SAP and AI Agents: The Pragmatic Path Through S/4HANA, ECC, and Business One for the Mittelstand

Every Mittelstand SAP customer in Germany has the same set of conversations on the calendar this year. The first one is about the 2027 ECC end-of-maintenance deadline. The second is about S/4HANA - which edition, which year, which integrator. The third, almost as an afterthought, is about AI: do we wait until we are on S/4HANA to do anything, or do we start now?

The honest answer is uncomfortable for the SAP marketing slides: most Mittelstand firms cannot afford to wait. ECC is still where their orders, invoices, and inventory live. S/4HANA migrations take 18 to 36 months on average⁹, and 69 percent of DACH enterprises already report insufficient internal resources for the project⁴. Meanwhile, the manual transaction work in finance, sales, and supply chain keeps growing. The right question is not “ECC or S/4HANA?” - it is “what do we automate today, regardless of where SAP sits?”

This guide is for the Mittelstand CFO, Head of IT, or SAP architect who runs SAP - any flavour - and wants a concrete answer to one question: can an AI agent take real work off the SAP-using teams now, without rewriting the ERP, without buying a new platform, and without disrupting the migration plan? The short answer is yes. The longer answer is the rest of this article.

The 2027 SAP Cliff

The numbers behind the SAP Mittelstand conversation are unforgiving. SAP confirmed mainstream ECC support ends 31 December 2027 with no further extension⁷. Extended maintenance is available, with a 9 percent fee premium and limited new functionality¹⁰. More than 10,000 customers worldwide remain on ECC, many of them German Mittelstand industrial and machinery firms⁴. And only about 39 percent of ECC customers have so far licensed S/4HANA⁹.

• 2027 deadline - SAP ECC mainstream maintenance ends 31 December 2027; after that, extended maintenance applies at +9% fee with no new content^7,10.
• Migration runway - Typical S/4HANA migrations take 18-36 months end to end; SI capacity is filling fast for late-2026 starts⁹.
• Resource squeeze - 69% of DACH enterprises report insufficient internal resources for the migration⁴.
• Joule adoption is thin - SAP ships 40-plus Joule agents and 2,400-plus skills, but only ~3% of SAP customers run them in production^4,5.
• The Mittelstand AI signal - 41% of German firms are now using AI actively, up from 17% the year before; 48% are planning²⁵. Most are not waiting for SAP to ship the answer.
• Operational cost stays high - The repetitive work in sales-order entry, three-way matching, master-data maintenance, and AR follow-up consumes hours that the migration project itself needs¹².

The temptation in many Mittelstand firms is to freeze AI investment until the S/4HANA migration is done. That logic is backwards. Every month of delay is hours not saved, capacity not freed, and master-data quality not improved. The cleaner your master data and the better-documented your processes are when the migration starts, the smoother the migration runs - and AI agents do both.

What an SAP-Native AI Agent Actually Does

The phrase “AI on SAP” covers everything from a chat box on top of Fiori to a full agentic platform inside BTP. Worth being precise about what an SAP-native AI agent is - and is not.

The agent loop on SAP

1. Capture - Pulls the trigger from email, a Fiori inbox, an EDI message, an OData event, an IDoc landing, or a scheduled job in SAP.
2. Read - Calls the relevant BAPI, OData service, or RFC to read the SAP context: open orders, vendor master, stock levels, customer credit limit, plant calendar.
3. Reason - Combines the SAP context with the trigger content (PDF invoice, customer email, EDI 850 order, sensor reading) and the firm-specific rules to decide what to do.
4. Propose - Generates the SAP transaction with all required fields populated and a confidence score for each.
5. Decide - Above the confidence threshold the agent posts the transaction directly through BAPI or OData. Below it, the case lands in a human-review queue with a one-line explanation.
6. Audit - Every action is logged with timestamp, technical user, agent version, and reasoning - alongside the standard SAP change documents and AUT10 logs.
7. Learn - Every correction the human makes feeds back into the agent. Patterns it sees three times become rules it applies automatically.

