EU AI Act and MCP Servers: What Article 12 Means for Your Agent Infrastructure

EU AI Act and MCP Servers: What Article 12 Means for Your Agent Infrastructure The EU AI Act becomes enforceable on August 2, 2026, with penalties up to 35 million euros or 7% of global annual revenue. If you run MCP servers — Anthropic's Model Context Protocol for agent-to-tool communication — in the EU or serve EU customers, those servers qualify as AI system components under the Act, and they need to meet its requirements. The Problem: MCP Has No Built-In Compliance MCP is a clean, minimal protocol. That's its strength. But it ships with zero compliance infrastructure. Every tool call is unaudited. There is no oversight mechanism. No risk classification. No tamper-evident logging. Article 12 of the EU AI Act requires structured, tamper-evident logging for AI systems. Article 14 requires human oversight for high-risk decisions. Article 9 requires documented risk management. None of this exists in the MCP SDK today. If your agents are calling tools that write to databases, send emails