SAP's API policy and ECC: what actually changes for existing customers

On 27 April 2026, SAP published API Policy v.4/2026a. The decisive section 2.2.2 prohibits using SAP APIs for "(semi-)autonomous or generative AI systems that plan, select, or execute sequences of API calls" — except through SAP-endorsed routes. Reactions were sharp: the German-speaking SAP user group DSAG publicly criticized the policy, and CEO Christian Klein clarified on the Q1 investor call that it "mainly refers to SAP's domain know-how, not customers' data." A revised version is widely expected.

For mid-market companies on SAP ECC, Business One, or on-premise S/4HANA, the more practical question is: what does this concretely mean for us? The answer is more sober than the headlines suggest.

What the policy actually governs

The policy covers SAP-published APIs — and it governs how AI agents may call them. The endorsed routes are SAP's own stack: AI Core and Joule Studio as the runtime, the MCP Gateway in Integration Suite (generally available since Q1 2026, Techzine), the A2A protocol for agent-to-agent communication, and BDC Connect on the data side. If you're on RISE or GROW and want agents working against SAP APIs, you have a clear, sanctioned path.

What it means for ECC and B1 customers

Three observations that get lost in the noise:

First: Joule was never available to you — it requires RISE or GROW contracts. The policy hasn't made your starting position any worse; the native SAP agent path wasn't open to you before, and it isn't open to you now.

Second: the sanctioned channels live in the BTP cloud stack. For an ECC or Business One system without a BTP connection, the policy is above all one thing today: a signal of where SAP wants to steer the agent world — into its own cloud.

Third, and most important: not every AI agent calls SAP APIs. An agent that works on the exports your users already pull every day — an IDoc error log from WE02, a delivery-block list, a freight-cost export — touches no SAP interface at all. It reads a document a human produced and returns an analysis. That pattern sits outside what an API policy can govern, and it works on ECC 6.0 exactly as it does on S/4HANA.

What we recommend

First: inventory your planned agent use cases by whether they call SAP APIs or work on exports and documents. Second: for API-bound cases on RISE / GROW, the road runs through the endorsed channels — MCP Gateway and A2A. Third: watch the announced policy revision before tying long-term architecture decisions to the current wording.

We build agents of the third pattern: they work on exports, run on your own infrastructure, and need neither BTP nor a policy exception. The SAP Logistics Copilot is the first example — free to test on your own data. If you want to sort out which pattern your use case falls into: book a 30-minute fit call.