The EU AI Act: what SAP customers need to do and when

#What changed, and when

The EU AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024. Its rules switch on in stages. In July 2026 the EU changed the later stages.

On 27 July 2026, the Digital Omnibus on AI (Regulation (EU) 2026/1744) entered into force. It moved the start of the high-risk rules back by more than a year. It also softened the AI literacy duty, added a new prohibited practice, and extended some small-company relief to small mid-cap companies.

As of October 2026, the European Commission lists these dates:

The decision for you: the high-risk deadline moved, but the work did not shrink. Prohibitions, AI literacy and transparency already apply, and an SAP rollout starting in 2027 will go live under the high-risk rules.

#Why it matters to the business

The Act regulates uses of AI, not models. So the question for an SAP program is not "is our AI compliant?" but "which of our use cases fall into which tier?"

The Commission describes four tiers:

• Unacceptable risk: banned. Examples include social scoring and emotion recognition in the workplace.
• High risk: allowed with strict duties. Examples include CV-sorting software and credit scoring that decides access to a loan.
• Transparency risk: allowed if people are told. Chatbots must say they are AI; generated content must be identifiable.
• Minimal risk: no specific duties. Most back-office AI lands here.

Take three running examples:

• Hire-to-retire. A tool that ranks applicants for a requisition is a listed high-risk use (Annex III, point 4). So is AI that informs promotion or termination decisions or monitors worker performance.
• Order-to-cash. Scoring the creditworthiness of natural persons is high-risk (point 5(b)). A credit limit proposal for a company customer is not on that list, because the Act names natural persons. Fraud detection is excluded explicitly.
• Procure-to-pay. Extracting fields from supplier invoices, or explaining a three-way match exception to a clerk, is usually minimal risk. If a supplier chats with your bot, the bot must say it is AI.

The fines are large enough to reach the board. Prohibited practices can cost up to EUR 35 million or 7% of worldwide annual turnover, whichever is higher. Most other breaches can cost up to EUR 15 million or 3%. For SMEs, including start-ups, the lower of the two figures applies; small mid-cap companies get the same relief for breaches other than prohibited practices.

#How SAP does it

As of October 2026, SAP states on its Responsible AI page that it is aligning its operations with the EU AI Act. It says:

• The prohibited-practice rules (Article 5) are already implemented in its processes.
• A cross-functional team under the SAP Executive Board is building a classification process for SAP's AI use cases.
• SAP may play several roles in the AI value chain: provider, deployer or integrator.
• Every SAP AI use case goes through an AI Ethics impact assessment, which sorts it into risk categories.
• SAP holds an ISO/IEC 42001 certificate for AI governance, and publishes an FAQ on how customer data is used, with opt-outs in SAP for Me.

What SAP's work does not do is take over your duties. The Act splits duties between the provider (who builds the AI system and puts it on the market) and the deployer (who uses it in its own processes). For an AI feature SAP ships, SAP is the provider and you are the deployer. For an agent or extension your team builds on SAP BTP, your company is the provider. If you rebrand, substantially modify or repurpose a system so it becomes high-risk, you become its provider too.

#Where typical SAP AI use cases land

A first-pass view. Your legal team decides the final classification.

#Questions to ask

1. Do we have one register of every AI use case, including AI features switched on inside SAP applications and tools business units bought themselves?
2. For each high-risk candidate: are we the provider or the deployer? Did we rebrand, substantially modify or repurpose anything?
3. What has our vendor (SAP or a partner) given us for each high-risk feature: instructions for use, the intended purpose, and its own classification?
4. Which go-lives fall after 2 December 2027? Are the oversight, logging and notification steps in their plans?
5. Do our chatbots and agents tell users they are AI? Is generated content marked where required?
6. What have we done for AI literacy, and can we show it?

#Common misconceptions

• "The delay means we can wait until 2027." Prohibitions, AI literacy and transparency already apply. And a high-risk system placed on the market after December 2027 must comply from day one. An older system loses its grace period once its design changes significantly, so controls are cheaper to build in now.
• "SAP is compliant, so we are." SAP's duties as a provider don't cover yours as a deployer: human oversight, input data, logs, informing workers and affected people.
• "Anything in HR or finance is high-risk." Only the listed uses are, and the Article 6(3) exception can remove narrow or preparatory tasks. A tool that profiles people never qualifies for that exception.
• "All credit scoring is high-risk." The Annex III point covers natural persons. Business-to-business credit decisions are not on that list.
• "The model vendor handles it." General-purpose model rules bind the model provider. The system you build on top is yours.