What it is not

• Not screen scraping - The agent never drives SAP GUI like a human; it calls stable APIs.
• Not a SAP replacement - SAP remains the system of record; the agent reads from and writes to it.
• Not unsupervised at first - Every new use case starts read-only or with full human approval, then earns auto-posting one transaction at a time.
• Not a Joule clone - Joule is SAP\'s in-product copilot. An agent runs outside SAP, can connect to non-SAP systems, and is portable across SAP editions.
• Not RPA in disguise - RPA bots break when the screen changes. Agents reason and recover.

7 SAP Use Cases That Pay Back Fast

Not every SAP transaction is a good first AI candidate. The use cases below share the same DNA: high volume, repetitive, well-documented in SAP, and with a clear correct answer. Pick one. Go live. Add the next.

1. Sales-Order Entry from Customer Email or PDF

Customers still send orders by email and PDF, even when EDI is offered. The agent parses the email or attachment, looks up the customer in SAP (XD03 or the OData equivalent), validates open credit, matches material numbers and pricing conditions, and drafts the sales order through BAPI_SALESORDER_CREATEFROMDAT2.

• Volume is high - Mittelstand machinery and distribution firms see 50-500 of these per day across the sales-office team.
• Patterns repeat - 80% of customers send the same 5-15 materials with the same incoterms and payment terms every month.
• Match logic is hard but bounded - Material aliases, customer-specific part numbers, and free-text descriptions are exactly what an LLM is good at.
• Side benefit - Order-to-confirm cycle drops from 24-48 hours to under 1 hour for clean orders.
• Compliance side effect - Every order-creation event is in CDPOS / CDHDR; the agent\'s reasoning sits next to it for full traceability.

2. Three-Way Match for Accounts Payable (MIRO)

Matching incoming invoices to purchase orders and goods receipts is one of the most repetitive jobs in SAP finance. The agent reads the invoice, calls BAPI_PO_GETDETAIL and BAPI_GOODSMVT_GETLIST, runs the three-way match, and drafts the MIRO posting. Exceptions (price variances, partial deliveries, missing GR) get routed to a human queue.

• Industry benchmark - 80% reduction in AP cost per invoice when matched automatically vs manual three-way match¹².
• Skonto capture - Faster posting catches early-payment discounts the team currently misses on slow invoices.
• Tolerance handling - Configurable tolerances per vendor type and material group, all logged.
• GR-blocked work - Agent monitors GR-blocked invoice queue and chases the missing receipt with the warehouse before it ages.
• Pairs with DATEV - For firms that book in DATEV but procure in SAP, the agent bridges both systems in one workflow.

3. Vendor Master Maintenance (LFA1, LFB1, LFM1)

Vendor master is where SAP data quality goes to die. Duplicates, blocked vendors that no one unblocks, missing payment terms, withholding-tax codes set wrong. The agent watches the create-vendor request inbox, matches against existing records, enriches with Handelsregister and bank data, and pre-fills the BAPI_VENDOR_CREATE call for finance to approve.

• Duplicate prevention - 95%+ of duplicate-vendor requests caught before the second record is created.
• Master data quality - IBAN, VAT-ID, and Handelsregister number validated against authoritative sources at creation time.
• Migration prep - Cleaner vendor master is one of the highest-leverage things you can do before an S/4HANA migration¹¹.
• Block / unblock workflow - Agent monitors vendor-block events and chases the responsible party for resolution.
• Audit-friendly - Every change is in the SAP change documents; agent adds the reasoning text alongside.

4. Inventory Adjustments and Cycle Counts

Cycle counts, transfer postings, and inventory corrections are constant background work in any plant or warehouse. The agent watches the count results, compares to MM-IM stock, drafts the BAPI_GOODSMVT_CREATE adjustment, and posts the difference once a manager approves.

