What Is Air-Gapped AI, and Does Your Business Need It?

Detailed Explanation

Start by writing down what must stay separated. Is the requirement that client documents never reach a cloud model? That the AI server cannot contact the public internet? Or that the whole working environment has no automated connection to outside systems? Each asks for a different design.

The air-gap definition in NIST's glossary describes separation with no physical connection and no automated logical connection across the interface; transfers happen manually under human control. An isolated environment can contain several connected machines. The boundary around that environment is what matters.

The AI security and privacy hub covers the wider adoption checks. Decide the network boundary separately from who should operate a self-hosted AI system.

Compare the controls against the requirement

An Australian hosting address answers a location question. It does not demonstrate network isolation. Check data residency separately when a customer specifies where information may be processed or stored.

For example, a fictional accounting practice wants staff to summarise scanned client correspondence without sending it to a cloud model. A local document-processing service and local model, with outbound connections denied and approved internal access, are a reasonable starting design to assess. Buying a physically isolated workstation would also mean arranging how each new file gets onto it and how the reviewed summary gets back to the practice system.

If the same customer explicitly requires a disconnected processing environment, the design must meet that requirement. An assurance that the model runs locally would leave the main question unanswered.

When a true air gap is worth assessing

Consider it when a customer contract or information-handling requirement explicitly demands isolation, or when the consequence of an external connection is unacceptable under the business's documented risk assessment. Have the person accountable for that requirement approve the boundary and the transfer procedure before buying hardware.

For an ordinary workflow where the concern is an unintended upload, first assess local processing with blocked outbound access. This is a practical design recommendation, not a finding that every small business has the same risk profile. It lets you test the control against the actual concern while retaining approved internal integrations.

As checked on 2 November 2026, the OAIC's security guidance frames APP 11 around reasonable steps appropriate to the circumstances for entities it covers, including technical and organisational measures. Its factors include information sensitivity and consequences of a breach. The guidance does not make an air gap a universal AI requirement. Sector rules and contracts still need their own check.

Ask the supplier to prove the boundary

Request a diagram that follows a document from arrival to the final output. Include the workstation, OCR, model, search index, logs and backups. Mark each place information could leave the agreed environment.

For scanned documents, verify local OCR before the model sees the text. Keeping the model local does not establish where the scan was processed.

Then agree a demonstration using synthetic documents:

1. Load the model and other required files, then block the external connections the design says it can operate without.
2. Restart the service and process a fresh document. A demonstration using only an already-open session can miss a startup dependency.
3. Inspect the relevant network rules and connection logs during the run. Check document conversion and search as well as the model call.
4. Try an unavailable external service. The workflow should stop or use an explicitly approved local path; it should not silently switch to cloud processing.
5. Record what happened, which configuration was tested and who approved it. Repeat the relevant checks when components or settings change.

One successful disconnected run shows that the tested task can work without those connections. It does not prove there are no other transfer paths. Combine the demonstration with configuration review, including the browser, extensions and administrator access.

If a cloud model is intentionally part of the workflow, redaction before the cloud call is a different control. Document that boundary honestly.

Plan updates and file transfers before go-live

Ask who will obtain updates, check their origin, test them and bring them into the isolated environment. Agree how to return to the previous working version if an update fails. A system that cannot contact its update service still needs a maintenance owner.

For file transfers, specify who can authorise them, which media or transfer method is permitted, what gets checked and what record is kept. Apply the procedure to exported answers as well as incoming documents. A confidential answer copied to an unrestricted laptop has left the protected environment even if the model never made an internet request.

ASD's secure AI development guidance covers protecting infrastructure, incident management and continued secure operation. Isolation is one design choice within that work. It does not remove the need to limit an AI agent's actions or address prompt injection inside the environment.

Things to Consider

• Include staff time for transfers, updates and support in the quote. Hardware pricing alone will not show the operational cost of the isolation requirement.
• Decide whether the workflow needs live email, web search or external business systems. Each connection must be reconciled with the promised boundary.
• Keep local access permissions, backup recovery and physical access controls in scope. Removing an internet path does not decide who can read a file on the server.
• Put the accepted design and its exceptions in writing. Terms such as "private", "offline" and "on-premises" are too broad to serve as acceptance criteria on their own.

Common Mistakes

• Calling an office server air-gapped while it retains internet access or remote support connections across the stated boundary.
• Testing the model alone while a document converter, search service or chat interface still makes external calls.
• Disconnecting a system without funding a way to patch and restore it.
• Choosing isolation before asking how staff will get documents in and reviewed results out. If the approved path is impractical, pressure to work around it starts immediately.