#Key terms

All course terms, A to Z, in the glossary

• AI Act: Regulation (EU) 2024/1689, the EU law on AI systems.
• Digital Omnibus on AI: Regulation (EU) 2026/1744, in force 27 July 2026, which amended the AI Act's dates and some duties.
• Provider: the organization that develops an AI system and places it on the market or puts it into service under its name.
• Deployer: the organization that uses an AI system under its authority, for example a company using an SAP AI feature.
• High-risk AI system: a system in a listed use case (Annex III) or a safety component of a regulated product (Annex I).
• Article 6(3) exception: a listed use case is not high-risk if the system only performs a narrow or preparatory task and doesn't materially influence the decision. Never available for profiling.
• Fundamental rights impact assessment (FRIA): an assessment some deployers must do before first use, including deployers of consumer credit and life or health insurance scoring.
• AI literacy: the duty to take measures that help staff who work with AI understand it.

#Check yourself

#Mental model: duties come from two answers

Every obligation in the AI Act falls out of two questions about one use case:

1. Which tier is the use? Prohibited, high-risk, transparency or minimal. The tier depends on what the system is used for, not on the model inside it.
2. Which role do you hold? Provider (you build it and put it into service) or deployer (you use it under your authority). One company can be both, for different systems or for the same one.

The tier tells you which duties exist. The role tells you which of them are yours. The date tells you when they bite. An AI register is just these three columns kept current for every use case.

flowchart LR
  U[Use case] --> T{Tier?}
  U --> R{Role?}
  T --> D[Duties that exist]
  R --> M[Duties that are yours]
  D --> O[Your obligations]
  M --> O
  O --> W[With a start date]

#How it works

#The tiers, checked in order

A use case is checked from the strictest tier down. The first match decides the bucket, though transparency duties can stack on top of any tier.

flowchart TD
  A[AI use case] --> P{Prohibited<br/>practice?}
  P -- yes --> X[Stop: banned]
  P -- no --> H{Listed in<br/>Annex III?}
  H -- no --> T{Talks to people or<br/>generates content?}
  H -- yes --> F{Profiles<br/>people?}
  F -- yes --> HR[High-risk]
  F -- no --> E{Only a narrow or<br/>preparatory task?}
  E -- no --> HR
  E -- yes --> C[Not high-risk if<br/>documented: 6.3]
  C --> T
  HR --> T
  T -- yes --> TR[Add Article 50 duties]
  T -- no --> M[Minimal: AI literacy only]

Prohibited practices (Article 5). The Commission lists nine. Eight have applied since 2 February 2025, including social scoring, harmful manipulation, emotion recognition in workplaces and education, and untargeted scraping to build face databases. The ninth, systems that generate non-consensual sexual images or child sexual abuse material, applies from 2 December 2026. For an SAP program, the realistic trap is emotion recognition: "sentiment" features that infer how employees feel during calls or meetings.

High-risk, Annex III. The Act lists use areas in Annex III. Two matter most for SAP customers:

• Point 4, employment. (a) recruitment or selection: targeting job ads, screening and filtering applications, evaluating candidates. (b) decisions on work terms, promotion or termination, task allocation based on behavior or personal traits, and monitoring or evaluating performance.
• Point 5, essential services. (b) evaluating the creditworthiness of natural persons or setting their credit score, except for fraud detection. (c) risk assessment and pricing for natural persons in life and health insurance.

The others (biometrics, critical infrastructure, education, law enforcement, migration, justice, public benefits) are rarer in an S/4HANA landscape but can appear in public-sector or utilities customers.

The Article 6(3) filter. A system in an Annex III area is still not high-risk if it poses no significant risk of harm and doesn't materially influence the decision. It must meet at least one of four conditions: (a) a narrow procedural task, (b) improving the result of a completed human activity, (c) detecting patterns or deviations without replacing or influencing a completed human assessment without proper review, or (d) a preparatory task. Two hard limits:

• A system that profiles natural persons is always high-risk.
• The provider must document the assessment before placing the system on the market and register it (Article 6(4)). Authorities can ask to see it.

High-risk, Annex I. AI that is a safety component of a product under EU product law (machinery, medical devices and others). From 2 August 2028. Mostly relevant to manufacturers who embed AI in what they sell, not to their ERP.

Transparency (Article 50). From 2 August 2026:

• Providers must design systems that interact directly with people so that people know they are dealing with AI, unless that is obvious to a reasonably well-informed person.
• Providers of generative systems must mark outputs in a machine-readable, detectable way. There are exceptions, for example for standard assistive editing and machine-to-machine outputs. Systems already on the market before 2 August 2026 have until 2 December 2026 for this marking duty.
• Deployers must label deepfakes, and label AI-generated text published to inform the public on matters of public interest, unless a person reviews it with editorial responsibility.

General-purpose AI models. Since 2 August 2025, providers of the large models behind assistants have transparency and copyright duties, and providers of models with systemic risk must also assess and mitigate those risks. If you call such a model through an API, those duties are the model provider's. What you build around it is your system.

