AI Governance & the EU AI Act for SAP Delivery
As of 2026-10-04
The EU AI Act (Regulation (EU) 2024/1689) has applied in stages since 2025, and the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) moved the stand-alone high-risk obligations (Annex III: HR, credit scoring, critical infrastructure, education…) to 2 December 2027 and product-embedded high-risk systems to 2 August 2028. Prohibitions, AI literacy and the general-purpose AI rules already apply, and the Article 50 transparency duties apply since 2 August 2026. For an SAP delivery team the work is concrete: inventory every AI feature, classify it against Article 6 and Annex III with a written rationale, settle who is provider and who is deployer, design human oversight and logging into the build, and keep a technical file that grows with the system. The deferral is time to build, not permission to wait.
What you will learn
- State the EU AI Act calendar in force on 23 September 2026, including the Digital Omnibus changes (Annex III to 2 December 2027, Annex I to 2 August 2028, Article 50 from 2 August 2026)
- Classify an SAP AI feature against Article 5, Annex III, Article 6(3) and Article 50 and write a defensible rationale citing the guidance version used
- Allocate provider, deployer and supplier roles for SAP-delivered, partner and custom systems, including the Article 25 traps and the Article 25(4) written agreement
- Turn Articles 9–15, 17, 26, 27, 49, 72–73 and 86 into dated, owned deliverables inside an SAP delivery plan
Module overview
The EU AI Act (Regulation (EU) 2024/1689) is the binding frame for every AI system placed on the EU market or used in the EU, including the Joule skills, retrieval pipelines, predictive models and agents a consultant builds on SAP Business Technology Platform, SAP Business Data Cloud and SAP AI Core. (SAP BTP has since been renamed SAP Business AI Platform, announced at SAP Sapphire 2026.) The question a senior consultant is paid to answer is not whether AI is regulated, but which of the client's AI features fall into which risk class, who carries which obligation, and what the delivery plan has to contain so that the answer can be proven later. This module teaches that answer as it stands on 23 September 2026, after the Digital Omnibus on AI changed the calendar.
Prerequisites
- Intermediate hands-on experience on SAP analytics or AI projects
- Review core concepts first: C029, C134, C194
Outcomes
- Explain to a CFO sponsor what the Digital Omnibus deferred, what it did not, and why the design work starts now
- Produce an AI inventory and classification register for a client landscape (Joule, SAP AI Core, SAP Databricks, SAC predictive features) with legal sign-off on borderline cases
- Design human oversight, logging (six-month deployer retention) and an incident-reporting drill against the 15/2/10-day windows
- Map AI Act evidence onto artefacts the client already runs — Datasphere/BDC lineage, GDPR DPIAs, ISO/IEC 42001 — without creating a parallel bureaucracy
Full module available to members. The full module adds: the decision framework · the end-to-end scenario walkthrough · the KPI scorecard · the anti-patterns · the code blocks · the knowledge check · the diagrams.