Where AI pilots actually die: the integration backlog
The gap between "it works" and "it runs"
A pilot that has proved a model can read your invoices is not most of the way to production. In our experience it is roughly a fifth of the way, and the remaining four-fifths is integration work that nobody scoped because it was invisible at pilot stage.
The pilot ran on a folder of exported documents. Production has to read from the mailbox, the portal and the scanner. The pilot wrote to a spreadsheet. Production has to write to the ERP, behind an authentication model that was designed in 2009 and an approval workflow that exists partly in the system and partly in a person's head. The pilot had a clean sample. Production has fourteen years of supplier variance.
This is where the money goes, and it is why integration deserves more attention in a business case than model selection does.
What changed in 2025
One class of that cost genuinely got cheaper, and it is worth understanding precisely which one.
The historic problem was combinatorial. Connecting M AI applications to N business systems meant building and maintaining roughly M×N bespoke connectors. Every new model, every new tool, every new system multiplied the surface.
Anthropic released the Model Context Protocol on 25 November 2024, with reference implementations for Google Drive, Slack, GitHub, Git, Postgres and Puppeteer, and Block and Apollo as the first named enterprise adopters. OpenAI adopted it in March 2025 across its Agents SDK, Responses API and desktop application. Google DeepMind and Microsoft followed through spring 2025, with Microsoft announcing Windows 11 support at Build in May 2025. On 9 December 2025, MCP was donated to the Linux Foundation's newly formed Agentic AI Foundation, with OpenAI, Block, AWS, Google, Microsoft, Cloudflare and Bloomberg involved — which removed the single-vendor risk that would otherwise have made enterprise standardisation on it imprudent.
The authorisation model hardened alongside it: OAuth 2.1 support arrived in March 2025, protected resource metadata separating MCP servers from authorisation servers in June 2025, and mandatory PKCE for clients in November 2025.
The effect is real. M×N becomes M+N. Each system exposes one standard interface, each AI client speaks one protocol. For an organisation that watched a pilot die in connector work, that is a material change.
The four classes it did not touch
A protocol standardises how a system is reached. It says nothing about whether reaching it solves your problem.
Data quality. An interface to a table of supplier records does not make those records consistent. If the same supplier exists four times under three spellings, extraction accuracy is capped by the reference data regardless of the model. This is the single most common cause of an accuracy ceiling that no amount of model tuning moves.
The access model. Standard protocol, non-standard permissions. Deciding what an automated process may read and write, under whose identity, with what approval gate before a consequential action, is an organisational decision that takes longer than the engineering. In regulated environments it takes considerably longer.
Exception handling. Nothing in a protocol tells you what to do when the write fails, when the record is locked, when the downstream system accepted the first of three related updates and rejected the second. Partial-failure reconciliation is unglamorous, it is where production incidents originate, and it is almost never in the pilot.
Ownership of the legacy system. The interface may exist. The question of who is permitted to authorise a change to the system behind it frequently does not have an answer. We have seen more integration work stall on this than on any technical constraint.
There is a fifth item that is not integration but behaves like it: the security surface of the integration layer itself. Researchers documented real vulnerabilities in community-published MCP servers during 2025. A standard that makes connection easy makes careless connection easy too. Self-host, vet what you run, apply least privilege, and require approval for consequential actions.
What to do about it
Scope integration before you scope the model. Ask which systems must be read, which must be written, under what identity, and who can authorise that. If those four answers are not available in a week, they are your critical path, not the model.
Profile the reference data early. Duplicate rates, null rates, format variance. Do this in the discovery phase, when it costs two days, rather than in build, when it costs six weeks.
Design the partial-failure path explicitly. Write down what happens when step three of five fails. If the answer is a manual reconciliation, size how often that will happen at your volume.
Treat the protocol as plumbing, not strategy. MCP is a good standard and it removed real cost. It did not remove the reasons your last pilot stalled.
The pilot proves the model can do the task. Production proves the organisation can let it.