For most of the last decade, “clean core” was an upgrade conversation. Keep the standard standard, push customizations side-by-side onto SAP BTP, and your next S/4HANA upgrade stops being a six-month ordeal. That was the pitch, and it was a good one.
In 2026, the conversation changed underneath us.
At SAP Sapphire this year, SAP stopped talking about AI agents as a roadmap item and started shipping them — 200+ specialized Joule agents, an Autonomous Suite that lets them execute real work, and Joule Work as the surface where a user simply states an outcome and lets the system assemble the steps. SAP’s Chief Technology Officer, Philip Herzig, summed up the dependency in one sentence: “No AI agent can compensate for a broken data model.”
He’s right. But there’s a second half to that statement that deserves equal attention, and it’s the half most SAP customers are missing: no agent can act on a process it cannot see. And in a typical SAP landscape, the thing hiding your processes from AI isn’t your data. It’s your custom code.
Clean core stopped being optional in 2026
The agentic shift is neither subtle nor slow. Gartner expects 40% of enterprise applications to include task-specific AI agents by the end of 2026, up from less than 5% a year earlier. SAP is pushing hard to stay ahead of that curve, embedding Joule agents across S/4HANA, Ariba, SuccessFactors, and the rest of the suite.
But capability isn’t the bottleneck. Readiness is.
The numbers on readiness are sobering. According to the DSAG Investment Survey 2026, only 3% of SAP customers run Business AI in production today, while 77% of AI-active enterprises are using non-SAP tools to do it. Gartner separately predicts that 40% of agentic AI projects will be canceled by the end of 2027 — not because the technology fails, but because of cost, unclear value, and inadequate readiness.
Read those two findings together and the strategic picture is clear. The agents are here. Most enterprises can’t use them yet. And the gap between the two is almost entirely a question of how clean — and how visible — your core is.
How Joule agents actually work (and why that matters for your Z-code)
To understand why custom code is the blocker, you have to understand how an agent does its job, because it works nothing like a report or a workflow.
A Joule agent is given an objective — resolve this disputed invoice, onboard this supplier, release production orders when material is available — and it plans and executes the steps itself. To do that, it leans on three things:
- The SAP Knowledge Graph and Domain Models, which tell the agent what a business object is and how it relates to others — that an invoice should match a goods receipt and a purchase order before it can be paid, for example.
- Released, standard APIs, which are how the agent actually reads data, writes data, and triggers actions.
- The standard authorization model, which governs what the agent is allowed to do, exactly as it governs a human user.
Notice what all three have in common: they are built on the standard. The agent reasons over standard objects, acts through standard APIs, and is governed by standard authorizations. Anything that lives outside that standard surface is, from the agent’s point of view, invisible and unreachable.
That is the entire problem in a single sentence.
The custom-code blind spot
Most of the “clean core for AI” commentary you’ll read focuses on data: clean your master data, govern it, deduplicate it. That advice is correct, and you should follow it. But it’s only half the story, and it quietly skips the half that’s hardest to see.
Industry studies have long suggested that around 91% of SAP customers run custom ABAP, and that nearly half of mission-critical processes depend on it. That custom code is exactly where agent-readiness goes to die. Here’s how it happens.
Custom tables the Knowledge Graph has never heard of. When critical data lives in Z-tables instead of standard business objects, the Knowledge Graph can’t map it. The agent reasons over a model of your business that has holes in it — precisely where your most customized, and often most important, processes live.
Business rules buried in user exits, BAdIs, and enhancements. An agent can call a standard API to post a document or release an order. But if the real logic governing that action — the pricing exception, the credit check, the approval rule — sits in an enhancement that bypasses the standard object, the agent will execute the standard path and produce an outcome that’s wrong, incomplete, or non-compliant. It did exactly what it was told. It just couldn’t see the rule that actually mattered.
Custom transactions that shadow the standard process. Many organizations have a Z-transaction that has quietly become the “real” way a process runs, while the standard transaction sits unused. An agent will operate on the standard, official process. Your business runs on the shadow one. The two never meet.
Modifications that block the updates carrying the agents. S/4HANA Cloud ships new agents and skills on a quarterly cadence. Core modifications turn every one of those updates into a re-testing project. The most heavily customized enterprises don’t just struggle to use agents — they struggle to even receive them.
Authorization sprawl from years of custom roles. Agents inherit the authorization model you already have. If that model is a tangle of over-provisioned custom roles, your agents will be too — which means either ungoverned access you can’t audit, or blocked actions that make the agent useless.
None of these are data problems. Every one of them is a code problem. And none of them show up in a master-data assessment.
