❌

Visualização de leitura

SAP wants Joule to run business workflows, not just answer questions

SAP says it is ushering in a new era of agentic AI, one where agents don’t just learn a business, but help run it.

This week at its TechEd conference, the company is announcing new tools in its SAP Business AI Platform that will extend AI agents’ capabilities, give them richer, more enterprise-specific data and context, and beef up governance controls so they can be rolled out safely across enterprise workflows.

“There used to be a time where AI assistants or interfaces could do a couple queries, and you had to get the query more or less right,” SAP chief AI officer Jonathan von Rüden told CIO. “And then if you asked three, four questions, eventually it would say, ‘I can’t go that far.’ Now that constraint isn’t really there anymore.”

New orchestration layer

SAP has introduced new capabilities in its AI-driven workspace Joule Work and its AI no-code/pro-code agent building environment, Joule Studio.

Joule Studio will now be natively integrated with Joule Work, giving users a single build layer. They will be able to describe their intent, and the system will orchestrate the right agents, apps, and data. Joule Work is built on the SAP Business AI Platform, which provides context, data, and governance.

“Effectively, business users get a coding agent into their hands, but they don’t know it is one, so they come up with all kinds of very, very interesting use cases,” von Rüden said.

SAP has put a good deal of R&D effort into graduating from conversations to a generative UI to “step-by-step” replace classic UIs, he noted. “You don’t need those anymore, you can have them tailor made per person.”

A new orchestration layer in Joule Work will support more complex, multi-step workflows. Beyond working across SAP environments, agents will be able to plug into external systems, data, and tools via Modern Context Protocol (MCP) and Agent2Agent (A2A) Protocol.

Further, Joule Studio will be more tightly integrated with SAP Business Data Cloud so that builders can access various data products across SAP, and users across different teams will be able to collaborate on agents while customizing them to their different roles. These shared environments will have role-based access, and developers will be able to design and run n8n workflows, test pre-deployment in built-in sandboxes, and perform offline evaluations.

Governance, debugging tools

The company also announced that the SAP Knowledge Graph will now have the ability to pull data from both SAP and non-SAP sources, while interoperability tools will allow third-party agents to securely invoke Joule Agents through a governed gateway. This will enable safe collaboration between agents from different providers, SAP said.

New AI capabilities in the SAP Integration Suite will provide tools that analyze bugs, flag anomalies, simplify schema setups, manage GitHub integrations, perform core Git operations, standardize communications, and automate processes across platforms like Gmail, Microsoft Excel, and Salesforce Service Cloud.

From a governance perspective, a new SAP Enterprise AI Gateway will consolidate authentication, policy enforcement, routing, monitoring, usage tracking, and auditing, giving users the ability to view and govern all traffic and interactions. Joule Studio also has new observability and administrative controls, and a new Governance Agent will help companies comply with the EU AI Act.

The Enterprise AI Gateway will bring “enterprise-grade governance to AI interactions” in one control plane, SAP said.

SAP is rolling out Joule Work and the various new Joule Studio features in phases, and general availability for SAP Enterprise AI Gateway and the new SAP Knowledge Graph capabilities are planned for Q1 2027.

Accessing hundreds of assistants for enterprise workflows

With Joule Work and Joule Studio, users can immediately customize a skill load, von Rüden said, and can easily build a reusable dashboard. “Now they have these standard backend connections to SAP.”

For instance, he explained, say a user wants to plan deliveries for the next six weeks. They can pull in data from Jira and GitHub, but also overlay that with data from project planning. “I crunch all of this up in completely natural language, and with out of the box UIs, I can see whether I can actually deliver on what I’ve planned over the next six weeks,” he said.

If a user likes something they co-designed with AI, they can tell it to persist that workflow as a skill. “I can share it back with other colleagues, and that becomes a very powerful workflow,” von Rüden said. “I’m not queuing for eight months in the IT backlog.”

With Joule Work, users have access to 40 specific assistants that can orchestrate hundreds of agents beneath. These include, for example, billing, campaign, enterprise architecture, case management, or HR operations assistants.

“Customers can map these assistants to actual personas,” von Rüden said. Then, assistants can be connected to other relevant assistants (like accounts payable and accounts receivable). “We have one central place where they can exchange trust, and we can secure everything, do policy enforcement.”

Essentially, the right integrations can support near-infinite iteration in AI systems, von Rüden asserted.

New data tools, Tabular foundation model

Also at TechEd this week, SAP is introducing new ontology tools, lakehouse capabilities, and governance and admin controls to take AI from “intent to trusted execution.” The company is building on its recent acquisition of Dremio and an expanded partnership with Databricks to unify data, simplify its management, and support faster contextual insights.

The company is also infusing AI into RISE with SAP, its subscription-based service that helps enterprises transition from on-premises enterprise resource planning (ERP) systems to the cloud. Customers will get AI-assisted implementation guidance, best practices, roadmaps, onboarding, and assessment, alignment, and business mapping tools.

Finally, SAP has announced its latest tabular AI model, SAP-RPT-2.0, which will go beyond classification and regression to anomaly and outlier detection and AI-powered analysis. These capabilities will reduce manual engineering and help customers predict values across business metrics for forecasting purposes. Customers will be able to use SAP-RPT-2.0 through the SAP Integrated Business Planning platform.

von Rüden said that the model is being used for “so many wild use cases,” ranging from running small business loans and performing financial forecasting to the classification of astronaut health by NASA.

NetSuite launches SuiteExpress to expedite implementation and optimization of ERP

Agentic AI is the main topic at most industry events this year, with vendors adding agents to their products with gleeful abandon. NetSuite is no different; at its SuiteWorld conference this week, it is unveiling agents and AI workspaces designed to do everything from autonomous financial closing to AI-based supply chain management.

SuiteExpress, announced today, however, is something different. Rather than automating processes within the ERP suite, it is tied into Customer Success services, using AI to help customers implement the product.

“We’re leveraging the opportunity to bring AI to bear on the implementation, and accelerating the delivery of NetSuite’s implementations for our customers, as well as for helping them understand and take advantage of new capabilities as their business evolves and their business needs change,” explained Craig Sullivan, group VP of product management at Oracle NetSuite. “It’s the fast track onto NetSuite, delivers faster implementations at a lower cost, taking into account all of the key knowledge that the customer has about the way that they run their business today, as well as all of the knowledge that NetSuite has about how other customers in similar industries have been able to be successful on NetSuite.”

The company said this will help customers implement more of what they need at the beginning, to realize greater value more quickly. It claims that, using SuiteExpress, NetSuite implementation time is reduced “to weeks, or even days.”

SuiteExpress is powered by two connected knowledge bases that combine customer-specific context with NetSuite’s proprietary expertise, the company said in a news release. “The Customer Knowledge Base ingests meeting notes, documents, spreadsheets, recordings, and data from other systems to capture requirements, business processes, configuration decisions, and validation history, giving customers and implementation consultants a shared understanding of how the business works,” it said, while the NetSuite Knowledge Base adds proprietary product, implementation, and industry expertise from NetSuite’s experience with its customers. The two knowledge bases provide the context and expertise needed by the AI to recommend next steps, and to perform implementation tasks such as preparing data for migration, with oversight from consultants. It will also help customers continuously improve how they use NetSuite after go-live.

NetSuite SuiteExpress is available today to customers in the software industry in North America as part of a phased rollout. The company plans to broaden availability to other industries and geographies in 2027.

Oracle patches 1295 security vulnerabilities in October, including six scoring 10.0

Oracle has patched 1295 security vulnerabilities with its October Critical Patch Update Advisory; six of them scored the highest vulnerability rating of 10.0 on the CVSS version 3.1 scale.

