# Adding a Private AI Layer to Dynamics AX 2012 On-Prem

> Source: https://netray.co/erp-help/private-ai-layer-dynamics-ax-2012-on-prem-architecture
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: ERP Help

## Short answer

You can put a useful AI assistant on Dynamics AX 2012 without sending anything to a cloud: read from a SQL Server replica, expose a short list of approved read actions through a tool server, serve an open-weight model on local GPUs, and mirror AX security roles so answers respect what each user may see. Write-back stays human-approved and goes through AX services, never direct SQL.

## Kind

advanced

## System

dynamics

## Erp

Microsoft Dynamics AX 2012

## Module

Data access / AIF / SQL Server / Security

## Query

how to add AI to Dynamics AX 2012 on-prem

## Alternate Queries

- Dynamics AX 2012 AI integration without cloud
- AX 2012 local LLM chat over sales orders and inventory
- AX 2012 private AI architecture SQL Server AIF
- AX 2012 ChatGPT alternative on premises

## Applies To

Dynamics AX 2012 (RTM, R2, R3) on SQL Server, any hosting that lets you add a read-only SQL replica and an application server on the same network

## Steps

### How to stand up a private AI layer on AX 2012

**Items:**

Inventory what the assistant must answer: open sales and purchase orders, item availability, customer balances, production status, attached documents. Rank by how often people ask a colleague today.

Create a read-only copy of the AX business database: an AlwaysOn readable secondary, log shipping with standby, or a nightly restore. Point all assistant queries at it, never at the production AOS database.

Create a dedicated SQL login with SELECT on a small set of views you own in a separate schema. Do not grant db_datareader on the whole database.

Export and map metadata: table and field names from SQLDictionary, enum integers to labels, and DATAAREAID and PARTITION values, so the model sees readable columns.

Build a retrieval index over attachments (DocuRef and DocuValue), item descriptions, work instructions on file shares and any SSRS report text you want searchable.

Stand up a tool server that exposes named read actions (get_open_sales_orders, get_item_availability) with parameter validation, and let the model call only those.

Serve an open-weight model with vLLM or Ollama on local GPUs, wire the audit log, then pilot with ten users on read-only questions before enabling drafts.

## Sections

### Real data access paths in AX 2012

**Body:**

AX 2012 stores business data in a single SQL Server database per environment. Almost every table carries DATAAREAID (the legal entity), PARTITION (the AX partition, with the initial partition having a well-known RecId) and RECID. Main tables you will touch first are CUSTTABLE, VENDTABLE, INVENTTABLE, SALESTABLE, SALESLINE, PURCHTABLE, PURCHLINE, CUSTTRANS, INVENTTRANS and INVENTSUM. Enums are stored as integers, so an assistant needs a mapping from the AOT enum definitions to labels or it will misread status columns.

SQLDICTIONARY maps AX table and field ids to SQL names, which matters when you generate queries from natural language. For supported programmatic access AX 2012 offers the Application Integration Framework (AIF) with document services such as the sales order service, custom X++ services published through service groups on the AOS, and the Query service. Direct SQL on a replica is the pragmatic read path for analytics-style questions; services are the right path whenever business logic, security or posting rules matter.

**Code:**

-- Read-only: open sales order lines for one legal entity and the initial partition
SELECT st.SALESID, st.CUSTACCOUNT, st.SALESSTATUS, sl.ITEMID,
       sl.SALESQTY, sl.REMAINSALESPHYSICAL, sl.LINEAMOUNT
FROM   SALESTABLE st
JOIN   SALESLINE  sl ON sl.SALESID = st.SALESID
                    AND sl.DATAAREAID = st.DATAAREAID
                    AND sl.PARTITION  = st.PARTITION
WHERE  st.DATAAREAID = 'usmf'
  AND  st.PARTITION  = 5637144576   -- initial partition
  AND  st.SALESSTATUS = 1           -- backorder (open); confirm against your enum
ORDER BY st.SALESID;

### Reference architecture, including the air-gapped option

**Body:**

Keep five components inside your network. A read-only replica or reporting copy of the AX database, optionally fed by change data capture or SQL Server change tracking so the retrieval index updates incrementally. A retrieval index over documents and text fields, using a local vector store or a SQL Server or PostgreSQL extension. A tool server, typically an MCP server, that exposes approved read actions. An open-weight model (Llama, Qwen, Mistral, Gemma, gpt-oss class) served by vLLM or Ollama on local GPUs. And an audit log recording user, question, tool calls, SQL or service request and answer.

