SAP mainstream maintenance for ECC ends December 31, 2027. Moving to S/4HANA protects your ERP investment, but only if the business processes around SAP keep running. Control-M is the enterprise orchestration layer that coordinates SAP and non-SAP workflows so execution stays reliable through the change.

The countdown is real. For the estimated 17,000 organizations still running ECC, that deadline is no longer a distant milestone. It’s a planning problem that needs an answer now.

The move to S/4HANA is more than just a technical upgrade. It’s a shift from stable, system-centric operations to dynamic, interconnected processes that span cloud services, data platforms, and external partners. Your SAP investment only delivers value when everything around SAP works, and that’s specifically where migration risk hides.

Why does S/4HANA migration increase execution risk?

Most transformations involve a dual-run period, where ECC and S/4HANA operate in parallel while teams work toward cutover. During that window, a single financial close or order-to-cash cycle can span SAP, data platforms, cloud services, and non-SAP applications, each with its own dependencies and timing.

When those workflows are managed in siloed tools, three problems surface fast:

• Cross-system dependencies break down. Processes that depend on coordinated handoffs between SAP and connected systems fail in ways that aren’t obvious until they hit business outcomes.
• Visibility fragments. Teams lose a unified view of what’s running, what’s blocked, and what’s at risk.
• Recovery becomes manual. Disconnected tools mean more effort and more chances for late or failed processes.

The work that looks stable inside SAP can still collapse across the systems SAP depends on.

How Control-M protects your SAP investment

SAP runs your core business processes. But when those processes span systems, coordination breaks down. Control-M is the enterprise orchestration layer that ensures reliable, end-to-end execution across SAP and dependent systems. It’s not a better SAP scheduler, but the layer that governs the full business workflow.

During migration, Control-M orchestrates workflows across ECC and S/4HANA simultaneously, manages parallel execution, and coordinates cutover, reducing disruption risk. After go-live, it keeps financial close, data movement, and cross-platform workflows running as coordinated processes rather than disconnected jobs. And as legacy SAP automation tools reach end of support, Control-M consolidates automation into one governed control plane with unified SLA tracking and audit-ready visibility.

What results have organizations seen?

• REWE digital shifted its entire distribution system to Control-M with zero downtime. At 23:59 on go-live, the original vendor’s tool ran its last workflow. One minute later, Control-M launched all workflows across every fulfillment center.

• Coop manages 107 SAP instances and 140,000 job runs a day with only three administrators.

• Snam reduced workflow errors by 40 percent after consolidating data and application workflows in Control-M.

These gains are the difference between a migration that protects the business and one that puts it at risk.

Protect the investment before the deadline

The 2027 deadline is about protecting the processes your business runs on. Modernization increases complexity, and complexity left ungoverned becomes operational risk.

Control-M ensures those processes continue to run reliably through the change. SAP manages the core. Control-M makes sure the full business service executes on time and within policy, across every system involved.

If you’re planning your move to S/4HANA, see how Control-M can ease and accelerate your migration.

Frequently asked questions

When does SAP ECC maintenance end?

SAP provides mainstream maintenance for ECC 6.0 (enhancement packages 6–8) until December 31, 2027. Many organizations are choosing a migration path now to avoid rising costs and a compressed timeline.

Why is S/4HANA migration considered risky?

The main risk isn’t SAP itself. It’s execution across connected systems. During dual-run periods, coordinating workflows with fragmented tools leads to broken dependencies, lost visibility, and manual recovery.

How is Control-M different from SAP-native scheduling?

SAP-native tools manage jobs within SAP. Control-M coordinates the full business process across SAP and non-SAP systems, mapping dependencies, enforcing SLAs, and providing unified visibility across the entire workflow.

Do we have to replace our existing tools to use Control-M?

No. Control-M acts as a unifying orchestration layer without forcing a rip-and-replace. It consolidates fragmented automation over time, which is especially valuable as legacy SAP automation reaches end of support.

Modernizing your orchestration platform during an SAP S/4HANA migration protects existing automation investments, closes integration gaps across hybrid landscapes, and creates a governed control plane for AI workflows. Doing both together reduces dual-run risk and helps critical business processes run reliably through change and after go-live.

SAP runs the core processes that keep a business moving: financial close, order flows, supply chain, and reporting. But those processes rarely stay inside SAP. They reach into data platforms, cloud services, mainframes, and dozens of non-SAP applications. When you migrate from ECC to S/4HANA, the systems your workflows depend on shift too, and the coordination between them gets more fragile.

That’s the part many migration plans overlook. Teams focus on the ERP move itself, then assume their existing automation will behave the same way in the new environment. It usually doesn’t. New complexity (multi-cloud execution, longer dependency chains, parallel ECC and S/4HANA operation) changes how workflows perform. The result is missed SLAs, manual recovery, and the kind of late-night escalations no one budgets for.

This post explains why your orchestration platform deserves attention at the same time as your S/4HANA migration, not after it. You’ll learn how modernizing both together protects what you’ve already built, supports emerging AI-driven work, and keeps business processes running predictably through one of the biggest transitions your organization will face.

Why modernize SAP orchestration during migration?

A migration to S/4HANA is rarely a clean, single-day switch. Most organizations run ECC and S/4HANA in parallel for a stretch, coordinating cutover and validation across both. That dual-run period is where execution risk spikes. You’re managing timing, dependencies, and handoffs across two ERP environments plus everything connected to them, often with disconnected tools and a lot of manual effort.

Modernizing orchestration at the same time gives you a single control plane to manage that complexity. Instead of stitching together SAP-native schedulers and siloed point tools, you coordinate end-to-end business processes across ECC, S/4HANA, and dependent systems from one place. You see what’s running, what’s blocked, and what’s at risk before it affects the business.

Treating orchestration as a separate, later project tends to backfire. Execution coordination is hardest to fix once fragmentation is already entrenched. Addressing it during the migration, when you’re already redefining how work runs, means you build the new environment on a stable foundation rather than retrofitting one under pressure.

The forcing function: legacy automation reaching end of support

There’s a practical reason this conversation is happening now. Legacy SAP automation tools are reaching end of support, which pushes many organizations into a replacement decision they can’t defer. Rather than swapping one siloed scheduler for another, this is the moment to adopt an enterprise-wide orchestration layer that consolidates SAP and non-SAP execution under unified control, without rebuilding the same workflows in a tool that only understands SAP.

