Sovereign AI on SAP — Architecture and Decision Guide for Regulated EU Customers

What you will learn

• Separate the five layers of sovereignty (residency, operational, technical, legal, model/agent) and say which question residency does not answer
• Describe the four EU AI Cloud deployment options with their status, date and one limit each
• Trace a Joule or Joule Studio request hop by hop and name the control that applies at each hop (orchestration masking, grounding region, model host, agent runtime, log)
• Classify AI workloads by data class and route each to a minimum sovereignty tier with an allow-listed model set
• State which EU AI Act dates bind a deployer in October 2026 after the Digital Omnibus, and what did not move
• Write a sovereignty recommendation that separates generally available, Early Adopter Care and announced capabilities and lists what SAP has not announced

Who this is for. You already deliver SAP data and AI work — Datasphere or BDC models, Joule rollouts, generative AI hub prototypes — and a regulated European customer (a bank, insurer, hospital group, utility or public body) has just asked the question that stops most AI programmes: "Where does our data go, who can compel access to it, and which model reads it?" This module gives you the architecture and the decision procedure to answer that precisely. It assumes M333 (AI & LLM fundamentals) and M325 (generative AI hub hands-on), builds on M364 (masking and filtering) and M050 (AI governance and the EU AI Act), and does not repeat them. The goal is narrow and commercial: know which sovereignty options SAP actually offers, which parts are generally available and which are announced, how to route workloads across them, and how to write a defensible recommendation instead of repeating "sovereign" as a slogan.

1. Why sovereignty is a stack, not a checkbox

"Sovereign AI" is used for at least five different things, and a customer who says it usually means only one of them. Separate them before you design anything:

Prerequisites

• Completion of M333 (AI & LLM Fundamentals for SAP Consultants) and M325 (SAP Generative AI Hub hands-on) or equivalent working knowledge of orchestration, grounding and masking
• Working knowledge of GDPR roles (controller, processor) and of the EU AI Act risk tiers; M050 (AI Governance & the EU AI Act for SAP Delivery) is recommended
• Optional: read access to SAP Roadmap Explorer and help.sap.com to confirm the current status of any capability before quoting it to a client

Outcomes

• Explain to a regulated client which sovereignty layer each SAP option covers and which it does not, with status, date and source.
• Produce a workload register that routes each AI use case to a minimum sovereignty tier, an allow-listed model set and a named human approver.
• Design the evidence plan (logging, retention, readers, inspector drill) that makes a sovereign design auditable.
• Apply the EU AI Act dates after the Digital Omnibus correctly: what moved to 2027-2028 and which duties (Article 50 transparency) stayed on 2 August 2026.