What is the air-gap test, and can your AI pass it?

The air-gap test is simple: physically unplug the network and see whether the system still works. An AI passes only if it keeps reasoning, retrieving from its own data and sealing its own audit record with no link to the internet or any external service. Most systems sold as air-gapped fail, because they still reach a remote endpoint for the model, a licence check or telemetry. Mickai passes, because it was engineered to run offline on operator-owned hardware, with its audit record sealed locally rather than in the cloud.

The phrase air-gap has been stretched until it means very little. Vendors apply it to systems that sit inside a private network but still call home. In 2026 that gap between the label and the behaviour is where regulated buyers get burned. When a bank, a hospital or a defence supplier asks whether an AI is air-gapped, they are really asking a harder question: if the wire is cut, does anything break, and can we prove that nothing left the building.

What is the air-gap test, exactly?

An air gap is a physical separation between a trusted system and any untrusted network. The test turns that definition into an experiment. Disconnect every network interface. Then run the full workload: a query, a document retrieval, a model inference, a signed log entry. If each step completes, the system is genuinely air-gapped. If any step stalls, times out or silently degrades, it was depending on a connection it claimed not to need. The test is binary and cheap. That is what makes it useful.

Why do so many air-gapped systems fail it?

Because most modern AI is built to be connected. The weights live in someone else's data centre. Retrieval hits a hosted vector service. Authentication verifies a token against a remote server. Even the licence phones home. A system can run inside a locked room and still fail, because unplugging it removes the very services it was quietly leaning on. Public cloud AI such as ChatGPT, Claude and Gemini cannot pass at all: their models are the network. The failure is architectural, not a configuration slip, and no firewall rule fixes it.

What can an auditor actually check?

An auditor does not need to trust marketing. They can watch the test happen. Practical checks include:

• Pull the cable, then complete a real task end to end and time it.
• Inspect outbound network logs for any attempted connection during the run.
• Confirm the model weights, the index and the licence sit on local storage.
• Verify each action wrote a tamper-evident entry to a local audit ledger.
• Check that the ledger validates offline, with no external certificate authority in the loop.

A system that survives all five is doing the work locally. One that fails any of them has a dependency it has not disclosed.

Which rules make this necessary?

Data residency and control law now reach into architecture. The US CLOUD Act lets US authorities compel data held by US providers wherever it sits, which is why a hosted model is a jurisdictional exposure for UK and European operators. DORA, in force since January 2025, holds financial entities responsible for the resilience of their information systems and third parties. NIS2 extends security duties across essential and important entities. GDPR governs where personal data may go, and ISO/IEC 42001 asks for a governed AI management system. On the EU AI Act, the high-risk Annex III obligations once due on 2 August 2026 were deferred by the Digital Omnibus to 2 December 2027, with embedded Annex I high-risk moving to 2 August 2028 and the Article 50 transparency duties largely unchanged. We read that as a build window, not a reprieve. Air-gap capability is a foundational control for meeting the strictest reading of all of them.

How does Mickai stay verifiable offline?

Mickai is a Sovereign Intelligence Operating System, a SIOS, engineered to keep its guarantees when the wire is cut. The design rests on a few concrete mechanisms:

• A zero-egress inbound perimeter: data can come in under control, and nothing leaves.
• Hardware-attested identity, so every action is bound to a specific machine and operator, not a remote account.
• A post-quantum signed audit ledger, where every action is sealed with FIPS 204 (ML-DSA) signatures, backed by FIPS 205 (SLH-DSA), so the record stays verifiable for decades and cannot be forged.
• Cross-model consensus, where several sovereign models check each other locally rather than deferring to one hosted oracle.

Because the identity, the ledger and the models all live on the operator's hardware, the proof of what happened does not depend on any network being present. These mechanisms sit within a body of 104 filed UK patent applications and approximately 2,340 claims, owned by Mickai LTD, all filed and patent pending. That is the difference between offline and air-gapped.

“A system that needs the network to function was never air-gapped; it was merely offline until its next connection.”

Can an air-gapped system still stay current?

Yes, and this is where the loose use of air-gap causes confusion. Staying disconnected does not mean going stale. Updates to sovereign models, indexes and policy arrive as signed packages that an operator reviews and installs on their own schedule, through a controlled inbound channel, never an always-on link. The system verifies each package's signature before applying it. Currency becomes a deliberate act by the operator, not a background process reaching out on its own. That inversion is the whole point: the operator decides what enters, and nothing decides on its behalf.

Frequently asked questions

What does air-gapped mean for AI?

Air-gapped means the AI runs with no physical or logical connection to any external network, including the internet. For AI specifically, it means the model weights, retrieval index, identity and audit trail all sit on local, operator-owned hardware. If any of those live elsewhere, the system is connected, not air-gapped.

Can ChatGPT or Claude run air-gapped?

No. Public cloud services such as ChatGPT, Claude and Gemini run their models in remote data centres, so the network is not optional, it is the product. They can be reached through a private connection, but they cannot pass the air-gap test, because unplugging the network removes the model itself.

How do you test whether a vendor's AI is really air-gapped?

Ask to run the workload with every network cable physically removed, then time a real task from query to signed result. Watch the outbound logs for any connection attempt during the run. If the task completes with zero egress and writes a locally verifiable audit entry, the claim holds. If anything stalls, it does not.

Is offline the same as air-gapped?

No. Offline usually means temporarily disconnected, with full function expected to return once a connection is restored. Air-gapped means the system is designed to deliver its full guarantees with no connection at all. A truly air-gapped system treats reconnection as optional, not as a dependency.

Does air-gapping mean the AI is out of date?

Not if updates are handled correctly. Sovereign models and indexes can be refreshed through signed packages that the operator reviews and installs deliberately, through a controlled inbound channel. The system verifies each signature before applying it, so it stays current without ever holding an always-on link to the outside.