The company’s flagship Oracle E-Business Suite was home to one of the vulnerabiltiies, tracked as CVE-2026-101809. This enables any unauthenticated attacker with network access via HTTP to compromise the workflow notification mailer in the suite’s Workflow component, taking over Workflow and potentially affecting other products too. The flaw affects Workflow versions 12.2.3 through 12.2.15.

Oracle SOA Suite, part of Oracle Fusion Middleware, was hit by three of the bugs rated 10.0.

One, tracked as CVE-2026-91231, is in the Adapters component, and enables unauthenticated attackers to compromise Oracle SOA Suite resulting in its takeover, with potential impact on connected products.

Two others were in the Fabric Layer component of Oracle SOA Suite: CVE-2026-91216 and CVE-2026-91221.

Both are easily exploitable, Oracle said, and enable an unauthenticated attacker with network access via the T3 or IIOP protocols to compromise Oracle SOA Suite and perhaps affect other products too. The bugs appear in supported versions 12.2.1.4.0 and 14.1.2.0.0.

There’s a 10.0-rated vulnerability in another part of Oracle Fusion Middleware too. The flaw in Oracle Access Manager (tracked as CVE-2026-87337 leaves it open to compromise by any unauthenticated attacker with network access via HTTP. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification of critical data on Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0.

The last “perfect 10” vulnerability in Oracle’s latest report is in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards, tracked as CVE-2026-91299. This enables an unauthenticated attacker with network access via HTTP to compromise and take over versions 9.2.0.0 through 9.2.26.5 of the orchestrator.

SAP must stop infringing a Celonis process mining patent, court rules

The legal disputes between Germany’s largest software company, SAP, and the Munich-based process mining specialist Celonis took another turn last week. After the German Federal Cartel Office most recently dismissed a complaint filed by Celonis in July, the Munich I Regional Court ruled entirely in favor of Celonis in a case regarding the infringement of a European patent held by Celonis.

Case No. 7 O 12849/25 concerned patent EP 3 139 274 B1 describing a method for determining a net lead time between process steps using process data stored in a structured manner in main memory (in-memory).

Celonis had filed a lawsuit alleging that the patent was infringed by a feature of the SAP Signavio Process Intelligence software solution — SAP acquired Celonis’s rival Signavio in March 2021.

SAP must cease use and provide information

The court ruling prohibits SAP from offering the patent-protected method in Germany or using it itself. SAP must also provide Celonis with information regarding the extent to which it has infringed the patent since April 22, 2020, including details on:

  • where the patent-infringing processes originated and through which channels they were offered and distributed;
  • which customers purchased them, including names and addresses;
  • how many access licenses were granted and how much users paid for them;
  • for how many users the methods were used per calendar year;
  • which other individuals were involved in offering and using the methods.

In addition, SAP must provide a transparent account of the extent of the patent infringements based on its financial figures. The company is obligated to pay appropriate compensation or damages.

“The ruling by the Munich Regional Court confirms our legal position: SAP Signavio’s technology infringes on Celonis’s patent rights. We consistently protect our intellectual property and remain committed to fair competition,” explained a Celonis spokesperson.

SAP says no consequences for its customers

SAP, however, points out that the court ruling pertains to a single, specific feature within SAP Signavio Process Intelligence, not to the product as a whole. SAP Signavio Process Intelligence remains available to customers, according to a company spokesperson.

The spokesperson also dismissed concerns that the ruling could hinder companies’ migration to SAP S/4HANA Cloud. Migrations to SAP S/4HANA Cloud are not affected by this, he said. SAP is working to ensure that there are no disruptions for its customers.

The concern is not entirely unfounded: SAP Signavio is part of Rise with SAP, a SaaS solution from the Walldorf-based company designed to support migration to the S/4HANA Cloud. SAP Signavio’s process mining tools are designed to provide insight into actual process flows and identify inefficiencies and bottlenecks.

SAP will appeal

The Regional Court’s ruling does not mean the matter is by any means settled: As the spokesperson for the Walldorf-based software giant explained, SAP does not share the Munich court’s legal opinion and will file an appeal against the ruling. In addition, SAP has challenged the validity of the patent in question before the Federal Patent Court.

“SAP’s top priority is to ensure that customers are not affected by this. All other issues will be resolved through the appropriate legal channels,” said the spokesperson for the Walldorf-based company.

This article first appeared on Computerwoche on Oct. 13, 2026.

SAP advances its autonomous AI agenda with yet more Joule Assistants and agents

SAP has launched new AI agents and assistants across multiple domains at its SAP Connect event, saying that its October update is fulfilling the promises it made around its vision of the Autonomous Enterprise at Sapphire in May.

The SAP Autonomous Enterprise comprises capabilities in Joule Work and SAP Autonomous Suite, built on the SAP Business AI Platform. The assistants and agents, as well as Joule Studio and Joule Work, will be offered as SAP-managed products via the SAP for Me portal; their general availability begins this month.

Like many other vendors, SAP is turning its agents into a front end for its products.

While Joule used to be just a natural language-based chat client, its scope has expanded, said Manoj Swaminathan, president and chief product officer, SAP Autonomous Suite. “Joule Work now becomes one harmonized experience for anything and everything that the users can interact with, with agents backing it as part of the autonomous suite, fueled and powered by the platform,” he said.

Users can still use the traditional SAP interface if they wish to.

“Systems-of-record-based applications still will be there, but they are now provided with these agentic experiences as well as AI on apps,” he said, “so that if a customer chooses to, they can now take advantage of them either in a semi-autonomous way or a fully autonomous way.”

SAP said that Joule Work is already live with 110,000 employees within the company, and claims 20% productivity gains across finance, HR, and procurement.

At the conference, SAP showcased SAP Autonomous Suite capabilities in finance, where it can automate revenue recognition, disclosures, and trade compliance; in supply chain, where planners “can turn multi-hour disruptions into one-click resolutions across planning, manufacturing and logistics;” as well as in HR, procurement, and customer experience.

Cloud ERP updates

The latest release of the SAP-managed public cloud ERP offers deeper integration across SAP Autonomous Suite. SAP S/4HANA Cloud Public Edition now integrates with SAP Ariba and SAP Sales Cloud solutions, while links to SAP Taulia, SAP Subscription Billing, and SAP SuccessFactors will be made available before year end.

Even SAP’s on-premises offering, Cloud ERP Private, is getting the managed AI services treatment, with new integrations with Joule all delivered and maintained by SAP. It is currently available through the SAP Early Adopter Care program, with general availability planned by year-end.

Analysts displayed varying levels of enthusiasm about the announcements.

Thomas Randall, research lead at Info-Tech Research Group, was unimpressed. “SAP Connect is not giving us any breakthrough moments,” he said. “Microsoft, Salesforce, ServiceNow, Oracle, and the hyperscalers have already established comparable assistants, agent studios, multi-agent orchestration, model choice, and governance capabilities. SAP’s announcements are best understood as fast-following AI technology for business-process suites.”

However, he does see potential. “SAP’s opportunity to pull ahead lies in its positioning AI as a controlled execution layer for back-office operations,” he noted. “Few vendors can match its combination of process depth, transactional authority, industry-specific configuration, and installed footprint. This gives SAP a distinct advantage: its systems are already trusted to move money, adjust plans, release orders, and record the resulting business consequences. I look forward to seeing this advantage in action.”

Jason Andersen, principal analyst, apps, agents and automation at Moor Insights & Strategy, has a more positive view.

First, he said, SAP is showing that it can deliver as planned on the promises made at Sapphire earlier this year. “Notable are a series of task or role driven agents that will augment common roles in many enterprises such as procurement and supply chain roles,” he said.

And, he added, “There is also the backing of the SAP Business AI Platform, which will help enterprises customize these agents to the specific processes and standards for each company. This is a great way for providers like SAP to embed decades of customer understanding within agents but also enable customers to tune them to suit their needs. While the more specific agents get a lot of attention, I also think that SAP’s advances with Joule Studio and Desktop can help workers deliver SAP capabilities in the context of common business remain notable.”

