AI integration with your ERP, SAP Business One included: what to connect first

AI integration with your ERP, SAP Business One included, means letting an AI assistant such as Claude read your business data and prepare changes to it under your control. The ERP (enterprise resource planning system) is the software that holds your stock, orders, suppliers, customers and ledger. The assistant sits beside it, answers questions in plain language and drafts work that a person then approves.

SAP Business One is a common case. ChatFin describes it as the ERP of choice for tens of thousands of mid-market companies, built for businesses that have outgrown entry-level accounting software but do not need the complexity of SAP S/4HANA. That is the kind of business this guide has in mind.

One principle runs through everything below. The ERP stays the system of record. The assistant reads and proposes, and the ERP, with a person approving, decides what is true.

That principle shapes the practical choices. It tells you which data to expose first, which route to use, how to handle purchase orders and where to put the controls. The rest of the guide takes those choices in order, starting with the vocabulary you will meet when you talk to a developer or read vendor pages.

Integration projects go wrong when the buyer and the builder use the same words for different things. These are the terms this guide uses, defined once.

• System of record: the one system whose data counts when two systems disagree. Here, that is your ERP.
• API (application programming interface): a documented way for one piece of software to read or change data in another.
• Service Layer: SAP Business One's standard REST API for system integration. REST is the common web style of API, where each request asks for or changes one resource.
• DI API: the other official SAP Business One API. UpBuff names the Service Layer and DI API together as the official routes in.
• MCP (Model Context Protocol): an open-source standard for connecting AI assistants to tools. Anthropic's documentation says Claude Code can connect to hundreds of external tools and data sources through it.
• MCP server: a small service that exposes ERP data and operations, such as querying items, reading customer balances or listing open orders, as tools the assistant can call.
• Plugin: in Claude, a package that bundles skills, connectors and sub-agents. Plugins are available on all paid plans: Pro, Max, Team and Enterprise.
• Claude Cowork: brings the agent capabilities of Claude Code to knowledge work beyond programming, so it can carry out multi-step tasks on your behalf.

With these in place, the design questions become concrete. What can the assistant see, what can it change, and who signs off?

Whatever route you choose, a safe ERP integration has three parts. Leave one out and you either get a toy or a risk.

A read model

A read model is a deliberately limited view of ERP data that the assistant may query: named objects, named fields, named companies. It is not the whole database. UpBuff's advice is blunt: never give AI direct database access, and send everything through the Service Layer or DI API so SAP Business One stays the untouched system of record.

An approval step

Any change the assistant proposes should arrive as a draft that a named person approves. Claude Cowork has three approval modes: Manual, Auto and Skip. In Auto, Claude keeps working without asking at each step, checks every action for risks such as data exfiltration or prompt injection, and blocks what it judges unsafe. That checking uses more of your usage limit than the other modes. In Skip, nothing checks its actions at all. For anything that writes to your ERP, Manual is the sensible default.

An audit trail

An MCP server acts with the credentials it is given. UpBuff recommends scoping those credentials tightly, read-only where possible, and logging every call. If you build a custom integration instead, you also own error handling, permissions, logging and the upkeep as models and APIs change. The log is what lets your finance team answer who changed what, and why, a month later.

UpBuff describes three ways to connect AI to SAP Business One: a custom integration between a language model and the Service Layer, an assistant such as Claude connected through an MCP server, or a purpose-built add-on. All three use the official APIs, so the ERP core is not modified. The table sets out when each fits.

If you take the MCP route, the transport matters. Anthropic recommends HTTP servers for remote MCP servers, calls the older SSE transport deprecated, and notes that HTTP supports OAuth sign-in while WebSocket does not. A stdio server runs as a local process on one person's machine, which suits a single user testing, not a team.

Before building anything, check what the ERP gives you. ChatFin notes that SAP has added some AI-assisted capabilities to SAP Business One, but describes them as embedded features that assist people rather than autonomous agents. UpBuff likewise says the built-in intelligence is limited and most of what businesses want comes from add-ons.

Document Information Extraction

The most concrete native option is supplier document reading. According to SAP's own community post, Feature Pack 2102 introduced the first integration with the Document Information Extraction service. The Electronic Documents Service watches a folder, sends documents to the service, and the user can then create an AP invoice draft pre-filled with the extracted data.

The integration is part of the SAP Business One licence, but the extraction service is not. It is bought separately on SAP Store in monthly blocks of 100 documents, where one document equals three pages. SAP Note 3021904 describes the detail.

Joule

Joule is SAP's AI assistant. SAP says customers with existing SAP cloud subscriptions can activate Joule base for free. OptiProERP describes deeper Joule integration into SAP Business One as part of SAP's roadmap, so treat it as something to watch rather than plan around today.

The decision is simple. If your main need is reading supplier invoices, price the native service first. If you want to ask questions across the ERP and draft documents, an assistant route is the better fit.

