AI Governance

The NIST AI RMF is the most widely used voluntary risk framework for AI. This article explains its four functions, the Generative AI profile, the 2026 critical infrastructure profile, and the distinction from ISO 42001 and the EU AI Act, translated into SAP governance.

The Digital Omnibus on AI is an EU Commission package designed to simplify and partially postpone obligations under Regulation (EU) 2024/1689 (EU AI Act). On May 7, 2026, the Council and Parliament reached a provisional agreement during the third trilogue.

Article 26 of Regulation (EU) 2024/1689 defines the operational obligations for deployers of high-risk AI systems. For SAP users, these obligations remain unchanged as of August 2, 2026.

Frankenstein architecture: Saueressig's term from November 2025, extended to cross-vendor agents from SAP, Microsoft, Salesforce, Workday, and Community-MCP. What Klein's Sapphire statement from May 11, 2026, solves and what it leaves open. Tool comparison and five operational consequences for operators.

SAP achieved ISO 42001 certification for SAP Business AI in Q1 2026 and is positioning itself as a provider. Klein's Sapphire statement on May 11, 2026, reinforces the provider role with a governance commitment for SAP-native agents. Operator obligations under Article 26 remain with the SAP customer and are non-transferable.

An assessment framework for CISOs, SAP Basis teams, and architects in the era of 40+ community servers and the OWASP MCP Top 10.

Agentic AI refers to AI systems that autonomously execute multi-step tasks. This creates new governance requirements in SAP change management.

AI toolchains, MLOps, and LLMOps structure the operation of AI systems. Governance requirements must be integrated into the architecture from the very beginning.

The EU AI Act is the world's first comprehensive AI regulatory framework. It applies extraterritorially and designates SAP customers as deployers.

AI governance manages the use of AI in companies. It is not a sub-area of IT governance, but a distinct framework.

The Digital Omnibus on AI aims to postpone the high-risk obligations of the EU AI Act. For SAP customers, this changes less than hoped.

The Digital Omnibus trilogue aims for a political agreement during the second trilogue on April 28.

CVE-2026-27681 is a critical SQL injection vulnerability in SAP BPC and BW with a CVSS score of 9.9.

SAP Business AI is the collective term for the AI functions that SAP embeds in its products or provides as a standalone service on the SAP BTP.

Three platforms, two opposing answers to the same question: Who controls the agent that touches SAP production?