SAP News September 2026: Key Updates & Customer Impact

September brought no headline launches from SAP. The company entered its quiet period ahead of third-quarter results and is preparing for SAP Connect. Quiet months, however, show what the spring announcements turn into. This September the common thread is clear: agents and AI features are moving from keynote slides into daily operations, and the question “what can the agent do” is giving way to three others: who authorised it, on what data, and at what cost.

The month in brief. AI features in SAP S/4HANA Cloud Public Edition release 2608 became part of the base scope. Finance agents for the period-end close received availability dates. SAP explained how the Joule Studio runtime checks an agent’s authority before it acts. SAP Business Data Cloud gained an approval process for access to data products, and SAP HANA Cloud became available in new sovereign regions.

We read this news from the position of an implementation and support partner. IBA Group has been an SAP partner since 1996 and works with clients in oil and gas, energy and utilities, manufacturing, logistics, finance and retail through nine development centres. The conclusions below are therefore framed around what these changes mean for running projects and production systems, not for the product roadmap as such.

SAP events in September 2026 and the key October dates

September dates are publication dates; 30 September is the general availability date reported by ERP Today. The deadline for SAP’s commitments to the European Commission is calculated as three months after the decision of 9 July.

SAP S/4HANA Cloud Public Edition 2608: AI Features and Updates

September was the first full month in which customers worked on release 2608. What matters in this release is not the number of features but the fact that AI capabilities moved into the base scope. According to SAP, all eight AI-assisted UI features, including Easy Fill (filling form fields in natural language), are part of Base as of 2608. Users will see them without a separate rollout project, which means training and usage rules are needed now rather than later.

In manufacturing, the Manage Production Orders app received the Production Planning and Operations Agent: a Joule Release button supports the release of production orders, but it appears only when the system is integrated with Joule. In sales, the intercompany pro forma invoice for export declarations became generally available without activation through a feature toggle.

For finance teams, the more significant news came mid-month. SAP released the Accounting Accruals Agent. The agent reads an accrual policy handbook that the company uploads as a plain-language PDF, retrieves historical data, calculates amounts and prepares journal entry proposals that an accountant accepts, adjusts or rejects. It works through Joule in S/4HANA Cloud Public Edition and is currently under Restricted Availability. The same source gives 30 September as the general availability date of the Financial Closing Orchestration Agent, which coordinates the closing agents. SAP’s October update at SAP Connect states that general availability of its assistants and agents begins in October, so the status of this agent in your tenant should be checked in SAP for Me before planning.

Why this matters.

In the public cloud a release cannot be postponed, so the decision “should we adopt AI” has in practice been replaced by “how do we govern what has already arrived”. The accrual handbook becomes an executable document: who changes it, who approves it and where the version used for a given calculation is stored are now internal control questions, not only methodology questions. In addition, a single agent task can consume several AI Units, and unused units expire after 12 months. Volumes should be sized from scenarios, not from the price list.

SAP Joule AI Agents: Governance, Security, and Runtime Control

On 28 September SAP published an update on its joint work with NVIDIA on OpenShell, an open-source agent runtime that SAP is embedding into SAP Business AI Platform. What interests us here is not the collaboration itself but how responsibilities are split inside the SAP stack.

The model works as follows. Before an action runs, the Joule Studio runtime checks business authorisation, role-based policy and process context, deciding whether the action should happen at all. OpenShell then limits what the agent can see and do during execution, and where inference goes. SAP states explicitly that FedRAMP and FIPS enablement and support for regulated industries are still on the roadmap.

Agent action control in SAP Business AI Platform: two levels of checksSource: IBA Group. AI-assisted visualization based on the SAP News Center article of 28 September 2026 (link above). SAP, Joule and NVIDIA are trademarks of their respective owners

The first check is a business check based on roles; the second is technical isolation. The diagram is based on the SAP News Center article of 28 September 2026.

There are two practical consequences. First, an agent’s authority relies on the same role model and IAM as employees’ authority, so the quality of current business roles in S/4HANA directly determines how safely agents can be admitted into a process. Second, the Joule Studio runtime is free for customers and partners until the end of October 2026. This is a window for a pilot without runtime costs, but by November an estimate of operating costs will be needed.

Status of key components at the end of September:

The gap between announcement and production use also needs to be factored in. After Sapphire, Forrester analysts noted that most of the 224 announced agents and 51 assistants were in a mixed status of general availability, Early Adopter Care or preview. Project plans should start from the status of a specific agent in your region and licence, not from a keynote slide.

SAP Business Data Cloud and SAP BTP: Data Governance and AI Updates

In SAP Business Data Cloud, the September changes concern access rules rather than new sources. Wave 2026.20 introduces data product governance: a consumer requests access and a data steward approves it through a documented, auditable process, with live deployments originally planned for 29 September. SAP lists the limitations of the first version itself: the share permission is still global and cannot be narrowed to a domain, and a data steward cannot revoke access once it has been granted. SAP’s September roundup for Business Data Cloud and Datasphere now presents the capability as delivered, and the official change log lists the data product governance improvements under 9 September.

For customers, this means the data ownership model has to be designed before agents start consuming data products. If a steward cannot revoke access, an approval error is corrected organisationally, not with a button. That argues for a narrow first circle of consumers and a formal register of granted access.

KEY TAKEAWAY

“The data ownership model has to be designed before agents start consuming data products.”

The BDC customer story of the month is Team Liquid. The esports organisation combines gameplay, biometric and operational data in BDC, and Joule gives coaches recommendations based on that data. The sector is far from industry, but the architectural pattern is the same: heterogeneous signals are brought into one model with business semantics, and only then does AI work on top of them.

