Short answer: YC's "AI for the Air-Gapped Economy" asks founders to bring frontier AI inside the networks of defence contractors, banks, hospitals and nuclear plants, through on-prem models, deployment tooling, security accreditation and hardware. A model inside the wall is necessary. It is not sufficient. In Colrows' benchmark, raw text-to-SQL answered 14.5% of real enterprise questions correctly, and the same queries reached 98.2% once compiled through a governed context layer. The layer that holds your business context, your access rules and your audit trail decides whether air-gapped AI is usable.
In late October 2026, Y Combinator published its Winter 2027 Requests for Startups. One entry, written by partner Brad Flora, names a market most AI companies have avoided: the data that never leaves the building. YC calls it AI for the Air-Gapped Economy.
What a model inside the wall still needs
| What you need inside the wall | A model dropped into the network | Model plus the Colrows semantic execution layer |
|---|---|---|
| Accuracy on your own databases | 14.5% execution accuracy for raw text-to-SQL | 98.2% on the same queries, compiled through Colrows |
| Who sees what | The model reads whatever its database credentials allow | Clearance rules compiled into every query, so a forbidden row is never returned |
| Proof behind an answer | A fluent reply with no trail | The question, the rules applied and the data used, replayable later |
| Data movement | Data copied into a vector store or a new platform | Data queried where it already sits |
| Upkeep with no internet | Manual prompt and schema fixes after every change | The context layer updates itself as systems change |
Accuracy figures are from Colrows' first-party benchmark, where the same queries ran both ways.
What YC asked for
The full entry is about 120 words. These are the lines that matter for anyone selling into regulated buyers:
"The most valuable data in the world isn't in the cloud. Defense contractors, banks, hospitals, and nuclear plants keep it behind walls, and they can't send it to an AI API. That's why so much of the economy is still waiting on AI."
"We want to fund the companies that bring frontier AI inside those walls. That means on-prem models, deployment tooling, security accreditation, and hardware. It's slower and harder to sell. It's also where the largest budgets and the most defensible companies are."
Source: Y Combinator, Requests for Startups, Winter 2027.
Read it alongside its neighbour on the same page. In "Own Your Intelligence", partner Jon Xu writes that renting models is costly "in regulated industries, where strict data governance and locked-down infrastructure make renting even more expensive for the performance they get." Two of eleven Winter 2027 requests point at the same buyer: the regulated enterprise that wants AI on its own terms.
YC also says founders "keep hitting the same wall: the customer loves the product and wants it running entirely inside their own building." The YC directory shows that wall in practice. Ryvn (Fall 2024) builds tooling for on-prem deployments and says on its YC company page that vendors charge 3 to 10 times more for them. BayMachines (Spring 2026) ships air-gapped GPU systems for defence teams.
How big is the air-gapped economy?
Three terms get used interchangeably, and they are not the same:
- On-premise AI runs on infrastructure the organisation owns or controls. That infrastructure may still have an internet connection.
- Sovereign or private AI runs in an environment with defined guarantees on where data lives, who operates it and which laws apply. The guarantees vary by provider.
- Air-gapped AI runs on a network that is physically disconnected. Anything that crosses the gap goes through a controlled, human-approved transfer.
No credible source measures the strictly air-gapped market on its own. The wider market for AI under the buyer's control is easier to size.
- Sovereign cloud is growing fast. Gartner forecasts worldwide sovereign cloud infrastructure spending of $80.4 billion in 2026, up 35.6%, rising to $110.6 billion in 2027. Governments are the main buyers, followed by energy, utilities and telecom. The Middle East and North Africa is the fastest-growing region, at 89%. (Gartner, February 2026)
- Most of it is new demand. Gartner expects about 80% of sovereign cloud spending to come from new solutions or legacy workloads that were never in public cloud. Only about 20% is workloads moving from global to local providers.
- Sovereign AI is a revenue line. Nvidia's CFO told investors in August 2025 that the company was "on track to achieve over $20 billion in Sovereign AI revenue this year, more than double that of last year." (quoted by The Motley Fool)
- The forecast is larger still. McKinsey estimates a sovereign AI market of $500 to $600 billion by 2030, with sovereignty requirements shaping 30 to 40% of AI spending. (McKinsey, March 2026)
These figures measure different things, so do not add them together, and none of them measures the air-gapped market directly. Together they show fast-growing demand for AI that runs under the buyer's own control. The strictly air-gapped buyers YC names sit at the far end of that demand.
