---
title: "Air-gapped AI for enterprises: a practical guide | Aventail™"
url: https://aventail.co.uk/guides/air-gapped-ai
description: "Learn how to deploy air-gapped AI, keep model requests on approved hardware and test offline workflows with Aventail™ Link, Control and Connect."
lang: en-GB
---

Skip to content

Locai is now Aventail™ Learn about the rebrand: https://aventail.co.uk/newsroom/locai-rebrands-as-aventail

All guides (https://aventail.co.uk/guides)

# Air-gapped AI: a practical guide for enterprises

28 October 2026

Learn how to deploy air-gapped AI, keep model requests on approved hardware and test offline workflows with Aventail™ Link, Control and Connect.

Air-gapped AI runs models and their supporting workflow inside an isolated environment, without an automated connection to external networks. It gives organisations a way to use AI where confidential source code, documents or operational data cannot be sent to a public AI service.

The important word is **workflow**. Running a model locally is one part of the job. Authentication, document retrieval, application integrations, management and updates must fit the same boundary.

Aventail ™ Link can operate completely disconnected. Enterprises that need local management can also deploy Aventail ™ Control inside an air-gapped environment. Aventail ™ Connect brings supported applications’ model requests into that runtime, allowing teams to use local inference through familiar tools.

This guide explains when that approach makes sense, what needs to run inside the boundary, and how to test the result before introducing sensitive work.

## What counts as air-gapped AI?

NIST’s definition of an air gap (https://csrc.nist.gov/glossary/term/air_gap) describes systems without a physical connection, with transfers across the boundary performed manually under human control.

In practice, vendors sometimes use “air-gapped”, “private” and “offline” loosely. Write down the architecture you actually require.

- **On-premises AI:** the model runs on hardware at your premises. That location alone does not establish that the application, management services or tools have no external connections.
- **Restricted-network AI:** network controls limit which connections are possible. That does not establish physical separation or the absence of every automated external data path.
- **Air-gapped AI:** the system is separated from external networks, with controlled transfers across the boundary. This does not protect against every insider, software, supply-chain or model risk.

A private endpoint to a cloud AI provider is still a connection to an external service. It may meet your organisation’s requirements, but it is a different architecture.

Start with the written restriction: does the information need to stay on a particular device, inside an internal network, or within a completely disconnected environment?

### Is “not used for training” the same as keeping data inside our network?

No. A hosted service can restrict training use or retention while still processing the request outside your environment. Those commitments answer different questions from where information goes and which systems receive it. Anthropic’s data-usage documentation (https://code.claude.com/docs/en/data-usage) distinguishes commercial training policies, retention and local storage. If your rule prohibits sending source code or documents outside an approved boundary, assess the processing path as well as the provider’s contractual commitments.

## Why businesses are taking disconnected AI seriously

The demand is becoming explicit.

Y Combinator’s Winter 2027 “AI for the Air-Gapped Economy” request (https://www.ycombinator.com/rfs) identifies organisations that want AI inside their own facilities without an internet connection. Its focus includes deployment tooling and security, as well as models and hardware.

The same requirement appears in enterprise announcements. On 5 October 2026, PwC and Cohere announced an alliance (https://www.pwc.com/gx/en/news-room/press-releases/2026/accelerate-secure-enterprise-ai-adoption.html) that explicitly includes private-cloud, on-premises and air-gapped deployments. Microsoft’s February 2026 Sovereign Cloud announcement (https://blogs.microsoft.com/blog/2026/02/24/microsoft-sovereign-cloud-adds-governance-productivity-and-support-for-large-ai-models-securely-running-even-when-completely-disconnected/) also describes disconnected management and support for local AI models.

These are signals of a practical buying requirement: companies want useful AI without accepting an external dependency that conflicts with how they handle sensitive work.

Security research reinforces the need to review the whole application. The 2025 EchoLeak case study (https://arxiv.org/abs/2509.10540) describes a Microsoft 365 Copilot vulnerability involving indirect prompt injection and data exfiltration. It was remediated before public disclosure; it should not be presented as evidence of a current, unpatched customer breach.

