To connect AI agents to legacy systems and ERP, you expose each system through a governed integration layer, then let the agent call those systems as tools rather than rewriting the systems themselves. In practice that means one of five patterns, chosen per system: an API facade over the application, a standardized tool interface such as a Model Context Protocol (MCP) server or unified API, event-driven middleware, an RPA bridge for applications with no API, or an ETL pipeline into a modern store the agent can query. The right choice depends on whether the system has a usable API, how fresh the data must be, and how tightly the action must be governed.

This guide is written for IT directors, enterprise architects, and operations leaders who have a working AI pilot that breaks the moment it has to touch the CRM, the finance system, and the ERP everyone is afraid to modify. The bottleneck is almost never the model. It is the plumbing. Below is how to connect those systems without a rip-and-replace, what each pattern costs you in effort and risk, and how to keep the whole thing auditable.

Key Takeaways

• The model is rarely the blocker; integration is. A Zapier survey of enterprise leaders found 78% are struggling to integrate AI with their existing systems even though 92% treat AI as a priority.
• You do not need to replace the ERP. The proven approach is to add a governed middle layer so legacy and AI coexist, each doing what it does best.
• There are five repeatable integration patterns. API facade, standardized tool interface (MCP / unified API), event-driven middleware, RPA bridge, and ETL to a modern store — most production systems combine two or three.
• MCP is becoming the default wiring. The open standard that lets an agent reach external systems through one interface, adopted across the major AI platforms, which makes it a governance decision as much as a technical one.
• Governance belongs at the integration chokepoint. Routing every agent action through one controlled tool layer is what makes least-privilege access, approvals, and audit logs enforceable.
• Readiness, not model choice, decides success. Data access, API availability, identity, and clear ownership determine whether a pilot ships or stalls.

The short answer: how AI agents connect to legacy systems and ERP

An AI agent does not connect to a legacy system directly. It connects to a tool — a governed, described interface that the agent is allowed to call — and that tool connects to the system. Your job is to build or expose the right tool for each system, using the pattern that fits that system's reality.

The five patterns, in plain terms:

• API facade: Wrap the application's existing API (or a thin new service over its database) so the agent calls clean, modern endpoints.
• Standardized tool interface: Expose capabilities through an MCP server or a unified API gateway so any agent can discover and invoke them without bespoke point-to-point code.
• Event-driven middleware: Use an integration or iPaaS layer so the agent reacts to events (a new order, a stock threshold) instead of polling.
• RPA bridge: For green-screen, desktop, or no-API applications, drive the UI with robotic process automation and present that as a tool.
• ETL to a modern store: Move data into a lakehouse or database the agent can query when real-time write-back is not required.

Why do AI agents stall when they hit legacy systems and ERP?

Because the systems that matter most — the ones holding your orders, claims, and customer records — are usually the hardest to connect to, and replacing them is not realistic in the short term. A pilot that dazzles in a demo quietly stops scaling once it has to read the CRM, write to finance, and reconcile against an ERP customization that only two people understand. Leadership reads that as an AI problem; it is an integration problem.

The numbers back this up. Pega's 2025 research found 68% of IT decision-makers say legacy systems are stopping their organization from fully embracing AI, and fragmented environments are markedly more likely to hit implementation delays. McKinsey frames the same problem at the ERP layer as a "great divide": investment is flowing into AI while the core systems AI needs to act on are starved of the modernization that would let agents thrive.

There are three recurring reasons agents break at the legacy boundary. First, no usable interface — older systems emit flat files or SOAP endpoints, not clean REST APIs. Second, data that is not agent-ready — fragmented, undocumented, or lacking the business context an agent needs to reason instead of hallucinate. Third, no governance model for an entity that can take action across systems at machine speed, which stalls the project in security review.

What are the integration patterns for connecting AI agents to legacy systems?

