SAP's API policy and ECC: what actually changes for existing customers

Update, 11 November 2026. Two points below have changed. Joule is no longer out of reach for ECC by definition: SAP offers selected AI scenarios to ECC and on-premise customers that commit to moving the majority of their landscape to SAP Cloud ERP (SAP, May 2026). Business One has had native generative AI since August 2026 and offers partners an MCP server (SAP News, 5 November 2026). And no revised API policy has appeared yet: the document at SAP's standard URL still dates from April 2026. Our current view is in the SAP AI-agent landscape.

On 27 April 2026, SAP published API Policy v.4/2026a. The decisive section 2.2.2 prohibits using SAP APIs for "(semi-)autonomous or generative AI systems that plan, select, or execute sequences of API calls" — except through SAP-endorsed routes. Reactions were sharp: the German-speaking SAP user group DSAG publicly criticized the policy. A revised version is widely expected.

For mid-market companies on SAP ECC, Business One, or on-premise S/4HANA, the more practical question is: what does this concretely mean for us? The answer is more sober than the headlines suggest.

What the policy actually governs

The policy covers SAP-published APIs — and it governs how AI agents may call them. The endorsed routes are SAP's own stack: AI Core and Joule Studio as the runtime, the MCP Gateway in Integration Suite (generally available since Q1 2026, Techzine), the A2A protocol for agent-to-agent communication, and BDC Connect on the data side. If you're on RISE or GROW and want agents working against SAP APIs, you have a clear, sanctioned path.

What it means for ECC and B1 customers

Three observations that get lost in the noise:

First: SAP's native agent path runs through its cloud contracts. RISE and GROW include Joule; on ECC and on-premise S/4HANA, SAP offers selected Joule scenarios only to customers who commit to moving most of their landscape to SAP Cloud ERP. If you have not made that commitment, the policy hasn't made your starting position any worse — the native path wasn't open to you before, and it isn't now.

Second: the sanctioned channels live in the BTP cloud stack. For an ECC or Business One system without a BTP connection, the policy is above all one thing today: a signal of where SAP wants to steer the agent world — into its own cloud.

Third, and most important: not every AI agent calls SAP APIs. An agent that works on the exports your users already pull every day — an IDoc error log from WE02, a delivery-block list, a freight-cost export — touches no SAP interface at all. It reads a document a human produced and returns an analysis. That pattern calls no SAP API, and it works on ECC 6.0 exactly as it does on S/4HANA.

What we recommend

First: inventory your planned agent use cases by whether they call SAP APIs or work on exports and documents. Second: for API-bound cases on RISE / GROW, the road runs through the endorsed channels — MCP Gateway and A2A. Third: watch for a revised policy before tying long-term architecture decisions to the current wording.

Our free SAP Logistics Copilot follows the third pattern: it works on files a user exported and calls no SAP API. Where an agent should also execute transactions, we design that per workflow through interfaces you sanction — on RISE / GROW, through SAP's endorsed channels — with least-privilege access, your approval rules, and an audit trail. If you want to sort out which pattern your use case falls into: book a 30-minute fit call.