By Micky Irons, founder and CEO of Mickai.
Every institution now runs the same experiment. A team spins up a chatbot, a copilot, a summariser. It works in the demo, wins a round of applause, and then quietly stalls when it meets the auditor, the regulator, or the board. The pilot was never the hard part. Turning that spark into an owned, governed, permanent capability is where most organisations lose their nerve.
A sovereign AI Centre of Excellence is the answer to that stall. It is not a lab, not a hackathon, and not a licence you rent by the seat. It is a standing institutional function that owns its intelligence outright, governs it under law, and keeps the receipts. We built Mickai as the substrate for exactly this, and here is how the capability comes together.
Why a pilot is not a capability
A pilot proves that intelligence can do a thing. A capability proves that your institution can do that thing repeatedly, safely, and defensibly, for years, in front of anyone who asks. The gap between the two is not model quality. It is ownership, governance, and evidence.
When intelligence lives in someone else's cloud, behind someone else's terms, your Centre of Excellence is a tenant, not an owner. It cannot promise where data went, cannot freeze a capability version for a regulator, and cannot prove after the fact what any action did. The public cloud giants, our allies at a different layer, serve the open world superbly. They were never built to cross the regulated boundary on your terms. That boundary is where a sovereign Centre of Excellence has to stand.
Own the intelligence, do not rent it
Sovereignty starts with possession. A sovereign Centre of Excellence runs on hardware the customer owns, air-gapped or on-premise, with zero data egress. Nothing leaves the boundary you control. The intelligence is not a subscription that can be revoked, repriced, or silently retuned under you.
Hestia kept the hearth that never went out, the way an institution keeps a capability that outlives every project.
Inside that boundary, capability is delivered as brains and studios. Brains are the specialised, revocable subsystems of intelligence. Studios are the workspaces where a department puts them to work. Because every brain is revocable, a Centre of Excellence can grant, suspend, or retire a capability the way it manages any other institutional asset. The point is not to hoard everything on day one. It is to own the ability to decide, forever, without asking a vendor for permission.
Govern it under law, by design
Governance cannot be a policy document stapled to a system after launch. It has to be the mechanism itself. In a sovereign Centre of Excellence, every action is signed before it runs. Our Operation Attestation Record, the OAR, is created and signed ahead of execution, so the system commits to what it is about to do before it does it. There is no acting first and reconstructing intent later.
Themis held the scales that decide before the deed, the way attestation signs an action before it runs.
High-stakes actions raise the bar further. Releasing funds, changing a control, touching regulated data: these can require multi-brain agreement plus voice-biometric approval from a named human, so no single automated path can move alone. That is how a Centre of Excellence satisfies the General Data Protection Regulation (GDPR), the European Union Artificial Intelligence Act (EU AI Act), the Digital Operational Resilience Act (DORA), the second Network and Information Security directive (NIS2), and sector regimes such as the Health Insurance Portability and Accountability Act (HIPAA), the second Markets in Financial Instruments Directive (MiFID II), or the Sarbanes-Oxley Act (SOX), without bolting compliance on at the end. The governance is the plumbing.
Keep the receipts nobody can forge
Trust in an institution is not a feeling. It is evidence you can produce on demand. A sovereign Centre of Excellence maintains a tamper-evident, cryptographically-signed audit ledger: every attestation hash-linked into a chain using SHA-3-512, so altering one record breaks every record after it.
Those signatures are post-quantum. We use the ML-DSA-65 scheme standardised as Federal Information Processing Standard 204 (FIPS 204), so an audit trail signed today still verifies decades from now, even against a future adversary with a quantum computer. And verification is offline: a regulator, an insurer, or an internal auditor can check the ledger against the mathematics alone, without calling home to any server and without trusting us. That is the difference between a log you keep and proof anyone can check.
Stand it up as an institution, not a team
A Centre of Excellence earns the name by becoming permanent. Give it a charter, a named owner, and a mandate that outlives any single project. Its first job is not to ship one flashy use case. It is to define how every future use case will be owned, governed, and evidenced across the organisation.
Mnemosyne remembered everything perfectly, the way a hash-linked ledger keeps a record none can forge.
Then let capability spread by studio. Pick one department with a real, painful, regulated workload. Prove the full loop there: signed actions, revocable brains, offline-verifiable ledger, human approval on the high-stakes steps. Once that pattern holds under scrutiny, the same substrate carries the next department and the next, because the governance model never changes as the surface grows. The institution scales its confidence, not just its tooling.
The moat is capability, held under your law
What makes a sovereign Centre of Excellence durable is that the hard capabilities are protected and specific. Mickai rests on 104 filed UK patent applications, about 2,340 claims, owned by Mickai LTD, each describing a concrete mechanism: attestation before execution, hash-linked ledgers, revocable brains, the approval choreography behind a high-stakes action.
Hephaestus forged what others could only imagine, the way patented capability is built, not merely claimed.
For an institution, that matters in a practical way. The capability you are standing up is not a thin wrapper anyone can clone next quarter. It is a defined body of engineering you can build on, aligned with emerging assurance regimes such as the ISO 42001 AI management standard, the National Institute of Standards and Technology AI Risk Management Framework (NIST AI RMF), and the transparency duties arriving under the EU AI Act. You are not chasing the frontier. You are compounding a moat inside your own boundary.
The bottom line
A sovereign AI Centre of Excellence is what a pilot becomes when an institution decides to grow up. It owns its intelligence outright, on hardware it controls, with nothing leaving the boundary. It governs every action by signing it before execution and demanding human approval where the stakes are highest. And it keeps proof no one can forge, verifiable offline, for as long as the law requires.
Do that, and AI stops being an experiment your board tolerates and becomes a capability your institution owns. That is the whole point of building it under your own law, on your own ground, on terms only you can change.
Written by Micky Irons. Originally published at https://mickai.co.uk/articles/building-a-sovereign-ai-centre-of-excellence. More from Micky Irons and Mickai at mickai.co.uk.
Top comments (0)