The lesson is to examine what an assistant can access, execute and transmit. Changing its inference endpoint does not answer all three questions.

## The benefits, and the costs to plan for

A well-designed air-gapped deployment can help a business:

- **Make restricted workflows usable.** Explain internal code, search approved documents or assist with technical work where an external AI API is not permitted.
- **Control the processing boundary.** Keep model execution, retrieval and operational records within the approved environment.
- **Reduce external operational dependencies.** Continue supported local work without relying on an internet connection or a remote model endpoint.
- **Control changes.** Decide which model, application and runtime versions enter the environment, and test them before rollout.

That control comes with responsibility. Your organisation needs capacity planning, security maintenance, model evaluation, backups and an approved update process. Local hardware, energy and support have costs. A disconnected model may also perform differently from the hosted model employees already know.

If your requirement is simply to keep particular requests on approved infrastructure, a policy-controlled private deployment may be sufficient. Choose an air gap because the requirement calls for it, and evaluate the complete operating cost.

## Design the complete AI workflow

Before choosing a model, map the path from the employee’s task to the final result.

For a document assistant, that can include file parsing, OCR, embeddings, a search index, retrieval, generation and storage. For a coding assistant, include repository access, shell commands, package managers, plugins and MCP servers.

Each component needs an answer to three questions:

1. Where does it run?
2. What can it read or change?
3. What connections or external services does it require?

A local language model does not make a cloud embedding service local. An offline assistant cannot install a missing package from a public registry. These are deployment dependencies to resolve before the pilot.

## How to deploy air-gapped AI

### 1. Choose one business workflow and define its boundary

Begin with a bounded task, such as explaining a synthetic codebase or answering questions from a small set of approved documents.

Agree the allowed data, users, machines and actions. State whether other internal machines may process requests, and what must happen when no approved model is available.

Set measurable acceptance criteria: useful output, acceptable response time, enough capacity for the pilot and no prohibited data path.

### 2. Prepare the software and model supply chain

Inventory the runtime, model weights, tokeniser, drivers, application versions and any retrieval or tool dependencies.

Establish an approved route for importing and checking those artifacts. Retain their versions, provenance and integrity evidence, and confirm the model’s licence permits the intended use. Plan updates and rollback at the same time.

The joint secure AI deployment guidance (https://www.cyber.gov.au/publication/deploying-ai-systems-securely) emphasises deployment hardening, supply-chain review, validation and access controls. Treat downloaded models and supporting software as components to assess before they enter production.

A package-download page or internet-based installer is not an offline deployment procedure. Agree provisioning, registration, licensing and update arrangements for the disconnected environment before rollout.

### 3. Run inference inside the approved environment

Aventail ™ Link combines a built-in inference engine with an LLM gateway and policy-based routing. It can run supported models on your machines and operate completely disconnected.

Choose a compatible model for the actual task and available hardware. Test tool use for coding assistants, and check memory requirements at the intended context length. A model that loads successfully may still be unsuitable for the workflow or number of users.

Start with one machine. If another internal server will serve requests, review its listener, authentication, transport and network rules. Signing in to Control does not automatically secure a model’s serving port; see the security and access documentation (https://docs.aventail.co.uk/docs/guides/security).

### 4. Keep management inside the boundary too

Enterprises requiring a disconnected management plane can deploy Aventail ™ Control locally within an air-gapped environment.

This matters when device configuration, model management and operational records must remain inside the same boundary as inference. Hosted Control and public model downloads require connectivity; they are not the management path for a fully isolated installation.

Use the architecture and data-flow reference (https://docs.aventail.co.uk/docs/introduction/platform-architecture) to separate inference from management, then agree the local enterprise deployment with the team.

### 5. Restrict execution destinations and fallback paths

Permit only destinations inside the approved environment. For a single-device workflow, that means local execution. For an isolated internal network, it may include specifically approved machines running Aventail ™ Link.

