SAP General Terms and Conditions Explained: Key Clauses Every Enterprise Buyer Must Understand

SAP's GTC grants SAP SE (or its designated measurement partner) the right to audit the customer's use of SAP software during business hours with reasonable notice. The standard drafting gives SAP broad discretion on what constitutes "reasonable notice" — in practice, SAP has sent audit notification letters with 30-day windows. The clause typically requires the customer to cooperate fully with the audit process, provide access to systems, and run SAP's measurement tools (USMM, LAW) across the landscape. Critically: the clause does not by default cap the frequency of audits, meaning SAP can audit annually if it chooses. What to negotiate: Minimum 60-day notice, audit frequency cap (no more than once every 24 months), right to use independent measurement tools, and a cap on back-licence claims to a defined lookback period.

The licence grant clause defines what the customer is actually permitted to do with SAP software. SAP licences are granted on a Named User basis (specific identified users) or as Engine/Package licences (based on usage metrics). The critical risk is that the permitted use definition is narrow: access for "internal business purposes" of the contracting entity only. Third-party access — including contractors, consultants, customers, or automated interfaces from non-SAP systems — may constitute indirect access and require separate Digital Access licences. What to negotiate: Explicit carve-outs for specific integration scenarios your business requires, clear definition of what constitutes "internal business purposes" for your group structure, and affiliate licensing provisions if you have subsidiaries.

This is arguably the most commercially dangerous clause in SAP's GTC for enterprises with third-party systems. Indirect access (renamed "Digital Access" in SAP's post-2018 framework) covers the use of SAP software through non-SAP interfaces — for example, a customer portal triggering SAP sales orders, or an IoT platform sending data to SAP. Under the GTC's standard drafting, this use requires either Named User licences for the humans behind the transactions or Digital Access document licences for the nine document types (Purchase Order, Sales Order, Delivery, Invoice, Notification, Material Document, Goods Receipt, Financial Posting, Time Sheet). SAP's audit teams consistently identify undisclosed indirect access as the primary basis for back-licence claims, with the average Indirect Access claim reportedly running into millions. What to negotiate: Explicit written confirmation of which of your integrations are covered under existing licences, Digital Access document type carve-outs for low-volume or legacy integrations, and a cap on indirect access claim scope.

SAP's standard GTC includes provisions that allow SAP to increase maintenance fees in line with contractually defined mechanisms — typically Consumer Price Index (CPI) escalators or fixed annual percentage increases. The standard contract does not cap total maintenance costs over the contract term, and many enterprises discover that their 22% Enterprise Support fee is subject to annual escalation on top of any licence value growth. Some GTC versions also include provisions that allow SAP to adjust pricing following significant changes in the customer's licence estate (e.g., post-M&A). What to negotiate: Fixed maintenance rate for the contract term, explicit CPI cap, protection against maintenance fee increases following M&A events, and a fee freeze during any Extended Maintenance period.

SAP licences are granted to the named contracting entity — not automatically to the corporate group. Many enterprises assume that their SAP licences cover all subsidiaries and affiliates, only to discover during an audit that entities added through M&A, joint ventures, or restructuring are outside the contracted licence scope. The GTC's affiliate provisions are often limited to "majority-owned subsidiaries" at the time of contracting, with new entities requiring licence amendment. What to negotiate: Broad group licensing language that covers affiliates regardless of acquisition timing, explicit definition of "affiliate" that matches your group structure, and auto-inclusion provisions for entities acquired mid-term.

The GTC incorporates SAP's Software Use Rights (SUR) document by reference. The SUR — which SAP updates periodically and unilaterally — defines the specific metrics, permitted use cases, and restrictions for every SAP product. The risk is that SUR updates can change the effective meaning of your existing licence without requiring you to sign anything new. SAP's 2017 Digital Access SUR update, which retroactively reframed indirect access licence requirements, is the most cited example of this risk materialising. What to negotiate: A contractual commitment that the SUR version applicable to your licence is the version in force at the time of signing, with changes applying only to future Order Forms.

SAP's GTC typically includes provisions for SAP to suspend access to cloud services or support if the customer is in material breach — most notably, if maintenance fees are in arrears. For on-premise software, termination rights are more limited, but the clause may allow SAP to terminate the licence agreement in cases of insolvency, change of control, or persistent material breach. For cloud customers, SAP's suspension rights are broader and faster-acting. What to negotiate: Minimum 30-day cure period before any suspension, no suspension for genuinely disputed invoices (where the dispute is raised in writing before the due date), and change-of-control provisions that protect continuity of service.

SAP's standard GTC caps SAP's liability to the customer — typically at the fees paid in the twelve months preceding the claim. This is commercially standard for software vendors but creates an asymmetry: SAP's potential back-licence claim against you is uncapped, while your remedy against SAP for software defects or service failures is limited. The GTC also typically excludes consequential loss, including business interruption or data loss. What to negotiate: Mutual limitation of liability, enhanced liability caps for critical service failures (particularly for cloud products), and business continuity protections for P1 outages.

For SAP cloud products, the GTC incorporates a Data Processing Agreement (DPA) governing how SAP processes personal data on behalf of the customer. SAP uses a global sub-processor network for cloud infrastructure, and the DPA typically requires SAP to notify of sub-processor changes within a short notice period. Under GDPR, the customer bears responsibility for ensuring the DPA is adequate. SAP's standard DPA has been challenged by several European data protection authorities. What to negotiate: Specific sub-processor restrictions for sensitive data categories, enhanced notification windows for sub-processor changes, and contractual guarantees on data residency for EU-regulated entities.

SAP's standard GTC designates German law as governing law, with disputes subject to the courts of Walldorf, Germany (SAP's headquarter jurisdiction). For non-German enterprises, this creates practical complexity in any dispute situation. Some enterprise customers successfully negotiate for governing law to be changed to their home jurisdiction, or for commercial disputes above a certain threshold to be referred to ICC arbitration. What to negotiate: Governing law alignment with your primary operating jurisdiction, arbitration clause for disputes above €1M, and English as the language of proceedings regardless of governing law.