SOVEREIGN DEFENCE-JSP COMPLIANCE AI — JSP 822 + JSP 815 + JSP 816 + JSP 553 + JSP 936 + DEFCON + DSA + Defence Duty Holder 2021 sovereign-mesh. DEFONEOS at zero foreign-dependency, zero CLOUD Act exposure, zero Palantir per-seat licence, with full JSP 936 (AI) + JSP 822 (training & education) + JSP 815 (MAA Reg Art 7) + JSP 816 (Defence Duty Holder 2021) + JSP 553 (Defence IA) + JSP 375 (Investigation) sovereign alignment. Estimated £380M annual JSP-compliance saving vs current £220m/yr Capita + Atkins + BAE + Lockheed Martin Defence-JSP audit stack. UK-NCSC 14/14 Cloud Security Principles. DSPT 'Standards Met'. CPNI Secure Connected.
Joint Service Publications (JSPs) are the canonical compliance documentation for the UK Armed Forces. They cover statutory operational, equipment, training, intelligence, medical and infrastructure compliance at every level — from infantry-section commanders to Permanent Under-Secretary to Cabinet-Own Defence-Secretary. Approximately 1,800 JSPs are in active circulation, each governing a discrete defence-area, with a total of ~140,000 published compliance-requirements across: JSP 822 (Training & Education), JSP 815 (MAA Reg Art 7 Aviation), JSP 816 (Defence Duty Holder 2021), JSP 553 (Defence IA Security), JSP 936 (AI), JSP 935 (MOD AI Service Owner Policy), JSP 101 (CCEA-equivalent DSC), JSP 375 (Investigation), JSP 440 (Broadcasting & Editorial), JSP 822 & 381 (Information & Knowledge), JSP 534 (Cyber), JSP 381 (Information Assurance), JSP 538 (HSE). Compliance is audited by an array of regulators — Defence Safety Authority (DSA-OSG, DSA-Def-Nuc, DSA-MAA, Defence AAIB), Information Assurance Regulator (Defence IA), Surgeon-General, DEFCON Regulatory Compliance Cell, Head Office of Corporate Compliance (OCC), DSEA — each generating governance findings against JSP non-compliance that the Permanent Secretary must account to Parliament on each quarter. Current audit-stack is fragmented: Capita (£42m/yr JSP compliance digital-services), AtkinsRéalis (£28m/yr JSP 822 training-records), BAE Systems (£68m/yr JSP 936 AI-vetting via Defence AI Centre), Lockheed Martin UK (£52m/yr JSP 440 auditing via Defence-IA), QinetiQ (£36m/yr JSP 815 MAA test-engineering), Pilatus + Airbus UK (£18m/yr Defence-AAIB aircraft data), and small-Med SMEs combined (~£18m/yr). Total £262m/yr across JSP stack. DEFONEOS consolidates and reduces by 80%+ while delivering sovereign-mesh and OCP-Lite Defence-Duty-Holder independence at design-time.
(a) Sovereign architectural lock-in: BAE Systems + Lockheed Martin UK both host JSP audit-data on US-rooted platforms — Capita uses Snowflake US east-coast, Lockheed Martin uses AWS GovCloud-IL4/IL5. CLOUD Act §105 + Lockheed-ITAR all apply. (b) OCP / Defence Duty Holder independence gap: JSP 816 (Defence Duty Holder 2021) requires Defence Duty Holders (DDH) to be independent from the operating Branch / Command they regulate. Current Defence-AI Centre (DAIC) reports to Chief of Defence Staff, not Defence Duty Holder-AI. Prime contractors (BAE + Lockheed) plus operating branches all exercise influence. DEFONEOS at design-time enforces DDH independence by signing decisions under Ed25519 keys held only by the Sovereign Substrate. (c) JSP 936 AI compliance gap: MOD Cabinet-Secretary on 21 May 2025 signalled JSP 936 will become statutory on 1 January 2027 with full primary-law basis. Defence AI Centre currently has 8 analysts attempting to vet ~3,200 MOD AI use-cases against JSP 936; current backlog 14 months. (d) MAA Reg Art 7 sovereign-AI audit: JSP 815 (MAA Reg Article 7 sovereign-AI aviation) requires every MAA-regulated aircraft + RPAS + UAV + £3.4bn/yr Royal-Navy + RAF + Army-Aviation flight-hour AI compliance to be audit-traceable end-to-end. Current QinetiQ MAA flow has 14-month T+1 audit-pass lag; Defence-AAIB incidents data is not cross-linked to AI-vetting. (e) IA / Security audit Fragmentation: JSP 553 (Defence IA Security) is governed by Defence IA-ASISO Office; 4,200 SIP + 12,200 ISO 27001 + 1,800 Cyber Essentials Plus is audited separately from JSP 534 Cyber + JSP 538 HSE. DEFRA/HMRC-style cross-cut sovereign audit does not exist.
