Skip to content
Initial call

AI and data protection

How we use language models on SAP data – and where the limits are.

Arrange an initial call

Data flow

From SAP to the result – in five stages.

Data flow in five stages
  1. SAP S/4HANA
  2. Read-only access
  3. Language model, SAP-compliant
  4. Control and approval
  5. Result

Our rules

  • Read-only access with your authorizations.
  • Data masking before the model, wherever possible.
  • Models only via SAP AI Core or a platform you have approved.
  • We only use model access where the use of your data for training is contractually excluded.
  • Every request is logged, every statement cites its source.
  • A human decides before anything is posted or published.
  • Data stored in the region you specify.

Data masking: SAP documentation on SAP AI Core (orchestration), as of October 2026

Legal framework

SAP API Policy and EU AI Act.

SAP API Policy

Since 27 April 2026, SAP has prohibited API use by (semi-)autonomous and generative AI systems outside architectures approved by SAP. We only design on these routes.

Source: SAP API Policy, version 4.2026a, § 2.2.2

EU AI Act

  • 2 Feb 2025AI literacy obligation
  • 2 Dec 2027High-risk obligations under Annex III

Typical finance applications such as reconciliation, close support or variance commentary are not listed in Annex III; we assess the classification case by case. No legal advice.

Sources: European Commission (AI Act Service Desk), AI Act Art. 113 as amended

GDPR

  • Data processing agreement
  • Support with the data protection impact assessment
  • No solely automated decisions (Art. 22 GDPR)

Contact

Let’s talk about your SAP project.

Arrange an initial call

Yassine Ruschkowski

Managing Partner · your contact

Reply within one business day