Sourcing Speak

MCP Connectors: Mitigating the Risks of AI Agents in a Connected Architecture

Mia Rendar, Samuel C. Markel and Andrew Caplan — Wed, 15 Apr 2026 21:51:30 +0000

In the most recent installment of our series on Model Context Protocol (MCP) connectors, we closed with this observation: Organizations that will manage MCP connector technology effectively are those that treat deployment as an enterprise risk concern. We promised a practical starting framework for how to think about mitigating those enterprise risks.

In this installment, we provide that framework through a hypothetical (and associated risk incidents) that illustrate how the risks may manifest in practice, annotated with suggested mitigants that may have prevented—or meaningfully limited—each issue.

Stateful AI: What to Remember in the Shift to AI That Remembers

Mia Rendar and Austin Chegini — Wed, 18 Mar 2026 17:44:14 +0000

Providers have recently moved towards enabling AI agents to maintain persistent context and memory across interactions rather than treating each request as an isolated event. The environment makes it easier for enterprise AI systems to be designed to remember data and materials input and output from the tool.

MCP Connectors: Legal and Operational Risks

Mia Rendar, Samuel C. Markel and Michael McCann — Fri, 06 Mar 2026 20:16:05 +0000

Any time a new technology emerges that includes the ability for an AI model to autonomously “reach out and interact with the world,” legal and operations teams take notice. And rightly so, the legal and operational implications of any AI autonomy deserve careful consideration. MCP connectors are powerful precisely because they reduce friction between AI models and databases, and between each prompt and the resulting action, resulting in a proliferation of agentic AI. But reduced friction cuts both ways. The same architecture that makes MCP efficient also makes it a meaningful source of risk that requires appropriate governance.

Below, we examine the key legal and operational risks that an organization should consider before and during any MCP connector deployment in its AI portfolio. It is worth noting that risks inherent in generative AI use more broadly persist when an MCP connector conduits to an LLM, but the below analysis focuses on the risk specific to the new MCP connection infrastructure.

Model Context Protocol (MCP) and Connectors: A Primer

Mia Rendar, Samuel C. Markel and Michael McCann — Fri, 06 Mar 2026 19:06:31 +0000

We all remember the first time we beheld the majestic power of generative AI. It plans vacations! It drafts my emails! It writes my essays! … then you accidentally include “Would you like me to soften the breakup message I drafted for you to be less confrontational?” in the text you send to your now ex- and highly offended partner, and you realize quickly the glaring limitation that a large language model (LLM) has on making you more productive. The model could give you the words, but it couldn’t act on them to fix your problems. And so, agents came along, which we thought would fix the inefficiency of copying and pasting a text response. But technically, these tools were hard to scale because every connection was custom-built, one at a time. Want Claude to talk to Slack? Build a custom bridge. Want ChatGPT to talk to Google Drive? Build another custom bridge. In reality, these tools weren’t scaling in the way we thought would drive efficiency. Your dreams of building an autonomous breakup robot were just not coming to fruition.

That is until Anthropic came up with a solution. Enter the Model Context Protocol (MCP), a standardized language that allows integration of LLMs into existing data source and application structures.

Digital Omnibus: European Commission Position on Changes to EU Digital Rules

Steven Farmer, Scott Morton and Mark Booth — Mon, 22 Dec 2025 17:28:49 +0000

The European Commission has published its regulatory proposal for the EU Digital Omnibus, a package of amendments seeking to streamline EU rules on data protection, artificial intelligence and digital regulation in an effort to improve EU competitiveness. For more information on the background to the Digital Omnibus, see our earlier briefing here. The Digital Omnibus is split into two regulations, one targeting the AI Act and another targeting other EU digital regulations.

From a Thousand Flowers to Nipping It in the Bud: What J&J Teaches Us About Evaluating AI Use Cases

Mia Rendar — Tue, 11 Nov 2025 20:00:42 +0000

“Let a thousand flowers bloom” used to be Johnson & Johnson’s strategy to generative AI innovation. In short order, nearly 900 projects sprouted across the company.

But subsequent internal review revealed that only 10–15% of those projects produced 80% of the value. In response, J&J pivoted. It narrowed its focus to high-impact use cases, and scrapped the rest. These remaining efforts were tightly aligned with business strategy, execution quality and adoption.

Quantum‑as‑a‑Service: Contracting for the Next Wave of Cloud Computing

Andrew Caplan and Sam Reno — Mon, 10 Nov 2025 15:24:19 +0000

Quantum-as-a-Service (QaaS) has moved from lab curiosity to real-world adoption. The inflection point isn’t that enterprises will own quantum computers anytime soon; it’s that usable quantum capacity is becoming accessible through cloud platforms, and leading firms are reporting production-adjacent use cases in real workflows.

The EU Data Act: Scope, Obligations and Enforcement

Steven Farmer, Lee Rubin, Scott Morton, Mark Booth and Johanna Lipponen — Wed, 17 Sep 2025 14:59:06 +0000

Regulation (EU) 2023/2854 (the Data Act) entered into force on January 11, 2024, and applied from September 12, 2025, with certain provisions phased in through 2026 and 2027. The Data Act is intended to create a harmonized framework for fair access to and use of data across the EU, supplementing the GDPR and sector-specific rules. The Data Act also includes specific requirements on providers of a “data processing service” to enable customers to switch to another provider (or to an on-premise solution)—this is likely to have a significant impact on the global cloud market.

Sustaining and Modernizing Mainframe Systems in the Global Economy

Pillsbury's Global Sourcing Team — Mon, 15 Sep 2025 19:13:02 +0000

Mainframe computers are the backbone of many global industries, and integral to industry sectors such as finance, health care, transportation and government. However, the personnel trained to manage these systems are aging out of the workforce while mainframes are not—they continue to provide unmatched reliability, resiliency and security. In Sustaining and Modernizing Mainframe Systems in the Global Economy, colleagues Aaron M. Oser, Philip T. Evans, Roger C. Roy Jr. and Brittney D. Sandler break down the resulting and growing challenge of ensuring continuity of expertise while managing escalating software licensing costs due to vendor practices.

Read the white paper here.

EU AI Act at the Crossroads: GPAI Rules, AI Literacy Guidance and Potential Delays

Steven Farmer, Scott Morton and Mark Booth — Mon, 07 Jul 2025 14:33:32 +0000

The EU AI Act (AI Act), effective since February 2025, introduces a risk-based regulatory framework for AI systems and a parallel regime for general-purpose AI (GPAI) models. It imposes obligations on various actors, including providers, deployers, importers and manufacturers, and requires that organizations ensure an appropriate level of AI literacy among staff. The AI Act also prohibits “unacceptable risk” AI use cases and imposes rigorous requirements on “high-risk” systems. For a comprehensive overview of the AI Act, see our earlier client alert.