Protect the automation investments you’ve already made

Here’s the concern that keeps IT leaders up at night during a migration: years of carefully built automation suddenly at risk. You’ve invested time and budget into workflows that span SAP, data pipelines, file transfers, cloud services, and homegrown applications. Moving to a SAP-specific tool often means rebuilding much of that from scratch, which adds cost, delay, and risk to an already demanding project.

Modernizing with an enterprise orchestrator preserves that work. Control-M brings your existing non-SAP automation and your new S/4HANA workflows into the same control plane, so you extend what you’ve built rather than recreate it. With more than 100 native integrations covering AWS, Azure, Google Cloud, Oracle, Informatica, Kubernetes, Databricks, Apache Airflow, and many more, the workflows surrounding SAP keep running while the ERP environment changes underneath them.

The financial logic is straightforward. SAP S/4HANA migration projects already carry significant investments across planning, licensing, resources, and implementation. Folding orchestration modernization into the same program reduces the number of follow-on upgrade projects later, and the savings can be redirected elsewhere in the business. Investment protection isn’t only about preserving old work. It’s about getting more value from the project you’re already funding.

AI agents need governed orchestration, not free rein

SAP is moving fast into AI-assisted operations. SAP Joule and intelligent agents built on the SAP Business Technology Platform (BTP) can generate decisions, trigger actions, and interact with APIs across systems. That’s powerful, but business value doesn’t come from isolated intelligent components acting on their own.

Agent-driven workflows are dynamic, cross-platform, and sensitive to compliance requirements. They need a structured, observable, and accountable layer to sequence execution, enforce SLAs, and maintain an audit trail of what ran, when, and with what outcome. Without that governance, AI activity becomes another source of risk rather than a source of value.

This is where orchestration earns its place in your future architecture. Control-M orchestrates event-driven and AI workflows within governed business services, so intelligent systems operate inside guardrails instead of around them. If you’re audited tomorrow, you can show what executed and whether it met policy. As more AI enters production, accountability becomes essential rather than optional.

The migration challenges that orchestration solves

The more established an organization is in SAP ECC, the harder the transition tends to be. A few recurring challenges show up across nearly every migration:

• Accumulated integrations. Over years, companies have built up a growing web of integrations with their SAP systems. Managing all of them during a migration pulls focus away from the project itself and creates more places for things to break.

• Complex landscapes. Many organizations run multiple ERPs, add-ons, non-SAP systems, and custom scripting. If any associated job or process breaks during migration, operations can grind to a halt, costing real time and money.

• Clean core pressure. SAP’s clean core strategy moves custom logic and integrations out of the ERP and into the surrounding landscape. Without a capable orchestration layer to manage those externalized workflows, teams end up with new coordination gaps where the old customizations used to be.

• No plan for ongoing automation. Teams often keep running automation the way they always have. During migration, that lack of forward thinking leads to gaps as workflows move to S/4HANA.

Each of these comes down to the same root issue: execution that spans systems without coordinated, end-to-end control. A modern orchestration layer addresses all three by mapping dependencies, sequencing execution, and giving teams one view across the whole process lifecycle.

How Control-M supports your S/4HANA migration

As an SAP-certified solution, Control-M creates and manages SAP ECC, S/4HANA, and BW jobs, plus data archiving, and supports any application in the SAP ecosystem. It connects to SAP through the SAP-certified BC-XBP interface, and both the self-hosted and SaaS versions are SAP Certified for Integrations with RISE with SAP S/4HANA Private Cloud. Here’s what that delivers in practice:

• Reduced project time and cost. Pre- and post-migration automation keeps operations smooth and consolidates modernization into one program, cutting the number of follow-on upgrade projects.

• Reduced integration complexity. Control-M provides a complete integration view across SAP and non-SAP systems, so data flows and dependencies stay coordinated through the transition.

• End-to-end visibility and governance. Real-time monitoring, SLA management, and full execution traceability give teams the control and audit readiness modernization demands.

• Scalability and stack alignment. Control-M scales with the business and sets a clean foundation for the innovation projects that follow migration.

Proof that this approach works

Two examples show what reliable orchestration looks like during high-stakes change.

When REWE digital migrated its mission-critical distribution systems, the cutover was seamless. At 23:59 on go-live, the previous automation tool ran its last workflows. One minute later, at 00:00, Control-M launched every workflow, managing orders to all fulfillment centers across the company’s markets. The entire distribution system shifted with zero downtime, no small feat when thousands of supermarkets depend on it.

Coty, one of the world’s largest beauty companies, uses Control-M to automate and orchestrate its most critical business processes. By consolidating onto a single orchestration platform, Coty streamlined execution across its environment and sustained high process reliability. This is clear evidence that unifying fragmented automation pays off in day-to-day operations, not just at cutover.

Build the foundation before you need it

A migration to S/4HANA succeeds only when workflows run reliably, make daily work better for business users, and support what the enterprise wants to build next. Your ERP can be perfectly migrated and still fall short if the processes around it stumble.

Modernizing orchestration alongside your S/4HANA migration protects the automation you’ve already invested in, simplifies the integrations that make migration risky, and prepares your environment for AI-driven work that needs governance to be safe. The organizations that handle both together don’t just survive the transition. They come out of it with a stronger foundation for everything that follows.

To see how Control-M can de-risk your S/4HANA migration and strengthen your broader SAP workflows, visit the Control-M for SAP website.

Frequently asked questions

Why should I modernize orchestration during an SAP S/4HANA migration instead of after?

Migration is when execution risk is highest, because you’re often running ECC and S/4HANA in parallel and coordinating cutover across connected systems. Modernizing orchestration at the same time gives you one control plane to manage that complexity. Waiting until after means retrofitting coordination once fragmentation is already entrenched, which is harder and costlier.

How does Control-M protect existing automation investments?

Control-M brings your existing non-SAP workflows and new S/4HANA jobs into a single control plane, so you extend what you’ve built instead of rebuilding it in an SAP-only tool. With more than 100 native integrations, the automation surrounding SAP keeps running while the ERP environment changes.

