Can you run an LLM completely offline with no internet?

Yes. Open-weight models such as GLM-5.2, DeepSeek, Qwen3-VL, and Llama are static files that require no external calls to load or run. With weights, serving stack, and dependencies mirrored inside the boundary, inference, retrieval, and fine-tuning all execute with zero network connectivity — permanently.

Does CMMC or ITAR prohibit using ChatGPT or cloud AI?

Effectively, for controlled data. ITAR-controlled technical data may not flow to systems or persons outside your authorization, which rules out public AI APIs outright. CMMC Level 2 requires the 110 NIST SP 800-171 controls for CUI, including boundary control (SC.L2-3.13.1) — pasting CUI into an external AI service places it outside the assessed boundary and outside your control.

What are the hidden network calls that break an air-gapped AI deployment?

The common offenders: model-hub SDKs checking for updated weights at load time, serving frameworks and orchestrators emitting usage telemetry, license-manager phone-homes in commercial components, package managers resolving dependencies at install or container build, and monitoring agents shipping metrics to SaaS endpoints. An air-gapped build mirrors every dependency internally and verifies isolation with egress monitoring at the boundary.

How do you update models and software in an air-gapped environment?

Through a controlled transfer process: artifacts are downloaded on a connected staging system, checksum-verified against published hashes, scanned, approved, and carried across on approved media — then installed from an internal mirror. Open-weight releases arrive monthly, so a working sneakernet cadence with documented provenance is part of the operating model, not an afterthought.

Air-Gapped LLM Deployment: The Complete Guide for CMMC and ITAR Environments

An air-gapped LLM deployment is a model running on infrastructure with no path to any external network — and in 2026 it is a fully practical architecture, because frontier-class models now ship as open weights that load and run entirely offline. For defense contractors and manufacturers handling CUI or ITAR-controlled technical data, it is also close to the only architecture: public AI APIs place controlled data on systems outside your authorization boundary, which ITAR (22 CFR parts 120–130) and CMMC Level 2's NIST SP 800-171 controls do not forgive. The build itself is straightforward — weights, serving stack, and dependencies mirrored inside the boundary. What breaks air-gapped deployments in practice is almost never the model; it is the quiet network calls — telemetry, license checks, model-hub SDK update pings — smuggled in by the software around it. This guide covers both halves.

When is an air gap actually required?

Regime	What it demands	AI implication
ITAR (22 CFR 120–130)	Export-controlled technical data restricted to authorized US persons/systems	Public AI APIs are an unauthorized export path; offline deployment keeps data inside authorized systems
CMMC 2.0 Level 2	110 NIST SP 800-171 controls for CUI, incl. boundary protection (3.13.1) and CUI flow control (3.1.3)	External AI services sit outside the assessed boundary; CUI must not flow there
CMMC 2.0 Level 3	800-171 plus selected NIST SP 800-172 enhanced controls	Isolation-heavy postures where air gap is the natural reading
DFARS 252.204-7012	Safeguarding covered defense information; incident reporting	Vendor-held prompts become reportable surface you don't control
Trade-secret regimes	Reasonable measures to preserve secrecy	Crown-jewel process data pasted into public tools undermines "reasonable measures"

Note what an air gap buys beyond compliance: a deployment that cannot leak is also a deployment whose behavior cannot be changed remotely — no silent model swaps, no deprecations, no export-policy revocations. The June 11, 2026 US order cutting foreign access to Anthropic's top models demonstrated how fast connected AI can vanish; an air-gapped rack is immune by construction.

What does the reference architecture look like?

Five layers, all inside the boundary:

Compute. GPU nodes sized to the model — GLM-5.3-Flash (320B MoE, 18B active, natively multimodal, MIT) serves a firm from a single node at FP8 and a workgroup from two GPUs at 4-bit; our GLM-5.3-Flash hardware guide has the numbers, and the full GLM-5.3 fills an 8-GPU node for agentic coding. Qwen3.8 rides alongside where a second vision model is wanted. Kimi K3-class models (weights public since July 27, 2026) are cluster-tier.
Weights with provenance. Models downloaded on a connected staging system, verified against published checksums, scanned, and transferred on approved media. Weights are static files — they cannot transmit anything, which is precisely why this pattern works.
Internal mirrors. A full offline mirror of OS packages, Python dependencies, container images, and model artifacts. Nothing inside the boundary ever resolves an external hostname.
Serving and access control. vLLM/SGLang-class inference behind SSO tied to the enclave's identity provider, role- and program-based access (ITAR data segmented to authorized persons), and append-only audit logging.
Boundary verification. Egress monitoring — ideally a diode or deny-all with alarmed violations — proving the gap is real. "We think nothing calls out" is not evidence; a flat egress graph is.

What are the gotchas that silently break the air gap?

These are the failures we find in audits of "air-gapped" builds:

Model-hub SDKs. Popular loading libraries default to checking a hub for updated weights and will attempt DNS resolution at load time. Offline modes must be forced and verified, and artifacts served from the internal mirror.
Framework telemetry. Serving stacks, orchestrators, experiment trackers, and even CLI tools ship usage analytics by default. Every component needs telemetry explicitly disabled and the disablement verified at the boundary — flags change between versions.
License-manager phone-homes. Commercial components (drivers, schedulers, monitoring suites) may validate licenses against vendor servers and degrade or fail closed when they can't. Every commercial dependency needs an offline-licensing answer before procurement.
Container-build leaks. Images built inside the enclave that reach for public registries, or base images with embedded update agents. Build on staging, transfer finished, signed images.
Monitoring backchannels. The observability stack itself — agents shipping metrics to SaaS endpoints — is a classic accidental egress. Observability must be self-hosted inside the boundary.
The update problem. Open-weight releases now arrive monthly; a deployment with no legal update path decays into obsolescence, and one with an informal path ("someone's USB stick") decays into a security incident. The sneakernet — staging, checksums, approval, transfer log — is a designed process with named owners.

What can an air-gapped model actually do without the internet?

Everything that matters for internal work. Inference, million-token document analysis, retrieval over internal archives, code assistance against internal repositories, and fine-tuning on your own corpus all run offline — LoRA adapters train on the same rack that serves inference. A precision manufacturer's decades of CAD notes, tolerances, and failure analyses become a conversational internal expert that no competitor, vendor, or foreign authority can ever see. What you give up is live web retrieval — which is exactly the point, and which curated, periodically transferred reference corpora replace for most engineering workflows.

How do you get there?

Our air-gapped AI practice delivers this as a standard engagement: enclave architecture, mirrored dependency infrastructure, verified-provenance model transfer, hardened serving with program-level access control, and the update cadence — typically six to twelve weeks from assessment to production. For the defense supply chain specifically, our defense-sector page maps the architecture to CMMC assessment evidence. The one-line summary for your assessor: controlled data never leaves the boundary, because the intelligence came inside instead.