Risk management

However, independent technology analyst Carmi Levy cautioned that there is a wide gap between plans and reality. “As agentic tools draw ever closer to core organizational workflows, enterprise decision makers face amplified concerns around data integrity, privacy, and accuracy,” he said. “Elevated agentic risks should be a primary concern for SAP shops, while SAP’s third-party integration should raise alarm bells among leaders worried about guardrails being violated across the organization.”

While SAP’s announcement goes into significant detail explaining how tightened protocols around authentication, governance, and identity management ensure agents won’t exceed defined limits, he said, it fails to address agents’ vulnerability to new forms of attack such as model injection that organizations must now deal with.

“Agentic AI is already rewriting the cybersecurity playbook for all enterprises, and vendors owe it to customers to explicitly explain how they intend to mitigate the risk,” he said.

“Automated AI agents will ultimately rewrite how work gets done in the same way earlier technologies, like PCs and smartphones, similarly rewrote the rules of modern work,” he said. “But AI agents introduce enough additional baggage into the equation that handing entire processes over to automation at this fraught moment in their development is hardly the recipe for C-Suite harmony.”

Despite ShinyHunters arrests after FBI jobs data breach, enterprises still have no answers about PeopleSoft risks

The theft of FBI employee data by hacking group ShinyHunters, and the subsequent shutdown of the FBI’s Peoplesoft-based jobs portal, is causing concern for enterprise users of the Oracle product, with analysts recommending extreme measures in response.

Law enforcement has made some progress in its pursuit of the cyber criminals involved, but there has still been no official word from either the FBI or Oracle about Peoplesoft’s alleged involvement.

On Saturday, Reuters reported that a suspected member of ShinyHunters had been arrested in Jordan and has been cooperating with law enforcement to help identify other member of the group. The arrest comes a week after the arrest of another suspected ShinyHunters member by the Dutch National Police. In a video about that arrest, an FBI official warned gang members that arrests have a way of changing who is willing to talk, concluding, “You know how to find us, and we know how to find you.” Before the arrests, the gang told The Register it had discovered a new PeopleSoft zero-day hole and leveraged it to break into an FBI system, stealing information on all FBI employees. The FBI has since confirmed the breach without providing details.

This wouldn’t be the first flaw ShinyHunters had found in PeopleSoft. It discovered a PeopleSoft zero-day hole in June that resulted in a flurry of extortion attempts, long after Oracle said it had patched the bugs.

Oracle did not respond to a request for comment on the alleged new vulnerability.

Significant risk exposure for enterprises

Analysts and consultants played up the risk exposure from the potentially new vulnerability even as they sharply played down the implications of the arrest.

Frank Dickson, principal analyst at Dickson Research, recommended that PeopleSoft users take immediate action.

“If it is a new flaw, the patch is necessary but not sufficient. PeopleSoft customers should pull the Environment Management Hub and the Integration Broker off the public internet,” he said. “Doing so does not break normal user sessions.”

He also encouraged users to quickly implement many of the recommendations from Google unit Mandiant’s report late last month on PeopleSoft security issues, especially “hunting for the web shells and outbound traffic Mandiant describes.”

“For PeopleSoft shops, the to-do list is short,” Dickson said. “Apply Oracle’s patch. Disable or remove the Environment Management Hub if you do not use it. Search your logs for encoded variants of the PSEMHUB path, not just the literal string. If you find a web shell, treat the server as compromised and rotate every credential it could read.”

This is a dangerous situation, he said: “An unpatched PeopleSoft flaw is a Sword of Damocles over every PeopleSoft shop

But despite the extreme risk, even after the patch was released, rather than applying it, some organizations have opted for other mitigations. “Many organizations chose to block the vulnerable endpoint with web application firewall rules rather than patch,” Dickson said. “The attackers walked past those rules by changing a single character in the web address, writing ‘%50’ in place of the letter ‘P.’”

Could signal a bigger problem

However, IDC Research Director Philip Harris encouraged CISOs to view the FBI’s confirmation of its breach with caution, given the attack vector was not revealed.

“ShinyHunters says it used a second, previously undocumented PeopleSoft preauth RCE zero-day, distinct from the CVE-2026-35273 flaw exploited in the earlier campaign,” he said. Yet, he pointed out, “no CVE has been assigned to it, it has not appeared on CISA’s Known Exploited Vulnerabilities catalog and Oracle has not commented on it. Every outlet covering this is explicit that the zero-day claim comes only from the threat actor, not from independent forensic confirmation or from Oracle. That distinction matters.”

But if the hole is as the group has suggested, Harris said it signals a much bigger problem.

“Assuming it is real, this would mean PeopleSoft has a second critical, unpatched preauth RCE in the same window as CVE-2026-35273, a pattern of recurring critical exposure rather than one isolated bug,” he said. “ShinyHunters’ own claim that they are already using it against other, unnamed Fortune 500 targets would mean every PeopleSoft customer is currently exposed to an unpatchable, undisclosed flaw with no vendor guidance to act on, a meaningfully worse position than the WAF-bypass story, since there is no mitigation to attempt while waiting on Oracle to confirm something it has not acknowledged.”

Jeff Valdes, a director at consulting firm Acceligence, added that Oracle’s silence is unwarranted.

“I think customers reasonably want more communication from the vendor,” he said. “They want to understand whether Oracle’s original guidance remains sufficient, whether there are additional mitigations customers should implement, whether Oracle is seeing anything through its own support organization that changes the risk picture, and whether there are configurations or architectural choices that materially increase exposure. Those are operational security questions that can be addressed without discussing attribution, arrests, investigative techniques or anything else that might interfere with an FBI investigation.”

This article originally appeared on CSOonline.

Oracle Fusion Claw pinches AI costs, tightens grip on policies

Oracle is adding a new execution layer to its Fusion Cloud Applications Suite that it says will help enterprises lower the costs of automating complex and long-running business processes with AI agents.

The execution runtime, Fusion Claw, uses a combination of a frontier model, deterministic policies, and governed execution capabilities to plan and carry out a given task or process, instead of relying for each step on AI inference, which can result in repeated model calls as the task progresses. That can help enterprises keep inference and compute costs under control, the company said.

The deterministic policies can include approved algorithms, business rules, calculations, optimization services, reconciliation logic, and transaction-processing capabilities. Enterprises can define or configure them via Fusion’s AI Agent Studio while building the agent or modifying existing agentic applications, Oracle said.

Claw then uses two built-in features, the Enterprise Operating Envelope and the Enterprise Trust Harness, to enforce those policies as controls during task execution, ensuring that the agent operates within its delegated authority and the required governance boundaries, while also generating an auditable record of agent actions and decisions, it further said.

Fusion Claw could help improve an agent’s unit economics

For Manoj Chandra Jha, principal analyst at Nord-IQ research, Fusion Claw’s approach to agentic execution is likely to help enterprises with the unit economics of deploying AI agents to automate business processes.

“By keeping the expensive model for planning and running high-volume work on cheap deterministic computation, Fusion Claw can make agentic costs both lower and more predictable for CIOs,” Jha said.

Beyond cost, Fusion Claw’s approach to separating AI reasoning from deterministic execution can also make agentic automation more reliable and repeatable, which could be “critically important” for CIOs trying to move agentic applications from prototype to production, according to Scott Bickley, advisory fellow at Info-Tech Research Group.

The deterministic controls combined with delegated authority, approvals, escalation rules and an auditable record of decisions and transactions can give enterprises a measure of “safe autonomy,” he said.

There are advantages for developers, too, especially in terms of productivity.

As the new execution layer packages up most of the underlying plumbing stack required to operationalize an agentic application, developers can focus on process design, offloading the mundane work of integrating and orchestrating the underlying components needed to put an agentic application into production, Bickley said.