Five patterns show up repeatedly in real deployments. They are not mutually exclusive — most production architectures combine them, choosing one per system based on API availability, data freshness, and governance needs.

The five AI-agent integration patterns compared

API facade / wrapper layer

• Best for: Systems with an existing or buildable API — modern ERPs, CRMs, custom apps.
• Trade-off: Cleanest and most testable; requires the system to expose something callable.

Standardized tool interface (MCP / unified API)

• Best for: Scaling many agents across many systems without rewriting an integration each time.
• Trade-off: Eliminates point-to-point sprawl and centralizes governance; depends on mature gateway tooling.

Event-driven middleware (iPaaS / ESB)

• Best for: Real-time reactions to business events across multiple systems.
• Trade-off: Resilient and decoupled; adds an integration platform to own and operate.

RPA bridge

• Best for: Green-screen, mainframe, or desktop applications with no API at all.
• Trade-off: Connects the genuinely unconnectable; brittle to UI changes, so treat it as a last resort.

ETL to a modern store

• Best for: Read-heavy analysis where near-real-time write-back is not required.
• Trade-off: Fast to stand up and query; introduces data latency and a copy to govern.

The deciding variable is simple: does the system have a usable API, and does the action need to be real-time and governed? If yes to both, favor an API facade behind a standardized tool interface. If there is no API, an RPA bridge keeps you moving while a proper interface is built. WSO2's architecture team makes the core point well — the answer is to introduce a middle integration layer and let legacy and modern systems coexist rather than treating replacement as a prerequisite.

The model was never the hard part; the twenty-year-old system it has to touch is.

This is where most integration programs are won or lost, and it is the work BabyBots does day in and day out. We run fixed-fee integration readiness assessments that map each target system to the right pattern, flag the identity and data gaps before they stall a security review, and hand you a costed architecture instead of a science project. The goal is a path to production, not another promising demo.

How do you connect an AI agent to SAP or another ERP?

For the Microsoft-centric enterprises BabyBots works with, the ERP question usually lands on Copilot Studio and SAP. There are two broad routes, and Microsoft documents both. The first is the connector route: the SAP ERP connector, used through Power Platform, lets flows read and write SAP data — but it depends on an on-premises data gateway and specific prerequisites, so it is an infrastructure decision, not a checkbox. Microsoft Learn's Copilot Studio with SAP overview lays out which option fits which landscape.

The second is the standardized-tool route: exposing SAP capabilities through an MCP gateway so a Copilot Studio agent can discover and invoke SAP business functions as governed tools — without point-to-point integration code and without moving SAP data out of its system of record. Note that SAP's Agent Gateway for this pattern is not yet generally available, so confirm current status before you commit an architecture. For the full SAP-specific walkthrough, see our deep-dive guide on integrating SAP with Microsoft Copilot and Power Platform. The same logic — connector for speed, standardized tool interface for scale — applies to Oracle, Dynamics, and most core ERPs.

Is your environment ready? An integration readiness checklist

Before you connect anything, work through these in order. A pilot stalls far more often on readiness than on the model.

1. Inventory the target systems: List every system the agent must read from or write to, and whether each has an API, an events feed, or neither.
2. Assess the data: Confirm the data the agent needs is accessible, documented, and carries enough business context to be used without guessing.
3. Map identity and permissions: Decide how the agent authenticates to each system and what least-privilege scope it gets — agents are non-human identities and must be governed like one.
4. Choose a pattern per system: Match each system to API facade, standardized tool, event-driven, RPA bridge, or ETL based on API availability and freshness needs.
5. Define the governance chokepoint: Route every agent action through one controlled tool layer so approvals, logging, and policy are enforced in one place.
6. Set exit gates: Decide what "production-ready" means per workflow — accuracy, human-in-the-loop points, and rollback — before you scale.

How do you govern AI agents that touch core systems?

