SAP ECC 6.0 private AI layer blueprint generator
This generator turns a few facts about your SAP ECC 6.0 landscape into a structured architecture plan for a private AI layer: data access path, reporting copy, retrieval index, model serving, tool server, identity and audit. Export it to PDF or Word and take it to your architecture and security review.
Fill in
SAP ECC Private AI Layer Blueprint Generator
Private AI Layer Architecture Plan: SAP ECC 6.0
Prepared for: Acme Precision Ltd System: ECC 6.0 EHP7 on Oracle Hosting: On-prem server Named users: 400 Sites: 3 plants Target go-live: 2027-03-31
Context and scope
Acme Precision Ltd runs ECC 6.0 EHP7 and wants an AI assistant that works on its own data without moving that data to an external service. The assistant is read-only first, answers with cited records, and writes back only through supported interfaces after human approval.
Main use cases: Open PO and delivery status, stock by plant, vendor performance questions, SOP and drawing search, draft vendor emails
Data that must never leave the site: Pricing conditions, bank details, HR data, ITAR controlled technical data, customer contract terms
Components
| Component | Design | Notes |
|---|---|---|
| Data access path | RFC-enabled function modules and BAPIs (for example BAPI_PO_GETDETAIL1) for live lookups; SLT or database replication for bulk tables (EKKO, EKPO, EKET, EKBE, MARA, MARC, MARD, VBAK, VBAP) | No direct reads on production; confirm SAP licence terms on third-party database access |
| Reporting copy | Approved tables only, column allow-list, refreshed by SLT or CDC for Acme Precision Ltd | Restricted columns excluded at the replication filter |
| Retrieval index | GOS and ArchiveLink attachments, DMS documents (DRAW), SOPs and drawings from shares, chunk metadata carries plant and company code | Re-index on change; delete on source delete |
| Model serving | Open-weight model on vLLM or Ollama, Two to four data-centre GPUs | Weights and images imported by controlled transfer if air-gapped |
| Tool server | Named read tools with typed parameters; no free-form SQL | Row caps and mandatory plant filter |
| Identity and permissions | SSO to SAP user via SNC or trusted RFC; authorization objects such as M_BEST_WRK and F_BKPF_BUK mirrored or enforced per call | Fail closed if the user cannot be resolved |
| Audit | Append-only log of question, tool, parameters and returned document keys | Retention set with security and legal |
Security controls mapped to your inputs
| Control | How it is met |
|---|---|
| Data stays on site | Hosting: On-prem server. Model, index and replica run inside your network; no outbound calls from the AI layer. |
| Least privilege | Dedicated RFC user with S_RFC limited to approved function groups; write BAPIs only through the approval service user. |
| Row-level access | Authorization values per user applied as filters or per-user RFC for 400 named users. |
| Protected data | Excluded at replication and index time: Pricing conditions, bank details, HR data, ITAR controlled technical data, customer contract terms |
| Write-back | BAPI calls only after human approval, followed by BAPI_TRANSACTION_COMMIT, payload stored in the audit log. |
Three-phase rollout
| Phase | Scope | Exit criteria |
|---|---|---|
| 1. Read-only | Read-only questions on the replica and documents for a pilot group at the first site | Answer accuracy on a fixed question set agreed with business owners; zero authorization leaks in testing |
| 2. Drafts | Drafts: vendor emails, requisition drafts, exception summaries reviewed by a person | Drafts accepted without edit at an agreed rate; audit log reviewed |
| 3. Approved actions | Approved actions through BAPIs with an approval step and audit trail | Approval workflow tested; rollback and idempotency verified |
Open questions for IT
1. Which NetWeaver release and support package level, and is SAP Gateway active? 2. Is SLT licensed, or must replication use database tools? 3. Which custom Z tables and function modules hold business-critical data? 4. How are roles maintained (PFCG) and can we export effective authorization values? 5. What is the S/4HANA conversion timeline and which parts of the layer must survive it? 6. Which GPU option (Two to four data-centre GPUs) fits the peak concurrency for 400 users? Use the sizing calculator to check.
Approvals
This is a planning starting point, not a design guarantee. Verify interface availability, object names and licence terms against your exact release and contract before building.
Review of your SAP ECC 6.0 AI blueprint
Optional: send the exported plan and we will comment on the data access path, permissions model and rollout order. The generator works fully without it.
Optional. The tool and every export work without this. No spam.
How to use the generator
Fill the ten fields on the left: company, version, database, hosting model, named users, sites, use cases, data that must never leave the site, GPU availability and target go-live. The plan updates as you type. Be specific in the use cases and protected-data boxes, because those drive the tool list and the exclusions the plan describes. Export the result and mark the open questions that your team cannot answer yet; those become the first workshop agenda.