What does the end of support for legacy SAP automation mean for my migration plan?

It forces a replacement decision you can’t postpone. Rather than swapping one siloed scheduler for another, you can use the moment to consolidate SAP and non-SAP execution into one enterprise orchestration layer, reducing tool sprawl and avoiding a rebuild later.

Is Control-M certified to work with SAP and RISE with SAP?

Yes. Control-M is an SAP-certified solution that manages SAP ECC, S/4HANA, and BW jobs through the SAP-certified BC-XBP interface. Both the self-hosted and SaaS versions are SAP Certified for Integrations with RISE with SAP S/4HANA Private Cloud.

Data plays an integral role in the success of modern businesses. In an SAP ecosystem, data must flow across multiple inbound and outbound sources. To make things even more complicated, gathering and processing data, and then delivering insights, often requires orchestration of data and applications across multiple SAP and non-SAP systems. And as companies enact plans to migrate from legacy SAP systems to SAP S/4HANA^®, failure of critical SAP data flows can bring those digital transformation and modernization efforts to a screeching halt. Missing business modernization deadlines could have long-lasting ramifications, including additional maintenance costs and less-inclusive approaches.

Without a solid data orchestration strategy to ease the process, SAP data orchestration can get difficult quickly. Orchestrating and monitoring data flow within SAP systems is challenging due to factors like integration complexity, data quality, performance, and scalability issues. Monitoring data workflows through multiple SAP and non-SAP systems can also create a range of difficulties, from a general lack of workflow visibility to the inability to address dataflow failures in a timely manner. In addition, SAP data engineers must manage complex environments with multiple integrations and interoperability, often while trying to keep up with frequent changes in business requirements and technologies. All this work, and the troubleshooting required to find data and job failures, leads to more time and money being spent to get everything back on track.

How Control-M Can Help

Control-M provides the workflow orchestration capabilities to help organizations streamline their SAP dataflows in parallel with their migration to SAP S/4HANA. As an SAP-certified solution, Control‑M orchestrates non‑SAP and SAP workflows (including SAP ECC, S/4HANA, and SAP BW jobs) within a single platform. It provides out-of-the-box visibility to all enterprise workflows and their dependencies across SAP and non-SAP source systems and de-risks the transition to SAP S/4HANA.

With unified scheduling and automation of workflows with both SAP and non-SAP systems, Control-M can help organizations greatly reduce time to value, complexity, and the requirement for specialized knowledge. It can also be used for all other enterprise jobs, services, processes, and workflows. That lets businesses using SAP build, orchestrate, run, and manage all their enterprise jobs from a consolidated, integrated platform. In addition, Control-M easily adapts to changing business and technology requirements, ensuring that data processes remain consistent across systems and platforms and aligned with organizational goals. And as resources fluctuate, Control-M can help allocate them effectively, optimizing system capability usage and reducing bottlenecks.

Control-M can serve as a comprehensive platform because of its many integrations. The solution can support all SAP versions and job types. It also supports many other enterprise workflows and has more than 100 native integrations with popular tools, including Amazon Web Services (AWS), Azure, and Google Cloud (and many of their components), Oracle, Informatica, SQL, Red Hat, Kubernetes, Apache Airflow, Hadoop, Spark, Databricks, UiPath, OpenText (Micro Focus), Alteryx, and many more.

Robust data orchestration is crucial to the success of your SAP workflows, especially when they include both SAP and non-SAP systems. Complexity can increase quickly, making it difficult to keep up and hard to manage, and ultimately, leading to missed service level agreements (SLAs). With Control-M, organizations can cut through complexity and have full visibility and control of their application and data workflows.

If you’re interested in learning more about how Control-M can help you with SAP dataflows and much more, check out our website.

AI is changing where risk shows up—and making it harder to prove you’re in control.

TL;DR

AI agents, APIs, and automated workflows are scaling faster than the controls designed to govern them. Fewer processes involves people, but most controls still assume they do.

Policies exist. Monitoring exists. But control rarely happens at the moment work runs.

That’s the gap.

If you can’t prove—right now—what executed, what data was used, and whether it followed policy, you don’t have real-time compliance. You have delayed reporting.

What Do We Mean by “Real-Time Compliance”?

Practically speaking, it’s pretty simple: Can you tell me—right now—what ran, what data it used, and whether it followed policy? If you can’t answer that without digging through logs or pulling reports later, it’s not real-time.

Real-time compliance means control is applied as work runs—not before on paper, and not after in an audit. And the proof is created at the same time, automatically.

If you have to reconstruct what happened after the fact, you’re not operating in real time. You’re piecing together history.

The Real Problem: Control Isn’t Applied Where Work Happens

Most organizations aren’t missing controls. You likely already have:

• IAM to define who can access what
• Security tools to detect issues
• Governance frameworks to set policies

The problem is that these systems don’t actually control what happens when work runs across workflows, data pipelines, or AI systems. As a result, gaps show up in production:

• Machine-driven activity grows, but enforcement isn’t consistent
• Data pipelines move faster, but validation gets weaker
• AI systems follow policies on paper, but not always in practice

And when someone asks, “Are we compliant right now?” you still can’t answer in real time. It can take hours, days, or even weeks.

A Quick Litmus Test: Is Control Enforced?

If you’re accountable for risk and compliance, there’s a simple way to pressure-test your current state: Check the boxes where you can prove control at execution—not just in policies or audit reports.

Machine & AI execution

• You can list every non-human identity running production workflows
• You can trace every AI-driven action to a system and dataset
• Policies are enforced before execution, not just logged afterward

If not, machine activity is happening outside enforceable control—and you can’t reliably audit it.

Data and AI pipelines

• Every production pipeline includes enforced validation checkpoints
• You can prove lineage from source to output
• AI systems cannot run on unapproved or external data

If not, decisions are being made on data you can’t fully trust or defend.

Compliance proof

• You can generate evidence in real time without manual effort
• Audit trails are system-generated, not assembled afterward
• You can answer “are we compliant right now?” with actual data

If not, compliance is reactive and hard to defend under scrutiny.

The takeaway: If you can’t check every box in a category, control in that area isn’t enforced at execution. And if you see gaps across categories, you’re not preventing risk, you’re discovering it after the fact.

