import { classify, obligations } from '@eu/ai-act'; // Regolamento (UE) 2024/1689import { classify, obligations } from '@eu/ai-act'; // Regolamento (UE) 2024/1689import { classify, obligations } from '@eu/ai-act'; // Regolamento (UE) 2024/1689import { classify, obligations } from '@eu/ai-act'; // Regolamento (UE) 2024/1689import { classify, obligations } from '@eu/ai-act'; // Regolamento (UE) 2024/1689import { classify, obligations } from '@eu/ai-act'; // Regolamento (UE) 2024/1689

const system = inventory.find((s) => s.name === 'chatbot-assistenza'); // art. 50: trasparenzaconst system = inventory.find((s) => s.name === 'chatbot-assistenza'); // art. 50: trasparenzaconst system = inventory.find((s) => s.name === 'chatbot-assistenza'); // art. 50: trasparenzaconst system = inventory.find((s) => s.name === 'chatbot-assistenza'); // art. 50: trasparenzaconst system = inventory.find((s) => s.name === 'chatbot-assistenza'); // art. 50: trasparenzaconst system = inventory.find((s) => s.name === 'chatbot-assistenza'); // art. 50: trasparenza

const role = system.provider === company ? 'fornitore' : 'utilizzatore'; // art. 3const role = system.provider === company ? 'fornitore' : 'utilizzatore'; // art. 3const role = system.provider === company ? 'fornitore' : 'utilizzatore'; // art. 3const role = system.provider === company ? 'fornitore' : 'utilizzatore'; // art. 3const role = system.provider === company ? 'fornitore' : 'utilizzatore'; // art. 3const role = system.provider === company ? 'fornitore' : 'utilizzatore'; // art. 3

if (risk === 'vietato') throw new Error('Pratica vietata dal 2 febbraio 2025');if (risk === 'vietato') throw new Error('Pratica vietata dal 2 febbraio 2025');if (risk === 'vietato') throw new Error('Pratica vietata dal 2 febbraio 2025');if (risk === 'vietato') throw new Error('Pratica vietata dal 2 febbraio 2025');if (risk === 'vietato') throw new Error('Pratica vietata dal 2 febbraio 2025');if (risk === 'vietato') throw new Error('Pratica vietata dal 2 febbraio 2025');

if (risk === 'alto') await obligations.highRisk(role, { from: '2027-12-02' });if (risk === 'alto') await obligations.highRisk(role, { from: '2027-12-02' });if (risk === 'alto') await obligations.highRisk(role, { from: '2027-12-02' });if (risk === 'alto') await obligations.highRisk(role, { from: '2027-12-02' });if (risk === 'alto') await obligations.highRisk(role, { from: '2027-12-02' });if (risk === 'alto') await obligations.highRisk(role, { from: '2027-12-02' });

await notice.show('Stai parlando con un assistente virtuale basato su AI');await notice.show('Stai parlando con un assistente virtuale basato su AI');await notice.show('Stai parlando con un assistente virtuale basato su AI');await notice.show('Stai parlando con un assistente virtuale basato su AI');await notice.show('Stai parlando con un assistente virtuale basato su AI');await notice.show('Stai parlando con un assistente virtuale basato su AI');

await training.log({ team: 'marketing', topic: 'alfabetizzazione AI', art: 4 });await training.log({ team: 'marketing', topic: 'alfabetizzazione AI', art: 4 });await training.log({ team: 'marketing', topic: 'alfabetizzazione AI', art: 4 });await training.log({ team: 'marketing', topic: 'alfabetizzazione AI', art: 4 });await training.log({ team: 'marketing', topic: 'alfabetizzazione AI', art: 4 });await training.log({ team: 'marketing', topic: 'alfabetizzazione AI', art: 4 });

const decision = await human.review(cv); // D.Lgs. 179/2026, art. 41const decision = await human.review(cv); // D.Lgs. 179/2026, art. 41const decision = await human.review(cv); // D.Lgs. 179/2026, art. 41const decision = await human.review(cv); // D.Lgs. 179/2026, art. 41const decision = await human.review(cv); // D.Lgs. 179/2026, art. 41const decision = await human.review(cv); // D.Lgs. 179/2026, art. 41

