SAP customers scrutinise AImodels over security risks

SAP customers are increasingly asking where the artificial intelligence (AI) models used in their business software come from, as geopolitical tensions and Europe’s push for technological independence influence corporate technology decisions.

Dominik Asam, chief financial officer of German software company SAP,told Reuters on October 22 that customers want to know whether data processed by AI models could be transferred to locations where it should
not be accessed.

The growing concern highlights how businesses are looking beyond AI performance and cost to consider data security, technology governance and the origin of the models they use.

SAP integrates more than 70 AI models from different providers into its enterprise software, which supports business operations such as accounting and supply-chain management. Instead of relying entirely on its own AI technology, the company follows a model-agnostic approach, allowing it to select models from multiple providers.

However, customer preferences vary across markets and applications. Asam said some US customers may reject components developed using Chinese AI models, while other organisations are comfortable using open- weight models from different origins for less sensitive tasks.

These concerns are particularly important for government agencies, defence organisations and businesses that handle confidential information. Such organisations must consider where their data is processed, who can access it and what safeguards are in place to protect it.

Europe’s push for technological sovereignty has added urgency to the debate. Governments and businesses are exploring ways to reduce their dependence on overseas technology providers and maintain greater control over critical digital systems. Asam said SAP wants access to AI models from multiple regions, including Europe and Canada, to meet
different customer requirements.

Businesses are also assessing their dependence on foreign cloud
infrastructure and the risk that geopolitical disputes could disrupt access to essential technology. As a result, choosing an AI model increasingly involves evaluating not only the model itself but also its provider, hosting arrangements and data-handling policies.

SAP’s multi-model strategy gives customers greater flexibility, but the origin
of an AI model alone does not determine whether it is secure. Data protection also depends on how the model is deployed, access controls, contractual safeguards and compliance with relevant regulations.

As AI becomes more deeply integrated into finance, supply chains and other core business operations, companies must balance productivity gains with data protection and long-term control over their technology.

For enterprise software providers such as SAP, the challenge is no longer just delivering capable AI tools. They must also address customers’growing demands for security, transparency and control over where their data is processed.