That, in turn, is likely to result in business processes being automated faster, he added.

Lower AI consumption does not necessarily mean lower costs

However, that reduction in development and orchestration work does not eliminate the work required to govern agentic applications, but rather adds to the governance work required, Jha cautioned: “Development teams must encode policies and approval rules, choose autonomy levels, and verify outcomes.”

That outcome verification will also be important for CIOs in determining whether the promised cost savings and cheaper unit economics actually translate into lower costs, rather than simply lower AI consumption, according to Bickley.

While Oracle’s architecture can reduce the amount of AI inference needed for a task, the actual cost of an agentic application can vary based on factors including the actions it performs, token consumption, model used, testing, human review, exception handling and ongoing operational support, Bickley said.

As a result, CIOs should measure the cost of successfully completing a business outcome, such as resolving an accounting exception or filling a staffing gap, rather than looking only at the cost of AI units or tokens, Bickley added.

The analyst also cautioned CIOs about Oracle’s AI unit policy, which he said could introduce additional considerations into the cost of running Fusion Claw-based applications: “Unused pooled units expire without reimbursement, while Oracle can modify its action and model tables with at least 30 days’ notice.”

CIOs should demand per-outcome pricing in writing and let a bounded pilot build the business case, said Jha.

Adoption will depend on process and governance maturity

Those considerations, combined with the added governance requirements, are also likely to shape which enterprises adopt Fusion Claw first, even among existing Oracle customers.

“Existing Oracle Fusion customers with standardized processes, reliable master data, mature controls and high-volume work with measurable outcomes are likely to be the initial adopters. Finance reconciliation, supply-chain planning, staffing and other constraint-heavy processes are logical candidates because they combine analysis with calculations and repeatable execution,” Bickley said.

On the flip side, adoption will be “slower” in enterprises with heavily customized Fusion estates, fragmented data, multiple ERP platforms, weak segregation of duties, or limited AI governance, he added.

For enterprises willing to try out Fusion Claw, the execution runtime is now available as part of the Suite, Oracle said.

The company is also making 25 pre-built Claw-powered agentic applications available, including Ledger, Workforce Staffing, Shipping Consolidation, and Sales Territory Planning, aimed at helping divisional leaders, such as CFOs, CSOs, supply chain heads, and CHROs, improve productivity and reduce costs.

The company will make the other 21 apps available in October, it said.

6 ERP trends for 2026 and beyond: CIOs rethink core systems

The market for enterprise resource planning (ERP) systems is entering what some industry experts are calling an upgrade “supercycle,” fueled by a convergence of key factors.

Grandview Research predicts global ERP software sales will grow 9.5% annually from 2026 to 2033. Fortune Business Insights puts the growth rate from 2026 to 2034 at 13%. And Morgan Stanley analyst Chris Quintero is even more bullish, saying the ERP market will grow by 17% annually.

This projected growth spurt is significant because, as Forrester analyst Faram Medhora points out, “The ERP solutions market is mature, saturated in large enterprise adoption, and driven primarily by modernization rather than net-new ERP buying.”

Quintero adds that 50% of CIOs in a recent Morgan Stanley survey indicated they planned to upgrade and modernize their ERP systems over the next few years.

For many organizations, inertia is a powerful force. If the finance, supply chain, manufacturing and HR software are fully paid for and doing the job, then there’s little incentive to embark on a costly, risky upgrade. But the days of running mission-critical business processes on decades-old software are quickly coming to an end. Here’s why.

1. AI is having a transformative impact

Medhora, who uses the term “supercycle” to describe the rapid pace of ERP modernization, says, “AI-driven automation is the main innovation trend, moving ERP toward active orchestration across a federated application estate connected by APIs.”

Gartner analyst Johan Jartelius adds that AI “is transforming ERP systems from transactional to intelligent platforms that provide insights while reducing the need for human intervention in routine tasks.” Gartner predicts that by 2030, over 50% of foundational ERP tasks will be autonomously executed by AI, reducing human involvement in finance, supply chain, and HR.

But So Chan, US enterprise performance leader at Deloitte, cautions that AI’s rise is by no means marginalizing the centrality of ERP.

“AI isn’t the death of ERP; ERP is actually what enables the value of AI. That’s what we’re seeing,” Chan says. “The way we’ve been articulating it with our clients when we think about how their ecosystem works is this idea of a core, the systems of record, and that’s ERP. Then we have this outer layer that we are defining as systems of action. These are the agentic AI-enabled processes that wrap around the core system of record.”

To the question of where AI should be deployed, either into ERP systems or sitting on top, “what we’re finding is that being embedded in the transactional process is where you’re going to get that really important notion of context that is required to unlock AI value,” Chan says. “With legacy ERP systems you need to modernize the core before you layer on AI capabilities. Modernizing ERP isn’t a cost; it’s actually a catalyst to unlocking the value that you’re looking to achieve.”

Organizations that have integrated AI into their ERP systems have reported significant operational improvements, including a 25% reduction in delivery times and a 15% decrease in operational costs, according to Mordor Intelligence.

2. End-of-life deadlines loom large

ERP vendors that have been trying for years to nudge customers off legacy, on-premises systems and onto cloud platforms have found a new, highly effective tool: announcing end-of-support deadlines.

SAP announced it will end support for SAP Business Suite 7 on Dec. 31, 2027. And Microsoft said it will end support for Dynamics GP on Sept. 30, 2029. Running mission-critical software without a support contract means no new security patches, which constitutes an unacceptable risk for most enterprises.

“Legacy on-premises systems are approaching end-of-life, creating a ‘forcing function’ for cloud migration,” says Morgan Stanley equity strategist Simon Clark, adding that an estimated 60% to -70% of SAP’s support base has yet to move to the cloud.

These deadlines leave CIOs with the choice of migrating to the cloud on the incumbent vendor’s platform or switching to an entirely new vendor. Because it can take 18 to 36 months, not to mention millions of dollars, and considerable effort in areas such as data integrity and change management, to complete a cloud migration, CIOs need to start making those decisions now.

Chan adds that from her experience advising enterprise clients, the end-of-life deadlines are more of an impetus to start the upgrade conversation than an actual threat. From the vendor side, it’s more about “how do you envision unlocking the value that you are trying to achieve as an organization and how best can we get you there,” she says.

But the deadlines are having the intended effect of getting those conversations started.

3. Data sovereignty, geopolitics reshape cloud deployment decisions

Regulatory pressures, particularly in Europe and Asia/Pacific, are forcing CIOs of multinational enterprises to rethink their ERP strategies, particularly when it comes to the sensitive data contained in finance and HR applications.

“Geopolitical pressures are shaping cloud ERP choices: Increasing geopolitical tensions and regulations are driving organizations to use more local and regional cloud providers, especially in Europe, Asia/Pacific, and Canada, which is having a flow-on effect for ERP selection,” says Gartner analyst Neha Ralhan.

She points out that cloud sovereignty issues are also being driven by specific business and application requirements, which can vary by country, industry, and workload. Gartner recommends organizations “establish a sovereignty strategy by assessing legal, industry, and workload-specific requirements, and evaluate cloud vendors based on their ability to meet these needs in a sustainable manner.”

4. Cloud migration accelerates

Those three factors — AI, end-of-life deadlines, and data sovereignty requirements — are driving CIOs to rethink their ERP strategy, which in most cases means migrating from on-prem to the cloud.

The cloud ERP market is projected to expand from $56.53 billion in 2026 to $138.56 billion by 2031, a 20% growth rate, according to Mordor Intelligence. “The market continues to transition from traditional on-premises environments toward multitenant, consumption-based architectures that deliver faster time-to-value and lower total cost of ownership,” Mordor’s report says.

