What is air-gapped AI, and how does air-gapped LLM deployment work?

Air-gapped AI is an LLM or RAG system that runs on an isolated network with no outbound connectivity, where the model weights, the source documents, and the inference engine are all fully contained inside one controlled boundary. Nothing leaves the network, no external API is ever called, and the system keeps working with the internet cable unplugged. Organizations choose air-gapped AI when the cost of a single byte of data leaving the perimeter is unacceptable: classified environments, core banking, and critical infrastructure.

What does air-gapped AI mean?

Air-gapped AI means an artificial intelligence system that operates on a network deliberately separated from the public internet and from any other untrusted network. The “air gap” is the absence of a connection: there is no route out, so prompts, retrieved passages, and model outputs cannot be transmitted to a third party, and no remote service can reach in.

In practice, air-gapped AI covers two layers. The model layer is an open-weight LLM whose weights sit on local hardware, so inference happens on machines you control. The retrieval layer is a RAG (retrieval-augmented generation) system that searches your own documents and feeds the relevant passages to the model. When both run inside the isolated network, you have an air-gapped AI deployment.

How does an air-gapped LLM deployment work?

An air-gapped LLM deployment works by hosting every component the system needs on hardware inside the isolated zone, then removing the network paths that would normally reach outward.

1. Local model serving. Open-weight model weights are loaded onto GPUs or accelerators inside the secure network. Inference runs there, so no prompt is sent to a hosted endpoint.
2. Local document index. Your documents are ingested and embedded inside the boundary. The vector index and the source files never leave.
3. Internal request flow. A user asks a question, retrieval finds the matching passages from local storage, and the local model generates an answer grounded in those passages. Every hop stays inside the network.
4. Offline updates. New model versions, security patches, and document refreshes are staged and verified on connected infrastructure, then carried in through an approved controlled-transfer path, such as vetted physical media or a one-way data diode. There is no automatic over-the-internet update. The full procedure is in how to patch an air-gapped AI system offline.
5. Internal monitoring. Logging, metrics, and audit trails are written to systems inside the air gap rather than to an external observability service.

The trade-off is operational. An air-gapped deployment gains full containment, but it gives up the convenience of cloud-style auto-updates and external API enrichment. Updates are deliberate, scheduled, and logged rather than continuous. The cost side of the trade-off is quantified in our breakdown of on-prem LLM TCO: GPU capex versus cloud API cost, and the hardware side in air-gapped LLM hardware and GPU VRAM sizing.

Air-gapped vs connected on-prem vs hybrid: what is the difference?

These three deployment models sit on a spectrum of connectivity, and the right one depends on how strict your data-egress rules are. For a deeper split of the cloud-versus-local axis, see on-prem vs cloud LLM.

Property	Air-gapped	Connected on-prem	Hybrid
Network location	Isolated, no internet	Your data center, internet reachable	Mix of local and cloud
Outbound data	None	Possible (telemetry, APIs)	Controlled, partial
Model weights	Local only	Local	Local or hosted
Updates	Controlled transfer only (media or data diode)	Over the network	Over the network
Best for	Classified, core banking, critical infrastructure	Regulated firms needing local control	Teams balancing reach and control
Operational effort	Highest	Moderate	Moderate

Air-gapped is the strictest posture. Connected on-prem keeps data in your building while still allowing chosen outbound traffic. Hybrid lets you place sensitive workloads locally and less sensitive ones in the cloud, switching as policy requires.

Which isolation tier do you actually need?

“Air-gapped” is often used loosely to cover four distinct tiers of isolation. They differ in how data physically moves, how often you can update, and which attacker each one actually stops. Naming the tier precisely is the first step in any deployment conversation.

Tier	How data moves in or out	Typical industries	Update cadence	Threat it addresses
Fully air-gapped	No network path in either direction; transfers only via vetted, scanned physical media	Classified defense networks, intelligence, weapons research	Scheduled transfer windows, typically monthly or quarterly	Remote exfiltration and remote compromise are impossible by construction; residual risk is an insider carrying media
One-way data diode	Hardware enforces a single direction; data flows in (or logs flow out) with no return channel	Power, water, and nuclear control networks, telecom core	Continuous inbound feeds, so daily document and patch ingestion is feasible	Command-and-control callbacks and interactive intrusion, since no acknowledgment can ever travel back
Restricted egress	Default-deny firewall with a short allowlist of pinned internal endpoints, such as a package mirror	Core banking, insurance, hospitals	Weekly patching through internal mirrors	Bulk data exfiltration and shadow SaaS; DNS and proxy logs give an audit trail; residual risk is a compromised allowlisted endpoint
VPC-isolated	Private cloud subnet with no internet gateway; traffic rides the provider backbone via private endpoints	Enterprises under data-residency rules, pharma R&D, analytics teams	Continuous, standard CI/CD	Opportunistic internet-borne attack; does not remove the cloud provider from the trust boundary, and one misconfigured endpoint reopens egress

The first two tiers are what regulators and defense handling rules usually mean by air-gapped. Restricted egress is where most banks and hospitals land in practice. VPC isolation is a cloud pattern, useful but categorically different: your data still sits on hardware someone else operates.

What accidentally defeats an air gap?