await workers.inform({ tool: system.name, legge: '132/2025', art: 11 });await workers.inform({ tool: system.name, legge: '132/2025', art: 11 });await workers.inform({ tool: system.name, legge: '132/2025', art: 11 });await workers.inform({ tool: system.name, legge: '132/2025', art: 11 });await workers.inform({ tool: system.name, legge: '132/2025', art: 11 });await workers.inform({ tool: system.name, legge: '132/2025', art: 11 });

const fine = Math.min(35_000_000, revenue * 0.07); // PMI: il più basso, art. 99const fine = Math.min(35_000_000, revenue * 0.07); // PMI: il più basso, art. 99const fine = Math.min(35_000_000, revenue * 0.07); // PMI: il più basso, art. 99const fine = Math.min(35_000_000, revenue * 0.07); // PMI: il più basso, art. 99const fine = Math.min(35_000_000, revenue * 0.07); // PMI: il più basso, art. 99const fine = Math.min(35_000_000, revenue * 0.07); // PMI: il più basso, art. 99

await dvr.add({ system: system.name, impatto: 'organizzazione del lavoro' }); // art. 42await dvr.add({ system: system.name, impatto: 'organizzazione del lavoro' }); // art. 42await dvr.add({ system: system.name, impatto: 'organizzazione del lavoro' }); // art. 42await dvr.add({ system: system.name, impatto: 'organizzazione del lavoro' }); // art. 42await dvr.add({ system: system.name, impatto: 'organizzazione del lavoro' }); // art. 42await dvr.add({ system: system.name, impatto: 'organizzazione del lavoro' }); // art. 42

await client.inform({ studio: true, strumenti: ['assistente di ricerca'] }); // art. 13await client.inform({ studio: true, strumenti: ['assistente di ricerca'] }); // art. 13await client.inform({ studio: true, strumenti: ['assistente di ricerca'] }); // art. 13await client.inform({ studio: true, strumenti: ['assistente di ricerca'] }); // art. 13await client.inform({ studio: true, strumenti: ['assistente di ricerca'] }); // art. 13await client.inform({ studio: true, strumenti: ['assistente di ricerca'] }); // art. 13

export default compliance.by({ design: true, deadline: '2027-12-02' });export default compliance.by({ design: true, deadline: '2027-12-02' });export default compliance.by({ design: true, deadline: '2027-12-02' });export default compliance.by({ design: true, deadline: '2027-12-02' });export default compliance.by({ design: true, deadline: '2027-12-02' });export default compliance.by({ design: true, deadline: '2027-12-02' });

