Cross-cutting audit trails: How SAP customers can cover the EU AI Act, SOX, NIS2, and DORA in a single architecture

1. Why this article is needed now

SAP customers in the DACH region are facing an architectural challenge in 2026 that has emerged over the last 18 months. Four key regulations each require their own audit trail structures, with different retention periods, content requirements, and reporting obligations. Those who treat them in isolation end up building four parallel logging silos and paying three times more than necessary. Those who integrate them need the architecture described in this article.

The four regulations are: SOX Sarbanes-Oxley Act (in effect since 2002 for publicly traded companies with US ties, Section 802 requires 7-year retention), EU DORA Digital Operational Resilience Act (in effect since January 17, 2025, for financial entities), NIS2 in Germany (NIS2 implementation act in effect since December 6, 2025, affecting approximately 29,500 companies across 18 sectors), EU AI Act Article 26 (effective from August 2, 2026, for deployers of high-risk AI systems).

This concentration of deadlines is new. While SOX has been around since 2002, DORA, NIS2, and Article 26 have all come into force within the last 16 months or will take effect in the next 90 days. Customers who last reviewed their audit architecture before 2024 will find gaps today that need to be closed.

The BaFin guidance from January 2026 explicitly clarified that AI systems must be embedded into DORA-compliant ICT risk management frameworks, rather than kept in a separate AI compliance silo. Customers need an audit trail architecture that reflects this integration.

2. Comparing the four regulations

2.1 SOX, the veteran

Scope: Public companies with a US stock exchange listing and their auditors. Audit trail requirements: Section 802 requires 7 years of retention in tamper-proof storage. Section 404 requires annual internal control reports subject to external audit. Penalties: Prison sentences of up to 20 years for intentional manipulation. Material weakness findings in the annual report. SAP implementation: SAP Security Audit Log (SM19/SM20), BTP Audit Log Service, Cloud ALM Audit Log API. Annual reporting cycle.

2.2 DORA, the financial sector anchor

Scope: 20 categories of financial entities (banks, insurance companies, investment firms, payment institutions, crypto-asset service providers) plus their critical ICT third-party providers. Audit trail requirements: Explicit logging program according to RTS, practically a 5-year retention period. Article 10 requires real-time anomaly detection. Article 17 requires incident reporting in three stages (24h/72h/1M). SAP implementation: FS-CD, insurance-specific SAP solutions, S/4HANA Finance components. Logging architecture must be real-time capable.

2.3 NIS2, the critical infrastructure and SME anchor

Scope: Around 29,500 companies across 18 sectors in Germany. Three categories: operators of critical infrastructure, essential entities, and important entities. Audit trail requirements: §30 new BSIG: 10 core risk management measures. §32: Reporting obligations in three stages (24h/72h/1M). §39: Proof of effectiveness within 3 years. Important: Registration deadline with the BSI ended on March 6, 2026. Relationship to DORA: DORA is lex specialis for financial entities. Penalties: Up to EUR 10 million or 2% of annual turnover, plus personal liability for management.

2.4 EU AI Act Article 26, the latest anchor

Scope: Deployers of high-risk AI systems from Annex III (8 sectors). Audit trail obligations: 6-month retention of automatically generated AI logs (paragraph 6). Document human oversight activities. SAP implementation: SuccessFactors Recruiting, FS-CD credit scoring, Joule agents. Digital Omnibus status: Trilogue failed on April 28, 2026; follow-up trilogue scheduled for May 13, 2026. Customers are planning based on the original deadline.

3. Retention matrix: Comparing regulatory deadlines

RegulationMinimum RetentionApplicability to SAP LogsTamper-Proof RequirementSOX Section 8027 yearsAll finance-related SAP logsYes, criminal law requirementDORA RTS ICT Risk ManagementPractically 5 yearsICT logs in financial SAP systemsYes, per Article 9NIS2 §32Practically 2-3 yearsIncident-related logsYes, per §30 risk managementEU AI Act Article 26 Paragraph 66 monthsAI system logsImplicit, for authority accessGDPRAs long as necessaryPersonal data in logsNo, on the contrary: deletion obligation

Pragmatic approach: Those subject to multiple regulations should adopt the longest period as the standard. SAP customers with SOX requirements retain their finance-related logs for 7 years. AI system logs: 7 years. ICT incident logs: 5 years. System operation logs: 2 years.

The GDPR conflict: SOX, DORA, NIS2, and the EU AI Act require long retention periods, while GDPR Article 5 requires storage limitation. Resolution: Pseudonymization during logging, separation of technical audit trails from personal tracking, and a clear legal basis under GDPR for long-term retention.

4. The most common architectural conflicts

Conflict 1: Data sovereignty versus cloud storage

DORA requires EU data centers for critical data. Customers storing audit logs in US cloud services must explicitly select the EU region and secure this contractually. For customers with strict data sovereignty requirements, BSI-certified providers (C5:2026, published by the BSI in April 2026) are the natural choice: T-Systems Open Telekom Cloud, IONOS, Plus Server.

Conflict 2: Tamper-proof versus real-time access

SOX Section 802 requires tamper-proof storage. DORA requires real-time detection. Solution: WORM (Write Once, Read Many) architecture with read optimization. AWS S3 Object Lock, Azure Blob Immutable Storage, and Google Cloud Storage Bucket Lock are the typical cloud implementations. For on-premises requirements: WORM NAS from NetApp, Dell EMC, or IBM.

