What Is Air-Gapped AI?
Air-gapped AI is artificial intelligence — most commonly a large language model (LLM) — that runs on hardware which is physically or logically isolated from the public internet and any untrusted network. The term borrows from cybersecurity, where an "air gap" is a deliberate gap between a secure system and the outside world: there is no cable, no Wi-Fi, and no routable path across which data can flow in or out. Applied to AI, it means the model weights, the inference engine, and the data being processed all live inside that isolated boundary, and every answer is computed locally without a single byte crossing the gap.
That is a materially stronger guarantee than "the cloud, but private." In a true air-gapped deployment there is no API call to an outside provider, no background telemetry, and no software-update channel that phones home. A user can type a prompt, attach a sensitive document, and receive an answer while the machine is in airplane mode, inside a shielded room, or on a network that has never touched the internet. The isolation is the product: it is what lets organizations use generative AI on information that is legally or operationally forbidden from leaving their control.
It helps to be precise about the phrase "air gap," because it is used loosely in marketing. A genuine air gap is architectural — the system is incapable of reaching the internet — not merely a policy that says data "should not" be sent. Many products described as "secure" or "private" still route requests to a hosted endpoint over an encrypted connection; that is private cloud, not an air gap. The distinction matters enormously to a security team, because an architectural guarantee can be inspected and proven, while a policy can be misconfigured, bypassed, or quietly changed in a future release.
Air-gapped AI = a local model + your isolated hardware + a runtime that makes no external calls. The result is a generative AI assistant that is provably offline — nothing enters or leaves the boundary.
What Is an Air-Gapped Network (and an Air-Gapped Computer)?
An air-gapped network is a network with no physical or logical connection to the internet or any untrusted network. An air-gapped computer is a single machine held to the same rule: no Ethernet, no Wi-Fi, no Bluetooth path off the box. Data crosses only by a deliberate, approved transfer: hand-carried media, a one-way data diode, or a cross-domain solution.
The term comes from network security, where isolation is the last line of defense. NIST SP 800-53 control SC-7 (Boundary Protection) describes controlling the edge between a system and external networks; an air gap is the extreme end of that control. Rather than filtering what crosses the boundary, it removes the crossing. There is no firewall rule to misconfigure and no proxy to bypass, because there is no route at all — which is why security teams treat an air gap as something they can inspect and prove rather than something they have to trust.
The two phrases describe the same rule at different scales. An air-gapped network is an enclave: a file server, a set of workstations, a printer, and often an internal model server that all speak to each other freely while the enclave as a whole speaks to nothing outside. An air-gapped computer is one machine carrying the boundary on its own — the laptop in a controlled space, the workstation on a plant floor, the analyst machine in a shielded room. Both can run air-gapped AI; they differ in where the model sits and how many people it serves.
| Dimension | Air-Gapped Network | Air-Gapped Computer |
|---|---|---|
| Scope | An enclave of many machines | One isolated device |
| Where the model runs | An internal server, shared by the enclave | On the device itself (CPU, GPU, or NPU) |
| How data gets in | Approved media, or a one-way transfer at the enclave edge | Approved removable media, verified before it is mounted |
| Typical setting | Classified enclaves, OT and plant networks, research labs | Field laptops, SCIF workstations, forward-deployed teams |
| Where it usually breaks | A dual-homed machine bridging the enclave to the corporate LAN | A radio re-enabled by a driver update or a user |
Data still has to move, and there are only three sanctioned ways to move it. The first is the hand-carried transfer — approved removable media, scanned and signature-checked before it is mounted. The second is a one-way transfer device, often called a data diode, that physically permits traffic in one direction so updates can enter an enclave while nothing can leave it. The third is a cross-domain solution that inspects and releases specific content between classification levels under its own accreditation. All three are deliberate, logged events; none of them is a background connection, which is exactly the property that makes the gap meaningful.
Whether the boundary surrounds an enclave or a single laptop, the model weights, the inference engine, the embeddings, and the document index all have to live inside it. Anything the assistant needs that is not inside the boundary is a break in the gap.
Air-Gapped Meaning in Practice: The Three States (Sealed, Offline-Tolerant, Cloud-Dependent)
In practice "air-gapped" describes three different states. Sealed systems have no network path at all. Offline-tolerant systems keep working with the network unplugged but can reconnect. Cloud-dependent systems only appear private — they still call an external endpoint. Only the first is a true air gap.
