GUIDE: AI IN SAPAI in SAP: how to use Joule and AI agents without risking your ledger

What does SAP offer natively for AI?

SAP groups its AI under the SAP Business AI brand. In May 2026 it launched the SAP Business AI Platform, which SAP describes as “a unified architecture bringing together SAP Business Technology Platform, SAP Business Data Cloud, and AI Foundation under a single roof”, with a context layer, a build layer and a governance layer. [3]

The main components a buyer meets:

Two announcements matter for anyone planning around models. SAP and Anthropic announced plans to make Claude “a primary reasoning and agentic capability embedded across SAP’s AI-enabled solution portfolio, powered by Joule and Joule agents”. [5] SAP describes this as complementing its “open ecosystem approach to supporting any model”. [5] And SAP says Joule’s bi-directional A2A capability lets “third-party agents securely call on Joule Agents”. [4]

How is SAP Business AI licensed, and what are AI Units?

SAP’s published commercial model has three tiers. [1]

Some details that change a business case:

• AI Units are “SAP’s single virtual currency” for Premium AI, bought annually, held in one shared pool, and “unused AI Units expire after 12 months”. [1]
• An agent action is “a single step an agent takes to complete a task, such as calling a service, triggering a workflow, or generating a response”. A task can take several actions. [1]
• SAP Joule for Consultants costs 35 AI Units per assigned consultant a month, with a pooled allowance of 22,900 requests each. [1]
• Joule Work offers: existing cloud customers with AI Units get 15,000 Joule Work actions at no additional cost; new SAP cloud customers can try it with 500 AI Units free for 12 months. [2]
• Custom agents: SAP user-group material from June 2026 says running custom agents is free “through 2026” under a time-bound promotion. [9] Confirm with your SAP account executive.

On-premises S/4HANA is the catch. The same SAP user-group material says AI for on-premises ERP requires a commitment to convert at least 50% of the current annual maintenance fee into an eligible cloud ERP subscription, plus a minimum release: S/4HANA 2021 for Joule Base scenarios and 2023 for most Premium AI scenarios. [9] Joule itself is a BTP application that needs an SAP BTP enterprise account and Cloud Identity Services. [12] Treat these as the start of a conversation with SAP, not a final position.

Not licensing advice. Prices and terms are SAP’s published figures as at 8 November 2026. SAP moves features between tiers often; confirm with SAP before you build a business case.

Where does AI cut costs in SAP processes?

The best early use cases share three traits: high volume, a lot of time spent finding and reconciling data, and a human who still makes the final call. That last trait matters, because it means AI can start by answering questions and preparing drafts that a person approves.

The cost case in each row is usually time: minutes saved per question, multiplied by the number of people asking. SAP reports that one retail customer cut a purchase-order lookup from up to 10 minutes to about three seconds using a custom Joule Studio experience. [4] That is a vendor-reported figure. Measure your own baseline before you build.

Price the AI as well as the saving. An agent that takes eight actions per task costs eight times the per-action price, and hosted model tokens add up. Our guide to reducing AI costs shows how to calculate cost per outcome rather than cost per token, and the AI cost calculator runs the numbers for your workload.

Where does AI create growth in SAP?

Cost use cases are easier to prove. Growth use cases are often worth more, but they need cleaner data and a clear owner.

• Forecasting. Time-series models can forecast demand from SAP history without a custom machine learning project. SAP’s SAP-RPT-TS model is aimed at use cases such as demand forecasting in SAP IBP. [6] The gain comes from fewer stock-outs and less cash tied up in stock.
• Pricing and margin. AI can surface where discounts, rebates and freight erode margin by customer and product. An analyst asks the questions, and pricing changes still go through your normal approval.
• Customer service. Service teams answer “where is my order?” and “why was I charged this?” faster when an assistant can read orders, deliveries and invoices in one place. Keep customer-facing answers behind a human until accuracy is proven.

