July 2026 briefing: MCP goes stateless, the AI Act moves its deadlines, and the UAE gets easier access to AI chips

The month in one paragraph

MCP shipped its 2026-07-28 specification, turning a stateful bidirectional protocol into a stateless request and response one¹, a day after the Ruby SDK reached 1.0². The EU AI Act Digital Omnibus was reported published and in force, deferring high-risk obligations³. A US Commerce rule effective 10 July let approved UAE entities receive advanced AI chips without individual licences⁴⁵. OpenTelemetry reflected on graduating from the CNCF and shipped zero-code instrumentation for Go and a one-command Linux install⁶⁷⁸. And in the Kubernetes world, etcd 3.7 landed and the v1.37 sneak peek set out what to prepare for⁹¹⁰.

MCP goes stateless

The 2026-07-28 release retired the initialize exchange and the Mcp-Session-Id header. Each request now carries its protocol version, client identity and capabilities, so any request can land on any server instance behind a round-robin load balancer without shared storage¹. The maintainers also reported close to half a billion SDK downloads a month across Tier 1 SDKs¹, which tells you how much infrastructure depends on getting this right.

The other changes are just as relevant to anyone operating agents:

• Multi Round-Trip Requests replace server-initiated requests that needed a held-open stream. A tool that needs a confirmation returns an "input required" result and the client retries with the answers¹.
• Header-based routing. Mcp-Method and Mcp-Name headers let gateways, rate limiters and WAFs act without parsing JSON bodies¹.
• Cacheable list results with TTLs, so clients can cache tool catalogues and keep prompt caches stable¹.
• Authorisation hardening, including issuer validation and a move away from Dynamic Client Registration towards client metadata documents¹.
• A deprecation policy with a twelve-month minimum window¹.

One line in the announcement deserves attention: if your server needs state across calls, mint an explicit handle from a tool and have the model pass it back, rather than hiding state in the transport¹. I agree. Hidden session state is what usually makes horizontal scaling painful, and explicit handles are also far easier to log and audit.

The EU AI Act moves its deadlines

The Digital Omnibus on AI, Regulation (EU) 2026/1744, was reported published in the Official Journal on 24 July and in force from 27 July³. Annex III high-risk obligations moved from 2 August 2026 to 2 December 2027, and Annex I systems in regulated products, such as medical devices, to 2 August 2028³. Article 50 transparency duties kept their August 2026 date.

I wrote a full analysis in the EU AI Act after the Digital Omnibus. The short version: deferred is not cancelled. Use the time to build logging, evaluation and documentation into the platform once.

The UAE and AI compute

For anyone building in the Gulf, this was the most consequential item of the month. A Bureau of Industry and Security rule, effective 10 July 2026, moved the UAE into a closer export control group and allowed approved UAE government bodies and listed companies to receive certain advanced AI chips and systems without individual export licences⁴⁵. The analyses I read stress the limits: approval applies to named entities, everyone else still needs a licence, and end-use restrictions still apply⁵.

I cover the regional angle in more depth on my UAE page.

Observability gets easier to switch on

OpenTelemetry's graduation within the CNCF was announced in May, and in July the project looked back at how it got there, from the merger of OpenTracing and OpenCensus in 2019 to becoming the default standard for telemetry⁶.

Two practical releases followed. OpenTelemetry Go Compile-Time Instrumentation reached v1: change one line in how you build a Go binary and get traces and metrics for the application and its dependencies, with no code changes⁷. And an opentelemetry system package for Debian and Red Hat family hosts now installs an injector plus auto-instrumentation for Java, .NET, Node.js and Python⁸.

Both lower the cost of the "instrument everything" step that most platform roadmaps keep postponing. For AI systems in particular, tracing every model and tool call is the foundation for evaluation and audit.

Kubernetes and etcd

etcd 3.7 shipped RangeStream, which streams large result sets in chunks instead of buffering them, along with keys-only range optimisations and removal of the legacy v2 store⁹. The etcd team says Kubernetes users should see a significant drop in etcd CPU usage compared with 3.6⁹.

The v1.37 sneak peek flagged changes worth acting on early: kube-proxy's ipvs mode is being deprecated, static Pods can no longer reference Secrets or ConfigMaps, and cgroup v1 support continues towards removal¹⁰. If any of your nodes still run cgroup v1, that is the item to fix first.

What I'd do with this

1. Plan the move to stateless MCP. Replace session state with explicit handles and update gateway rules to use the new routing headers.
2. Re-plan AI Act work against the new dates, but ship Article 50 transparency changes now.
3. For Gulf deployments, document your compute supply chain and data residency alongside your architecture.
4. Turn on zero-code instrumentation for Go services and Linux hosts, then trace model and tool calls end to end.
5. Check node cgroup versions and kube-proxy mode before upgrading to v1.37.

How I can help

I design agent platforms, observability and governance for teams in the US, Europe and the Gulf. See my AI architecture work and my UAE practice, or analyse your challenge and bring the result to a call. For investors, the same checks are part of my technical due diligence.