Vendor concentration risk in RISE.

A RISE with SAP arrangement consolidates a remarkable amount of operational dependency into a single supplier relationship, and the concentration is greater than many buyers initially appreciate. The application, the hosting, the operational support, the upgrade path, the integration runtime, and increasingly the analytics layer all flow from the same commercial counterparty, with the hyperscaler tucked underneath as a subcontractor that the buyer typically does not contract with directly. Vendor concentration risk is the term for the cumulative exposure this structure produces. It is not, by itself, an argument against RISE, but it is an exposure the buyer side must measure, mitigate inside the contract, and report into the enterprise risk framework with the seriousness it deserves. This article works through the concentration profile, the failure modes it produces, the contract mechanisms that materially reduce the exposure, the governance structure that keeps the concentration visible, and the limits of what mitigation can realistically achieve.

01.The layered concentration profile of a RISE arrangement

RISE bundles together six things that, in a traditional licensing model, were often supplied by different parties. The application software comes from SAP. The hosting capacity comes from a hyperscaler that SAP contracts with on the buyer's behalf. The operational managed service comes from SAP. The upgrade execution comes from SAP. The integration runtime, in many configurations, is provisioned by SAP under the same agreement. The analytics layer, where SAP Datasphere or SAP Analytics Cloud is in scope, also runs inside the same commercial frame.

From a procurement perspective, the buyer has signed a single contract that covers a stack the buyer used to govern through three or four separate agreements. The simplification is genuine. So is the concentration. If the relationship deteriorates for any reason, ranging from commercial dispute to performance failure to regulatory intervention to a corporate event on either side, the buyer's exposure now sits inside one counterparty rather than diversified across several.

The concentration is not only contractual. It is also operational. A buyer side technology team that runs RISE develops deep familiarity with SAP managed service processes, ticketing structures, escalation chains, and change windows. That familiarity does not transfer cleanly to another model. The team becomes, in effect, a single vendor team, even though its members are the buyer's employees. The point is not that this is wrong, but that it amplifies the concentration the contract has already established.

02.The failure modes the concentration produces

A buyer side risk register for RISE should identify the specific failure modes that concentration produces, because generic statements about vendor risk do not generate useful mitigation. There are five failure modes worth naming explicitly, and each has a different shape and a different mitigation pathway.

The first is commercial leverage at renewal. The supplier knows that the buyer has invested years of operational adaptation, has retired the previous estate, and has limited alternatives within the renewal window. The leverage shows up as a price proposal that assumes lock in. The buyer who has not prepared substantive alternatives discovers, late, that the renewal economics are different from the original.

The second is performance degradation without effective remedy. The service credits embedded in RISE are typically modest relative to the operational impact of an outage. A buyer that experiences extended degradation finds that the contractual remedy does not approach the actual business loss, and the operational dependency on the same supplier limits the practical leverage available outside the contract.

The third is a corporate event affecting SAP or the underlying hyperscaler. A change of control, a regulatory enforcement action, a shift in strategic direction, or a material financial event on either side can affect service continuity in ways that the contract does not anticipate. The probability for any given event is low, but the cumulative probability across the seven year horizon is meaningful.

The fourth is regulatory intervention. Data sovereignty, sectoral regulation, and competition policy are evolving in several jurisdictions, and a regulatory development affecting either SAP or the hyperscaler could constrain the service in ways the contract did not foresee. The buyer's mitigation pathway, in this scenario, is partly contractual and partly architectural.

The fifth is geopolitical disruption. Hyperscaler regions can become unavailable for reasons unrelated to either the supplier or the buyer. Geopolitical instability, sanctions regimes, and infrastructure disruption all sit inside this category. The concentration in RISE amplifies the impact because the buyer cannot, in most architectures, simply move the workload elsewhere on short notice.

03.The contract mechanisms that materially mitigate the exposure

Several contract provisions, when negotiated specifically against the concentration profile, materially reduce vendor concentration risk. The provisions are negotiable in most cases and should be treated as a coherent package rather than a wish list.

Data portability provisions ensure the buyer retains a usable copy of the operational data throughout the term and after termination, in a format that can be loaded into an alternative environment without unreasonable engineering effort. The provision should specify export frequency, export format, export coverage, and a defined retention window after termination during which the buyer can request additional exports.

Exit assistance provisions oblige SAP to support the buyer through a transition out of RISE, whether at renewal or in a termination scenario, at agreed rates and within agreed timelines. The provision should cover knowledge transfer, configuration documentation, integration documentation, and supporting the transfer of the workload to an alternative provider.

Step in rights, more relevant in regulated sectors, allow the regulator or, in some configurations, the buyer to assume operational responsibility for the workload in a defined set of crisis scenarios. The provision is rarely exercised but its existence materially constrains the supplier's behaviour in adversarial situations.