AI literacy (Article 4). The omnibus replaced the original wording. Providers and deployers must take measures to support the AI literacy of their staff. It doesn't require any specific level for each person. It applies to every tier, including minimal.

#Roles: when a deployer turns into a provider

Article 25 names three ways a deployer, distributor or other party becomes the provider of a high-risk system and takes on the provider's duties:

1. It puts its own name or trademark on a high-risk system already on the market.
2. It substantially modifies a high-risk system and it stays high-risk.
3. It changes the intended purpose of a system that wasn't high-risk, so that it becomes high-risk.

The third is the SAP trap. A generic summarization or matching capability is not high-risk. Wire it into a requisition so it ranks applicants, and you have changed its purpose into Annex III point 4(a). Your company now holds the provider's duties for that use.

#What a deployer of a high-risk system must do

Article 26 is the list most SAP customers will live with from 2 December 2027:

Fundamental rights impact assessment (Article 27). Public bodies, private entities providing public services, and deployers of Annex III 5(b) and 5(c) systems (consumer credit, life and health insurance) must assess the impact before first use. It covers the process, how long and how often the system is used, who is affected, the specific risks, how oversight works, and what happens when risks materialize. As amended, it can reuse parts of a GDPR data protection impact assessment, and the AI Office is to provide a simplified template.

#Fines

Article 99 sets maximum fines: up to EUR 35 million or 7% of worldwide annual turnover for prohibited practices, up to EUR 15 million or 3% for most other obligations, and up to EUR 7.5 million or 1% for misleading information to authorities, whichever is higher. For SMEs, including start-ups, the lower figure applies. The omnibus added the same relief for small mid-cap companies, except for prohibited practices.

#Build it yourself: an AI use-case register with a first-pass triage

You will build radar/ai_act_register.py. It reads a list of AI use cases from a spreadsheet file, sorts each into a review bucket (prohibited, high-risk, check the 6(3) exception, transparency, minimal), works out your role, and lists the obligations with their start dates. It writes a register you can hand to legal and compliance.

This is a triage tool. It turns the rules above into explicit, testable logic so that nothing is missed and every decision has a written reason. It does not replace a legal assessment.

Before you start: complete Set up your computer for this course. It creates your orchestrate-course folder with its .venv. This lab uses only Python's built-in modules, so there is nothing new to install.

flowchart LR
  C[ai_use_cases.csv] --> S[Triage rules]
  S --> B[Bucket + role]
  S --> O[Obligations<br/>with dates]
  B --> R[Register:<br/>CSV + Markdown]
  O --> R

#What you need

• Your course folder orchestrate-course with its .venv.
• About 35 minutes.
• Cost: free. No account, no key, no network call.

#Step 1: Open your course folder and turn on the virtual environment

1. Open VS Code, choose File > Open Folder, and open orchestrate-course.

2. Open a terminal: Terminal > New Terminal.

3. If the prompt doesn't start with (.venv), turn it on:

   • Windows (PowerShell):

     Copy

     .venv\Scripts\Activate.ps1

   • macOS / Linux:

     Copy

     source .venv/bin/activate

4. Check Python:

   Copy

   python --version

   You should see Python 3.10 or newer. On macOS or Linux without .venv, use python3 in every command.

Run every command in this topic from the course folder, not from inside radar.

#Step 2: Create the folder and the script

1. Create the radar folder if it doesn't exist yet (the certification topic also uses it):

   • Windows (PowerShell):

     Copy

     New-Item -ItemType Directory -Force radar

   • macOS / Linux:

     Copy

     mkdir -p radar

2. In VS Code, create a new file radar/ai_act_register.py, paste the whole script below, and save.

"""AI use-case register with a first-pass EU AI Act triage.

A teaching tool, not legal advice. It sorts AI use cases into review
buckets and lists the obligations and dates a lawyer should confirm.

Commands:
  python radar/ai_act_register.py sample             write radar/ai_use_cases.csv
  python radar/ai_act_register.py triage             triage every use case
  python radar/ai_act_register.py triage --as-of 2028-01-01
  python radar/ai_act_register.py explain UC-02      show the reasoning for one use case
  python radar/ai_act_register.py dates              the application timeline
"""
import argparse
import csv
import sys
from datetime import date
from pathlib import Path

HERE = Path(__file__).resolve().parent
CASES = HERE / "ai_use_cases.csv"
REGISTER_CSV = HERE / "ai_act_register.csv"
REGISTER_MD = HERE / "ai_act_register.md"

# Application dates of Regulation (EU) 2024/1689 as amended by the
# Digital Omnibus on AI, Regulation (EU) 2026/1744 (in force 27 July 2026).
DATES = {
    "prohibitions": date(2025, 2, 2),
    "ai_literacy": date(2025, 2, 2),
    "gpai": date(2025, 8, 2),
    "transparency": date(2026, 8, 2),
    "marking_legacy": date(2026, 12, 2),   # Art. 50(2) for systems on the market before 2 Aug 2026
    "new_prohibitions": date(2026, 12, 2),  # nudification and CSAM generators
    "annex_iii": date(2027, 12, 2),
    "annex_i": date(2028, 8, 2),
}