Where Real-Time Compliance Breaks Down

In most environments, the issue is that controls aren’t applied where the work actually runs.

Here’s where it typically breaks down:

1. Identity control stops with people

IAM works well for humans, but most production activity now isn’t driven by people. It’s service accounts, APIs, automated workflows, and AI agents doing the work. These identities often aren’t consistently governed, aren’t tied to enforceable policies at runtime, and aren’t monitored at the point of action. So, while access may be controlled, execution isn’t.

2. Data pipelines outrun your controls

Pipelines are built to move fast. Controls are often layered around them, not inside them. That leads to validation being optional, policies being applied inconsistently, and outputs being built on unverified inputs. So, you might have lineage—but not trust in the outcome.

3. AI governance stops at definition

Most organizations have started defining model policies, access controls, and governance frameworks. But they don’t control how AI actions are triggered, what data is actually used, and how decisions propagate through systems. So, policy exists, but enforcement doesn’t.

What It Takes to Prove Compliance

At some point, this becomes a practical question: Can we prove what happened, as it happened? To do that, control has to move closer to execution, where works runs.

That means having a layer that:

• enforces policy before execution
• validates data as it moves
• governs AI workflows like any other production process
• captures evidence as part of execution—not afterward

When that exists, questions like these are easier to answer:

• What ran across our environment in the last 24 hours?
• Which workflows used unvalidated data?
• Where were controls bypassed?
• Which AI-driven actions violated policy?
• Are we compliant right now?

If you can’t answer these questions quickly, control is assumed—not enforced.

What Real-Time Compliance Requires

Frameworks like the EU AI Act and NIST AI RMF aren’t asking for more documentation.

They’re asking for provable behavior. To meet that bar, four things need to be true:

1. Controls are enforced at execution

Non-compliant workflows don’t run. Policies apply consistently. Every execution records whether it passed or failed control.

2. Data and decisions are traceable

Every output can be traced back to its data sources, transformations, and execution path. Across systems, not just within tools.

3. Compliance is continuous

You don’t check compliance periodically. You can see what’s running, under which policies, in real time.

4. Evidence is generated automatically

Audit trails aren’t reconstructed. They’re created as part of execution. If compliance depends on reconstructing events, it won’t hold up under real pressure.

What This Looks Like in the First 90 Days

Achieving real-time compliance isn’t a multi-year transformation. It starts with visibility into where control breaks down, and then quickly moves to enforcing control at execution.

Days 0–30: Visibility

• Identify critical workflows
• Surface unmanaged machine and AI activity
• Map where execution happens outside control

Outcome: You know where compliance can’t be proven right now.

Days 30–60: Enforcement

• Bring high-risk workflows under orchestration
• Introduce policy checkpoints
• Apply validation to key pipelines

Outcome: High-risk execution is now governed at runtime.

Days 60–90: Proof

• Automate evidence generation
• Establish continuous compliance baselines
• Link workflows, data, and outcomes

Outcome: You can prove compliance as work runs, not after. 

Common Questions Security & Risk Leaders Ask

1. How do we find where controls are being bypassed?

You need visibility into execution, not just policy definitions. That usually means centralizing orchestration and making workflow execution observable across systems.

2. How do we keep AI agents within bounds?

By enforcing controls at runtime: identity, data access, and allowed actions. Every action must pass through those controls, not just inherit policy.

3. How do we add human approvals without slowing everything down?

By applying them selectively. Most workflows run automatically. Only exceptions or high-risk actions trigger human approval in real time.

4. How do we prove what happened without manual reconstruction?

By capturing execution as it happens: inputs, transformations, model activity, outputs. All in a single, time-sequenced record.

Final Thoughts: The Mental Shift That Matters

Compliance used to be about documentation. Now it’s about provable execution. The question isn’t “Do we have policies?” It’s “Can we prove they were enforced when work actually ran?”

That’s where an AI control plane approach starts to matter.

Platforms like Control‑M bring execution, control, and evidence together, so you can:

• Enforce policy at execution, not after the fact
• Validate data before it’s used
• See exactly what ran, how it ran, and what it produced
• Capture audit evidence automatically, as part of runtime

When that’s in place, everything tightens up: Work runs under control, activity is visible in real time, policies are applied consistently, and compliance is provable without reconstruction.

Final takeaway: If you’re trying to move from “we think we’re compliant” to “we can prove it right now,” it starts with enforcing control where execution happens.

How to operationalize AI governance to control risk and compliance in production

TL;DR

AI isn’t the hard part anymore. Operationalizing AI is.

Most AI projects stall because no one really has control over how the whole thing behaves in production.

Pipelines run. Workflows exist. But they’re stitched together across tools, scripts, and “somebody who knows how it works.” What you have isn’t a system. It’s coordination by coincidence.

A SOAP is the layer that turns all of that into something you can actually run and rely on.

Why So Many AI Projects Stall — and What’s Missing in the Middle

The model works. The use case is valid. And then it stalls. Not because the model failed, but because everything around it starts to break.

The problem shows up in the middle:

• data isn’t where it needs to be
• steps don’t run in the right order
• systems drift out of sync

Individually, those pieces exist. Together, they don’t behave like a system. That’s why “we got it working” rarely turns into “this runs reliably in production.”

There’s a layer that’s supposed to hold all of this together. In most environments, it doesn’t exist as a single system. It’s spread across schedulers, pipelines, scripts, and a lot of tribal knowledge.

When you actually pull that together into something coherent, it’s what’s referred to as a Service Orchestration and Automation Platform (SOAP).

Is SOAP Just Rebranded Orchestration?

It sounds like it. Most teams already have plenty of orchestration. And yet the common experience is: everything runs but it still doesn’t feel under control.

That’s because orchestration is built to execute workflows—even across systems—but it doesn’t inherently give you control over how those workflows behave at the system level.

The problem is that real systems don’t stay in boundaries. Workflows interact. Dependencies cross tools. Upstream delays ripple. AI steps behave inconsistently. So you end up here: everything ran, but the outcome is still wrong.

That’s not an execution failure. It’s a control failure. That’s the shift:

• Orchestration defines how the workflow is supposed to run across systems.
• SOAP is what actually keeps those workflows running correctly across the environment.

