OAR-as-a-Service: The Audit-Grade Accountability Layer for Enterprise AI
Every AI action a regulated business takes should be provable after the fact. Mickai ships that proof as a tamper-evident, post-quantum-signed audit record you run inside your own walls.
The question regulators are already asking
When an AI system inside a bank declines a loan, flags a transaction as fraud, or prices an insurance policy, one question follows close behind. Can you prove what it did, why it did it, and that nobody altered the record afterwards?
For most enterprise AI deployments today, the honest answer is no. Models run in someone else's cloud. Logs are mutable, scattered, and trusted only because the vendor says so. When a regulator, an auditor, or a court asks for an account, the firm reconstructs a story rather than producing evidence.
I built Mickai, the sovereign AI operating system, around the opposite premise. Accountability cannot be a feature you bolt on after an incident. It has to be the substrate. Every action the system takes is written to an Operational Audit Record (OAR): tamper-evident, cryptographically chained, and post-quantum-signed. This is built and live, not a roadmap promise. We now ship it as a discrete capability, OAR-as-a-Service, for organisations that need the accountability layer even before they replace the model underneath.
What an Operational Audit Record actually is
An OAR is not a log file. A log file is a list of things a system claims happened. An OAR is a chained, signed evidence record where each entry binds to the one before it, so altering any single event breaks the chain and the tampering becomes self-evident.
Three properties matter here.
First, it is tamper-evident. Entries are hash-chained, so a deleted or edited record cannot hide. You do not have to trust that the log is intact. You can verify it.
Second, it is post-quantum-signed. The signatures use algorithms designed to survive the arrival of cryptographically relevant quantum computers. A regulated firm keeping records for seven, ten, or twenty years cannot afford signatures that become forgeable inside that window. We sign for the retention horizon that actually applies, not the one that is convenient today.
Third, it is sovereign. The record lives where your data lives, on-prem or air-gapped, inside your own walls. There is no third party who could be compelled to produce, alter, or lose it. Under the US CLOUD Act and similar regimes, where data sits and who can reach it is not a footnote. It is the whole question.
Why this is becoming a precondition, not a nice-to-have
The wedge here is regulation, and regulation is tightening on exactly this axis.
The EU AI Act places high-risk AI systems under explicit logging and record-keeping obligations. The PRA's SS2/21 expects model risk management with traceable governance. UK GDPR special-category data, the NHS Data Security and Protection Toolkit, the NIS Regulations, and export-control regimes such as ITAR and EAR all converge on the same demand. If AI touches a regulated function, you must be able to account for it, durably and credibly.
The population this affects is large. Roughly 0.85 million UK businesses, about 15 percent, operate under rules that make sending data to public-cloud AI legally fraught. Across the EU the figure is around 5 million. These are not laggards waiting to be convinced. They are firms that legally cannot adopt the dominant AI deployment model, and who need an alternative that is accountable by construction. The sovereign AI market reflects this, moving from around 40 billion dollars in 2025 toward a projected 148 billion by 2032.
OAR-as-a-Service is how a regulated firm closes the accountability gap first, often as the entry point before adopting the wider system.
How it ships as a service
OAR-as-a-Service is one of Mickai's Studio modules, alongside Greek-named subsystems such as Nemesis for fraud and AML, Plutus for finance and FP&A, Tyche for underwriting, Nomos for compliance, Astraea for legal, Panacea for clinical work, and Aletheia for audit. It also stands on its own.
You point it at the AI actions you need accountable, whether those run inside Mickai or in systems you already operate. It captures each action, the inputs and the decision context, chains and signs the record, and stores it sovereign. When the auditor, the regulator, or your own second line asks for evidence, you produce a verifiable record rather than a reconstruction. The verification is cryptographic, so its credibility does not depend on trusting us, or you, or anyone.
This is the dual-buyer thesis in practice. The compliance and risk function buys provable accountability. The engineering function buys an audit substrate they do not have to build, secure, and defend themselves. Both get the same record.
The IP and the moat behind it
The accountability layer sits on a deliberately built patent position: 104 filed UK patent applications, roughly 2,340 claims, owned by Mickai LTD with myself as inventor. These are filed, not granted, and I am precise about that distinction. Filing establishes priority and a prior-art moat. It does not assert a grant we do not yet hold.
The same portfolio maps to 196 companies across 311 patent-company pairs as potential licensees, including names such as Microsoft, AWS, NVIDIA, Google, Adobe, and IBM. That is potential-licensee sizing, a map of where this architecture is relevant, not an allegation of infringement against anyone. Mickai is an ally to the broader AI ecosystem, not an OpenAI killer. The hyperscalers serve the workloads that can live in public cloud. We serve the ones that legally cannot, and the accountability primitives we have filed are built to matter to both.
Momentum and where we are
As a third-party signal verified live in June 2026, Micky Irons was ranked number four on Crunchbase's CB Rank for people, with the Mickai company profile in the top one to two percent globally. I treat that as a snapshot of momentum at a moment in time, not a permanent claim. It tells me the thesis is landing. The work is to convert that into deployments.
Mickai is a UK company with Birmingham manufacturing secured, and we are building to scale. OAR-as-a-Service is live and capturing records today.
A window for selected partners
As Mickai scales, a pre-seed window is open to a small number of selected partners. This is an invitation to get involved early in sovereign, accountable AI infrastructure, at the point where the regulatory tailwind is becoming undeniable. It is an opportunity offered from strength, not a search for rescue.
If your firm operates under rules that make accountability non-negotiable, or you want to talk about the pre-seed window, reach me directly at micky@mickai.co.uk.
Micky Irons, founder and CEO of Mickai.
Frequently asked questions
What is an Operational Audit Record (OAR)?
An OAR is a tamper-evident, cryptographically chained, post-quantum-signed record of every action an AI system takes. Unlike an ordinary log file, each entry binds to the one before it, so any deletion or edit breaks the chain and becomes self-evident. You verify the record cryptographically rather than trusting that it is intact.
Why does AI accountability need to be post-quantum-signed?
Regulated firms retain records for many years, often seven to twenty. A signature that is secure today but becomes forgeable once cryptographically relevant quantum computers arrive cannot defend a record across that horizon. Post-quantum signatures are designed to survive that transition, so the evidence stays credible for the full retention period.
Can OAR-as-a-Service run inside our own walls?
Yes. Mickai is a sovereign AI operating system, built to run on-prem and air-gapped. The audit record lives where your data lives, so no third party can be compelled to produce, alter, or lose it. This matters directly under regimes such as the US CLOUD Act, the EU AI Act, UK GDPR special-category rules, and the NHS Data Security and Protection Toolkit.
Does OAR-as-a-Service only work with Mickai's own models?
No. It captures and signs AI actions whether they run inside Mickai or in systems you already operate, which makes it a practical entry point for firms that want provable accountability before replacing the model underneath.
Is Mickai positioned against the major cloud AI providers?
No. Mickai is an ally to the broader AI ecosystem, not an OpenAI killer. The hyperscalers serve workloads that can live in public cloud. Mickai serves the regulated workloads that legally cannot, and the filed accountability primitives are built to matter to both.