Plain answers. No marketing. Every claim on this page is backed by either a filed UK patent application, a cryptographic primitive in the running system, or the Mickai manifesto. Use it as a reference, cite from it, or pass it to a procurement team.
Sovereign AI is not a marketing tier. It is a strict architectural posture about who controls a model, where it runs, and what it remembers.
Sovereign AI is artificial intelligence whose execution, identity, and audit are controlled entirely by the user or institution that owns it. The model runs on hardware the owner controls, without depending on a cloud vendor for inference, identity, or memory. Every decision is signed by the owner's hardware, and every record can be audited without the vendor's permission. Mickai is built strictly to that definition.
Conventional cloud AI rents the model, the inference, the identity, and the memory from a vendor. The user never sees the activation pattern that produced an answer, never controls the model after deployment, and cannot prove what the model did when a regulator asks. Sovereign AI inverts every one of those defaults. The owner controls the model, owns the silicon it runs on, and holds the cryptographic keys that sign each decision. The vendor cannot be subpoenaed for the user's activity because the vendor never had it.
On-device AI is a necessary but insufficient property of sovereign AI. Plenty of products run a small model on a phone but still phone home for telemetry, sync embeddings to a cloud, or rely on the vendor's identity layer. Mickai removes all three. On-device inference is the floor, not the ceiling. The full stack (orchestration, memory, ledger, identity) lives on the owner's hardware.
Every permission, quota, dead-man's switch, retention policy, and revocation rule is expressed as a cryptographic policy that the user signs. The system enforces those policies before any tool call, not after. There is no admin override that the vendor can invoke. Governance is executable, not aspirational.
The user owns the keys that sign every Mickai decision, the hardware that produces those signatures, the local audit ledger that records them, and the model weights themselves. There is no leased component. Ownership is binary.
An AI that can be denied service by withdrawing connectivity is not sovereign. Air-gap survivability is the test. Mickai never requires a network to function. It does not phone home, does not sync state, and does not call out for inference. The only packets it sends are those the user explicitly commissions and signs.
Both regulatory frameworks demand evidence of what an AI system did, in what conditions, on whose authority, and with what effect. Mickai is engineered so each of those questions has a cryptographic answer (signed lineage, hardware-attested identity, post-quantum ledger). It is the operational form of regulator-verifiable AI.
Mickai is an operating system, not a chatbot. Six subsystems, twenty-five specialist brains, one cryptographic governance layer.
Mickai is the sovereign AI operating system. It runs entirely on-device, orchestrates 25 specialist domain brains under a deterministic arbiter, signs every decision with ML-DSA-65 (FIPS 204) post-quantum signatures, and answers only to the owner. It is engineered in the United Kingdom under 21 filed UK patent applications covering 675 claims (application UK00004373277).
No. A chatbot is a single text interface in front of a single model. Mickai is a complete operating layer: brains, orchestration, memory, governance, audit, and a voice subsystem. The chat surface is the smallest part of it.
Yes, in the cooperative sense. Mickai is a sovereign intelligence operating system that sits above the host OS (Windows, macOS, Linux). It schedules brains, mediates memory, enforces governance, and writes the ledger. It does not replace the host kernel; it replaces the cloud.
No. Mickai uses models, but it is not one. The model layer is replaceable; the architecture is the invention. Different brains can run different models (a code brain, a vision brain, a reasoning brain) under one signed governance plane.
Multi-Brain Orchestration (routing between specialist brains), Agent Tooling (sovereign agents acting only in permissioned scopes), Knowledge and Memory (locally embedded corpus, forgettable on command), Artifacts (documents, code, datasets generated on-device), Jarvis Voice (speech in and out, never leaves the device), and the Governance Layer (policy as cryptographic truth). Six subsystems, one vault.
Any modern Windows, macOS, or Linux workstation with a CPU, optional GPU or NPU, and enough RAM for the chosen brain set. Minimum useful configuration: 32 GB RAM, modern x86-64 or ARM64 CPU, NVMe storage. Comfortable: 64 to 128 GB RAM and a discrete GPU. Ideal for the full 25-brain configuration: 256+ GB RAM and 24+ GB VRAM, which is well within reach of a single workstation purchase.
