Every organisation now runs two AI estates – the shadow AI employees smuggle in, and the approved AI arriving through copilots, embedded assistants and the SAP roadmap itself. Most govern only the first. Drawing on 27 years on the customer side, this session shows why approval status is not a data protection strategy, and how to govern both estates before EU AI Act enforcement makes the gap expensive.

ATTENDEES WILL LEAVE WITH– A two-sided map of AI data exposure – uninvited and invited – across the SAP estate– The questions to ask of any embedded or sanctioned AI before it touches corporate data– A practical governance starting point aligned to EU AI Act obligations.