Air-gapped sovereign AI for a UK central government department

A delivered engagement, not an illustration. The client is not named and operational detail is deliberately omitted. What is published here is the architecture and the assurance pattern, which is the part that transfers to anyone facing the same constraint.

The constraint

The department had a clear set of use cases and an equally clear reason none of them had reached production. The material involved could not be sent to a commercial API, and the network its users sit on has no route to the internet.

That rules out most of the market by construction, and not because the products are poor. It is because they assume connectivity: a licence server to reach, a registry to pull images from, a telemetry endpoint to post to, and a vendor who can push a model update when something needs fixing.

So the brief was never "which AI tool should we buy". It was "build a platform that runs entirely inside the boundary, that our own people can operate, and that will stand up in a GovAssure assessment".

Why on-premise, and why this hardware

On-premise was decided by the network position, not by preference. Once a workload has to run on a segregated network with no egress, cloud data residency stops being the relevant question: there is no route to the region regardless of which country the region is in.

Sizing was driven by concurrency and context length rather than parameter count alone, which is the calculation most procurement exercises get backwards. The memory available per GPU on Blackwell Ultra is what makes it practical to serve large open-weight models at long context without splitting a single model across nodes, and splitting across nodes is where the operational complexity and most of the fragility live.

DGX B300 fitted here specifically because it arrives as a validated system with a defined firmware, driver and software baseline. On an air-gapped network a known-good baseline you can reproduce exactly is worth considerably more than the last few percent of price-performance, because you cannot download your way out of a version mismatch.

Building for no egress

The engineering work in an air-gapped deployment is not the inference. It is the systematic removal of every assumption of connectivity, and there are far more of those than anyone expects at the start.

• Container registry mirrored inside the boundary, with images pinned by digest rather than by tag
• Operating system and language package repositories mirrored and version-pinned
• GPU driver, CUDA and firmware bundles staged as versioned artefacts with a tested rollback
• NVIDIA AI Enterprise entitlement served locally, so licensing never needs a route out
• Model weights imported as hashed artefacts through the approved transfer path
• Vulnerability and CVE feeds imported on a defined cadence, like every other artefact

Hardening, in code

Hosts were built from a DISA STIG baseline and reconciled against CIS Benchmarks Level 2, expressed as code, so the build is reproducible rather than being a machine somebody once configured well.

The container runtime and the Kubernetes layer were hardened against their own STIGs and benchmarks. That layer is the one AI platform deployments routinely skip, and a carefully hardened host running a permissive container runtime is not a hardened system.

Workload isolation used MIG partitioning, so separate consumers get hardware-level separation rather than a scheduler’s assurance that they will not interfere with one another.

A short list of deviations was unavoidable, because some Level 2 controls genuinely conflict with GPU driver and scheduler operation. Each one carries the finding ID, the technical reason and the compensating control. That document is what an assessor actually wants, and it is the one nobody produces.

Assurance built alongside, not afterwards

The department is assessed against the NCSC Cyber Assessment Framework under GovAssure, so the platform was mapped onto the CAF objectives during the build, while the people making the design decisions were still available to explain them.

The NCSC Guidelines for Secure AI System Development were applied the same way, across their four lifecycle stages. That pairing matters: the CAF was not written with model artefacts in mind, and the AI guidelines were. Used together they cover ground that neither covers alone.

Control tracing to NIST SP 800-53 Rev 5 families and the NIST AI Risk Management Framework was done in parallel, largely because it makes assurance conversations with partners outside the UK short rather than long.