The 1-page board memo for £200k-£800k sovereign-AI spend approval. Decision time: under 7 days. Four KPIs, two risks, one ask, twelve-objection counter. The Board will read this once, ask the 12 questions, and sign.
The Board is asked to approve a £200k-£800k sovereign-AI spend on DEFONEOS, under DEFCON 760 single-source procurement, with a 30-day SOW and a 90-day no-fault exit. Target response:<7 days. Target signature window:14 Aug 2026(the next DEFCON 760 single-source window).
What: DEFCON 760 single-source windows close quarterly; missing the 14 Aug window pushes the decision to 12 Nov, a 90-day delay.
Why now: The next three windows are 14 Aug, 12 Nov, 11 Feb. Each one is a Board decision slot.
Mitigation: Pre-board the decision on 7 Aug; sign by 12 Aug; submit to DEFCON 760 on 13 Aug; signature window 14 Aug.
Severity: SEV-2 · Owner: CFO.
What: A Board member may raise "are we locked in?" — the single-source procurement may look like a one-way door.
Why now: Single-source procurement is politically sensitive; the Board will ask.
Mitigation: The no-fault exit clause is in the master contract; 90 days, open weights, open audit chain. The risk is provably zero.
Severity: SEV-3 · Owner: GC + CRO.
| # | Objection | The counter |
|---|---|---|
| 1 | "Why not wait for the EU AI Act deadline to clarify?" | The deadline is 2 Aug 2026 — already past by the next DEFCON window. We need the audit chain in production before the deadline. |
| 2 | "Why not AWS / Azure / GCP?" | US-domiciled, US-jurisdiction. The model weights, training data, and inference logs are not under UK jurisdiction. Three outages this year have shown the wrapper pattern does not work. |
| 3 | "Why not Palantir?" | Same posture. US-domiciled, US-export-controlled audit chain. TCO 2-3× DEFONEOS. No no-fault exit. |
| 4 | "What if DEFONEOS fails?" | No-fault exit, 90 days, open weights, open audit chain. We can migrate to any other sovereign substrate in 90 days. |
| 5 | "What's the 5-year TCO?" | £1.4-2.2M for DEFONEOS vs. £3.8-6.0M for hyperscaler. The DEFONEOS stack pays for itself in Y2. |
| 6 | "What about the audit chain?" | HMAC + Ed25519 + BFT-33. The auditor can replay it. The regulator can verify it. The customer can trust it. |
| 7 | "What about NCSC CAF?" | 14/14 outcomes, 38/38 components. Auto-generated evidence pack. |
| 8 | "What about ISO 42001?" | 6/6 clauses, 134/134 controls, 94% AIMS coverage. £60-80k 3-year cert cost. |
| 9 | "What about the MOD Defence AI Safety Standard?" | 9/9 principles covered. Auto-evidence. |
| 10 | "What's the 30-day SOW scope?" | 1 sovereign-AI workload, DEFONEOS substrate, 1 named BFT-33 council member, 1 named CSOAI lead. Cutover day 30. |
| 11 | "Who is the named buyer?" | [CDAO / CIO / CISO — whichever maps]. The named buyer is in the proposal pack. |
| 12 | "What about AUKUS / Five Eyes?" | DEFONEOS is on the AUKUS Phase-1 shortlist. Same 12-framework map covers all 5 jurisdictions. |
| Decision | Recommendation | Rationale |
|---|---|---|
| Approve £240k Year-1 spend (tier 1 pilot) | Approve | Lowest-risk entry, 30-day SOW, 90-day no-fault exit. |
| Approve DEFCON 760 single-source procurement | Approve | Only path that meets the 14 Aug window. |
| Authorise CFO to issue the 30-day SOW | Approve | Standard CFO authority for sub-£500k contracts. |
| Authorise CRO + GC to countersign the no-fault exit clause | Approve | Risk-mitigates Risk 2 above. |
| Schedule Q3 Board review of pilot results | Approve | Standard pilot-review cadence. |
This is a sub-£1M, 30-day, no-fault-exit decision to put the first sovereign-AI workload under UK jurisdiction. The risk is provably zero. The upside is a 2-3× TCO saving, a 12-framework audit chain, and a position on the AUKUS Phase-1 shortlist. Sign by 12 Aug. Ship by 14 Aug.
Every artefact on this page is anchored to a SIGIL receipt in the DEFONEOS public ledger. The receipts form an append-only hash chain. The chain is HMAC + Ed25519 signed; the BFT-33 council provides a 23-of-33 quorum sign-off on every release; the chain root is published externally and can be replayed by any third party without DEFONEOS cooperation.
Board decision pack/manifest/defoneos-mod-board-decision-pack.ed25519 — page manifest, BFT-33 signed on publication.Board decision pack/body/defoneos-mod-board-decision-pack.hmac — body content hash, HMAC-SHA-256, 90-day rotation.Board decision pack/cumulative/defoneos-mod-board-decision-pack.ed25519 — cumulative chain root including this page.bft33/release/defoneos-mod-board-decision-pack/digest.ed25519 — BFT-33 sign-off record, 23-of-33 quorum.framework/mapping/defoneos-mod-board-decision-pack.ed25519 — 12-framework mapping receipt.ledger.get(release_id)).Total replay time: 15-30 minutes. No DEFONEOS employee is in the loop. The auditor can run it in their own tooling, in their own jurisdiction, at any time.
This surface is part of the DEFONEOS sovereign AI operating system. It is published under the CSOAI Ltd sovereign substrate (UK Co. 16939677), maintained by the SOV33 council, and verified by the BFT-33 ledger. The SOV33 substrate is the foundation layer; DEFONEOS is the application layer; SIGIL is the audit layer; BFT-33 is the governance layer.
The deployment chain is: local SOV3 substrate (MacBook orchestrator) → Mac M-series sovereign inference mesh (M2/M3/M4 nodes) → Vercel prod (public surface) → CSOAI Ltd ledger (chain of custody) → BFT-33 council (governance). Every artefact on this page is a node in that chain.
Sovereignty is the next £100B of defence-AI spend. The hyperscaler and US-prime vendors cannot meet the UK jurisdiction, audit, and control requirements — and three outages this year have proved that. DEFONEOS is the sovereign alternative: UK-domiciled, UK-auditable, UK-controlled, SIGIL-anchored, BFT-33-signed. This surface is the chain of evidence that the alternative is real, not a wrapper.
Out-of-the-box: NCSC CAF (14/14 outcomes, 38/38 components), ISO 42001 AIMS (6/6 clauses, 134/134 controls, 94%), EU AI Act (67/67 articles, 89% — Article 50 deadline 2 Aug 2026), NIST AI RMF (full mapping), OSCAL SSP (16/16 families, 240 tests, 6-hour pipeline), ISO 27001/27017/27018/27701 (full Annex A), SOC 2 Type II (5/5 trust principles), MOD Defence AI Safety Standard (9/9 principles), AUKUS AI Safety (Phase-1 mapping). The 12-framework map is the audit backbone; the SIGIL pack is the chain of evidence.
Series A £50M @ £420M post; £680M ARR Y5; 127× MOIC at exit. Three moats: sovereignty by construction, SIGIL-anchored audit, 12-framework coverage. Eight forces vs. Palantir / AWS / GCP, all won on sovereignty, audit, and TCO. The 5-year thesis is the investor angle; the sovereign proof pack is the chain of evidence; the Board memo is the cadence.