Morgan Stanley’s Clark adds, “As organizations seek to leverage generative AI, cloud infrastructure becomes essential. This need is prompting enterprises to fast-track their cloud strategies. For example, SAP SE has seen increased adoption of its S/4HANA cloud offering, driven by demand for AI capabilities.”

Deloitte’s Chan says, “Sitting and watching in a market that is moving so fast with the options and the technological advancement available is not really a sound business plan or strategy.” The discussion she has with clients is not whether to move to the cloud, but the pace of adoption and how to make that move while infusing AI into the mix.

At the same time, private cloud isn’t dead yet. Mordor Intelligence reports that private cloud ERP is growing at 22% a year, reflecting regulatory requirements, particularly in banking and healthcare.

“Cloud is now the architectural standard, but hybrid is the default in many regulated environments that require on-premises ledgers,” Forrester’s Medhora notes.

5. Monolithic apps are getting unbundled

When organizations take a step back and analyze cloud migration options, one approach is to break up their monolithic ERP platform into smaller, composable pieces.

“The obvious assumption is that the key beneficiaries of this ERP upgrade cycle will largely be the same companies with their cloud-equivalent offering,” says Justin Overdorff, a partner at Lightspeed Ventures.

But that’s not necessarily the case. “As organizations modernize, many are moving away from expensive on-premises ERP vendors like SAP and Oracle and towards modern cloud-based systems that support digital transformation and AI-readiness,” Overdorff says. “But, instead of adopting next-gen versions of these monolithic, do-everything systems, enterprises are opting for an unbundled, best-of-breed stack across finance, HR, procurement, supply chain, CRM, and more — tools that snap together like Lego pieces.”


6. The door opens to ERP startups

Lifghtspeed’s Overdorff argues that the acceleration of cloud ERP deployments combined with the breakup of monolithic ERP systems presents a unique opportunity for startups to capture market share in specific functional domains.

“This is more than just a tech refresh; we believe it’s an opportunity to turn the $150 billion ERP market on its head and reset the cost structure and performance of core business operations for the next decade,” he says.

He adds that the “all-in-one approach created high barriers to entry for new competitors (few could build such a broad system), and it locked customers into a single vendor’s ecosystem. However, we are now seeing a shift toward disintermediation of the enterprise OS, as companies opt for more modular point solutions. Rather than trying to build an entire ERP suite, many new entrants are targeting subsegments — individual functional areas traditionally served by a module of a big ERP — and doing them better.”

For example, the growing list of challengers offering cloud-native, AI-driven ERP specifically for accounting and finance includes Rillet, Pennylane, Ramp, Light, DualEntry, Campfire, Everest, and Digits.

Overdorff adds that there is also an opportunity for startups at the orchestration layer that sits above individual modules. “With agentic AI, such a platform can ingest semi-structured/unstructured data, reason across multiple workflows, and route tasks to the right tool with minimal human intervention, delivering maximal output and efficiency,” he says.

A decision hiding in plain sight

Picture two retail chains. Akkar & Co Group is the giant — hundreds of stores, the biggest revenue in the sector, the name every shopper recognizes. Tripoli Boutique is the smaller player — a regional chain with a loyal but modest footprint, competing against Akkar & Co’s sheer size. Both start the same way: manual inventory counts, paper-based reordering, spreadsheets stitched together by exhausted store managers — no real digital backbone anywhere.

Then both decide it’s time to grow up, picking the same cloud ERP platform and hiring the same systems integrator (SI) to implement it. Same software, same partner, same rough timeline — on paper, Akkar & Co and Tripoli Boutique are starting the race from the exact same line.

But one choice splits their paths. Akkar & Co asks for the system to be heavily customized around its own way of doing things — its own merchandising logic, its own supplier terms, its own store-level workflows. It has a simple conviction behind the request: our processes are the reason we’re winning, and no off-the-shelf system should be allowed to flatten them. Tripoli Boutique, without that same conviction — or the budget to test it — accepts the standard, out-of-the-box configuration the SI recommends.

Three years later, where do these two retailers actually stand — and what does that tell us about the risk of believing your own processes are worth defending?

The fork in the road

Because the software and the implementer are identical, we can rule those out as reasons for whatever happens next. The one real variable is a decision: bend the software to fit the business, or bend the business to fit the software.

Akkar & Co takes the first path, with confidence rather than stubbornness. Leadership had spent years refining exactly how the company merchandises, prices, and replenishes stores — habits and judgment calls that made it the biggest name in the category. “The ERP should adapt to us, not the other way round,” the CIO tells the board, “Because what we do isn’t generic, and we’re not going to let a piece of software pretend otherwise.” So Akkar & Co asks for custom pricing engines, custom store-replenishment logic, custom loyalty integrations — everything tailored to encode what actually makes it good at retail.

Tripoli Boutique takes the second path, and it’s worth being honest about why. It isn’t just budget. Tripoli Boutique has never been entirely sure its own processes are anything special — it has grown steadily, but never by doing anything a competitor couldn’t copy. Standard configuration isn’t a disciplined strategic choice so much as the safer, cheaper default for a company that has never had the confidence, or the resources, to bet that its own way of working is worth preserving in code.

That difference — conviction versus caution — is the whole story.

Two go-lives, one clear fit

Akkar & Co’s go-live is hard. Customization means a longer project, a bigger bill, and more testing when real store data — SKUs, promotions, seasonal pricing — hits a system built to order. Change management is heavy too, because store staff are being asked to fully commit to a tool built around exactly how they already work. But once it stabilizes, the system fits Akkar & Co like a tailored suit, because it was cut from Akkar & Co’s own pattern. Store managers don’t just tolerate it — they recognize their own judgment reflected back at them in how the system behaves.

This isn’t a small footnote. A 2025 report on ERP customization costs found most ERP implementations cost three to four times the original budget, and that modifications made “to improve usability” — the polite name for customization — drive the overspend in roughly two out of three projects. Akkar & Co walks into that statistic with open eyes. For a company confident in what it’s protecting, the extra spend isn’t a risk. It’s the price of keeping an edge intact.

Tripoli Boutique’s go-live, by contrast, is smooth and cheap — and unremarkable. Standard configuration means fewer surprises and a shorter timeline. Staff adjust to the system’s way of doing things because there was never really a “Tripoli Boutique way” strong enough to insist on keeping. It works fine. It just doesn’t do anything for the company that a hundred other retailers on the same platform aren’t already doing.

The AI divide

About a year or two after go-live, the ERP vendor rolls out its next big wave of features — built-in AI: demand forecasting, anomaly detection, automated markdown suggestions, a copilot for store performance questions. This is not a separate project either retailer asked for. It’s simply the next version of the software both of them already own. But what each company gets out of it depends entirely on what it built underneath.

For Tripoli Boutique, the AI is a wash. Because its configuration is standard, the AI slots in cleanly and works well — genuinely useful for demand forecasting and reordering. But it’s the same AI every other retailer running the same standard setup gets. It doesn’t help Tripoli Boutique stand out. It helps Tripoli Boutique keep up, and nothing more.

For Akkar & Co, the AI becomes something else entirely. Because the vendor’s AI learns from the data and workflows underneath it, and Akkar & Co’s data and workflows encode three years of genuinely differentiated retail judgment — pricing logic built around real customer behavior, replenishment rules shaped by real store-level patterns — Akkar & Co’s AI comes out sharper. It doesn’t just forecast demand; it starts predicting the shape of a customer’s experience: what a shopper is likely to want next, when they’re likely to want it, what would make them spend more or come back sooner. The same AI feature, running on top of a genuinely superior foundation, produces a genuinely superior result. This is the payoff the customization was always betting on.

A 2026 industry briefing on ERP and generative AI makes a related point: the retailers getting the most out of AI aren’t necessarily the ones with the newest technology, but the ones whose underlying data and processes were distinctive enough to give the AI something worth learning from in the first place. Generic input, generic output. Distinctive input, distinctive output. Akkar & Co bet on distinctive input three years earlier, without knowing exactly what it would pay off as.

