Your ERP vendor just gave you an impressive AI agent demo. Now you need to decide what to actually enable, in what order, and with what guardrails. That’s where most CIOs stall — not for lack of enthusiasm, but for lack of a method to move from vendor promises to a deployment that holds up in production.
This article does not compare AI tools across ERP vendors — that work is done in our comparison of SAP Joule, Sage Copilot, Odoo AI and Microsoft Copilot. It answers a different question: once you’ve made your choice (or had it made for you), how do you actually do this?
Agentic AI in ERP: An Honest Assessment in September 2026
What Vendors Actually Deliver vs. Marketing Announcements
By September 2026, the ERP market has reached a two-speed maturity on AI.
On one side, so-called “copilot” features — text suggestions, form auto-completion, automatic summarisation — are genuinely widespread among major vendors (SAP, Microsoft, Oracle, Sage, Odoo). These features are available, documented, and mostly activatable without custom development. Their ROI is modest but measurable: a few minutes saved per transaction, fewer data entry errors.
On the other side, autonomous agents that execute full processes without human intervention — the real promise of agentic AI — remain in early access or beta at most vendors. SAP publishes its public progress on the SAP AI Use Case Explorer. The reality: around thirty use cases documented in production, out of hundreds announced.
The practical implication for a CIO: the risk is not moving too fast — vendors themselves slow things down through cautious roadmaps. The real risk is disrupting your teams for features that won’t be delivered by the promised date.
The Key Distinction: Copilot vs. Agent vs. RPA
Before setting your strategy, clarify the vocabulary internally. Three levels coexist in current ERPs:
- AI Copilot (assistance): the AI suggests, the human decides and validates. Examples: VAT code suggestions, support ticket summaries, customer follow-up email drafts. Low risk. Moderate immediate value.
- AI Agent (partial autonomy): the AI executes an action conditionally, with optional human validation above a risk threshold. Examples: automatic bank reconciliation under 50 lines, purchase order generation triggered by stock levels. Medium risk. High potential value.
- RPA (traditional automation): a deterministic script without AI, triggered by a rule. Examples: scheduled accounting extracts, file synchronisation. Low risk. Stable but non-adaptive value.
The most common mistake: calling “agentic AI” what is really RPA dressed up with a prompt. This creates false internal expectations and disappointment at the first audit.
Identifying Your First Three Priority AI Use Cases
Method: Impact × Risk × Technical Maturity Matrix
For a first deployment, don’t start from the features available in your ERP — start from the processes that cost your organisation the most. Then cross-reference with what your vendor actually delivers today.
A simple three-axis matrix is sufficient:
| Axis | Question | Score 1–3 |
|---|---|---|
| Business impact | How many person-hours per month does this process consume? What is the cost of an error? | 1 = minor, 3 = critical |
| AI risk | What is the cost of an agent error? Is it reversible? | 1 = low, 3 = high |
| Technical maturity | Does your vendor deliver this use case today? Is your data clean? | 1 = not ready, 3 = available |
Priority score = Impact × Maturity / Risk. Use cases with a high score and low risk form your Phase 1.
Low-Risk, Quick-Win Use Cases (Phase 1)
These four use cases are available from most enterprise ERP vendors in 2026, on well-structured data, with limited consequence risk if an error occurs:
1. Automatic bank reconciliation The agent matches bank statement lines against ERP postings. Any exception goes to a human queue. Typical gain: 60–80% of volume processed automatically. Prerequisites: a clean bank coding scheme and six months of properly labelled transaction history.
2. Expense report anomaly detection The agent scans submitted expense reports, compares against internal policy (spending caps, permitted categories, missing receipts), and flags suspicious cases before approval. No automatic decision: the agent flags, the human decides. This “control before validation” framing is politically easier to get buy-in from business teams.
3. Supplier history summary before negotiations Before a negotiation session, the agent compiles in 30 seconds: 12-month order volumes, service levels, open disputes, price history. What used to take a buyer 45 minutes. Near-zero risk — it’s reading, not writing.
4. Purchase order proposal generation on stock thresholds The agent monitors stock levels against min/max thresholds, creates draft purchase orders (not firm orders), and submits them for approval. Meaningfully different from a classic MRP: context is enriched with recent consumption data and supplier availability alerts.
High-Potential but Higher-Risk Use Cases (Phase 2)
Reserve these for Phase 2, once your AI governance is established and your team has experience handling first agent correction cycles:
- AI-assisted financial close: month-end journals carry high compliance risk. Enable only with systematic human validation on every generated entry.
- 13-week cash flow forecasting agent: high value, but forecasting errors affect financing decisions. Requires pristine AR/AP data quality and at least 18 months of historical data.