You don’t feel that difference when you’re building a pipeline. You feel it when:

• that pipeline connects to everything else
• something upstream is late
• something downstream quietly breaks
• and no single tool can explain what actually happened

In practice, this is where platforms like Control‑M show up—not as “another orchestrator,” but as the layer that coordinates workflows across data, applications, and AI so they behave like a system.

Takeaway: It’s not more orchestration. It’s the layer that makes everything already orchestrated actually behave predictably.

What a Control Plane Has to Get Right

Once you think in terms of a SOAP as the control plane, the question shifts pretty quickly from: “how do we run this workflow?” to “what does it take to keep this thing behaving under real conditions?”

In practice, there are a few things a control plane needs to get right if it’s going to hold up in production:

1. It actually has to run reliably

Not just once. Not just in a clean path. Across:

• cloud + onprem
• internal systems + external APIs
• workloads that don’t all behave the same way

AI makes this harder, not easier. Latency varies. Dependencies drift. Retries don’t always help. At some point, you realize the pipeline is only as reliable as the least predictable thing in it.

2. It has to understand what depends on what

This is the one most teams feel immediately. Something upstream is delayed, and you don’t find out until something downstream fails—or worse, runs with bad data.

Without system-level awareness, you’re always reacting. With it, you can actually see what’s at risk, what’s impacted, and what needs attention now.

3. It has to explain what’s going on

This is where things usually fall back to people. Someone knows how the workflow works, why it fails in weird ways, and what “normal” looks like. And everyone else is stuck asking them.

A control plane starts to pull that knowledge into the system itself:

• what this workflow does
• what changed
• what likely caused the issue

Not magic. Just enough context to stop everything from being a guessing game.

Takeaway: You’re no longer just running workflows. You’re running a system where behavior is visible, dependencies are understood, and issues are explainable. That’s what lets AI pipelines move from “it works” to something you can actually rely on.

What This Looks Like When It Actually Works

This is where the control plane idea stops being conceptual and starts showing up in real workflows.

1. When a “quick change” isn’t a scramble anymore

You get the request: “Can we refresh this dashboard with updated projections today?”

Without a control plane, that usually turns into a scramble—figuring out which pipelines are involved, coordinating across a few teams, manually triggering jobs, and then watching closely to see what breaks.

With a control plane, that same request is already understood as a workflow. The dependencies are mapped, the execution path is known, and the change can be applied in one place without chasing it across tools.

The difference isn’t just speed. It’s that the work becomes predictable and repeatable instead of reactive.

2. When AI actually makes it to production

Moving revenue forecasting models, fraud analysis pipelines, or supply chain optimization workflows from proof-of-concept to operational requires enterprise-grade discipline: governed data ingestion, controlled model execution, managed LLM invocation.

With a control plane, ingestion, transformation, inference, and downstream updates are all coordinated, observable, and governed the same way. At that point, moving to production stops feeling like starting over.

3. When governance isn’t a periodic fire drill

In most environments, workflow sprawl builds up quietly over time. Pipelines stick around long after they’re needed, dependencies overlap, and no one really has a clear view of what’s still in use. You don’t notice it until something breaks, performance slips, or there’s an audit coming up.

Without a control plane, governance is something you piece together after the fact. With one, the system itself starts to surface what’s changed, what’s no longer used, and where things are drifting. Governance becomes continuous instead of reactive.

Why the Lack of a Control Plane Feels Worse With AI

This isn’t a new problem. The gaps in how workflows are coordinated have always been there. AI just makes them obvious.

You now have more steps, more variability, more external dependencies (LLMs, APIs), and less predictable behavior. So the same coordination gaps that were manageable before start to show up everywhere.

Without a Control Plane

No shared context

• Each part runs its piece
• Dependencies are implicit
• Failures are discovered late
• People connect the dots manually

With a Control Plane (SOAP)

• One layer coordinates execution across everything
• Dependencies are explicit and visible
• Failures are understood in context
• Impact is clear before it spreads

Where SOAP Changes Day-to-Day Work

This is where it gets real.

• Instead of debugging across tools, you can actually see the workflow end to end.
• Instead of isolated failures, you get context about what those failures affect.
• Instead of relying on “who knows this pipeline,” the system carries that understanding.

With a SOAP, AI workloads stop being special cases and start behaving like everything else you run in production—the same way mature teams handle automation and orchestration across the rest of the stack.

Where to Start (Without Turning This Into a Rewrite)

You don’t need to replatform everything. You need to expose where you don’t have control.

1. Start with one pipeline that matters

Not a clean one. A real one. Map what actually happens: where data comes from, what it triggers, and what breaks if something is late. This is where hidden dependencies show up.

2. Count how many “control planes” you actually have

Most teams have multiple orchestration tools, scripts filling gaps, and people connecting the dots. Everything is orchestrated. Nothing is coordinated.

3. Make the system visible before you automate it

You should be able to answer, in one place: what does this workflow actually do, what depends on it, and what happens if it fails or drifts. If you can’t answer those, automation just makes troubleshooting harder.

4. Treat AI workloads like real workloads

This is where things quietly break. AI steps often have different retry behavior, weaker monitoring, and less consistent control. That works in testing. It doesn’t in production. Treat them like everything else: observable, governed, and part of the same system—which is increasingly what agentic orchestration is being built to handle.

5. Don’t try to fix everything at once

If one pipeline becomes visible, predictable and understandable, that’s already meaningful progress. From there, it scales.

What You’re Actually Building Toward

Not a new tool. Not a perfect architecture. Just this: a single layer that understands how your workflows behave and keeps them from drifting.

Once you have that, automation gets easier, failures are less surprising, and scaling doesn’t multiply chaos.

To Sum Up: The Shift That Actually Matters

AI isn’t a modeling problem anymore. It’s an operations problem: can you run complex, cross-system workflows reliably under real conditions? That’s the same shift driving teams to operationalize data and AI projects through orchestration.

If this feels familiar

If your current setup works, but only with careful coordination, tribal knowledge, and a few “don’t touch that” pipelines, you’re not behind. You’re just missing the layer that turns all of it into a system you can actually control. That’s the role SOAP is starting to play.

If you’re trying to move from “we got it working” to “we can run this reliably, every day”—here’s a practical guide to turning complex workflows into AI-powered outcomes: Orchestration: The Missing Layer in Enterprise AI.

