SAP’s AI Strategy: Openness on the Surface, Control Beneath the Hood

New capabilities announced at Sapphire 2026

At the Sapphire conference in Orlando, SAP introduced Joule Studio 2.0, a development environment for AI agents that supports the Model Context Protocol (MCP) and A2A protocols. These standards are intended to let agents pull data from any source that implements the same protocol, meaning a Joule‑created assistant could, in theory, query a Salesforce record or a Snowflake table without custom adapters.

Key features include:

• Agentic orchestration that can span on‑premise S/4HANA, cloud ECC, and third‑party SaaS applications.
• Real‑time data ingestion for context‑aware processes, allowing an assistant to react to a change in inventory the moment it occurs.
• Extensibility through a single UI where developers can add tools, workflow steps, or custom code to any out‑of‑the‑box agent.

SAP also announced a partnership with Anthropic to embed the Claude model in the SAP Business AI Platform, positioning the model as a “first‑party” option for customers who want a ready‑made large language model.

What the API policy means for integration

In February 2026 SAP published an updated API policy that defines which endpoints third‑party AI platforms may call and under what licensing terms. The policy distinguishes between:

1. Read‑only data APIs – freely usable for analytics and reporting.
2. Transactional APIs – require a paid “AI‑runtime” license and are subject to usage caps.
3. Agent‑execution APIs – only accessible to services that have been vetted and registered with SAP’s compliance gateway.

Critics, including Gartner analyst Christian Hestermann, argue that the policy effectively forces customers to route any AI‑driven business transaction through SAP‑hosted runtimes, where SAP can levy per‑call fees and retain audit logs. The policy also mandates that any third‑party model that wishes to act on SAP data must undergo a security certification process before receiving a token.

Compliance timeline for enterprises

Date	Requirement	Action for IT/Compliance teams
1 July 2026	API policy enforcement begins for new customers	Review existing integrations; ensure all calls use the read‑only endpoints or obtain the AI‑runtime license.
1 Oct 2026	Mandatory registration of external AI agents	Submit a security assessment for each third‑party model (e.g., Claude, OpenAI) and obtain a compliance token from SAP.
1 Jan 2027	Auditable logging of all agentic transactions	Deploy SAP’s audit‑log collector or integrate with an approved SIEM solution to capture API usage details.

Enterprises that rely on a mixed‑vendor landscape should map their current AI workloads against this schedule. Failure to register agents before the October deadline will result in blocked API calls and potential service disruptions.

Commercial implications

For organizations that already run the majority of their core processes on SAP, the Joule Studio approach may simplify governance: a single vendor controls model updates, security patches, and compliance reporting. However, for companies with significant footprints in Salesforce, ServiceNow, or other SaaS platforms, the new policy introduces a dual‑pricing model—one set of fees for SAP‑hosted runtimes and another for external AI services.

Forrester analyst Faram Medhora emphasizes that the technical problem is solved; the open protocols work. The remaining questions are who pays for the runtime, who governs the audit trail, and whose roadmap determines feature availability. Those decisions will be baked into contracts that are likely to be negotiated now for implementations slated for 2028.

What to do next

1. Inventory all AI agents – catalog which ones are built in Joule Studio, which use Anthropic’s Claude, and which rely on external models.
2. Map data flows – identify every SAP endpoint accessed by an agent and classify it under the new API tiers.
3. Engage SAP account teams – request a detailed cost breakdown for AI‑runtime licenses and confirm the timeline for compliance token issuance.
4. Update governance policies – incorporate SAP’s audit‑log requirements into your existing AI governance framework.
5. Consider alternative runtimes – if the cost or lock‑in risk is unacceptable, evaluate building a parallel agent layer on a neutral platform that can call SAP’s read‑only APIs while keeping transactional logic elsewhere.

The strategic takeaway is clear: SAP is offering the technical hooks for an open, interoperable AI ecosystem, but the accompanying policy and pricing structure steer customers toward a SAP‑centric runtime. Enterprises must weigh the convenience of a single‑vendor stack against the long‑term cost and flexibility implications of that choice.

---

For further reading, see the official SAP API policy document here and the announcement of the Anthropic partnership on SAP’s blog.