- AI-driven production planning: the interdependency of constraints (stock, machine capacity, supplier lead times) makes agent errors difficult to detect without strong domain expertise.
Technical Architecture: Connecting Your LLM to Your ERP
Approach 1 — Vendor-Native AI: Advantages and Limits
SAP Joule, Microsoft Copilot for Dynamics 365, Oracle Fusion AI Agents, and Sage Copilot are native AI solutions: they access ERP data via pre-built connectors, respect existing user permissions, and are maintained within the vendor’s update cycles.
Advantages: zero integration work to write, default compliance with the ERP security model, support included in the vendor contract.
Limits: you don’t control the underlying model, available features are those the vendor chose (not necessarily the ones you need), and per-user cost can be significant — vendors typically charge between £20 and £60 per user per month for advanced AI modules, depending on functionality level and contract size.
Approach 2 — External LLM via API Connected to the ERP
Connecting an external LLM (OpenAI GPT-4o, Claude, Gemini) to your ERP via REST API calls or via the MCP (Model Context Protocol) — an open standard published by Anthropic in November 2024, now adopted by dozens of ERP integrators.
MCP defines a standardised protocol for an AI agent to invoke “tools” exposed by a third-party system (reading a purchase order, creating an accounting entry, querying a stock level) without the developer writing a custom connector for each LLM. Mid-market ERP vendors are beginning to publish official MCP servers.
Advantages: full control over the model, ability to build custom agents tailored to your specific processes, potentially lower cost.
Limits: internal integration and maintenance burden, responsibility for the security of data sent to the external LLM, and the obligation to filter LLM calls through your data privacy policy.
Approach 3 — Third-Party Agentic Platform Orchestrating ERP Tools
Platforms like LangChain, AutoGen, or CrewAI enable orchestration of multi-step AI agents that call multiple tools in sequence: an ERP query, an external calculation, an email, a human approval step. This is the most flexible and most complex approach.
Suited to cross-functional processes that span multiple systems (ERP + CRM + finance), it requires a solid technical team and the ability to maintain orchestration code over time. Reserve for IT organisations already mature in AI.
What CIOs Must Understand: The Sensitive Data Access Question
Whatever architecture you choose, one question must be answered before any deployment: what ERP data is transmitted to the AI model, and with what confidentiality guarantees?
For vendor-native AI, data remains within the contractual perimeter — but verify that your contract explicitly excludes the use of your data for model training purposes. For external LLMs via API, check the operator terms of service (Microsoft Azure OpenAI, Google Vertex AI, and AWS Bedrock offer non-training guarantees on customer data; direct OpenAI/Anthropic Enterprise APIs do too).
A confidential data leak via a misconfigured LLM is a real GDPR compliance risk. That is not a reason to block the project, but it is a reason to do this work before the pilot.
Governance and AI Risk Management in ERP
The Hallucination Risk in an ERP Context
An LLM can fabricate information with apparent high confidence. In an ERP context, high-risk hallucinations include:
- An invented amount or accounting code in a generated journal entry
- An unverified delivery date cited in a supplier communication
- An invented tax rule in a VAT coding suggestion
Mitigation: for any agent that writes to the ERP (not just reads), always impose either a human validation step or an automatic consistency check (e.g., the generated entry must balance, the amount must fall within a reasonable historical range). Never allow an agent to write without guardrails on financial data.
Audit Trail: Logging Every AI-Assisted Decision
The EU AI Act (Regulation 2024/1689, EUR-Lex official text) requires high-risk AI systems to maintain logs that allow reconstruction of how a decision was made. Even if your use case is not classified as high-risk under the Act, maintaining an audit trail is an indispensable best practice: who initiated the action, which AI agent produced which output, what input data was used, who approved it.
Most enterprise ERP vendors now include AI activity logs in their audit dashboards. Verify that these logs are enabled and retained according to your retention policy.
Permissions and Access: An AI Agent Must Have the Same Constraints as a Human User
A classic mistake in early integrations: the AI agent is configured with a broad-rights service account “because it’s simpler.” This is the worst thing you can do. An AI agent must operate under the same permission model as the human employee whose action it replaces or assists:
- Access only to the modules and entities needed for its function
- Access logging (agent accesses must be distinguishable from human accesses in logs)
- Easy revocation if the agent is deactivated or compromised
Think of it as an external contractor accessing your ERP: defined scope of service, minimum rights, full traceability.
AI Act Compliance: Obligations for Organisations Deploying AI
The AI Act distinguishes AI system providers (your ERP vendors) from deployers (you). As a deployer, your main obligations are:
- Risk assessment: classify your AI use cases according to the AI Act categories (prohibited, high-risk, limited risk, minimal risk). Most standard ERP AI use cases fall into limited or minimal risk. HR AI modules (candidate scoring, performance assessment) are potentially high-risk — verify with your vendor.