This guide goes deeper into what’s missing when it comes to operationalizing AI—what it actually looks like in production, why it shows up so consistently, and how teams are starting to close the gap with a real control plane.

As digital certificate lifetimes drop to 47 days, automation becomes essential to maintain availability, security, and compliance. BMC AMI Digital Certificate Manager extends automated certificate lifecycle management to the mainframe, enabling standardization across the enterprise using your current CLM vendor.

Digital certificates are the connective tissue of the enterprise environment, enabling systems, workloads, applications, and APIs to verify each other and communicate securely. When a certificate fails due to expiration or error, the impact on service availability and security can be immediate and severe. And with regulators driving certificate lifetimes down to as little as 47 days by 2029, organizations face a sharp increase in both operational and compliance risk. That makes digital certificate management a top priority for BMC customers.

By enabling organizations to discover, track, and renew certificates across the infrastructure, digital certificate management prevents the outages and security gaps that can result from expired, misconfigured, or otherwise compromised certificates. This task has grown more difficult in recent years, and even greater challenges are on the horizon. But BMC has a solution.

Why digital certificate management is becoming an urgent challenge

Traditionally, many organizations have managed mainframe certificates through manual processes centered on spreadsheets and tribal knowledge. In recent years, the growing number of system identities relying on these certificates has pushed these methods to the breaking point. Now, regulatory changes have made them completely unsustainable.

To reduce the exposure that can result from a compromised certificate, the CA/Browser Forum has announced aggressive reductions in TLS certificate lifetimes. Until this month, companies were allowed a relatively manageable 398-day renewal cycle. Now that window has been nearly cut in half to 200 days. Next March, it will shrink once again to 100 days, and by March 2029, TLS certificates will be good for only 47 days. Each of these reductions effectively multiplies the certificate management workload for mainframe security teams, and with it, the chance of manual errors, expirations, and system outages.

This isn’t a future problem. The regulatory deadlines are fixed, the timelines are non-negotiable, and their impact is inevitable. That’s why I’m excited to announce BMC AMI Digital Certificate Manager (DCM)—a new solution that fundamentally changes certificate management on the mainframe.

How to extend enterprise digital certificate management to the mainframe

Most enterprises already invest in Certificate Lifecycle Management (CLM) platforms for their distributed and cloud environments. These platforms haven’t been able reach the mainframe, however, leaving z/OS as a manual island in an otherwise automated estate. Now BMC is filling that gap with the only solution enabling digital certificate management platforms to extend automation to the mainframe as part of a consistent enterprise strategy.

Proven in operational environments for over five years, DCM provides a unified integration layer to connect Venafi and Keyfactor digital certificate management tools to mainframe ESMs including RACF, ACF2, and Top Secret. With DCM, you can standardize on one BMC solution for your mainframe while supporting whichever certificate vendors your organization already uses, no rip-and-replace required.

End-to-end automated certificate operations

DCM extends your organization’s CLM to automate the entire mainframe certificate lifecycle, from issuance and renewal to replacement and rollback. The impact is immediate and measurable:

• Dramatic effort reduction: Mainframe certificate implementations that previously took up to three hours of manual work are now fully automated.
• Eliminated outage risk: Expired or mismanaged certificates are a major cause of preventable mainframe outages. DCM’s scheduled renewals and built-in rollback ensure continuous availability without late-night firefighting.
• Reduced dependency on scarce skills: Mainframe security expertise is increasingly hard to find. DCM removes the need for skilled personnel to manually execute certificate commands across RACF, ACF2, or Top Secret, freeing them for higher-value work.
• Complete audit visibility: Every action is logged with full detail, including which commands were issued, which ESM responses were received, who authorized the change, and when.

Real-world impact at a major financial institution

One of the world’s largest financial institutions evaluated DCM against its current, pre-automation state. With certificate volumes growing over 30 percent year over year, a small core team currently handles digital certificate management manually across many application owners and faces an increasing risk of outages, audit failures, and security gaps.

The firm projected the five-year value of deploying DCM as $8.6 million, driven by manual effort reduction and avoided headcount ($3.6M), eliminated application outages ($2.2M), compliance and audit risk reduction ($1.4M), operational efficiency gains ($0.8M), and future-proofing against accelerating certificate volumes ($0.6M). Beyond these measurable financial gains, the solution supports the institution’s broader strategic priorities around operational resilience and responsible growth.

Strengthening Zero Trust across the enterprise

Machine identity is foundational to Zero Trust: Every workload, process, and system must be authenticated. Working alongside BMC AMI Security, DCM becomes part of a comprehensive Zero Trust strategy for the mainframe, enabling continuous threat detection, automated response, and end-to-end protection across your most critical environment. Security teams gain the observability, policy enforcement, and confidence they need to report to the chief information security officer (CISO) and the board that the mainframe is truly protected.

Looking ahead

The certificate landscape continues to move toward shorter lifetimes, more frequent renewals, higher volumes, and tighter regulatory scrutiny. All of these trends will drive an exponential growth in manual digital certificate management workloads. By acting now, organizations can stay ahead of increasingly urgent certificate deadlines while preparing their infrastructure for continuous, automated certificate renewals.

BMC AMI Digital Certificate Manager is generally available. We invite you to learn more about how DCM can modernize certificate management across your mainframe environment—preserving your existing tools, eliminating manual effort, and building the operational resilience your business demands.

BMC is aware of recent industry discussion about the use of advanced AI techniques to identify software vulnerabilities, including initiatives such as Project Glasswing.

As part of normal security operations, BMC continuously monitors emerging research, threat intelligence, and industry developments related to software and supply chain security. These developments reflect an acceleration in how vulnerabilities may be identified across the industry.

BMC maintains a defense-in-depth security program and regularly evaluates opportunities to enhance controls and processes as technologies evolve. We engage with customers, partners, and the broader security community to remain aligned with industry best practices.

As new information becomes available, BMC will use its proactive notification process to help keep customers up to date.

