top of page

Current Regulations Affecting SAP Projects in the EU and Turkey: Why Consulting Services Have Become Inevitable

Current Regulations Affecting SAP Projects in the EU and Turkey: Why Consulting Services Have Become Inevitable
Current Regulations Affecting SAP Projects in the EU and Turkey: Why Consulting Services Have Become Inevitable

Introduction: SAP Projects in an Increasingly Complex Regulatory Environment

Today, the successful implementation of SAP projects is no longer merely a matter of technological infrastructure and software integration—it has evolved into a struggle for compliance with complex legal regulations. The European Union’s new digital regulations and Turkey’s e-transformation legislation have led to significant changes and additional requirements in SAP modules, including FI, CO, and HR. Considering that approximately 70% of corporate data worldwide is stored in SAP systems, compliance with regulations is no longer optional, but a critical necessity. Regulations like the GDPR, as well as Turkey’s digital transformation goals, have exponentially increased the complexity of SAP projects. This reality provides a clear answer to the common question, “Why can’t we just operate everything in a standard way?” The dynamic nature of regulations and the varying requirements unique to each country and sector make standard, one-size-fits-all SAP deployments impossible. As a result, the need for professional SAP consulting services is being felt more than ever.

The Impact of EU Regulations on SAP Projects

In recent years, the European Union has significantly reshaped the framework of SAP projects through comprehensive regulations enacted in the digital sphere. This section examines the impact of major EU regulations on SAP, such as the GDPR, DSA, CSRD, and the AI Act.

GDPR and Data Protection Standards


The General Data Protection Regulation (GDPR) has introduced stringent standards for the processing and protection of personal data across the EU. This has required major ERP systems like SAP to fundamentally review their data management infrastructures. In particular, the storage, processing, and deletion of employee data within SAP HR/HCM modules must be restructured by GDPR principles such as the “right to be forgotten” and data portability. For example, GDPR compliance features such as data deletion (purge), explicit consent management, and data portability have been integrated into SAP HR solutions like SAP SuccessFactors. As a result, when employees request the deletion of their data or leave the company, their data can be securely erased and delivered in a structured format if requested. The risk of severe fines—up to 4% of annual turnover in the event of a GDPR violation—has made firms in the EU extremely meticulous about compliance when running SAP projects. Consequently, many companies in the EU are seeking intensive consulting support to update their SAP systems to meet GDPR requirements and maintain their competitive advantage.

Digital Services Act (DSA) and Platform Obligations

The Digital Services Act (DSA), which came into effect across the EU in 2024, has increased the responsibilities of digital platforms. In the context of SAP, this has primarily impacted SAP’s ecosystem: for example, platforms such as SAP Community and SAP Concur are now required under the DSA to publish periodic transparency reports, combat illegal content, and fulfill new obligations regarding content moderation. The standards set by the DSA also serve as a precedent for businesses using SAP solutions. Especially in SAP-based systems where user-generated content is managed, it has become necessary to establish audit and reporting mechanisms in compliance with the DSA. In this area, consultants guide companies on structuring their platforms following the legal framework and developing the required reporting functions.

Corporate Sustainability Reporting Directive (CSRD)

The Corporate Sustainability Reporting Directive (CSRD) is a major EU regulation that imposes non-financial sustainability reporting obligations on large enterprises. Covering companies with more than 250 employees or over 20 million euros in net assets, the CSRD has been implemented gradually since 2024. In terms of SAP projects, the most notable impact is the integration of sustainability metrics into the CO (Controlling) module. For instance, within the SAP CO module, new data fields and report formats have been defined to enable carbon footprint calculations and ESG (Environmental, Social, and Governance) reporting at the cost center level. These mandatory reporting standards introduced by the CSRD require a redesign of existing cost accounting processes. As many enterprises have started collecting sustainability data from 2024 onwards, updating SAP systems to capture and report this data has become a critical priority. This, in turn, has increased the demand for specialized support in sustainability consulting and CO module configuration.