import { classify, obligations } from '@eu/ai-act';                         // Regolamento (UE) 2024/1689
const system = inventory.find((s) => s.name === 'chatbot-assistenza');        // art. 50: trasparenza
const role = system.provider === company ? 'fornitore' : 'utilizzatore';      // art. 3
const risk = classify(system, { annexIII: true, profiling: false });          // art. 6
if (risk === 'vietato') throw new Error('Pratica vietata dal 2 febbraio 2025');
if (risk === 'alto') await obligations.highRisk(role, { from: '2027-12-02' });
await notice.show('Stai parlando con un assistente virtuale basato su AI');
await training.log({ team: 'marketing', topic: 'alfabetizzazione AI', art: 4 });
const decision = await human.review(cv);                                      // D.Lgs. 179/2026, art. 41
await workers.inform({ tool: system.name, legge: '132/2025', art: 11 });
const fine = Math.min(35_000_000, revenue * 0.07);                            // PMI: il più basso, art. 99
await dvr.add({ system: system.name, impatto: 'organizzazione del lavoro' }); // art. 42
await client.inform({ studio: true, strumenti: ['assistente di ricerca'] }); // art. 13
export default compliance.by({ design: true, deadline: '2027-12-02' });
import { classify, obligations } from '@eu/ai-act';                         // Regolamento (UE) 2024/1689
const system = inventory.find((s) => s.name === 'chatbot-assistenza');        // art. 50: trasparenza
const role = system.provider === company ? 'fornitore' : 'utilizzatore';      // art. 3
const risk = classify(system, { annexIII: true, profiling: false });          // art. 6
if (risk === 'vietato') throw new Error('Pratica vietata dal 2 febbraio 2025');
if (risk === 'alto') await obligations.highRisk(role, { from: '2027-12-02' });
await notice.show('Stai parlando con un assistente virtuale basato su AI');
await training.log({ team: 'marketing', topic: 'alfabetizzazione AI', art: 4 });
const decision = await human.review(cv);                                      // D.Lgs. 179/2026, art. 41
await workers.inform({ tool: system.name, legge: '132/2025', art: 11 });
const fine = Math.min(35_000_000, revenue * 0.07);                            // PMI: il più basso, art. 99
await dvr.add({ system: system.name, impatto: 'organizzazione del lavoro' }); // art. 42
await client.inform({ studio: true, strumenti: ['assistente di ricerca'] }); // art. 13
export default compliance.by({ design: true, deadline: '2027-12-02' });
import { classify, obligations } from '@eu/ai-act';                         // Regolamento (UE) 2024/1689
const system = inventory.find((s) => s.name === 'chatbot-assistenza');        // art. 50: trasparenza
const role = system.provider === company ? 'fornitore' : 'utilizzatore';      // art. 3
const risk = classify(system, { annexIII: true, profiling: false });          // art. 6
if (risk === 'vietato') throw new Error('Pratica vietata dal 2 febbraio 2025');
if (risk === 'alto') await obligations.highRisk(role, { from: '2027-12-02' });
await notice.show('Stai parlando con un assistente virtuale basato su AI');
await training.log({ team: 'marketing', topic: 'alfabetizzazione AI', art: 4 });
const decision = await human.review(cv);                                      // D.Lgs. 179/2026, art. 41
await workers.inform({ tool: system.name, legge: '132/2025', art: 11 });
const fine = Math.min(35_000_000, revenue * 0.07);                            // PMI: il più basso, art. 99
await dvr.add({ system: system.name, impatto: 'organizzazione del lavoro' }); // art. 42
await client.inform({ studio: true, strumenti: ['assistente di ricerca'] }); // art. 13
export default compliance.by({ design: true, deadline: '2027-12-02' });

MCP

MCP explained:
what the Model Context Protocol means for companies

The Model Context Protocol (MCP) is an open standard for connecting AI applications such as Claude, ChatGPT, Copilot and Gemini to company systems: documents, databases, your CRM or ERP. You build a connector once (an MCP server) and every compatible assistant can use it, within the permissions you set.

Anthropic launched MCP in November 2024 and the Linux Foundation has hosted it since December 2025. This guide covers how it works, who supports it as of 12 November 2026, what the 28 July 2026 specification changes, examples by team, the risks flagged by the NSA and OWASP, the EU rules that apply and 6 steps to start.

By Cesare D'Adamo/Updated 12 November 2026/10 min read

Book a free consultation All guides

In this guide

01What is MCP (Model Context Protocol)?
02How does MCP work? Hosts, clients and servers
03Who supports MCP in 2026: ChatGPT, Claude, Copilot and Gemini
04What changed in the 2026-07-28 MCP specification?
05MCP use cases for business, team by team
06Is MCP secure? Risks and how to reduce them
07MCP and EU rules: AI Act and GDPR
08How to start with MCP in your company: 6 steps
09Frequently asked questions

What is MCP (Model Context Protocol)?

MCP is a protocol: a shared set of rules an AI application uses to request data or actions from another system. The official documentation describes it as an open-source standard for connecting AI applications to external systems, and compares it to a USB-C port: one plug instead of many different cables.

The problem it solves is practical. When Anthropic introduced MCP on 25 November 2024, it put it plainly: "Every new data source requires its own custom implementation." With MCP, whoever owns the data writes a server, whoever builds the assistant writes a client, and the two simply work together.

