By Micky Irons, founder of Mickai.
Two jurisdictions, one set of scales. The question is no longer which rulebook applies, but whether you can prove what your systems did under either.
The fragmentation everyone predicted has arrived. Colorado's AI law and the European Union's AI Act now sit on the desk of the same operator, and they do not agree. They use different definitions of a high-risk system, different triggers for disclosure, different timelines, and different evidence of good faith. An operator selling into Denver and Dublin no longer faces one compliance question. They face two, and the two pull in opposite directions.
Colorado leans on a duty of reasonable care to prevent algorithmic discrimination, with impact assessments and consumer notice at its centre. The European Union leans on a risk taxonomy, conformity assessment, and a paper trail held ready for a regulator who may never knock but is entitled to. Neither asks the same thing in the same words. Both ask the operator to demonstrate, after the fact, what a system actually did and why.
The seam is where the cost lives
The expensive part of a regulatory patchwork is not any single rule. It is the seam between rules. An operator can read Colorado's statute in an afternoon and the AI Act over a long weekend. What they cannot do cheaply is maintain two separate, defensible accounts of the same software behaving the same way, each framed for a different reader, each current, each trustworthy a year later when a complaint lands.
Most organisations close that seam with people. They hire counsel in two jurisdictions, stand up a compliance function, and produce documents on request. That works until the documents disagree with each other, or with the logs, or with what the system actually did in production. A record assembled after a dispute, by the party with the most to lose, is the weakest evidence there is. Everyone in the room knows it can be edited.
A record only helps if it travels. The same sealed account has to satisfy a Colorado consumer notice and a European conformity file without being rewritten for each.
One record, two readers
The way out of the seam is not a second legal team. It is a single record of what the system did, captured as it happens, framed once and read by both regimes. Colorado wants to see that you exercised reasonable care. The European Union wants to see your assessments and your logs. Both are satisfied by the same underlying fact, a contemporaneous, tamper-evident account of each consequential decision, who or what made it, on what inputs, under which policy.
This is the work Mickai was built to do. Mickai is a Sovereign Intelligence Operating System, a SIOS that runs fifty specialised AI brains, twenty-five domain and twenty-five operational, on the operator's own hardware and fully offline if required. It does not send the operator's regulated activity to a third party to be judged. The operator keeps the systems, the data, and the proof in the same place, under their own control.
At the centre of that proof is the Open Audit Record. Every consequential action the SIOS takes is sealed and signed with FIPS 204 ML-DSA-65, the published NIST post-quantum signature standard. Mickai did not invent that standard. It adopts it, so the seal still verifies in a decade, after the cryptography that protects today's ordinary signatures has aged out. The record is not a log the operator can quietly tidy before an audit. It is a signed chain. A change announces itself.
The Open Audit Record is a signed chain, not a tidy-able log. Each consequential action is sealed with the published post-quantum standard, so the proof outlives the cryptography that signed it.
Permanence without permission
A signed record answers a sharper question still. How does an operator prove the record existed on the day they claim, and that it has not been quietly reissued since? Mickai's answer is Pantheon, its own sovereign Layer 1, anchored to Bitcoin, with a native token (PAN, fixed at five billion supply). Pantheon writes a hash commitment of the record to Bitcoin. It commits a fingerprint, nothing more.
This is worth stating plainly, because it is widely misunderstood. Pantheon does not move Bitcoin and it is not a Bitcoin Layer 2. Anchoring is not spending. The operator publishes a one-way fingerprint of their record into the most permanent public ledger available, and from then on the date and the integrity of that record can be checked by anyone, without trusting the operator, the regulator, or any intermediary. The proof stands on its own.
That is what makes the record travel. A Colorado regulator and a European auditor are not asked to trust Mickai's word, or the operator's. They are handed a signed account whose date and integrity they can verify independently. The same record satisfies both, because both are really asking the same thing in different dialects, show me what happened, and show me you have not changed the story since.
Evidence, not theatre
None of this is aspirational architecture. The approach is backed by 101 filed UK patent applications, around 2,234 claims, owned by Mickai LTD, with Micky Irons named as inventor. Mickai is held privately by its founder. The patents are evidence that the mechanism is specified in detail, not a headline in their own right. The headline is simpler. When two governments write two rulebooks, the operator who can prove what they did, on hardware they own, in a record neither party can edit, stops paying the tax of the seam.
The patchwork is a weight, but it does not have to be carried by people and paperwork. A portable, signed, independently verifiable record turns two rulebooks into one answer.
More regimes are coming. Other states will follow Colorado, other blocs will follow Europe, and the definitions will keep diverging. An operator who builds their compliance on a stack of jurisdiction-specific documents will rewrite that stack every time a new rule lands. An operator whose proof is a single sovereign record, signed once and anchored for permanence, simply hands the same record to the next reader. The patchwork grows. The work does not.
Written by Micky Irons. Originally published at https://mickai.co.uk/articles/the-patchwork-arrives-colorado-the-eu-and-the-record-that-travels. More from Micky Irons and Mickai at mickai.co.uk.
