Private AI layer for SAP S/4HANA on-premise: released APIs, CDS and a local model
SAP S/4HANA on-premise AI integration without cloud
Also searched as
- how to add a private LLM to S/4HANA on-premise
- S/4HANA CDS views AI assistant architecture
- S/4HANA private cloud edition local LLM
- SAP S/4HANA OData API AI agent
Short answer
For S/4HANA on-premise, build the AI layer on released OData APIs and CDS views rather than raw tables, replicate analytical data to a store you control, index documents separately, and serve an open-weight model on local GPUs. CDS access control and PFCG roles carry the user's permissions into answers. Writes use released APIs after human approval, which keeps the core clean and upgrade-safe.
Applies to: SAP S/4HANA on-premise (1909 onward in practice) and S/4HANA Cloud, private edition. Public cloud editions restrict custom code and network paths and are out of scope here.
Wire a private AI layer into S/4HANA
- 1List the released APIs for your scope in SAP Business Accelerator Hub and your own system's service catalog (/IWFND/MAINT_SERVICE), for example the purchase order, sales order, material document and business partner APIs. Prefer these over table reads.
- 2For analytical questions, identify the CDS views you are allowed to extract. Use the I_ interface (VDM) views and extraction-enabled views, and check released status in the ABAP Development Tools API state view.
- 3Choose the data movement: ODP-based extraction or SLT replication into a reporting store you control, or live OData calls through the Gateway hub for small result sets. Do not read tables like ACDOCA or MATDOC from outside on a high-frequency schedule against production.
- 4Create a communication user and communication arrangement in the system for the AI layer, scoped to the communication scenarios it needs. Use per-user propagation where answers must reflect the asker's own access.
- 5Build the retrieval index over attachments (Attachment Service and GOS), DMS documents, and external SOPs and drawings. Carry company code, plant and sales organization as chunk metadata.
- 6Expose approved read actions through an MCP or internal tool server, and serve the model with vLLM on your GPUs. The model chooses tools; the tools build OData requests.
- 7Add an approval queue for drafts and write-backs, log every call, and pilot read-only first.
Data access paths on S/4HANA
S/4HANA changed the data model. Financial postings land in the universal journal table ACDOCA, material movements in MATDOC, and customers and vendors are modelled through the business partner (BUT000 and related tables). Compatibility views keep old table names readable for old code, but they are not a stable contract for new integrations. SAP's direction is the virtual data model: CDS views, with released ones carrying a stability guarantee, exposed as OData services, and wrapped by released APIs such as the purchase order and sales order services.
Use the layers in this order. First, released OData APIs for transactional reads and approved writes. Second, extraction-enabled CDS views through ODP or SLT for bulk analytics. Third, only if neither covers it, a custom CDS view with its own access control, built in the system by your ABAP team. Direct SQL against the HANA schema is the last resort and in many contracts and RISE-style private cloud setups it is not available at all, so design as if it were not.
# Read recent purchase orders through a released OData service (verify service path and fields on your release)
GET /sap/opu/odata/sap/API_PURCHASEORDER_PROCESS_SRV/A_PurchaseOrder
?$filter=PurchaseOrderDate ge datetime'2026-09-01T00:00:00'
&$select=PurchaseOrder,Supplier,PurchasingOrganization,PurchaseOrderDate
&$top=100
Accept: application/json-- Replica query on extracted universal journal data (column names illustrative, check your extraction view) SELECT RBUKRS, GJAHR, RACCT, RCNTR, SUM(HSL) AS amount_local FROM acdoca_replica WHERE RLDNR = '0L' AND GJAHR = '2026' AND RBUKRS = '1000' GROUP BY RBUKRS, GJAHR, RACCT, RCNTR;
Reference architecture and the private cloud edition
The components match any private AI layer: a reporting store fed by ODP or SLT, a retrieval index, a tool server wrapping OData calls, a locally served open-weight model, an identity layer and an audit log. What differs on S/4HANA is that the contract is the API. If your tool server only calls released services and extraction views, the same layer survives upgrades and conversions, because SAP keeps those interfaces stable.
On S/4HANA Cloud, private edition, SAP or a hosting partner runs the landscape. You usually get API access over a private network path but not database access and not arbitrary add-ons on the application server. Plan the network route between your GPU cluster and the hosted system early, and agree what data may be replicated out. If policy forbids any replication to your premises, the AI layer must run in the same sovereign zone as the system, or use live API calls only.
For an air-gapped plant running S/4HANA on-premise, everything above runs inside the enclave: model weights, container images, and the retrieval index are imported through a controlled transfer, and no component needs outbound internet.
S/4HANA --(released OData / CDS via Gateway)--> tool server --> orchestrator --> vLLM (local GPUs) S/4HANA --(ODP / SLT)--> reporting store (approved views only) Attachments + DMS + SOPs --> parser --> retrieval index (company code / plant metadata) Identity: SSO user mapped to SAP user; communication user for background sync Audit: append-only log of question, tool, parameters, row keys returned
Permissions and write-back
S/4HANA authorizations still run through PFCG roles and authorization objects, and for CDS views the equivalent is the access control definition (DCL) attached to the view, which restricts rows by the user's authorization values. A view without access control, or called by a user with broad technical rights, returns everything. Insist that every CDS view in your tool contract has a DCL, and test with a restricted user.