Aspect	Custom integration	With MCP
Who builds it	Your team or a vendor, for every pair of assistant and system	The software vendor (official server) or your team, once
If you switch AI assistant	You rebuild the integration	You reuse the same server with another compatible assistant
What the AI can do	Whatever the code allows	The tools the server exposes, within the account's permissions
Controls	Designed from scratch each time	Standard authorization (OAuth), user confirmations and call logs

How does MCP work? Hosts, clients and servers

MCP has three roles. The host is the AI application you use, such as Claude, ChatGPT, Copilot Studio or VS Code. Inside the host, a client keeps a connection to each server, the program that exposes a system's data and actions. A server can run on your computer (a local server) or as a web service run by the vendor (a remote server), the usual setup in companies.

A server offers three kinds of building blocks: tools, actions such as looking up a customer or drafting an invoice; resources, data to read such as a file or a record; and prompts, reusable instruction templates. The model sees the list of tools with their descriptions and picks one; the host makes the call and returns the result.

01RequestWhich customers have invoices overdue by more than 60 days?
02AI hostClaude, ChatGPT or Copilot picks the right tool
03MCP clientSends the call to the server with the user's credentials
04MCP serverQueries the ERP and runs only the actions it exposes
05AnswerThe result comes back to the chat; changes need approval

How a request travels through MCP. Simplified from the official architecture overview, version 2026-07-28.

For a company this means the AI can only do what the server exposes and the connected account allows. The limits live there, not in the prompt.

Who supports MCP in 2026: ChatGPT, Claude, Copilot and Gemini

Every major AI assistant supports MCP. On 9 December 2025 Anthropic contributed it to the Linux Foundation's new Agentic AI Foundation, launched with AWS, Anthropic, Block, Bloomberg, Cloudflare, Google, Microsoft and OpenAI as platinum members. At that point the foundation counted more than 10,000 published MCP servers and named ChatGPT, Claude, Cursor, Gemini, Microsoft Copilot and VS Code among the adopters.

25 November 2024Anthropic introduces MCP as an open standard
9 December 2025MCP moves to the Agentic AI Foundation (Linux Foundation)
26 January 2026MCP Apps: interactive interfaces inside the chat
28 April 2026Google Cloud: more than 50 managed MCP servers
28 July 2026Specification 2026-07-28: a stateless protocol
4 and 10 November 2026Adobe across assistants, new interactive connectors in Claude
28 July 2027Earliest date to remove deprecated features

MCP milestones. Sources: Anthropic, Linux Foundation, official MCP blog, Google Cloud, Adobe, Agentic AI Foundation.

ChatGPT: remote MCP servers can be added as custom apps or plugins. OpenAI says it does not verify them, and ChatGPT asks for manual confirmation before write actions.
Claude: custom connectors over remote MCP are available on all plans, with one connector on the Free plan; on Team plans only Owners can add them. On 10 November 2026 Anthropic added interactive connectors such as Adobe and Atlassian that open inside the chat.
Microsoft Copilot Studio: MCP support has been generally available since 29 May 2025, with tracing that shows which server and tool an agent used.
Google Cloud: since 28 April 2026 it offers more than 50 Google-managed MCP servers, generally available or in preview, including BigQuery, Cloud SQL and Workspace (Gmail, Drive, Calendar, Chat).

Official figures show the growth: the MCP Registry had close to 2,000 entries on 25 November 2025, and on 28 July 2026 the maintainers reported close to half a billion monthly downloads for the main SDKs.

What changed in the 2026-07-28 MCP specification?

Version 2026-07-28 makes MCP easier to run as an enterprise service at scale. The headline change is a stateless protocol: the opening handshake and session IDs are gone, every request carries its own version and capabilities, so any server in a pool can answer, like a normal web service behind a load balancer.

Official extensions: MCP Apps (since 26 January 2026) renders interactive interfaces in the chat inside a sandboxed frame; Tasks handles long-running jobs whose result you fetch later.
Stronger authorization: stricter OAuth checks, plus Enterprise-Managed Authorization, which lets IT assign server access centrally.
Deprecations with notice: Roots, Sampling, Logging, dynamic client registration and the old HTTP+SSE transport keep working for at least 12 months.

