SAP clients increasingly worry about AI models' origin, CFO says

SAP CFO: Clients Increasingly Worry About Where AI Models Are Built and Sourced

By Leo Marchandon

Client Concerns Over AI Model Origins and Security

Oct 22 (Reuters) - Customers are increasingly asking where the AI inside their business software was built, SAP's finance chief told Reuters on Thursday, with export controls and Europe's sovereignty debate now shaping decisions once made on price and performance alone.

Technology Governance and Client Requirements

"Could data used by that model be channelled out to end up in places where it shouldn't end up?" Dominik Asam said in the interview, describing a client question SAP regularly hears. It has become an art form to understand companies' precise requirements over technology governance when juggling several AI models, he added.

SAP’s AI Model Strategy

SAP, Europe's most valuable tech company, embeds more than 70 models from various providers into its software that runs accounting and supply chains at many of the world's largest companies, a strategic choice to be agnostic on the market rather than internally build its own models.

Regional Preferences and Security Considerations

But for clients, where the AI comes from matters. A US customer may not accept components developed with Chinese models, while others' back-office work, including SAP's own, can run on open-weight software "from wherever it comes from", Asam said.

Different Needs for Different Clients

"If you're a Department of Defense of a large nation, you will think about that differently as opposed to a mom-and-pop shop."

European Sovereignty and Alternative Solutions

European debate over a possible "kill switch" in US cloud infrastructure has also fed the market for sovereign alternatives, Asam said. SAP has recently signed deals with governments and defence contractors, and prefers access to models from every region, including Europe and Canada, so it can offer a flexible portfolio to such clients, he said.

Security Testing and Vulnerability Management

Asked whether this week's PHP vulnerability disclosures had touched SAP, Asam said the company was using frontier AI models to attack and test its own products before anyone else could do it.

Transparency and Ongoing Security Efforts

"Anyone who says I don't have any vulnerabilities would lie to you," he said, while declining to comment on findings of such screenings.

(Reporting by Leo Marchandon in Gdansk, editing by Milla Nissi-Prussak)