For per-user fidelity, propagate the asker's identity to the API call (OAuth with SAML bearer assertion or principal propagation through your gateway). For mirrored filters, export authorization values and apply them in the replica and index. Business partner and organizational filters (company code, purchasing organization, plant) are the usual dimensions.
Write-back goes through released APIs only: for example creating a purchase requisition or posting a confirmation via the corresponding service, after a human approves the drafted payload in a separate screen. Keep idempotency keys and store the exact payload in the audit log. Never write to ACDOCA or MATDOC or any table directly; the HANA core relies on posting logic for consistency.
Sizing, rollout and limits
As ranges: 100 to 300 named users on a 30B to 70B open-weight model are commonly served from two to four data-centre GPUs, with the reporting store and index on ordinary servers. ACDOCA volumes can be very large, so extract aggregates and recent periods rather than every line, unless a use case demands line items.
Phases: read-only questions through released APIs and the replica; then drafts (supplier emails, exception summaries, requisition drafts); then approved actions through APIs. Measure answer accuracy against a fixed question set before each phase.
Limits. SAP's own AI (Joule and embedded intelligent scenarios) is built for SAP-managed cloud and may be enough if you are already there and your data policy allows it; this architecture is for teams that must keep data and inference on their premises. Free-text business questions that depend on heavy custom Z logic will need that logic exposed as an API first. Public cloud editions are a different problem. And note that some APIs paginate or limit page size, so design the tool code to page and aggregate rather than request everything.
Try it here, free
SAP RISE vs On-Premise TCO Calculator
Model the multi-year total cost of RISE with SAP against an on-premise or self-hosted S/4HANA, using your own cost inputs.
Common pitfalls
- !Reading ACDOCA or MATDOC directly on a schedule from an external tool, hurting performance and ignoring access control.
- !Building on compatibility views or non-released CDS views, then breaking at the next upgrade.
- !Exposing a custom CDS view without a DCL, which returns data regardless of the user's authorizations.
- !Assuming private cloud edition gives database access; it generally does not.
- !Pulling every journal line into the index instead of aggregates, inflating storage and latency.
- !Letting the model construct OData filters from free text instead of typed tool parameters.
How an ERP-grounded AI assistant handles this
ERPray calls S/4HANA through released OData services and approved views, shows the request behind each answer, and keeps the model on your hardware. A sensible first scope is three or four read tools plus a document index, then drafting. Write actions stay behind approval and released APIs, so the core stays clean through upgrades.
Frequently asked questions
Should I use CDS views or OData APIs for AI access?
Use released OData APIs for transactional reads and approved writes, and released CDS views through ODP or SLT for bulk analytics. Both are stable contracts SAP maintains across upgrades. Custom CDS views are fine when they carry their own access control. Avoid raw table reads and non-released objects.
Can we run the LLM on our own GPUs if S/4HANA is in a private cloud edition?
Usually yes, if you establish a private network path and agree what data may leave the hosted zone. The model can run on your GPUs and call released APIs over that path. Replication of large datasets out of the hosted environment needs a policy decision first.
Does Joule make this unnecessary?
Not for everyone. Joule fits teams on SAP-managed cloud services that accept SAP's data handling. If you need inference and data to stay on your premises, need non-SAP sources in the same answer, or run air-gapped, a self-hosted layer is the practical option.
How do we keep row-level security?
Give every CDS view an access control definition, propagate the user's identity on API calls, or mirror authorization values into the replica and retrieval filters. Test with restricted users and fail closed: if a user's filters cannot be determined, return nothing.
Related
SAP ECC 2027: what mid-size manufacturers should actually do
SAP's mainstream maintenance for ECC 6.0 ends in 2027, with extended maintenance available at additional cost typically through around 2030 depending on the specific agreement. Mid-size manufacturers have three real options: migrate to S/4HANA (on-prem or cloud) before 2027, pay for extended maintenance to buy 2-3 more years, or move off SAP entirely. With limited internal SAP resourcing, most mid-size manufacturers should already be past discovery and into a scoped S/4HANA conversion plan by now, or actively budgeting for extended maintenance as a deliberate bridge, not a default.
How-toSAP SE16N vs SQVI: Table Browser vs Ad Hoc Query
SE16N is a single-table browser: fast filtering, formatted display, and export from one table at a time, with an optional edit function for authorized users. SQVI (Quick Viewer) builds ad hoc queries that join multiple tables without writing ABAP, and can be saved as a reusable report. Use SE16N for a quick look at one table; use SQVI when you need data joined across two or more tables.
How-toHow to Use BAPI_TRANSACTION_COMMIT Correctly
SAP's BAPI programming model separates business logic from the database commit on purpose, so a caller must explicitly call BAPI_TRANSACTION_COMMIT after a successful BAPI - usually with WAIT = 'X' - or the created object never actually persists. Skipping this step, or forgetting WAIT, is the most common reason a BAPI 'runs fine' but nothing gets saved.
