SAP’s new policies on AI access are making CIOs question their current agent-based infrastructure to browse and act on SAP’s ERP. New SAP API policy specifies that AI workloads be directed via approved interfaces and guidelines as to when raw ERP data is accessed. Though SAP’s major emphasis is on native software like BDC, BTP and Joule, the key limitation applies to third-party agents accessing sensitive data without restriction.
The direct catalyst is SAP’s restriction on unrestricted Operational Data Provisioning via Remote Function Calls (ODP-RFC). A security patch on June 9, 2026 verifies ODP-RFC calls and declines one that isn’t aligned with SAP’s approved set of subscribers. SAP and integration providers have indicated that a temporary opt-out route is available only for a limited period and should be exercised at the earliest.
For CIOs, the issue is bigger than one connector or one policy update.
Why is SAP Tightening Access
There’s a governance, security, system stability, and intellectual property angle to SAP’s concern. An AI agent can make thousands of repetitive, automated calls, volumes that would be impossible for conventional user-driven integrations. A badly behaving agent without stricter controls could pose operational risk, a data breach, or an overload on key ERP systems.
A senior CIO from a chemical giant says, “It is also possible that the vendor is apprehensive about giving complete access because it fears reverse engineering. Today, low-code and no-code platforms have made software development very easy. With unabated access to its solution, SAP may fear that its IP can be used to build something similar.”
The policy therefore reflects both a technical and strategic concern. SAP aims to allow access to ERP data from outside tools via governed interfaces, with authentication, identity awareness, usage monitoring, and enforceable rules in place. For third-party agent access, SAP’s reference architecture stipulates that the external agent must be authenticated by SAP Cloud Identity Services; the gateway then decides whether or not the agent has permission to talk to the target SAP service.
That is a reasonable governance objective, especially when agents move from answering questions to creating orders, updating supplier records or approving transactions. However, CIOs argue that the controls must not become a mechanism for limiting choice or charging repeatedly for access to enterprise data.
While enterprise technology leaders agree that a greater degree of oversight is necessary, they also want cost certainty, feasible interoperability, and flexibility to choose the AI stack of their liking.
Challenge No 1 for CIOs: Architecture Reset
On SAP’s new posture Sanchit Vir Gogia, Chief Analyst at Greyhound Research, says the shift requires CIOs to validate their existing AI designs before taking them into production.
“SAP’s policy does not stop AI use but it forces a re-check of whether existing AI setups comply with SAP’s rules before going live. CIOs cannot sign off on a rollout merely because a pilot worked. They need to confirm that the architecture, connector and data-access route will still be permitted in production.”
Qlik, for instance, has confirmed that SAP’s restrictions affect its connectors that use ODP-RFC for bulk extraction to non-SAP systems. SAP’s temporary opt-out mechanism may allow continued use in the short term, but that option is expected to be disabled at the end of 2026.
SAP has gone further to state that organizations won’t be able to make a non-compliant setup compliant just by putting a proxy, gateway or custom middleman in front of it. In other words, putting another layer of software around an impermissible AI agent is not going to be the solution.
This assumes significance for CIOs. A proof of concept may have worked by pulling SAP data into an external environment through a legacy connector, custom extraction method or ODP-RFC interface. But the same setup may now require reassessment, remediation or a move to a supported integration pattern.
Challenge No 2 for CIOs: Data Reconciliation
For a large number of CIOs, the transaction data in SAP alone does not hold true value. The business interpretation stored in the SAP system (such as definitions, hierarchies, the relationships between processes, rules on currency, security roles, the years of application logic) is what is invaluable.
A Delhi-NCR-based global CIO of an infrastructure developer says that transferring raw ERP data to a data lakehouse without that context can reduce its value dramatically.
“Whenever you bring data to a data lake, SAP will not let you bring the meaning easily. You bring numbers—1, 2, 3, 2, 3, 4. It could be sales, purchase, anything. You assign meaning to this data in the data lake manually. But is that humanly possible? ERP systems like SAP have existed for so long and contain so much embedded intelligence that it’s impossible to manually handle it,” he says.
SAP has positioned BDC as a data and intelligence layer with zero-copy integration options, including its partnership with Databricks. The promise is that companies can analyze data in near real time without creating uncontrolled copies or losing business context.
The global CIO argues that SAP’s preferred BDC route could centralize not only data governance but also the commercial value created around enterprise AI. “They don’t want to let this revenue go out of their hand. They are trying to create all the possible hurdles in between,” he says.