3 years later: the scoreboard

So, three years on — who’s ahead?

Akkar & Co is not just still leading; the lead has grown. That lines up with the broader market too: the biggest ERP vendors and their biggest customers tend to stay on top for a long stretch, and current global ERP market data shows the same concentration pattern, with the largest players controlling a disproportionate share of a market still growing at double digits every year. Size, once earned, tends to keep earning — but this time, faster.

A few things are true at once:

  • Momentum was never really at risk. Market leadership built over years — brand trust, customer relationships, scale, supplier power — was always going to be hard for Tripoli Boutique to close in three years. But the ERP decision didn’t just fail to shrink that gap. It widened it.
  • The customization was the whole point, not a side bet. Akkar & Co’s custom workflows encoded genuine competitive advantage — pricing logic, replenishment rules, merchandising judgment that actually differentiate the business. When AI arrived, that advantage didn’t just survive the upgrade. It compounded through it.
  • Tripoli Boutique’s caution had a ceiling. Lower cost and a smoother go-live were real, honest advantages in year one. But without a genuine edge underneath its systems, Tripoli Boutique had nothing for the AI wave to amplify. Standard configuration kept it safe. It never once made it distinctive.
  • The gap that might have narrowed didn’t. In a story where Tripoli Boutique’s agility slowly closes the distance, this isn’t that story. Akkar & Co’s AI-driven differentiation opened a second front Tripoli Boutique had no way to compete on, on top of the first one it was already losing.

Akkar & Co is ahead because of the customization, not in spite of the cost and friction it created going in. The bet on “our processes are superior” turned out to be correct, and correct bets compound.

Image is everything

Once Akkar & Co’s AI started genuinely shaping the customer experience — not just the back office — the company didn’t stay quiet about it. It built a one-year, aggressive marketing campaign around it. Customer-facing stories about AI that seemed to know what a shopper wanted before they did. Public demonstrations of personalized recommendations, faster and more relevant than anything a shopper had seen from a competitor. Messaging that made a simple, confident claim: this is what happens when a retailer’s technology is built around genuinely better judgment.

This wasn’t a defensive move. Akkar & Co wasn’t reacting to a closing gap — there wasn’t one to close. It was amplifying a real advantage it already had. And it worked, for a very ordinary reason: shoppers don’t audit a retailer’s back-end systems, but they do notice when a store seems to understand them better than the last one did, and they talk about it. A 2026 review of branding statistics found that the large majority of marketing executives consider branding essential to business growth, and that companies with consistent, visible branding see measurably higher revenue growth than those without it — branding ROI shows up directly in customer lifetime value and market share, not just recognition. None of this proves marketing alone drove Akkar & Co’s growth — but paired with a genuine capability underneath it, the campaign didn’t need to invent a story. It only had to tell a true one, loudly.

Technology gave Akkar & Co something real to say. Marketing made sure everyone heard it.

The long game

Here’s the part nobody outside Akkar & Co’s boardroom saw coming. Buried in Akkar & Co’s five-year strategic plan, quietly sitting behind the public narrative of “AI leadership,” was a single line item: acquire Tripoli Boutique.

It wasn’t about market share — Tripoli Boutique’s share was modest enough that absorbing it barely moved Akkar & Co’s numbers. What Akkar & Co wanted was something its own mass-market base could never give it: Tripoli Boutique’s customers. Despite its unremarkable technology, Tripoli Boutique had spent 20 years quietly building a small but genuinely valuable clientele — customers with serious money, who bought high-end jewelry and premium cosmetics, and who trusted Tripoli Boutique’s staff enough to keep coming back for exactly that kind of purchase. It was a relationship built the old way, person to person, long before either company touched an ERP system.

Akkar & Co’s leadership recognized that value the moment its own AI proved what it could do with distinctive data. Feed 20 years of high-value jewelry and cosmetics purchase history into an AI engine already sharp enough to predict ordinary shoppers’ behavior, and something bigger becomes possible: a premium tier Akkar & Co could never have built organically, and a much clearer picture of exactly which VIP customers were worth a personal call, a private preview, or a nudge toward the next expensive purchase.

Tripoli Boutique’s board wasn’t blind to the timing. They’d turned down Akkar & Co’s interest twice before, confident their customer relationships were worth more standing alone. This time, watching a competitor’s AI-driven personalization pull further ahead every quarter with no real answer of their own, the board concluded that their most valuable asset — the trust of their VIP customers — would do more good inside a company that could finally act on it at scale than it would sitting inside a smaller one that couldn’t. It wasn’t a surrender. It was a recognition that the asset and the capability to use it well finally belonged in the same building.

The deal wouldn’t be frictionless in real life — a regulator would want a look at combined market share in overlapping regions, and any acquisition of this size rarely closes without scrutiny — but in this telling, the story is about strategy, not scrutiny.

Akkar & Co didn’t just out-execute Tripoli Boutique. It built a genuine edge, told the truth about it loudly, and then bought the one thing its own strength couldn’t manufacture: a customer base built entirely on old-fashioned, human trust.

Closing thought

Akkar & Co’s bet was the right one. Superior processes, encoded deliberately rather than smoothed away by a generic system, turned out to be worth defending — and when AI arrived, that decision didn’t just hold up, it paid out. Tripoli Boutique’s caution wasn’t foolish, exactly. It was simply insufficient: a safe choice that kept the lights on but never gave the company anything to amplify when the moment came.

And here’s the detail that makes the whole plan feel like design, not luck: both companies had been running the same ERP platform all along, just configured differently, so the integration itself was almost frictionless by construction. After the deal closed, Akkar & Co brought the vendor back to the table, not to ask whether the two systems could talk to each other, but to decide how deliberately Tripoli Boutique’s data should be folded in. They chose to merge it fully into Akkar & Co’s customized core, rather than bolt it on as a separate system, precisely so that Tripoli Boutique’s 20 years of purchase history could run directly through Akkar & Co’s optimized processes and AI models — not sit beside them as an afterthought but become part of the same intelligence from day one.

But sit with the ending for a second longer. What Akkar & Co actually acquired wasn’t a smaller retailer’s revenue — it was 20 years of trust that wealthy customers placed in people who knew them by name, and it’s about to run that trust through a machine built to predict what those same customers will want to buy next. The strategy worked exactly as designed. That’s not the uncomfortable part. The uncomfortable part is this: once a relationship built on being known becomes a dataset built on being predicted, is it still the same relationship — and does it matter, to the business or to the customer, if nobody involved can quite say when the answer changed?

Avoiding the ERP hangover

I have seen the same pattern repeat across industries, geographies and operating models. Fortune 500 organizations spend millions on ERP transformations to modernize lead-to-cash, finance, people operations, supply chain and other core functions. For several years, those programs create a clear sense of direction. Roadmaps define the work, system integrators add capacity and execution discipline, and governance forums create visibility. Milestones give everyone a common language for progress as capabilities roll out to the business.

Then the program ends. After the go-live celebrations and hypercare fade, many organizations face what Lenovo’s Art Hu described to me in 2019 as “a sea change.” For three years or more, the answer to “what should we work on next?” was embedded in the program roadmap, and accountability was reinforced by transformation governance and third-party partners. Continuous improvement was often slowed on purpose to create capacity for the implementation. And the skills and operating rhythms that carried the organization through go-live are not always the ones that create value from the platform afterward.

This is where the ERP hangover sets in. Like any hangover, it can be painful, disorienting and harder to shake than expected. It is also manageable if you see it coming. Working with clients at this inflection point through 2026, I have seen three moves separate the organizations that lose momentum from those that build on what they just bought.