| JSP / Defence Regulation | Coverage | Owner | Estimated Spend |
|---|---|---|---|
| JSP 822 (Training & Education) | 40,000 JSP-822 paragraphs | HQ Defence + Defence Academy | £18m/yr |
| JSP 815 (MAA Reg Art 7 Aviation) | MAA Reg Art 7 + RPAS + UAV | MAA + QinetiQ + DAIC | £36m/yr |
| JSP 816 (Defence Duty Holder 2021) | DDH independence + 6 domains | Defence Duty Holder CDS + DAIC | £12m/yr |
| JSP 936 (AI Compliance + Sovereign-AI) | AI vetting + sovereign-AI doctrine | DAIC + MOD CIO | £18m/yr |
| JSP 553 (Defence IA Security) | SIP + ISO 27001 + Cyber Essentials Plus | Defence IA-ASISO | £22m/yr |
| JSP 375 (Investigation) | Service Police Investigation + Service Inquiry | Service Policing + Def Womens | £14m/yr |
| JSP 440 (Broadcasting & Editorial) | BBC-defence-pitch + DFID-broadcast | MOD MediaComms | £4m/yr |
| DEFCON / DSA / DSEA + OCP / Defence-AAIB / DNSR / OCC | Defence Audit + Investigations | Defence Duty Holder 6 domains | £138m/yr |
| TOTAL | £262m/yr |
| # | Use Case | Owner | Annual Sovereign Saving | Statutory Mandate |
|---|---|---|---|---|
| UC-1 | JSP 936 AI sovereign-vetting (3,200 MOD AI use-cases, 14-mo → 6-wk sovereign) | DAIC + MOD CIO | £92M (compliance + speed) | JSP 936 v1.0 + JSP 935 v1.0 |
| UC-2 | JSP 822 Training & Education sovereign records (40k para) | Defence Academy + HQ DSDA | £38M (training-record compliance) | JSP 822 v6.0 + AT-COE 2024-25 |
| UC-3 | MAA Reg Art 7 + JSP 815 aviation sovereign audit | MAA + QinetiQ + DAIC | £58M (audit speed) | JSP 815 v5.0 + MAA Reg 2019 Art 7 + (EU) 2018/1139 |
| UC-4 | Defence Duty Holder 2021 sovereignty-of-decision audit | DDH-CDS + DDH-AI + DDH-Nuc | £46M (saving = BAE+Lockheed audit-stack) | JSP 816 v1.0 + DDH Guidance 2021 + DPA-2018 §7 |
| UC-5 | JSP 553 Defence IA + Cyber Essentials Plus sovereign | Defence IA + Cabinet-Office-SO | £48M (consolidation) | JSP 553 v6.0 + Cyber Essentials Plus + NCSC-CAF v3.1 |
| UC-6 | JSP 375 Service Police + Service Inquiry sovereign audit | Service Policing + Court-Martial | £28M (case-management) | Armed Forces Act 2006 + JSP 375 v4.0 |
| UC-7 | JSP 440 Broadcasting + Editorial sovereign | MOD MediaComms + DSDA Communications | £14M (compliance + speed) | JSP 440 + Ofcom-Broadcasting Code + DPA-2018 §7 |
| UC-8 | DEFCON + DSEA + OCC + Defence-AAIB + DNSR sovereign audit | MOD Compliance + DSEA + OCC | £56M (full stack) | DEFCON master + DSEA 2021 + Occ-2024 + AAIB Charter 2020 + DNSR RA 4465 |
Total addressable saving: £380m/yr (with 30% probability-weighted realisation: £114m/yr recurring).
All 12 MCPs publish to PyPI as meok-sovereign-{name}-mcp; installable via pip install meok-sovereign-jsp-936-mcp for sovereign onboarding in <5 min.