- Pick the real version, since interfaces differ by release
- List protected data explicitly, one item per line
- Choose Air-gapped if no outbound internet is allowed
- Keep named users realistic, not the licence maximum
What the plan is built on
Every plan follows the same private-AI pattern: read-only access first, a reporting copy or governed interface for heavy questions, a retrieval index over documents with ownership metadata, an open-weight model served locally with vLLM or Ollama, a tool server exposing named read actions, an identity layer that mirrors the system's own permissions, and an append-only audit log. The table rows are specific to SAP ECC 6.0: they name its real data access mechanisms rather than generic placeholders.
How to read and challenge the result
Treat the components table as a hypothesis. Ask your SAP ECC 6.0 administrators whether each named interface is enabled and licensed, whether the permission model can really be mirrored, and who owns each refresh job. Then walk the rollout table: each phase has exit criteria, and the next phase should not start until the criteria are met. The open-questions block is deliberately uncomfortable; unanswered items are where projects stall.
- Confirm licence terms for every data access path
- Test permissions with a restricted user, not an administrator
- Decide the audit retention period before go-live
- Plan for the next system upgrade from day one
Common mistakes
The most common mistake is giving the model direct database access because it is quick in a demo. It skips the application's own authorization and business logic, and it is hard to defend in a security review. The second is skipping the document index metadata, so a retrieval hit shows content the user cannot open in the source system. The third is starting with write-back. Start read-only, measure accuracy, then add drafts, then approved actions.
Frequently Asked Questions
Does the generated plan require any cloud service?
No. The plan assumes the model, index, tool server and audit log run on your own servers or in your private cloud, and the air-gapped option removes outbound internet entirely. You can still choose to use a cloud service for specific non-sensitive tasks, but the plan does not depend on one.
Is the plan accurate for my exact version?
It is a well-grounded starting point, not a guarantee. Interface availability, support package levels and licence terms vary. Verify each data access path with your administrators and the vendor documentation for your release before committing to a design.
Can I use this for a security review?
Yes, as input. The security controls table maps controls to your inputs, which gives reviewers a concrete starting point. They will add their own requirements, such as logging standards, key management and network segmentation.
What does the GPU choice change?
It changes which model sizes and how many concurrent users you can serve. Use the sizing and value calculator to estimate peak concurrency and GPUs from your own question volumes, then update the plan with the result.
If you want a second pair of eyes on the plan, Netray builds private AI layers on SAP ECC 6.0 and similar on-prem systems and can review your draft with your IT team.
Related Tools
SAP ECC AI Assistant Sizing and Value Calculator
Estimate peak concurrent requests, GPUs, tokens per day, index size, hours saved and payback for a private AI assistant on SAP ECC 6.0.
On-Prem AIOn-Prem AI Deployment Checklist
A 30-point pre-deployment checklist covering use cases, hardware, security, model operations, and rollout for self-hosted enterprise LLMs.
On-Prem AIOn-Prem AI Security Hardening Checklist
A practical control checklist for securing self-hosted language models, covering model provenance, network isolation, data governance, host hardening, and audit readiness.
On-Prem AIOn-Prem LLM Total Cost of Ownership Calculator
Model the full multi-year cost of running LLMs on your own hardware, including GPU capex, power, cooling, support contracts, and operations staffing.
More SAP tools
See allKeep exploring
Free tools
- SAP S/4HANA On-Prem Private AI Layer Blueprint GeneratorFill in your version, database, hosting and use cases to get an architecture plan for adding a private, on-prem AI assistant to SAP S/4HANA, with components, security controls and a three-phase rollout.
- SAP Business One Private AI Layer Blueprint GeneratorFill in your version, database, hosting and use cases to get an architecture plan for adding a private, on-prem AI assistant to SAP Business One, with components, security controls and a three-phase rollout.
- SAP PI/PO Private AI Layer Blueprint GeneratorFill in your version, database, hosting and use cases to get an architecture plan for adding a private, on-prem AI assistant to SAP PI/PO, with components, security controls and a three-phase rollout.
Integrations
- How to use ChatGPT with SAP ECC 6.0Using ChatGPT with SAP ECC 6.0: custom GPT actions, exports versus live access, an OData or MCP bridge, enterprise data controls, and when a private model is safer.
- How to add AI agents to SAP ECC 6.0How to add AI agents to SAP ECC 6.0: a tool layer over BAPIs, RFC and IDocs, human approval before any posting, and an on-prem model that never leaves your network.