The word is used loosely enough that two teams can agree they need an air-gapped system and mean different architectures. Sorting a deployment into one of three states settles the question quickly, and it is a testable classification rather than a matter of description: block egress at the firewall, or pull the cable, and watch what stops working.
| State | What it means | How to verify it | What AI can run there |
|---|---|---|---|
| Sealed | No routable path exists; the system is incapable of reaching an outside network | Inspect the build: no radios, no route, no update channel. Nothing to disable, because nothing is there | Local open-weight models with local retrieval, installed from verified media |
| Offline-tolerant | The system works disconnected but a path exists and can be re-enabled | Unplug it: the software keeps working. Reconnect: it syncs, updates, or reports | The same local models, but the isolation is a setting rather than a guarantee |
| Cloud-dependent | Private tenancy or encrypted transport, with inference on someone else's compute | Block egress: the assistant stops answering, because the answer came from outside | Hosted frontier models, appropriate when the data is allowed to leave the boundary |
The three states are a fit question, not a ranking. Cloud-dependent is the right answer for a great deal of enterprise work, and an authorized environment such as FedRAMP AI exists precisely so regulated data can be processed off-premise under a recognized control set. What causes trouble is buying one state while believing you bought another.
Two failure patterns account for most of the confusion. The first is the offline-tolerant system sold as sealed: it demonstrates beautifully with the cable out, then re-enables telemetry or an auto-update check the moment it sees a network again. The second is the retrieval pipeline that is local everywhere except one call — a hosted embedding model, a remote reranker, a license check — which quietly relocates every indexed document to an outside service. Both are found the same way: run the system with egress blocked and log every connection it attempts. For a ranked view of products built for the sealed state, see the roundup of the best AI solutions for air-gapped environments; for the wider category above it, see what private AI is.
Air-Gapped AI vs On-Premise vs Private Cloud
Air-gapped, on-premise, and private cloud are frequently lumped together as "not public cloud," but they describe three different levels of isolation. Choosing correctly is a security decision, not a branding one, so it is worth separating them cleanly. They sit on a spectrum from most convenient (private cloud) to most controlled (air-gapped).
| Dimension | Private Cloud | On-Premise AI | Air-Gapped AI |
|---|---|---|---|
| Where it runs | Provider-hosted, dedicated tenant | Servers inside your network | Isolated, disconnected hardware |
| Internet path? | Yes (encrypted) | Often, but controlled | None — architecturally isolated |
| Data leaves you? | Yes, to the tenant | No, stays in-network | No — nothing crosses the gap |
| Works fully offline? | No | On your network | Yes, with zero connectivity |
| Best for | Scale, convenience, low sensitivity | Enterprise control & governance | Classified, regulated, OT |
The key line is "internet path": every air-gapped system is on-premise, but not every on-premise system is air-gapped. For the enterprise on-premise variant and its hardware trade-offs, see how to deploy an LLM on-premise and the broader private LLM guide.
Why Organizations Need Air-Gapped AI
Organizations adopt air-gapped AI when their data cannot legally or safely leave a controlled boundary. For these teams, the cloud is not merely inconvenient — it is prohibited. Air gapping is how they capture the productivity of generative AI without breaking the rules that govern their information. Four situations drive almost all demand.
Classified & Defense Environments
Intelligence, defense, and national-security work happens inside classified enclaves and sensitive compartmented information facilities (SCIFs) where connected systems are simply not allowed. Air-gapped AI is the only way to bring an LLM into that room at all. This is a core focus of Iternal's public sector & government practice, where deployments must satisfy defense data-handling requirements from day one.
Regulated Industries
Healthcare, finance, legal, and critical infrastructure handle protected data governed by rules such as HIPAA, ITAR, CMMC, and GDPR. Sending patient records, deal documents, privileged case files, or export-controlled technical data to a third-party API can be a reportable violation. Keeping inference inside the boundary is how these organizations stay compliant while still using AI on their most valuable documents.
Operational Technology & Disconnected Sites
Factories, utilities, energy platforms, ships, and remote field sites run operational technology (OT) networks that are intentionally isolated from IT and the internet for safety and reliability. Connectivity may also simply be unavailable. Air-gapped AI lets crews get answers from technical manuals, procedures, and logs on-site — with no assumption that a network is reachable.
Data Sovereignty & IP Protection
Even outside classified and regulated work, some organizations treat their trade secrets, source code, and research as too valuable to expose to any external service. Air gapping guarantees data residency and removes the risk of a prompt or document being logged, retained, or used to train someone else's model. The isolation is a strategic control over intellectual property, not just a compliance checkbox. For more on the jurisdictional rules that drive this decision, visit the sovereign AI and data residency page.
If you are trying to decide whether air-gapped AI fits your organization — and which use case to fund first — the free AI Readiness Assessment scores where you stand on data sensitivity, governance, and deployment readiness in a few minutes.
How Air-Gapped AI Works
Air-gapped AI works by moving three things — the model, the compute, and the data — inside the isolated boundary, so nothing needs to be requested from outside it. Cloud AI splits these across the internet: your data travels to a provider, the model runs on the provider's compute, and the answer travels back. Air-gapped AI collapses that whole loop onto hardware you control. Three mechanics make it possible.