To register for proactive notifications, please see the following BMC Support Central article:

https://docs.bmc.com/xwiki/bin/view/Standalone/BMC-Support-Central-User-Guide/supportcentraluserguide/Manage-Your-Support-Account/Favorite-Products-and-Alerts/

The Orchestration Imperative for the AI Era

Something interesting is happening in enterprise technology right now. In conversations with clients, I’m hearing that as companies modernize, invest heavily in AI, and build increasingly complex digital ecosystems, many are running into the same reality.

Innovation is moving faster than operations.

And the gap is now showing up in execution. Customers report that as they move quickly to launch more AI pilots and adopt new platforms, the operational foundations beneath these innovations often remain fragmented. Automation silos, disconnected pipelines, and governance gaps create that fragmentation—and introduce risk just when scale matters most.

What’s interesting is where this leads: automation itself is no longer the goal. The question is no longer how do we automate more? It’s how do we orchestrate everything reliably at enterprise scale?

Based on numerous conversations with customers and prospects in recent months, here are five operational shifts I believe every enterprise will face if they aren’t already there.

1. From AI experimentation to AI execution

Many enterprises have already piloted GenAI. They are now expecting measurable outcomes. The focus is shifting from isolated experiments to production-grade AI embedded directly in operations. Leaders are asking practical questions:

Does AI …

• Reduce incidents?
• Accelerate root cause analysis?
• Improve SLA adherence and resource utilization?

AI will increasingly power predictive workflow orchestration—anticipating job failures, recommending remediation, reallocating resources, and learning from execution patterns. But intelligence alone isn’t enough. Enterprise AI must be transparent, explainable, and governed. Black-box automation won’t meet operational standards. The most valuable AI will be embedded directly into orchestration platforms—where visibility, policy enforcement, and accountability already exist.

The organizations that succeed won’t be those that experimented the most. They’ll be the ones that operationalized AI to improve resilience, efficiency, and speed at scale.

 2. Speed at scale demands “freedom with guardrails”

Technology ownership continues to decentralize. Developers, data engineers, DevOps teams, and business technologists all want the ability to build and deploy quickly without waiting on centralized teams. But autonomy without structure creates risk—security gaps, compliance exposure, duplicated workflows, and operational sprawl.

In response, leading organizations are adopting a “freedom with guardrails” model. Teams gain self-service capabilities to build workflows and pipelines, while governance is embedded directly into the automation layer. Role-based access, policy enforcement, auditability, and standardized templates allow teams to move independently without sacrificing oversight.

The key shift is architectural: governance won’t be an afterthought or manual review step. It will be codified into orchestration frameworks themselves. This balance of empowerment and control will become a defining characteristic of high-performing digital enterprises.

 3. Real-time orchestration becomes the backbone of operations

The era of purely nightly batch processing is fading. As digital services compress response times and customer expectations approach real-time, orchestration must evolve from static scheduling to event-driven responsiveness.

Moving forward, organizations will increasingly rely on workflows triggered by real-time business signals—transaction anomalies, supply chain disruptions, or customer behavior changes. Modern orchestration platforms will unify batch, micro-batch, and streaming execution models within a single operational framework.

This requires horizontal scalability, high availability across hybrid and multi-cloud environments, and end-to-end workflow visibility. Monitoring alone won’t be enough. Organizations will demand predictive insights and proactive remediation, transforming observability into operational foresight.

4. Ecosystem collaboration emerges as a competitive advantage

No enterprise operates in isolation—and no orchestration platform can either. Modern operations span SaaS applications, hyperscalers, on-prem systems, managed file transfer, data lakes, AI services, and edge environments. The orchestration layer increasingly becomes the connective tissue across this ecosystem.

Interoperability will move from nice-to-have to mandatory. Customers will expect secure, open, and extensible integrations that connect data pipelines, AI engines, compliance systems, and operational workflows seamlessly. API-driven architectures, pre-built integrations, and ecosystem partnerships will shape buying decisions more than feature checklists.

Working with vendors that embrace openness and integration supporting hybrid and multi-cloud strategies without lock-in will stand out as strategic enablers. Trust, extensibility, and ecosystem compatibility will define leadership in the orchestration market.

5. Orchestration evolves into a shared business capability

Orchestration is no longer an IT-only concern. It touches revenue operations, customer experience, compliance, analytics, and supply chain resilience. Organizations that treat orchestration as a shared, cross-functional capability will outperform those that silo it within infrastructure teams.

This means evolving operating models. Shared ownership between IT operations, data teams, DevOps, and business stakeholders will become the norm. Governance councils, cross-functional workflow design, and outcome-based metrics will replace purely technical KPIs.

Most importantly, orchestration will be treated as a living capability—continuously refined as new applications, AI services, and regulatory requirements emerge. Enterprises that embed this mindset will build an automation backbone that scales with growth, adapts to disruption, and supports innovation without sacrificing control.

Final Thought: Confident AI at Enterprise Scale

The conversations that defined the last twelve months around AI, speed, governance, and resilience are converging into a more mature operational mandate.

The goal is no longer experimentation. It’s confident scale.

Organizations want to move faster, operate smarter, and maintain unwavering trust in every automated outcome. I’m looking forward to continuing this conversation as we operationalize these ideas.

If these themes resonate with what you’re seeing in your organization, I’d love to hear what’s highest on your operational agenda.

IMS continues to serve as the backbone for high-volume, transaction-driven applications across industries such as banking, insurance, retail, and healthcare. These environments are trusted due to their reliability and performance, yet they are also evolving. Today’s IMS systems support a wider mix of users, integrations, and business-critical activity than ever before. As a result, complexity is increasing while many teams cope with limited resources and fewer experienced specialists.

This shift is driving renewed attention to how IMS environments are monitored, analyzed, and managed every day. Traditional monitoring approaches remain important, but they are limited by static thresholds and fragmented views, making it difficult to understand how system behavior fits together. When issues arise, teams may recognize that something is wrong without clear visibility into why it matters or where to focus first.

How AIOps improves IMS visibility

To address this challenge, organizations are increasingly adopting mainframe AIOps. Using machine learning and advanced analytics to examine system and performance data, AIOps helps teams recognize normal behavior, identify emerging conditions earlier, and reduce alert noise that doesn’t require action. In IMS environments, this helps teams gain clarity faster and make more confident decisions without increasing manual effort.