Why the data stays behind the wall
Three forces keep it there: bans, breaches and regulation.
Bans. Samsung banned generative AI tools on company devices from 1 May 2023, after staff uploaded source code to ChatGPT. JPMorgan, Bank of America, Citi, Goldman Sachs, Deutsche Bank and Wells Fargo restricted ChatGPT in the same period (TechCrunch). Cisco's 2024 Data Privacy Benchmark found 27% of organisations had banned generative AI at least for a time, while 48% admitted entering non-public company data into those tools (Cisco, January 2024).
Breaches. IBM's 2025 Cost of a Data Breach report puts the average US breach at a record $10.22 million and healthcare, still the costliest industry, at $7.42 million. Shadow AI caused a breach at 1 in 5 organisations and added about $670,000 to the cost. Of the organisations that reported a breach of an AI model or app, 97% lacked proper AI access controls (IBM, July 2025).
Bans do not stop usage. Staff paste data into public tools anyway. The practical choice for a regulated firm is sanctioned AI inside the perimeter, or unsanctioned AI outside it.
Regulation. Certification schedules move. The duty to protect data stays. On 13 July 2026, the US Department of War suspended CMMC Phase II, which was due to start third-party certification on 10 November 2026, and opened a review of the programme. Phase I self-assessments remain in force, and every defence contractor is still contractually bound by DFARS 252.204-7012 to safeguard covered defence information (U.S. Department of War, July 2026). In India, most obligations under the DPDP Rules, including cross-border transfer rules, apply from 12 May 2027 (AZB & Partners). A defence supplier that pastes covered defence information into a public chatbot breaks that contractual duty, whatever happens to the certification timetable.
What breaks when you carry AI inside the wall
Running a capable model locally is now practical. OpenAI's open-weight gpt-oss-120b runs on a single 80 GB GPU at near-parity with o4-mini on core reasoning benchmarks, and launch partners host it on-premises "for data security" (OpenAI, August 2025). Microsoft cleared GPT-4o for Azure Government Top Secret in January 2025 (DefenseScoop), and Google runs Gemini on its air-gapped Distributed Cloud (Google Cloud).
What follows the model inside is harder.
Updates become paperwork
In an air gap, new model weights of 10 to 400 GB cross the boundary on encrypted media or through a one-way data diode, with a security review each time (Tian Pan, "The Air-Gapped LLM Blueprint"). Hosted embedding services, AI-graded evaluations and cloud monitoring all stop working and have to be rebuilt inside the network.
Features arrive late
When AWS launched Bedrock in its Top Secret cloud in January 2025, Knowledge Bases and Agents were listed as "planned for future releases" (AWS). The model inside your network is often a version behind, so you cannot wait for the next release to fix accuracy.
Accuracy collapses on real databases
This is the problem YC's list does not name. The Spider 2.0 benchmark uses real enterprise databases, often with more than 1,000 columns. On it, GPT-4o solved 10.1% of tasks and o1-preview 17.1%. The older, cleaner Spider 1.0 had seen scores of 86.6% (Spider 2.0, arXiv 2411.07763). Agent systems on the current Spider 2.0 leaderboard score far higher, and they get there by wrapping the model in schema knowledge and context.
Defence, banking and hospital systems are some of the oldest and messiest databases in existence. Cryptic column names, coded values and identifiers that differ from system to system are normal. A smaller model running offline, a version behind, on those schemas, will guess. The hosted evaluation and monitoring services that cloud AI relies on are not available either, so any check on its answers has to run locally.
The layer above the model: context
YC names four things: models, deployment tooling, accreditation and hardware. All four get a model running inside the wall. None of them tell the model what your data means. Colrows does not replace the model, the deployment platform or accreditation. It is the layer that makes them useful on your own data.
The evidence says meaning matters as much as the model. On the BIRD benchmark test set, GPT-4 scored 54.89% when given short expert notes explaining the data's codes and terms, and 34.88% without them, a gap of 20 points (BIRD paper, Table 2). Business definitions were worth as much as a whole model generation.
