Protecting journalistic sources: why a newsroom cannot use cloud AI

A newsroom cannot put confidential source material into cloud AI because a cloud service is a third party that can be compelled by a court or breached by an attacker, and once the material has left the building the newsroom can no longer promise a source that it stayed secret. Source protection is a legal and ethical duty, so confidential material must stay inside a boundary the newsroom controls, with a record that proves it never left. If a document sits on a vendor's servers, a subpoena to that vendor, not to the journalist, can expose the source.

This question matters more in 2026 because reporters now want intelligence systems to summarise leaked documents, transcribe interviews and search large evidence sets. Every mainstream cloud assistant, including ChatGPT, Claude and Gemini, sends that content to servers the newsroom does not own. The convenience is real, and so is the exposure: the same upload that speeds up an investigation also creates a copy outside the reporter's control and outside the shield the law gives to journalists.

How does a cloud AI service become a legal risk to a source?

When a reporter pastes a document into a cloud assistant, that document lands on infrastructure owned by a company that is neither the newsroom nor the source. Three consequences follow. First, the vendor can be served with legal process, and under the US CLOUD Act a US provider can be compelled to hand over data it holds anywhere in the world. Second, a subpoena to a vendor rarely reaches the journalist, so the newsroom may never get the chance to fight it in court. Third, the material now lives in backups, logs and processing pipelines the newsroom cannot inspect or delete. A promise of confidentiality that depends on a third party's goodwill is not confidentiality.

What is the difference between a cloud assistant and a sovereign system?

A cloud assistant is a service you reach across the public internet. A Sovereign Intelligence Operating System, or SIOS, is different by design: it runs offline on hardware the newsroom owns, and the confidential material never crosses the building's perimeter. Mickai is a SIOS. Our sovereign models run on the operator's own machines, so a leaked file, an interview recording or a whistleblower's identity is processed in the same room it was received. There is no vendor to subpoena, because there is no vendor holding the data.

How does an offline system keep the material inside the newsroom?

We build the boundary from four mechanisms. A zero-egress inbound perimeter lets material and updates come in but blocks any outbound connection, so nothing can leave even if a component is compromised. Hardware-attested identity binds every operator and device to the machine itself, so only known people on known hardware can open the file. A post-quantum signed audit ledger records every action, sealed with signatures under FIPS 204, the ML-DSA standard, and where required FIPS 205, so the record cannot be forged now or by a future quantum computer. Cross-model consensus runs a question past several sovereign models and compares answers, so a single model cannot quietly leak or fabricate. The mechanisms described here are covered by 104 filed UK patent applications, approximately 2,340 claims, owned by Mickai LTD; these applications are pending, never granted or patented.

“The only way to keep a promise of confidentiality is to make sure the material never leaves a boundary you control, and to hold a sealed record that proves it.”

What can an editor or an auditor check afterwards?

Trust in journalism rests on being able to show your working. An offline system with a sealed ledger lets an editor, a lawyer or an external auditor verify three things without taking anyone's word for it. The record is complete, because every read, query and export is written to the ledger. The record is genuine, because each entry is signed and any tampering breaks the signature chain. The record proves non-egress, because there is no outbound path and no vendor log to contradict it. Offline verifiability means the proof lives on the newsroom's own hardware and can be checked even with the network unplugged.

Which rules make this necessary?

Several regimes point the same way. Source protection itself flows from press-freedom law and journalistic ethics, and it predates all of this. On data protection, GDPR treats a whistleblower's identity as sensitive personal data that a newsroom must not expose to unnecessary third parties. The US CLOUD Act is the reason a US-based cloud vendor is a reachable target for legal process. For media groups that count as essential or important entities, NIS2 raises the bar on security and incident duties, and DORA, in force since January 2025, does the same for financial-sector operations that many media businesses touch. On governance, ISO/IEC 42001 sets out how to manage an AI system responsibly. The EU AI Act adds obligations for higher-risk uses: the high-risk Annex III obligations once due on 2 August 2026 were deferred by the Digital Omnibus to 2 December 2027, with embedded Annex I high-risk duties moving to 2 August 2028 and the Article 50 transparency rules largely unchanged. We read that deferral as a build window, not a reprieve.

What should a newsroom ask before uploading anything?

Before any confidential material touches a system, we apply a simple test. Ask four questions in order:

• Does the material leave the building at all?
• Who could be served with legal process to obtain it?
• Is there a signed record that proves what happened to the file?
• Can that record be checked offline, by someone the newsroom chooses?

If the honest answer to the first question is that the data goes to a vendor's cloud, the other answers do not matter, because the source is already exposed to a subpoena the journalist may never see.

Frequently asked questions

Can a newsroom use ChatGPT or Claude if it turns off training on its data?

Turning off training helps, but it does not remove the core risk. The content still travels to and is stored on a vendor's servers, where it can be reached by legal process under the US CLOUD Act or exposed in a breach. Source protection requires that the material never leaves a boundary the newsroom controls, not that a vendor promises to be careful.

What is a Sovereign Intelligence Operating System?

A Sovereign Intelligence Operating System, or SIOS, is an intelligence system that runs offline on hardware its operator owns, with every action cryptographically sealed. Mickai is a SIOS. Confidential material is processed on the newsroom's own machines and never crosses the perimeter, so there is no third party to subpoena or breach.

How can we prove to a source that their material never left the building?

You show them the sealed audit ledger. Every action is signed under the FIPS 204 post-quantum signature standard, so the record cannot be forged, and the system has no outbound path for data to leave. An editor, lawyer or external auditor can verify that record offline, on the newsroom's own hardware.

Does the EU AI Act ban newsrooms from using cloud AI?

No, it does not ban it outright. The Act adds obligations for higher-risk uses, and the high-risk Annex III duties once due on 2 August 2026 were deferred to 2 December 2027 by the Digital Omnibus. The stronger constraint on source material comes from source-protection law, GDPR and the exposure a cloud vendor creates, not from a single deadline.

Is an offline AI system less capable than a cloud assistant?

For newsroom work the gap is narrower than it looks. Sovereign models running on owned hardware can summarise documents, transcribe interviews and search large evidence sets, and cross-model consensus checks answers against several models to reduce error. The trade is that the material stays inside the newsroom, which for confidential sources is the whole point.