The RISE with SAP contract review checklist.

The RISE with SAP contract is not a single document. It is a stack of interrelated documents that together define the commercial terms, the service description, the operational obligations, the data and privacy provisions, the security framework, and the legal protections that govern the relationship across a typical seven year horizon. The order form contains the headline pricing and the commercial terms specific to the buyer transaction. The master subscription agreement contains the general terms that govern the relationship. The service description contains the operational definition of what SAP delivers. The data processing addendum addresses the privacy framework. The supplemental terms contain additional provisions that vary by product, region, and transaction. The buyer side contract review must address every document in the stack, identify the provisions that create commercial risk or operational constraint, and propose redlines that align the contract with the buyer interest. Across 500 plus engagements, the firm has built a structured review checklist that captures the high impact provisions, the medium impact provisions, and the lower impact provisions that the review must address. The checklist is not a substitute for the buyer specific review that the engagement requires. It is the framework that the review applies to the buyer specific situation, with the buyer specific commercial position, the buyer specific operational profile, and the buyer specific strategic priorities determining the actual redline outcomes.

The order form review framework.

The order form is the document the buyer signs to commit to the RISE engagement. The order form references the master subscription agreement and the supplemental terms as incorporated by reference, but the commercial substance of the transaction lives in the order form. The review must address every numeric field, every defined term, every reference to capacity or volume, and every option that the order form exercises against the broader contractual framework. The review must also address the gaps in the order form, identifying the provisions that should be present and that the standard SAP order form omits.

The pricing fields in the order form require detailed review. The subscription fee for the contract term, the price protection mechanism for the renewal cycles, the FUE allocation by user type, the BTP credit allocation, and any product specific allocations or bundles require examination against the buyer commercial expectations. The pricing review also requires examination of the indexation, the currency provisions, the payment terms, and the discount stacking that the proposed structure embeds. Buyers should verify that the order form pricing aligns to the negotiated commercial position rather than to a default structure that the SAP back office may have populated without explicit alignment to the negotiated terms.

The capacity and volume fields require equal scrutiny. The contracted FUE volume, the contracted BTP capacity, the contracted infrastructure parameters, and any product specific volume commitments must align to the buyer operational profile and growth projection. The review should examine the elasticity provisions, the true up provisions, the over usage charging mechanism, and the under usage credit mechanism if any. The capacity provisions establish the commercial framework for the operational period and require alignment to the operational reality the buyer expects to face.

The master subscription agreement review.

The master subscription agreement contains the general terms that govern the relationship. The review must address the service availability provisions, the SLA framework, the remedies for SLA breach, the limitations on SAP liability, the indemnification provisions, the termination provisions, and the dispute resolution framework. Each provision must be evaluated against the buyer position on commercial risk allocation, operational continuity, and legal protection.

The service availability provisions typically establish a contracted availability percentage measured across defined operational windows, with credits or remedies available for measured periods where the deployment falls below the contracted availability. The review must examine the measurement methodology, the exclusions from the measurement, the threshold for triggering remedies, and the cap on remedies. The provisions in the standard SAP template typically favour SAP in the measurement methodology and the cap structure, and the buyer side review must identify the specific provisions where the alignment requires adjustment.

The limitation of liability provisions cap the SAP financial exposure to the buyer in the event of contractual breach, security incident, or operational failure. The standard limitation typically references a multiple of the annual subscription fee, with the multiple varying across SAP standard templates between one times and two times the annual fee. The buyer side review must evaluate whether the limitation is adequate for the buyer specific risk profile, with consideration of the value at risk in the deployment and the regulatory exposure that a breach or failure may create.

The indemnification provisions allocate the responsibility for third party claims against the buyer and SAP. The standard SAP indemnification typically covers intellectual property claims against the buyer use of the SAP software, with carve outs for specific categories of claim. The buyer side review must verify that the indemnification scope captures the realistic claim categories the buyer faces and that the carve outs do not create gaps in the protection that the buyer expects.

The service description review.

The service description defines what SAP delivers under the RISE contract. The document typically runs to several dozen pages and addresses the SAP managed services scope, the operational responsibilities, the service levels, the exclusions, and the assumptions that the service rests on. The buyer side review must address each element of the service description and identify the provisions that affect the operational experience.

The managed services scope review must verify that the scope captures the operational coverage the buyer expects. The SAP managed services typically include the underlying infrastructure operation, the application platform operation, certain operational tasks, and specified support coverage. The scope typically excludes activities that the buyer assumes the SAP managed services include, such as custom code maintenance, application configuration support, integration platform operation, and business process support. The buyer side review must identify the exclusions and either negotiate scope expansion, accept the exclusions with operational planning, or scope the buyer internal resources to cover the excluded activities.

The service level review must address the specific metrics the contract defines, the measurement methodology for each metric, the remedies for breach, and the operational coordination required to manage the service levels. The standard service levels typically include availability metrics, response time metrics for support cases by severity, and resolution time targets for support cases by severity. The buyer side review must verify that the metrics align to the buyer operational requirements and that the measurement methodology produces results that map to the operational experience.

The service description assumptions deserve specific attention. The document typically contains statements of fact about the buyer environment, the integration topology, the operational coordination, and the change management framework that establish the baseline against which SAP delivers the service. The buyer side review must verify that the assumptions match the buyer actual environment and identify any assumptions that the buyer cannot satisfy or that the operational reality will not match across the contract term. Assumptions that fail in operation typically create grounds for SAP to claim service level relief or scope adjustments that the buyer should not have accepted.

