AI in High-Security Environments: Safe Knowledge Transfer
How to run a knowledge transfer when nothing can leave the building: clearances, air gaps, on-premises AI models and six steps.
Running AI in a high-security environment means the AI, the data and the people stay inside a boundary your security officer approves. That is manageable until someone with years of knowledge leaves. Then the knowledge transfer has to happen without any of it crossing the boundary. This post explains what that takes, which deployment options exist and what to ask a vendor.
What counts as a high-security environment
A high-security environment is a workplace where information is classified or restricted by law, contract or policy. Examples are government ministries, defence suppliers, intelligence services and critical infrastructure. Staff usually hold a security clearance. Information is shared on a need-to-know basis. Some networks have no connection to the internet at all.
An air-gapped network goes furthest. The NIST glossary quotes a US national security instruction (CNSSI 4009). It describes an air gap as a boundary where two systems are not physically connected and any logical connection is not automated. Data crosses by hand under human control.
Why knowledge transfer is harder in a secure environment
Knowledge transfer is how what one person knows about a job reaches the next person. Four things change when that person works in a secure workplace.
Public cloud tools are usually off limits. Staff cannot paste notes into a public AI assistant, a cloud document or a transcription service. The usual ways to capture knowledge are not available.
The knowledge is restricted too. What the leaver knows about the work is often as sensitive as the documents. In many regimes a write-up carries the classification of what it describes. Agree the marking before the first session.
The successor arrives late. A new hire without a clearance cannot sit in on sessions about restricted work. Screening takes time.
Fewer people can help. Need-to-know limits who may know about a task. If one person holds a piece of knowledge, no colleague outside that group can rebuild it.
How long does screening take? The Dutch defence ministry's website says the unit that runs a screening has eight weeks and that it can take longer. In January 2023 the UK National Audit Office reported that nearly a third of Developed Vetting clearances in 2022-23 took more than 180 days. In the US the government reported that Secret-level investigations took 44 days and Top Secret-level investigations 57 days in the second quarter of fiscal 2026. That used the old measure of the fastest 90 percent of cases. From the third quarter the government counts all cases and says the result is slower. Compare these times with your notice periods. A successor who already holds a clearance can start sooner.
What the rules say about AI
The EU AI Act does not apply to AI systems used exclusively for military, defence or national security purposes. This is set out in Article 2(3). Whether a project falls inside that exclusion depends on its purpose. Ask your legal team. Other rules still apply, among them data protection law, national security rules and contract terms.
European organisations face a second question: who can be forced to hand over data. Under the US CLOUD Act of 2018 a US-based communications or cloud provider must preserve or disclose the contents of communications and customer records in its possession, custody or control when US authorities send a lawful order. The statute applies whether the data is stored inside or outside the United States. Legal experts have debated how this fits with the GDPR. In June 2025 a Microsoft France director told a French Senate inquiry that he could not guarantee that data on French citizens would never be handed to US authorities, and added that it had never happened before. For restricted material some European organisations choose a host that is not under US jurisdiction.
US organisations work under other rules. FedRAMP gives cloud services that serve US federal agencies one common security baseline. The CMMC rule of the Department of Defense sets security requirements for contractors that handle Controlled Unclassified Information. Its contract clauses took effect on 10 November 2025 and phase in over four years. The next phase starts on 10 November 2026. Export controls matter too. Under the ITAR a release of controlled technical data to a foreign person is a controlled event. Sending or storing such data is not an export only if it is unclassified and protected by end-to-end encryption that meets set conditions. That carve-out does not obviously fit an AI service that has to read the data in clear text. Ask your export compliance officer.
Five ways to run AI in a restricted environment
The options differ in where the AI runs and who can reach the data.
Level | Where the AI runs | Does data leave your premises? | Typical fit |
|---|---|---|---|
1. Public AI service | Provider's cloud, often outside your region | Yes | Not for restricted material |
2. Regional cloud service | Provider's servers in your own region, for example the EU or the US | Yes, to the host | Sensitive but not classified |
3. Private cloud | Servers dedicated to you, run by a provider or by you | Yes, to that environment | Sensitive material with tighter control |
4. On-premises | Your own servers | No | Restricted material |
5. Air-gapped | Your own servers with no network connection | No | Classified material |
These are rules of thumb. Your security officer decides which level fits which material.
The model is a second choice. A vendor model comes through the vendor's service. An open-weight model is a model whose weights are published, so it can run on servers you choose at any level above the first. Licences differ. Some have limited military use, so check that the licence allows yours. A customer's own inference model works the same way. Levels 4 and 5 add work: you run the hardware and you load updates and new models by hand.
Rinto works with open-weight models on EU servers. It also works with a customer's own AI inference models, including open-weight models that run on the customer's own servers. Rinto can run on premises, including in an air-gapped network, when the organisation can host a large enough language model itself. Accreditation stays with your security officer. Model providers do not train on Rinto client content.