TIMELINE = [
    ("2024-08-01", "The AI Act enters into force"),
    ("2025-02-02", "Prohibited practices and AI literacy apply"),
    ("2025-08-02", "Obligations for general-purpose AI model providers apply"),
    ("2026-07-27", "Digital Omnibus on AI (Regulation (EU) 2026/1744) enters into force"),
    ("2026-08-02", "Most rules apply; Article 50 transparency; enforcement starts"),
    ("2026-12-02", "New prohibitions; Art. 50(2) marking deadline for systems already on the market"),
    ("2027-12-02", "High-risk rules for Annex III use cases (HR, credit, insurance...)"),
    ("2028-08-02", "High-risk rules for AI in products under Annex I"),
]

ANNEX_III = {
    "recruitment": ("4(a)", "recruitment or selection of people"),
    "worker_management": ("4(b)", "decisions on work terms, promotion, termination, task allocation by traits, or monitoring of workers"),
    "credit_natural_person": ("5(b)", "creditworthiness or credit score of natural persons"),
    "life_health_insurance": ("5(c)", "risk assessment and pricing for life or health insurance"),
}

PROHIBITED = {
    "emotion_workplace": "emotion recognition in the workplace or in education (Art. 5(1)(f))",
    "social_scoring": "social scoring (Art. 5(1)(c))",
}

# Article 6(3): an Annex III system may not be high-risk if it only does one of these.
EXCEPTION_6_3 = {
    "narrow_task": "(a) a narrow procedural task",
    "improves_completed": "(b) improves the result of a completed human activity",
    "pattern_check": "(c) detects patterns or deviations without replacing human assessment",
    "prepares": "(d) a preparatory task for the assessment",
}

FIELDS = ["id", "name", "process", "sap_area", "built_by", "our_changes", "affects",
          "decision_area", "influence", "profiling", "talks_to_people",
          "generates_content", "publishes_public_text", "prohibited_flag", "public_service"]

SAMPLE = [
    ["UC-01", "Supplier chatbot for invoice status", "procure-to-pay", "S/4HANA + BTP", "us", "none",
     "business_contacts", "none", "decides", "no", "yes", "yes", "no", "none", "no"],
    ["UC-02", "CV ranking for open requisitions", "hire-to-retire", "SuccessFactors Recruiting", "partner", "configured",
     "candidates", "recruitment", "recommends", "yes", "no", "no", "no", "none", "no"],
    ["UC-03", "Invoice field extraction", "procure-to-pay", "Document AI", "sap", "configured",
     "none", "none", "narrow_task", "no", "no", "no", "no", "none", "no"],
    ["UC-04", "Credit limit proposal for business customers", "order-to-cash", "S/4HANA credit management", "us", "none",
     "business_customers", "none", "recommends", "no", "no", "no", "no", "none", "no"],
    ["UC-05", "Consumer financing score at checkout", "order-to-cash", "Commerce + BTP", "us", "none",
     "consumers", "credit_natural_person", "decides", "yes", "no", "no", "no", "none", "no"],
    ["UC-06", "Interview-notes summary for recruiters", "hire-to-retire", "BTP + generative AI hub", "us", "none",
     "candidates", "recruitment", "prepares", "no", "no", "yes", "no", "none", "no"],
    ["UC-07", "Agent-mood detection on service calls", "lead-to-cash", "Service Cloud + partner", "partner", "configured",
     "employees", "worker_management", "recommends", "yes", "no", "no", "no", "emotion_workplace", "no"],
    ["UC-08", "Blocked-order explanation agent", "order-to-cash", "Joule Studio", "us", "none",
     "employees", "none", "recommends", "no", "yes", "yes", "no", "none", "no"],
]

ALLOWED = {
    "built_by": {"sap", "partner", "us"},
    "our_changes": {"none", "configured", "own_name", "substantial", "new_purpose"},
    "decision_area": set(ANNEX_III) | {"none"},
    "influence": set(EXCEPTION_6_3) | {"decides", "recommends"},
    "profiling": {"yes", "no"},
    "talks_to_people": {"yes", "no"},
    "generates_content": {"yes", "no"},
    "publishes_public_text": {"yes", "no"},
    "prohibited_flag": set(PROHIBITED) | {"none"},
    "public_service": {"yes", "no"},
}


