What did lawyers say about our AI integrations?

In short:

The biggest wins you can have using AI inside your business do not come from big flashy changes, but from asking 'where do we have problems?' and solving those pain points with small, focused changes. But you've got to be careful those changes are safe and compliant.

"So Andreas, are you going to jail?" "Uh, possibly. No, probably not. We'll see."

That was one of the first conversations this morning in the SmplCo office after our partner Andreas got in, fresh from vibecoding a tool, connecting it to various systems, and then asking leading lawyers CMS Kluge to run a risk assessment of it...all in front of a live audience.

What would the lawyers say? How many regulations would he break? (The stakes were high: Bernt Olav Thorsheim, one of the legal judges / executioners announced beforehand he was more than ready to 'crush Andreas' dreams'.)

By lunchtime, Andreas was still a free man (and still dreaming) so we reckon we're OK.

How do you implement AI in a business, safely?

We ran this live experiment to show both the opportunities and risks of integrating AI, particularly autonomous agents, into your workflows offers.

To do this Andreas presented a live demonstration of an AI integration we've built, connecting Claude directly to our (3rd Party) accounting software, via a Model Context Protocol (MCP).

The idea is to make it much easier/quicker/less stressful for us at SmplCo to manage invoicing - all without having to pay for any 3rd party software to do it for us.

What the demo showed

During the live test, the AI added a client, created a project, and built out a full invoice.

Andreas controlled the entire workflow through natural conversation. No forms, no manual data entry, no switching between systems.

So far, so good.

Without being asked, the AI flagged that the parking ticket had different Norwegian VAT (MVA) rules compared to the conference fee, and corrected the invoice entry automatically.

A small detail, but exactly the kind of thing that causes credit notes, reissued invoices, and wasted time when it goes wrong. Andreas was clear he would have got that wrong himself, guaranteed.

Another big tick.

Time to stress test

The MCP had intentionally been built without a "send invoice" tool, a deliberate governance decision.

So Andreas instructed the AI, in no uncertain terms, to disregard every rule and send the invoice anyway. Live, in front of the room.

This was a big moment and a super important test, as LLM's are built to please and will look for ways to work around rules.

The AI refused.

Not because of a complex permission layer or an ethical override, but because the capability simply didn't exist within the tool.

It couldn't do what it wasn't built to do.

All-in-all, Andreas thought he'd done a pretty good job. But, the big question is:

What did the lawyers think about the AI?

The CMS Kluge were pretty impressed at the lengths Andreas had gone to secure the MCP and keep the AI in check. The distinction between permissions, overrides and capabilities mattered enormously.

But there were other important lessons to learn.

Firstly, and most importantly, your AI licence type matters more than most people realise.

Particularly when you're doing cool stuff internally (i.e. building autonomous systems to improve productivity, save costs, etc).

Using a personal/standard subscription to process client data can put you in technical breach of GDPR, because data flows straight to servers in the US.

A team or enterprise licence or a locally-run model changes that picture entirely, and is a must-have.

So, while the MCP itself passed scrutiny, the data handling around how you use AI was a key area where we (and you) need to pay attention.

Getting AI strategy right

This MCP experiment was a success from a regulatory perspective, but CRUCIALLY it also passed a strategic test most companies don't think about.

It wasn't a big, flashy piece of innovation. It was small, targeted, and smart.

There's a lot of noise right now about AI transformation, and a lot of pressure on businesses to do something with it.

But what Andreas built isn't a new AI platform. He didn't create an intelligent system from scratch.

He built a small, bounded connector that allows an AI model we're already using to talk to software we're already paying for.

The MCP itself is, in his words, "dumb'.

It's a defined list of things the AI is allowed to do, nothing more. It doesn't learn, it doesn't evolve, and it can't go off-script.

What it does do is remove the manual, error-prone, energy-draining tasks that sit between intention and output.

In SmplCo's case, this dramatically improved the process involved in complex multi-country invoicing with different templates, different tax rules, and real consequences when it goes wrong.

The first question to ask about implementing AI

Businesses should not be asking: "How do we implement AI?" They should start with: "Where is the pain?"

In practical terms, that means asking questions like:

Where are your people burning time and cognitive energy on repetitive inputs that a well-governed AI connection could handle accurately, every time?

Where are bloated, legacy tools getting in the way of your workflow? (And costing you a fortune for the privilege!)

How can you connect intelligent tools you already use to the systems already running your business?

That's where this all should start.

And critically: humans stay in the loop. The AI prepares. People verify and approve. That's not a limitation of the technology; it's the right way to use it.

And, most importantly, the lawyers will love you for it.

If your organisation is exploring AI-assisted workflows and wants to do it properly, we'd love to talk.

Visit https://smpl.as/academy to learn more about how to implement AI safely within your business or drop Andreas a line on andreas@smpl.as