Keep the chain intact. Read the documents where they already sit, on hardware you own, and make every extracted statement cite its source document, version and page. Then have a named person approve anything consequential, and seal that approval in a tamper-evident audit record an external auditor can verify offline.
Why is the document pile the hardest part of the decision?
Because that is where the evidence sits, and evidence is what has to survive a challenge. The analysis is rarely the bottleneck. In most regulated organisations the answer already exists somewhere: in a contract, a survey report, a superseded policy version, a scanned form filed in 2014.
What breaks is the chain. Someone finds the relevant pages, reads them, writes a summary, and the summary goes into a paper. The paper says the contract permits assignment. Nine months later a regulator, a counterparty or an internal auditor asks which contract, which clause, which version, and who read it. The link is gone. The person has moved teams. The summary is now the only artefact, and it cannot be checked without redoing the whole job from scratch.
So the real question is not whether a machine can read your documents. Plenty of things can read documents. The question is whether the reading leaves behind something another person can follow backwards, years later, when everyone involved has moved on.
What does a decision you can defend actually mean?
It means you can produce three things on demand: the evidence that was used, what the system did with it, and which named person accepted the result. Defensible is not the same as correct. Correct decisions still go wrong and defensible ones still get challenged. The difference is that a defensible decision can be examined rather than asserted.
That framing is not mine. The accountability principle in UK data protection law requires an organisation to demonstrate compliance, not simply to achieve it, and the ICO's guidance on accountability and governance treats documentation as the demonstration itself (ICO). The Data Protection Act 2018 sits behind that (legislation.gov.uk). For firms under the FCA, the SYSC record-keeping and governance obligations push in the same direction (FCA Handbook).
The practical consequence is a design choice. A document system for regulated work has to be built as an evidence system that happens to answer questions, not as a question-answering system that happens to touch evidence. Those two things look similar in a demonstration and behave nothing alike under scrutiny.
Can the documents be read without leaving the building?
Yes, and for regulated material they should be. The common pattern is to send the document to someone else's inference cluster, take the answer back, and accept a contractual promise about what happened in between. That is a fair trade for a marketing brochure. It is a poor trade for a client file, a defence contract or a member record.
I am not arguing against the cloud. The companies building the compute and cloud layer are doing hard work, and for non-regulated workloads renting that capacity is the sensible answer. What I object to is the assumption that a regulated organisation has no other option: that it must ship its most sensitive material offsite and take a vendor's word for what happened to it.
The Mickai Sovereign Intelligence Operating System (SIOS) runs on hardware the customer owns. It is offline capable, with no data egress. For document reading that means optical character recognition, layout parsing and the language model all run on the same machines, inside the same network boundary, under the physical controls the organisation already operates. Local OCR has read scanned PDFs in our own controlled internal testing, including poor-quality scans. That is our own testing on our own files, not an independent benchmark, and it is not a substitute for running it on yours. The NCSC's cyber security design principles set out making compromise difficult, including reducing the attack surface a system exposes (NCSC). Not moving the document anywhere is the plainest version of that.
What happens between a scanned page and an answer?
Four steps: extraction, structuring, retrieval and attribution. Extraction turns pixels into text and keeps the coordinates. Structuring works out that this block is a table, that one a signature panel and this one a clause heading, so a question about payment terms does not come back with the header of page one. Retrieval finds the passages that bear on the question. Attribution is the step most systems skip: every statement in the output carries a pointer back to the document, the version, the page and the region it came from.
Attribution is what makes review possible without repeating the work. A reviewer does not have to trust the summary. They open the cited page and look at it.
I should be straight about the state of this. The reading components work. The full extraction and ingestion integration inside SIOS, meaning the pipeline that takes an organisation's live repositories, ingests them continuously, versions them and wires them through to every studio that needs them, is still being completed. That is engineering still in progress, and I would rather say so than let a buyer find out later. If anyone tells you their ingestion is finished, ask them to run it on your files rather than their sample set.