The moment an agent can act inside your ERP, it becomes a security and compliance question, not just an engineering one. The practical answer is to centralize execution: funnel every tool call through a single governed chokepoint so you can enforce least-privilege access, require human approval for sensitive actions, and keep an auditable record of what the agent did and why.

This is also why the standardized-tool route matters beyond convenience. Because MCP and unified gateways define one consistent interface between agents and systems, they become the place where access policy lives — a deliberate governance decision about what each agent can reach. Treat agents like a new class of workforce identity: a verified identity, a defined role, task-scoped permissions, and oversight that increases as autonomy and consequence increase.

Frequently Asked Questions

Do I have to replace my legacy systems to use AI agents?

No. The established approach is to augment, not replace. You add a governed integration layer — APIs, standardized tools, events, or an RPA bridge — that lets AI agents read and act on legacy data while the underlying systems keep running. Replacement is a multi-year program; integration can deliver value in weeks to months per workflow.

What is MCP and why does it matter for legacy integration?

The Model Context Protocol is an open standard that lets an AI agent connect to external data, tools, and systems through one consistent interface instead of a bespoke integration for each. It has been described as a "USB-C port for AI applications" and has been adopted across the major AI platforms. For legacy integration it matters because it reduces point-to-point sprawl and centralizes where you govern agent access.

How do AI agents connect to systems that have no API, like a mainframe?

Use an RPA bridge. Robotic process automation drives the application's user interface the way a person would — logging in, navigating screens, reading and entering data — and you present that automation to the agent as a callable tool. It is brittle to UI changes, so treat it as a bridge while a proper API facade is built, not a permanent foundation.

Is it safe to let an AI agent write to our ERP?

It can be, if write actions are governed. Route them through a single controlled tool layer, grant the agent least-privilege scope, require human approval for high-consequence transactions, and log every action for audit. Many teams start read-only, prove reliability, then enable scoped write-back once governance and exit gates are in place.

Why do most AI pilots fail at the integration stage?

Because integration work is routinely underestimated. The systems that hold the most valuable data are the oldest and least connectable, the data inside them often is not agent-ready, and no one defined how the agent would authenticate or be governed. A Zapier survey found 78% of enterprises struggle to integrate AI with legacy systems — the plumbing, not the model, is what stalls.

How long does it take to connect an AI agent to an ERP?

It varies by pattern and system. A read-only connection over an existing API can be stood up in weeks; a governed, write-enabled integration across a complex ERP landscape with identity and compliance requirements is a multi-month effort. The biggest schedule risk is discovering mid-project that a target system has no usable interface, which is exactly what a readiness assessment surfaces early.

Where this is heading

The direction of travel is clear: standardized tool interfaces like MCP are becoming the default wiring between agents and enterprise systems, and vendors from Microsoft to SAP are building gateways that expose core business functions as governed tools. That shift lowers the cost of each new integration and moves the hard problem where it belongs — to data readiness and governance. The enterprises that win will not be the ones with the best model; they will be the ones that invested in integration architecture first.

Book a BabyBots integration assessment

If you have a pilot that works until it touches your ERP, the fix is an architecture, not another prompt. Book a BabyBots integration readiness assessment — in a single working session we map each target system to the right pattern, surface the identity, data, and governance gaps that stall security review, and hand you a costed path to production. Fixed fee, asset-first, no staff-aug drip.

Sources

• Zapier — 78% of enterprises are struggling to integrate AI with legacy systems (2025)
• Avatar Studios — Legacy systems are blocking your AI rollout (reporting Pega 2025 research)
• McKinsey — Bridging the great AI agent and ERP divide (2026)
• Model Context Protocol — Official documentation: what is MCP
• SAP Architecture Center — Copilot Studio and the MCP Gateway in SAP Integration Suite (2026)
• Microsoft Learn — Copilot Studio with SAP: overview and integration patterns
• Microsoft Learn — SAP ERP connector and on-premises data gateway setup
• WSO2 — Connecting legacy systems to AI agents: integration architecture strategies (2026)