Concept card

Data Governance — GDPR & EU AI Act for SAP Analytics

As of 2026-07-23

Edited by Cédric-Olivier Mâry, sole editor and publication director — 27 years in the SAP ecosystem. How these pages are produced, and where automation is used.

What is Data Governance — GDPR & EU AI Act for SAP Analytics?

GDPR (Art. 6, 5(1)(c), 15-22) and the EU AI Act (Art. 9-49, high-risk obligations effective 2026-08-02) both bind SAP analytics architecture decisions directly — and each high-risk AI system requires 200-800 person-days of compliance work.

What it is

Two European regulations now bound every SAP analytics programme deployed in the EU: the General Data Protection Regulation (Regulation EU 2016/679, in force since May 2018) and the Artificial Intelligence Act (Regulation EU 2024/1689, with high-risk obligations effective 2026-08-02). Together they govern what data analytics platforms can collect, how AI features can use it, and what documentation must accompany each high-risk deployment. The SAP analytics consultant cannot delegate this to the customer's legal team — the architecture choices made at design time decide whether the customer is compliant or carries a measurable regulatory liability.

Why it matters

A Story showing customer-level transaction history needs a different Art. 6 legal basis than one showing aggregated revenue by region — granularity itself changes the compliance requirement.
Data collected for sales analytics cannot be repurposed for HR analytics without a fresh legal basis under the purpose-limitation principle.
High-risk AI use cases (credit scoring, hiring, biometric ID, among others) carry documented obligations for risk management, data governance, and human oversight before deployment.

Key points

GDPR (EU 2016/679) — in force since May 2018; Art. 6 lawful basis, Art. 5(1)(c) data minimisation, Art. 15-22 data subject rights, applies to every analytic model containing personal data.
EU AI Act (EU 2024/1689) — high-risk obligations effective 2026-08-02; general-purpose AI obligations effective 2027-08-02 per §17.11 ledger.
Annex III high-risk domains — credit, hiring, education, public service, law enforcement, justice, migration, biometric ID; 200-800 person-days of compliance work per high-risk system.
Art. 9-49 obligations — risk-management system, data governance, technical documentation, record-keeping, transparency, human oversight, accuracy, robustness, cybersecurity.
Fines — up to 7% of global turnover for prohibited-systems violations, 3% for high-risk non-compliance.
Data Governance — GDPR & EU AI Act for SAP Analytics is mastered only when it changes a named buyer decision.
Start with the semantic contract and control model before demonstrating the tool.
Use current SAP, analyst, study, KG, and news signals as evidence, not decoration.
Separate verified facts from directional trends and modeled assumptions.
Define owner, metric, threshold, support path, and rollback before scaling.

Terms used on this page

Lawful basis (Art. 6 GDPR): The legal ground under which personal data is processed — one of six: consent, contract, legal obligation, vital interests, public task, legitimate interest; documented per processing activity in the record of processing (Art. 30).
High-risk AI system (Art. 6 EU AI Act): An AI system classified as high-risk under Annex III or as a safety component under Annex I; carries full Art. 9-49 compliance obligations including risk management, data governance, technical documentation, and human oversight.
Annex III: The EU AI Act schedule listing eight high-risk use-case domains: biometric ID, critical infrastructure, education, employment, public services, law enforcement, migration, justice; any AI system within these domains is high-risk.
Data Protection Officer (DPO): The GDPR-required role for organisations doing systematic monitoring or processing of special-category data on a large scale; the DPO advises on compliance and is the contact point for the supervisory authority.
Decision owner: The accountable person who accepts the trade-off and funds the next action.
Semantic contract: The shared definition of business terms, metrics, entities, and access rules used by tools and teams.
Control plane: The layer that applies policy, access, lineage, monitoring, and escalation across the operating model.
Evidence grade: A label that separates verified fact, directional signal, modeled assumption, and field observation.

Sources

Full card available to members. What the full card adds: the full decision framework · the SAP vs Snowflake / Databricks / Fabric comparison · the common pitfalls and their fix · the cheat sheet · the architecture schemas · the code blocks.

Open in the app →