Xylem

United States · xylem.com · 23 vendors

Xylem Inc. is a global water technology provider that designs, manufactures, and services engineered products and solutions for water and wastewater utilities, industrial, commercial, agricultural, and residential settings. The company focuses on solving critical water and infrastructure challenges by optimizing water and resource management across the entire water cycle.

Resilience scores

Technology vendors

Services catalogue

1 service in catalogue across 1 category; runs on 23 sub-vendors.

Insights

Last updated 2026-09-13 · revision 12

23 direct vendors, 285 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 7/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Xylem exhibits a solid technical foundation for migration readiness, driven by a modern internal tech stack that includes Microsoft Azure, Kubernetes, Docker, Azure IoT Hub, and Azure Machine Learning. This adoption of cloud-native technologies and containerization provides significant flexibility and agility for migrating and modernizing applications. The company's strong financial growth, with revenue increasing to $9.04B in 2025, suggests ample resources to fund complex migration initiatives. However, migration readiness is significantly challenged by a complex regulatory environment and stringent data residency requirements. As a global company operating in 150+ countries and a critical infrastructure provider in the EU, Xylem faces "High Risk" and "Assessment Required" statuses for GDPR and NIS2. These regulations impose strict requirements on data protection, cross-border data transfers (e.g., GDPR Article 44-49, China PIPL), and cybersecurity, which will necessitate meticulous planning for data placement, security controls, and compliance during any migration to new environments, especially cloud. The company's privacy policy indicates the use of EU Standard Contractual Clauses and data centers in multiple regions to address these, but the complexity remains high. The vendor relationship data is ambiguous, stating "Total Vendors: 0" while also listing "Total Services: 28" and vendor HQ countries (United States, Australia, India). This makes a precise assessment of vendor lock-in risk challenging. While the diverse tech stack suggests a multi-vendor strategy for core IT, the unknown specifics of vendor contracts for 28 services could introduce unforeseen complexities and potential lock-in during a large-scale migration. The combination of strong technical capabilities and financial backing is tempered by the significant regulatory and data sovereignty hurdles.

Compliance

10 in-scope frameworks identified; showing 3.

GDPR (source) — Partially Compliant

Xylem is a large multinational with 23,000+ employees and operations across all EU/EEA member states (Germany, France, Sweden, Italy, Netherlands, Belgium, Finland, Denmark, Poland, Spain, Portugal, Austria, Czech Republic, Hungary, Romania, Bulgaria, Croatia, Lithuania, Slovakia, Greece, and more). The company processes personal data of EU employees, customers, and business partners at scale. GDPR fines can reach €20M or 4% of global annual turnover — for Xylem at $8.6B revenue, this could mean fines exceeding $344M. The company has a published Privacy Statement referencing EU SCCs and data subject rights, indicating awareness, but no public DPO appointment or formal GDPR audit certification has been found, elevating residual risk. Cross-border data transfers to the US (confirmed in privacy policy) add further complexity under Schrems II and the EU-US Data Privacy Framework.

Evidence: https://www.xylem.com/en-us/resources/policies/privacy/, https://www.xylem.com/en-us/about-xylem/, https://www.xylem.com/en-us/xylem-at-a-glance/

China PIPL — Partially Compliant

Xylem has confirmed operations in China (Chinese language website, China listed as an operational market) and its Privacy Statement includes a dedicated China/PRC section addressing PIPL requirements. The risk is Medium because while Xylem has documented PIPL-specific provisions (cross-border transfer mechanisms, consent requirements, PRC-specific data subject rights), China's PIPL enforcement is increasingly active and the cross-border data transfer requirements (security assessments, standard contracts, or certification) are complex and evolving. Non-compliance can result in fines up to 5% of annual revenue.

