Oatly Group AB

Sweden · owned by Independent (Sweden) · www.oatly.com · 19 vendors

Oatly Group AB is a Swedish food and beverage company and the original oat drink company, producing a wide range of oat-based products including oat drinks, ice cream, yogurt alternatives, cooking creams, and spreads. Founded on research from Lund University, the company developed a patented enzyme technology to convert oats into nutritious liquid food. Oatly operates globally across Europe, North America, and Asia, and is publicly listed on the NASDAQ stock exchange.

Resilience scores

Technology vendors

Insights

Last updated 2026-09-13 · revision 3

19 direct vendors, 256 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 5/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Oatly Group AB's migration readiness is assessed as medium, with a score of 45 out of 100. The company exhibits some foundational elements that could support migration, such as the adoption of modern technologies like Storyblok (a headless CMS) and Drupal 10, as well as leveraging various SaaS platforms (Teamtailor, YouTube, LinkedIn, Meta, NASDAQ Investor Relations Platform) for specific functions. This indicates experience with cloud-based and modern architectural approaches. A significant advantage for migration is the absence of explicit data residency requirements, which simplifies the selection of cloud regions and compliance strategies. While awareness of regulations like GDPR and the NIS2 Directive is present, these also introduce compliance complexities that must be carefully managed during migration. However, several substantial challenges significantly lower the readiness score. The company's financial instability, characterized by a revenue decline in 2023 and reported net losses, poses a considerable risk to funding a potentially costly and resource-intensive migration project. The 'Vendor Lock-in Risk' being 'Unknown' is a critical impediment; if core systems are heavily reliant on specific vendors with complex contracts, migration could be extremely difficult and expensive. The data also lacks insight into Oatly's core operational systems (e.g., manufacturing, supply chain, ERP), which are typically the most complex and challenging to migrate, often involving legacy technologies. The presence of 'Total Services: 21' suggests a potentially fragmented and integrated landscape, which could lead to significant integration complexity during a migration effort. The inconsistency in 'Total Vendors: 0' versus the existence of 21 services from diverse vendor countries highlights a data gap that makes a precise assessment of vendor-related migration challenges difficult.

Compliance

13 in-scope frameworks identified; showing 3.

EU Food Safety Regulations — Compliant

As a food manufacturer operating in the EU, Oatly is subject to the General Food Law (EC 178/2002), food hygiene regulations (EC 852/2004), and official controls regulation (EU 2017/625). These are core operational requirements for Oatly's business. Risk is rated High not because of non-compliance evidence, but because: (1) food safety violations carry severe consequences including product recalls, facility shutdowns, and criminal liability; (2) Oatly's products are consumed by millions of people including those with dietary restrictions; (3) the company has faced regulatory scrutiny in various markets regarding product labeling and health claims; (4) supply chain complexity (oat sourcing, processing, global distribution) increases food safety risk exposure. Oatly's continued market operation and absence of major food safety enforcement actions suggest ongoing compliance.

Evidence: https://www.oatly.com/legal/supplier-code-of-conduct, https://www.oatly.com/legal/privacy-policy, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32002R0178, https://www.livsmedelsverket.se/en

US FDA Regulations — Assessment Required

Oatly has US manufacturing operations (Millville, New Jersey facility) and sells products throughout the United States. The FDA's Food Safety Modernization Act (FSMA) imposes preventive controls, supply chain program requirements, and foreign supplier verification requirements on food manufacturers. Risk is High because: (1) FDA enforcement in the US food sector is rigorous; (2) Oatly's US manufacturing facility is subject to FDA inspections; (3) FSMA requires documented food safety plans, hazard analysis, and preventive controls; (4) any FDA warning letter or import alert would have significant business impact for a NASDAQ-listed company; (5) Oatly's US market is a key growth area.

Evidence: https://www.fda.gov/food/food-safety-modernization-act-fsma, https://www.oatly.com/legal/supplier-code-of-conduct, https://investors.oatly.com

SOC 2 (source) — Assessment Required

SOC 2 is primarily relevant for technology companies and cloud service providers that store or process customer data on behalf of other organizations. Oatly is a food manufacturer, not a SaaS or cloud services provider. However, Oatly uses cloud-based systems internally (ERP, CRM, e-commerce, digital marketing platforms) and may be required by enterprise customers or partners to demonstrate SOC 2 compliance for any digital services or data-sharing arrangements. Risk is Low because SOC 2 is not a regulatory requirement for food manufacturers and Oatly is unlikely to be contractually obligated to obtain SOC 2 certification in its primary business lines.

Evidence: https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services, https://www.oatly.com/legal/privacy-policy

Financials

Three-year financials

Financial Resilience Score: 4/10

Oatly demonstrates mixed financial resilience. On the positive side, it holds strong brand equity as a leading global plant-based dairy brand, particularly in EMEA foodservice channels, and benefits from a diversified geographic footprint across three reporting segments. Gross margins have recovered from single-digit/negative levels in 2022 to high-20s% by late 2024, and the company has a supportive long-term shareholder base including Blackstone, Verlinvest, and China Resources that participated in the 2023 convertible note financing of approximately $425M. However, the company faces significant financial challenges. Oatly has been persistently unprofitable with operating losses of ~$212M (2021), ~$392M (2022), and ~$416M (2023), leading to substantial erosion of shareholders' equity from ~$1.15B post-IPO to ~$310M by end of 2023. Revenue growth has decelerated sharply from 53% in 2021 to just 5% in 2024. The plant-based category has plateaued in key markets, and the company executed a 1-for-20 reverse stock split in 2024 to maintain NASDAQ listing compliance, indicating share price weakness. Cash burn remains material and further dilution or debt raises are possible if profitability targets slip.

Key strengths: Category leadership and strong brand equity in plant-based dairy, Diversified geographic footprint across EMEA, North America, and Greater China, Improving gross margins (from negative to high-20s%) via asset-light strategy, Supportive long-term shareholder base (Blackstone, Verlinvest, China Resources), $425M convertible note financing in 2023 bolstered liquidity, Starbucks partnership in US and China foodservice channel

Risk factors: Persistent operating losses and negative free cash flow, Declining shareholders' equity due to cumulative losses, Plant-based category plateau in US and parts of Europe, Intensifying competition from Alpro (Danone), Silk, Chobani, and private label, Underperformance in Greater China segment, FX translation risk (USD reporting vs. EUR/SEK/GBP cost base), Share price weakness requiring 1-for-20 reverse stock split in 2024, Historical governance/accounting scrutiny (Spruce Point short report, shareholder litigation), Customer concentration risk with large foodservice/retail customers >10% of segment revenue

Revenue by geography

Revenue by product/service

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report