AdvancedHow to add AI to SAP ECC 6.0 on-prem without moving data to a cloud
You add AI to SAP ECC 6.0 by leaving ECC where it is and building a read-only layer beside it: RFC-enabled function modules and BAPIs for live lookups, an SLT or database replica for bulk analytics, a retrieval index over documents, and an open-weight model served on your own GPUs. SAP's authorization objects are enforced in the tool layer so users only see what they could see in the GUI. Writes go back only through BAPIs after human approval.
Error fixSAP M7 021: Deficit of SL Stock Quantity
M7 021 fires during a goods issue, delivery, or confirmation when SAP checks the unrestricted-use (SL) stock for the exact plant, storage location and batch combination and finds less than what you are trying to post out. Fix the entry (batch, storage location, quantity) first; only enable negative stock or downgrade the message to a warning if the business genuinely needs to post ahead of a receipt.
Error fixSAP IDoc Status 51: Application Document Not Posted
Status 51 tells you the IDoc reached the application layer and failed to post, but the status text itself is not the error - the real cause sits in the status record's long text or the linked application log. Fix the underlying data or configuration, then reprocess the IDoc through BD87 rather than editing the status.
AI for ERPAI for SAP S/4HANA, Running On-Prem or in Your Private Cloud
Run AI on SAP S/4HANA without sending ERP data to a public API. On-prem and private-cloud architecture, CDS views, OData, and honest deployment trade-offs.
AI for ERPSAP Joule or a Private LLM Beside SAP: An Honest Comparison
An honest comparison of SAP Joule and Business AI against a private, self-hosted LLM beside SAP: what each covers, where they overlap, and where CIOs run both.
AI for ERPSAP BTP and a Private LLM: Where the Generative AI Hub Fits and Where It Doesn't
Where SAP BTP's Generative AI Hub fits and where a self-hosted LLM belongs instead. CAP, Integration Suite, and an architecture decision framework.
Stuck on SAP S/4HANA (on-premise and private cloud edition)?
Talk to engineers who work inside SAP S/4HANA (on-premise and private cloud edition) every week, and who build private AI that answers these questions from your own ERP data.
Keep exploring
Free tools
- SAP RISE vs On-Premise TCO CalculatorModel the multi-year total cost of RISE with SAP against an on-premise or self-hosted S/4HANA, using your own cost inputs.
- ABAP CDS View Skeleton GeneratorFill in table, fields, aliases and one association to get CDS view DDL in both the classic DDIC-based and the view entity syntax.
- ABAP Naming Convention TemplateA fill-in development standard that defines prefixes for variables, parameters, classes, DDIC objects, programs and CDS views.
ERP fixes and how-tos
- Private AI for SAP Business One: Service Layer, a read replica and a local modelAdd a private AI assistant to SAP Business One: Service Layer reads, SQL Server or HANA replica, document index, local LLM, permissions and approvals.
- SAP S/4HANA Standard Reports: Fiori, Embedded Analytics and CDS ViewsWhere standard reports live in SAP S/4HANA: Fiori analytical apps, embedded analytics and CDS views, with examples for sales reporting and Group Reporting in finance.
- How to add AI to SAP ECC 6.0 on-prem without moving data to a cloudReference architecture for a private on-prem AI assistant on SAP ECC 6.0: RFC and BAPI reads, SLT replica, retrieval index, local LLM, permission mirroring.
Runs with your ERP
- SAP Joule in S/4HANA Cloud Public Edition: what it does for manufacturersWhat SAP Joule does in S/4HANA Cloud Public Edition for manufacturers: natural-language navigation and supply chain insights, limits, setup and trade-offs.
- Avalara AvaTax with SAP S/4HANA: sales tax on orders and invoicesHow the SAP-endorsed Avalara AvaTax connector calculates US/Canada sales tax and VAT on S/4HANA sales orders and invoices, how to set it up and what breaks.
- Avalara AvaTax with SAP S/4HANA Cloud Public Edition: US sales tax for manufacturersHow Avalara AvaTax adds US sales tax calculation to SAP S/4HANA Cloud Public Edition: extension model, data flows, setup, pitfalls and private AI.
AI on your ERP
- AI for SAP S/4HANA, Running On-Prem or in Your Private CloudRun AI on SAP S/4HANA without sending ERP data to a public API. On-prem and private-cloud architecture, CDS views, OData, and honest deployment trade-offs.
- SAP Joule or a Private LLM Beside SAP: An Honest ComparisonAn honest comparison of SAP Joule and Business AI against a private, self-hosted LLM beside SAP: what each covers, where they overlap, and where CIOs run both.
Integrations
- How to add AI agents to SAP S/4HANAAdd AI agents to SAP S/4HANA through released OData APIs, BAPIs and events, with a tool layer, read-first scoping and human approval before any posting.
- How to connect Power BI to SAP S/4HANAConnect Power BI to SAP S/4HANA using the HANA connector, OData or a warehouse, set up the on-prem gateway, and build manufacturing dashboards with AI Q&A.