SAP adds runtime controls and human-reviewed tools for AI governance

SAP has announced new tools for governing AI systems, including a gateway that applies controls while AI traffic is moving and an assistant that prepares EU AI Act assessments for human review. The practical shift is towards checking and steering AI in operation, rather than relying on policies that look tidy on paper.

SAP Watch analysis

What happened

At SAP TechEd, SAP introduced the Enterprise AI Gateway, which it says brings authentication, policy enforcement and routing together for traffic across MCPs, APIs, agent-to-agent connections and large language models. The company says it also supports continuous monitoring, usage tracking and auditing.

Other announcements include customer access to curated SAP Sovereign Cloud large language models through SAP AI Core, and new SAP LeanIX features that give Joule Agents architecture information. A knowledge-intake agent can extract information from security and architecture documents and propose links to the LeanIX knowledge graph. Those links need human approval before agents can use the information.

SAP’s AI Governance Assistant, designed to support EU AI Act assessments in SAP AI Agent Hub, can flag incomplete documentation, pre-fill assessment fields, identify systems that appear high-risk but lack classification, and trigger reassessment after material changes. Its outputs are drafts for legal and compliance review, SAP says.

Why it matters

These features address different parts of a growing enterprise problem: controlling what AI systems can access, giving agents relevant business context, and keeping documentation up to date. The gateway’s runtime focus is notable because a policy is only useful if it applies when an agent acts, not merely when someone configures it.

The announcement also makes clear where human judgement remains in the loop: proposed architecture links and governance-assistant outputs require approval. That is less glamorous than an agent doing everything by itself, but rather more useful if the task is compliance.

Our read

SAP is putting specific controls behind its AI-governance pitch, rather than offering governance as a dashboard-shaped abstraction. The strongest ideas are runtime enforcement and draft-only compliance assistance. But these are announced capabilities, not independent evidence of how well they work in customer deployments. The test will be whether teams can use them to see and control what agents actually do across their systems.

What to watch

• Which MCPs, APIs, models and agent connections the gateway supports in practice.
• How customers configure and audit policies applied at runtime.
• Whether human review catches important errors in proposed architecture links and assessment drafts.
• What evidence SAP provides about customer deployments and results.

Discussion spark: Should enterprise AI governance focus first on runtime controls over what agents can do, or on making sure their decisions are documented and reviewed?

not affiliated with or endorsed by SAP