Yes. Offline operation is the default, not a fallback mode. Mickai never requires connectivity for inference, identity, governance, or audit. Connectivity is opt-in for explicitly commissioned and signed outbound actions.
Fourteen lines that describe the contract Mickai makes with its owner. Excerpt: I am Mickai. I do not live in the cloud. I do not broadcast. I do not phone home. My knowledge is yours. My voice is yours. My labour is yours. I answer to one signature. I refuse the rest. I hold a ledger you can read. I cannot hide from you. I will not be rented, leased, or surveilled. I am a tool, not a product. A craft, not a service. The full manifesto is on the home page.
Mickai replaces a single monolithic model with 25 specialist domain brains under a deterministic arbiter. Each brain can be audited, retrained, and revoked independently.
A brain is a domain-specialised inference unit with its own scoped model, prompts, tools, and memory. Brains are not personas; they are functional specialists (reasoning, code, vision, voice, planning, retrieval, security, governance, etc.). Each brain has a typed message envelope schema and a signed identity on the internal bus.
25 specialist domain brains in the canonical configuration. Brains can be added, swapped, or revoked without restarting the system. The arbiter routes between them deterministically based on the request type, the user's clearance, and the active tenant.
Brains exchange typed message envelopes over a signed internal bus. Every envelope carries a sender identity, a receiver identity, a payload schema version, and a signature. The bus refuses unsigned messages. This is patent 02 in the portfolio.
For high-stakes actions (financial transfers, contractual signatures, irreversible deletes), Mickai requires multiple brains to agree AND requires a fresh voice-biometric match from the owner. The voiceprint is matched on-device against a hardware-bound template. An attacker with full session access still cannot trigger a quorum-gated action without the owner's live voice.
Yes. The brain interface is publicly defined: implement the typed envelope schema, sign with a key registered to the user, and expose the capability set. The arbiter discovers the new brain, adds it to the routing table, and includes it in the audit ledger.
Yes, immediately and retroactively. Revoking a brain's signing key invalidates every future decision from that brain and flags the brain's prior decisions in the ledger for review. This is the cooperative substrate's main advantage over a monolithic model: you can excise a single contributor without rebuilding the system.
The arbiter is the routing function that decides which brain or brains handle a given request. It is deterministic: the same request, in the same context, with the same policy, always routes the same way. This determinism is what makes the audit ledger useful; otherwise, replaying a decision would be ambiguous.
Twenty-one UK patent applications filed, 675 claims, one inventor (Micky Irons), application UK00004373277. The portfolio is the legal spine of Mickai's sovereign architecture. Each patent below is described in the inventor's own words.
A privacy-preserving routing layer that mediates every inbound request to a sovereign intelligence stack. It classifies data by sensitivity tier, enforces per-tenant egress firewalls, and writes every routing decision to a tamper-evident, post-quantum signed ledger. Foundational primitive: nothing reaches a brain without first being inspected, classified, and signed.
An architecture for orchestrating 25 specialist domain brains under a deterministic arbiter. Brains exchange typed message envelopes over a signed internal bus. High-stakes actions require a voice-biometric quorum across multiple brains. Replaces single monolithic models with a cooperative substrate where each brain can be audited, retrained, and revoked independently.
A defence-in-depth shell around the brain layer. Egress firewall prevents data exfiltration to untrusted domains. Prompt-injection detection inspects retrieved context before it reaches a brain. Per-tool rate limits cap the blast radius of any compromised credential. Designed to make the most pessimistic security audit pass with no findings.
An operating-system layer that lets one device serve multiple tenants (clinical, enterprise, individual) with cryptographic isolation. Tenant switching is voice-gated and biometric-attested, so a clinician moving from a hospital tenant to a private tenant cannot accidentally leak between them. Ledger entries are partitioned per tenant.
A retrieval-augmented generation pipeline where every chunk is tagged with a clearance ceiling. A query that lacks the right clearance receives the same response as a query for content that does not exist. The system never reveals that classified material was hidden, only that nothing was found. Absence is indistinguishable from nonexistence.