def load(path):
    if not path.exists():
        sys.exit(f"No file at {path}. Run: python radar/ai_act_register.py sample")
    with path.open(newline="", encoding="utf-8") as f:
        rows = list(csv.DictReader(f))
    for n, row in enumerate(rows, start=2):
        missing = [k for k in FIELDS if k not in row]
        if missing:
            sys.exit(f"{path.name} is missing columns: {', '.join(missing)}")
        for key, allowed in ALLOWED.items():
            value = row[key].strip().lower()
            if value not in allowed:
                sys.exit(f"Line {n} ({row['id']}): {key}='{row[key]}' is not one of {sorted(allowed)}")
            row[key] = value
    return rows


def role_of(uc):
    """Provider or deployer, following the Article 25 triggers."""
    if uc["built_by"] == "us":
        return "provider", "you built it and put it into service, so you are also its deployer"
    if uc["our_changes"] in {"own_name", "substantial", "new_purpose"}:
        return "provider", f"Art. 25: you {uc['our_changes'].replace('_', ' ')} a system someone else built"
    return "deployer", f"{uc['built_by'].upper()} is the provider; you use it under your authority"


def obligation(text, starts, as_of):
    status = "in force" if as_of >= starts else f"from {starts.isoformat()}"
    return f"{text} [{status}]"


def triage(uc, as_of):
    """Return (bucket, role, reasons, obligations). First pass only."""
    reasons, duties = [], []
    role, why_role = role_of(uc)
    reasons.append(f"Role: {role} ({why_role}).")

    # 1. Prohibited practices come first: nothing else matters if one applies.
    if uc["prohibited_flag"] != "none":
        reasons.append(f"Matches a prohibited practice: {PROHIBITED[uc['prohibited_flag']]}.")
        duties.append(obligation("Stop or redesign: prohibited practice", DATES["prohibitions"], as_of))
        return "PROHIBITED", role, reasons, duties

    # 2. Annex III high-risk areas, then the Article 6(3) filter.
    bucket = "MINIMAL"
    area = ANNEX_III.get(uc["decision_area"])
    if area:
        point, label = area
        reasons.append(f"Annex III point {point}: {label}.")
        if uc["profiling"] == "yes":
            reasons.append("Profiles natural persons, so the Art. 6(3) exception cannot apply.")
            bucket = "HIGH-RISK"
        elif uc["influence"] in EXCEPTION_6_3:
            reasons.append(f"May fit the Art. 6(3) exception: {EXCEPTION_6_3[uc['influence']]}.")
            bucket = "CHECK 6(3)"
        else:
            reasons.append(f"It {uc['influence']} on the outcome, so it materially influences the decision.")
            bucket = "HIGH-RISK"
    elif uc["affects"] == "business_customers" and uc["influence"] in {"decides", "recommends"}:
        reasons.append("Credit or risk scoring of companies is outside Annex III 5(b), which names natural persons. "
                       "Re-check if sole traders or individuals are scored.")

    if bucket == "HIGH-RISK":
        if role == "provider":
            duties.append(obligation("Provider duties: risk management, data quality, logging, technical "
                                     "documentation, information for deployers, human oversight, robustness, "
                                     "cybersecurity and accuracy", DATES["annex_iii"], as_of))
        else:
            duties.append(obligation("Deployer duties (Art. 26): use per instructions, competent human oversight, "
                                     "relevant input data, monitoring, keep logs at least six months",
                                     DATES["annex_iii"], as_of))
        if uc["affects"] == "employees":
            duties.append(obligation("Inform workers' representatives and affected workers before use (Art. 26(7))",
                                     DATES["annex_iii"], as_of))
        duties.append(obligation("Tell affected people that a high-risk system supports decisions about them "
                                 "(Art. 26(11))", DATES["annex_iii"], as_of))
        if uc["decision_area"] in {"credit_natural_person", "life_health_insurance"} or uc["public_service"] == "yes":
            duties.append(obligation("Fundamental rights impact assessment before first use (Art. 27)",
                                     DATES["annex_iii"], as_of))
    elif bucket == "CHECK 6(3)":
        if role == "provider":
            duties.append(obligation("Document the Art. 6(3) assessment before go-live and register it "
                                     "(Art. 6(4)); otherwise treat as high-risk", DATES["annex_iii"], as_of))
        else:
            duties.append(obligation("Ask the provider for its Art. 6(3) assessment; keep it on file",
                                     DATES["annex_iii"], as_of))

    # 3. Article 50 transparency, which stacks on top of any bucket.
    if uc["talks_to_people"] == "yes" and role == "provider":
        duties.append(obligation("Tell people they are interacting with AI unless obvious (Art. 50(1))",
                                 DATES["transparency"], as_of))
    if uc["generates_content"] == "yes" and role == "provider":
        duties.append(obligation("Mark generated content in a machine-readable way where feasible (Art. 50(2)); "
                                 "check exemptions such as assistive editing", DATES["transparency"], as_of))
    if uc["publishes_public_text"] == "yes":
        duties.append(obligation("Label AI-generated text published on matters of public interest unless a "
                                 "person reviews it with editorial responsibility (Art. 50(4))",
                                 DATES["transparency"], as_of))
    if bucket == "MINIMAL" and any(d.startswith(("Tell people", "Mark", "Label")) for d in duties):
        bucket = "TRANSPARENCY"