What to do: ask the vendors behind your servers which version they support and when they will migrate. Servers still on HTTP+SSE have a one-year off-ramp.

MCP use cases for business, team by team

The first benefit of MCP is an assistant that works on live company data instead of copy and paste between systems.

Team	What the MCP server connects	What to keep under control
Sales and marketing	CRM, analytics and campaigns: summaries, segments, email drafts	Sends to customers and data changes
Finance	ERP and invoicing: due dates, checks, draft documents	Issuing invoices, e-invoicing submissions, payments
Customer service	Ticketing and knowledge base: answers with sources, routing	Refunds and commitments to customers
Data and leadership	Databases and warehouses such as BigQuery: questions in plain language	Read-only access, personal data
Projects and IT	Jira, Confluence, GitHub, Slack: work status and documentation	Write permissions and secrets

Watch for unofficial servers. A community MCP server for Fatture in Cloud, a popular Italian invoicing tool, says on PyPI that it is not affiliated with the vendor, yet version 2.0.0 (1 September 2026) can create drafts and submit invoices to Italy's e-invoicing exchange. Before connecting any server, know who maintains it, where data goes and which actions to enable.

The next step is AI agents for business, which chain several MCP servers to finish a task on their own.

Is MCP secure? Risks and how to reduce them

MCP is as secure as the servers you connect and the permissions you grant: the protocol defines authorization and best practices, but the AI acts with the credentials you give it.

On 20 May 2026 the NSA published security design considerations for MCP: authentication, authorization and input validation are necessary but not sufficient, and high-stakes deployments call for caution. The OWASP Top 10 for Agentic Applications (9 December 2025) ranks agentic supply chain vulnerabilities fourth, meaning third-party components, such as MCP servers, that can be poisoned or compromised.

Prompt injection: hidden instructions in an email, document or web page read through a server push the AI to use other tools. OpenAI notes that trusting the developer is not enough if the server reads untrusted content.
Servers that change: Anthropic warns that a server can change how its tools behave without notice.
Over-broad permissions: a stolen token with full access opens everything. The MCP documentation recommends starting with minimal scopes and asking for more only when needed.
Local servers: a server installed on a laptop runs with the user's privileges; the client must show the exact command and ask for consent before running it.

The controls exist: on Claude Enterprise plans admins can restrict what a connector does, for example read Slack but not post; Google's managed servers add IAM deny policies, audit logs and Model Armor against prompt injection.

MCP and EU rules: AI Act and GDPR

MCP has no rulebook of its own: the rules follow the AI system that uses it and the data that flows through it. The European Commission says AI agents, which act for example by issuing function calls, are not a separate AI Act category. For the full picture, see what the EU AI Act requires of companies.

Rule	What it means with MCP	From
AI Act, Article 4	People who set up and use connectors need sufficient AI literacy	2 February 2025
AI Act, Article 50	If the assistant talks to customers or generates content, transparency duties apply	2 August 2026
GDPR, Article 28	If a remote server's vendor processes personal data on your behalf, you need sufficient guarantees and a contract	Already in force
GDPR, Article 32	Security appropriate to the risk: permissions, encryption, regular testing	Already in force

In practice: keep an inventory of connected servers as you do for software vendors, check where they are hosted and what they log, and include connector use in your AI literacy measures.

How to start with MCP in your company: 6 steps

Start from a business question, not from the protocol.

01Pick one use case that today means opening several systems, such as a customer's status across CRM, tickets and invoices.
02Look for the vendor's official server. The official MCP Registry, still in preview, verifies publishers through their domain or GitHub account but leaves security scanning of the code to others.
03Use the host you already have, Claude, ChatGPT, Copilot or Gemini, and check that your plan lets admins manage connectors for the whole company.
04Set minimal permissions: a dedicated account, read-only at first, confirmation for every write, no access to payments.
05Test with real but non-critical data, including documents that hide instructions, and review the call logs.
06Govern it over time: a register of servers with an owner, periodic permission reviews and a migration plan to the 2026-07-28 specification.