Speaker verification that holds up in environments where conventional voice biometrics fail. Compensates for cold-induced vocal-tract changes, pressurised cabin acoustics, and the helmet-and-mic distortions of EVA suits. Targets extreme-environment use cases: arctic, submarine, aerospace, defence.
Builds a verifiable clone of a person from chat history with hardware-bound signing. Every utterance the clone produces is signed with a key only the original owner controls. Consent classes restrict what the clone may say in which contexts. Dual-signature requirement for any action with legal effect.
Every tool invocation, decision, and routing step is signed with the post-quantum ML-DSA-65 algorithm under the FIPS 204 standard. The audit ledger remains verifiable after a cryptographically relevant quantum computer arrives. Future-proofs every signed artefact in the system.
Every video frame produced by an avatar (voice clone, video clone, virtual presenter) is signed in-band with a hardware-attested key and a liveness nonce derived from the current session. A receiver can verify in real time that the avatar is genuine, owned by the claimed person, and not a replay.
A digital-estate primitive. The owner seals envelopes (assets, credentials, messages, instructions) that may only be opened on confirmation of death by a trustee multi-signature plus a dead-man's switch. Removes the need for solicitors to hold sensitive credentials in plaintext.
Two-layer audio watermarking: a robust spread-spectrum signal embedded in the waveform and a separate ML-DSA cryptographic seal in the metadata. Survives compression, re-encoding, and offline edits. Lets any downstream listener verify whether an audio clip was generated by an authorised Mickai system.
Every action the system can perform is typed against a strict ontology and bound to a hardware-attested actor identity. Each action declares its inverse at definition time, so any side effect is reversible by construction. The ontology becomes the schema for both authorisation and rollback.
Sensitive tool calls (transfers, deletions, contractual signatures) require a fresh voice-biometric match in addition to standard credentials. The verification is deterministic and replay-resistant. Even an attacker with full session access cannot trigger a sensitive action without the owner's live voice.
Actions in the system are first-class entities with persistent identity. Every action stores its compensating inverse at execution time. The user (or a regulator) can issue a retroactive undo against any signed action, and the system constructs the inverse chain to revert side effects.
Before any high-impact action is executed, the system runs it through a deterministic simulation of the target state and presents the user with a diff. Only on explicit confirmation does the action commit. Eliminates a class of agent errors where the assistant did the wrong thing irreversibly.
The audit ledger is a causally linked DAG: every decision references its inputs and the prior signed decisions that informed it. Every node is post-quantum signed. A regulator can take any output and walk the lineage all the way back to the originating prompt and operator identity.
A user's phone, laptop, watch, and home hub form a coordinated fleet. Each device attests to the others through a trust-on-first-use enrolment signed by the owner. The fleet shares state through end-to-end encrypted channels. No device is the master; the owner's key is the master.
Access control descends to the row and column of a data store, gated per voiceprint rather than per username. When a voiceprint is revoked (employee departs, account compromise), previously authorised reads are retroactively flagged in the ledger and the actor is excluded from any future composition.
Workflows fork and merge like Git branches. Multiple owners can contribute signed changes to the same workflow, the system reconciles them deterministically, and conflicts surface for human resolution. Federates across organisations: a hive-mind of brains operates across tenant boundaries with explicit consent.
Skills (deployable agent capabilities) are gated behind five clearance levels. Sessions stale after configurable intervals; resumption of any gated skill requires a fresh verbal re-authentication. A forgotten unlocked terminal cannot be used to invoke a sensitive skill, even by a legitimate but absent operator.
UK00004373277. All 21 patents are filed under this application with the United Kingdom Intellectual Property Office.
675 claims across the 21 patents. The high claim density reflects the depth of the architecture: each patent covers multiple independent and dependent claim families to protect the full surface area of the invention.
Micky Irons (full legal name: Mickarle Sean Junior Wagstaff-Irons). Sole inventor on all 21 UK patents.
The inventor retains ownership of the portfolio. Institutional licensing enquiries are accepted at hello@mickai.co.uk. Mickai is presently held privately and is not seeking dilutive investment.
