Governance Guide for AI-Supported SAP Platforms

By Prof. Hernan Huwyler, MBA CPA CAIO · AI GRC Director · Academic Director, IE Law School
Published 9 November 2026 · Last reviewed 9 November 2026

In short

• SAP Business AI brings together Joule, Joule Studio, the Knowledge Graph, the AI Gateway and the Agent Hub. These capabilities can help move agent governance from written policies into platform-level controls. It is important, however, to distinguish generally available features from roadmap items.
• Approving an AI agent is an authority decision as much as a technical one. Before deployment, define which actions the agent is allowed to perform, which business data it can access and where human approval is required, especially in finance processes.
• Demonstrate that an agent is both useful and controlled through auditable evidence. Track traffic through the AI Gateway, actions performed by agents, exceptions and the frequency of human intervention.

Monday morning, a business owner asks for Joule Work to be switched on for four thousand users by the end of the month. The request cites a vendor announcement, and nobody in the room can say which parts of that announcement are live, which are in early access, and which are plans. The SAP and AI Architects have one question: who approves what an agent is allowed to do inside the finance system?

SAP told its developer conference that the SAP Business AI Platform, with Joule Work, Joule Studio, the Knowledge Graph and Business Data Cloud, is available to customers. General availability of a platform does not mean your governance is finished. It means the tooling now exists, and the decisions about ownership, autonomy limits, evidence, and cost remain yours. Some items in the same announcement, including the Enterprise AI Gateway and the AI Governance Assistant for the EU AI Act, were described as new or planned, with early adopters first.

This guide is for AI architects, Chief AI Officers, SAP enterprise architects, internal auditors, SOX control owners, and AI product owners. It separates what SAP has said is live from what is announced, explains what the announcements change for SAP as a vendor, and walks through the controls to put in place before agents act on SAP data: the tabular prediction model, the gateway, the agent inventory, the approval path for new agents, and the measures that show whether the agents help.

Passkeys vs Passwords: Controls for Cyber Security Experts and Auditors

By Prof. Hernan Huwyler, MBA CPA CAIO · Academic Director, IE Law School
Published 8 November 2026 · Last reviewed 8 November 2026

In short

• Passkeys are cryptographically bound to the legitimate website or service where they were created. They will not authenticate on look-alike phishing pages, providing phishing resistance that passwords cannot match.
• Passkeys do not eliminate every authentication risk. Account recovery, shared devices and legacy password fallbacks can remain weak points, so these paths need controls of their own.
• Prioritise controls according to their effectiveness and measure rollout success by protection coverage across high-value accounts, not simply by the total number of passkeys registered.

Picture a finance manager who types her password into a login page that looks exactly like her bank's. The attacker behind the page now holds a working credential, and she notices nothing until the transfer alert arrives. A passkey would have refused to answer that page, because the browser ties each passkey to the real domain where it was created. That single design property is why passkeys are more secure than passwords against phishing and remote attacks, and it is the reason this article exists.

The short answer for cyber security experts and risk owners is yes, with conditions. A passkey keeps a private key on the user's device and gives the website only a public key, so a breached server or a fake page has nothing worth stealing. What changes is where the attacker goes next: the phone in a thief's hand, the recovery flow, the cloud account that syncs the keys, malware on the laptop, and the old password that most accounts still keep alive. A recent TechRadar explainer by Mark Gill reaches a similar verdict. It calls passkeys an upgrade, warns against treating them as a cure-all, and names device access and platform lock-in as the main residual risks. This piece adds recovery, rogue enrollment and malware to that list and turns each gap into a control.

You can apply the nine controls below this week. They are ranked from most efficient to least, where efficient means the amount of risk removed for each hour of effort and each user you inconvenience. The first six suit any individual or small team. The last three matter most to security teams, administrators and anyone who builds a login. Each control names an owner and the evidence an auditor would ask for, so the work survives a review.

Controls to Prevent AI-Supported CEO/CFO Impersonation Frauds

By Prof. Hernan Huwyler, MBA CPA CAIO · Academic Director, IE Law School
Published 8 November 2026 · Last reviewed 8 November 2026

In short

• Voice and video are no longer reliable proof of identity. In the widely reported Hong Kong case, criminals used an AI-generated video conference to impersonate colleagues and induce a transfer of approximately US$25.6 million.
• Effective protection depends on verification steps that cannot be bypassed through a convincing conversation. Require payment authorisation through an independent channel, callbacks to previously verified numbers and additional approval for new beneficiaries or unusual transfers.
• Make these safeguards part of tested operational controls, not just written policies. Run realistic impersonation exercises and measure whether employees consistently follow verification and approval procedures before releasing funds.

A finance employee at the Hong Kong office of a London-based engineering firm received a message from someone posing as the group CFO. The message mentioned a confidential transaction, and the employee suspected phishing. Then he joined a video call, saw the CFO and several colleagues on screen, and heard voices he knew. The doubt faded, and he sent 15 transfers worth HK$200 million, about $25.6 million, to five accounts. Hong Kong police said everyone else on that call was a digital fake, as CNN reported.

Looking harder would not have saved him. People flag well-made fake video poorly even when they are told to hunt for fakes, so a defense built on spotting the fake fails at the moment the fake is good. The controls that work keep the payment safe when the voice, the face and the paperwork are all perfect. At the top of the ranking sit a callback to a number you already hold, approval only inside the system of record, two approvers reached on separate channels, and a cooling period for new payees. This article ranks twelve controls from most to least effective and explains how AI builds the fake documents and fake video meetings those controls have to withstand. It is written for controllers, treasury leads, accounts payable managers and the CFOs whose faces get borrowed.

