AI Governance for SAP Programs: EU AI Act, SAP Responsible AI and Agent Controls

Keep this: job aid

AI governance for SAP programs: one-page checklist

• Dates (Reg. (EU) 2026/1744): prohibitions 2 Feb 2025; GPAI 2 Aug 2025; Article 50 transparency 2 Aug 2026; new prohibitions 2 Dec 2026; Annex III high-risk 2 Dec 2027; Annex I 2 Aug 2028.
• Role first: SAP is usually provider of its features; you are deployer; what you build in Joule Studio or SAP AI Core can make you provider.
• Classify: prohibited? AI at all? Annex III area? Article 6(3) exception without profiling? Transparency?
• Watch HR: ranking applicants, promotion, task allocation and performance monitoring are Annex III point 4.
• SAP's ISO/IEC 42001 certificate covers SAP's AI management system, not your use.
• Agents: own identity, least privilege, SoD analysis, drafts before postings, existing approval thresholds kept.
• Log user, agent, tool, inputs, result and document; high-risk deployers keep logs at least six months.
• Tested kill switches with named owners and a fallback process.
• AI inventory plus evidence pack organized by NIST AI RMF: Govern, Map, Measure, Manage.
• Review monthly, quarterly and annually, and on triggers: new features, purpose changes, incidents, new rules.