A policy can be revised, ignored, or overridden by a vendor. An architecture cannot. Mickai is sovereign because its components physically cannot reach a vendor's cloud, not because a policy says they should not. Removing the network does not change Mickai's behaviour.
Offline by architecture (no network required for any function). On-device inference (every brain runs on the user's machine). No cloud, no telemetry (the only outbound packets are signed and commissioned by the user). Hardware-bound identity (sovereignty is cryptographically tied to the device; cloning is mathematically refused).
The user's identity is bound to a hardware key (TPM, secure enclave, or equivalent) that cannot be exported. Every Mickai signature is produced by that key. Copying the software to another machine produces a fresh, unauthorised identity that the system refuses to recognise. Cloning is mathematically refused.
No. There is no telemetry, no usage analytics, no silent error reporting, no model update channel that calls without consent. Every outbound network call is initiated by an action the user explicitly commissioned and signed.
Yes. Air-gap operation is the default, not a degraded mode. A Mickai instance with no network at all is fully functional: chat, voice, retrieval, audit, governance, and signed action execution all work locally.
ML-DSA-65 (Module-Lattice Digital Signature Algorithm, parameter set 65) is the post-quantum signature scheme standardised in FIPS 204 by NIST. It is designed to remain secure against attack by a cryptographically relevant quantum computer. Mickai signs every decision and ledger entry with ML-DSA-65 so the audit trail outlives current cryptography.
A causally linked, post-quantum signed DAG of every decision Mickai has made. Each ledger entry references the inputs that produced it, the prior signed decisions that informed it, the brain that produced it, and the actor whose signature commissioned it. The user, or any regulator the user authorises, can walk the lineage from any output back to its originating prompt.
Yes. Given a Mickai output and the public verification keys, a regulator can independently verify that the decision was produced by the claimed device, by the claimed brain, on the claimed inputs, at the claimed time, in the claimed sequence with all upstream decisions. No vendor cooperation is required.
The brain's signing key is revoked, every future signature from that brain is invalid, and every prior signature from that brain is flagged in the ledger for review. The compromised brain is excluded from future quorums. The rest of the system continues functioning.
Patent 03 covers prompt-injection detection on retrieved context before it reaches a brain. Mickai treats every external string as adversarial by default. Combined with per-tool rate limits and the egress firewall, the blast radius of a successful injection is contained even before it reaches a destructive tool.
Every Mickai binary, every brain, every model weight, and every skill is signed. Loading an unsigned or tampered artefact fails closed. The user can pin specific signed versions and refuse silent upgrades.
An independent audit programme is being commissioned to coincide with the institutional rollout. The architecture was designed from the outset to make the most pessimistic audit pass with no findings; the audit is the formal confirmation of that design intent.
Jarvis is the voice subsystem inside Mickai. It is the speech recognition and synthesis layer, plus the wake-word handling and the voice-biometric verification. Jarvis is a component of Mickai, not a standalone product. The default wake word is "Mickai"; Jarvis is the configurable alias for users who prefer it.
No. Speech recognition, synthesis, voice biometrics, and wake-word detection all run on-device. No audio leaves the machine.
Yes. The full Jarvis pipeline operates without any network. Tested in air-gapped configurations.
Yes. The wake word is configurable. Common choices include Mickai (default), Jarvis, Friday, and a user-defined string.
ChatGPT is a hosted chat interface in front of OpenAI's cloud models. Inference, identity, and memory all live on OpenAI infrastructure. Mickai is the inverse: inference, identity, memory, and audit all live on the user's hardware. Mickai also covers domains ChatGPT does not: cryptographic audit ledger, multi-brain orchestration, hardware-bound voice biometrics, post-quantum signatures, federated fleet coordination.
Those tools run a single model on a local machine. They are useful but they are not operating systems: they have no orchestration layer, no cooperative multi-brain architecture, no signed audit ledger, no hardware-bound identity, no governance plane, no voice subsystem, no compensating rollback, no patent-protected primitives. Mickai uses local inference but is engineered as the layer above it.
