The real value of enterprise AI in operations rarely sits in the model itself — it sits in the data locked inside the ERP system: orders, invoices, stock, master data, postings. A private ChatGPT account does not know that data, and for data-protection reasons must not. The question is therefore not "can ChatGPT write text?" but "how does an AI get controlled, GDPR-compliant access to the right ERP data — and only to that?"
That is what integrating AI into ERP systems such as SAP, Microsoft Dynamics or Odoo is about. This article shows the realistic integration patterns and their trade-offs, what GDPR and permissions mean for sensitive ERP data, three concrete workflows with example prompt and output, and a readiness check for the introduction. ERP vendors are not competitors here — they are integration targets.
Short definition: "connecting AI to the ERP" means connecting an enterprise AI platform to permitted ERP data through a connector, read-only database access or a bounded export — so employees get answers backed by sources from their own system, without ERP data ending up in uncontrolled private accounts. Access follows the least-privilege principle and is logged.
ERP data is the backbone of the company and frequently personal (customer data, supplier data, sometimes payroll). Copy it into a private chatbot and you lose control over processing, storage and possible model training. This is the classic shadow-AI case: employees solve a real problem and create a data-protection risk doing it.
The clean route reverses the direction: the data does not travel to the AI — the AI is connected, under control, to defined slices of the data, in an environment for which the company can contractually assure data protection. That is exactly what an enterprise AI platform with central permission management, EU operation and logging provides.
There is no single way to connect AI to an ERP — there are four patterns with different effort and risk profiles. The rule of thumb: pick the fastest stable path with a clear effect, not the most technically elaborate one.
| Pattern | What happens | Good for | Trade-off |
|---|
| 1. Read-only API / connector | The AI retrieves permitted ERP objects in real time through an interface | Status questions, order/invoice queries | Requires an available, released interface |
| 2. RAG over an ERP export | A bounded export (report, CSV, documents) is indexed and made semantically searchable | Large, fairly static data; look-ups | Not real-time — as current as the last export |
| 3. Read-only SQL access | Direct read access to an existing database with schema exploration and queries | Fast analysis, operational reporting | Needs controlled, strictly read-only DB access |
| 4. Custom tool / MCP server | A server encapsulates precisely defined read/write actions | Deep operational processes including writing | Highest effort; write operations need approval |
How to decide in practice: if a native integration exists, use the native connector first. If none exists but the data is structured, take the export/data-pool route (RAG). If deep operational access with reading and writing is needed, use a custom tool or custom MCP server. For on-premise systems with high security requirements, IP allowlisting, a dedicated connection network or a VPN complete the picture.
For SAP and other large ERP systems specifically: start with bounded export slices or read-only access and build the integration out in stages. That delivers benefit quickly, keeps risk small, and avoids a risky full access nobody can oversee any more. Whether a particular ERP component can be connected directly depends on your system landscape and the interfaces released.
ERP data is sensitive and often personal — which makes the connection data-protection relevant. The following points are the foundation of an auditable introduction, not optional extras:
- EU operation & DPA: processing runs in the EU (for meinGPT: hosting at Hetzner, Germany), a data processing agreement is standard, and inputs are not used for model training.
- Least-privilege scopes: the AI gets access only to exactly the released objects — order header data only, or invoice status only, not the entire ERP. Each person sees only what they are authorised for.
- Logging: who accessed what and when is traceable through audit logs and can be evidenced to data protection officers, works councils and auditors.
- Pseudonymising sensitive fields: particularly protected fields can be masked or pseudonymised before they are processed at all.
- Human-in-the-loop for write operations: postings and other audit-relevant changes stay in human hands — the AI proposes, a person posts after review.
- Independent evidence: operator SelectCode GmbH is certified to ISO 27001:2022 and has its security examined regularly by independent penetration tests (most recently SySS, 2025); policies and evidence are available through the Trust Center.
Quotable: a GDPR-compliant AI-ERP connection needs five things — EU operation with a DPA, no training on inputs, least-privilege access to only the released ERP objects, logging of every access, and a human approval for write operations.
Instead of clicking through transaction screens, the specialist asks in natural language — the AI reads the released order and invoice objects and answers with source references.
Example prompt:
"Which open orders from customer Müller GmbH have a promised delivery date in the next 14 days? Output order number, line value and status as a table."
Example output:
| Order | Line value | Promised date | Status |
|---|
| AU-10432 | €18,400 | 2026-07-09 | in production |
| AU-10457 | €6,250 | 2026-07-12 | goods receipt pending |
| AU-10461 | €2,980 | 2026-07-15 | picked |
Basis: 3 open orders (source: ERP order data, as of the query). For binding dates, please check production status.
A monthly ERP report (revenue, contribution margin, returns) is indexed as a bounded export. The AI produces a narrative summary for management — faster than a hand-written management summary.
Example prompt:
"Summarise the June sales report in five sentences for management: the biggest movement versus May, notable regions, a recommended action. Name the underlying figures."
Example output:
"June revenue was €1.42m (+6.8 % versus May). Growth was carried above all by the South region (+14 %), while North declined slightly (−3 %). The return rate fell from 4.1 % to 3.4 %. Notable is the contribution margin of product group C, which fell 2 points despite the revenue increase — worth a price and terms review. Recommendation: sharpen the terms for group C in July."
Note: values come from the indexed June export; the figures are as current as the last export.
Through read-only SQL access, the AI answers questions about master data and surfaces quality problems — as preparatory work for the data maintenance a person completes.
Example prompt:
"Find possible duplicates in the supplier master: identical VAT ID or very similar company names at the same address. Output the suspect pairs with supplier number."
Example output:
| Suspicion | Supplier A | Supplier B | Criterion |
|---|
| Duplicate | L-2091 · Meier Technik GmbH | L-3388 · Meier-Technik GmbH | identical VAT ID |
| Check | L-1120 · Nord Logistik | L-2740 · Nord-Logistik KG | same address, similar name |
Result: 1 certain duplicate, 1 case to check. Please approve the merge professionally before changing anything in the ERP.
- RAG is not real-time: an indexed export is only as fresh as the last export. For same-day stock or payment status you need live access (connector/SQL).
- Data quality shows through: if master data is messy, the answers are messy. The AI surfaces problems but does not replace data maintenance.
- No full access as a default: blanket access to "the whole ERP" is neither necessary nor advisable — it only enlarges the attack surface.
- Write operations stay human: postings and audit-relevant changes belong behind an approval; the AI prepares but does not carry the responsibility.
- What can actually be connected depends on the landscape: whether a particular SAP component or accounting interface is directly usable depends on your system landscape and has to be settled with IT and your accountants.
Which systems can be connected today through native connectors, databases and MCP is shown in the meinGPT integrations overview. How to evaluate and introduce an AI platform GDPR-compliantly overall — from selection criteria to adoption — is covered in AI for companies.
The pragmatic entry point stays the same: choose a bounded ERP slice, start read-only, evidence the benefit on a real workflow — and only then deepen the integration.
