Private AI for <PROSPECT>, operated on your premises.

Your bankers are probably already using AI, whether or not the firm has approved it. The question is no longer whether AI touches deal work. It is where it runs, who holds what it sees, and whether you can supervise it.

No one has handed you a template for AI supervision

FINRA Rule 3110 is technology-neutral. A banker drafting a teaser in a personal AI account is conducting business through a channel the firm has not risk-assessed and cannot review. That is a supervisory gap on its own, without anyone having to argue that a prompt is a record.

FINRA’s Regulatory Notice 24-09 reminds firms that gen-AI procedures should address technology governance, including model risk management, data integrity and model reliability. It says plainly that it “does not create new legal or regulatory requirements.” The 2026 Oversight Report goes further, listing practices firms may adopt: keeping prompt and output logs, and “tracking which model version was used and when.” Notice 25-07 asked the industry whether the recordkeeping rules themselves need updating for AI-generated communications.

So the evidence is yours to design. We propose to build it with you.

Every hosted AI vendor is a service provider you must oversee

Amended Regulation S-P requires a programme to oversee service providers that handle customer information, including notice from the provider no later than 72 hours after it learns of a breach, and notice to affected customers no later than 30 days after you do. Compliance dates were 3 December 2025 for larger entities and 3 June 2026 for smaller ones, so both have passed. The rule requires a programme, not a particular contract clause. Each AI vendor that sees client information is one more provider in that programme, and one more route by which someone else’s incident becomes your notification.

Records held by a third party bring their own obligations

Rule 17a-4(i) requires an undertaking from a third party that prepares or maintains required records for you, including a recordkeeping service that owns and operates the servers they sit on. Under this proposal, records are written only to storage you own and are pulled out by your own collector. On the better reading of 17a-4(i), that does not make mirmir a recordkeeping service. The SEC has not addressed this fact pattern, so it is on the list for your counsel in section 8.

Whether prompts themselves are required records is unsettled; no SEC or FINRA text says they are. AI-drafted communications that are circulated or sent are covered like any others.

Litigation you are not party to can reach a vendor’s logs

In May 2025, in the consolidated New York Times copyright cases, a federal court ordered OpenAI to preserve output logs it would otherwise have deleted, including logs users had asked to delete. ChatGPT Enterprise was excluded, but OpenAI later told the court it had preserved millions of API logs. The ongoing order ended in September 2025, and data already preserved is still held. In January 2026 the district judge affirmed an order to produce 20 million de-identified conversations, weighing their privacy as data users had “voluntarily disclosed to OpenAI.”

Nobody in that case has been found to have done anything wrong, and the same rules apply to every hosted provider. The point is structural. When a vendor holds your logs, a demand can go to the vendor. When you hold them, it comes to you and your counsel. Running AI on your premises does not put your data beyond discovery, and it should not. It means you see every hold and apply it yourself.

Hosted capacity is best-effort, in the vendors’ own words

“maximum allowed usage, not guaranteed minimums.”Anthropic, API rate limits documentation

“Reservations don’t guarantee capacity.”Microsoft, Azure provisioned throughput documentation

For a deal team in the last week before a signing, a throttled model is an operational problem. A node in your rack runs whatever the rest of the market is doing.

mirmir installs and operates a small cluster of Apple Mac Studio nodes with the M5 Ultra chip in your office or data centre. Apple specifies up to 512GB of unified memory and 1.2 TB/s of memory bandwidth per node, with a 480 W nameplate power rating. Apple has said the 512GB configuration is coming in late October 2026. We provision the nodes, deliver signed model and software updates, monitor them, hold spares, and build your workflows with you.

Two modes, fixed when a node is provisioned

In both modes, prompts, answers, documents and embeddings never leave your environment. A node’s mode is set when it is provisioned and recorded in its signed identity. Changing it means wiping and re-provisioning the node, so a sealed node cannot become an operated one by a configuration change.

Two consequences of the operated mode, stated plainly. First, during a support session you open, our engineers can access the system, so for those sessions mirmir is a service provider within your Regulation S-P programme. We will commit to your oversight terms, including the 72-hour notice. Second, a data query is itself information: repeated lookups on one issuer can reveal a live mandate. That is why every connector query is logged for your compliance team to review like any other communication.

1. 1A model arrives as a signed bundle. Every weight file is checksummed against a signed manifest before it is loaded. It starts serving only when you activate it, and the previous version is kept for rollback.
2. 2Your banker’s request is authenticated. The gateway records who asked, which deal team they belong to, and the exact model version that will answer, before any computation runs.
3. 3The model reads the whole prompt at once (prefill). This is the wait before the first word appears, and it grows with document length. Reference material a team reuses, such as a data room index or a style guide, is cached so it is not re-read. That cache is scoped to the team.
4. 4The answer is written token by token (decode). Speed here is set by memory bandwidth: each word requires reading the model’s active weights from memory.
5. 5Numbers come from code, not from the model. Ratios, multiples and totals are computed by deterministic tools. Before an answer is released, every figure in it is matched against the tool output it came from.
6. 6The answer streams back, and the record is written. The audit record goes to storage you own, where your existing retention, supervision and legal-hold processes already apply.

