Can AI Agents Still Access SAP Data Under New API Rules?

As a global leader in enterprise applications, SAP manages the complex data flows that power 90% of the world’s supply chains.

Enterprise technology leaders have spent the past two years connecting Gen AI to these core business systems to drive operational efficiency. 

However, a clause in the SAP April 2026 API policy is opening new conversations, sparking concerns that many AI and technology leaders haven’t confronted yet: does the vendor actually permit the very architecture it has built? 

Section 2.2.2 of API Policy v4/2026 states that SAP APIs may not be used for “interaction or integration with (semi-)autonomous or generative AI systems that plan, select or execute sequences of API calls”. 

Effectively, this prohibits third-party AI agents from making their own decisions about how to fetch or move data within the SAP ecosystem. 

Policy vs promise

The clause buried in the new API policy raises immediate legal concerns for enterprise innovators particularly those who built Copilot integrations or supply chain tools with live SAP data access.

These architectures may now be in breach of their SAP agreement. 

Christian Klein, SAP CEO, responded to these concerns during the company’s Q1 2026 investor call.

He clarified that the intent is to protect the domain know-how of SAP and prevent performance degradation. 

The policy is not meant to block customers from their own data, Christian added.

However, commentators note that legal rights and practical access architecture are different things. The policy text remains unchanged despite these verbal assurances.

DSAG CTO, Stefan Nogly, highlights these concerns from a customer’s point of view.

He says: “In an era of increasingly heterogeneous architectures and intensive AI experiments, APIs are a key driver of innovation.” 

He calls for a significant need for clarification and adaptation, putting forward the DSAG board’s position. This is essential to avoid disrupting business-critical processes or leaving organisations legally vulnerable. 

However, the deeper tension is a commercial one.

Products such as SAP Joule, Business Data Cloud and Agent Gateway currently represent the only approved pathways for AI to interact with SAP data.

This raises the question of whether the policy structurally advantages the AI offerings of SAP over third-party alternatives. 

DSAG describes this as a contradiction between restrictive rules and the public commitment of SAP to maintaining an open platform.

A question of compliance

The practical implications of this policy are significant, representing an imminent concern for major industrial players. 

BMW Group, a publicly confirmed S/4HANA customer, is actively exploring gen AI across its manufacturing and supply chain operations.

Any AI workflow that queries SAP for live production order status or supplier intelligence appears to fall within the prohibition. This is especially true for API patterns used outside the official SAP hub.

The technology leadership at BMW Group will now have to assess whether their piloted tools remain compliant.

Rebuilding these systems on the approved AI pathways of SAP would involve significant and costly practical changes.

Similarly, DHL Supply Chain relies on SAP TM and EWM at the core of its global logistics operations.

The company increasingly deploys AI tools for dynamic routing, exception management and capacity optimisation.

If these tools use agent-style API sequencing to read and act on SAP data, they appear directly captured by Section 2.2.2. As most modern AI orchestration frameworks rely on this method, the impact seems to be widespread.

SAP’s new rule may restrict all these kinds of AI automations unless they use SAP-approved methods. 

DHL Supply Chain and other logistics operators now face a difficult reality. They must determine if performing AI on SAP data effectively mandates the use of SAP software exclusively moving forward.

As an increasing number of companies connect AI tools to their SAP systems to automate business operations, the policy change places global enterprises in a difficult position, forcing them to navigate the risk of non-compliance.