- Air-gapped AI runs on systems with no connection to the internet or any outside network, so models, data and results stay inside.
- Anything that enters an air-gapped system, including model updates, crosses the gap by hand, under human control.
- Air-gapped AI suits classified, regulated and leak-sensitive work, at the cost of slower updates and fixed capacity.
- Air-gapped is where AI runs; sovereign AI is who owns it. An air-gapped system can still run a model you don't own.
What is air-gapped AI?
Air-gapped AI is AI that runs where nothing outside can reach it and nothing inside can leak out. The models, the data they read and the answers they give all stay in one isolated environment, usually a secure data center or a classified network. Anything that has to come in, such as a model update, crosses the gap by hand.
The term comes from security. The US Committee on National Security Systems defines an air gap as an interface between two systems that "are not connected physically" and where "any logical connection is not automated (i.e., data is transferred through the interface only manually, under human control)." Air-gapped AI applies that rule to the whole AI stack.
How air-gapped AI works
Everything an AI system normally fetches from the internet has to live inside the boundary instead.
| Part | Inside the air gap | How it gets in |
|---|---|---|
| Compute | GPU servers, or a disconnected Kubernetes cluster | Installed on site |
| Models | Open-weight or fine-tuned models, with their weights stored locally | Copied in as files after a security review |
| Software | The AI platform, the serving engine and their dependencies | Install packages carried across the gap and checked before use |
| Data | The documents, databases and logs the AI works on | Already inside, or moved in under the same controls |
| Updates | Patches, new model versions, new software | The same manual, reviewed transfer, on a schedule |
Because nothing can call out, every piece has to work offline: no cloud API behind the model, no license server, no telemetry sent home. That rules out most hosted AI services, which assume a connection.
Air-gapped AI vs on-premises AI vs sovereign AI
These terms overlap, but each answers a different question.
| Term | The question it answers | What it leaves out |
|---|---|---|
| On-premises AI | Does it run on hardware you control? | An on-premises system can still connect to the internet. |
| Air-gapped AI | Is it cut off from every outside network? | An air-gapped system can still run a model you don't own. |
| Sovereign AI | Who owns and controls the AI? | Nothing: agents, models, data and results, wherever they run. |
Air-gapped is the strictest place to run AI, not another word for owning it. Most organizations that need sovereign AI run some workloads in a cloud account they control and keep only the most sensitive ones air-gapped. For language models on your own hardware, see on-premises LLM.
Why organizations use air-gapped AI
- Classified and mission work. Defense, intelligence and national security systems often have to run on networks with no outside connection.
- Regulated data. Health records, citizen data and some financial data come with rules about where they can go. An air gap settles the question.
- Leak prevention. With no outbound path, prompts, documents and model weights can't be sent to a third party, by mistake or by attack.
- No outside switch. A model running offline can't be retired, repriced or turned off by a provider.
Challenges of air-gapped AI
- Slower updates. New models and patches arrive on a schedule, after review, not the day they ship.
- Fixed capacity. There is no cloud to burst into for more GPUs. Capacity is what's installed.
- Fewer model choices. Frontier models offered only as cloud APIs can't run inside the gap. Open-weight and small language models can.
- Harder support. A vendor can't log in to troubleshoot, so diagnostics also cross the gap by hand.
Air-gapped AI examples
- A federal research agency. NIH runs an AI assistant fully air-gapped, in an Oracle Cloud Isolated Region linked to its intranet. It serves more than 8,000 employees across 28 institutes and deflects 10,000 IT service requests a year.
- Defense and intelligence. Agencies run document analysis and decision support on classified networks with no outside connection.
- Hospitals and banks. Teams keep their most sensitive records, and the AI that reads them, on isolated networks.
Air-gapped AI in H2O AI
H2O AI Cloud runs fully air-gapped as H2O AI Hybrid Cloud, installed with Helm or Replicated with no public internet access. The whole platform runs inside the gap, including H2O AI Super Agent and its predictive, generative and agentic AI and observability capabilities, with any LLM you choose. H2O AI Cloud for Government, a separate option, is FedRAMP High certified.