Conflict 3: Multi-Source Aggregation vs. Data Consistency

SAP customers have logs from many sources with different formats and time zones. Solution: A two-tier architecture. First tier: Source-specific connectors that normalize data into a unified format (CEF, OCSF). Second tier: A central SIEM platform that aggregates the normalized data and makes it searchable.

Conflict 4: Multi-Report Reporting vs. Single Source of Truth

Four regulations, four different versions of the truth, and high maintenance effort versus a single source of truth. Solution: A central data layer with regulatory-specific view filters. Raw data is stored once, and reports are generated from regulatory perspectives.

5. SAP Data Source Mapping

Data SourceSOXDORANIS2EU AI ActSAP Security Audit Log (SAL)HighHighHighLowSAP Read Access Logging (RAL)MediumMediumMediumLowS/4HANA Application LogsHigh (Finance)High (Finance)High (KRITIS)MediumSAP Joule LogsLowMediumMediumHighBTP Audit Log ServiceMediumHighHighHighCloud ALM Audit Log APIMediumMediumMediumMediumMCP Server LogsLowHighHighHighDatabase Logs (HANA)HighHighHighLowgCTS and CI/CD LogsHighMediumMediumMediumActive Directory LogsHighHighHighLowServiceNow TicketsMediumMediumMediumLow

6. Architecture Pattern: The Layered Structure

The architecture proven in practice consists of five layers.

Layer 1, Source Connector: Source-specific modules that extract data from SAP components and third-party systems and normalize it into a unified format. Options: SAP's own Splunk connectors, Microsoft Sentinel SAP Solution, Google Chronicle Forwarder, ELK Beats with custom parsers, Onapsis, SecurityBridge.

Layer 2, Central Aggregation Platform: A SIEM platform that collects, indexes, and correlates normalized data in real time. For DORA Article 10 anomaly detection and NIS2 §30 incident detection. Market standards: Splunk Enterprise Security, Microsoft Sentinel, Google Chronicle, Elastic Stack, IBM QRadar.

Layer 3, WORM Compliance Storage: Immutable storage for long retention periods. Tiered storage: Hot (0-90 days), Warm (90 days to 2 years), Cold (over 2 years up to 7 years).

Layer 4, Regulatory Views: SOX ITGC dashboard (Logical Access, Change Management, IT Operations), DORA incident reporting dashboard, NIS2 reporting dashboard with BSI portal interface, EU AI Act compliance dashboard.

Layer 5, Operational Processes: Compliance officer roles, escalation process, training plan, review cycles (monthly operational, quarterly compliance, annual strategy), incident response playbooks. No technical architecture works without this organizational layer.

7. Tool Landscape: Tools Compared

Tool CategorySOXDORANIS2EU AI ActEU HostingSAP IntegrationSplunk Enterprise SecurityYesYesYesPartiallyYesSAP Connector availableMicrosoft SentinelYesYesYesPartiallyYesSAP Solution availableGoogle ChronicleYesYesYesPartiallyYesForwarder with SAP parserElastic Stack (ELK)YesYesYesPartiallyYesBeats with custom parsersIBM QRadarYesYesYesPartiallyYesSAP DSM availableOneTrust GRCPartiallyYesYesYesYesAPI connectionServiceNow GRCPartiallyYesYesPartiallyYesSAP Connector availableOnapsis PlatformYesYesYesLowYesNative SAP integrationSecurityBridgeYesYesYesLowYesNative SAP integrationPathlockYesYesPartiallyLowYesNative SAP integrationOrchestration Layer¹PartiallyPartiallyPartiallyPartiallyYesNative SAP integration

Solutive AG is the initiator of the Change Orchestration Institute. The ratings in the table are self-reported by the providers and are not part of an independently validated editorial assessment.

SIEM platforms are strong in DORA and NIS2 (real-time detection) but weaker in the EU AI Act. GRC platforms are strong in the EU AI Act and SOX but weaker in real-time detection. A combination of SIEM and GRC is the standard architecture for large enterprises.

8. Concrete implementation plan

Customers starting with an integrated audit trail architecture today need a 12-to-18-month plan.

Phase 1 (60-90 days): Determine compliance scope, inventory data sources, map obligations per regulation, perform gap analysis, and make architectural decisions (SIEM, GRC, storage, EU hosting). Output: Architectural concept.

Phase 2 (90-180 days): Implement source connectors, tune data volume, define correlation rules, set up WORM storage, and build initial dashboards. Output: Functional aggregation.

Phase 3 (60-120 days): SOX ITGC dashboard, DORA incident reporting, NIS2 reporting with BSI portal interface, EU AI Act compliance tracking, and cross-regulatory master view. Output: Complete reporting suite.

Phase 4 (ongoing): Establish compliance operations, training, audit preparation, roadmap tracking, and cost optimization. Output: Mature compliance architecture.

PhaseTimeframeMain Result1Inventory and gap analysis60-90 daysArchitectural concept2Connector setup90-180 daysFunctional aggregation3Regulatory views60-120 daysReporting suite4Operational maturityongoingMature compliance architecture