If your ERP has no official server, you can build one with the official SDKs, with authorization and logging designed in from day one. That is the kind of work an AI transformation program covers, and choosing the first servers to connect is a good topic for a free first consultation. If nobody inside can own it yet, an interim or fractional leader can set it up and hand it over.

Free consultation

Want to apply this to your company?

In a free first call we look at your situation and I tell you where I would start, with which tools and what results to expect.

Book a free consultation Services

Frequently asked questions

What is an MCP server?

An MCP server is a program that gives an AI application access to a system's data and actions, such as a CRM or a database. It can run on your computer or, more often in companies, as a web service run by the vendor.

Is MCP free to use?

Yes, the protocol is open source and hosted by the Linux Foundation. You pay for the AI assistant that uses it, any vendor service behind the server, and the work to configure or build servers.

What is the difference between MCP and an API?

An API is the interface of one piece of software and differs from vendor to vendor. MCP is a common layer on top of APIs: the server describes its actions in a standard way, so any compatible assistant can discover and use them.

Does ChatGPT support MCP?

Yes. You can add remote MCP servers to ChatGPT as custom apps or plugins, and ChatGPT asks for manual confirmation before write actions.

Do I need a developer to use MCP?

Not to connect an official server to Claude or ChatGPT: an admin of the business plan adds the server address and each user authorizes their own access. Building a server for a system that has none takes technical skills.

Is MCP safe for company data?

It depends on the servers and permissions. The NSA (May 2026) and OWASP point to risks such as prompt injection and compromised components: use official servers, dedicated accounts with minimal permissions, confirmation for writes and call logs.

Sources

Sources checked on 12 November 2026.

About the author

Cesare D'Adamo

Product and AI strategy consultant

15+ years in product, growth and AI, more than 20 AI-powered products built, and executive teams trained on EU AI Act compliance. Works from Berlin with companies across Europe, in English and Italian.

LinkedIn Full profile Services

Let's put AI to work

Strategy, products and automation with AI that deliver measurable results, within the rules. It starts with a free call.

Book a free consultation

First call free, no commitment

MCP explained:
what the Model Context Protocol means for companies

In this guide

What is MCP (Model Context Protocol)?

How does MCP work? Hosts, clients and servers

Who supports MCP in 2026: ChatGPT, Claude, Copilot and Gemini

What changed in the 2026-07-28 MCP specification?

MCP use cases for business, team by team

Is MCP secure? Risks and how to reduce them

How to start with MCP in your company: 6 steps

Want to apply this to your company?

Frequently asked questions

What is an MCP server?

Is MCP free to use?

What is the difference between MCP and an API?

Does ChatGPT support MCP?

Do I need a developer to use MCP?

Is MCP safe for company data?

Sources

Cesare D'Adamo

Related guides

AI agents for business: what they are, examples and costs

EU AI Act: what companies must do in 2026

GEO: how to get cited by ChatGPT, Gemini and AI Overviews

/services/ai-transformation

/services/interim-leadership

All guides

Let's put AI to work

MCP explained: what the Model Context Protocol means for companies

In this guide

What is MCP (Model Context Protocol)?

How does MCP work? Hosts, clients and servers

Who supports MCP in 2026: ChatGPT, Claude, Copilot and Gemini

What changed in the 2026-07-28 MCP specification?

MCP use cases for business, team by team

Is MCP secure? Risks and how to reduce them

MCP and EU rules: AI Act and GDPR

How to start with MCP in your company: 6 steps

Want to apply this to your company?

Frequently asked questions

What is an MCP server?

Is MCP free to use?

What is the difference between MCP and an API?

Does ChatGPT support MCP?

Do I need a developer to use MCP?

Is MCP safe for company data?

Sources

Cesare D'Adamo

Related guides

AI agents for business: what they are, examples and costs

EU AI Act: what companies must do in 2026

GEO: how to get cited by ChatGPT, Gemini and AI Overviews

/services/ai-transformation

/services/interim-leadership

All guides

Let's put AI to work

MCP explained:
what the Model Context Protocol means for companies