BMC AMI Ops Insight, working alongside brings these AIOps capabilities into IMS operations by learning how systems behave over time and identifying meaningful changes in system behavior within the wider operational context. Rather than treating every deviation the same, intelligent models correlate activity across metrics and subsystems to help teams assess potential impact and prioritize response. This allows teams to move more quickly from detection to understanding, even in highly complex environments.

Combining operational and data insight

Insight becomes even more valuable when paired with data awareness. IMS data activity plays a critical role in application behavior, performance trends, and recovery scenarios. BMC AMI Data for IMS provides visibility into database and application activity, adding context that helps explain what teams are seeing at the system level. When operational insight and data contexts are brought together, teams gain a fuller view of system behavior and risk.

Across the industry, organizations are applying these approaches to shorten detection and resolution timelines, improve incident clarity, and reduce. These efforts also support modernization and resilience initiatives, helping teams maintain confidence and control as demands on IMS environments continue to grow.

Watch the on-demand webinar How AI-Driven Insight is Changing IMS Operations to see how BMC AMI Ops Insight and BMC AMI Data for IMS help organizations apply AIOps-driven insight to IMS operations with greater clarity, faster understanding, and more confident action.

Artificial intelligence (AI) is evolving rapidly, and so are organizations’ approach to its use. In April 2026, BMC released a statement of direction on the integration of AI into the BMC AMI suite of mainframe solutions. In The Next Evolution in Enterprise AI is Purpose Built, BMC mainframe Senior Vice President and General Manager John McKenny discusses the shift from generative AI (GenAI) to agentic AI and our intent to embed agentic AI across the BMC AMI portfolio.

While the statement of direction explains how we’re moving into the future with agentic AI workflows, over the past two years we have developed purpose-built AI for the mainframe, offering in-context expertise through BMC AMI Assistant. With Knowledge Expert Chat, practitioners can harness the power of AI to find the answers they need when and where they need them, increasing the quality and efficiency of their work. Each quarter, we have added to what mainframe professionals can accomplish while increasing integration of BMC AMI Assistant across the BMC AMI portfolio.

The April 2026 release of enhancements to the BMC AMI portfolio focuses on this advancement of mainframe GenAI as well as the open integration of the platform with the broader enterprise IT ecosystem.

GenAI powered by organizational intelligence

Even as we increase the use of agent-driven automation on the mainframe, the efforts to improve GenAI assistance continue, including this quarter’s General Availability of Knowledge Hub, which surfaces institutional knowledge from across the organization to offer contextual information and answers at the moment of decision through BMC AMI Assistant Knowledge Expert Chat.

Knowledge Hub works behind the scenes, ingesting provided institutional knowledge from past issue resolutions, operational insights, and information from runbooks, tickets, and shared files, then combining it with BMC mainframe expertise to create Knowledge Expert Chat responses that are contextually aware and tailored to user’s mainframe environment. These responses are available directly in workflows using existing BMC tools, enabling quicker decisions made with expert-level confidence, regardless of the user’s experience level.

AI-generated application analysis reports

Just as Knowledge Hub captures institutional knowledge to inform assistance provided by Knowledge Expert Chat, a new feature in BMC AMI zAdviser Enterprise adds hard-won institutional knowledge to zAdviser’s collection of development tool and toolchain data to help development managers and their developers understand the applications they are modifying.

BMC AMI zAdviser Enterprise gathers BMC AMI tool usage data and DevOps metrics to give development managers a clear picture of development effectiveness. With new application analysis reports, they now get a single AI-generated view of how their applications work, where the risk is, and where their team’s time is going, accelerating modernization decisions and cutting weeks off of developer onboarding.

BMC AMI zAdviser Enterprise’s Application Analysis turns tribal knowledge into organizational knowledge before it walks out the door. The narrative assessments capture the knowledge of experienced developers, sharing that expertise with development managers and developers, creating more efficient application review, planning, and optimization.

Beyond a greater understanding of individual programs, these application analysis reports provide a clear picture of which programs are attracting a disproportionate share of developer attention because of failures and modifications. By correlating failure history with code complexity and maintenance patterns, they enable development teams to target problem applications with proactive remediation, improving system resilience and development efficiency.

Standardizing enterprise security

Manual management of security certificates decreases efficiency and weakens system security. For some time, security teams have been able to automate certificate management on distributed systems using third-party tools.BMC revolutionized mainframe security management with BMC AMI Enterprise Connector for Venafi. This April, we introduce BMC AMI Certificate Manager, a new product within BMC AMI Security that gives customers more choice and flexibility in integrating enterprise security solutions with the mainframe.

Designed to integrate with IBM Z^® enterprise security management (ESM) environments, including RACF^®, ACF2^™, and Top Secret^® for z/OS to automate the full certificate lifecycle without the need for infrastructure changes, BMC AMI Certificate Manager extends leading enterprise certificate management platforms to the mainframe. This gives CISOs and security teams the ability to use the same vendor solutions for distributed and mainframe certificate management, further integrating the mainframe with—and simplifying—enterprise security efforts.

BMC AMI Certificate Manager currently integrates with Venafi^® and Keyfactor^®, with further integrations to follow in future releases. With this unified integration layer between enterprise certificate management tools and IBM Z^® ESMs, organizations can automate certificate issuance, renewal, and enforcement with one BMC solution while supporting multiple vendors.

Breaking down silos with new technology

This quarter’s enhancements further BMC’s commitment to optimizing what is possible on the mainframe through open integration of the platform and continuous improvements to AI capabilities. With the addition of organization-specific knowledge to AI engines, Knowledge Hub empowers mainframe professionals to make the right decisions as they do their jobs, regardless of their experience and skill levels. Application analysis reports in BMC AMI zAdviser Enterprise combine development and application performance data with system telemetry to provide a clear picture of how applications are performing and where attention and efforts should be focused. And the new BMC AMI Certificate Manager enables security teams to employ certificate management policies across platforms without the need for separate tooling.

Each of these enhancements improves the productivity and efficiency of mainframe teams, a goal BMC is committed to pursuing with each of our quarterly releases. Make your mainframe the engine of faster, better, and smarter answers. When you BMC First.

These are just a few of the innovations included in the April 2026 release of BMC AMI features. To learn more about everything included in the release, visit the What’s New in Mainframe Solutions webpage.