Weekly Vendor Synthesis — 11 September 2026

Tag: S-2026-09-11-weekly-vendor-synthesis Type: own-writing Author(s): Paul (Red Strata), via automated weekly vendor-synthesis agent Date of source: 2026-09-11 Date ingested: 2026-09-11 Authority weight: high — own synthesis of Paul’s own week of vendor-intelligence captures; primary reflection of his market-watch focus. (The underlying per-vendor capability claims are vendor- or trade-press-asserted and weighted accordingly on their own source pages.) Raw file: S-2026-09-11-weekly-vendor-synthesis

What it claims

A synthesis of the 13 vendor-intelligence data-governance captures in the week of 5–11 September 2026 — 10 distinct DG/DM items once three duplicate captures are removed, four of them late captures (dated 20–31 Aug) from the 8 September catch-up run after the 29 Aug–7 Sep scan outage. Most active vendors: Ataccama (two moves), Alation (two), Qlik (two); Collibra, SAP, Microsoft (Purview) and a re-surfaced Solidatus/Monte Carlo reference make up the rest. The 15 in-window AI-governance vendor captures are out of scope.

It identifies four themes. (1) Governed context for AI agents via MCP and open semantic standards — the dominant thread: Ataccama’s announced (not shipped) open-source converter carrying business terms and a structured DQ block into Apache Ossie with its MCP Server as evidence back-end; Qlik’s MCP server listed in AWS and Databricks marketplaces and its “Trust Score for AI” / 275+ metadata-bridge claims; Alation’s IDC positioning on MCP and the Open Data Product Specification. The synthesis’s read: MCP plus an open semantic spec is becoming the standard channel through which catalogue-layer controls are claimed to reach agents, with no vendor stating what enforcement or logging travels with the call. (2) Analyst convergence on “data intelligence platform” — Alation and Qlik join Precisely as Leaders in the same IDC MarketScape (doc US54118226), scoring catalogue, integration and DQ heritage on one axis. (3) Access governance as documented workflow — SAP BDC 2026.19 request-based access agreements with multi-party approval; Purview’s late-August wave (500k/day auto-labeling, cross-SaaS DLP preview, network DLP preview, Claude Enterprise connector preview). (4) Vendor lifecycle and supplier-resilience events — Collibra 2026.09 (Dataplex ingestion frozen, Console log End of Life, breaking filter-API change), Alation’s 20 Aug cyberattack (first security incident recorded against a tracked governance vendor; unmentioned in its 4 Sep IDC release), and Ataccama’s Benelux distributor appointment.

Its headline regulatory finding is a negative one: no DG/DM vendor named an EU/UK obligation this week — every BCBS 239 / GDPR / DORA / EU AI Act mapping is the scan’s inference — in contrast to August’s Alation Critical Lineage release. Landscape: no DG/DM M&A or funding; the pure-play quiet streak recorded on 28 August broke; lineage momentum paused (no fourth consecutive month of material lineage moves as of 11 Sep).

Its distinctive practitioner contribution is three assurance-test framings: (a) “governed context via MCP” is now a testable claim across three vendors — ask what policy, certification status, masking and logging travel with the MCP call or semantic YAML, and treat a scheduled-refresh DQ block as a snapshot rather than a control until refresh cadence, versioning and retention are evidenced; (b) three vendor-side events (Alation incident, Collibra Console log EoL / Dataplex freeze, Ataccama distributor layer) are DORA register-of-information items, each with a named client question; (c) “documented workflow is not retained evidence” — for SAP access agreements and Purview cross-SaaS DLP, ask for the persisted/exported record and per-platform enforcement before accepting the screenshot.

Notable quotes

None — synthesis document; no verbatim quotes beyond those on the underlying per-vendor source pages.

What’s speculative vs. asserted

• Asserted: the capture count (13, of which 10 distinct; 3 duplicates; 4 late captures); the named moves and dates (Ataccama Ossie converter announced 9 Sep, Systemation 3 Sep; Alation IDC 4 Sep, cyberattack confirmed 20 Aug; Qlik MCP marketplaces 2 Sep, IDC 24 Aug; Collibra 2026.09 on 4 Sep; SAP BDC 2026.19 deployments from 9 Sep; Purview items 27–31 Aug; M&T analysis 6 Sep); that no DG/DM release in the window names an EU/UK obligation; the absence of DG/DM M&A/funding; the continuing absence of a named EU/UK regulated-FS production reference.
• Speculative / interpretive: the “MCP + open semantic spec as the standard channel” framing and the “category boundaries dissolving under the IDC label” read are this synthesis’s own cross-vendor interpretation [speculative]; all regulatory mappings are inference (no vendor names an obligation); the “quiet streak broken” and “lineage momentum paused” pattern claims depend partly on late captures and on a single week of data [speculative]; the Purview cross-SaaS DLP GA status is unresolved (Aug sources said GA early September; this week’s capture describes preview as of late August) — flagged to verify, not treated as a contradiction; the three engagement implications are Paul’s analytic framing, not claims in any capture.

Topics this feeds

• Agentic Data Access Governance — adds the cross-vendor “governed context via MCP / open semantic standard” pattern as the week’s dominant theme, the answer to the standing pure-play-lull open question, and the MCP-call evidence test.
• BCBS 239 and Data Lineage — records that the lineage-momentum question from 28 Aug is not yet answered (no material lineage product move in September to date) and that the trust-signal thread has moved into the semantic layer.
• Vendor Lifecycle Events as Evidence-Continuity Risk — adds Collibra’s 2026.08/09 lifecycle notices (Console log End of Life; Dataplex ingestion freeze) as a further DG/DM instance of the forced-migration/EOL variant.
• Operational Resilience and Third Party Risk — adds the first security incident at a tracked governance vendor (Alation) and channel intermediation (Ataccama/Systemation) as vendor-market instances of the ICT third-party thread.

Open questions raised

• Does a scheduled-refresh Ossie YAML carrying pass-rate/threshold/flag values count as retained evidence of DQ control for BCBS 239 or EU AI Act record-keeping, and who versions its history? (Ataccama converter unshipped; no vendor answer.)
• What policy enforcement, certification status and logging actually travel with a Qlik or Alation MCP call into Bedrock/Databricks agents? Unstated by all three vendors.
• Did Purview cross-SaaS DLP reach GA in early September as scheduled, or does it remain in preview? Sources diverge by date, not by claim — verify against a Microsoft primary.
• Will September produce a material lineage product move (fourth consecutive month), or has vendor momentum shifted from lineage to semantic-layer trust signals?
• What has Alation disclosed about the 20 Aug incident since, and does any analyst placement account for vendor security posture?
• Standing gap (unchanged): no independently verified EU/UK regulated-FS production reference for any of this week’s DG/DM vendor claims.