    # 4. Applies to every use case.
    duties.append(obligation("Support AI literacy of the staff who run it (Art. 4)", DATES["ai_literacy"], as_of))
    return bucket, role, reasons, duties


def cmd_sample(_args):
    with CASES.open("w", newline="", encoding="utf-8") as f:
        writer = csv.writer(f)
        writer.writerow(FIELDS)
        writer.writerows(SAMPLE)
    print(f"Wrote {len(SAMPLE)} sample use cases to {CASES.relative_to(HERE.parent)}")


def cmd_triage(args):
    rows = load(Path(args.file))
    as_of = args.as_of
    results = []
    for uc in rows:
        bucket, role, reasons, duties = triage(uc, as_of)
        results.append((uc, bucket, role, reasons, duties))

    print(f"First-pass triage as of {as_of.isoformat()} ({len(rows)} use cases). Not legal advice.\n")
    print(f"{'ID':<6} {'Bucket':<13} {'Role':<9} Use case")
    for uc, bucket, role, _, _ in results:
        print(f"{uc['id']:<6} {bucket:<13} {role:<9} {uc['name']}")

    counts = {}
    for _, bucket, _, _, _ in results:
        counts[bucket] = counts.get(bucket, 0) + 1
    print("\nTotals: " + ", ".join(f"{k} {v}" for k, v in sorted(counts.items())))

    with REGISTER_CSV.open("w", newline="", encoding="utf-8") as f:
        writer = csv.writer(f)
        writer.writerow(["id", "name", "process", "sap_area", "bucket", "role", "obligations", "reasons"])
        for uc, bucket, role, reasons, duties in results:
            writer.writerow([uc["id"], uc["name"], uc["process"], uc["sap_area"], bucket, role,
                             " | ".join(duties), " ".join(reasons)])

    lines = [f"# AI use-case register (first-pass EU AI Act triage, {as_of.isoformat()})", "",
             "Not legal advice. Every HIGH-RISK, CHECK 6(3) and PROHIBITED row needs review by legal and compliance.", "",
             "| ID | Use case | Process | Bucket | Role |", "| --- | --- | --- | --- | --- |"]
    for uc, bucket, role, _, _ in results:
        lines.append(f"| {uc['id']} | {uc['name']} | {uc['process']} | {bucket} | {role} |")
    for uc, bucket, role, reasons, duties in results:
        lines += ["", f"## {uc['id']}: {uc['name']}", "", f"**Bucket:** {bucket}", ""]
        lines += [f"- {r}" for r in reasons]
        lines += ["", "**Obligations to confirm:**", ""] + [f"- {d}" for d in duties]
    REGISTER_MD.write_text("\n".join(lines) + "\n", encoding="utf-8")
    print(f"Wrote {REGISTER_CSV.relative_to(HERE.parent)} and {REGISTER_MD.relative_to(HERE.parent)}")


def cmd_explain(args):
    rows = load(Path(args.file))
    match = [uc for uc in rows if uc["id"].lower() == args.id.lower()]
    if not match:
        sys.exit(f"No use case {args.id}. IDs: {', '.join(uc['id'] for uc in rows)}")
    uc = match[0]
    bucket, role, reasons, duties = triage(uc, args.as_of)
    print(f"{uc['id']}: {uc['name']} ({uc['process']}, {uc['sap_area']})")
    print(f"Bucket: {bucket}\n\nWhy:")
    for r in reasons:
        print(f"  - {r}")
    print("\nObligations to confirm:")
    for d in duties:
        print(f"  - {d}")


def cmd_dates(args):
    print(f"EU AI Act timeline (as amended by Regulation (EU) 2026/1744), checked against {args.as_of.isoformat()}:\n")
    for day, text in TIMELINE:
        mark = "done " if date.fromisoformat(day) <= args.as_of else "ahead"
        print(f"  [{mark}] {day}  {text}")


def main():
    parser = argparse.ArgumentParser(description="AI use-case register with a first-pass EU AI Act triage.")
    sub = parser.add_subparsers(dest="command", required=True)
    common = argparse.ArgumentParser(add_help=False)
    common.add_argument("--file", default=str(CASES), help="CSV of use cases (default radar/ai_use_cases.csv)")
    common.add_argument("--as-of", type=date.fromisoformat, default=date.today(),
                        help="date to check obligations against, YYYY-MM-DD (default today)")
    sub.add_parser("sample", help="write the sample use cases")
    sub.add_parser("triage", parents=[common], help="triage every use case and write the register")
    p_explain = sub.add_parser("explain", parents=[common], help="show the reasoning for one use case")
    p_explain.add_argument("id")
    sub.add_parser("dates", parents=[common], help="print the application timeline")
    args = parser.parse_args()
    {"sample": cmd_sample, "triage": cmd_triage, "explain": cmd_explain, "dates": cmd_dates}[args.command](args)


if __name__ == "__main__":
    main()