Service level commitments with meaningful remedy, beyond the modest credits in the standard agreement, address the performance degradation failure mode. The remedy should escalate with the duration and severity of the degradation, and should provide for material credits in the event of sustained underperformance.

Audit and inspection rights allow the buyer to verify operational performance, security posture, and compliance with regulatory obligations. The audit should be exercisable through independent third parties as well as directly, and the cost provisions should not discourage reasonable exercise of the right.

Pricing protection at renewal, in the form of capped escalation or a defined renewal mechanic, addresses the commercial leverage failure mode directly. The cap should reflect the buyer's planning horizon and should be specified explicitly rather than left to the supplier's discretion.

04.Architectural choices that reduce concentration

Beyond the contract, certain architectural choices reduce the practical impact of concentration even though they do not remove it. The choices are usually negotiated alongside the contract because they affect the sizing, the commercial terms, and the operational model.

Maintaining the integration layer outside the RISE bundle, in the buyer's own infrastructure or under a separate hyperscaler agreement, preserves the buyer's flexibility around integration and reduces the exposure to a single supplier for the connection points between SAP and the rest of the estate. The trade off is operational complexity and some duplication of capability.

Retaining edge or peripheral workloads outside RISE, particularly workloads that are operationally meaningful but not commercially central, preserves a buyer side capability for running SAP infrastructure that would otherwise atrophy. The buyer's ability to operate alternative environments is the most useful diversification asset available, and it requires active maintenance.

Selecting a hyperscaler region with strong alternatives nearby reduces the geopolitical and regulatory exposure. A region that has multiple availability zones and a credible disaster recovery profile across providers, even if the disaster recovery is not currently operationalised, materially reduces the concentration's practical impact.

Maintaining knowledge of the configuration and integration architecture inside the buyer's team, rather than fully delegating to the supplier's managed service, preserves the buyer's ability to understand, document, and ultimately transfer the workload. The cost is some duplication of effort. The benefit is real optionality.

05.Governance structures that keep concentration visible

Vendor concentration risk is not a one time analysis. It evolves through the term as the buyer's footprint changes, the supplier's organisation changes, and the regulatory and geopolitical environment changes. The governance structure should make the evolution visible and should escalate material changes to the appropriate level of management.

A quarterly concentration review, presented to the steering committee, should track the cumulative exposure in terms of dollar value at risk, operational dependency, and contractual maturity. The review should reflect changes in the supplier's organisation, in the hyperscaler relationship, and in the broader regulatory environment.

An annual review at board level, with a structured concentration risk presentation, ensures that the senior governance layer remains engaged with the exposure even when day to day operations are running well. The annual review should include the financial exposure, the operational dependency, the regulatory development picture, and the buyer's mitigation posture.

A formal escalation pathway, defined in advance and triggered by specific events such as a service incident exceeding a defined threshold, a corporate event affecting either supplier, or a regulatory development, ensures the governance response is structured rather than improvised.

The internal documentation of the concentration profile should be kept current, including the data portability posture, the exit assistance arrangements, and the architectural diversification choices. The documentation is critical input to any subsequent renewal negotiation and to any incident response.

06.The limits of what mitigation can achieve

A buyer side risk register should be honest about the limits of mitigation. Several aspects of vendor concentration in RISE cannot be removed, only reduced or accepted with eyes open.

The operational dependency on a single supplier for the core ERP function is, in practice, irreducible without a significant architectural change that the buyer is unlikely to undertake during the seven year horizon. The buyer can mitigate around it but cannot eliminate it.

The commercial leverage at renewal is real and persistent, and the contract provisions help but do not remove it. The buyer side preparation for renewal, starting twelve to eighteen months in advance, is the most important practical mitigation, but it does not change the underlying structural reality.

The corporate event and regulatory intervention failure modes are low probability but not negligible across the term. The buyer should accept that these are residual risks and should communicate that honestly into the enterprise risk register rather than overclaim the effectiveness of mitigation.

07.Conclusion

Vendor concentration in RISE is real, structural, and material. The concentration is the consequence of a bundle that simplifies commercial life while consolidating risk into a single counterparty. The buyer side response is to measure the concentration accurately, to negotiate the contract provisions that materially reduce the exposure, to make architectural choices that preserve diversification where it remains practical, and to maintain a governance structure that keeps the concentration visible through the term. The work does not remove the concentration, but it converts a passive exposure into a managed one. Buyers who treat vendor concentration as a first class risk inside the RISE programme typically secure better renewal outcomes, respond better to operational incidents, and provide the board with the assurance the exposure requires.

RISE simplifies commercial life. It also concentrates risk. The buyer who measures the concentration and manages it actively retains real optionality through the term.