Growth use cases depend on master data. If customer, material or vendor records are duplicated or incomplete, fix the data the use case touches first. A practitioner on r/SAP put the gap between pilot and production down to data quality. [18]

Where AI pays off in SAP

All processesCut costsCreate growth

All eight processes shown.

Value potential

Start hereWorth it, with controls12345678

Effort and risk to start

1. 1Finance close
2. 2Procure-to-pay
3. 3Inventory
4. 4Maintenance
5. 5Order-to-cash
6. 6Forecasting
7. 7Pricing and margin
8. 8Customer service

Procure-to-pay

Where time leaks

Invoice exceptions, price and quantity mismatches, duplicate vendors

What AI does

Explains why an invoice is blocked, groups exceptions by root cause, checks vendor master quality

Example question

“Which supplier invoices are blocked for price variance, and why?”

SAP-native option

Accounts Payable Assistant

Score this for my business

quantana.com.au

Value map: eight SAP processes placed by value potential and by the effort and risk to start. Switch between all processes, cost use cases and growth use cases. Select a process for details and an example question.

Process	Use case	Where time leaks	What AI does	Example question	SAP-native option
Finance close	Cut costs	Reconciliations, chasing open items, explaining variances	Summarises open items, drafts variance commentary, flags unusual postings for review	Which open items are holding up this month’s close?	Financial Closing Assistant
Procure-to-pay	Cut costs	Invoice exceptions, price and quantity mismatches, duplicate vendors	Explains why an invoice is blocked, groups exceptions by root cause, checks vendor master quality	Which supplier invoices are blocked for price variance, and why?	Accounts Payable Assistant
Inventory	Cut costs	Slow-moving and excess stock, safety stock set by habit	Finds slow movers by plant, compares stock to consumption, explains shortages	Which materials are slow-moving at each plant?	Supply chain assistants
Maintenance	Cut costs	Reactive repairs, poor notification text, parts not ready	Summarises equipment history, groups failure notes, checks parts availability before work orders	What has failed most often on this line this quarter?	Ask SAP which agents cover your release
Order-to-cash	Cut costs	Disputes, slow collections, credit blocks	Prepares collection calls, finds the root cause of a dispute across invoices, orders and deliveries	Why is this customer disputing last month’s invoices?	Accounts Receivable Assistant
Forecasting	Create growth	Stock-outs and cash tied up in stock	Forecasts demand from SAP history with time-series models	What demand should we plan for next quarter, by product?	SAP-RPT-TS in SAP IBP
Pricing and margin	Create growth	Discounts, rebates and freight eroding margin	Surfaces where margin leaks by customer and product	Where are discounts and freight eroding margin?	Varies by product
Customer service	Create growth	Slow answers to “where is my order?” and billing questions	Reads orders, deliveries and invoices in one place to answer faster	Where is this customer’s order, and when will it arrive?	Customer experience assistants

What are the architecture options for connecting AI to SAP?

There are three broad options. Most large SAP estates end up using more than one.

1. Native Joule. Use Joule, Joule Assistants and SAP-delivered Joule Agents inside SAP’s cloud applications. SAP manages the models, grounding (through SAP Knowledge Graph) and the agent gateway, which “enforces identity, access, and policy controls at runtime”. [2] This is the lowest-effort path for SAP cloud customers and the one SAP is investing in most.

2. Extensions on SAP’s platform. Build custom agents in Joule Studio, or pro-code agents on BTP with SAP AI Core and the generative AI hub. You choose models from the hub, and SAP can generate tool servers that expose SAP business capabilities to agents, with “authentication, authorization and data governance policies baked in”. [7] Runtime is billed through your BTP agreement. [1]

3. Third-party agents through APIs. Connect agents that live outside SAP, such as Claude, ChatGPT, Gemini, Microsoft Copilot or your own agent framework, to S/4HANA through published OData APIs, usually via a tool server or gateway. SAP’s Architecture Center describes two patterns: an external tool server on a third-party platform, and a custom one on a customer-managed BTP subaccount. It also describes SAP-managed routes: a gateway in SAP Integration Suite, and A2A through the Agent Gateway. [7]

SAP is candid about the third option. Its Architecture Center says the connection standard on its own “does not add business context or improve the accuracy of AI results”, and that wiring an agent “directly to raw SAP transactional APIs without semantic enrichment leads to poor entity discovery accuracy, excessive token consumption” and more. [7] That is a strong argument for third-party access on a curated set of APIs, within each user’s permissions, with the data condensed before the agent sees it.