EU AI Act and Artificial Intelligence Applications in SAP

The EU AI Act, adopted by the European Parliament in 2024, is the world’s first comprehensive artificial intelligence regulation. This law categorizes AI systems according to their level of risk and imposes strict controls, especially on high-risk AI applications. Within the SAP ecosystem, modules that utilize machine learning and artificial intelligence (such as predictive analytics tools, smart assistants, or automated decision support systems) may fall under the scope of this legislation. The AI Act mandates that SAP solutions using AI must ensure criteria such as risk assessment, transparency, and human oversight. For example, in SAP S/4HANA modules featuring AI capabilities or in SAP AI Business Services integrations, requirements such as algorithmic fairness and explainability, as well as human supervision of critical decisions, have emerged. Since compliance with this regulation is a technically complex process, there is a growing need for expert consulting to review and, if necessary, restructure AI applications within SAP projects. In particular, ethical and legal compliance assessments of AI tools have become a new area of focus for SAP consultants.

The Impact of Turkish Regulations on SAP Applications

Turkey’s digital transformation process and legal regulations also have a profound impact on SAP projects. In particular, regulations such as e-document implementations, public financial management laws, and the personal data protection law require the localization and adaptation of SAP systems.

E-Transformation Legislation: e-Invoice, e-Archive, and Financial Compliance

In recent years, Turkey has taken comprehensive steps in the field of digital transformation. In particular, the implementation of e-Invoice and e-Archive Invoice systems has required companies to make significant changes in their SAP FI (Financial Accounting) modules. With the communiqué of the Revenue Administration dated November 12, 2024, the threshold for issuing e-archive invoices was reduced from 5,000 TL to 3,000 TL as of early 2025, and this limit will be completely removed by 2026. This change means that starting from 2026, all invoices, regardless of amount, must be issued as e-archive invoices. As a result, it has become mandatory to configure SAP FI modules following these new thresholds and the expanded scope. Many companies have had to revisit their accounting processes and update e-invoice integrations within their SAP systems accordingly. Furthermore, the need to apply both the Tax Procedure Law (VUK) and International Financial Reporting Standards (IFRS) simultaneously has led to the establishment of dual accounting systems in SAP financial modules, especially for multinational companies. These complex adaptations aim to ensure compliance with both local regulations and international standards. The frequently changing regulatory environment in Turkey regarding tax and e-documentation has made localization expertise and continuous consulting support virtually indispensable for SAP projects.

Law No. 5018 and SAP Projects in the Public Sector

Law No. 5018 on Public Financial Management and Control is the fundamental law guiding the financial processes of public administrations and creates specific requirements for SAP projects in public institutions. This law includes principles such as strategic planning, performance-based budgeting, accountability, and financial transparency. Therefore, SAP systems implemented in public institutions must be structured under these principles set out by Law No. 5018. For example, in a public institution, SAP CO and Funds Management (FM) modules may need to operate in an integrated manner with strategic plan objectives and performance indicators. Additional control points and reporting tools are developed within SAP to ensure transparent and traceable reporting of expenditure processes. In public sector projects, audit trails and internal control mechanisms must also be designed to be ready for independent audits and Court of Accounts (Sayıştay) reviews. All these requirements make SAP projects in the public sector unique and more complex, making the support of experienced consultants critical in this field. Configuring SAP following the principles of Law No. 5018 requires a level of customization and expertise that most in-house teams cannot handle alone. As a result, the demand for SAP consulting services tailored to the public sector is steadily increasing.