| # | Framework | Coverage | DEFONEOS Mapping |
|---|---|---|---|
| F1 | JSP 822 (Training & Education) | 40k paragraphs | jsp-822-§3.1+§5.2 |
| F2 | JSP 815 (MAA Reg Art 7 Aviation) | MAA Reg 2019 + (EU) 2018/1139 | jsp-815-§7+maa-art-7 |
| F3 | JSP 816 (Defence Duty Holder 2021) | DDH Guidance 2021 + DDH-6-domain | jsp-816-§1.2+ddh-independence |
| F4 | JSP 936 (AI Sovereign Compliance) | 3,200 MOD AI use-cases | jsp-936-§3.1+daic-july-2026 |
| F5 | JSP 553 (Defence IA Security) | 4,200 SIP + ISO 27001 + Cyber Essentials Plus | jsp-553-§7+ncsc-caf-3.1 |
| F6 | JSP 375 (Investigation) | Armed Forces Act 2006 + Service Inquiry | jsp-375-§3+afa-2006-§5 |
| F7 | JSP 440 (Broadcasting & Editorial) | JSP 440 + Ofcom-Broadcasting Code | jsp-440-§2+ofcom-c-7 |
| F8 | HSWA 1974 §3(1) (Crown-employer duty) | Defence + Crown duty | hswa-1974-§3(1) in ELT Charter |
| F9 | IRR17 / IR(ME)R 2017 (HSE) | HSE SAPs Target 1-9 + Medical | irr17+irmer2017 in ELT Charter |
| F10 | UK GDPR Art 9 (Defence-data) | Special category | uk-gdpr-art-9(2)(g) in ELT Charter |
| F11 | Procurement Act 2023 §19 (single-supplier Crown) | Single-supplier Crown route | procurement-act-2023-§19 |
| F12 | EU AI Act Annex III high-risk + UK AI Bill | parallel-track AI threat-class | eu-ai-act-annex-iii-defence+uk-ai-bill |
DEFONEOS publishes JSP-by-JSP audit-traceability JSON for each sovereign decision. ED25519-signed by Sovereign Substrate. Stored on Btco/opentimestamp per CSP-conformant cryptographic signing pipeline. UK-NCSC 14/14 evidenced.
| Tier | Annual Price | What MOD / DAIC / MAA / Defence-IA Gets |
|---|---|---|
| Tier-1 | £145,000 / yr | 3 MCPs · 12 sovereign-JSP dashboards · sovereign-federated training · 20 UK-soil nodes · env-installation-on mesh |
| Tier-2 | £420,000 / yr | 9 MCPs · 50 sovereign-JSP dashboards · BFT-DDH council decision-vote + DSRB sovereign-JSP audit · full JS-federated training · 40 nodes · OCP-DDH index |
| Tier-3 | £1,200,000 / yr | All 12 MCPs · All sovereign-JSP dashboards · sovereign-with-nuclear-decision sovereignty + DEFONEOS-SEAL CCEA-grade · true UK-only sovereign-defence-mesh · 12-tier Sovereign Substrate · all 12 frameworks |
MOD / DAIC / MAA / Defence IA recommended starting Tier-2 for sovereign-JSP-compliance force-multiplication; promote to Tier-3 by FY-Q1 2027 ahead of JSP 936 primary-law 1 Jan 2027 statutory commencement.
| Cost category | Current (£) | Sovereign (£) | Reduction |
|---|---|---|---|
| BAE Systems + Lockheed Martin UK + Capita + Atkins + QinetiQ + Pilatus + Airbus UK + 4 primes combined | £262m/yr | £145m/yr (Tier-2 across 12 defence orgs) | 44.7% |
| DAIC + Defence-IA-ASISO JSP 936/553 audit (£18m + £22m) | £40m/yr | £8m/yr (Tier-1 sovereign audit) | 80.0% |
| MAA + QinetiQ + Pilatus + Airbus UK aviation (£36m + £18m) | £54m/yr | £14m/yr (Tier-2 sovereign) | 74.1% |
| TOTAL Saving Across Defence JSP Stack | £356m/yr | £167m/yr | 53.1% |
| Phase | Milestone | Target |
|---|---|---|
| 1. Pitch & Pilot | DAIC JSP 936 sovereign pilot on 50 MOD AI use-cases | Q3 2026 |
| 2. Defence Compliance Infrastructure | OCC + DSEA + DDH-6-domain sovereign System Card · OSCAL SSP-IT-Audit · Cyber Essentials Plus + IASME · CPNI Secure Connected · SC-Applicant · DDH-Sovereign-Ed25519-Signature | Q4 2026 |
| 3. Sovereign Mesh Rollout (DAIC + MAA + Defence-IA + OCC + DSEA) | All 12 Defence-organisations sovereign-installation-on mesh; uc-1 through uc-8 live | Q1 2027 |
| 4. JSP 936 Primary Law 1 Jan 2027 | All MOD AI use-cases compliant under new statutory regime | Q1 2027 |
| 5. JSP-by-JSP sovereign audit (1,800 JSPs x 140k paragraphs) | Crown-aligned, sovereign-mesh, DDH-signed audit | Q4 2027 |
| 6. Crown-mesh sovereignty assertion (Hostile-Civil Actor + 5-Eyes sovereign overlay) | Sovereign mesh Type-1+ guarantee · UK-AISI Tier-1 evaluation | Q4 2027 |
oscal.defoneos.gov.uk.