Modulos vs SAP AI Agent Hub: AI Governance (2026)

Modulos is a dedicated AI governance platform. Customers buy it separately and use it across whichever stack the organisation runs. Each AI system holds its frameworks, controls, evidence, risks and owners, with a history of every change to them. Pricing is bespoke, from about 50,000 USD to several hundred thousand USD per year depending on portfolio size and framework scope. For an SAP customer that is a separate budget line, and it buys the regulatory depth, risk quantification and conformity testing described below.

SAP announced AI Agent Hub at Sapphire on 13 May 2026 as the governance tier of the SAP Business AI Platform, built on SAP LeanIX. It described the hub as a single command center “to discover, manage, and govern all AI agents”, SAP and non-SAP. SAP said the hub would be generally available in the third quarter, included in the platform at no additional charge. An earlier version had launched in SAP LeanIX in November 2025. For an enterprise that already licenses the Business AI Platform, governance at no extra charge is a strong economic argument. SAP’s own news site names agent sprawl as the reason AI governance is now a board-level issue.

The Modulos edge: The Modulos fee buys a conformity programme across 26 frameworks with risk in money, and it applies the same way to AI built inside or outside SAP.

The Modulos AI agent, Scout, discovers AI systems on request in the platforms a customer connects. It lists Azure AI Foundry agents and Azure OpenAI deployments and inventories Microsoft Copilot Studio agents across the tenant. It also reads OpenAI Platform and Claude Console usage, which reveals who calls models through API keys. Scout has read-only access and proposes each find as a Draft for a person to confirm. Registration then follows a fixed path. Submission triggers a completeness check and an initial risk assessment, after which a Registration Manager approves or rejects the system with a recorded reason. Inventories kept in another tool can come in from CSV.

According to its product page, SAP AI Agent Hub automatically discovers assets from SAP, Microsoft, Google, AWS, Databricks and ServiceNow. It organises agents, LLMs and MCP servers into a searchable registry with classification, status and fact sheets. Because the hub sits on SAP LeanIX, each agent can be placed in the architecture and process model that enterprise architects already maintain. SAP SuccessFactors data shows which business units and roles an agent affects. Adoption is gated through architecture decision workflows.

The Modulos edge: Each approved AI system in Modulos has passed a human review with a first risk assessment, and its record then carries the conformity evidence for every framework in scope.

Modulos framework library 1.1.0 maps 26 frameworks, with the full EU set at its centre: the AI Act, the CRA, NIS2, DORA and GDPR. EN 18286, the quality management system standard, is the AI Act’s first harmonised standard. Its reference appeared in the Official Journal on 14 October 2026, so a provider applying it is presumed to meet Article 17(1) and the first sentence of Article 11(1). Modulos also maps prEN 18228 and prEN 18282 as drafts, next to ISO/IEC 42001, ISO/IEC 27001, ISO/IEC 27701, NIST AI RMF, US state rules and frameworks for Singapore, the UAE and Saudi Arabia. Of the 929 controls, 453 serve more than one framework.

SAP lists compliance mapping for AI regulation among the hub’s functions, and SAP LeanIX has offered risk assessments based on the EU AI Act since 2024. However, we found no published framework catalogue for the hub, no harmonised standard and no mapping for the CRA, NIS2 or DORA.

The Modulos edge: EN 18286, DORA, NIS2 and the CRA share one control set with the AI Act in Modulos, so evidence for a shared control counts for all of them at once.

For each AI risk, the Fermi Risk Agent produces an annual loss estimate in EUR, GBP or USD. Because it runs inside scheduled jobs, its figures follow the controls and evidence they depend on. A portfolio view drills from the organisation down to one threat vector and colours each level by the share of its Risk Limit already used. The AI System Graph traces threat to risk to AI system in money. Values are kept over time, so a risk committee can see whether exposure is rising or falling.

SAP AI Agent Hub records an AI risk rating for each agent, LLM or MCP server and supports structured assessments of any asset in the registry. At Sapphire, SAP CTO Philipp Herzig said that once customers identify the right agents, they “can control their risk and define architectural decisions or compliance rules”. That suits an architecture board, but we found no published monetary method behind the rating as of 16 October 2026.

The Modulos edge: Your CFO can weigh the annual loss Modulos estimates for each AI risk against your Risk Limits and against the cost of the control that reduces it.

Agent Tests let a compliance team write a check in plain English and run it on a daily, weekly, monthly or quarterly schedule. An agent with read-only tools examines the connected systems and reaches a cited verdict of pass, fail or error, and every run is stored immutably. A fail reverts the mapped controls to not executed and tells their owners, while an error leaves them as they were. Modulos has no runtime gateway and reads runtime evidence such as Vijil guardrail data. It holds CertX ISO/IEC 42001 product conformity certificate 213-001/24 and a SOC 2 Type 2 report. References include PwC, Armasuisse and A-ZN, Slovenia’s insurance supervisor.

SAP’s product page describes evaluations and structured assessments of any agent, LLM or MCP server. It adds observability for session health, goal completion and tool-call correctness, plus agent mining that shows how an agent executes its defined steps. At runtime, only verified MCP servers can be called in production workflows, and access is revoked when verification status changes. SAP says it received ISO 42001 certification for AI governance in the third quarter of 2025, covering AI systems such as Joule and SAP AI Core. The hub was due for general availability in the third quarter of 2026, so confirm which functions are live in your tenant.

The Modulos edge: Scheduled Agent Tests reopen a control as soon as a check fails, and the Modulos ISO/IEC 42001 certificate applies to the governance platform itself.