#Step 3: Write the sample use cases

1. Run:

   Copy

   python radar/ai_act_register.py sample

2. You should see:

   Copy

   Wrote 8 sample use cases to radar/ai_use_cases.csv

3. Open radar/ai_use_cases.csv in VS Code or a spreadsheet. Each row is one use case from an SAP landscape. The columns describe facts, not conclusions: who built it (built_by), what you changed (our_changes), who it affects (affects), which Annex III area it touches (decision_area), how strongly it shapes the outcome (influence), and whether it profiles people, talks to people, generates content or publishes text.

#Step 4: Triage every use case

1. Run the triage against a fixed date so your output matches this page:

   Copy

   python radar/ai_act_register.py triage --as-of 2026-10-14

2. You should see:

   Copy

   First-pass triage as of 2026-10-14 (8 use cases). Not legal advice.
   
   ID     Bucket        Role      Use case
   UC-01  TRANSPARENCY  provider  Supplier chatbot for invoice status
   UC-02  HIGH-RISK     deployer  CV ranking for open requisitions
   UC-03  MINIMAL       deployer  Invoice field extraction
   UC-04  MINIMAL       provider  Credit limit proposal for business customers
   UC-05  HIGH-RISK     provider  Consumer financing score at checkout
   UC-06  CHECK 6(3)    provider  Interview-notes summary for recruiters
   UC-07  PROHIBITED    deployer  Agent-mood detection on service calls
   UC-08  TRANSPARENCY  provider  Blocked-order explanation agent
   
   Totals: CHECK 6(3) 1, HIGH-RISK 2, MINIMAL 2, PROHIBITED 1, TRANSPARENCY 2
   Wrote radar/ai_act_register.csv and radar/ai_act_register.md

3. Open radar/ai_act_register.md. It has a summary table and one section per use case with the reasons and obligations. This is the file you would attach to a governance review.

Leave out --as-of to check against today's date.

#Step 5: Read the reasoning for one use case

1. Ask why the interview-notes summary is not simply high-risk:

   Copy

   python radar/ai_act_register.py explain UC-06 --as-of 2026-10-14

2. You should see:

   Copy

   UC-06: Interview-notes summary for recruiters (hire-to-retire, BTP + generative AI hub)
   Bucket: CHECK 6(3)
   
   Why:
     - Role: provider (you built it and put it into service, so you are also its deployer).
     - Annex III point 4(a): recruitment or selection of people.
     - May fit the Art. 6(3) exception: (d) a preparatory task for the assessment.
   
   Obligations to confirm:
     - Document the Art. 6(3) assessment before go-live and register it (Art. 6(4)); otherwise treat as high-risk [from 2027-12-02]
     - Mark generated content in a machine-readable way where feasible (Art. 50(2)); check exemptions such as assistive editing [in force]
     - Support AI literacy of the staff who run it (Art. 4) [in force]

3. Now run explain UC-04. The company credit proposal comes out MINIMAL with a reminder that Annex III 5(b) names natural persons. That one reason line is the kind of judgment you want written down, because someone will ask.

#Step 6: Move the clock forward

1. Check the same register as it will stand in January 2028:

   Copy

   python radar/ai_act_register.py explain UC-02 --as-of 2028-01-01

2. The deployer duties for the CV ranking now say [in force] instead of [from 2027-12-02]. The buckets don't change with time; only the status of each duty does.

3. Print the timeline:

   Copy

   python radar/ai_act_register.py dates --as-of 2026-10-14

   Copy

   EU AI Act timeline (as amended by Regulation (EU) 2026/1744), checked against 2026-10-14:
   
     [done ] 2024-08-01  The AI Act enters into force
     [done ] 2025-02-02  Prohibited practices and AI literacy apply
     [done ] 2025-08-02  Obligations for general-purpose AI model providers apply
     [done ] 2026-07-27  Digital Omnibus on AI (Regulation (EU) 2026/1744) enters into force
     [done ] 2026-08-02  Most rules apply; Article 50 transparency; enforcement starts
     [ahead] 2026-12-02  New prohibitions; Art. 50(2) marking deadline for systems already on the market
     [ahead] 2027-12-02  High-risk rules for Annex III use cases (HR, credit, insurance...)
     [ahead] 2028-08-02  High-risk rules for AI in products under Annex I

#Step 7: Save your work

git add radar/ai_act_register.py radar/ai_use_cases.csv
git commit -m "Radar: AI use-case register with EU AI Act triage"

The generated register files are outputs. Regenerate them whenever the CSV changes; commit them only if your team reviews them in Git.