• Movement type intelligence - Picks the right movement type (711, 712, 309, 311) based on the difference type without human lookup.
• Plant calendar awareness - Schedules postings to land in the open MM period.
• Variance flagging - High-value or high-percentage variances are escalated to the inventory manager with a one-line summary.
• Aging stock - Agent watches slow-moving stock reports and proposes write-down candidates monthly.
• Pairs with WMS - For firms using EWM, the agent runs the same logic across both legacy WM and EWM transactions.

5. AR Follow-Up and Cash Application

Open AR aging is the slowest-moving disaster in finance. The agent runs the F-28 cash-application flow on incoming bank lines, matches to open invoices via FBZP / DDLB, applies partial payments correctly, and drafts dunning letters per the FB12 / F150 cadence.

• Auto-match rate - 85-95% of bank lines matched to invoices on day one, climbing as patterns emerge.
• Customer-specific handling - Top 20 customers and disputes go to a human; the long tail runs automatically.
• DSO impact - Days Sales Outstanding typically drops 5-10 days within a quarter.
• Tone matching - Reminders and dunning letters drafted in the customer\'s language with the firm\'s voice.
• Hand-off to legal - Cases past Mahnstufe 3 are pre-packaged for the legal team with the full correspondence trail.

6. Plant Maintenance Work-Order Creation (PM)

Maintenance teams record problems in plain language - in WhatsApp, in plant logs, in maintenance tablets. The agent reads the report, classifies it against the equipment master (IH06 / IE03), drafts the notification (IW21) and the work order (IW31), and proposes the spare parts list against MM stock.

• Free text to structured data - “Pumpe 3 leckt Hydraulikoel an der Welle” becomes a typed notification with object number, damage code, cause code, and proposed activity.
• Spare parts pre-pick - Material reservations created automatically against MRP with the right plant and storage location.
• Predictive prep - Pairs naturally with sensor-based predictive maintenance for end-to-end automation from anomaly to scheduled work order.
• Compliance trail - Every notification carries the source text, classification reasoning, and the human approver - clean for ISO 9001 audits.
• Skill match - Work orders dispatched to the right craft and skill group based on equipment and damage type.

7. Master Data Exception Handling and Migration Prep

Every Mittelstand SAP system carries a long tail of master-data oddities that make migration projects painful: customers with the same name in two different sales orgs, materials with stale UoM conversions, BOMs with deleted components. The agent crawls the master data, flags the anomalies, proposes the fix, and tracks them through the cleanse workflow.

• Pre-migration value - The cleanse-data project that the SI prices at six figures starts paying back immediately when run by an agent.
• Continuous quality - After migration, the agent keeps watching the master data for drift instead of running a one-off project every two years.
• Cross-module checks - Customer / vendor / employee deduplication across SD, MM, HR (where allowed by data privacy).
• Field standardisation - Address formatting, country codes, region codes, and tax classifications normalised against authoritative sources.
• Audit-friendly outputs - Every flagged anomaly carries the reason and the proposed fix; the human decides each one.

S/4HANA, ECC and Business One: Three Worlds, One Agent Pattern

The Mittelstand SAP landscape is not one product; it is at least three. Each has its own integration surface, its own AI roadmap from SAP, and its own realistic agent pattern. The agent loop is the same; what changes is how the agent talks to SAP.

SAP S/4HANA (any deployment)

• Integration - OData V2 / V4, the public S/4HANA APIs, and modern BAPIs through SAP Gateway. Cloud Connector for hybrid deployments.
• Joule fit - Native on Cloud Public Edition and Cloud Private Edition with RISE / GROW. On-premise S/4HANA still needs the BTP add-on.
• Custom agent fit - Strong. Stable APIs, modern auth (OAuth, SAML, mTLS), CDS views for read-side queries.
• Best first use cases - Sales-order entry, three-way match, AR follow-up, master-data exception handling.

