An ERP System Designed for Failure

SAP ERP is more than just an optimal AI engine

The most fundamental risk posed by agentic AI in business-critical ERP environments lies in the potential uncontrollability of autonomously operating algorithms. While traditional software operates in a strictly deterministic manner, AI agents operate probabilistically. An autonomous Joule agent that independently manages supply chains, places orders, or makes financial entries without visual oversight requires error-free, flawless master data quality and absolute system stability. An autonomous AI could procure the missing data and would stop at nothing to do so, because it has only one objective: to optimize the result based on the given prompt.

Since these prerequisites are simply not met in the historically evolved data landscapes of most existing customers, erroneous AI decisions running in the background pose a risk of astronomical economic damage. If an AI agent, based on faulty data or a hallucination in the linked language model, concludes that a business process is inefficient and, in the worst-case scenario, arbitrarily manipulates or even deletes the ERP database, the very existence of the entire company is at stake.

Human in or above the loop

Without rigorous human oversight—the absolutely essential „human-in-the-loop“ or „human-above-the-loop“ approach —the uncritical use of such systems in the highly sensitive ERP sector is simply irresponsible, as machines cannot grasp the complex variables and the overall business context. AI systems lack understanding, but they perfectly compensate for this by “optimizing” the task at hand.

When examining the technical implementation of the SAP Business AI Platform, the Knowledge Graph, and the Joule assistant, a skeptical existing AI customer encounters a highly proprietary, closed system. SAP users are presented with a black box: Access to the central Knowledge Graph—which is intended to provide agents with semantic context—remains exclusively restricted to SAP. Customers can neither modify the Knowledge Graph nor see in detail how the routing of the language models based on it works within the Generative AI Hub (SAP BTP).

SAP BTP and SAP API Policy

Even the LLM, which is typically powered by Joule, remains a mystery to customers. By requiring, through the Clean Core guidelines, that customers develop their own agents exclusively in Joule Studio on the Business Technology Platform (SAP BTP), SAP is effectively blocking traditional, flexible ABAP development at its core. This is compounded by the restrictive new API policy that SAP enacted in the spring of 2026: SAP is erecting a digital tariff barrier here and drastically restricting API usage for systematic data extraction and integration with external, generative AI systems from third-party providers.

As a result, existing customers are artificially forced to use expensive, in-house platforms such as Datasphere or the Business Data Cloud (SAP BDC), while alternative, more flexible AI solutions from partners are systematically blocked. Furthermore, anyone who attempts to deeply integrate unstructured third-party agents into their S/4 landscape risks completely destabilizing the painstakingly built Clean Core architecture through new technical debt and uncoordinated data flows.

Security for AI and Agentic AI

From an IT security perspective, the integration of artificial intelligence into the S/4 environment represents an entirely new dimension of threat for which traditional frameworks are ill-prepared. Cyber resilience is vital for survival in a threat landscape that changes daily, yet SAP security is still treated as an inaccessible black box and a blind spot in many companies.

Thanks to AI, cybercriminals operate with a high degree of automation and efficiency today. Attackers „now speak ABAP“ and can analyze and exploit security vulnerabilities en masse in a matter of seconds. This particularly affects those business-critical core systems that, due to a lack of maintenance windows, often go unpatched for years and thus pose the highest risk.

On top of that, traditional security tools are completely unable to detect SAP-specific threats, such as malicious code injections or manipulated file uploads via standard interfaces. According to expert reports, the BTP—the linchpin of SAP’s AI strategy—also suffers from a glaring lack of effective governance, robust security structures, and best practices.

SAP Basis (CCoE) vs. Security

The organizational separation between SAP Basis teams and the overarching IT security function leads to dangerous silos that make it extremely difficult to effectively defend against attacks. When hybrid environments consisting of on-premises systems, private clouds, and hyperscalers are combined, all transparency regarding data flows, access rights, and security statuses is lost. The only effective defense left for existing customers is therefore to establish a strict zero-trust architecture, in which—in accordance with the principles of authenticity and confidentiality—no user, device, or AI agent is blindly trusted—even if access originates from the internal corporate network. Wherever AI attempts to achieve the optimal result, there will be a battle among IT systems.

For an S/4 system, these security risks intensify dramatically in the age of agents, as autonomous AI agents operate across trust boundaries (see OpenAI), make far-reaching decisions (final optimization), and process sensitive corporate data (security). Linking SAP data with external large language models (LLMs) poses a massive risk of data leaks, as customers’ personal information or protected intellectual property rights could inadvertently find their way into the hyperscalers’ training data.

New regulatory requirements, such as the EU AI Act, therefore mandate comprehensive, continuous risk assessment and mandatory human oversight mechanisms for such critical AI workloads, which significantly increases the administrative burden on companies.

Cloud First, AI First—But Security First

How is SAP CEO Christian Klein positioning himself in light of this crisis-ridden security landscape? Internally, Klein has declared a strategic emergency (Code Red) and made AI adoption a top priority. At the same time, he is reassuring the nervous stock market and concerned customers by repeatedly emphasizing that AI will not replace existing standard software, but rather urgently needs it as a stable anchor for data quality and process logic.

On the topic of security, SAP leadership refers to the company’s own security commitment to „Responsible AI“ and points to the SAP Trust Center. They assure customers that customer data is protected on the SAP AI Core through technical filters, data masking, and content filtering, and is not used to train third-party LLMs.

Yet Christian Klein uses these seemingly legitimate arguments for security and stability in the same breath to push for the isolation of the SAP ecosystem. Under the guise of data protection, SAP blocks high-performance interfaces for third-party providers in order to cement commercial vendor lock-in. Just how hollow the Walldorf-based company’s security promise is in a geopolitically unstable world became abundantly clear when the U.S. government blocked access to Anthropic’s models—Claude —the cognitive brain of Joule—for European users, causing the much-hyped SAP Autonomous Enterprise to suffer an embarrassing, uncontrollable meltdown overnight.