- User information: if an AI agent interacts with your employees or customers, they must be informed that they are interacting with an AI (Article 50).
- Human oversight: for high-risk systems, maintain effective human monitoring capability and document oversight procedures.
For a full regulatory assessment, see our dedicated article on the EU AI Act and ERP compliance.
AI Governance RACI: Who Is Responsible When an Agent Makes an Error?
This is the question nobody asks before the first incident. Define it before deployment:
| Role | Responsibility |
|---|---|
| CIO | Technical architecture, security, audit trail, regulatory compliance |
| Business director (CFO, CHRO…) | Use case validation, supervision of AI-assisted decisions within their scope |
| Data steward | Input data quality, anomaly reporting |
| ERP vendor | Model reliability for features covered by contract |
| The organisation (legal entity) | Final accountability for decisions made with AI assistance, vis-à-vis third parties |
This last point is critical: an AI is not a legal person. If an AI agent generates an incorrect accounting entry that distorts P&L, the liability belongs to the organisation, not the vendor (unless a documented contractual fault applies).
Budget and ROI: What to Plan For
Costs to Anticipate
Without quoting figures that vary by vendor and user volume, the cost categories to systematically budget are:
- Vendor AI licences: vendors typically charge these as an add-on to the base ERP contract. Ask explicitly for the per-user, per-module price — do not leave this vague during contract negotiation.
- Data preparation: this is the most underestimated cost line. An AI agent does not improve data quality — it amplifies it. Garbage in, garbage out. Budget between 15 and 40% of the total project cost for data preparation and governance, depending on the current state of your master data.
- Change management: AI agents that are not adopted by teams produce zero ROI. Train your users to work with AI (when to trust it, when to correct it, how to report an anomaly). Budget at least one training day per impacted business profile.
- Integration cost (for non-native approaches): depending on complexity, from a few days of development to several months for advanced orchestrations.
Measuring ROI
Before deploying, define for each use case:
- The baseline: how much time/people does this process currently consume?
- The success indicator: what percentage of volume must be handled automatically, with what acceptable error rate?
- The measurement window: no less than three months of stable production, ideally six months for predictive use cases.
The real ROI of first AI ERP deployments is generally positive but modest over 12 months. Well-documented projects from SAP and Sage report productivity gains of 15–25% on targeted processes (sources: SAP AI Use Case Explorer, Sage Annual Report 2025). These gains do not materialise in the first month — plan for a three-month ramp-up before you have usable figures.
Deployment Roadmap: From Zero to Three Active AI Agents in Six Months
A realistic sequence for a mid-market organisation starting from scratch:
Month 1 — Diagnosis and Selection
- Inventory of candidate processes using the Impact × Risk × Maturity matrix
- Assessment of your data state on candidate domains (this is often where the cold shower hits)
- Selection of three Phase 1 use cases
- Designation of RACI and internal AI governance policy
Month 2 — Pilot on One Use Case
- Activation of the first agent on a limited scope (one entity, one team)
- Training of pilot users
- Collection of error corrections, identification of false positives and negatives
Month 3 — Stabilisation and Rollout
- Parameter adjustment based on pilot feedback
- Extension to the full target scope
- Interim measurement vs. baseline
- Go/no-go on use case 1
Months 4–5 — Parallel Deployment of Use Cases 2 and 3
- Same pilot → stabilise → extend sequence
- Build on the governance framework established in Month 1
Month 6 — Review and Phase 2 Roadmap
- Formal ROI measurement across three deployed agents
- Identification of Phase 2 use cases (higher risk)
- RACI revision based on incidents encountered
Five Mistakes to Avoid at the Start
1. Launching without cleaning your data Agentic AI amplifies your data quality — in both directions. A supplier master with 30% duplicates will produce a bank reconciliation agent with an unacceptable error rate.
2. Choosing the most impressive demo use case Cash flow forecasting agents and production planning agents make great demos. But they require data quality and governance maturity that most mid-market organisations don’t have at the start. Begin with the highest Impact × Maturity score, not with what impresses the board.
3. Giving the AI agent overly broad rights “to start” What starts as “temporary” becomes permanent. Configure minimum rights from the pilot phase onwards.
4. Not defining the baseline before activation Without a before measurement, you cannot prove ROI after. And you will need it to justify Phase 2 budget.
5. Ignoring user resistance A user who doesn’t trust the AI agent will spend more time re-checking every action than they saved before. Change management is not optional.
To go further on choosing AI tools by vendor, read our comparison of SAP Joule, Microsoft Copilot, Sage Copilot and Odoo AI. For the regulatory implications of the EU AI Act on your ERP, see our article on AI Act and ERP compliance.