Running the AI inside the boundary
In April 2024 the US National Security Agency, CISA and the FBI published "Deploying AI Systems Securely" together with the cyber security agencies of Australia, Canada, New Zealand and the UK. It applies most to organisations that deploy externally developed AI systems on premises or in a private cloud. Five points from it matter for a secure site.
Check where a model comes from. Inspect an imported model in a separate secure zone before it runs in the production environment. Use checksums and digital signatures to confirm that nobody changed it.
Isolate the model. Run it in a hardened container or virtual machine behind firewalls with allow lists. Keep the weights in a restricted zone or a hardware security module with two-person control.
Control access. Limit who can reach the model and its data by role or attribute. Require phishing-resistant multi-factor login. Encrypt weights, outputs and logs at rest.
Log and watch. Record inputs, outputs and errors in storage that cannot be changed. Set alerts for unusual patterns.
Update with tests. Evaluate a new model version for accuracy and security before it goes live. Keep a rollback ready.
How to run the knowledge transfer in six steps
1. Classify first. Ask the security officer three things. What level applies? Who may attend? Where may notes be stored? Do this in the first 72 hours after a resignation.
2. Pick the tool that fits the level. Use the table above. Check whether sessions may be recorded at all, because many secure areas ban phones and recording devices. If no AI tool is approved, a cleared note taker and a pen are a valid start.
3. Start before the successor is cleared. Hold the sessions with the leaver and a cleared colleague or the manager. They can check what the successor will need once cleared.
4. Ask about situations. Use questions about the work, the people and the exceptions. Our 42 knowledge transfer interview questions are a starting point. Most of what matters is tacit knowledge. Questions about concrete situations bring it out better than questions about duties.
5. Keep the write-up inside the boundary. Store it in the approved system. Mark it at the level of its content. Let the leaver read it and correct it. The result is part of the institutional knowledge of the role.
6. Check with the successor. When the successor is cleared and has started, ask what they still could not find. Their answers show what the transfer missed. Our post on a first AI project in HR shows how to measure that.
The Handover Kit has a booking email and a template for the write-up. Adjust both to the rules at your site.
Questions to ask an AI vendor
Put these to every vendor before a pilot.
Where does the AI run: on our hardware, in your cloud or in a third party's cloud? In which country?
Which company could be ordered to hand over our data, and under which law?
Is any of our content used to train models?
Can the system use our own AI inference models or open-weight models on our servers?
Which licence does each model carry and does it allow our use?
Can the system run with no internet connection?
How do updates and new models reach us?
Who can see transcripts and for how long are they kept? Can we delete them?
Do logs contain content?
Does your support staff need clearance to work on our system?
Frequently asked questions
What is a high-security environment?
A high-security environment is a workplace where information is classified or restricted by law, contract or policy. Staff usually hold clearances and share information on a need-to-know basis.
Can you use ChatGPT in a high-security environment?
Not for classified material. Public AI services process data on the provider's servers, and classification rules do not allow that. Check your own policy for restricted or sensitive material.
Can an AI interview tool use our own models?
Some can. Rinto works with a customer's own AI inference models and with open-weight models on the customer's servers. It can also run on premises, including air-gapped, when the organisation can host a large enough language model. Ask any vendor for this in writing before a pilot.
What is air-gapped AI?
Air-gapped AI is an AI system that runs on hardware with no network connection to the outside. Data and updates cross the gap by hand under human control.
Can open-weight models run offline?
Yes. The weights are files. They can be loaded on local hardware with no connection. The weights need about two bytes of memory per parameter at 16-bit precision. A model with 70 billion parameters needs about 140 GB for the weights alone.
Does the EU AI Act apply to AI used for defence?
Article 2(3) excludes AI systems used exclusively for military, defence or national security purposes. A system that also serves a civilian purpose is not excluded. Ask your legal team.
How do you transfer knowledge when the successor is not cleared yet?
Start the sessions with the leaver and a cleared colleague. Store the write-up inside the approved system. Let the successor read it once cleared.
Working under strict rules and want a knowledge transfer that fits them? Tell us what your rules require and we will tell you what Rinto can do today.
Sources
Dutch Ministry of Defence: the security screening (veiligheidsonderzoek)
UK National Audit Office: Investigation into the performance of UK security vetting, January 2023
performance.gov: Personnel Vetting Quarterly Progress Report, fiscal year 2026 Q2
performance.gov: Personnel Vetting Quarterly Progress Report, fiscal year 2026 Q3
The Register: Microsoft admits it cannot guarantee data sovereignty, July 2025
Federal Register: Cybersecurity Maturity Model Certification (CMMC) Program
Cooley: DoD final rule implementing the CMMC contract clause, September 2025
Federal Register: ITAR rule on activities that are not exports, December 2019
NSA, CISA and partners: Deploying AI Systems Securely, April 2024