Air-Gapped AI Deployment in India: A Practical Guide for Pharma, Manufacturing and Other Regulated Workloads

Most Indian plants, pharma sites and warehouses already hold the data AI needs — SOPs, batch records, maintenance histories, waybills — on file shares nobody can search. What they lack is a safe way to let a language model touch any of it. Air-gapped AI deployment in India closes that gap by running the model, the indexes and the documents on your own servers, with no route to the internet at all.

This guide covers what air-gapped means in practice, which workloads justify it, what the stack looks like, and how to run a 90-day pilot without betting the farm.

What Air-Gapped AI Deployment Means (and What It Doesn't)

An air-gapped AI system runs its models, indexes and data on servers with no inbound or outbound internet connection. There is no API call to a remote provider, no telemetry leaving the rack, and no vendor-side copy of your prompts. Users on the internal network ask questions; retrieval, inference and logging all happen inside your perimeter.

That is the strictest point on a spectrum. Most organisations pick one of three isolation tiers:

Be honest about which tier you actually need. A full air-gap is justified when policy or a customer mandate forbids any external connectivity, or when a leak would be catastrophic. For most pharma, factory and warehouse workloads, an on-premise deployment with tightly controlled egress delivers the same data protection with far less operational pain — and it still counts as private enterprise AI.

The trade-off is real. Air-gapped systems cannot phone home: model updates, security patches and index upgrades arrive on physical media, get validated on a staging machine, and are applied in planned windows. You also give up one-click vendor support. Teams that accept this deliberately are the ones that succeed with it.

Why Regulated Indian Industries Want AI Inside Their Own Walls

The DPDP Act 2023 places security safeguards, purpose limitation and breach accountability squarely on the data fiduciary — your company. The Act does not ban cloud AI, but every prompt containing personal data that leaves your network is a transfer you must be able to secure, justify and explain. Processing onshore, on hardware you control, is the simplest way to demonstrate data sovereignty and keep the compliance story short.

Pharma carries an extra layer. Batch records, SOPs, deviations and training records fall under GxP expectations: data must be attributable, traceable and controlled, with audit trails intact. Sending these to a third-party API creates copies you do not govern and cannot fully delete. Quality teams are right to refuse.

Manufacturers face a different exposure: IP. Process parameters, tooling drawings, trial results and supplier pricing live on plant networks precisely because they are valuable. An assistant that works inside the network protects that boundary; one that calls out does not.

Then there is the fallback many IT teams try first: “anonymise before sending to a cloud API.” It fails in daily operations. De-identifying a batch record or customer complaint is manual, slow and error-prone, and under deadline pressure staff skip it or route around the tool entirely. If the safe path is harder than the unsafe one, the unsafe one wins.

The Core Building Blocks of an Air-Gapped Enterprise AI Stack

Four components do most of the work, and each runs entirely on your infrastructure. Together they form an enterprise knowledge assistant your auditors can live with.

Local LLM deployment

Open-weight models — downloaded once, run by you — are sized to your GPU servers rather than rented by the token. A capable mid-size model handles drafting, summarising and question answering over internal documents. Inference happens on your hardware: zero external API calls, zero prompt logs at a vendor.

RAG on-premise

Retrieval-augmented generation is what makes the model useful on your content. Documents are chunked, embedded and stored in a vector index on your network; at query time the system retrieves relevant passages and the model answers from them. Every query, document and result stays inside your perimeter, and access controls mirror the source systems.

Document intelligence and OCR

Regulated Indian businesses run on paper trails: handwritten logbooks, scanned batch records, waybills, invoices, claim documents. On-premise OCR and layout-aware document intelligence convert these into searchable text the RAG layer can use — without a single scan leaving the building.

A permission-aware assistant with citations

The user-facing layer answers with citations to the exact source — SOP number, clause, page. It respects each user's permissions, so a warehouse executive sees warehouse SOPs and not payroll data. Citations are not decoration; they make the output auditable and give your teams the confidence to act on an answer.

Practical Use Cases Across Pharma, Manufacturing and Logistics

Pharma compliance

Quality teams get cited answers to GxP queries from the current approved SOP, and drafting support for SOP revisions that a human then reviews and approves. The assistant sits alongside your existing SOP management software and document-control process — it does not replace them. Training-record lookups stop being a scramble before inspections.

Factory operations

Maintenance engineers search years of work orders and failure notes in seconds. Shift supervisors generate handover summaries from logs and the previous handover. Quality teams search across deviations and CAPA records to spot repeats. This is knowledge management for factories at its most practical: the answer already exists, and now it is findable.

Logistics and warehousing

OCR turns waybills, proof-of-delivery documents and claim paperwork into structured, searchable records. Warehouse teams get instant SOP lookup on shared terminals — no more calling a supervisor to ask about the exception-handling procedure.

Infrastructure and public bodies

Tenders, contracts and compliance filings — often decades of them — become searchable on a closed network. Officers find the clause they need without circulating sensitive files by email.

