The compliance layer the large platforms cannot build

The compliance layer the large platforms cannot build

Mickai is a sovereign intelligence operating system that regulated businesses own and run inside their own walls. It runs entirely on the customer's own hardware, on premises and air gapped, with zero data egress and no public cloud round trip. It is built and live today, not a concept and not a roadmap. In this piece we set out why the regulated market cannot be served from a shared public cloud, why that constraint is structural rather than temporary, and how we turned it into a defensible position that a platform reading over a buyer's shoulder should study closely.

The constraint is legal, not technical

Most conversations about enterprise AI assume the only question is model quality. For regulated firms it is not. The binding question is whether data may leave the building at all, and for a large and growing population of businesses the lawful answer is no. We count roughly 0.85 million UK businesses, about 15 percent of the total, that cannot lawfully send data to public cloud AI. Across the EU that figure is around 5 million. These are not laggards waiting to be convinced. They are firms whose regulators, statutes and contracts forbid the round trip that public cloud AI depends on.

The drivers are specific and they are not going away. In UK financial services, PRA model risk expectations under SS1/23 demand explainability and control that a black box in someone else's data centre cannot provide. UK GDPR special category data, the NHS Data Security and Protection Toolkit, and the EU AI Act high risk classification each raise the bar on where sensitive data may be processed and how decisions must be evidenced. ITAR and EAR govern defence and dual use technology. The NIS Regulations cover critical infrastructure. The US CLOUD Act means data held by a US owned provider can be reached by a foreign government regardless of where the servers physically sit, which is precisely the exposure a sovereign buyer is trying to eliminate. Put together, these rules describe a market that a shared, egress dependent architecture cannot enter, however good its models are.

What we built instead

We designed for that constraint from the first line. We run about fifty specialist models, twenty five domain and twenty five operational, with cross model routing under a deterministic arbiter, so that outputs are reproducible rather than merely plausible. Reproducibility matters to a regulated buyer far more than raw fluency, because a decision that cannot be reproduced cannot be defended to a supervisor. Everything runs on the customer's own hardware. Nothing depends on us being online, and nothing depends on the buyer trusting our goodwill.

The evidentiary spine is the Open Audit Record. Every consequential action is signed under post quantum cryptography (FIPS 204 ML-DSA-65, with ML-KEM-768) and hash chained into a tamper evident, append only ledger. Anyone can verify that ledger offline, for decades, without trusting the vendor and without a live connection back to us. This is the difference between a system that claims to be auditable and one that a regulator, an auditor or a court can check independently. It moves the burden of proof off the buyer's word and onto mathematics.

Above that spine we run studios, each a focused capability with a Greek name and a serious function. Nemesis handles fraud and anti money laundering. Plutus covers finance and FP and A. Tyche is underwriting. Prometheus is forecasting. Iris is customer service. Nomos is compliance and Astraea is legal. Panacea is clinical, Pythia is business intelligence, and Aletheia is audit. Vinis is voice, the Agentic Marketing Team handles marketing, and Trust Agent is the perimeter. We also offer OAR as a Service for firms that want the audit record as a standalone assurance layer. For estates that field many units, Pantheon, our post quantum Layer 1 now on testnet, provides multi node attestation across fielded units with no central server, so trust is distributed rather than concentrated.

The moat is filed, not asserted

We hold 104 filed UK patent applications, roughly 2,340 claims, across 13 invention families, owned by Mickai LTD, with named inventor Mickarle Sean Junior Wagstaff-Irons. These are filed, not granted. We are precise about that on purpose. Filing establishes priority and creates a prior art moat, which is what matters at this stage. The claims span the sovereign runtime, the audit record, the routing and arbiter design, and the attestation layer, which is to say the parts of the architecture that a competitor would need in order to serve the same regulated market the same way.

A market that is structurally underserved

The sovereign AI market is roughly USD 40 billion in 2025 and is projected to rise to about USD 148 billion by 2032. That growth is not driven by fashion. It is driven by the same regulatory pressure that keeps the largest platforms out. The public cloud model is superb at scale and elasticity, and it is structurally unable to promise a customer that their data never leaves the building. For the regulated population that promise is the entire purchase decision. We built our stack around that single, unmovable requirement, which is why we can serve firms the shared cloud cannot lawfully reach.

The dual buyer thesis

Our strategy has two sides and they reinforce each other. On one side, we sell sovereign AI directly to regulated firms that the public cloud cannot lawfully reach, delivering capability inside their walls with the audit record as proof. On the other side, we license the patented stack to the platforms that want to reach those same firms and cannot, because their architecture forecloses it. A platform that adds a sovereign layer instantly reaches a regulated market it cannot serve today. Our internal analysis maps 196 companies and 311 patent company pairs as potential licensees, with names including Microsoft, AWS, NVIDIA, Google, Adobe and IBM. We are clear about what that is. It is potential licensee sizing, not a signed book and not an infringement claim. We are an ally to the AI majors, not their opponent. The public cloud and the sovereign layer are complements, and we built the piece that the shared model cannot build for itself.

Where this leaves a regulated buyer

If you operate under SS1/23, under UK GDPR special category rules, under the NHS toolkit, under the EU AI Act, under ITAR or EAR, under the NIS Regulations, or in the shadow of the CLOUD Act, the calculus is straightforward. You need modern AI capability and you cannot let your data leave the building. We give you both, on your own hardware, air gapped, with an audit record that anyone can verify offline for decades. The capability is live now, the evidence is independently checkable, and the market that needs it is measured in millions of firms across the UK and the EU. Mickai LTD is a UK company, Companies House number 17166618, with Birmingham manufacturing secured, led by founder and chief executive Micky Irons. Our pre-seed round is opening soon, and we welcome inquiries from interested partners by email at micky@mickai.co.uk or on LinkedIn.

Does Mickai really run with no connection to the public cloud?

Yes. The system runs entirely on the customer's own hardware, on premises and air gapped, with zero data egress and no public cloud round trip. Nothing depends on us being online, and the audit record can be verified offline without any live connection back to us.

Are the 104 patents granted?

No. They are 104 filed UK patent applications, roughly 2,340 claims across 13 invention families, owned by Mickai LTD. Filing establishes priority and a prior art moat, which is the point at this stage. We do not describe them as granted.

Is Mickai trying to replace the large AI platforms?

No. We are an ally to the AI majors. We serve regulated firms the public cloud cannot lawfully reach, and we license the patented stack to platforms that want to reach those firms. The sovereign layer complements the public cloud rather than competing with it.