Air-gapped AI deployment

An air-gapped AI deployment has no outbound network connectivity. Models are served from hardware inside the boundary, the evidence base lives locally, and nothing — not inference, not telemetry, not error reporting — leaves. Updates arrive through a controlled physical process rather than over a wire.

It is the strongest sovereignty position available and the most constrained. This article covers what it actually takes to run, what it removes from your threat model, and what you give up. For the alternatives, see sovereign AI.

What it takes to run

Local model serving

The models run on hardware you control — in practice, open-weight models, since the largest frontier models are generally available only as hosted services. Capability is genuinely good and genuinely not frontier-equivalent. For structured extraction, classification and retrieval-grounded generation the gap is often small enough to close with better workflow design; for open-ended reasoning over very long contexts it is wider. See small language models in the enterprise.

GPU capacity

Local serving needs accelerators, a capital cost with procurement lead times measured in months in constrained markets. A practical consequence: air-gapped deployments push hard toward model routing, using small models for the many narrow steps and reserving the largest local model for the few that need it.

The update path

The part that gets underestimated. An air-gapped system still needs model updates, module updates and evidence-base refreshes, and none of those arrive over the network. That means a defined physical process: media prepared in a controlled environment, integrity verified, installed under change control. A frozen air-gapped system is the most common failure mode — not a breach, obsolescence. Six months without a refresh and the outputs are subtly wrong in ways nobody notices until an audit.

A local evidence base

Retrieval works over a corpus inside the boundary. For workflows depending on external sources that update frequently, such as safety literature monitoring, this is a real design constraint — the refresh cadence becomes a deliberate decision with a compliance implication rather than something that happens automatically.

What it removes, and what it does not

Removed: external exfiltration — there is no outbound path, so an injected instruction to transmit data cannot execute. External injection sources — the agent cannot retrieve a poisoned web page, because it cannot retrieve web pages. Cross-border transfer analysis — nothing crosses a border, so the question does not arise.

Not removed: internal over-privilege — an agent with a broad service account inside the boundary can still reach data the requesting user could not. Injection through internally held documents — submitted dossiers and supplier specifications carry the same injection risk they always did. Insider risk, and aggregation risk across internal systems. See enterprise AI agent security.

Air-gapping is the right answer for some workflows and an expensive over-correction for others — the determining factor is usually a specific legal or contractual constraint rather than a general security posture. See on-premise vs cloud AI in healthcare for the less constrained alternatives.

Show us your deployment constraints — we'll tell you which workflows genuinely need zero egress.