On-Device Inference
"Inference" is the act of running a trained model to produce an answer. In an air-gapped system, inference happens entirely on local silicon — a CPU, a GPU, or increasingly a neural processing unit (NPU) built into modern AI PCs. Because the computation is local, there is no network round-trip, responses are low-latency, and the assistant keeps working with the network cable unplugged. Smaller open-weight models are quantized (compressed) so they fit comfortably in the memory of a laptop or a modest server, which is what makes on-device inference practical rather than theoretical.
Model Locality
The model weights — the file that is the AI — are downloaded once on a connected staging system, verified, and then transferred across the gap onto the isolated hardware. From that point the model lives entirely inside the boundary. This is only possible with open-weight models (families such as Llama, Qwen, Gemma, Mistral, and DeepSeek publish their weights for local use); closed frontier models that exist only behind a hosted API cannot, by definition, be air-gapped. Model locality is what removes the outside provider from the runtime entirely.
Data Locality and Retrieval Inside the Boundary
A base model only knows its training data, so to answer questions about your organization you add your own documents through retrieval-augmented generation (RAG). In an air-gapped deployment, the document store, the embedding model, and the vector search all run inside the gap too. This is the step teams most often get wrong: a single remote embedding or search call buried in a RAG pipeline quietly defeats the air gap. A correct design keeps the entire retrieval path local. It also raises an accuracy question — naive retrieval over messy, duplicated files produces confident-but-wrong answers — which is why data-optimization approaches that clean and deduplicate source content before indexing matter so much for trustworthy offline AI.
It is rarely the chat model that breaks isolation — it is a forgotten external dependency: a cloud embedding API, a telemetry beacon, or an auto-update check. A genuine air-gapped product ships with these removed and can be verified to make zero outbound connections.
Best Practices for Deploying Air-Gapped AI
A reliable air-gapped deployment is disciplined about what enters the boundary and what runs inside it. The following practices separate a genuinely isolated system from one that only appears to be.
Verify everything before it crosses the gap
Pre-stage the application, model, embedding model, and every dependency on a connected system; check cryptographic signatures and hashes; then transfer onto the isolated hardware using approved media. Nothing enters the enclave unverified.
Keep the entire inference and retrieval path local
Audit the pipeline end to end for external calls — the model, the embeddings, the vector store, and any tools. A single remote endpoint breaks the guarantee. Prefer software that is designed to make no outbound connections at all.
Disable telemetry and auto-update
Turn off usage analytics, crash reporting, and background update checks. In an air-gapped environment these either fail noisily or, worse, indicate a path that should not exist. Updates become a deliberate, staged, re-verified process.
Right-size the model to the hardware
Match model size and quantization to the available CPU, GPU, or NPU so the assistant is fast enough for real work. On modern AI PCs, a capable mid-size model runs entirely on-device without a server room.
Clean your data before you index it
Deduplicate and structure source documents before building the local knowledge base. Trustworthy offline answers depend far more on clean retrieval data than on model size — garbage in, confident-but-wrong out.
Govern access and keep an audit trail
Even fully offline, apply least-privilege access, log usage inside the boundary, and define who can add documents or update the model. Isolation is a control, not a substitute for governance.
The Air-Gapped AI Landscape (Overview)
The tools that make air-gapped AI possible fall into two broad camps: developer runtimes for practitioners, and packaged applications for organizations. Both run models locally; they differ in who they are built for. Understanding the split helps you choose the right entry point rather than the loudest one. If you would rather begin from a shortlist, our ranked overview of the best AI for air-gapped environments walks through the leading options side by side.
On the practitioner side, open-source runtimes like Ollama, LM Studio, Jan, and GPT4All let an engineer download an open-weight model and run it locally in minutes. Ollama and llama.cpp are command-line-first and excellent for developers who want maximum control; LM Studio and Jan add friendly desktop interfaces. These tools are genuinely good at what they do, and for an individual technical user experimenting on one machine they are often the fastest path to a local model. They are, however, building blocks: getting from a single laptop to a governed, audited, air-gapped deployment across a regulated organization — with document chat, access control, and no external calls — is a separate body of work.
On the organizational side, packaged products fill that gap. AirgapAI is Iternal's example of the enterprise, no-CLI path: it installs like ordinary software, runs 100% offline, and ships with document chat and built-in workflows so a non-technical employee is productive on day one — no toolchain to assemble and no external endpoints to audit away. The right framing is that these are complementary categories, not rivals: a developer prototyping on Ollama and a hospital or agency rolling out a supported air-gapped assistant to hundreds of staff are solving different problems. For a side-by-side, ranked comparison of the options in this space, see our roundup of the best AI solutions for air-gapped environments.