KVKK and Cybersecurity Obligations

Turkey’s Personal Data Protection Law (KVKK), similar to the GDPR, imposes significant obligations on businesses regarding the protection of personal data. Ensuring KVKK compliance requires the implementation of additional measures in SAP modules containing personal data, especially HR (Human Resources) and CRM modules. For example, policies for data retention periods, data masking/anonymization needs for employee and customer records, must be enforced within SAP modules. Furthermore, recent cybersecurity regulations in Turkey have made annual penetration tests mandatory for critical systems in large-scale companies. Since SAP systems are included in this scope, regular security testing, vulnerability remediation, and comprehensive reporting must be carried out each year. The heavy administrative penalties for KVKK violations and cybersecurity breaches have brought security architecture and access controls to the forefront of SAP projects. In particular, for SAP modules processing personal data, continuous vulnerability monitoring and integration with intrusion detection systems have become essential requirements. SAP security consultants specializing in this area guide companies on topics such as authorization matrix design, encryption and masking solutions, log management, and penetration testing.

As a result, building SAP systems in Turkey that are both fully KVKK-compliant and resilient against cyber threats necessitates intensive consulting and ongoing improvement efforts.

Turkey’s digital transformation strategies are also shaping SAP projects. For instance, the 2025 Presidential Annual Program emphasizes GDPR compliance to support global trade and sets objectives such as creating infrastructure for the anonymization and secondary use of health data. Such national strategic directions generate new data management and integration requirements in SAP systems, requiring project teams to stay constantly up to date.

Technical and Managerial Challenges in SAP Projects

SAP implementations present a variety of challenges not only due to legal regulations, but also in terms of corporate dynamics and project management. Experience from both Europe and Turkey indicates that the following key issues frequently come to the forefront:

  • User Resistance: One of the most common challenges in deploying ERP systems is user resistance to change. Employees may find it difficult to give up familiar legacy systems and business processes; they may experience reluctance or anxiety when adapting to new SAP interfaces and workflows. This resistance can negatively impact project timelines and overall success, leading to delays and usability issues. Especially in public institutions, there can be significant resistance from different departments when transitioning to a single integrated SAP system.

  • Project Planning and Time Management: If the scope and duration of SAP projects are not properly planned, the risk of budget overruns and delays becomes very high. For example, incorrectly defined scope or overly optimistic time estimates can jeopardize the project. In one case in Turkey, a SAP project involving a team of 20 people over 14 months failed to be completed within the targeted timeframe due to planning deficiencies. Prolonged implementation schedules and inadequate project management are factors that undermine the success of SAP projects.

  • System Integration and Compatibility Issues: As a modular ERP system, SAP requires seamless integration between its various modules (finance, logistics, human resources, etc.) and, where applicable, with non-SAP systems. In practice, challenges often arise with data integration between legacy systems and SAP, or due to structural problems that prevent modules from functioning smoothly within a common database. When custom developments beyond SAP’s standard offerings are required to meet specific business needs, this adds another layer of complexity. Integration errors and data inconsistencies can reduce system efficiency, leading to additional corrective work and thus an increased need for consulting support.

  • Staff Turnover and Insufficient Training: Since SAP projects are usually long-term initiatives, there can be personnel changes within internal teams during the project. If a key user or technical expert leaves the organization mid-project, it can cause a loss of critical knowledge and disrupt the implementation. Moreover, if the initial training provided is inadequate, users may not be able to use the system efficiently once it goes live. This can result in not realizing the expected benefits. If training deficiencies persist after the project, system usage rates may decline, and there is a risk of reverting to manual processes.

  • Compliance Burden: Regulations such as the GDPR, KVKK, and Law No. 5018, as previously discussed, add extra layers that prevent SAP projects from being run as “standard” software projects. With data protection rules in the EU and requirements for strategic planning and accountability in Turkey, project teams must deal not only with technical tasks but also with compliance documentation. This brings significant workload and complexity to projects. Regulation-driven enhancements, such as data masking for KVKK or consent forms for GDPR, can extend project timelines and create challenges due to a lack of in-house expertise. These difficulties have also been highlighted by various studies. For instance, according to a study published in 2025, more than 60% of SAP S/4HANA transformations show significant deviations from their original timelines or budgets. This finding demonstrates that almost every SAP project carries a certain level of risk, and that external expert support plays a critical role in mitigating these risks.