Check the entire rule and fallback chain. If a policy permits an external provider, that is an external route even when the first request normally runs locally. When no destination is permitted, Aventail ™ errors rather than selecting a forbidden destination.

The local-model and cloud-API routing guide (https://aventail.co.uk/guides/route-local-models-and-cloud-apis) explains destination verification. For an air-gapped deployment, use that verification process with external destinations excluded.

### 6. Validate each application under real isolation

Connect the application to the approved runtime, then test the complete task with external connectivity unavailable.

Check startup, authentication, tool execution, storage, updates, diagnostics and any optional integrations. A session that was already authenticated and running before disconnection is not sufficient evidence of a complete offline lifecycle.

Maintain the network boundary independently of application settings. Review attempted as well as successful connections: blocked calls can reveal a dependency that will cause failures later.

## Using Claude interfaces with local models through Aventail ™ Connect

Aventail (https://aventail.co.uk/connect) ™ (https://aventail.co.uk/connect) Connect (https://aventail.co.uk/connect) brings supported model requests from Claude Desktop, Claude Code and OpenCode into Aventail ™ Link. This lets a team retain familiar applications while choosing a supported model that runs on its own hardware.

For the current Claude Desktop setup:

1. Download and prepare an approved compatible model.
2. Start serving it in Aventail ™ Link and check the context length and memory requirement.
3. Close Claude Desktop, open **Connected apps** in Link and connect Claude.
4. Reopen Claude Desktop and select the connected model.
5. Check the actual execution destination using the deployment’s usage records.

For Claude Code, the model is chosen in Link. Enable Claude Code under Connected Apps and open a fresh session. The supported automatic Connect path does not require manually editing an API endpoint or pasting a provider key.

Follow the illustrated Claude Desktop and Claude Code setup guide (https://aventail.co.uk/guides/claude-code-with-aventail-connect) for the version-specific steps.

**Connect can keep supported model requests local. A full application air gap also requires the app’s other dependencies and network behaviour to pass your isolation tests.** This is not a claim that Connect intercepts every connection, that every Claude feature works offline, or that Anthropic’s Claude model weights have been installed locally.

Anthropic’s Claude Code data-usage documentation (https://code.claude.com/docs/en/data-usage) describes separate storage and feedback behaviour. Review the installed app’s requirements alongside the enterprise Claude Code security checklist (https://aventail.co.uk/guides/claude-code-security-enterprise).

## An acceptance test before sensitive data

Use synthetic information first. The following checks are a starting point for your security and infrastructure owners.

1. **Start the application and runtime from a stopped state while isolated.** Record the versions, startup result and any missing dependency or authentication requirement.
2. **Run a representative harmless task.** Record output quality, response time, the actual model and execution destination.
3. **Stop the permitted local model or internal serving machine.** Confirm the request fails when no allowed destination is available, without an external fallback.
4. **Exercise file access, tools and retrieval.** Verify that only approved files, actions and internal services are used.
5. **Inspect network activity and local records.** Account for expected internal traffic, blocked external attempts, storage locations and access controls.
6. **Apply an approved update and restore the previous version.** Record the controlled import, validation result, rollback and successful repeat tests.

Retest when the model, application, policy, runtime or environment changes. A successful demonstration establishes the tested configuration, not every future combination.

## Questions security and IT teams ask

### Does an LLM gateway alone create an air gap?

No. A gateway controls model requests; an isolated deployment also needs an inference engine, available model weights and supporting services inside the boundary. Aventail ™ Link combines inference and routing, while locally deployed Aventail ™ Control can provide enterprise management inside that environment. The gateway versus inference engine guide (https://aventail.co.uk/guides/llm-gateway-vs-inference-engine) explains those responsibilities.