For CIOs nearing the end of a major program, these are the glass of water and two Advil you take before bed after a night of cabernet at the local CIO roundtable.

Reorient the operating model for continuous improvement

Much of what drove accountability and execution rigor during the implementation will scale back or disappear as the program winds down. To keep new ERP capabilities from dying on the vine, someone has to own the care, feeding and evolution of each one.

That owner is a capability manager, whose job is to stay in ongoing dialogue with the business or functional stakeholder about what is going well, where the opportunities to improve sit and where the business is pivoting next. A capability roadmap memorializes that conversation and gets revisited continuously. During the ERP program, milestones held steady for months at a stretch. In continuous improvement, what matters can shift week by week.

Consider a multi-brand, global CPG client nearing the first of many go-lives. They were candid about where they stood: strong at project-based implementation when the targeted outcome was static, thin on execution discipline for day-to-day work where the outcome moves. Their teams were organized around skill sets and went reactively from problem to problem across the value chain, leaving little room for proactive business enablement.

To get ahead of the hangover, they moved to a product-oriented, capability-aligned operating model. Team structures now follow the capabilities the ERP delivers, such as supply chain, finance and HR. Each capability has a product manager and the cross-functional resources to deliver end-to-end, a roadmap maintained with a defined set of business and functional stakeholders, and common agile ways of working to coordinate planning and dependencies.

Their bet is a clear one. Continuous improvement in a dynamic environment will not happen unless the operating model is designed for it, and leaving it as-is would forfeit the benefits the transformation was meant to deliver and make them poor stewards of the company’s investment.

Rethink the workforce strategy

Most ERP transformations set out to consolidate workflows from many applications onto a strategic platform: fewer tedious point-to-point integrations, less variability in how processes get done and no long tail of point solutions to maintain. Today’s cloud ERP platforms also arrive with a growing set of out-of-the-box capabilities that agents can deliver.

The implication is that bespoke development gives way to agent-driven workflows that connect native platform capabilities. Separately, the volume of AI solutions entering the enterprise will change how much manual operational work it takes to keep the lights on. The shape of the work before and after an ERP upgrade looks very different.

Our clients getting ahead of the hangover are using the quarters before go-live to reset the workforce strategy. They go job family by job family and ask a plain question: is this strategic to our future business imperatives and worth investing in, or is it a candidate for automation or outsourcing given the AI options now available?

One F500 manufacturing client is redefining the roles and skills it will need in a post-ERP world. Software development keeps getting faster and more commoditized, and the modernized platform brings more agentic capability out of the box in areas like sales and billing. They are leaning into that and reducing the resources dedicated to transactional, process-oriented work. The freed capacity funds hires who manage, integrate and orchestrate cross-functional, multi-agent workflows.

Acknowledge the two speeds ahead

This program may be winding down, but the astute CIO knows the next wave is only a matter of time. Organizations that avoid the hangover accept that they will always have two types of work: project work like the big ERP program, which is milestone-driven, and product work, which is continuous by nature. They set criteria for sorting work into each, define specific ways of working for both and expect the two to co-exist. Most importantly, they define how a capability transitions between them.

Action for CIOs

If your final go-live is 12 to 18 months out, the hangover is still preventable, and preventing it costs very little. Name the capabilities the platform will deliver and the person accountable for each. Start the workforce assessment now, job family by job family, while there is still runway to reskill and rebalance. Write down the criteria that separate project work from product work, and the path a capability takes between them. Then put the first capability roadmap in front of a business stakeholder before hypercare ends, so the muscle exists before you need it. All of it is easier while the governance forums, the partners and the executive attention are still in the room. There’s already a backlog of enhancements that have been deferred until after go-live. The organizations that get lasting value from ERP start building for the day after while the implementation is still running.

The ERP reckoning: Decades of customization could block AI value

For years, ERP customization was the smart play. When SAP or Oracle systems didn’t bend easily to the way a factory ran shifts or a distributor priced products, CIOs built around it, modifying, extending, or hard-coding until the system matched the business rather than the other way around.

And, for some time, customization worked. It also quietly became one of the most expensive decisions many companies never explicitly signed off on.

There’s a correction under way in enterprise IT, however, and AI is what’s forcing it out into the open.

Angela Maragkopoulou, chief information and digital officer at Sunlight Group Energy Storage Systems, has been direct with her leadership team about what standardizing on an ERP system core buys them. “Don’t sell standardization to your board as technical cleanup,” she says of the case for a “clean core” ERP strategy. “Frame it for what it is: the price of admission to AI.”

That price isn’t one every CIO is willing to pay yet. Even as AI investment accelerates elsewhere in the business, the share of organizations that prefer a customized approach has barely moved: from 52% in late 2024 to 51% by August 2025, according to IDC’s most recent research. “It appears to be a strategic minority move today, concentrated in large enterprises with the technical debt pain, and not yet a broad-based CIO spending pattern,” says Mickey North Rizza, group vice president of enterprise software research at IDC.

James Baker, a partner in Bain & Co.’s Enterprise Technology practice, is seeing nearly the same thing among his clients: Companies, he says, are not yet “funding wholesale de-customization purely for AI.”

Until then, a competitive gap is likely to widen between those CIOs addressing a decades-old problem and IT leaders still deciding whether it’s worth touching at all. At stake is the ability to make the most of AI going forward, as grafting AI onto an existing mess quietly inherits every flaw in it, too.

Why the customization happened in the first place

No one got here by mistake,” says Maribel Lopez, founder of Lopez Research.

“You have to think of why they customized in the first place,” she says. “ERP companies have been trying to get customers to move to the cloud for years. One of the reasons they wouldn’t is they are loath to give up the customization. Customization equals specialized business process in ERP.” It was a rational choice at the time.

What’s changed is who, or what, is trying to use that customized system. Older reporting and automation tolerated customization because a human was still reconciling the exceptions. “AI agents, especially agentic AI, need a single, trustworthy version of the process to act on,” North Rizza says. “Customization fragments this version; … custom code, bespoke workflows, and legacy architecture become a ‘black box’ risk rather than just maintenance overhead.”

Lopez likens customized ERP to a bespoke bicycle. A bike built for a person five feet tall would be hard for someone six feet tall to ride. “You could get some things to work, but it wouldn’t work the same way,” she says. A vendor’s embedded AI is built for the standard bike.

Customization doesn’t make the system unrideable. But it means every mile will cost you more.

Where this shows up first is fairly consistent across the companies IDC tracks: finance close and reconciliation, procurement contract management, and supply-chain demand planning. That is, the high-volume, rules-based processes where agentic AI has the clearest early payoff, and the least tolerance for a fragmented version of the truth.

A CIO who reconciled this early

Sunlight’s S/4HANA implementation was, in Maragkopoulou’s telling, a standardization decision first and an AI decision in hindsight. The triggers were concrete: Its legacy SAP system was heading out of support in 2027, and running parallel systems across factories in Greece, Germany, and the US was expensive and fragile; moreover, leadership was eager for real-time, role-based reporting.

“AI wasn’t on the agenda when we scoped it,” Maragkopoulou says. “But standardization turned out to be the best AI decision we made, long before AI was the headline.”

Sunlight kept customization only where it was a genuine differentiator — a variant configurator that automates complex B2B order entry — and cut the rest, including what she calls a “convenience layer” of old screens and reports that had quietly accumulated without anyone questioning them.

The payoff came later. “The simplified data model and embedded analytics mean the data is consistent and trustworthy, which is most of the battle,” says Maragkopoulou. “A clean foundation makes AI possible, not automatic.”

Maragkopoulou’s advice to other CIOs is to standardize first, or don’t bother. “If you bolt AI onto a heavily customized landscape, you don’t get intelligence,” she says. “You get your complexity, automated and scaled.”

A realization, or a trap?

Not every CIO reads this the way Maragkopoulou does.