To follow the rules and align with SAP’s policy, a senior CIO from a large manufacturing company based in Gurugram is moving to a “two‑layer” setup.
“SAP stays as the system of record for finance, supply chain, etc. Data is extracted in a controlled way (via CDS views and the semantic layer) into an external cloud data lakehouse, where AI models do their heavy thinking and combine SAP data with other sources. When AI needs to take action inside SAP (create an order, update a record), it writes back only through SAP BTP, with proper authentication and logging. Inside SAP itself, Joule is used for routine, in‑system tasks like navigating Fiori apps, while more advanced, cross‑source AI runs outside SAP on the data lakehouse,” he says.
But this arrangement is far from perfect. “The catch is that this clean, compliant design comes with trade‑offs. The semantic layer correctly reflects SAP’s business logic, currencies and security roles, but it does not automatically fix dirty master data (duplicates, inconsistencies) and is still too slow for some real‑time, sub‑second agent scenarios when pulling from many systems at once,” says the CIO.
While this architecture provides companies with space to extend into Databricks, Snowflake, AWS, Microsoft Azure, Google Cloud or other AI platforms, it also requires more integration, more governance and more company-wide data management.
This is the key reason why CIOs are concerned that the policy could lead to a costly architecture that does little to address the fundamental issue that keeps AI from going beyond pilots: bad data quality in the enterprise.
Challenge No 3 for CIOs: The Product Readiness Gap
A further concern is that some of SAP’s preferred AI access routes are still maturing.
SAP supports third-party Model Context Protocol, or MCP, access through governed approaches and positions Agent2Agent, or A2A, protocols as appropriate for broader multi-agent interoperability. However, SAP’s own architecture documentation says that bidirectional communication with third-party and self-hosted agents through its Agent Gateway is not yet supported.
That creates a gap between policy direction and product readiness. CIOs may be told to use governed SAP pathways, while some of the capabilities needed for fully functional two-way agent integration are still emerging.
Gogia says this gap must be recognized in planning. “A signed contract or a product announcement is not the same as a working production deployment. There is a journey from setting up the environment and migrating data to running analytics and deploying an agent that can safely act on ERP data,” he says.
This is especially relevant for Indian enterprises with complex SAP landscapes, custom code, multiple business units, legacy interfaces and heterogeneous data estates. Their path to compliant AI will not be a simple connector replacement.
The global CIO flags another problem. “BDC is not that mature. It is very nascent. Even their partnership with Databricks only solves for the core ERP data. What about the broader vision of a corporate knowledge layer or knowledge graph? To achieve that, you cannot rely solely on the ERP; you need the CRM, the MES, time-series data, and shop-floor sensor data. You need to ingest all of this information into one centralized place to form a cohesive company knowledge graph,” he says.
SAP’s policy governs the method of access (the interface pattern), not the vendor of the AI tool. However, using non-SAP products to meet these standards often requires significantly more integration effort than simply adopting SAP’s native stack.
Challenge No 4 for CIOs: The Cost Concern
The most immediate concern among CIOs is not only access but it is the unpredictability of cost.
The CIO from the manufacturing company describes what may become a “double-cost” model.
“Financially, the company is now paying twice: for BTP capacity and API calls on the SAP side, and for cloud data lakehouse storage and AI compute on the hyperscaler side. On top of that, because SAP is monetizing API calls, especially from autonomous agents, there is a real risk of fast‑growing, hard‑to‑predict bills,” he says.
SAP says its policy does not create a new charge merely for API access through approved architectures. But CIOs point out that existing Digital Access rules can still create billable events when an external system, bot or automated process creates documents in SAP.
The critical distinction is between an AI system that reads data and one that acts on the ERP system. A read-only assistant might respond to a query regarding inventory, procurement or receivables. An agent that creates a sales order, updates a vendor record, initiates a purchase requisition or approves a purchase transaction may generate licensing, audit and governance concerns.
A CIO shared an example where a procurement agent has thousands of API calls a day to validate inventory, lead times and supplier performance. As per the existing Digital Access rules, a read-only agent may not create a licensing event, but the same agent creating purchase requisitions or orders could. Add BTP integration costs, data lakehouse storage and AI compute, and the monthly bill becomes hard to model in advance.
Gogia says SAP needs to provide much more clarity. “An AI agent that reads data may not trigger a licensing event, but an agent that creates a sales order could count as a billable document. SAP should set out plainly how agent-created documents are counted under each license model.”
