Lesson 6 of 6
Keeping AI governance current
8 min
Listen to this lesson
AI governance has more moving parts than most compliance topics. In 2026 alone, the EU amended the AI Act months after it began to apply, SAP published a new API Policy that restricts how agents use APIs, and SAP features moved from early adopter programs to general availability (or didn't). A governance setup that was right in January can be wrong by October. This lesson sets up a review rhythm and the triggers that should force an earlier look.
Four streams to watch
| Stream | What changes | Where to check | Owner at Contoso |
|---|---|---|---|
| Regulation | AI Act amendments, Commission guidelines, harmonised standards, codes of practice; national and US state AI laws | EUR-Lex, the Commission's AI Office pages, counsel updates | Counsel with Nadia |
| SAP terms and policies | AI terms, product development schedule, SAP API Policy, data processing terms | SAP Trust Center, SAP for Me, help.sap.com API Policy | Grace (PMO) with procurement |
| SAP features | Early Adopter Care to GA, new agents, deprecations, base vs premium changes | help.sap.com pages, What's New, SAP Discovery Center | Theo and Priya |
| Your own use | New use cases, configuration changes, incidents, evaluation drift | AI inventory, incident log, monitoring | Each inventory owner |
The four streams that can make your AI governance stale.
A review rhythm
Triggers that force an early review
- A new AI feature is activated, or an Early Adopter Care feature becomes GA and someone wants to use it.
- A use case changes purpose, for example a chat assistant starts answering HR eligibility questions.
- A significant change to a high-risk system's design (which matters for the AI Act's treatment of systems already in use).
- An incident: wrong decisions affecting people, data leakage, or an agent acting outside its limits.
- A regulatory change, such as the Digital Omnibus, or new Commission guidance on high-risk classification.
- A change to SAP's AI terms, product development schedule or API Policy.
- Jan 2026BaselineInventory built during the project; 12 use cases.
- Apr 2026API PolicySAP API Policy v.4.2026a published; agent designs reviewed against section 2.2.2.
- Jul 2026Digital OmnibusRegulation (EU) 2026/1744 in force; dates updated in the inventory and roadmap.
- Oct 2026Wave 2 featuresCloud ALM AI features assessed; test agents kept as pilot (Early Adopter Care).
- Dec 2027Annex III dateAny HR high-risk use must have deployer controls in place.
What a quarterly review produces
A review that produces only minutes changes nothing. Contoso's quarterly AI governance review has four fixed outputs. First, an updated inventory: every entry's status, risk class and review date confirmed, new entries added, retired ones closed with a reason. Second, a change log of external developments with an impact statement for each, for example "SAP Signavio recommenders deprecated on March 21, 2027: no Contoso dependency" or "Annex III date moved: HR proposal timeline unchanged, controls still required before activation." Third, a list of actions with owners and dates, tracked as tasks in SAP Cloud ALM like any other project work. Fourth, a one-page summary for Grace's decision group, which decides on any reclassification, new high-risk use or change to policy.
Keep the review short by doing the reading beforehand. Each stream owner brings a list of changes found since the last review, with links to the primary source (EUR-Lex for regulation, help.sap.com and the SAP Trust Center for SAP). Secondary sources such as law firm alerts and trade press are useful to spot a change quickly, but the inventory should always cite the primary text. The meeting then spends its time on decisions, not on discovering news.
What would you do?
In November 2026 a team asks to switch on a new SAP feature that ranks internal candidates for promotion. It is GA, and the vendor says it "supports compliance." Nothing in Contoso's inventory mentions it. What should happen?
- Watch four streams: regulation, SAP terms and policies, SAP features, and your own use.
- Review monthly (features, incidents), quarterly (inventory, regulation, terms) and annually (policy, literacy).
- Treat new features, purpose changes, incidents and regulatory changes as triggers for early review.
- Correct stale dates: Annex III high-risk duties apply from 2 December 2027 under Regulation (EU) 2026/1744.
Check your understanding · not graded
Lesson check
1. A chat assistant that answered IT questions starts answering HR eligibility questions. What should happen?
2. A 2025 training deck says "high-risk duties apply from 2 August 2026." What is the correct statement now?
3. Which source should be checked for the authoritative text of an AI Act amendment?
4. Who at Contoso watches SAP feature status changes such as Early Adopter Care to GA?