Compliance offerings from SAP

SAP’s Joule Agents operate under uniquely provisioned identities within existing enterprise controls, with a full audit trail recording of those who acted, their authorization scope, and actions taken. Agents are assessed against the EU AI Act’s risk classification framework on a feature-by-feature bases, including high-risk findings in SAP SuccessFactors employment functions.

Due to its neutrality, scope, compactness, and testability, C5 has proven itself as an attestation for a stable foundation for internal auditing and for information security management in regulated industries.

NIS2 is the most recent EU directive aimed and harmonizing and improving its cybersecurity framework for critical infrastructure (CI) providers. In addition to being a registered CI provider, SAP also supports CI providers in many countries’ compliance with their respective cybersecurity regulations. SAP is a registered CI provider in Germany (KRITIS), subject to German jurisdiction. We are monitoring Germany’s adoption of its draft NIS2 law and will provide further updates as matters evolve.

SAP has been officially designated by the European Supervisory Authorities (ESAs) as a Critical ICT Third-Party Service Provider (CTPP) on the 17th of November 2025. This designation recognizes SAP’s essential role in supporting the digital infrastructure of the financial sector. As a CTPP, SAP is subject to direct oversight by the ESAs, ensuring enhanced operational resilience and risk management. For our financial services customers, this designation reinforces transparency and trust, demonstrating that SAP meets the highest standards of security and continuity in delivering ICT services to the financial industry.

Endorsed by the European Data Protection Board and approved by the Belgian Data Protection Authority, the EU Cloud Code of Conduct allows cloud service providers to demonstrate adherence to Article 28 of the GDPR and related articles.

The Data Act (effective September 12, 2025) is designed to enhance the EU’s data economy and foster a competitive data market by making data more accessible and usable, encouraging data-driven innovation and increasing data availability. The law applies in the 27 EU member states and offers cloud customers of data processing services the right to switch providers within a defined notice period.

The EU AI Act is a comprehensive new law designed to address potential risks to health, safety, and fundamental rights from the development and use of artificial intelligence technologies.

Developed by the Federal Office for Information Security (BSI), IT-Grundschutz is a methodology for information security management systems that considers technical, organizational, infrastructural, and personnel aspects equally. Our information security network covers the secure operation of the building infrastructure of SAP-owned data centers (in St. Leon-Rot and Walldorf), which serve as bases for implementing and maintaining redundant services and IT infrastructures in Germany. The German Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik - BSI) gave authorization to use (Einsatzerlaubnis) for OpenStack Barbican SCI. VS-NfD (Verschlusssache – nur für den Dienstgebrauch) is a data classification from German public sector and high-security branches according to the BSI Secrecy handbook (Geheimschutzhandbuch).

HDS (Hébergement de Données de Santé) is a certification for service providers that host personal health data of French citizens. It was established under the French Healthcare Modernization Act (Law No. 2016-41). SAP’s information security management systems, select cloud regions, and select SAP office locations hold certificates for HDS 817871 and HDS 754140.

The National Security Framework is made up of the basic principles and minimum requirements necessary for the adequate protection of the information processed and the services provided by an organization. ENS compliance helps ensure access, confidentiality, integrity, traceability, authenticity, availability and conservation of data and services processed by electronic means.

Cyber Essentials is a UK government-backed cybersecurity certification program that helps organizations protect themselves against common cyber threats. Certification is available at two levels:

1. Cyber Essentials (Level One) is a self-assessment where organizations complete a questionnaire, which is then reviewed by an independent certification body.
2. Cyber Essentials Plus (Level Two) is a technical audit of scoped IT systems by an independent certification body.