AI Governance in SAP

When AI acts inside your SAP landscape, the liability sits with you — not SAP, not the model.

We map every active and planned AI feature, classify its risk, close the data and privacy gaps, and build the oversight your organisation needs to operate AI in SAP compliantl

AUTHORISATION RISK

81% of Roles Carry Critical Access. Now Add an Agent That Acts on All of Them.

That's not an outlier — we see the same pattern in systems old and new. Today, a person with judgment holds that access and decides where the line is. That's the trade-off most organisations quietly accept: as long as it isn't flagged in an audit, and as long as you trust your users. That assumption is what's changing. As more tasks move to AI agents, it's increasingly the agent — not the person — acting in SAP, strictly within whatever your authorisation model allows. An agent will never learn the unwritten rule about what not to touch. It won't distinguish between access someone needs and access nobody ever removed. Your authorisation concept becomes the agent's authorisation concept too — and an SoD conflict nobody has resolved in years gets exercised in seconds, at machine scale

57%

of roles carried high-risk segregation-of-duties conflicts, six months after go-live

81%

held critical access nobody had signed off on

HOW WE WORK

Every AI Feature, Tiered Against the EU AI Act and ISO 42001.

Your SAP landscape drives the plan. Every AI feature is mapped, tiered against the EU AI Act, and closed against ISO 42001. You get clarity instead of exposure.

These four steps aren't a one-off audit. They run on a cycle: quarterly classification reviews, an annual AI audit, and board-level reporting — governed under ISO 42001 Clause 9 & 10.

Risk Classification

We tier every AI use case — Minimal, Limited or High — against the EU AI Act, before it goes live in production

Data & Privacy

We establish legal basis, run DPIAs, and verify EU data residency across BTP AI Core, Joule and Business Data Cloud.

Operational Oversight

We name AI owners per SAP module, build the intake and approval process, and embed SoD for AI outputs.

Vendor Accountability

We review your SAP DPA and assess every third-party add-on.

Trusted by the world's best companies

Why It Matters

Don't Wait for the Regulator to Ask First.

Most organisations activating Joule, BTP AI Services or SuccessFactors AI have looked at risk informally at best — no documented classification, no AI asset register, no formal governance process. Here's what that costs you.

EXPOSURE

Regulatory Exposure

EU AI Act, GDPR, NIS2 and DORA create overlapping obligations the moment AI touches personal data or business decisions. Non-compliance carries fines of up to €35M or 7% of global turnover.

VISIBILITY

Embedded & Invisible AI

Most SAP clients can't tell us how many AI features are active in their landscape at all — let alone whether each one has been formally assessed. Joule, BTP AI Services, SuccessFactors Talent AI and IBP are routinely switched on ahead of that review.

LIABILITY

Accountability Gap

You remain the data controller regardless of what SAP does with your data. SAP's ISO 42001 certification does not cover your obligations as a deployer. The liability stays with you

THE SHIFT

From System of Record to Autonomous Agent

At SAP Sapphire 2026, SAP outlined ERP's evolution from a system of record to an intelligent orchestration layer. Joule is moving from a conversational copilot to an autonomous agent — reading context, deciding the next step, and executing inside your system. Business Data Cloud, Knowledge Graph and Domain Models feed it real business context. Governance has to move at the same pace as the access it inherits.

SECURITY

Autonomy Creates a New Security Reality

AI agents must operate within the same SoD, IAM and approval boundaries as your people. An agent must not become a superuser by design — autonomous execution is not the same as secure execution

"The AI conversation in SAP cannot be separated from the security conversation. Every AI strategy needs explicit security obligations built in from day one."

Identity & Access Control

AI agents have their own identity — not shared with human user accounts — with least-privilege authorisations

Segregation of Duties

No agent can bypass SoD rules by design or by speed. Autonomous actions stay inside the same boundaries as your people

Human Approval Gates

Payment approvals, vendor changes and privileged access require human sign-off. AI recommendation ≠ automatic execution

Audit-Proof Documentation

Every AI decision is logged — which agent, which data, which model, which approver. Auditors can reconstruct any decision chain

Continuous Threat Monitoring

Behavioural anomaly detection, not just rule-based alerts — high AI transaction volume can hide fraud and role manipulation

WHY 1DIGITALTRUST

20+ Years in SAP Security, Now Applied to AI

We understand your landscape, your modules and your risk exposure before we walk in the door. Our Data Ethics practice is a dedicated AI governance capability, built on ISO 42001, the EU AI Act and deep SAP expertise — delivered fixed-scope, with clear deliverables, clear timelines and clear price. No engagement creep.

HOW WE CAN HELP

Assessment First, Foundation Next

Direct handover and no duplicated work.

AI Governance Assessment

2–3 weeks. Delivers your AI Asset Register, an EU AI Act risk tier per use case, a maturity score across 6 governance domains, recommendations per gap, a board-ready findings report, and a roadmap into the Foundation.

AI Governance Foundation

5–7 weeks. Delivers an AI policy signed by top management, a domain AI owner structure, the intake and approval process, an SoD framework, an SAP DPA review with AI addendum, and DPIA templates.

AI Governance Managed Service

Ongoing. Keeps your governance current after go-live — quarterly classification reviews, an annual AI audit, board-level reporting, and continuous monitoring as new AI features are activated.