There were three BTP developments. First, on 15 September SAP made TabPFN-3.5 Plus from Prior Labs available in SAP AI Core. It is a tabular foundation model: it predicts payment delays, supplier risk or customer churn from structured data without training or tuning for a specific dataset. For tasks that used to require a separate machine learning project, the entry threshold drops noticeably, and the quality of ERP source data becomes the main constraint. This is where master data work, which IBA Group delivers with SAP MDG, has a direct effect on prediction quality.

Second, the September release of the SAP Cloud Application Programming Model shipped, the first minor release after the June major one: CAP Node.js 10.1 and CAP Java 5.1. Third, and more urgent: the Security Patch Day of 8 September included critical note 3798315 (CVSS 9.4) on credential disclosure in multitenant applications built on the @sap/cds-mtxs library. According to Pathlock, this coincided with SAP’s guidance on a compromise of open-source npm packages affecting CAP tooling. If you run your own extensions on BTP, a dependency review is a task for this week, not next quarter.

SAP Sovereign Cloud: HANA Cloud Expansion and Data Sovereignty

Until recently, SAP’s sovereign cloud was discussed mainly in terms of applications: S/4HANA Cloud Private Edition, SuccessFactors, Analytics Cloud. The September quarterly release of SAP HANA Cloud moves the focus to the data layer. SAP HANA Cloud became available in two new SAP Sovereign Cloud regions: India on AWS, and Europe/Germany on SAP Cloud Infrastructure. For the German region, SAP stresses that it delivers sovereignty across the full stack on SAP-owned hardware located in Germany. The same post reports FedRAMP certification for SAP HANA Cloud on SAP NS2.

The significance goes beyond the choice of region. HANA Cloud underpins BDC, the knowledge graph and the persistent long-term storage of Joule Studio agents. While the database was not available inside the sovereign perimeter, regulated organisations could keep their ERP there but could not place analytics and AI scenarios next to it without leaving the perimeter. That gap is now narrowing, though not closing: as noted above, FedRAMP and FIPS for the Joule Studio and OpenShell combination remain on the roadmap.

The practical conclusion for architects: sovereignty requirements have to be checked separately for each layer (application, database, AI services, agent runtime), not for the solution as a whole. For European clients this check usually runs in parallel with NIS2 and DORA obligations, which IBA Group addresses in its security practice. Service availability by region and certification changes every quarter, so the check should use SAP’s official lists as of the decision date, not material from past events.

SAP Acquisitions, ERP Support Regulations, and Corporate Updates

SAP announced no new acquisitions in September. It was, however, the first month in which one of the summer deals produced something customers can use: TabPFN-3.5 Plus in AI Core, two months after the Prior Labs acquisition closed. All three 2026 deals target the data and AI layer, not application modules:

The logic of the portfolio is unambiguous: SAP is buying what makes data usable by agents, namely master data quality, access to external sources and predictive models for tables. For customers, the value of AI features will depend more and more on the state of master data and on how cleanly the ERP data model is built. This is consistent with the clean core principle that partners, IBA Group included, already apply in S/4HANA migrations.

The regulatory background matters for planning too. On 9 July the European Commission made SAP’s commitments on on-premise ERP support legally binding; they apply globally for ten years. According to SAP’s half-year report, the company must implement them within three months of the decision, that is, by early October. The investigation did not concern cloud offerings. For customers staying on ECC or S/4HANA on-premise until their migration is complete, this is a reason to review support terms now.

Among corporate events: between 21 and 25 September SAP bought back 590,000 shares, bringing the total under the current programme to 8,895,886 shares. The customer signal of the month on cloud models was HARTING Technology Group, which signed a long-term RISE with SAP contract and is moving to SAP Cloud ERP Private. Two October dates are worth watching: SAP Connect in Las Vegas on 5–7 October and third-quarter results on 21 October.

SAP Updates: What Customers Should Do in October 2026

The actions below are what we recommend after September. They are grouped by audience and ordered by urgency. Most of them fall within the scope of a typical SAP support contract, so for clients with an application management service in place they can be handled through the existing change process rather than as separate projects.

Security (all customers with ABAP systems and BTP extensions). The September Security Patch Day contains four notes rated Critical. Three of them concern the kernel and NetWeaver components, that is, on-premise and private cloud systems; SAP patches its public cloud services itself.

SAP S/4HANA Cloud Public Edition customers. Check which 2608 AI features are already visible to users and decide whether to restrict them through roles until training is complete. If finance plans to use the Accounting Accruals Agent, start with the accrual handbook: SAP recommends limiting it to no more than five expense categories. The procedure for changing and approving this document should be defined before go-live, not after the first error.

Companies planning agents. Use the free Joule Studio runtime period until the end of October for one pilot with a tight scope: one process, one company code, a clear metric. In parallel, review business roles, because the agent’s authority check relies on them. Size the AI Units budget from scenarios, keeping in mind that unused units expire after 12 months.

Data owners and analytics teams. Before connecting consumers to BDC data products, appoint data stewards and keep a register of granted access: in the first version a steward cannot revoke access. If predictive scenarios such as late payments or supplier risk are planned, evaluate TabPFN-3.5 Plus in AI Core as an alternative to a separate machine learning project.

Customers on ECC and S/4HANA on-premise. The commitments to the European Commission take practical effect in October. If a support renewal falls in the coming months, compare SAP’s offer against the new terms before signing. Mainstream maintenance for ECC ends in 2027, with optional extended support to 2030 at additional cost, so the renewal and the migration plan should be decided together.

Regulated industries and the public sector. Check the sovereign perimeter layer by layer: application, database, AI services, agent runtime. The September HANA Cloud expansion closed some gaps, but not all of them.

Data as of 1 October 2026. Availability of SAP features varies by region and licence; verify it in SAP Help Portal and SAP Roadmap Explorer before planning a project.