### Can Claude Code run offline with a local model?

Aventail ™ Connect can direct supported Claude Code model requests to a model running in Aventail ™ Link. That provides local inference. Verify the installed app’s startup, features, tools and other dependencies with connectivity blocked before describing the whole application as air-gapped. The Connect setup alone does not establish that result.

### Does air-gapping prevent prompt injection?

No. Untrusted documents or repositories can still contain malicious instructions, and an assistant may still perform harmful actions within its permitted access. Isolation constrains external connectivity; permissions, approval controls and input handling remain necessary.

### Can an air-gapped deployment use frontier APIs?

A fully disconnected environment cannot make live calls to external APIs. If an approved network path allows such calls, describe the system as a connected or hybrid deployment and assess that path explicitly.

### Do we have to replace all our existing AI applications?

Not necessarily. Aventail ™ Connect supports specific applications’ model requests. Whether the complete application can meet your air-gap requirement depends on the installed version, features, dependencies and isolation tests.

### Does an air gap make the deployment compliant?

It establishes a technical boundary. Compliance also depends on the applicable requirements, access, data handling, retention, operating processes and evidence. Assess the deployment rather than treating “air-gapped” as a certification.

## Start with the workflow your business cannot send to the cloud

Aventail ™ brings model execution, deployment and routing into one platform. Link can operate disconnected, Control can be deployed locally for enterprise air-gap requirements, and Connect brings supported applications’ model requests under those routing rules.

For team rollout planning, read the private AI workspace deployment guide (https://aventail.co.uk/guides/private-ai-workspace-deployment), or talk to the team (https://aventail.co.uk/contact) about one workflow, its data restrictions and the environment it needs to run in.

We use optional cookies and tracking to identify visiting companies and load our contact form. Cookie policy (https://aventail.co.uk/cookies)

## Structured data

```json
{
  "@context": "https://schema.org",
  "@graph": [
    {
      "@type": "Organization",
      "@id": "https://aventail.co.uk/#organization",
      "name": "Aventail",
      "alternateName": "Locai",
      "legalName": "Loc.ai Ltd",
      "description": "Aventail, formerly Locai, was founded in May 2025 and is a graduate of Google AI First. Its integrated AI inference platform combines a built-in inference engine, deployment of supported models across approved hardware, and policy-based routing between those machines and approved external AI providers. Organisations use Aventail to control where inference requests run.",
      "url": "https://aventail.co.uk/",
      "logo": "https://aventail.co.uk/apple-touch-icon.png",
      "email": "hello@aventail.co.uk"
    },
    {
      "@type": "Article",
      "@id": "https://aventail.co.uk/guides/air-gapped-ai#page",
      "url": "https://aventail.co.uk/guides/air-gapped-ai",
      "name": "Air-gapped AI: a practical guide for enterprises",
      "description": "Learn how to deploy air-gapped AI, keep model requests on approved hardware and test offline workflows with Aventail™ Link, Control and Connect.",
      "publisher": {
        "@id": "https://aventail.co.uk/#organization"
      },
      "headline": "Air-gapped AI: a practical guide for enterprises",
      "datePublished": "2026-10-28",
      "dateModified": "2026-10-28T12:22:19.129594+00:00",
      "image": "https://aventail-ai-platform.lovable.app/images/share/newsroom/air-gapped-ai-v1.jpg",
      "author": {
        "@id": "https://aventail.co.uk/#organization"
      }
    },
    {
      "@type": "BreadcrumbList",
      "@id": "https://aventail.co.uk/guides/air-gapped-ai#breadcrumb",
      "itemListElement": [
        {
          "@type": "ListItem",
          "position": 1,
          "name": "Home",
          "item": "https://aventail.co.uk/"
        },
        {
          "@type": "ListItem",
          "position": 2,
          "name": "Guides",
          "item": "https://aventail.co.uk/guides"
        },
        {
          "@type": "ListItem",
          "position": 3,
          "name": "Air-gapped AI: a practical guide for enterprises",
          "item": "https://aventail.co.uk/guides/air-gapped-ai"
        }
      ]
    }
  ]
}
```