Now accepting guest editorial from SAP, Oracle, Workday and ServiceNow practitioners.Pitch a guide
The Sign-Off Table

Lesson 3 of 6

What SAP provides and what you own

8 min

Listen to this lesson

0:00 / 8:54

SAP publishes a lot about responsible AI: a Global AI Ethics Policy, an AI Ethics Handbook, an AI ethics governance structure, and an ISO/IEC 42001 certification. All of it is useful, and none of it transfers your deployer duties to SAP. This lesson separates what SAP does from what stays with you.

SAP's responsible AI framework

Policy and principlesSAP's Global AI Ethics Policy, based on the ten principles of the UNESCO Recommendation on the Ethics of AI, and the AI Ethics Handbook for teams.
Governance bodiesAn AI Ethics Office coordinating the work, an internal Global AI Ethics Steering Committee of senior leaders, and an external Global AI Ethics Advisory Panel.
Use-case reviewEvery SAP AI use case goes through an AI ethics impact assessment, is classified into risk categories, and passes review steps depending on risk.
Certified management systemISO/IEC 42001 certification for SAP's AI management system, covering internal AI governance and key solutions such as Joule, SAP AI Core and SAP AI Launchpad.
Security and data commitmentsCustomer data isn't shared with third-party LLM providers to train their models; product development use is governed by contract, with opt-out in SAP for Me.
SAP's responsible AI framework, as SAP describes it on its Responsible AI page.
The Sign-Off Table · thesignofftable.com/academy/sap-ai-301

The ten principles SAP lists are proportionality; safety and security; fairness and non-discrimination; sustainability; right to privacy and data protection; human oversight and determination; transparency and explainability; responsibility and accountability; awareness and literacy; and multistakeholder and adaptive governance. SAP says its AI governance framework draws on the EU AI Act, the NIST AI Risk Management Framework, NIST CSF, ISO 27002, ISO 42001, ISO 42005 and its own Global Security Policy.

What ISO/IEC 42001 does and doesn't mean

ISO/IEC 42001:2023 is a management system standard: it certifies that an organization runs a system of policies, risk management, deployment, monitoring and improvement for AI. SAP's certificate, issued by an accredited certification body, covers SAP's AI management system for using AI in SAP and providing AI through SAP products (SAP links the certificate from its Responsible AI page; check its scope statement and validity dates before you cite them). That is real evidence of SAP's governance as a provider. It does not certify that a particular AI feature is suitable for your use case, that your configuration is correct, or that your company manages AI well. If an auditor asks about your AI governance, SAP's certificate is one supplier document in your evidence pack, not the answer.

TopicSAP (as provider of its AI features)You (as deployer, or provider of what you build)
Design and testing of the featureSAP's development standards, ethics review and quality processesTest the feature in your configuration with your data and users
DocumentationProduct documentation and, for high-risk systems, instructions for useRead and follow them; keep your configuration records
Data used for training and improvementGoverned by your contract and the product development scheduleDecide whether to opt out in SAP for Me; keep personal data out of prompts where not needed
Use-case risk classificationSAP classifies its own use cases internallyClassify your use of the feature in your process (lesson 2)
Human oversightFeatures designed with human review pointsAssign trained, empowered people and define when they must intervene
LogsFeatures and platforms produce logsRetain, protect and review them (at least six months for high-risk deployers)
Informing peopleProduct labels such as AI noticesInform employees, works councils or representatives, and affected people
Agents and apps you buildPlatform controls (Joule Studio, SAP AI Core, gateways)Everything about the agent's purpose, permissions, testing and monitoring

Splitting responsibilities between SAP and your program.

SAP's provider-side controls feed your deployer controls; they don't replace them.
The Sign-Off Table · thesignofftable.com/academy/sap-ai-301

What would you do?

A steering committee member says, "SAP is ISO 42001 certified, so our use of Joule is compliant and we can skip our own review." What should Grace reply?

Key points
  • SAP's Global AI Ethics Policy follows ten principles based on the UNESCO Recommendation, with an AI Ethics Office and review of every SAP AI use case.
  • ISO/IEC 42001 certifies SAP's AI management system, covering Joule, SAP AI Core and SAP AI Launchpad; it doesn't certify your use.
  • Deployer duties stay with you: classification, oversight, logs, informing people, and anything you build.
  • Collect vendor answers on purpose, limits, oversight, logs and data use for your AI inventory.

Check your understanding · not graded

Lesson check

  1. 1. What does SAP's ISO/IEC 42001 certification cover?

  2. 2. On which international framework does SAP base its ten AI ethics principles?

  3. 3. Who in SAP's framework coordinates the AI ethics impact assessment of SAP use cases?

  4. 4. Contoso builds its own agent in Joule Studio. Who is responsible for the agent's purpose, permissions and testing?