For an air-gapped site, nothing in that list needs the internet: models and Python or container packages are brought in through a controlled transfer, the replica is refreshed from backups inside the enclave, and the audit log stays local. The trade-off is operational: you own patching, model updates and evaluation, so schedule them like any other server maintenance.

**Code:**

{
  "name": "get_open_sales_orders",
  "description": "Read-only. Open sales order lines for a customer account in one legal entity.",
  "inputSchema": {
    "type": "object",
    "properties": {
      "dataAreaId": { "type": "string", "maxLength": 4 },
      "custAccount": { "type": "string", "maxLength": 20 },
      "maxRows": { "type": "integer", "maximum": 200 }
    },
    "required": ["dataAreaId", "custAccount"]
  }
}

### Permissions and write-back

**Body:**

AX 2012 security is role based: users are assigned security roles, roles contain duties, duties contain privileges that grant entry points, and extensible data security (XDS) policies filter records by constraint. Role assignments live in AX tables such as SecurityUserRole. The assistant should resolve the signed-in Windows user to an AX user, read their roles and legal entities, and pass those as filters inside every tool call. Because direct SQL bypasses XDS, either reimplement the relevant constraints in your views or send those questions through AX services that enforce them.

Write-back is a separate, later phase. Let the assistant draft a purchase requisition or a customer note, show it to the user, and on approval post it through a supported AIF document service or a custom X++ service so validation, number sequences and workflow still run. Never write to AX tables with SQL, and never let the model decide on its own to submit.

### Sizing, phased rollout and honest limits

**Body:**

A 100 to 300 user AX estate typically needs one to two inference GPUs for an 8B to 32B class model, plus a modest server for the index and tool server; a few hundred thousand documents usually index into single-digit to low tens of gigabytes. Treat these as starting ranges and size from your own question volume with the calculator linked on this site. Roll out in three phases: read-only questions for a pilot group, then drafts that a person reviews, then a small set of approved actions.

Be honest about limits. AX 2012 is out of mainstream support, so any new integration should be weighed against your Dynamics 365 plan; an assistant built on stable SQL views and a tool server moves with you, but X++ service customizations will not. Free-text answers about posting logic or inventory costing will be only as good as the documentation you index. If your need is simply scheduled reports, SSRS and Power BI are enough and an LLM adds cost without value.

## Pitfalls

- Querying the production AOS database for assistant traffic. Long scans compete with order entry; always use a replica.
- Ignoring DATAAREAID and PARTITION in joins, which returns rows from other legal entities and breaks both accuracy and confidentiality.
- Giving the model raw enum integers. It will guess labels. Map enums from the AOT metadata and test the mapping.
- Using db_datareader for the assistant's login. Grant SELECT only on curated views so new sensitive tables are not exposed by default.
- Bypassing XDS policies in direct SQL and assuming role filters are enough. Re-check any constrained table before exposing it.

## Ai Angle

Netray's ERPray approach for older Microsoft estates uses this pattern: read-only by default, the generated SQL or service call is shown with every answer, AX roles are mirrored, and the model runs on your hardware. It is a custom build per estate, not a packaged AX connector, so the first week is spent confirming which tables, views and services your users actually rely on.

## Faq

### Can AX 2012 use Microsoft Copilot?

**Answer:** Microsoft's Copilot features are built for current cloud-hosted Dynamics products, not for AX 2012. If you want natural-language access to AX 2012 data, you build it yourself on a replica and a local model, which is also what keeps data inside your network.

### Is reading the AX database directly supported?

**Answer:** Reading with SELECT from a replica is a common practice for reporting, but it bypasses AX business logic and XDS security. Use curated views and mirrored roles, and prefer AIF or X++ services whenever rules or security matter.

### Which model size is enough for AX questions?

**Answer:** Most lookup and summarisation questions work with an 8B to 32B open-weight model when retrieval and the tool server are well built. Larger models help with complex multi-step questions. Test against your own question set before buying GPUs.

### Should we do this instead of upgrading to Dynamics 365?

**Answer:** It depends on your timeline. A read-only AI layer can deliver value in weeks and lets you keep AX running, but it does not remove support risk. Design the views and tool server so they can be repointed to a successor system.

## Search terms

AX 2012 AI integration, Dynamics AX 2012 on-prem AI, AX 2012 local LLM, AX 2012 AIF services, AX 2012 SQL replica reporting, AX 2012 security roles XDS, private AI Dynamics AX, air-gapped Dynamics AX AI, AX 2012 MCP server, chat with AX 2012 data

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json