What this means for sizing

Built for teams, not the whole firm.Each word generated requires reading the model’s active weights from memory, so a node serves a handful of simultaneous users well. Adding users slows each person, and for the large mixture-of-experts models this hardware suits, total throughput rises only modestly. In the pilot you set a per-user speed target, and we measure how many people a node can serve at that speed on your work.

Large mixture-of-experts models suit this hardware. They keep every expert in memory but read only a few for each word, which fits a machine with a lot of memory and moderate bandwidth. We choose the model with you in the pilot, from open-weight models whose licences your counsel accepts.

Reduced precision is used, and managed. Model weights are stored at 4 or 8 bits to fit and to run faster. The arithmetic still runs at 16 bits, but rounding can occasionally change a close word choice. That is one more reason calculations never happen in the model and copied figures are always checked.

Each control below is a pilot deliverable. None is claimed as proven today. Each has a test your security and compliance teams run themselves, and the pilot fails if any test fails. Identifiers match our control matrix, which we share with your reviewers.

Stated early, because a reviewer will look for these, and you should hear them from us first.

• It is not cheaper than a hosted API. If a shared, pay-per-token service is acceptable for a workload, it will usually cost less. We compete on control and dedicated capacity, not on price per token.
• It is not firm-wide scale. A node serves a small team well. We size honestly in the pilot, from measurements on your workflows, and publish no throughput figure before then.
• It is not an information barrier. Team-scoped caches and per-team policy help, but we do not ship a document search that enforces your entitlements. Material a banker could not open directly must not be put in front of the model on their behalf. That boundary is enforced above our system, or by separate deployments.
• Your supervision stays yours. Rule 2210 approval, review of AI-assisted work, and validation of the model for your uses remain your processes. We make them possible by recording which output, which person and which model. We do not perform them.
• It is not bit-exact by default. No inference system, hosted or on-premise, guarantees identical output by default. We state the conditions under which an output can be regenerated, and test them.
• The hardware has gaps, and we carry them. Apple silicon does not report memory errors, so integrity is a software control, tested above. Apple’s enterprise support terms are thinner than a server vendor’s, so spares, a standby node and repairs are part of our operating responsibility, not yours.
• Check the FIPS position now. Apple’s certification page lists FIPS 140 validations for some macOS 15 cryptographic modules. The macOS versions that ship on M5 Ultra hardware have no validated modules yet. If your policy requires validated cryptographic modules, raise it in scoping.
• On-premise is also a target. Concentrating deal-team prompts on one system makes that system valuable to an attacker. We remove outbound paths and harden inbound ones, and your security team reviews both.

1. 1Scope. Choose two or three workflows, for example summarising diligence documents, first drafts of teasers and process letters, or comparable-company notes built from your data provider. Agree the data classes, the mode, the per-user speed target and the acceptance tests in writing.
2. 2Install. Nodes are provisioned at our depot, racked in your environment and their mode attested. Your security review starts with a boundary traffic capture that runs for the whole pilot.
3. 3Build. We build the workflows with your bankers, including the deterministic calculation tools and figure checks. Compliance receives the audit stream from day one.
4. 4Measure and decide. Run every acceptance test in section 5. Measure first-response time and per-user speed on your documents, and how many people a node serves at your target. You decide on the results, which are yours to keep.

Commercial terms are provided separately.

These are unsettled or firm-specific. We would rather raise them than have your reviewers find them.

• Is an on-premise software operator with no custody of records a third party under Rule 17a-4(i)? On the better reading it is not, but the SEC has not addressed the fact pattern.
• How should operated-mode support sessions be treated in your Regulation S-P service-provider programme?
• How do AI prompts, outputs and connector queries map onto your retention schedule and legal-hold process?
• Which AI-drafted communications route into your existing capture and Rule 2210 review? FINRA has proposed changes to pre-use approval (Notice 26-14), which are not yet adopted.
• Do your data providers’ licences permit use of their content inside a system you run with a third-party operator?

All checked on 21 September 2026.

• FINRA Regulatory Notice 24-09, generative AI
• FINRA 2026 Annual Regulatory Oversight Report, generative AI
• FINRA Regulatory Notice 25-07
• FINRA Regulatory Notice 26-14 (proposal)
• SEC Release 34-100155, Regulation S-P amendments (2024)
• SEC Release 34-96034, Rule 17a-4 amendments (2022)
• 17 CFR 240.17a-4
• Preservation order, S.D.N.Y. 1:23-cv-11195, 13 May 2025
• Stipulation ending ongoing preservation, 9 October 2025
• OpenAI opposition to sanctions, describing API log preservation
• Order affirming production of 20 million logs, 5 January 2026
• Anthropic, API rate limits
• Microsoft, Azure provisioned throughput
• Apple, Mac Studio technical specifications
• Apple Newsroom, new Mac Studio with M5 Max and M5 Ultra
• Apple, macOS security certifications
• Thinking Machines Lab, Defeating nondeterminism in LLM inference