Air-Gapped Laptops and Workstations: What Local AI Needs From the Hardware
An air-gapped laptop is a machine with its radios disabled and no route to the internet, used inside a controlled space. To run a useful local model on one, budget roughly 16GB of RAM for a small model and 32GB for a mid-size one, plus fast SSD storage for the weights.
Two things have to be true of the device. It has to be genuinely isolated, and it has to be capable enough that the assistant is worth using. Teams tend to solve the first and forget the second, then conclude that offline AI is slow — when the real problem was a model that did not fit in memory.
Radios off at the firmware level
Wi-Fi, Bluetooth, and cellular modules are disabled in firmware or removed, not merely switched off in the operating system, so a driver update or a user cannot put the machine back on a network. Ports and removable media are governed by policy on the endpoint.
Encrypted at rest, controlled in place
An isolated laptop concentrates sensitive material in one portable object, so full-disk encryption, boot protection, and physical custody carry more weight than they would on a networked fleet. Isolation protects the data in transit that never happens; encryption protects the device that walks away.
Memory sized to the model, not the brochure
A quantized open-weight model has to hold its weights plus its working context in memory. RAM and, where present, dedicated video memory decide which model class the machine can run; the processor decides how fast the answer arrives.
The sizing tiers Iternal publishes with AirgapAI are a workable planning baseline for any isolated Windows device, because they are expressed in memory and model class rather than in a specific product.
| Tier | Memory | Model class | What it is good for |
|---|---|---|---|
| Entry | 16GB RAM, Intel Core Ultra with integrated GPU and NPU | 1B-class open-weight model | Drafting, summarizing, and question-answering over a modest local document set |
| Standard | 32GB RAM | 1B to 3B-class models | Everyday knowledge work with a larger index and longer context |
| Heavy | 64GB RAM (integrated GPU/NPU), or a discrete NVIDIA RTX 500-class GPU or better | 3B to 8B-class models and above (9B-class needs an RTX 2000-class GPU) | Technical reasoning, longer documents, and faster responses under load |
Tiers as published in the AirgapAI system requirements on the AirgapAI page, which also list 8GB of vRAM as the minimum for the 1B to 4.5B models. For how model size, quantization, and memory interact before you pick hardware, see the local LLM guide; for the server-side equivalent that serves an enclave rather than a single device, see how to deploy an LLM on-premise.
Storage is the quiet requirement. Quantized weights run from roughly one gigabyte for the smallest models to tens of gigabytes for larger ones, and the local document index sits alongside them, so an isolated machine wants fast SSD capacity and room to keep more than one model on disk. Plan the transfer path at the same time: whatever installs the application, the model, and the embedding model has to fit on the approved media the enclave allows, and it has to be verified before it is mounted.
Air-Gapped AI on Intel AI PCs
One of the biggest shifts making air-gapped AI practical is that the hardware to run it now ships in ordinary laptops. Modern Intel AI PCs pair a CPU, integrated GPU, and a dedicated neural processing unit (NPU) on a single device, giving on-device inference a purpose-built accelerator. That means a capable model can run entirely on the machine in front of you — no server rack, no data center, and no network — which is exactly what an air gap requires.
AirgapAI is built for this hardware. As a core co-branding partner, Intel provides the AI PC platform and the OpenVINO runtime that AirgapAI uses to run open-weight models efficiently across the CPU, GPU, and NPU. The result is a turnkey, 100% offline AI assistant that installs on a standard Intel AI PC and works with zero connectivity — suitable for the SCIF, CMMC, and other regulated environments described earlier in this guide. Because it is a packaged product rather than a DIY stack, the air gap is a verified property of the software, not something a team has to engineer and re-check on every update.
The same on-device approach extends to adjacent jobs. AirgapAI Transcribe brings meeting and audio transcription inside the boundary, so confidential conversations can be transcribed and summarized without ever uploading the recording. Together they show the pattern: take a workflow that normally assumes the cloud, and run it entirely on local Intel silicon so the data never has to leave.
Ready to see air-gapped AI running fully offline?
Explore how AirgapAI delivers a governed, 100% offline AI assistant on standard Intel AI PCs — then request a demo to see it in your environment.
Why Iternal
Iternal Technologies builds the secure, sovereign AI stack referenced throughout this guide — AirgapAI for 100% offline local AI and Blockify for accurate, deduplicated retrieval so an offline model answers from clean data. Iternal is the complementary secure-and-sovereign-AI specialist alongside the major firms: Accenture, Deloitte, McKinsey, BCG, IBM, Dell, NVIDIA, HPE, and Intel are partners, not competitors. If you are moving from a single-laptop experiment to a governed, air-gapped deployment across a regulated organization, that bridge is exactly what Iternal builds.