On-premise and air-gapped AI for aviation and defence

An on-premise AI assistant runs inside the organisation's own infrastructure, so the documents it reads, the questions staff ask and the answers it gives never leave the network. An air-gapped deployment goes one step further and runs with no connection to the internet at all, which means the language model itself has to run locally. For aviation organisations the choice stopped being a preference when Part-IS arrived: Regulation (EU) 2022/1645 has applied to design and production organisations since 16 October 2025, and Regulation (EU) 2023/203 applies to maintenance organisations, CAMOs, operators, training and ATM organisations from 22 February 2026. Both require an information security management system that identifies every system and data element the organisation depends on, every interface with another organisation, and every risk with a potential impact on aviation safety. An AI tool that sends the exposition or the type design to a third party is an interface to be assessed, and the assessment is easier when there is no interface.

Four ways to deploy an AI assistant

The first two rows are what most general AI products offer, including those sold as "private". The last two are what a Part-IS risk assessment tends to lead to once design data, customer maintenance data or operational records are in scope.

What Part-IS actually asks of you

Point IS.I.OR.200 requires the organisation to set up an information security management system with an information security policy, a risk assessment, risk treatment measures, internal and external reporting schemes, incident detection and response, controls on contracted activities, personnel requirements, record-keeping, compliance monitoring, and protection of the confidentiality of information received from other organisations according to its sensitivity. Point IS.D.OR.200 places the same obligations on design and production organisations.

Point IS.I.OR.205 is the one that decides the deployment question. The organisation must identify all elements that could be exposed to information security risks, including its activities, facilities, resources and services, and the equipment, systems, data and information that contribute to them. It must identify the interfaces with other organisations that could result in mutual exposure. For each risk with a potential impact on aviation safety it must assign a level according to a predefined classification that takes into account the potential of occurrence of the threat scenario and the severity of its safety consequences. The assessment must be reviewed whenever the elements, the interfaces, the knowledge used to assess them, or the lessons from incidents change.

Point IS.I.OR.210 then requires measures that control the circumstances that contribute to the threat scenario, reduce the safety consequences or avoid the risk, and those measures must not introduce any new unacceptable risk. Point IS.I.OR.235 covers contracting: when any part of the ISMS activities is contracted out, the contracted activities must comply with the regulation, the contracted organisation must work under the organisation's oversight, and the competent authority must be able to access the contracted organisation on request. Point IS.I.OR.250 requires all of this to be described in an information security management manual that the authority approves.

Where an AI assistant lands in that assessment

None of this makes on-premise deployment mandatory. Part-IS asks for an assessment and for measures that match the assessed risk. It does mean that the assessment has to be written, that the AI vendor appears in it by name, and that "the vendor says it is secure" is not a risk treatment measure.

What air-gapped really requires

An air-gapped deployment is not an on-premise deployment with the internet switched off. Four things have to be true, and they are worth checking before a vendor's claim is accepted.

• The model runs locally. If any part of answering a question calls an external model, the deployment is not air-gapped, whatever the contract says about data retention. A local model runs on the organisation's own hardware, and the hardware has to be sized for it.
• Nothing phones home. No licence check, no telemetry, no error reporting, no update check during operation. The deployment must work indefinitely with no route to the outside.
• Updates arrive as packages. Software, model and regulatory corpus updates are delivered as signed packages and installed by the organisation's own administrators under its change procedure. The regulatory corpus, for example a new revision of the Easy Access Rules, enters through the same controlled ingestion step as everything else.
• Logs and backups stay inside. Every question asked and every answer given is itself information about the organisation. The audit log and the backups belong in the same network, under the same record-keeping controls as the documents.

There is a trade-off, and it should be stated plainly. A local model is smaller than the largest cloud models. For open-ended writing the difference shows. For compliance work it matters less than people expect, because the assistant's answers are bounded by the documents in the corpus and shown with their citations, so the reader is checking a paragraph reference rather than trusting prose. The RDB-1 Regulated Document Benchmark measured this on a technical report from a completed regulatory assessment: the best local model on Wingman360 Teammate scored 74 out of 100, level with the best cloud model on the same harness and above a frontier model on a general agent tool. The same maintenance data requirements apply either way: point 145.A.45(g) makes the organisation responsible for keeping the data current, and point 145.A.45(e) requires electronic work card databases to be protected against unauthorised alteration and backed up within 24 hours. Whatever sits next to those records has to meet that bar.

Seven questions for any vendor

1. Where, physically and organisationally, are the documents, the index, the model, the logs and the backups?
2. Can the system operate with no internet connection, and for how long?
3. What leaves the network during normal operation, and what leaves during an update?
4. Who can change what the assistant knows, and is that separated from everyday use?
5. How are software and model updates delivered, signed and verified?
6. Can our ISMS auditor and our competent authority inspect the running system, as point IS.I.OR.235(b) may require?
7. If we stop using it, can we export everything, and what is deleted where?

Our own answers to the seven questions, for Wingman360 Teammate as deployed, are on the trust page.

The conditions for trusting the answers themselves are the four in Can AI be trusted for aviation compliance documentation?, and the way to introduce an assistant into a maintenance or CAMO organisation is in the Part 145 and CAMO guide. Deployment is the third leg: the answers can be right and the process can be sound, and the tool can still fail the risk assessment because of where it runs.

How Wingman360 Teammate is deployed

Every Wingman360 Teammate deployment is a dedicated single-tenant instance, either in the organisation's own cloud account or on its own premises. There is no shared platform and no data pooled across customers. With the local model option the model runs inside the organisation's network, so no model call, no document and no question leaves it, and the deployment can run air-gapped. Administrators control what enters the knowledge base through a privileged ingestion step; everyone else has read-only access and receives cited answers. Updates are delivered as packages for the organisation's administrators to install. Security in this model comes from isolation and from the organisation's own controls, which is also why it fits inside an ISMS rather than beside it.