The Role and Contributions of Consulting Services in SAP Projects

Overcoming the challenges listed above and ensuring the technical and managerial success of SAP projects is often only possible with the support of specialized consulting firms. SAP consultants and integrated service providers add value in many areas, from project initiation to go-live and maintenance phases. The critical contributions of consulting services can be summarized under the following headings:

  • Technical Configuration and Process Redesign: Consultants play a key role in designing the most suitable technical solution for the organization’s needs in SAP projects. The setup of system architecture, correct configuration of modules, and adjustment of localization settings in compliance with local laws are all expedited by consultants’ expertise. For example, when developing a data management strategy on SAP in line with GDPR’s data retention and deletion requirements, consultants draw on global best practices and previous experiences to determine the best approach for the company. The redesign of business processes to align with SAP standards (process re-engineering) and, when necessary, the implementation of custom developments are realized through the technical expertise of consulting teams. In this way, complex problems that internal teams may encounter for the first time are resolved with the guidance of consultants who have experience from similar projects.

  • Change Management and Training: Change management practices are critically important in overcoming user resistance and ensuring adoption of the new system. Consulting firms prepare comprehensive training programs, workshops, and communication plans to help employees adapt during large-scale ERP transformations. For example, change management specialists are involved in the process to communicate the benefits of the system to all users, address their concerns, and prepare them for new roles. Additionally, the training of “super users”—key personnel—and the establishment of an internal support mechanism after the project are made possible with the support of consultants. Ensuring continuity of training and providing close support during the first months after go-live minimizes user errors and guarantees project success. Through well-managed change and training processes, efficient use of the SAP system and employee satisfaction can be significantly increased.

  • Project Management and Process Monitoring: SAP projects are complex undertakings that involve multiple business units and technical teams and can last for several months. Experienced consultants ensure that schedules and budgets are kept under control by establishing a project management office (PMO) or by taking on the role of project manager themselves. They utilize methodological approaches (such as ASAP or Activate, which are SAP-specific methodologies) to create the project plan, clarify milestones, and define responsibilities. With regular status reports and risk assessments, they keep senior management informed and help identify and address potential delays or deviations at an early stage. Considering the frequent issues with planning and time management seen in projects in Turkey, the guidance of external experts provides a critical assurance mechanism for companies. With successful project management support, the likelihood of completing the SAP implementation within the defined budget and timeline increases significantly.

  • Regulatory Compliance and Risk Management: One of the most valuable aspects of consulting services is their ability to keep companies up to date with constantly evolving legal requirements. The dynamic nature of regulations in both the EU and Turkey means that SAP systems must be continually adapted. At this point, SAP consultants specializing in regulatory advisory services analyze the impact of new communiqués, laws, or directives on SAP and provide the necessary action plans. For example, when a new reporting standard like CSRD comes into force, consultants can identify which areas in the CO module need to be updated and which data should start being collected, then implement these changes. Similarly, developments related to KVKK or GDPR are closely monitored, and additional measures in the system (such as maintaining data access logs or implementing extra masking features) are proactively put into effect. From a risk management perspective, consultants identify risks at the beginning of the project and develop mitigation strategies; after implementation, they support the company during audits or compliance checks, assuring potential penalties. All these factors demonstrate that investing in consulting ultimately protects companies from much greater costs in the long run.

In conclusion, consulting firms provide multidimensional support at every stage of SAP projects: with technical expertise, process experience, training, change management skills, and regulatory knowledge, they help companies achieve a correct implementation the first time. Indeed, market data supports this trend: as of 2025, the global digital transformation consulting market is expected to exceed $560 billion. This growth reflects the extent to which businesses are increasingly relying on consulting support in an increasingly complex environment.

Unique Challenges in the Public Sector and SMEs

While SAP projects pose unique challenges in every industry, particularly notable differences are observed in the public sector and among small and medium-sized enterprises (SMEs). In these areas, in addition to the general difficulties mentioned above, specific needs and constraints significantly influence the course of SAP projects.