SAP ECC (still 10,000+ live)

• Integration - RFC, BAPI, IDoc, and SAP Gateway-exposed OData where the team has built it. SLT and ALE for replication.
• Joule fit - None directly. Joule is cloud-only.
• Custom agent fit - Strong. RFC and BAPI are stable, well-documented, and most ECC systems already expose them through PI / PO or CPI.
• Best first use cases - Three-way match (MIRO), vendor master maintenance, sales-order entry, master-data cleanse for migration prep.
• Migration angle - The agent that runs on ECC today moves to S/4HANA after cutover with a re-pointed integration layer, not a rebuild.

SAP Business One (the Mittelstand small / mid)

• Integration - Service Layer (REST), DI API (heavier batch operations), B1if for event-based triggers.
• Joule fit - Limited. SAP is layering AI features into B1, but they are narrower than Joule on S/4¹⁷.
• Custom agent fit - Strong on Service Layer; pragmatic for operational workflows.
• Best first use cases - Sales-order entry from PDF / email, AR follow-up, inventory adjustments, customer onboarding.
• Volume reality - B1 customers typically run smaller agent setups - one or two use cases, focused on the highest-volume manual queue.

Integration Layers: BAPI, OData, RFC, IDoc, CPI

The integration layer is where most SAP-AI projects either succeed or fail. Pick the wrong primitive and the agent fights SAP for a year. Pick the right one and the agent fits the same way any other SAP-connected system fits.

The five integration primitives

• BAPI (Business Application Programming Interface) - The stable contract for transactional operations. BAPI_SALESORDER_CREATEFROMDAT2, BAPI_GOODSMVT_CREATE, BAPI_VENDOR_CREATE, BAPI_PO_CREATE1. Backwards-compatible across SAP support packs and the safest write surface.
• OData (V2 / V4) - The modern REST surface, especially on S/4HANA. Public S/4HANA APIs in the SAP API Business Hub cover the bulk of operational scenarios; CDS view-based services cover the rest.
• RFC (Remote Function Call) - The transport layer underneath BAPI. Useful when you need a synchronous call that BAPI does not expose; less safe than BAPI for write operations.
• IDoc (Intermediate Document) - Asynchronous, message-based integration. Best for high-volume, event-driven flows: order receipts, shipment confirmations, invoice receipts. Pairs naturally with EDI.
• CPI / SAP Integration Suite - SAP\'s integration platform on BTP. Routes, transforms, and authenticates calls between the agent and SAP. Best practice for production agent deployments²².

The deployment pattern

1. Agent runs on BTP or your own EU infrastructure - Never on the SAP application server itself. Keep the boundary clean.
2. Cloud Connector or SAP Private Link bridges the agent to SAP - Standard SAP-blessed pattern for hybrid agents calling on-prem ECC or S/4HANA.
3. SAP Integration Suite (CPI) sits in the middle - Authenticates the agent (OAuth client credentials, mTLS, or service keys), routes the call to the right backend, transforms payloads if needed²³.
4. The agent uses a dedicated technical user in SAP - Named (AGENT_AP, AGENT_SD, etc.), with a PFCG role scoped to exactly the transactions and authorisation objects it needs.
5. Every call is logged in CPI message monitoring AND in the agent\'s own audit trail - Two-side traceability for any audit.

Authentication in production

• OAuth 2.0 client credentials - Default for agent-to-CPI and CPI-to-S/4HANA cloud. Tokens rotate, scopes are scoped per use case.
• mTLS - Used where regulatory or contractual requirements need certificate-based machine identity.
• Service keys - For technical users on BTP services; rotated quarterly, stored in a secrets manager (Vault, AWS Secrets Manager, Azure Key Vault, BTP Credential Store)²².
• Cloud Connector principal propagation - When the agent needs to act on behalf of a specific user (rare but useful for traceability of human-approved transactions).
• SAML / SSO - For Joule and BTP UI components; less relevant for headless agent calls.