What does SAP’s API Policy mean for third-party AI agents?

SAP published its API Policy on 27 April 2026. [8] It matters to anyone connecting outside agents to SAP. According to SAP’s overview of the policy for user groups:

• Published APIs, those listed on the SAP Business Accelerator Hub or in SAP product documentation, are supported “for their documented usage”. [8]
• Among its general controls, the policy lists “large-scale data extraction or scraping or integration with autonomous AI agents, only via an endorsed SAP architecture”. [8]
• SAP says the policy does not force customers onto Joule: customers “can use any third-party AI platform, provided it connects to SAP through an endorsed architecture” using open protocols such as A2A. [8]
• Existing integrations “using APIs for their documented purpose are not expected to be impacted”, and SAP says it prioritises “dialogue first”. [8]
• Custom APIs in the customer namespace remain permitted, but custom code “cannot be used to circumvent the policy”. [8]

SAP’s Architecture Center sets out when third-party tool servers may access SAP APIs: the API Policy is followed in full, authentication and authorisation are enforced on every connection, the rate limits of the underlying SAP APIs are respected, and security hardening is in place. Operational responsibility “rests entirely with the customer or partner deploying it”. [7]

What this means in practice: third-party agent access to SAP is permitted, but it has to be designed, not improvised. Ask any vendor, including us, which endorsed pattern their product follows.

General information, not licensing or legal advice. Confirm your position with SAP or an SAP licensing specialist before production.

How to connect Claude to SAP

Claude never logs in to SAP itself. It calls a tool, and the tool decides what it may read, a bit like a reference desk that checks your library card before it hands over a file. With QSAP as that tool, connecting Claude to SAP S/4HANA Cloud takes seven steps:

1. Scope the use case and the data. Pick one question your team asks every week, and list the SAP data it needs, such as supplier invoices and purchase orders.
2. Set up a read-only technical user with the right SAP roles. Give it only the business roles that use case needs. QSAP also respects each person’s own SAP authorisations, so nobody sees more through Claude than they could in SAP.
3. Deploy QSAP in your cloud or ours. It runs on your infrastructure or is hosted by Quantana, and reads S/4HANA through SAP’s published OData APIs.
4. Connect QSAP to Claude as a tool. Add it as a connector in the Claude apps, Claude Code or Claude for enterprise. Sign-in uses token exchange, so Claude’s token is never passed through to SAP.
5. Test with real questions. Use the questions from step 1 and check the answers against SAP before anyone relies on them.
6. Review the audit trail. Every request records who asked, what was read and when. Walk your risk team through it before you widen access.
7. Roll out to a team. Start with one group, measure the time saved, then add the next use case.

Once it is connected, people ask in plain words:

• “Show overdue supplier invoices over A$50k by vendor.”
• “Summarise this month’s purchase price variance.”
• “Build a weekly working-capital report.”

QSAP condenses the SAP data before Claude reads it, so each question uses up to 80% fewer tokens. Claude can also spot anomalies and prepare drafts, such as a supplier follow-up or a suggested correction, which a person approves in SAP.

Connecting ChatGPT, Copilot or Gemini to SAP works the same way. QSAP works with the AI assistants your teams already use: ChatGPT (including ChatGPT Enterprise and the OpenAI API), Microsoft Copilot through Copilot Studio, and Google Gemini through Gemini Enterprise or Vertex AI. Teams that build their own agents can connect open models such as Llama, Mistral, Qwen or DeepSeek through their agent framework. Only step 4 changes.