From clean core to agent-ready core
This is why it helps to draw a sharper line than the industry currently does. A core can be in one of three states, and most transformation programs only aim for the middle one.
Dirty core. Years of invasive customization glued to standard objects. Upgrades are expensive and risky. Agents are essentially a non-starter.
Clean core. Customizations moved side-by-side onto SAP BTP; the standard kept standard. Upgrades are smooth. This is where good transformation programs aim — and it is necessary, but it is not sufficient for AI.
Agent-ready core. A clean core that has also been validated through an AI-readiness lens — where every business-critical process is visible to the Knowledge Graph, reachable through released APIs, and governed by clean authorizations.
The difference between the second state and the third is the difference between “we can upgrade easily” and “we can deploy agents.” To get from one to the other, assess your core against five questions:
- Visibility — Is every business-critical process represented in standard objects the Knowledge Graph can actually see, or is it hiding in custom structures?
- Reachability — Can an agent execute each critical action through a released, standard API, or is it locked behind custom code?
- Governance — Are authorizations clean enough to grant agents scoped, auditable, least-privilege access?
- Data integrity — Is master data governed and trustworthy enough for an agent to act on without supervision? (Yes — the data dimension still matters. It just isn’t the only dimension.)
- Currency — Are you current enough on releases to receive new agents and skills as they ship?
Clear those five and you don’t just have a system that’s easy to upgrade. You have a system that’s ready to put agents to work.
You can’t assess this by hand
Here’s the practical wall most teams hit. The five questions above are easy to ask and very hard to answer at scale. A mature SAP landscape can carry thousands of custom objects — reports, function modules, enhancements, interfaces, Z-transactions — accumulated over fifteen or twenty years, frequently undocumented, frequently built by people who left long ago. Answering “is this object agent-ready?” for each one by hand, in workshops and spreadsheets, is the kind of project that takes months and is out of date by the time it’s finished.
This is the problem CoreAssess.AI was built to solve, which is why the AI-readiness lens fits it so naturally. Instead of manual review, it uses trained LLMs and deep SAP expertise to analyze every custom object and classify it: keep it (already clean and reachable), refactor it side-by-side, or retire it. More to the point for agent-readiness, its newer ABAP-to-RAP/CAPM conversion can take logic that’s currently trapped in the core and move it into modern, standard, API-exposed structures on SAP BTP — which is precisely the step that turns an invisible custom process into one an agent can see and act on.
In other words: the same assessment that makes your core clean is the assessment that makes it agent-ready. The lens is simply pointed at a more valuable target.
Your 90-day agent-ready action plan
You don’t need to clean everything before you can deploy anything. Agent-readiness is per-process, which means you can sequence it. Here’s a pragmatic first quarter.
- Inventory and classify your custom code against the agent-readiness lens — visible and reachable, fixable, or retire. Get the full picture before you make a single decision.
- Pick your first two or three target agents, not your whole landscape. Start where SAP already ships strong agents and the ROI is obvious — finance close, procure-to-pay, dispute resolution, supplier onboarding.
- Find the shadow logic behind those specific processes — the Z-tables, the exits, the custom transactions an agent would trip over.
- Decide, retire, refactor side-by-side, or keep for each object in scope, and remediate only what those first agents actually need.
- Stand up governance so the core doesn’t drift back. Clean core is not a one-time cleanup; it’s a discipline. Every new requirement should be evaluated against the standard before anyone writes custom code.
Boil the ocean later. Make your highest-value processes agent-ready first.
The bottom line
Clean core was never really about tidiness. It was about keeping your options open — and in 2026, the most valuable option on the table is AI that does the work, not just AI that talks about it.
For three years, the case for clean core was largely defensive: get off ECC before mainstream maintenance ends in 2027. Agentic AI changes the calculation entirely. The reason to standardize is no longer just to avoid a deadline — it’s to unlock capability your competitors are already deploying. Enterprises with an agent-ready core activate new Joule agents on day one of each release and compound that advantage quarter after quarter. At Sapphire 2026, Levi described running more than 1,000 agents across its business — the kind of scale only a standardized, well-governed foundation makes possible. Companies still wrestling with custom code don’t get a smaller version of that future; they get to watch it happen to someone else.
The encouraging part is that the path is concrete, and you already know the first step — because it’s the same step that has always defined a clean core. See your custom code clearly. The only difference now is that the question you ask of each object is sharper: not just can we upgrade around this? but could an agent actually see and act on this? Answer that honestly, object by object, and the move from clean core to agent-ready core becomes a sequence of deliberate decisions rather than a leap of faith.
The agents are ready. The only real question left is whether your core is.