What does the Open Audit Record prove, and what does it not?
Every consequential action in SIOS is sealed in an Open Audit Record, signed with ML-DSA-65, the post-quantum signature scheme NIST published as FIPS 204 in 2024 (NIST). Export the record and an auditor verifies it offline with a public key, using tools that are not ours. That last point matters more than the cryptography. Verification that depends on the vendor's own software is not verification.
What it proves is narrow and precise. The record has not been altered since it was sealed. Edit a line, move a timestamp, remove an entry, and verification fails. The OAR is tamper-evident. It is not tamper-proof, it does not prevent attacks, and it does not guarantee compliance with anything. It makes silent alteration detectable, which is a different and more honest claim than making alteration impossible.
What it does not prove is that the answer was right. A signed record of a bad extraction is a bad extraction, sealed. The gain is that the bad extraction is now visible, attributable and reviewable, instead of being laundered into a summary nobody can trace.
Where does a person still have to sign?
At every consequential action. The system reads, extracts, retrieves and drafts. It does not decide. Anything with a consequence, releasing a document, filing a return, amending a record, sending a response, waits for a named person to approve it, and that approval becomes part of the sealed record.
This is a deliberate limit and it is the one people argue with most. The case for autonomy is throughput. The cost of autonomy in a regulated setting is that you lose the human you need to be able to point at. I would take a slower process with an accountable name attached over a fast one where the honest answer to "who decided this" is "the system did".
How would you start without betting the organisation on it?
Pick one bounded corpus and one recurring question. Not the whole estate. One document type, one team, one question that costs a person several hours and gets asked every week: supplier contract terms, planning conditions, policy exceptions, claims correspondence.
Then run it against material where you already know the answer, and measure three things yourself: time taken, error rate against a human baseline you established, and whether the citations actually land on the right page. Do not take a number from me or from anyone else selling you something. Measure it on your own files, on your own hardware, with your own people checking the output.
For the record on who is saying this. Mickai LTD is a UK company, Companies House 17166618, held privately by me. MICKAI is a registered UK trade mark, UK00004373277. We hold 104 filed UK patent applications carrying 2,340 claims, filed and not granted. SIOS spans 63 studios, 14 production-ready at launch and 49 in development, supported by 50 specialised models. The closed beta is open, with one regulated company onboarding as a design partner.
Frequently asked questions
Can SIOS read scanned PDFs, or only documents that already contain text?
Local OCR has read scanned PDFs in controlled tests on our own hardware, including poor-quality scans. The reading components run on the customer machines with no data egress. The wider extraction and ingestion integration inside SIOS, which connects live document repositories and versions them continuously, is still being completed.
What happens if someone alters the audit record?
Verification fails. The Open Audit Record is sealed with ML-DSA-65, the post-quantum signature scheme NIST published as FIPS 204 in 2024. It is tamper-evident, not tamper-proof: it does not prevent an attack and does not guarantee compliance. It makes alteration detectable by an auditor verifying the exported record offline, with tools that are not ours.
Does the system make decisions on its own?
No. It reads, extracts, retrieves and drafts. Every consequential action waits for a named person to approve it, and that approval forms part of the sealed record. The limit is deliberate. In a regulated setting you need an accountable human name attached to the outcome, not a log entry saying the system proceeded on its own.
Do our documents leave our network at any point?
No. SIOS runs on hardware the customer owns and is offline capable, with no data egress. Optical character recognition, layout parsing and the model all execute inside your own network boundary, under the physical and access controls you already operate. Nothing is sent to an external inference endpoint for processing.
How do we test this against our own documents?
Choose one bounded corpus and one recurring question, then run it on material where you already know the answer. Measure the time taken, the error rate against a human baseline you set yourself, and whether every citation lands on the correct page. The closed beta is open, with one regulated company onboarding as a design partner.
Written by Micky Irons, founder and chief executive of Mickai LTD, which builds a sovereign AI operating system for regulated organisations. More at mickai.co.uk.
Top comments (0)