Compliance, Audit Trails and the DPDP Act

Map DPDP Act obligations to deployment choices rather than treating compliance as an afterthought:

• Data location: on-premise or air-gapped processing keeps personal data on hardware you control, inside the country, which simplifies security safeguards and any future transfer restrictions.
• Access control: the assistant inherits your directory permissions; users only retrieve what they are already entitled to read.
• Purpose limitation: documents indexed for SOP search are not silently reused elsewhere; the index and its scope are documented.

Audit readiness should be a design property, not a scramble before an inspection. Every AI answer is cited, logged and attributable to a source document: who asked, what was retrieved, which document and version answered, and what the model said. When an answer influenced a decision, you can reconstruct it months later.

For anything that touches official records, keep humans in the loop. The right pattern is workflow automation with approval gates: the AI drafts the SOP revision, deviation summary or claim note; a qualified person reviews and approves; the system records who approved, when, and against which document version. AI drafts, humans decide, the audit trail captures both.

Before sign-off, Indian quality and IT audit teams typically ask: Where does the data physically reside? Who can access the model and the index? Are answers traceable to controlled documents? How are models and software updated and validated? What is the retention and deletion story? Pick a stack that answers these on day one.

Costs, Hardware and Team Readiness: An Honest Assessment

Hardware sizing

A credible pilot fits on a single server. A 24 GB-class GPU runs a 7–8 billion parameter open-weight model in quantised form with headroom for context; the vector index and OCR pipeline run on CPU and RAM alongside it. Larger 30–70 billion parameter models need multi-GPU servers or 48 GB-class cards, and are worth it only when answer quality on your hardest documents demands it. Start small, prove value, then size up.

Total cost of ownership

Cloud APIs charge per token, so costs scale with usage and grow every year as adoption spreads. On-premise deployment is front-loaded — hardware, power, cooling, admin time — and then relatively flat. For high-volume, multi-year workloads such as plant-wide SOP search or OCR of thousands of waybills a month, on-premise AI in India usually wins over two to three years. For sporadic or experimental use, it may not; be honest about your volumes before committing.

Skills your IT team needs

Model operations (loading, monitoring, swapping models), patch discipline for the OS and stack, and standard backup and disaster recovery for the index and logs. None of this is exotic — it is server operations with a new workload — but it must be owned by named people, not assumed.

A decision checklist

• Full air-gap, when: policy or a customer mandate forbids external connectivity; the data is genuinely classified or crown-jewel IP; the site already runs isolated OT networks.
• On-premise with controlled egress, when: you want scheduled, vendor-supported model and security updates; the workload is regulated but not no-egress; your team values operational simplicity.
• Cloud, only when: the content is non-sensitive and low-risk, and speed of experimentation matters more than control.

A 90-Day Pilot Plan to Get Started

1. Weeks 1–2: inventory your documents — where they live, formats, permissions — and pick one high-value workload. SOP search or scanned-record OCR are the usual suspects because the pain is visible and the baseline is measurable.
2. Weeks 3–8: deploy on one server with a pilot user group of ten to twenty people. Measure two things honestly: time saved per task, and answer accuracy as judged by your own subject-matter experts.
3. Weeks 9–12: add workflow automation with human approval gates for the highest-value task, and write your update and rollout policy — how models get refreshed, who owns the system, how access expands.

Shodh runs air-gapped on your own servers: the local LLM, the RAG index, the OCR pipeline and the permission-aware assistant, all inside your network with no external calls. Request Shodh beta access to see private, on-premise AI answer questions from your own documents — pilot with your SOPs, batch records and waybills, and judge the answers yourself.

Frequently Asked Questions

What is air-gapped AI deployment?

It means running AI models, indexes and data on servers that have no inbound or outbound internet connection. Users on the internal network ask questions; retrieval, inference and logging all happen inside your perimeter. Updates arrive on physical media and are applied in planned, validated windows.

Is on-premise AI the same as air-gapped AI?

No. On-premise AI runs on your own hardware but may keep a controlled, whitelisted internet connection for updates and support. Air-gapped AI has no connectivity at all. Most regulated workloads in pharma and manufacturing are well served by on-premise with controlled egress; a full air-gap is reserved for no-egress sites and the most sensitive data.

Does the DPDP Act require companies to keep AI on-premise in India?

No. The DPDP Act 2023 does not mandate a specific deployment model. It requires data fiduciaries to apply reasonable security safeguards, honour purpose limitation, and remain accountable for personal data, including breach reporting. On-premise or air-gapped processing is a practical way to demonstrate that control, especially while the Act's rules are still being operationalised.

What hardware does a local LLM need for an enterprise pilot in India?

A single server with one 24 GB-class GPU can run a 7–8 billion parameter open-weight model in quantised form, with the vector index and OCR pipeline on CPU and RAM alongside it. Larger 30–70 billion parameter models need multi-GPU servers or 48 GB-class cards. Start with one server, prove value on one workload, then size up.

How do you update an air-gapped AI system without internet access?

Updates travel on verified physical media — typically encrypted drives — and are first scanned and validated on a staging machine inside the network. Model refreshes, security patches and index upgrades become scheduled, documented exercises with rollback plans, owned by your IT team, rather than automatic background downloads.