Black Snow IntelligenceBlack Snow Intelligence
Black Snow Report

SAP

Method v1.6As At 2026-08-0818 Surfaces Read1 Offering Assessed

Your own published record, as at 2026-08-08.

Your Details

The Macro Picture17

Red · Adverse
5
of 17 banded observations across 1 offering band Adverse. 1 was never measured.

2 conditional rows (Hosting Locality = EU Access — optional, per-service, chargeable, EEA and Switzerland · Hosting Locality = SAP NS2 — processing confined to US locations and US personnel) sit outside these counts. A Variant is a stated deployment mode, not a published offering, and the Grid Standard holds it to its own band.

What Is Published8

Your Own Words3

If we transfer personal data from a country in the EU or the EEA to a country outside the EEA and for which the EU Commission has not issued an adequacy decision, SAP uses the EU standard contractual clauses to contractually require the data importer to ensure a level of data protection consistent with the one in the EEA to protect your personal data.
Privacy Statement, international transfers. No destination country is named anywhere in the statement, and the Australia section says only that data 'will likely be held and stored by the SAP Group located in another country'. The data-centre overview is a separate hosting map, not a transfer disclosure, and is scored under destination_set_conflict. · Source
SAP will not provide Customer Data to third-party model providers to train their artificial intelligence models and SAP will provide Customer the ability to opt-out of the use of Customer Data by SAP to train artificial intelligence models, except where the model is deployed solely for Customer's use within Customer's Cloud Service tenant.
SAP AI Terms enGLOBAL v.8-2026, clause 4.5 'Training'. The third-party bar is flat and unqualified — a countervailing finding in SAP's favour. SAP's own use is opt-out, not opt-in, and tenant-confined models are carved out of the opt-out entirely. The clause names no screen, form, setting, contact or deadline for exercising the opt-out, and addresses training only, not inference. A separate and wider instrument sits alongside it: the Product Development Schedule enGLOBAL v.3-2021 permits the SAP Group to 'also process Customer Data … for Product Development purposes globally', with clause 1(f) displacing the DPA's own data-processing, non-disclosure and security terms for that processing, and a withdrawal right conditional on SAP having built the functionality ('Where SAP makes such functionality available to Customer (e.g., customer dashboard)'). · Source
processing is by SAP SE, Dietmar-Hopp-Allee 16, Walldorf 69190, Germany if you are in a member state of the EU or the EWR or in any of the countries of Andorra, Faroe Islands, Guernsey, Isle of Man, Jersey, Switzerland, or the United Kingdom or by SAP America Inc., … if you are in any other country
Privacy Statement, 'Who is the responsible SAP Group member'. The group access chain is disclosed at controller level, and SAP additionally publishes its own account of CLOUD Act reach: 'Even companies without a direct U.S. presence may be indirectly affected if they use U.S.-based service providers or rely on U.S. infrastructure' (CLOUD Act — Overview and SAP's Position, v1.0, 15 May 2025). · Source

Parties You Name5

See which of these are assessed in this register

Register Check3

AI Role By Offering1

Assessment Basis

Produced under Method v1.6 from the entity's fact record. 8 of 8 observations were measured under that generation; the rest read Not Measured, which is a fact about this register's coverage and not a finding about the entity.

Read from 18 first-party surface(s) across 1 assessed offering(s), found by the entity's own link graph and sitemap rather than by guessed paths.

Fact Record
Version 1.0, dated 2026-08-08
Standards Commit
1d6dcb2c2a1e
Register Control Quality
Both Views

Verification And Challenge

Every finding on this record is a statement about what could be read on your own published surfaces as at 2026-08-08. Correspondence route as recorded on this card input: ror@blacksnowintel.com.

What A Machine Could Not Establish6

6 questions are open and 2 are established, read as at 2026-08-08 under method v1.6.

The One Thing To Publish First

Publish it: name the AI providers you use.

Red · AdverseAI Providers Named

Ai Provider Region: Not Applicable

Where To Put It

This was read on your own page at https://www.sap.com/about/trust-center/agreements/cloud/cloud-services.html. That is the page a reader already reaches for and does not find it on, so it is the page to correct first.

Where Others Stand

73 organisations in the register name the AI providers they use. You do not.

What A Published Answer Looks Like

Microsoft Corp (Azure OpenAI); Google LLC (model hosting for the optional embedding and reranking model services); Baseten Labs, Inc. (inference services for the same). All three named United States.

A question answered plainly in public, by an organisation read as Strong on it. It is not an endorsement of the position the sentence states — Black Snow reads what is published and never recommends what to practise. Read on a published sub-processor page. Claim tier Quoted. The organisation that published it is not named.

One is named here, and one is deliberate. The rest of the open questions are listed below without a prescription; what to publish for each, in what order, and drafted machine-readable evidence for all of them, is the Deep Dive.

Still Open

Deep Dive

The full assessment, plus consulting on what to fix.

Reviewing your record is free.