How do you keep AI agents in SAP secure and auditable?

Six controls cover most of what an SAP owner, CISO and internal auditor will ask.

1. Questions and reports first. Begin with questions, summaries, reports and exception triage on live data. Reading data cannot change a transaction, and drafts go to a person who approves them in SAP.
2. Least privilege. Expose only the APIs and fields each use case needs. SAP’s guidance says a credential must be “scoped to the minimum permissions required by the specific tool being invoked”. [7]
3. A named identity for every agent. SAP’s guidance says a tool server “must never proxy the caller’s auth token directly to a downstream API”. It should exchange it for a scoped credential that carries the agent’s identity and “retains the original user context for data access control and audit purposes”. [7] SAP’s security guidance argues for “named identities” rather than “a shared service account”. [13]
4. A business-level audit trail. Log every tool call with caller identity, parameters (with personal data redacted), target API, response status and latency. [7] SAP makes the point well: infrastructure logs show “an API was called”; a business-process audit trail shows what changed and who approved it. [13]
5. Segregation of duties. An agent should never hold a combination of permissions that SAP Access Control would flag for a person, such as creating a vendor and releasing payments to it. [14] Run agent identities through the same analysis as people.
6. Masking and rate limits. Mask or redact sensitive fields, such as bank details and personal data, before an agent sees them, and set rate limits that sit below SAP’s own API limits. When an agent prepares a draft, SAP’s principle applies: “the model can propose; but the application decides.” [13]

Add input validation on every tool call and regular testing for prompt injection. [7]

QSAP builds these controls in: field-level masking and redaction of sensitive data, rate limiting, each user’s SAP authorisations respected, token exchange with no token pass-through, and a full audit record of every request, showing who asked, what was read and when.

What happens between the question and the answer

AllowedSensitive fieldsOut of scope

Replay

User asks their AI assistant“Which supplier invoices are blocked for price variance this month, and why?”

1. 1Who is asking?Single sign-on identity verified
2. 2Is this assistant registered?Token exchanged for a scoped credential, never passed through
3. 3Is this request allowed?Tool and parameters match the allow-list
4. 4Within rate limits?Under the limit for this user and assistant
5. 5Within this user’s SAP authorisations?The user’s SAP roles allow this data
6. 6Read from S/4HANARead through OData; answer returned
7. 7Record the requestWho asked, what was read and when, on record

Audit log

What the user sees…

Every request stays within the user’s SAP permissions, sensitive fields are masked, and every step is on record, including stopped requests.

quantana.com.au

Request flow: an AI assistant’s request to SAP S/4HANA passes identity, token exchange, allow-list, rate-limit and SAP authorisation checks before an OData read with sensitive fields masked, and every step is recorded in the audit log. Three scenarios: an allowed question, a question touching sensitive fields, and out-of-scope data that is stopped.

Check	Allowed	Sensitive fields	Out of scope
Who is asking?	Single sign-on identity verified	Single sign-on identity verified	Single sign-on identity verified
Is this assistant registered?	Token exchanged for a scoped credential, never passed through	Token exchanged for a scoped credential, never passed through	Token exchanged for a scoped credential, never passed through
Is this request allowed?	Tool and parameters match the allow-list	Tool and parameters match the allow-list	Tool and parameters match the allow-list
Within rate limits?	Under the limit for this user and assistant	Under the limit for this user and assistant	Under the limit for this user and assistant
Within this user’s SAP authorisations?	The user’s SAP roles allow this data	The user’s SAP roles allow this data	Stopped: outside this user’s SAP authorisations
Read from S/4HANA	Read through OData; answer returned	Read through OData; bank details masked	Not reached
Record the request	Who asked, what was read and when, on record	Who asked, what was read and when, on record	Who asked, what was read and when, on record

What does APRA expect when AI touches SAP?