Scott Hicar, a fractional CIO who has lived through several SAP platform transitions (R/3 to ECC, and now ECC to S/4HANA), calls these shifts a vendor revenue strategy, not a strategic CIO choice. CIOs get pulled into them whether they intend to or not.

“ERP companies strategically, every five to 10 years, need to force a re-licensing or re-upgrade sort of event to generate enough top-end revenue to meet their plans,” he says. AI, in his view, is this cycle’s justification: new capability available natively only on the latest platform, paired with the pressure of an end-of-life deadline.

“It always made me mad as a CIO that my maintenance dollars were funding the R&D of a next platform I ultimately wasn’t licensed for,” he says.

Hicar isn’t just wary of being swept into an expensive re-licensing event on a vendor’s timeline. He’s also skeptical of CIOs stacking custom AI atop a legacy system rather than paying to standardize. That custom AI, he says, risks going obsolete, or simply being duplicated for free, once a company finally upgrades to the standardized platform.

“The shelf life of AI investments is really short, given the speed of innovation,” Hicar says. “It’s hard to make these one-off bets pay off before obsolescence.”

Even CIOs who accept the case for standardization may not agree on how to get there. Some go underneath, cleaning up the core system itself; others layer AI agents on top of legacy systems instead, leaving the customization in place. SAP HANA migrations alone average roughly 15 months, according to an IDC survey fielded in May 2025 — and that’s before a company has touched a line of custom code. Either path is expensive.

“The question,” Lopez says, “is where will people spend the money.”

The risk of waiting

The cost of sitting on the fence compounds. IDC’s CIO Sentiment Survey, fielded in April 2025, ties technical debt to 49% to 60% higher maintenance costs at large enterprises. North Rizza is frank that it “slows AI deployment and scaling.”

A November 2025 IBM study found that unaddressed tech debt can consume 18% to 29% of AI implementation costs and stretch a 30-month project to 36 months. Even before AI enters the picture, 80% of ERP transformations miss their goals, according to Bain’s AI-Enabled ERP X-Ray. Layering AI on top of an already unstable foundation, Baker says, “doesn’t solve the problem; it just makes it harder to unwind.”

For now, many companies are doing neither. They aren’t standardizing, and they aren’t sitting still. They’re piling AI onto whatever already exists, inheriting the same fragility that has always come with customization, just with higher stakes attached. Maragkopoulou is convinced that’s a mistake CIOs will come to regret. Hicar agrees the workaround is no safer; AI built to avoid the upgrade risks going obsolete before it pays for itself, he argues.

The bill is coming regardless. What’s left is a simpler question: whether CIOs choose when they pay it or let a vendor’s deadline choose for them.

SAP dodges German antitrust investigation over data extraction

SAP is not unfairly preventing enterprises from extracting their data from its systems for use with competitors’ applications, the German Federal Cartel Office (Bundeskartellamt) concluded Thursday after a preliminary investigation.

The Bundeskartellamt does not currently intend to initiate abuse proceedings against SAP, although it will continue to monitor developments in what it views as a dynamic market, it said in a news release.

It launched its investigation into SAP’s practices following complaints by software companies including Celonis, a developer of process mining tools, alleging that SAP makes it difficult for customers and third parties to access data from its ERP systems and favors its own Signavio process mining tool.

“Companies must generally also be able to use their own data in third-party applications. With large software platforms, in particular, non-discriminatory access to data is crucial to effective competition,” said Bundeskartellamt President Andreas Mundt. “Our preliminary investigation has found that there are currently sufficient data extraction options available and that there have so far been no indications of exclusionary practices that may be relevant under competition law.”

SAP changed its policies on accessing data held in its applications via APIs in April, prompting customer pushback.

But, said Mundt, the Bundeskartellamt found that despite the API policy change, data extraction options that were previously permissible are still available.

Data extraction is possible

SAP welcomed the Bundeskartellamt decision, saying that “as the authority states, SAP customers and partners have sufficient and permissible technical options to extract data from SAP systems and use it in solutions from other providers. The SAP API Policy does not restrict these capabilities.”

Celonis also issued a statement, noting that the Bundeskartellamt ruling underlined the continued importance of unrestricted data access, and warning, “The decision is based on the key premise that data extraction for software from providers such as Celonis will remain possible even under SAP’s new API policy — a premise that SAP has been unwilling to confirm to date.”

The Celonis statement continued, “We remain steadfast in our conviction that company data belongs entirely to the customers who generate it. No provider should restrict a company’s right to extract its own information or prevent users from working with third-party providers such as Celonis that offer added value to customers.”

Celonis is also attacking SAP’s policies on data extraction in court in California. It filed a complaint in March 2025 alleging that SAP was leveraging its software to “prevent SAP customers from sharing their own data with third-party providers, including Celonis, without paying prohibitively expensive fees.” The judge dismissed some of the claims in that case, leaving three to be tested in a trial then scheduled for December 2026. Celonis has since amended its complaint to include 10 claims, and the trial has been rescheduled for 2027, the company said.

“Our litigation continues to uncover evidence of SAP’s unlawful behavior, including anticompetitive conduct and theft of intellectual property, and we are confident in the evidence that we will present at trial,” Celonis said following the German authority’s decision.

The Bundeskartellamt’s failure to find sufficient evidence to open a ‘formal abuse of dominance proceeding’ is a small win for SAP, said Scott Bickley, advisory fellow at Info-Tech Research, but “CIOs should not mistake it for a validation of SAP’s data access model.”

Although SAP recognizes customers’ right to decide they use their data, it does not make it easy for them to do so, he said. “CIOs may technically retain vendor choice but be faced with expensive replication architectures, API rate and volume restrictions, additional platform costs, performance lags and data migration costs, all with a dependency on an SAP-approved technical pattern, which can be a moving target.”

Data ownership as a procurement issue

Justin Greis, CEO of consulting firm Acceligence, sees the decision as an instructive one for enterprise CIOs.

“This isn’t a reason to stop asking hard questions of your ERP vendor. Whether it’s SAP, Oracle, Microsoft, Salesforce, or anyone else, enterprises should continue to evaluate how easy it is to access their own operational data, integrate third-party applications, and migrate workloads if business priorities change. Those questions are becoming strategic procurement issues, not just technical ones,” Greis said.

CIOs should consider data portability early in the procurement process, said Kaan Dincer, CEO of data migration vendor Settle: “Negotiate export rights, API access on reasonable terms, and documentation of the data model before signing and test a real extraction while the vendor still wants your renewal. The cost of your eventual exit is set on the day you implement, not the day you leave. ERP data now feeds analytics and automation outside the system of record, so access friction that used to be an IT annoyance is becoming a strategy constraint.”

In the SAP case, he said, “the regulator answered a narrow legal question, not the operational one. Declining to open proceedings means the friction was not shown to be anticompetitive. It does not mean the friction is not real. The Bundeskartellamt’s own findings acknowledge that extracting large data volumes is technically demanding and it said explicitly that it will keep watching as access mechanisms and license models evolve. That is not a clean bill of health. It is a decision to hold fire.”

Srinivasulu Reddy Battu, a senior software engineer with cloud vendor ZT Systems, said the big takeaway is the difference between difficult and impossible. SAP’s argument is that the data migration outside of its environment is possible, but Battu said it can be a time-consuming and expensive process.

“When the ruling says ‘various permissible and viable options’ exist, that’s technically true, but it glosses over how much expertise it actually takes to use them,” Battu said. “CIOs should still watch how process mining gets packaged in their contracts. If Signavio comes included by default, teams will naturally start using it and that quietly reduces your negotiating power with other vendors over time. This isn’t just about SAP: Oracle, Microsoft, every major ERP vendor sits on a massive amount of your business data. If any of them decided to tighten their API policies tomorrow, most companies would be scrambling.”

❌