Sovereign AI for Financial Services: The Evidence Bar

Sovereign AI for financial services means running intelligence inside your own regulated boundary, so that material non-public information never leaves your control and every model action is recorded as evidence. In a regulated firm the bar is not a clever answer, it is proof: who saw what, which model produced which output, and whether that record can be shown to an auditor unchanged. Mickai is a Sovereign Intelligence Operating System (a SIOS) that keeps data, models and logs on infrastructure you govern, and signs every action into an Open Audit Record so the evidence bar is met by design.

• The evidence bar is met with records, not assurances: firms must show who accessed information, which model ran, and what it produced.
• Material non-public information (MNPI) sent to a third-party cloud model can create control gaps that are hard to evidence and harder to defend.
• Model risk management expects firms to inventory, validate and monitor every model, including AI, and to keep that evidence current.
• Record-keeping rules require durable, tamper-evident logs of relevant communications and decisions, retained for years.
• Mickai runs inside your boundary and signs every action into an Open Audit Record with FIPS 204 ML-DSA, so audit becomes a query, not a project.

What is the evidence bar in a regulated firm?

The evidence bar is the standard a firm must meet to show a supervisor, an auditor or a court that a control actually worked. In UK and EU financial services this rests on the systems and controls expectations set by the FCA and the PRA, and on record-keeping duties under MiFID II that require firms to retain relevant records for at least five years. For AI, meeting the bar means producing a complete, unaltered trail linking data, model, prompt, output and the person accountable, on demand.

Why does MNPI make cloud AI risky?

Material non-public information (MNPI), known in the UK and EU as inside information under the Market Abuse Regulation, must be tightly controlled to prevent misuse and unlawful disclosure. When MNPI is sent to a general-purpose model hosted by a third party, the firm often cannot evidence where the data went, how long it was retained, or whether it shaped another customer's output. That control gap is difficult to close after the fact and harder still to explain to a regulator.

A sovereign approach removes the gap by keeping the information inside the firm's own boundary. Because the model, the data and the logs never leave infrastructure the firm governs, the firm can answer the only question that matters: this information was never exposed, and here is the signed record that proves it.

How is AI model risk governed?

Model risk management is a long-standing supervisory expectation. The PRA's supervisory statement on model risk management (SS1/23) sets principles for identifying, validating and monitoring the models banks rely on, and the discipline applies to AI models as much as to traditional ones. Firms are expected to maintain a model inventory, document assumptions and limitations, validate performance independently, and monitor for drift over time.

Meeting these principles for AI is far easier when the model runs in a governed environment. Mickai treats each model as a controlled asset, records its version and configuration, and captures every inference as evidence, so validation and monitoring draw on a single, trustworthy record rather than scattered exports.

What can an auditor actually check?

An auditor needs to reconstruct events, not accept assertions. In Mickai, every action is written to the Open Audit Record and signed using FIPS 204 ML-DSA, the post-quantum digital signature standard, which makes any later alteration detectable. An auditor can query the record to see which user invoked which model version, what inputs were supplied, what output returned, and when, with each entry cryptographically bound to the rest.

Because the record is tamper-evident rather than merely stored, the firm can demonstrate integrity, not just possession. This turns a routine audit from a scramble for logs into a direct query against evidence that was captured the moment each event occurred.

Why does record-keeping favour a sovereign approach?

Record-keeping obligations under MiFID II and the equivalent UK rules require durable, complete and readily retrievable records, retained for at least five years and sometimes longer at a regulator's request. Operational resilience expectations, including the EU's Digital Operational Resilience Act, add duties around controlling and evidencing the technology a firm depends on. A sovereign design keeps those records under the firm's own control, in a form that can be produced quickly and shown to be unchanged.

Mickai, founded by Micky Irons, was built so that this evidence is a by-product of normal work rather than a separate compliance exercise. Every studio in the SIOS writes to the same Open Audit Record, giving one consistent source of truth across the organisation.

Frequently asked questions

Can I use a public AI chatbot with client MNPI?

The core risk is that once material non-public information leaves your boundary, you can no longer evidence how it was handled, and that control is exactly what supervisors expect firms to keep. A sovereign approach keeps the information inside infrastructure you govern, so the firm retains both control and proof. This is a compliance and risk matter for each firm to assess, and it is not investment advice.

Does sovereign AI mean I lose model quality?

No. Sovereignty is about where intelligence runs and how it is evidenced, not about capability. Mickai runs capable models inside the firm's own boundary while recording every action, so firms gain auditability without giving up performance.

How do I prove to an auditor that a record was not changed?

Every action in Mickai is signed into the Open Audit Record using FIPS 204 ML-DSA, a post-quantum signature standard, so any alteration to an entry breaks its signature and is detectable. The auditor verifies signatures against the record rather than trusting that files were left untouched.

Is Mickai only for banks?

No. Any regulated financial firm facing MNPI controls, model risk expectations and record-keeping duties can benefit, including asset managers, insurers, brokers and payment firms. The SIOS is built to meet the same evidence bar across regulated sectors.

Does Mickai hold patents in this area?

Yes. The architecture is protected by 104 filed UK patent applications, approximately 2,340 claims, owned by Mickai LTD. These are filed applications covering the sovereign design and its audit and control mechanisms.