SAP Sapphire 2026 - SAP CTO Philipp Herzig on SAP's API Policy Changes, and Why "Organizational Memory" Matters for Agentic AI

Why It Matters

The changes balance open AI innovation with data security, influencing how partners build agentic solutions on SAP platforms. Clear policy and memory initiatives are critical for enterprises seeking trustworthy, real‑time AI insights.

Key Takeaways

• SAP API policy adds uniform fair‑use limits across all cloud apps
• Existing customer contracts are honored; no API access is blocked retroactively
• AI agents allowed via defined A2A pathways; security hardened with Cloudflare
• Organizational memory initiative aims to capture tribal knowledge for smarter agents
• User groups praise FAQ but seek clearer guidance on ODP‑RFC and MCP

Pulse Analysis

SAP's updated API Policy FAQ, unveiled at Sapphire 2026, marks a strategic shift toward consistent data access rules across its sprawling cloud suite. By establishing fair‑use limits derived from the 99th percentile of usage, SAP aims to prevent throttling for most customers while safeguarding legacy contracts. The policy also explicitly permits AI agents to interact via defined A2A integrations, a move that acknowledges the growing role of generative tools while mitigating risk through partnerships with security providers like Cloudflare. This nuanced stance signals to enterprise developers that SAP is embracing AI-driven automation without imposing hidden toll roads on data movement.

Beyond the API overhaul, SAP introduced its "organizational memory" concept, an ambitious effort to codify the tacit, tribal knowledge that resides in employee decisions and undocumented processes. Leveraging the recent Reltio acquisition, SAP plans to fuse structured data with unstructured decision traces, creating a contextual layer that AI agents can query for real‑time insights. This memory fabric promises to enhance the fidelity of autonomous workflows, enabling agents to reason with the same historical context that human experts use, ultimately driving more accurate recommendations and operational efficiencies.

The industry response underscores both optimism and caution. User groups such as DSAG and UKISUG have welcomed the clarified FAQ but stress the need for detailed guidance on legacy interfaces like ODP‑RFC and emerging standards such as MCP. Partners are already testing MCP‑based solutions outside SAP's Integration Suite, testing the limits of the new policy. As SAP continues to refine its security posture and openness, the balance it strikes will dictate whether it becomes the preferred platform for next‑generation AI agents or a bottleneck for innovation. The coming months, especially through TechEd, will reveal how effectively SAP can align security, openness, and monetization concerns.