An air-gapped AI deployment runs the model, the governance control plane and the record of its decisions entirely inside a network with no connection to the public internet. Nothing is fetched at request time and nothing is reported out. The system either functions with what is inside the boundary or it does not function.
How it differs from on-premises, and from private cloud
These three get used interchangeably and they are not the same commitment.
Private cloud or VPC means the workload runs in the customer's cloud account. Data may stay in that account while the control plane still calls a vendor service to decide what is permitted.
On-premises means the software runs on the customer's own infrastructure, which may still have outbound connectivity for licensing, telemetry or policy updates.
Air-gapped means no outbound path exists. That is the distinction that constrains design rather than deployment: every dependency has to be satisfiable locally, licensing cannot phone home, model weights have to be present, and policy has to be evaluable without a call. A product can be moved to on-premises late. Air-gapped has to be true from the beginning.
Who requires it, and why
Defense programs and intelligence work inside accredited enclaves where the accreditation itself forbids egress. Certain banking environments treat the governance configuration as controlled information, on the reasoning that a rule set describing what is monitored is itself sensitive. Manufacturers run operational technology networks isolated by safety engineering rather than by security policy. Some jurisdictions require that specified categories of data remain in-country on infrastructure the operator controls.
What these share is that the requirement is not a risk appetite to be negotiated. It is an entry condition, and it eliminates most of the AI governance market before any feature comparison begins — as the landscape map sets out, on-premises deployment is undocumented across most of the security-branded cohort, and air-gapped operation is documented by almost none of it.
What it costs to support
Supporting it properly means accepting constraints elsewhere. Threat intelligence and model updates arrive on a media transfer cadence rather than continuously. Observability stays inside, so vendor-side diagnosis is unavailable and the product has to be operable by people who cannot escalate a live session. Policy distribution needs signed offline bundles with verifiable provenance.
The governance benefit is that the enforcement decision and the evidence of it are both inside the boundary, so reconstructing a decision for a regulator is a query against your own system rather than a request to a third party. That is the architectural argument behind AI sovereignty, the Trust Fabric, and the defense and intelligence approach, with regulated-industry deployment and deployment practices documented separately. For organizations spanning several regulators, the multinational approach covers running one policy set across boundaries.
Related terms
AI sovereignty · Runtime governance · Information barrier · Policy as code · Full glossary
Put this in the path of your own agents.
Policy enforced inline between your agents and every model and tool they reach, with a record bound to the human who owns it.
Request a Demo Read the docs