Joule vs Custom: When to Build, When to Buy

SAP Joule has a strong story: 40-plus pre-built agents, 2,400-plus skills, native integration with the SAP stack, one vendor relationship, one upgrade path⁴. The story has one wrinkle - according to multiple analyst reports, only about 3 percent of SAP customers have Joule running in production today^5,6. The reasons are not always about the product; they are often about scope.

Where Joule wins

• You are on RISE with SAP or GROW with SAP - You already have the contract, the BTP entitlement, and the AI Units credit pool.
• Workflows are SAP-internal - Sales orders, finance, procurement, HCM - all inside SAP, end to end.
• You want SAP\'s upgrade path - Joule evolves with SAP releases; you do not maintain the integration layer yourself.
• You have an SAP-only IT strategy - One vendor, one UI, one support relationship.
• You are early in S/4HANA adoption - Joule comes pre-wired; lower marginal effort than building.

Where a custom agent wins

• You are still on ECC - Joule does not run on ECC; the custom agent does.
• You run Business One - Joule is limited or absent; custom agent fits the Service Layer and B1if naturally.
• The workflow crosses systems - Order arrives in M365, gets validated against your CRM, posted in SAP, copied to DATEV. Joule lives in SAP\'s walls; the custom agent does not.
• You are not on RISE / GROW - On-premise S/4HANA without the cloud add-on means Joule needs more setup; the custom agent does not care.
• You need EU sovereignty with a non-SAP model - Mistral, Aleph Alpha, or self-hosted models need to run alongside the agent; SAP AI Core is one option, not the only one.
• You want pricing tied to outcomes, not AI Units - Joule billing is based on AI Unit consumption; custom agents are typically priced per use case.

The 90-Day Pilot Playbook

SAP-connected agents are a forgiving place to pilot precisely because SAP is the system of record. Read-only modes are easy. Approval gates are natural. Audit trails come for free. A focused 90-day pilot on one transaction gets you from kick-off to confirmed ROI without disrupting period close or the migration project.

Phase 1: Scope and Read-Only (Days 1-30)

1. Week 1: Pick the transaction - One BAPI, one OData service, one human queue. Sales-order entry, three-way match, or vendor master are the safest first picks.
2. Week 2: Auth and access - Provision the technical user, the PFCG role, the CPI iflow, the OAuth client. SI signs off on the role assignment.
3. Week 3: Data audit - Pull six months of the transaction from CDPOS / CDHDR. Tag the top patterns, the exception types, and the current cycle time. This is the baseline.
4. Week 4: Read-only pilot - Agent reads, proposes, posts the proposal to a queue for the human team to review. No SAP write yet. Compare proposal against actual human posting to measure accuracy.

Phase 2: Shadow and Approve (Days 31-60)

5. Week 5-6: Shadow run - Agent processes every incoming case in parallel with the human team. Track agreement rate, false positives, edge cases.
6. Week 7: Tune and document - Adjust confidence thresholds, document edge cases, build the runbook. Verfahrensdokumentation drafted.
7. Week 8: Selective auto-posting (top patterns) - For the most common 30 patterns at high confidence, agent posts directly through BAPI / OData with a one-click human approval. The long tail still goes to the human.

Phase 3: Expand and Measure (Days 61-90)

9. Week 9-10: Broaden auto-posting - Expand the auto-post bucket as confidence climbs. Top 50 patterns, then top 80.
10. Week 11: Operational handover - Agent partner trains your operations team on monitoring, escalation, and the one-page runbook.
11. Week 12: Measure and report - Compare against the baseline: hours saved, cycle time, error rate, exception volume. Present to the steering committee. Plan use case 2.

Compliance, Authorisation and Sovereignty

SAP-connected agents touch finance data, employee data, and customer data. Compliance is not optional and it is not someone else\'s job. The good news: SAP gives you most of the building blocks. The pattern below works for ECC, S/4HANA, and B1.

