Clinical Trials on a Sealed Substrate: Pharma AI Without Moving Patient Data

A phase three oncology trial generates a corpus few datasets can match for sensitivity. It holds genomic sequences, longitudinal biomarker readings, adverse event narratives and the identities of consenting participants, and it sits alongside the sponsor's most valuable intellectual property: the molecule, the mechanism and the analysis plan. It is special category personal data under the UK GDPR and its European counterpart, and trade secret material whose exposure could reset a competitive position.

This is why capable artificial intelligence in drug development sits uneasily with the way most of that intelligence is delivered. A model that reads trial data, drafts a safety narrative or flags a protocol deviation is useful. One that requires that data to be copied to a third party's infrastructure is, for a regulated sponsor, a governance problem before it is a scientific gain. The EU AI Act's Annex III high-risk obligations, once due on 2 August 2026, now apply from 2 December 2027 after the Digital Omnibus deferral, and with that list placing many health uses in the high-risk category the proof requirements are unchanged, so the sensible response is to build now. The question is not whether the model is clever, but where the data went, who could reach it and whether every step can be proven afterwards.

The data cannot move, so the intelligence must come to it

The conventional cloud model of machine learning inverts the safe order of things. Data is drawn out of the controlled environment, transported across a network boundary and processed on hardware the sponsor neither owns nor sees. Each movement is a fresh surface for interception, mishandling or compelled disclosure, and each one weakens the chain of custody a regulated trial depends on. A sovereign approach reverses that assumption. Mickai is a Sovereign Intelligence Operating System, a SIOS that runs entirely offline on hardware the operator owns. The sovereign models, the analysis pipelines and the audit machinery are installed inside the sponsor's own security perimeter, in the same room as the data they read. The trial corpus never leaves: no upload step, no external endpoint and no third-party tenancy in which a copy could persist. The intelligence comes to the data, and the data stays where consent, contract and regulation already permit.

Zero egress is a property you can inspect, not a promise you accept

The phrase no data leaves is easy to write on a datasheet and hard to guarantee in a system that keeps outbound connections for updates, telemetry or model calls. We treat egress as an architectural constraint, not a policy. The perimeter is inbound only: work, data and instructions flow into the sealed environment, and nothing carrying trial content flows back out. There is no callback to a vendor cloud and no telemetry streamed to an external service.

This matters beyond ordinary confidentiality. The US CLOUD Act allows lawful demands to be served on a provider for data held under its control, wherever that data physically sits. For a European or British sponsor, data on a foreign provider's infrastructure carries a jurisdictional exposure no contractual clause fully closes. When the substrate is sealed and operator-owned, there is no external custodian to compel.

Every step signed, so the record survives scrutiny

Regulated research lives or dies on evidence. A finding is only as good as the ability to show, later and to a sceptical auditor, how it was reached, on what data and by which version of which process. Verbal assurance does not survive inspection, so the SIOS writes every action into a cryptographically sealed audit chain. Each material event, a dataset loaded, an analysis run, a narrative drafted or a result released, is a signed entry linked to the one before it, so the sequence cannot be reordered or edited without breaking it. The signatures are post-quantum, so a record made today stays verifiable over the long custody periods clinical data demands. The identity performing each action is hardware-attested, bound to the machine rather than a reusable password, so the log answers not only what happened but on which device and under whose authority.

“When the data never moves and every action is signed on the operator's own hardware, the sponsor keeps both the science and the proof of how it was reached.”

Cross-model consensus against the confident error

A single model asked to summarise an adverse event or interpret a signal can be fluent and wrong at once, and in a safety context a confident error is worse than an honest gap. The OWASP work on risks in large language model applications names this directly, and responsible use in drug development has to design against it.

Within the sealed environment we run analysis through cross-model consensus. More than one sovereign model considers the same question independently, and where they diverge the disagreement is surfaced to a human reviewer rather than smoothed into a single tidy answer. The output is not a lone verdict but a position accompanied by the degree of agreement behind it, and that corroboration is written into the same sealed chain, so an inspector sees not only the conclusion but whether the system's own models concurred when it was reached.

Where this meets the 2026 regulatory frame

The compliance picture facing a research sponsor in 2026 is dense and converging. The EU AI Act's high-risk obligations demand logging, human oversight, data governance and traceability for the health uses set out in Annex III. DORA has been in force since January 2025 and holds regulated financial and adjacent entities to strict operational resilience and third-party risk standards. NIS2 raises the security bar for essential and important organisations, and ISO/IEC 42001 shapes responsible AI into a management system. These regimes do not ask for good intentions; they ask for records, boundaries and demonstrable control.

A sealed substrate answers those demands structurally rather than procedurally. Logging is the native signed audit chain. Data governance is enforced by an architecture in which the data cannot leave. Third-party risk shrinks because there is no live processing dependency on an external provider. Our patent estate, 104 filed UK patent applications, approximately 2,340 claims, owned by Mickai LTD and held as patent pending, covers much of the mechanism that makes this possible.

What this makes possible for research teams

The practical effect is to remove a false choice that has held research organisations back: capable AI at the cost of moving sensitive data elsewhere, or full data control at the cost of forgoing modern analysis. A sovereign operating system collapses it.

• Trial data is analysed in place, on operator-owned hardware, with no upload and no external tenancy.
• Every action is written to a post-quantum signed, tamper-evident audit chain suitable for inspection.
• Identity is hardware-attested, so access is bound to a device and an authority rather than a shared secret.
• Cross-model consensus exposes disagreement instead of concealing it, keeping a human in the decision.

The direction of travel

The pressure on clinical research is not going to ease. Regulators will keep tightening traceability and oversight, participants will keep expecting their most intimate data to stay under genuine control, and sponsors will keep guarding intellectual property whose value depends on secrecy. The organisations that navigate this well will stop asking how to move sensitive data safely and start asking why it needs to move at all.

We built Mickai around that second question. A sealed, sovereign substrate lets pharmaceutical science take up the intelligence it needs while the data, the identities and the proof remain where they belong: inside the sponsor, on hardware the sponsor owns, with a record verifiable long after the trial has closed. Where the stakes are measured in patient safety and public trust, that discipline is the point.