Alle Artikel

Four regulations, four retention periods, four reporting logics: How to design an audit logging architecture that satisfies all of them simultaneously without storing logs four times.

A technical assessment of the landscape between standard solutions, community tools, and an impending toolchain gap

What Cloud ALM can do today, what is still missing, and which migration strategies are truly sustainable

An assessment framework for CISOs, SAP Basis teams, and architects in the era of 40+ community servers and the OWASP MCP Top 10.

Ein operatives Framework für CAB, SAP-Basis und Change Manager

Agentic AI refers to AI systems that autonomously execute multi-step tasks. This creates new governance requirements in SAP change management.

An audit trail in the SAP change process is the end-to-end, audit-proof recording of all activities related to a change.

SOX Section 404 requires a verifiable internal control system for changes to financial SAP systems.

Test automation and impact analysis in SAP environments must be considered together to reach their full potential.

A hybrid SAP ALM architecture manages SAP cloud and on-premise components within a consistent change process.

Triple compliance in May 2026 refers to the simultaneous applicability of NIS2, DORA, and the EU AI Act. The three regulatory frameworks consume the same operational evidence: audit trail, incident reporting, supply chain inventory, human oversight, and training. An integrated architecture reduces effort and closes gaps.

The NIST AI RMF is the most widely used voluntary risk framework for AI. This article explains its four functions, the Generative AI profile, the 2026 critical infrastructure profile, and the distinction from ISO 42001 and the EU AI Act, translated into SAP governance.

It is not just ChaRM that will disappear in 2027. Monitoring, landscape automation, and landscape data also require a successor, and not every solution is SAP-native.

SAP achieved ISO 42001 certification for SAP Business AI in Q1 2026 and is positioning itself as a provider. Klein's Sapphire statement on May 11, 2026, reinforces the provider role with a governance commitment for SAP-native agents. Operator obligations under Article 26 remain with the SAP customer and are non-transferable.

An analytical lens for SAP Change Governance: five layers with distinct tasks and decision-making rights, and why ALM is not the same as governance.

SAP Business AI is the collective term for the AI functions that SAP embeds in its products or provides as a standalone service on the SAP BTP.

Three platforms, two opposing answers to the same question: Who controls the agent that touches SAP production?

Frankenstein architecture: Saueressig's term from November 2025, extended to cross-vendor agents from SAP, Microsoft, Salesforce, Workday, and Community-MCP. What Klein's Sapphire statement from May 11, 2026, solves and what it leaves open. Tool comparison and five operational consequences for operators.

AI toolchains, MLOps, and LLMOps structure the operation of AI systems. Governance requirements must be integrated into the architecture from the very beginning.

With Sapphire 2026, ABAP development is becoming agentic: ADT for VS Code and ABAP MCP servers are available, with a custom code migration agent to follow. An analysis of the new toolchain and its implications for the SAP change lifecycle.

The Digital Omnibus trilogue aims for a political agreement during the second trilogue on April 28.

CVE-2026-27681 is a critical SQL injection vulnerability in SAP BPC and BW with a CVSS score of 9.9.

The EU AI Act is the world's first comprehensive AI regulatory framework. It applies extraterritorially and designates SAP customers as deployers.

In late April 2026, official SAP CAP npm packages were compromised. The attack targets the development toolchain before the first transport. Analysis of the incident, the control points, and the consequences for change governance.

SAP Cloud ALM Q1 2026 brings the Retrofit app and ATC integration. The functional gap compared to ChaRM remains.

The DSAG Investment Report 2026 documents a strategic gap: 43 percent total AI investment, but only 3 percent in SAP AI.

AI governance manages the use of AI in companies. It is not a sub-area of IT governance, but a distinct framework.

Many read 2030 as a breather. In reality, Extended Maintenance is reduced, tied to Business Suite 7, and sees some components phased out as early as 2027.

Release governance manages the transition from individual changes to coordinated, controlled production cycles.

Transport management controls the path of changes from the development system to production. Three classes of errors dominate daily operations.

Change management in SAP encompasses all changes to code, customizing, and configuration. It does not end with the transport.

SolMan maintenance ends on December 31, 2027. Those who have not yet migrated must begin their functional inventory now.

SAP ALM is the discipline of end-to-end management of SAP systems, from the initial requirement to decommissioning.

The SAP ALM tool landscape is divided into four categories. None of them covers the entire lifecycle.

At SAP Sapphire 2026 in Orlando, SAP announced the Autonomous Enterprise architecture on May 12, 2026: Business AI Platform, AI Agent Hub on LeanIX, and Joule Studio 2.0.

NIS2 is the EU directive on cybersecurity. Transposed into German law via the BSIG. BSI audit phase active since May 2026; personal liability for management effective since December 2025.

The Digital Omnibus on AI is an EU Commission package designed to simplify and partially postpone obligations under Regulation (EU) 2024/1689 (EU AI Act). On May 7, 2026, the Council and Parliament reached a provisional agreement during the third trilogue.

The Digital Omnibus on AI aims to postpone the high-risk obligations of the EU AI Act. For SAP customers, this changes less than hoped.

Article 26 of Regulation (EU) 2024/1689 defines the operational obligations for deployers of high-risk AI systems. For SAP users, these obligations remain unchanged as of August 2, 2026.

Cloud ALM can replace ChaRM for many scenarios. However, for single-landscape customers with parallel tracks, critical CSOL protection is missing.