Concept card

Data Governance — GDPR & EU AI Act for SAP Analytics

As of 2026-09-27

Edited by Cédric Mary, sole editor and publication director — 27 years in the SAP ecosystem. How these pages are produced, and where automation is used.

What is Data Governance?

GDPR (Art. 6, 5(1)(c), 15-22) and the EU AI Act (Art. 9-49, high-risk obligations effective 2027-12-02 (Digital Omnibus, in force since 2026-07-27)) both bind SAP analytics architecture decisions directly — and each high-risk AI system requires 200-800 person-days of compliance work.

What it is

Two European regulations now bound every SAP analytics programme deployed in the EU: the General Data Protection Regulation (Regulation EU 2016/679, in force since May 2018) and the Artificial Intelligence Act (Regulation EU 2024/1689, with high-risk obligations effective 2027-12-02 (Digital Omnibus, in force since 2026-07-27)). Together they govern what data analytics platforms can collect, how AI features can use it, and what documentation must accompany each high-risk deployment. The SAP analytics consultant cannot delegate this to the customer's legal team — the architecture choices made at design time decide whether the customer is compliant or carries a measurable regulatory liability.

GDPR's analytics surface. The four pillars that hit analytics directly: lawful basis (Art. 6 — every personal data processing in an analytic model needs a documented basis: consent, contract, legitimate interest, legal obligation), data minimisation (Art. 5(1)(c) — analytics should hold only what is necessary for the purpose; a Story showing customer-level transaction history needs a different basis than aggregated revenue by region), purpose limitation (data collected for sales analytics cannot be repurposed for HR analytics without a fresh basis), and rights of the data subject (Art. 15-22 — access, rectification, erasure, portability, objection; analytics platforms must support the upstream-source rectification cascade).

Why it matters

A Story showing customer-level transaction history needs a different Art. 6 legal basis than one showing aggregated revenue by region — granularity itself changes the compliance requirement.
Data collected for sales analytics cannot be repurposed for HR analytics without a fresh legal basis under the purpose-limitation principle.
High-risk AI use cases (credit scoring, hiring, biometric ID, among others) carry documented obligations for risk management, data governance, and human oversight before deployment.

Key points

GDPR (EU 2016/679) — in force since May 2018; Art. 6 lawful basis, Art. 5(1)(c) data minimisation, Art. 15-22 data subject rights, applies to every analytic model containing personal data.
EU AI Act (EU 2024/1689) — high-risk obligations effective 2027-12-02 (Digital Omnibus, in force since 2026-07-27); general-purpose AI obligations effective 2027-08-02 per §17.11 ledger.
Annex III high-risk domains — credit, hiring, education, public service, law enforcement, justice, migration, biometric ID; 200-800 person-days of compliance work per high-risk system.
Art. 9-49 obligations — risk-management system, data governance, technical documentation, record-keeping, transparency, human oversight, accuracy, robustness, cybersecurity.
Fines — up to 7% of global turnover for prohibited-systems violations, 3% for high-risk non-compliance under the AI Act; GDPR fines separately reach up to 4% of global turnover or €20 million.
Since 22 Sep 2026, SAP's AI Agent Hub inventories Joule agents/LLMs/MCP servers and auto-classifies AI Act/NIST risk — a starting inventory, not a substitute for the Art. 6 GDPR lawful-basis question.
The AI Act classification test depends on what a score is used to decide (employment, credit, essential services), not on how sophisticated the underlying model is.

Terms used on this page

Lawful basis (Art. 6 GDPR): The legal ground under which personal data is processed — one of six: consent, contract, legal obligation, vital interests, public task, legitimate interest; documented per processing activity in the record of processing (Art. 30).
High-risk AI system (Art. 6 EU AI Act): An AI system classified as high-risk under Annex III or as a safety component under Annex I; carries full Art. 9-49 compliance obligations including risk management, data governance, technical documentation, and human oversight.
Annex III: The EU AI Act schedule listing eight high-risk use-case domains: biometric ID, critical infrastructure, education, employment, public services, law enforcement, migration, justice; any AI system within these domains is high-risk.
Data Protection Officer (DPO): The GDPR-required role for organisations doing systematic monitoring or processing of special-category data on a large scale; the DPO advises on compliance and is the contact point for the supervisory authority.
Legitimate interest (Art. 6(1)(f) GDPR): A lawful basis allowing processing when it is proportionate to a genuine business need and a documented balancing test favours the controller over the data subject's interests.
Record of processing (Art. 30 GDPR): The documented inventory every controller must keep of its processing activities, including the lawful basis relied on for each — the artefact where an Art. 6 decision for an analytic model gets recorded.
AI Agent Hub (SAP): SAP's cross-vendor registry and governance layer for agents, LLMs and MCP servers; since 22 Sep 2026 its AI Governance Assistant auto-classifies EU AI Act / NIST risk when an inventoried scenario changes.

Sources

Full card available to members. What the full card adds: the full decision framework · the SAP vs Snowflake / Databricks / Fabric comparison · the common pitfalls and their fix · the cheat sheet · the architecture schemas · the code blocks · the facts worth quoting.

Open in the app →