For banks, insurers and super funds, SAP is often where critical operations run, so AI connected to it falls squarely under existing prudential standards. APRA’s April 2026 letter says “existing prudential standards apply to AI risk” and asks for, among other things, “human involvement for high-risk decisions and accountability” and “controls over agentic and autonomous workflows”, including identity and access for non-human actors. [16]

In practice that maps onto the controls above. CPS 234 expects information assets classified by sensitivity and controls tested by independent specialists, which applies to the SAP data an agent can read. CPS 230 expects you to manage material service providers and the fourth parties behind them, which includes the model provider behind a hosted agent. [17] A least-privilege access layer that masks sensitive data and records every request gives your risk team evidence for both.

Our private AI guide covers the APRA letter, CPS 230 and CPS 234 in detail, and when to run models on your own infrastructure.

General information, not legal advice. APRA material as at 6 November 2026, with links to the primary source.

Which option should you choose?

Which SAP AI route fits?

SAP deployment

Public cloudPrivate cloud or RISEOn-premises

Where people work

SAP appsMicrosoft or Google toolsOur own AI assistantMixed

What should AI do first?

Answers and reportsBothWorkflows inside SAP

Data sensitivity

InternalConfidentialRestricted

In-house SAP BTP skills

NoneSomeStrong

Best fit: Governed third-party access. Governed third-party access scores 8; Native Joule scores 7; Platform extensions scores 7.

Governed third-party accessBest fit

Claude, ChatGPT, Copilot or your own agents reach SAP through a governed access layer, on record.

Score 8

Native Joule

Joule, Joule Assistants and SAP-delivered agents inside SAP’s cloud apps.

Score 7

Platform extensions

Custom agents in Joule Studio or on SAP BTP with SAP AI Core.

Score 7

Get your AI roadmapCompare QSAP and Joule

How this works

Each answer adds points to each route, and the highest score wins. When the top two are within 10 per cent, the sorter suggests combining them.

• SAP deployment: Public cloud (Native Joule +3, Platform extensions +2, Governed third-party access +1); Private cloud or RISE (Native Joule +2, Platform extensions +2, Governed third-party access +2); On-premises (Native Joule +0, Platform extensions +1, Governed third-party access +3).
• Where people work: SAP apps (Native Joule +3, Platform extensions +1, Governed third-party access +0); Microsoft or Google tools (Native Joule +0, Platform extensions +1, Governed third-party access +3); Our own AI assistant (Native Joule +0, Platform extensions +2, Governed third-party access +3); Mixed (Native Joule +2, Platform extensions +1, Governed third-party access +2).
• What should AI do first?: Answers and reports (Native Joule +1, Platform extensions +1, Governed third-party access +2); Both (Native Joule +2, Platform extensions +2, Governed third-party access +1); Workflows inside SAP (Native Joule +3, Platform extensions +2, Governed third-party access +0).
• Data sensitivity: Internal (Native Joule +1, Platform extensions +1, Governed third-party access +1); Confidential (Native Joule +1, Platform extensions +1, Governed third-party access +1); Restricted (Native Joule +0, Platform extensions +1, Governed third-party access +2).
• In-house SAP BTP skills: None (Native Joule +2, Platform extensions +0, Governed third-party access +2); Some (Native Joule +1, Platform extensions +2, Governed third-party access +1); Strong (Native Joule +0, Platform extensions +3, Governed third-party access +1).

quantana.com.au

Route sorter: choose your SAP deployment, where people work, what AI should do first, data sensitivity and BTP skills to score native Joule, platform extensions and governed third-party access.

Route	Score	Status
Governed third-party access	8	best fit
Native Joule	7	option
Platform extensions	7	option

What does a 90-day SAP and AI roadmap look like?

Ninety days is enough to prove one or two use cases in production, within existing SAP permissions, with evidence your risk team can sign off. Our AI roadmap guide covers the full method; this is the SAP version.

Want us to do the mapping with your data? Get your AI roadmap.