Most air-gap failures are not exotic attacks. They are default settings that were never turned off. Four show up again and again in AI deployments:

• DNS leaks. A host inside the boundary resolves an external name, and the internal resolver forwards the query to an upstream public resolver. Even when the connection itself is blocked, the DNS query has already left, and DNS tunneling can carry data in the query names themselves. The fix is an internal authoritative resolver with forwarding disabled, and a firewall rule that drops port 53 and DNS-over-HTTPS traffic at the boundary.
• Telemetry baked into inference servers and libraries. Several widely used open-source inference servers and model-hub client libraries ship with usage telemetry enabled by default and expose an environment variable to opt out. On a truly isolated network those calls fail silently; on a restricted-egress network they may succeed. Set the opt-out variables explicitly in every service definition, and treat any process that attempts an outbound call as a finding, not noise.
• Package managers reaching public registries. pip, npm, and apt default to public registries. One pip install on a box with a forgotten route pulls code straight from the internet and leaks your dependency list as a side effect. Stand up internal mirrors, point every client’s index configuration at them, and block the public registry domains at the firewall so a misconfigured client fails loudly.
• Browser-based UIs phoning home. Web front ends routinely load fonts, CDN-hosted scripts, analytics beacons, and update checks from public hosts. Inside an air gap those requests hang or fail, and on a restricted-egress network they quietly report usage. Self-host every asset the UI needs and set a Content-Security-Policy that only permits internal origins.

The common thread: an air gap is not a state you declare, it is a state you verify. Run a packet capture at the boundary during normal operation. The correct amount of outbound traffic is zero, and anything else is a work item.

When is air-gapped AI required?

Air-gapped AI is required wherever regulation or threat model forbids any data leaving the environment. Typical settings where air-gapped AI applies include:

• Classified and defense networks, where handling rules prohibit external connectivity by design. See air-gapped AI for government and sovereign LLMs.
• Core banking systems, where transaction and customer data must stay inside a hardened zone. See air-gapped AI for banks.
• Critical infrastructure such as power, water, and telecom control networks, where isolation limits the attack surface.
• Hospitals and research institutions handling sensitive records that cannot transit a public network. See air-gapped AI for hospitals.

If your rule is “this data may never touch the internet,” air-gapped deployment is usually the only model that satisfies it. If your rule is “data stays in our control but limited outbound traffic is acceptable,” connected on-prem may be enough. Our guide on how to deploy an LLM on-premise walks through that decision, and air-gapped LLM hardware and GPU sizing covers the VRAM you need to serve it.

How does air-gapped AI map to GDPR, the EU AI Act, DPDP, and RBI rules?

No major framework mandates an air gap by name. What each one does is impose duties that an air-gapped deployment either satisfies structurally or makes far easier to evidence. Outside the US, four matter most:

Framework	What it requires	How an air-gapped deployment maps
GDPR (EU)	Restricts transfers of personal data outside the EEA and requires technical and organizational security measures appropriate to the risk	Processing never leaves your controlled boundary, so there is no third-country transfer to justify; network isolation is a strong, demonstrable technical measure
EU AI Act	Obligations for general-purpose AI model providers apply from August 2025; transparency duties from August 2026; high-risk system obligations phase in later after a timeline extension	Self-hosting does not exempt you from the Act; deployers of high-risk systems owe logging and human oversight, which local, tamper-evident audit logs directly support
India DPDP Act 2023 (Rules notified November 2025)	Reasonable security safeguards for digital personal data, breach reporting to the Data Protection Board, penalties up to Rs 250 crore for failing the safeguards duty, phased compliance through 2027	Full containment shrinks the breach surface a fiduciary must defend, and internal logs provide the evidence trail the Rules expect
RBI Master Direction on IT Outsourcing, 2023 (India, banking)	Regulated entities outsourcing IT services must retain control and audit access, manage concentration risk, and address data location in contracts	Consuming an external LLM API can bring the arrangement into outsourcing governance scope; a fully self-hosted deployment removes the third-party dependency those controls target

The pattern across all four: regulators do not reward isolation for its own sake, they reward provable control over where data goes and who touched it. An air-gapped deployment converts several of the hardest questions on an audit checklist into structural properties of the network.

How does Samvad AI support air-gapped deployment?

Samvad AI is a secure, source-cited RAG assistant that answers only from your own documents, and it deploys on-premise, air-gapped, or hybrid, switchable by configuration. You do not run a different product for air-gapped mode; you change how the same system is deployed.

In air-gapped mode, Samvad AI keeps these properties intact:

• Answers only from your sources. It grounds every response in your documents and states clearly when an answer is not in your sources, so the model cannot fall back on outside knowledge.
• Exact-passage citations. Each answer cites the specific source passage it used, which matters when reviewers must trace a claim inside a closed network.
• Permission-aware access. Role-level and row-level controls mean users see only what they are cleared to see, even inside the isolated zone.
• Tamper-evident audit log. Every query and answer is recorded so internal auditors can review activity without any external service.
• Multilingual. Samvad AI works in English, Hindi, and more, which suits multi-region institutions running fully offline.

Because the model and the documents are both local, Samvad AI runs with the network unplugged. You can read more about the controls behind this on our security page. For banks, hospitals, universities, governments, and enterprises that cannot let data leave the building, air-gapped AI turns a hard compliance constraint into a working assistant your staff can actually use.