Evidence: https://www.xylem.com/en-us/resources/policies/privacy/, https://www.xylem.com/changelanguage?culture=zh-cn&content=8

NIS2 (source) — Assessment Required

Xylem is a large enterprise (23,000+ employees, $8.6B revenue — far exceeding the 50-employee / €10M turnover NIS2 thresholds) with confirmed operations across the EU. Critically, Xylem's core business directly serves sectors explicitly listed as NIS2 Essential Entities: drinking water supply and distribution (Municipal Drinking Water market), wastewater management (Municipal Wastewater market), and energy (Energy & Power Generation market). Xylem also provides digital/OT technology (Xylem Vue, Sensus smart metering, SCADA-connected systems) to critical infrastructure operators, which may trigger NIS2 obligations as an ICT service provider or manufacturer of critical products. Non-compliance penalties under NIS2 can reach €10M or 2% of global annual turnover for Essential Entities. The risk is HIGH because Xylem's EU subsidiaries almost certainly qualify as Essential Entities in the drinking water and wastewater sectors, and NIS2 was transposed into national law across EU member states by October 2024.

Evidence: https://www.xylem.com/en-us/about-xylem/cybersecurity/, https://www.xylem.com/en-us/markets/municipal-drinking-water/, https://www.xylem.com/en-us/markets/municipal-wastewater-treatment/, https://www.xylem.com/en-us/markets/energy-power-generation/

Financials

Three-year financials

Financial Resilience Score: 8/10

Xylem demonstrates strong financial resilience underpinned by scale leadership in the global water technology market (~$9.0B revenue, ~150 countries, 8,300+ patents) and diversified, non-cyclical demand drivers including aging U.S. water infrastructure, water scarcity, PFAS regulation, data center water needs, and smart metering rollouts. The company generates significant recurring revenue (~17% from services alone) supported by a large installed base and a $4.6B backlog representing ~51% of annual revenue. Margin expansion has been robust, with adjusted operating margin rising 180 bp to 17.8% in 2025 and adjusted EBITDA margin reaching 22.2%. Cash generation is strong at $1.24B operating cash flow and $910M free cash flow in 2025. The balance sheet is conservatively structured with $1.5B cash, $1B undrawn revolver (~$2.5B total liquidity), $1.9B of laddered fixed-rate senior notes, investment-grade ratings, and very low leverage (debt/equity ~0.17x; net debt/adjusted EBITDA ~0.25x). Key risks include high goodwill/intangible concentration (~60% of assets, largely from Evoqua, with ~$2.5B in one WSS reporting unit flagged as a Critical Audit Matter), tariff and FX exposure (~42% non-U.S. revenue), ongoing restructuring drag, softness in emerging markets, a 9% YoY backlog decline, and unresolved Swedish tax litigation (~$91M exposure). Overall, the combination of category leadership, structural demand, strong cash flow, low leverage, and diversified customer base (no customer >5% of revenue) supports a high resilience score.

Key strengths: Scale leadership in global water technology market with ~$9.0B revenue and 8,300+ patents, Diversified non-cyclical demand from municipal utilities, water scarcity, PFAS regulation, and smart metering, Strong balance sheet with ~$2.5B liquidity, low leverage (debt/equity ~0.17x), and investment-grade ratings, Robust cash generation: $1.24B operating cash flow and $910M free cash flow in 2025, Adjusted operating margin expanded 180 bp to 17.8% in 2025, $4.6B backlog (~51% of revenue) with ~60% expected to convert in 2026, No customer >5% of revenue; broad geographic and end-market diversification, Growing recurring services revenue (17% of total, $1.56B)

Risk factors: Goodwill/intangibles ~60% of assets, concentrated in WSS reporting unit (Critical Audit Matter), Tariff and trade exposure with 42% non-U.S. revenue and manufacturing in China, Mexico, Taiwan, Foreign currency translation risk (EUR, SEK, CAD, PLN, GBP, AUD), Restructuring/realignment charges of $133M in 2025 with ongoing transformation, Emerging markets organic revenue decline in 2025, Backlog declined 9% YoY at end of 2025, Swedish tax litigation exposure of ~SEK 837M (~$91M), Sensus smart-meter business dependent on FCC-licensed 900 MHz spectrum, 5-year TSR ($149) has lagged S&P 500 ($196) and S&P 500 Industrials ($189)

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report