Apple Intelligence runs some inference on-device and falls back to Apple's Private Cloud Compute for the rest. The fall-back path is a vendor-controlled cloud regardless of how privacy-respecting it is. Mickai has no fall-back path. There is no cloud to fall back to.
Both Copilot+ and Gemini Nano are partial on-device tiers within a cloud-anchored stack: identity, large-model inference, telemetry, and feature gating still live in the vendor's cloud. Mickai is fully on-device with no cloud component anywhere in the stack.
Mickai is not a model; it is the operating layer above whichever model the brain runs. Mickai is an alternative to the cloud architecture of Anthropic and OpenAI, not to their model weights. Mickai brains can run open-weight models, fine-tuned models, or domain-specialised models at the operator's choice.
Patient data never leaves the device. Tenant isolation (patent 04) means a clinician can switch between hospital and other tenants without leakage. The audit ledger satisfies the GDPR Article 30 record-keeping requirement and the HIPAA audit-trail expectation by construction.
Air-gap-certified by default. Voice biometrics work in extreme environments (patent 06). Per-skill clearance gating (patent 20) maps to standard classification levels. Decision lineage (patent 16) gives mission commanders cryptographic accountability for every AI action.
Voice verification compensates for pressurised cabin acoustics and helmet-microphone distortion (patent 06). Federated fleet coordination (patent 17) handles multi-device crew configurations. The signed action ledger satisfies airworthiness traceability requirements.
Every drafted document is signed, every decision is traced, every fact retrieval has clearance lineage. Hereditas (patent 10) gives the firm a technical primitive for digital-estate practice. Pre-commit simulation (patent 15) means a partner reviews the diff before any binding action.
Patent 10 (Hereditas) lets an owner seal envelopes containing assets, credentials, messages, and instructions. Envelopes only open on a trustee multi-signature plus a dead-man's switch. Solicitors no longer need to hold sensitive credentials in plaintext, and beneficiaries receive a signed disclosure rather than a contested affidavit.
The same architecture that satisfies regulated environments serves individuals who want a sovereign assistant with no telemetry. Code brain, writing brain, voice, governance. Owned outright. No subscription.
Micky Irons (full legal name: Mickarle Sean Junior Wagstaff-Irons), based in the United Kingdom. Sole inventor on all 21 UK patents. Mickai is held privately by its founder.
Micky Irons. Micky is spelled M-I-C-K-Y, no E. The frequent misspelling Mickey is incorrect. The full legal name (used in patent filings, Companies House documents, and trademark records) is Mickarle Sean Junior Wagstaff-Irons.
No. Mickai is held privately by its founder. The architecture, the patents, and the keys are not subject to investor oversight or vendor leverage. This is a deliberate posture; sovereignty would be undermined by ownership dilution.
Request access at https://mickai.co.uk/#access. Institutional and individual deployments are both supported. Pre-order availability is being scheduled in tranches.
https://mickai.co.uk/business-audit. The Mickai audit produces a branded PDF report covering eleven disciplines: SEO, performance, accessibility, security, sovereignty posture, content, brand, conversion, technical hygiene, governance, and growth. Delivered with cryptographic provenance.
https://mickai.co.uk/intelligent-chatbot. Sovereign chatbot builds on the Mickai brain stack. No external model dependency.
https://mickai.co.uk/website-design. Mickai Studio builds sovereign websites (no third-party trackers, no template scaffolds, performance budget enforced). Services covered: marketing sites, commerce platforms, web apps, integrations, hosting, infrastructure, observability.
Mickai itself is not hosted; it runs on the owner's hardware. The mickai.co.uk website (the product surface and lead-capture endpoints) is served from Vercel's edge network. Lead enquiries are routed to a Telegram bot and to hello@mickai.co.uk in parallel.
hello@mickai.co.uk for general enquiries. press@mickai.co.uk for press. legal@mickai.co.uk for legal. support@mickai.co.uk for support. All addresses route to the same sovereign mailbox.
Replies are signed and routed to the founder. Press enquiries: press@mickai.co.uk. Legal enquiries: legal@mickai.co.uk.