SAP Joule Under the EU AI Act: The ERP Copilot Is Classified Module by Module
SAP Joule is classified module by module under the EU AI Act: ERP automation is minimal-risk; the HR module can be Annex III high-risk.
SAP Joule is the AI copilot across SAP's business suite — finance, supply chain, procurement, and HR (SuccessFactors). Under the EU AI Act, Regulation (EU) 2024/1689, it has no single risk tier. Most of what Joule does is minimal-risk business automation; one area, HR, can be genuinely high-risk. The rule is to classify each use, not the copilot as a whole.
Most ERP automation is minimal-risk
Article 6(2) makes a system high-risk only where its purpose sits in Annex III. Drafting purchase orders, summarising financials, surfacing supply-chain insights, answering process questions — none is an Annex III use. These uses are minimal-risk, with no mandatory AI Act obligations beyond Article 4 AI literacy and your GDPR controls where personal data is involved.
Note the boundary for finance: Annex III point 5(b) covers evaluating the creditworthiness of natural persons. B2B credit checks on companies, fraud detection, and internal financial forecasting are not that — so Joule's finance features are not high-risk on that basis.
Where Joule can be high-risk: the HR module
The exception is SuccessFactors / HR. If Joule is used for recruitment, candidate screening, or decisions on promotion, task allocation, termination or worker evaluation, that use falls under Annex III point 4 and is high-risk — with the full provider/deployer regime. And using AI to infer employees' emotions in the workplace is prohibited under Article 5(1)(f). Treat the HR module as the one that needs a careful classification, separately from finance and supply chain.
Provider or deployer?
You are a deployer under Article 26 of Joule as offered; SAP is the provider, and any underlying general-purpose model carries its GPAI duties with the model provider. Article 25 flips you to provider only if you substantially modify, rebrand, or repurpose a use into a high-risk one.
Timeline and penalties
Article 5 prohibitions and Article 4 literacy are in force since 2 February 2025; GPAI since 2 August 2025; Article 50 transparency from 2 August 2026. Stand-alone high-risk Annex III (relevant to the HR module) is deferred to 2 December 2027 under the Digital Omnibus, adopted by Parliament (16 June 2026) and Council (29 June 2026) and pending only Official Journal publication. Penalties under Article 99: €35 million or 7% (99(3)); €15 million or 3% (99(4)); €7.5 million or 1% (99(5)); SME cap at the lower figure (99(6)).
Worked example: a 400-person manufacturer
Helios Components, a 400-person manufacturer, runs Joule across finance, procurement and HR. Finance and procurement uses are minimal-risk — Article 4 literacy and GDPR only. The HR team's use of Joule to screen and rank applicants is Annex III point 4 high-risk: Helios is the deployer, so it confirms SAP's conformity documentation, builds human oversight into shortlisting, retains logs for at least six months, and informs the works council before deployment. Same copilot, two very different obligation sets.
How Confir helps
Confir classifies each Joule use on its module and purpose — finance and supply chain as minimal, HR screening as Annex III high-risk — and assembles the Article 26 deployer duties where they apply. The engine is deterministic and rule-based, with every finding cited to the Article and Annex point.
Frequently asked questions
Is SAP Joule high-risk under the EU AI Act?
Not as a whole. Joule is classified use by use. Finance, supply-chain and procurement automation are minimal-risk because they are not Annex III uses. The HR module can be high-risk under Annex III point 4 when used for recruitment or worker-management decisions. Classify each module by its purpose.
Is Joule's finance AI an Annex III credit-scoring use?
Generally no. Annex III point 5(b) covers assessing the creditworthiness of natural persons. B2B credit checks, fraud detection and internal forecasting are not that, so Joule's finance features are not high-risk on that basis. Consumer creditworthiness scoring would be the exception.
What do we owe if we use Joule in HR?
If the HR use is Annex III high-risk, you are the deployer under Article 26: verify SAP's conformity documentation, ensure human oversight (Article 14), retain logs for at least six months, and inform workers' representatives before deployment. A Fundamental Rights Impact Assessment is not automatic for private employers — check the Article 27 categories.
Who is the provider of Joule?
SAP, when you use Joule as offered; you are the deployer under Article 26. The GPAI duties for the underlying model sit with the model provider. You would only become a provider under Article 25 by substantially modifying or rebranding it.
When do the high-risk obligations apply?
Stand-alone high-risk Annex III obligations are deferred to 2 December 2027 under the Digital Omnibus, adopted by Parliament and Council in June 2026 and pending only Official Journal publication.
Related guides
- How AI risk classification works
- Annex III employment use cases
- Article 26 deployer obligations
- EU AI Act recruitment software requirements
- Build your AI system inventory
Manage your EU AI Act compliance in one place
Confir automates risk classification, technical documentation, and audit trails for any company. No consultants. No 6-month projects. 14-day free trial.
Start free trial →