The four compliance pillars

• SAP authorisation (PFCG) - Each agent has a dedicated technical user with a scoped PFCG role. SoD analysis run before go-live. Never SAP_ALL, never a personal account.
• SAP audit trail - Every agent transaction is in the standard SAP change documents (CDPOS / CDHDR), AUT10, and STAD. The agent\'s own log adds the reasoning text alongside.
• GoBD (for finance-related transactions) - Nachvollziehbarkeit, Unveraenderbarkeit, Verfahrensdokumentation. The agent generates the documentation; the auditor reviews it.
• GDPR / DSGVO - Personal data (employees, customers, suppliers) is mapped in your Verzeichnis von Verarbeitungstaetigkeiten. AV-Vertrag (DPA) with the agent provider. Sub-processor list current.

EU AI Act fit (in force August 2026)

• Most operational SAP agents are minimal-risk - Sales orders, three-way match, inventory adjustments, AR follow-up. Obligations: AI literacy training and an entry in your AI inventory.
• HR-adjacent SAP agents can be high-risk - Candidate ranking, performance scoring against HCM data, automated promotion decisions. These need a heavier compliance pass before August 2026²⁸.
• Article 4 AI literacy - The team operating and reviewing the agent needs documented training. Bring the Betriebsrat in early to align on the scope.
• Documentation - For each agent: purpose, data sources, model, human-review checkpoint, escalation path, owner. Same template across the AI inventory.

Sovereignty options

• SAP BTP EU data centres - Frankfurt and Amsterdam regions for data residency. Standard for sovereign deployments.
• SAP AI Core with EU-hosted models - Run the agent\'s LLM through SAP AI Core for tighter SAP integration; use EU-resident foundation models.
• EU-only model providers - Mistral, Aleph Alpha, or sovereign-cloud LLM hosting for full sovereignty without depending on US-hosted models.
• Self-hosted models - For the most sensitive deployments, run an open-weight model on your own EU infrastructure. Slower upgrade cycle, full control.
• Hybrid setups - Operational SAP transactions on BTP EU; long-context reasoning on sovereign cloud. Document the chain.

How Superkind Fits

Superkind builds custom AI agents for SMEs and enterprises. For SAP-running Mittelstand firms, that means an agent shaped around your SAP edition, your transaction codes, and your SI relationship - not a generic SaaS that you have to bend your processes into.

• SAP-edition-aware - We work on ECC, S/4HANA (any deployment), and Business One. The integration adapter is different; the agent pattern is the same.
• Process-first discovery - We sit with the SAP user team, watch the actual transaction, and read the existing process documentation before we touch anything technical. No templates, no assumptions.
• SI co-design - We design the integration, the technical user, the PFCG role, and the CPI iflow with your SI in the room. Their sign-off is in scope, not a fight.
• Live in 90 days - One transaction goes from kick-off to first measurable hours saved within three months. Then we add the next.
• No platform replacement - SAP stays the system of record. The agent calls in through stable APIs and never touches the SAP application server.
• Outcome-based pricing - Per use case with a measurable ROI defined before the build. No multi-year licences, no AI-unit consumption surprises.
• EU sovereignty option - Agent runs on BTP EU or your own EU infrastructure with EU-hosted models. No transatlantic data flow when you do not want it.
• Migration-friendly - The agent built today on ECC ports to S/4HANA at cutover with the integration adapter re-pointed, not a rebuild.

Decision Framework: Where Should You Start?

Not every SAP-running Mittelstand firm needs an agent project this quarter. Use the table below as a quick read on whether to start a pilot now, prepare first, or wait.

Frequently Asked Questions

Henri Jung

Co-founder of Superkind, where he helps SMEs and enterprises deploy custom AI agents that actually fit how their teams work. Henri is passionate about closing the gap between what AI can do and the value it creates in real companies. He believes the Mittelstand has everything it needs to lead in AI - it just needs the right approach.