HSHHSH Health Technology Supplier Hub
Home › Suppliers › SAP › Risk

SAP: risk summary

Summaries are drawn from public sources and link to them. HSH does not give a risk rating: read the summary and sources and reach your own view. Unproven allegations are labelled as such. Suppliers can submit a response, which is shown alongside.

Financial

Latest full-year results from official filings.

FY2025 revenue €36.80bn (+8.0%); operating margin 26.7%; net income €7.49bn.

Net liquidity (net cash) €3.38bn.

Researched 8 Nov 2026

Adverse media

Credible news about incidents, disputes, legal action or restructuring in the last 24 months.

Sep 2025: the European Commission opened an antitrust probe into SAP's ERP maintenance and support practices. In Jul 2026 it made SAP's commitments (e.g. more flexible maintenance terms) binding for 10 years, without finding an infringement; SAP maintains its practices complied.

Researched 10 Nov 2026

Cyber & information governance

Data breaches, cyber incidents, regulator action and assurance status.

Apr 2025: SAP disclosed CVE-2025-31324, a maximum-severity (CVSS 10) flaw in NetWeaver Visual Composer that was actively exploited in the wild; customers were urged to patch or disable the component urgently. NHS DSPT status not yet checked.

Researched 10 Nov 2026

Regulatory & clinical safety

Recalls, safety notices, regulator action and clinical safety concerns.

ERP and business software supplier; no regulatory or clinical safety actions found in the last 24 months.

Researched 10 Nov 2026

Contract performance

Contract delivery, go-lives, terminations and disputes.

Dec 2025: Dorset Council said it would replace its heavily customised SAP ECC6 system, described in its business case as no longer fit for purpose, with Oracle Fusion in a programme costing about £14.2m over three years.

Researched 10 Nov 2026