1 of the criteria catalog provides for all other cloud models to refer to an annex in order to determine in more detail which type of cloud is the subject of the contract."

In the coming months, our DSAG, the SAP community and SAP itself will still have a lot of legal work to do. The R/3 black box has grown into an ERP universe that requires far more rules, terms and conditions and regulations than ever before. Some things will be solved with the EU Data Act, others are already mentioned in the SAP Rise contracts, but remain largely unclear: the compliance topic of DPA (Data Processing Agreement) in Rise and Grow with SAP is still a mystery to me, including many cross-references.

As part of the AI discourse, our Group legal advisor pointed out to me the rights and wrongs of training data and prompts for generative AI. In the SAP community, we have been working on the topic of anonymizing data for test applications for several years now. Professor Hasso Plattner has also been researching this at HPI and his students presented a solution. The provision of anonymized data is particularly important for automated testing. Training data for large-language models is just as popular as test data, but even more complex in terms of clean compliance.

Ultimately, every existing SAP customer should be aware that signing a Rise contract will be a lonely journey, because there is not one contract for the S/4 cloud conversion, but ultimately many contracts to be orchestrated, which always remain dependent on the individual starting position. Even the contract for decommissioning the legacy systems can become a stumbling block if the goal of the Rise contract is not achieved in time. The pace of Rise digitization must therefore be set individually by the existing customer. SAP remains a service provider here, trying to realize the highest possible contribution margin.