The safest order is reference data first, live documents second, drafts third and posting last. Each stage gives you evidence that the one before it works. The table is the checklist.

Design each tool to return a small, filtered answer. "Open purchase orders for one supplier" is a good tool; "all purchase orders" is not. Claude Code shows a warning when an MCP tool's output exceeds 10,000 tokens and caps it at 25,000 tokens by default, so a tool that dumps whole tables will be cut off or will crowd out the actual question.

The same order works whatever the ERP. If your stock sits in Zoho Inventory rather than SAP Business One, the stages and the draft-first rule are identical.

A buyer asks Claude: "Which items are below reorder level at the main warehouse? Draft a purchase order to the usual supplier for them." Here is how that request travels, step by step.

Step 1: the server and its credentials

An MCP server sits in front of the Service Layer and is reached over HTTP. It signs in as a dedicated service user that can read items, business partners and purchase orders, and can create purchase order drafts. It cannot post, delete or touch the ledger.

Step 2: Claude reads

Claude calls a tool that lists items below reorder level for the named warehouse. It then calls a second tool for each item's preferred supplier and last purchase price. Both answers are short and filtered.

Step 3: validation before anything is written

UpBuff warns that language models confidently produce plausible but wrong item codes, quantities and prices. So the server checks every line against master data before it accepts a draft: the item code exists, the supplier is active, the price matches the price list. Anything that fails comes back to Claude as an error, not as a guess.

Step 4: approval and the draft

In Cowork's Manual mode, Claude shows the proposed draft and waits. The buyer checks the lines and approves. The draft appears in SAP Business One, where the buyer opens it and adds it as a real purchase order.

Step 5: the log

The server records who asked, which tools ran, what was validated and which draft was created. That record, not the chat, is your audit trail.

The inbound side follows the same pattern. SAP has demonstrated an Intelligent RPA bot sending a customer's purchase order to Document Information Extraction and creating the matching sales order through the Service Layer.

Most failures are not about the model. They come from access, networking and expectations.

• Wrong values that look right. Without validation against master data, a plausible item code or price reaches a document. Put the check in the server, not in the prompt.
• Credentials that are too broad. The server acts with whatever rights it holds. An administrator login turns a drafting assistant into something that can change anything.
• Prompt injection. Anthropic warns that MCP servers fetching external content can expose you to prompt injection, where instructions hidden in that content steer the assistant. A tool that reads supplier emails or PDFs is exactly that kind of server.
• Networking. In Cowork, connectors reach external services through Anthropic's cloud, not your local network, so a custom connector must point at a server reachable over the public internet. Plugins containing local MCP servers only work through the desktop app, and those local servers run with the same permissions as any other program on the machine.
• Slow or dropped calls. A tool call still running after two minutes moves to a background task. Claude Code reconnects a dropped remote server with up to five attempts, but does not reconnect stdio servers automatically.
• Treating MCP as a process. UpBuff points out that MCP alone does not give you a monitored business process such as touchless order intake. That needs orchestration, queues and exception routing.

At Svennis, when we connect Claude to a business system we have built, we ship read-only tools first and add one write action that lands as a draft for a named person to approve; the integrations we see go wrong are usually those where a write tool arrived before anyone had checked the data it reads.

Three practical points apply to a UK company running SAP Business One or a similar ERP.

First, location. If your ERP server sits in your own office or a private hosting environment, a Cowork connector cannot reach it unless you deliberately publish an MCP server to the internet with proper sign-in. Decide that architecture before you pick tools, and involve whoever runs your network.

Second, personal data. An ERP holds customer contacts, supplier contacts and often staff details, so your read model is also a data protection decision. Anthropic states that deleted Cowork tasks are removed from its backend storage within 30 days, and that cloud tasks run on its servers in an isolated environment, currently in beta. SAP states that Joule processing follows GDPR and that customer data stays within the customer's own SAP tenancy. Check how the rules apply to you in our guide to AI law in the UK for businesses.

Third, where the value is. For manufacturers, purchasing and stock questions are the natural first step. For finance teams, ChatFin reports that manual month-end reconciliation on SAP Business One still takes 5 to 7 days, which is why accountants often start with read-only reporting questions rather than postings.

You can start without committing to a build. Work through these in order.

1. List three questions your team asks of the ERP every week, such as stock below reorder level or open orders for one customer.
2. Map each question to objects and fields. Mark each one read-only or draft, using the staged table above.
3. Check the native options. If supplier invoices are the pain, price SAP's Document Information Extraction before anything custom.
4. Pick a route from the comparison table: MCP server for conversational work, a custom integration for one fixed process, a platform for unattended processes.
5. Create a dedicated service user with read-only rights and switch on logging of every call.
6. Run read-only for a few weeks, then add a single draft action with Manual approval.

If you want to see how this fits alongside other automation, read about AI automation for growing businesses, which covers where assistants and automated processes each belong. You can also browse AI by business task to find the ERP job closest to yours, or read why AI works best inside the systems you already use.