The Hong Kong case was not a one-off. In November 2026, US prosecutors announced an indictment of three people accused of stealing about $129 million from companies between July 2024 and February 2026, using CEO emails, AI-generated executive voices and impostor attorneys, as AP reported through PBS NewsHour. The charges are allegations, and the defendants are presumed innocent. The FBI's Internet Crime Complaint Center counted $3.05 billion in business email compromise losses for 2025, and for the first time it broke out complaints that referenced AI: 22,364 of them, with about $893 million in reported losses across all fraud types, according to coverage of the report.

Turning Fragmented Operational Risks into Decisive Business Action

By Prof. Hernan Huwyler, MBA CPA CAIO · Academic Director, IE Law School
Published 4 November 2026 · Last reviewed 4 November 2026

In short

• Operational risk is often assessed separately by departments using different methods, metrics and assumptions. This creates fragmented views that can hide how risks accumulate or interact across the organisation.
• A shared financial loss taxonomy provides a common language for comparing cyber, operational, safety and other risk exposures. It helps leadership understand potential losses across the business and prioritise them at portfolio level.
• Aggregation should not erase specialist knowledge. Preserve the assumptions behind each domain's assessments and make cross-domain dependencies and cascading loss scenarios visible when translating risk information into business decisions.

 

The transition from domain specific risk management to true enterprise risk quantification marks a fundamental shift in how organizations evaluate uncertainty and protect corporate value. Historically, departments have operated within isolated silos. Cybersecurity teams calculate system vulnerabilities, operational units log equipment failures, health and safety groups track physical workplace incidents, and corporate finance tracks liquidity and credit exposures. When presented to executive leadership or the board, these disparate operational domains are often aggregated into chaotic, color-coded heat maps that obscure real financial exposure.

Operational risk quantification solves this fragmentation by establishing a common currency across every corner of the business. By grounding risk analysis in a unified financial loss spectrum and consistent scenario modeling, risk leaders move away from abstract rating systems and deliver concrete decision support that protects corporate balance sheets.

 

Moving Beyond the Qualitative vs. Quantitative Risk Debate

By Prof. Hernan Huwyler, MBA CPA CAIO · Academic Director, IE Law School
Published 4 November 2026 · Last reviewed 8 November 2026

In short

• The debate between qualitative and quantitative risk assessment misses a fundamental challenge: autonomous systems make probabilistic decisions at runtime. Static heat maps alone cannot capture how their behaviour and risks change in operation.
• Risk reporting should support real decisions. Measure the business impact of verified failure modes and demonstrate whether technical safeguards, human oversight and runtime controls effectively limit those risks.

Organizations establish risk committees, draft policies, and populate registers with qualitative heat maps, yet these measures frequently create a false sense of security. When systems operate autonomously and make probabilistic decisions, static compliance frameworks break down. Moving past this paper-pushing illusion requires a fundamental shift in how teams measure exposure, evaluate runtime controls, and govern agentic behavior across production environments.

Governance must become an operating system for everyday decisions rather than a graveyard of static documents. International frameworks like the NIST AI Risk Management Framework frame governance as a continuous, cross-cutting function that embeds risk management across the entire technology lifecycle. That means pulling policies, accountability structures, third-party integrations, technical design, and corporate culture into a unified operational pattern. The EU AI Act takes a similar stance by treating high-risk systems as an ongoing lifecycle obligation. Risk management, data governance, continuous logging, technical transparency, human oversight, system robustness, cybersecurity, and post-market monitoring are living operations, not one-time compliance artifacts to file away before an audit.

 

Oversight in AI Systems From Governance Illusion to Operational Control

By Prof. Hernan Huwyler, MBA CPA CAIO · Academic Director, IE Law School
Published 8 November 2026 · Last reviewed 8 November 2026

In short

• A policy, a committee, or a risk register entry is not evidence that an AI model is safe to approve. Evidence is a dated record that a quantified assessment was done, that a named executive accepted a stated loss tolerance, and that the model was tested against acceptance criteria set before the test.
• Acceptance criteria come from the loss the organization can absorb, not from a vendor benchmark. In the worked example below, a tolerance of 5 percent probability of exceeding 1.5 million in annual fraud loss translates into a minimum recall of about 0.79, so the approval threshold is set at 0.80 and tested with a confidence interval.
• Test the controls the criteria rely on. Measure reviewer catch rates in drills, red-team the agent permissions, and rerun the quantification when drift, a new tool, or a new model version changes the assumptions.

 

An approval board reviews a payment fraud screening model on a Tuesday afternoon. The vendor slide reports 94 percent accuracy, the project team is pleased, and the chair asks who decided that 94 percent was enough. Nobody answers, because the figure came from the vendor's test set and the bar was set after the result was known. The board approves the model anyway, and the minutes record that it met expectations.

AI governance needs evidence of that decision, and evidence has a specific form. It starts with a quantified assessment of what the model could cost if it fails: how often, how much, and how likely a bad year is. An accountable executive then states a tolerance, such as the largest annual loss they accept at a stated probability. Acceptance criteria are derived from that tolerance before anyone tests the model, and the test results, the approval, and the later monitoring are stored in records a reviewer could rerun. Without that chain, a governance program produces documents that describe intent and nothing that proves control.

This guide is for Chief AI Officers, risk and compliance leaders, internal auditors, model owners, and anyone who signs an approval. It explains what counts as evidence, what a quantified AI risk assessment contains, and how to turn a loss tolerance into numerical acceptance criteria for predictive and agentic systems. It then covers testing against those criteria, measuring human oversight as a control, how the EU AI Act and the main standards point the same way, and the evidence register that ties it together.