My question is: Is SA implemented when using AH and ESP protocols, or
only in ESP when confidentiality is required?
SA is also required in AH. To quote RFC 4302:
3.3.1. Security Association Lookup
AH is applied to an outbound packet only after an IPsec implementation determines that the packet is associated with an SA that calls for AH processing.
There's no AH unless the SA says so; therefore AH requires an SA.
How does the router know whether to use IPsec or not? By using the
protocol field in the ip header?
Correct, IPSec runs over IP protocols 50 (ESP) and 51 (AH), as opposed to protocol 6 (TCP) or 17 (UDP) for more normal traffic.
More information about Security Associations and IP Traffic Processing can be found in the Security Architecture document, RFC 4301. For example, section 4.1 of that document reiterates that AH requires SA in a more roundabout way:
Security services are afforded to an SA by the use of AH, or ESP, but
not both. If both AH and ESP protection are applied to a traffic
stream, then two SAs must be created and coordinated to effect
protection through iterated application of the security protocols.