The data processing addendum and privacy framework review.

The data processing addendum addresses the privacy framework for the RISE deployment, including the categories of personal data processed, the processing purposes, the data subject rights provisions, the cross border transfer mechanisms, the data subject request handling, the breach notification provisions, and the sub processor framework. The buyer side review must verify that the addendum aligns to the buyer regulatory framework and operational practice.

The cross border transfer provisions require specific attention in jurisdictions with strong data localisation requirements. The standard RISE deployment involves data processing across multiple SAP entities and across the hyperscaler provider, with the transfer mechanisms typically including standard contractual clauses, adequacy decisions, and other frameworks that authorise the cross border processing under applicable privacy law. The buyer side review must verify that the transfer mechanisms cover the actual data flows that the deployment involves and that the mechanisms remain valid across the contract term in the event that the legal framework evolves.

The sub processor framework defines the third parties that SAP engages to deliver elements of the RISE service. The standard provisions typically include the hyperscaler provider, certain SAP affiliate entities, and other operational service providers. The buyer side review must verify that the sub processor list captures the actual operational arrangements and that the change management for sub processor additions or substitutions provides the buyer with adequate notice, review opportunity, and objection rights if the buyer requires those provisions.

The security framework and operational resilience review.

The security framework defines the controls that SAP implements to protect the RISE deployment and the buyer data within the deployment. The framework typically includes physical security at the hyperscaler facilities, logical security at the platform and application layers, identity and access management, encryption at rest and in transit, vulnerability management, security monitoring, and incident response. The buyer side review must verify that the framework aligns to the buyer security standard and the regulatory security requirements applicable to the deployment.

The security certification provisions document the third party assessments that SAP completes for the RISE service. The certifications typically include ISO 27001, SOC 2, and industry specific certifications where applicable. The buyer side review must verify that the relevant certifications cover the specific service the buyer subscribes to, that the certifications remain current across the contract term, and that the buyer has audit access to the relevant certification reports under appropriate confidentiality provisions.

The operational resilience provisions address the deployment posture against operational disruption including hardware failure, software failure, network failure, security incident, and broader operational events. The provisions typically include redundancy across the hyperscaler infrastructure, backup and recovery capabilities, disaster recovery provisions, and business continuity arrangements. The buyer side review must verify that the resilience provisions match the buyer operational continuity expectations and that the recovery time objectives and recovery point objectives align to the buyer requirements rather than to the SAP standard provisions which may not match the buyer specific risk profile.

The exit, transition, and renewal provisions review.

The exit provisions define the buyer rights and SAP obligations at the conclusion of the contract term. The standard provisions typically include data return or data deletion obligations, transition assistance provisions, and continuity provisions that address the operational handoff. The buyer side review must verify that the exit provisions provide adequate protection for the buyer in the event of non renewal, voluntary termination, or termination for cause. The exit provisions should address the data formats, the data return timeline, the transition assistance scope, and the continuity arrangements that the buyer requires.

The transition assistance provisions deserve particular attention because the value of the assistance is realised only at the conclusion of the contract relationship. The provisions should obligate SAP to provide assistance with the data migration to a successor environment, the operational handoff to a successor service provider, and the knowledge transfer required to support the transition. The provisions should specify the assistance scope, the timeline, the pricing structure if applicable, and the standard of performance that SAP must meet during the transition period.

The renewal provisions affect the commercial posture for the next contract cycle. The standard provisions typically include automatic renewal mechanisms, price escalation provisions, and notice requirements for non renewal. The buyer side review must verify that the renewal mechanism aligns to the buyer preferred posture, that the price escalation framework is consistent with the negotiated commercial position, and that the notice requirements provide the buyer with adequate time to evaluate the renewal decision and negotiate the next cycle commercial terms.

The change of control provisions address the consequences of a change of control involving either party. The provisions affect the buyer position in the event of an acquisition or divestiture transaction that involves the buyer or a buyer affiliate, and affect the operational expectations in the event that SAP undergoes a transaction that affects the deployment. The buyer side review must verify that the provisions accommodate the realistic scenarios the buyer faces and that the provisions do not create commercial or operational exposure that the buyer cannot accept.

The contract is not a formality after the negotiation. The contract is the negotiation, expressed in language that will be litigated word by word if a dispute emerges five years into the relationship.

Conclusion.

The RISE with SAP contract review checklist provides the structured framework that the buyer side review must apply to each transaction. The order form review addresses the commercial substance specific to the buyer transaction. The master subscription agreement review addresses the general terms that govern the relationship. The service description review addresses what SAP delivers operationally. The data processing addendum review addresses the privacy framework. The security framework review addresses the operational protection. The exit, transition, and renewal provisions review addresses the lifecycle posture across the contract term. Each element of the checklist must be applied to the buyer specific situation with the buyer specific commercial position, operational profile, and strategic priorities determining the actual redline outcomes. The review is not a one time exercise. The contract evolves through addenda, amendments, and the operational interpretations that emerge across the relationship lifetime. The buyer side discipline is to maintain the contract review framework as a living document that captures the negotiated position, tracks the variations that the relationship introduces, and produces the redline positions for the renewal cycle when the next negotiation begins. Buyers who execute this discipline avoid the contractual surprises that the standard SAP templates otherwise embed in the multi year relationship and that operational experience reveals only after the fact.