How do you keep AI inside the building when the data is regulated?

You keep AI inside the building by running inference and agents on hardware you own, behind a perimeter that permits no outbound connection at all. Data residency answers where files rest. The harder question is where the reasoning happens, and the answer must be on your own machines, with zero egress. Mickai is a Sovereign Intelligence Operating System, a SIOS that runs offline on operator-owned hardware and cryptographically seals every action, so regulated data is processed in place and never transmitted.

This distinction matters more in 2026 than it did a year ago. Public, cloud-hosted AI services send each prompt to infrastructure the customer does not control, which is disqualifying for banks, hospitals, defence suppliers and critical infrastructure operators. DORA has been in force since January 2025, NIS2 now binds essential and important entities, and the US CLOUD Act means data held by a US-linked provider can be compelled whatever country the server sits in. The compliance question has moved from where data is stored to where it is computed.

What does keeping AI inside the building actually require?

Three things must stay local, not one. The model weights must sit on your hardware. The inference compute, the actual reasoning, must run on that hardware. And the agents that read, write and act on your systems must execute inside the same perimeter. Data residency covers only the first idea, storage. Sovereign inference covers the other two. We hold the models, run the reasoning and orchestrate the agents on operator-owned hardware, so no stage of the work reaches outside infrastructure.

How does a zero-egress perimeter work?

Zero egress means the system has no outbound path. The inbound perimeter accepts work from inside the organisation and returns results inside it, and nothing leaves. There is no telemetry call, no model-update fetch, no cloud sync. Updates arrive as signed packages that a person approves and imports. The absence of an outbound route is a tested property, not a policy promise. If a connection out is attempted, it fails, and the attempt is written to the record.

What can an auditor actually check?

An auditor does not have to trust our word. Every action Mickai takes is written to an append-only audit ledger, and each entry is signed. The signatures use post-quantum standards: FIPS 204 (ML-DSA) is the primary scheme, with FIPS 205 (SLH-DSA) available alongside it, so the ledger stays verifiable even against a future quantum adversary. Identity is hardware-attested, which binds each entry to the specific machine that produced it. An auditor can replay the ledger, verify every signature, confirm which model and which operator produced each result, and confirm that no entry records an outbound transmission. The ledger is offline-verifiable, so the check needs no call back to us.

Which rules make this necessary?

Several regimes push in the same direction. GDPR restricts where personal data may be processed and transferred. DORA, in force since January 2025, holds financial entities responsible for the resilience and control of their ICT, including third-party AI. NIS2 extends security duties across essential and important entities. The US CLOUD Act sits beneath all of it, because a US-linked provider can be compelled to disclose data it holds wherever the server is. On the EU AI Act, the high-risk Annex III obligations once due on 2 August 2026 have been deferred by the Digital Omnibus to 2 December 2027, with embedded Annex I high-risk moved to 2 August 2028 and the Article 50 transparency duties largely unchanged. We read that as a build window, not a reprieve. ISO/IEC 42001 offers a management-system framework for governing the whole arrangement.

How do you trust an offline model's answer?

Isolation must not become a single point of failure in judgement. Mickai can run several sovereign models over the same question and compare their outputs, a method of cross-model consensus. Where the models agree, confidence is higher. Where they diverge, the disagreement is surfaced rather than hidden, and the decision returns to a human. All of this happens inside the perimeter, so the second opinion costs nothing in data exposure. These mechanisms, the zero-egress perimeter, the sealed ledger and cross-model consensus, are the subject of 104 filed UK patent applications, with approximately 2,340 claims, owned by Mickai LTD, and remain patent pending.

“The only way to prove regulated data never left the building is to make sure the reasoning never left it either.”

Why is a data-residency region not enough?

A residency region tells you the country a file rests in. It does not tell you who can compel access, where inference runs, or whether an agent called home. A US-linked cloud region is still reachable under the CLOUD Act. A managed model endpoint still sends the prompt off your hardware to be processed elsewhere. Residency is necessary and not sufficient. The property a regulator responds to is that the regulated data was processed and never transmitted, and only local inference behind a zero-egress perimeter can demonstrate that.

Frequently asked questions

Can AI run completely offline with no internet connection?

Yes. A Sovereign Intelligence Operating System holds the model weights and runs inference on hardware you own, so it can operate with no outbound connection at all. Updates arrive as signed packages that a person approves and imports offline. Nothing depends on a live link to any vendor.

Does the EU AI Act allow AI to be kept on-premises?

Yes, and on-premises deployment helps rather than hinders. The high-risk Annex III obligations once due on 2 August 2026 were deferred by the Digital Omnibus to 2 December 2027, with embedded high-risk under Annex I moved to 2 August 2028. Running AI in-house with a signed audit trail is a practical way to be ready well ahead of those dates.

What is the difference between data residency and zero egress?

Data residency fixes the country where files are stored. Zero egress fixes whether anything can leave the network at all, including prompts sent for inference and agent traffic. Residency is about storage location. Zero egress is about computation and transmission, which is the stricter and more relevant test for regulated AI.

How can an auditor prove no data left the system?

Every action is written to an append-only ledger and signed with post-quantum signature standards, with FIPS 204 as the primary scheme. Identity is hardware-attested, so each entry is tied to the machine that produced it. An auditor can replay the ledger and verify each signature offline, confirming which model produced each result and that no entry records an outbound transmission.

Can a private cloud give the same guarantee?

Not on its own. A private cloud still runs on infrastructure the operator does not fully control, and a US-linked provider remains reachable under the US CLOUD Act. The guarantee regulators respond to is local inference behind a zero-egress perimeter, where the regulated data is processed in place and never transmitted.