#What each part of the script does

#If something goes wrong

#The SAP way

There is no SAP product that "does" AI Act compliance for you. What SAP offers is its own work as a provider, plus the building blocks for the evidence a deployer or a builder needs.

#What SAP says about its role (as of October 2026)

SAP's Responsible AI page states that it is aligning its operations with the EU AI Act, that the Article 5 prohibited-practice rules are already implemented, and that a cross-functional team under the Executive Board is building a classification process. It says every SAP AI use case goes through an AI Ethics impact assessment that assigns a risk category, and that SAP may act as provider, deployer or integrator. SAP also holds an ISO/IEC 42001 certificate for AI governance and publishes an FAQ on data use and opt-outs.

For your register, that translates into three asks to SAP or the partner that delivered each AI feature:

1. The intended purpose and instructions for use. Your Article 26 duties are defined against them.
2. The provider's classification, and for a listed area its Article 6(3) assessment if it concluded the feature isn't high-risk.
3. What the feature logs, where, and for how long, so you can meet the six-month minimum for logs you control.

#What you build on SAP BTP is yours

An agent built in Joule Studio, a CAP extension calling the generative AI hub, or a Python service on SAP AI Core makes your company the provider of that AI system. The model provider's general-purpose AI duties don't cover it. The evidence you need maps to topics in this course:

The governance process around all of this (who approves, change control, incident handling) is covered in AI governance for SAP programs.

#Build vs. SAP

#Production concerns

• Inventory first, including the quiet AI. Many AI features in SAP applications are switched on by configuration. Scan scope items, feature toggles and BTP subaccounts, not only projects with "AI" in the name.
• Classification is a decision with an owner. Record who decided a tier, on which facts, and when. Re-run it when the use changes. The script's reasons column is the minimum.
• Human oversight must be real. An approval button that people click without reading is not competent oversight. Measure override rates and review time, and train approvers.
• Logs and retention. Six months is the floor for logs you control. Personal data in those logs still falls under GDPR, so set retention with your data protection officer, and keep business data out of trace payloads where you can.
• SAP authorizations are part of the control. Who can change the AI's configuration, prompts or thresholds is a change-control question. Use roles and transports, not shared admin users.
• Workers' information takes time. In many EU countries informing or consulting works councils has its own lead time. Put it in the project plan before go-live.
• Clean core still applies. Build AI side by side on BTP rather than modifying standard code. It keeps the line between SAP's feature (SAP as provider) and yours (you as provider) clear.
• Watch the dates. They moved once already. Keep the dates in one place, as the script does, and check the Commission's AI Act pages in each quarterly review.

#Pitfalls

• Classifying the model instead of the use. The same model is minimal-risk in invoice extraction and high-risk in applicant ranking.
• Accidental provider status. Repurposing a generic capability into recruiting or consumer credit makes you its provider.
• Leaning on the 6(3) exception for profiling. It never applies when the system profiles people.
• Forgetting that "obvious" is narrow. The chatbot exception applies only when a reasonably well-informed person would clearly see it is AI. A short notice is cheap.
• Treating company credit like consumer credit, or the reverse. Annex III 5(b) names natural persons. Sole traders are natural persons.
• One-time assessments. A FRIA must be updated when the facts change, and a classification must be redone when the use changes.
• Hard-coding dates in slides. Teams plan against stale dates. Keep a single source and its date of last check.

#Exercise

Add a use case from your own SAP world, triage it, and record a decision the script can't make for you. The register you build here feeds AI governance for SAP programs.

Before you start: finish Build it yourself above, at least Steps 3 and 4.

1. Open radar/ai_use_cases.csv in VS Code.

2. Add this line at the end and save:

   Copy

   UC-09,Shift assignment by reliability score,plan-to-produce,S/4HANA + BTP,us,none,employees,worker_management,decides,yes,no,no,no,none,no

3. Run:

   Copy

   python radar/ai_act_register.py explain UC-09 --as-of 2026-10-14

   You should see Bucket: HIGH-RISK, a reason naming Annex III point 4(b), a line saying the system profiles natural persons, and a duty to inform workers' representatives before use.

4. Add one more line for a use case you know from a real project, using only the allowed values listed in ALLOWED in the script. Run triage --as-of 2026-10-14 and check that your row appears.

5. Create radar/classification_decisions.md. For your own use case, write four lines: the bucket the script gave, whether you agree, the fact that decided it (for example the provider's intended purpose, or whether natural persons are scored), and who should confirm it in your organization.

6. Commit:

   Copy

   git add radar/ai_use_cases.csv radar/classification_decisions.md
   git commit -m "Radar: add own use cases and classification decisions"

Done when explain UC-09 shows HIGH-RISK with the workers' information duty, triage lists ten use cases, and classification_decisions.md records your judgment on your own use case.

#Check yourself