Air-gapped AI: what it means and why most regulated firms need something else
What air-gapped AI means, what it costs to run, and why most regulated firms need a system that keeps content from AI companies instead.
At a glance
- An air-gapped AI system runs on computers with no network connection to the outside world, so every update, patch, model and document has to be carried in by a controlled route.
- “Air-gapped” is often used loosely when what people mean is no-egress: nothing goes to an AI company.
- Most CROs, medtech and life-sciences firms need no-egress. Few need a true air gap.
- Isolation makes routine security work harder. Five Eyes guidance expects regular patching, monitoring with alerts and model evaluation before each update, and every one of those needs a way in or out.
- Ask any vendor that says “air-gapped” how updates arrive, who reads the logs and what happens when hardware fails.
“Air-gapped” shows up on vendor pages and in client security questionnaires, usually as the strongest word available. It describes a real architecture, built for defense and intelligence work, and it carries a real operating cost. A regulated business that hears it may wonder whether it needs one. Most do not. What they need is a system that keeps their content away from AI companies, which is a different design and much cheaper to run.
What an air gap is, and what an air-gapped AI system is
An air gap is physical isolation. The computers on one side have no network path to the computers on the other: no cable to the internet, no Wi-Fi, no remote management link. Data crosses only when a person carries it, usually on removable media, through a controlled and logged procedure.
An air-gapped AI system puts everything the AI needs inside that isolated area: the model weights, the software that runs them, the document index, the user accounts and the logs. Nothing is fetched from outside at run time. When something new is needed, whether a security patch, a new model version or a new batch of documents, it is brought in through the same controlled route.
Two things people mean: air-gapped and no-egress
| Air-gapped | No-egress | |
|---|---|---|
| What it means | No network link to the outside at all | Prompts, documents and answers never go to an AI company |
| Does data leave? | Only by hand, through a controlled transfer | No content goes to an AI company, though other connections (updates, support) may exist |
| How updates arrive | Carried in on media, checked, then installed | Over the network |
| Operating burden | High: every patch, model update and document batch is a manual procedure | Low to moderate |
An air-gapped system is also no-egress. The reverse does not hold: a no-egress system can still be connected to your network and maintained remotely.
Who genuinely needs an air gap
Air gaps belong where the threat is a capable adversary and the material is classified or critical: defense, intelligence, some government systems and parts of critical infrastructure. Those environments come with formal accreditation regimes and staff whose job is to run isolated networks.
The government guidance on AI security makes the same point about fitting controls to the threat. The “Deploying AI Systems Securely” paper, from the US NSA, CISA and FBI with the cyber security agencies of Australia, Canada, New Zealand and the UK, says its best practices may not apply to all environments and should be adapted to specific use cases and threat profiles. The UK NCSC’s “Guidelines for Secure AI System Development” says the same: not all of the guidelines will apply to every organization, and they should be considered alongside the organization’s use cases and threat profile.
A CRO handling sponsor protocols or a medtech consultancy holding design files faces a different threat: material leaking to a third party through everyday tools, or an unpatched system being breached. An air gap answers the first problem with far more than it needs and makes the second one harder.
What isolation costs to run
The cost of an air gap is in operations. Every routine security duty needs a path in or out, and the gap removes the path.
Patches
The deployment paper tells operators to review hardware vendor guidance and notifications for GPUs, CPUs and memory and to apply software patches and updates. On an air-gapped device, each patch has to be downloaded on a connected computer, checked, copied to media, carried across and installed by hand. The same paper asks operators to confirm each artifact’s origin and integrity with signatures or checksums, which on an air gap becomes a manual step for every file.
Automatic updates
The NCSC guidelines ask providers to include automated updates by default and to use secure, modular update procedures to distribute them. An air gap rules out automatic updates by design. That is a tension between the architecture and the guidance, and a firm choosing an air gap needs a written manual update process to stand in its place.
Model upgrades
When a model is updated to a new version, the deployment paper says to run a full evaluation of accuracy, performance and security before redeploying. Inside an air gap that evaluation also has to happen inside, on isolated hardware, with test data carried in.
New documents
An agent is only as current as its index. If your SOPs, protocols and reports live on connected file servers, every revision has to be exported, carried across and re-indexed. Until it is, the agent answers from the old version.
Monitoring
The deployment paper recommends collecting logs of inputs, outputs, intermediate states and errors with automated alerts, and alert systems that notify administrators of possible compromise. An alert on an isolated network only helps if someone on that network is watching. For a small firm, that usually means nobody.
Hardware failure
A failed disk or power supply in an isolated enclave needs someone on site with the right parts and clearance to replace it, and backups that were also kept inside the gap.
None of this is impossible. It is a standing workload, and it falls on staff that small regulated firms do not have.
What most regulated businesses need instead
For a CRO, medtech or life-sciences firm, the realistic requirement is usually this:
- No content goes to AI companies. Prompts, documents and answers stay on a device in your office, with no account at any AI company. This is what client confidentiality clauses are about.
- Patching and monitoring happen on time. A connected, maintained device that gets its patches on time is safer in practice than an isolated one whose patches wait for a manual procedure nobody runs.
That combination is no-egress, without the air gap. It meets the confidentiality concern behind most client questionnaires and keeps the routine security work routine. The wider question of whether on-premise AI suits your firm is in our guide to on-premise AI. Confidential AI is a broader topic of its own.
Questions to ask a vendor that says “air-gapped”
- Is the system physically isolated with no network link of any kind?
- Does any content (prompts, documents, answers, logs) leave the device, and to whom?
- How do security patches for the operating system, drivers, firmware and AI software reach it, and how often?
- How are update packages verified before installation?
- How does a new model version get in, and who evaluates it before it goes live?
- How do new and revised documents get into the index, and how quickly?
- Who reads the logs and alerts, and how do they see them if the system is isolated?
- What happens when hardware fails, and where are the backups kept?
- What does the update procedure cost us in staff time each month?
Where IntraMuros fits
IntraMuros is not air-gapped, and we do not describe it that way. It is a connected device in your office that a vendor keeps patched and monitored, which is the combination described above. Mayet, a British company that builds software for pharma, biotech, medical devices, clinical research and other regulated industries, ships the device in a couple of days, configures it remotely in a few hours after you plug it in, and connects it to your documents and email, and can connect it to software such as your eQMS, eTMF, CTMS or ERP. Mayet then patches, monitors and backs it up, and replaces it if it fails, so the questions on patches, logs and hardware failure have a named answer.
The model runs on the device itself, so prompts, documents and answers do not go to an AI company, and your documents and conversations are never used to train any AI model, by Mayet or anyone else. Staff use MURO, the agent, from a browser and sign in with their Microsoft or Google work account, and MURO works with that person’s permissions. On question 2: Mayet connects to the device to update, monitor and back it up. That connection is exactly why it is not an air gap, and Mayet is the one outside party that administers the device.
That maintenance costs £1,000 a month or £10,000 a year for one device. The device is a one-off charge with set-up included, and a CRO or medtech firm of 25 fits Enterprise at £12,000.
If your contracts or your threat model require a true air gap, IntraMuros is not the right product. For firms that need their content kept from AI companies and their patching done on time, see how it works and pricing.
Sources
- Deploying AI Systems Securely: Best Practices for Deploying Secure and Resilient AI Systems — NSA AISC, CISA, FBI and Five Eyes partners, v1.0 (April 2024)
- Guidelines for Secure AI System Development — UK NCSC, CISA and international partners (November 2023)