Public Sector: Public institutions operate in a more rigid environment in terms of regulatory compliance and bureaucratic procedures. The accountability and transparency requirements introduced by Law No. 5018 make SAP projects particularly complex in organizations such as ministries or municipalities. Furthermore, due to processes subject to public procurement regulations, there may be less flexibility in project planning and a requirement to adhere to specific timelines. Additional needs often arise in public projects, such as native language support, public sector reporting formats, and integration with central government systems (for example, integration with central accounting or electronic document management systems). Employees in public institutions often follow the same processes for many years, which can increase resistance to change. For all these reasons, there is a need for SAP consultants who are familiar with the public sector. These consultants act as a bridge throughout the project thanks to their technical expertise and familiarity with public sector operations, helping prevent possible communication breakdowns. Recently, in Turkey, it has been observed that public institutions have placed greater emphasis on experienced consultants in digital transformation projects and have begun to consider this as a criterion in procurement processes.

SMEs: ERP projects present different challenges for small and medium-sized enterprises (SMEs) compared to large organizations. The primary constraint for SMEs is often their limited budget. The license, infrastructure, and consulting costs of a large-scale SAP project can seem high for SMEs, leading them to undertake projects with a narrower scope or restricted resources. A lack of technical expertise is another common issue—SMEs typically do not have a large IT team or staff with extensive ERP experience. In this context, external consultants not only implement and launch the system but also play a role in training the internal team. SME employees, who juggle project tasks alongside their regular workloads, may find it difficult to dedicate time to change initiatives and may experience adaptation challenges. While user resistance is also seen in SMEs, it is often easier to overcome with the right approach, thanks to the close communication between top management and staff. The government also implements support programs to encourage the digital transformation of SMEs. For example, through KOSGEB’s SME Digital Transformation Support Program, businesses meeting certain criteria can receive financial support of up to 20 million TL. Such incentives help SMEs cover consulting costs when implementing comprehensive systems like SAP and facilitate access to external expert support. As a result, in SMEs, experienced SAP consultants become a key part of the “doing more with less” mission to ensure the most efficient use of limited resources.

Outlook and Conclusion: The Growing Need for Consulting Is Inevitable

As of 2025, the complexity of the regulatory environment in both the European Union and Turkey has made professional consulting services virtually indispensable for SAP projects. A wide range of regulations—from the GDPR and the Digital Services Act to Turkey’s e-transformation process, the KVKK, and cybersecurity legislation—make it impossible for businesses to rely solely on one-size-fits-all, fully standard SAP implementations. Every new regulation or amendment means new customizations, new processes, and new controls for SAP systems.

The answer to the question, “Why can’t we just use everything out of the box?” is now abundantly clear: the dynamic nature of regulations, varying country- and sector-specific requirements, and the constantly evolving technological landscape no longer allow for standard, one-size-fits-all solutions. This reality elevates SAP consultants and consulting firms from being merely an option to being guarantors of successful digital transformation.

Expectations for the future also indicate that this need will continue to grow. With AI integrations, sustainability reporting, and evolving data protection regulations, the scope and complexity of SAP projects will further expand. For example, new EU regulations expected to come into force in the coming years (such as the full implementation period of the AI Act and the e-Privacy Regulation), as well as draft AI and digital legislation being prepared in Turkey, will introduce new compliance requirements for SAP systems. To keep up with this continuous wave of change and remain competitive, businesses must place expert consultants at the center of their planning.

In conclusion, utilizing specialized consulting in SAP projects is no longer a luxury but a critical requirement for competitive advantage and regulatory compliance. Investment in this area not only ensures the smooth implementation of the project but also protects against potential penalties, reputational loss, and inefficiency costs. As the pace of change accelerates in 2025 and beyond, the knowledge and experience of SAP consultants will continue to serve as a safe harbor for businesses. In short, even as regulations evolve, the formula of “the right roadmap + the right consulting support” will remain the key to successful SAP projects.

References

Comments

bottom of page