There is also concern about fair-use limits. SAP manages call volumes through usage controls, but CIOs do not have published numerical thresholds that would allow them to model the impact of high-frequency AI-agent workloads in advance. That is particularly worrying because autonomous agents are designed to make repeated, machine-speed calls, often near the upper end of normal system activity.
The Road Ahead
India has a big SAP footprint in BFSI, manufacturing, pharma, energy and large conglomerates. Its SAP landscape is often multi lingual, heavily customized and tied to non-standard interfaces with sector-based legal and compliance requirements, besides high cost sensitivity.
Going ahead, the path is clearer: companies will need tighter governance as AI takes a more central role in the ERP system. The CIO test is whether that governance will also preserve interoperability, transparent pricing and portability going forward. Without those, companies may end up with a more automated AI environment but one that will leave their negotiating power and ability to innovate behind.
The core tenet of design is modularity, which means companies should be able to change their AI model, lakehouse or data platform over the years without having to redo integrations, identity and business processes to work with a single vendor.
For SAP’s legacy customers it’s not practical to turn your back on SAP altogether. A more likely scenario is that SAP will be used as the primary source of record and transaction layer, complemented by an ecosystem of outside platforms providing cross-source analysis, reasoning and processing for part of their workloads. But CIOs must guard against sacrificing the autonomy to use multiple AI platforms rather than choosing one platform as becoming the sole gatekeeper.
As Gogia says, “This is not a choice between SAP and independence. It is a choice about where control sits: where business meaning is governed, where the model runs, and where the authority to transact lies.”
For the Gurugram-based CIO, it’s grin-and-bear as he expects the hybrid model to become a practical compromise. “Over the next 12–18 months, the strategy is to live with this hybrid model, optimise how agents call SAP, and accept higher costs in exchange for governance, compliance and a clearer path to production AI,” he says.
Meanwhile, the CIO of a Mumbai-based conglomerate says enterprises are not asking SAP to abandon governance. They want reasonable access, predictable pricing and the freedom to choose where their AI capabilities run.
“Companies that want total freedom and flexibility might lean toward Oracle. However, big, traditional companies running SAP will likely stay put because switching ERP systems is incredibly hard and expensive, even if they dislike SAP’s additional costs.”
That architecture will also require different levels of controls, because not all AI workloads will be equally risky. A read-only helper responding to questions about supplies and finance data is quite distinct from an autonomous agent that can generate a sales order, modify a supplier record, or approve a transaction.
Gogia recommends that CIOs classify the integration estate before making broad compliance decisions.
“A copilot returns an answer to a person and stops. Middleware on a schedule does the same thing every night, in the same order. Then comes AI that helps an engineer write a mapping, which changes how an integration is built but leaves how it runs untouched. And the fourth is the agent that plans its own sequence of calls, and that is the one SAP’s agentic clause is written for.”
The first category needs accurate data definitions, controlled access and logging. The fourth requires narrowly scoped permissions, transaction limits, approval workflows, audit trails, anomaly monitoring, a reversal path and a named business owner. Controls should match the risk of the use case, rather than treating every agent as equally dangerous.
On comparisons with Oracle, Gogia says, ” Oracle is more open at the database, but in ERP its route for outside agents is an A2A call into Oracle’s own Fusion agents under Oracle’s roles, which is the shape SAP describes for Agent Gateway. Oracle shipped that in Release 26A in March, while SAP says its equivalent is not yet supported. The difference is timing, not philosophy.”
CIOs’ Ask From SAP
Before SAP AI investments, CIOs require a contractual confirmation as to what can currently be delivered versus what is planned; how consumption of API, BTP and agents will be metered and charged; how Digital Access applies to transactions created by AI; what are the true fair-use limits; what are the notice periods for policy change; and what are their data export, portability and workload migration rights.
This is particularly important because the commercial impact is not yet fully clear.
Gogia argues that customers need clarity before they make an architectural commitment. “A procurement lead should feel both relief and unease: relief that an outside model is allowed in, unease that the price of letting it in is not yet written down.”
Summing up the broader sentiment among enterprise technology leaders, the Mumbai-based CIO says enterprises are not asking SAP to loosen governance; they want it to be commercially fair, technically workable and predictable.
“CIO expectations from SAP are increasingly clear: stop charging extra fees simply to read company data through standard AI tools; provide clear, predictable pricing so monthly AI costs do not come as a surprise; and distinguish between a harmful bot and an approved enterprise AI tool operating under proper controls,” he adds.
SAP was approached for comment. The company had not responded by the time of publication.