Colrows measured the same effect directly. In our first-party benchmark across 50 proprietary enterprise schemas plus the MIMIC-III and eICU hospital databases, raw text-to-SQL scored 14.5% execution accuracy. The same queries compiled through the Colrows semantic layer scored 98.2%, with 100% join-path accuracy (Colrows Research). Clinical schemas are some of the hardest in that test, and hospitals are one of YC's four named sectors.
Inside an air gap you cannot swap in a better model next week. You can give the model you have the definitions, the joins and the rules it needs. Accuracy follows the context around the model, not the size of the model.
Inside the wall, the threat moves indoors
An air gap stops data leaking to the internet. It does not stop data reaching the wrong person inside the network.
The OWASP Top 10 for LLM Applications 2025 ranks Prompt Injection first and Sensitive Information Disclosure second, with Excessive Agency sixth (OWASP GenAI Security Project). Picture an AI agent with broad database credentials reading an internal document that contains a planted instruction. The air gap holds. The agent still shows a junior analyst a record above their clearance. NIST lists "confabulation", confident false answers, as a named generative AI risk (NIST AI 600-1).
The fix is architectural. An agent should never hold raw database credentials. It should ask its questions through a layer that applies the user's own entitlements before any query runs, and that keeps a record of every answer.
How Colrows fits the air-gapped economy
Colrows is a semantic execution layer. It sits between your databases and every AI agent, assistant or dashboard, and compiles each question into governed SQL before anything touches your data. For a network with no outside connection, that design matters in five specific ways.
- It runs fully on-premise. Colrows deploys inside your network, with the open-weight LLM of your choice on your own servers. No telemetry, licence checks or update calls leave the network.
- Your data stays where it is. Colrows queries your existing systems in place, across databases, and does not copy them into a new platform or vector store. That leaves fewer copies of controlled data to secure.
- Clearance is checked before the query runs. Role-based, attribute-based, row-level and column-level rules compile into the query itself, so a forbidden row is never returned to the model or the user. Personal data is anonymised before it reaches the model, and injected instructions cannot override access rules.
- Every answer is on record. Each answer carries a join-path proof and an audit trail that can be replayed at a point in time. When an auditor asks how a number was produced, months later, you can show them.
- It keeps itself up to date. Inside a closed network, every manual fix is a change request. Colrows maintains its business context by reading your databases, catalogues and query history, as the example below shows. It also reads scanned documents with OCR, which matters in sectors that still run on paper.
What autonomous upkeep looks like, offline
Take an illustrative case. A bank's loan system renames the field that holds days past due. A second system classifies a loan as non-performing at 90 days overdue, while the first uses its own status code. An analyst asks for the non-performing portfolio by region.
- The change is picked up locally. Colrows reads the schema from the database itself and updates its map. No internet connection and no vendor visit.
- The conflict is flagged. Colrows sees that the two systems define "non-performing" differently. A definition certified by an analyst or data owner ranks above anything the system inferred.
- Ambiguity goes to a person. If no certified definition exists, Colrows asks the data owner to decide. It does not pick one silently.
- The query compiles under the analyst's permissions. The analyst sees only the regions and accounts they are cleared for.
- The answer is reproducible. The definition version, the rules applied and the data used are recorded. If the definition changes next quarter, last quarter's answer can still be replayed exactly as it was given.
You can read the full pipeline on the How Colrows Works page.
What a governed answer looks like in YC's four sectors
| Sector YC names | An illustrative question | What the context layer adds |
|---|---|---|
| Defence contractors | "Which programmes have parts at risk of missing delivery this quarter?" | Joins supply, workshop and contract records under the user's clearance |
| Banks | "Which loan accounts moved into non-performing status this month, and why?" | One governed definition of "non-performing", with a reproducible audit trail |
| Hospitals | "Which wards are running short of critical drugs next week?" | Clinical terms resolved correctly, patient details anonymised before the model |
| Nuclear and energy plants | "Which maintenance tasks are overdue on safety-class equipment?" | Answers traced to the source record, with no data leaving the site |
Colrows already does this work in regulated settings. An Indian asset reconstruction company runs a Colrows NPA-evaluation agent in production under full audit, with Indian banking regulation built in, and cut evaluation cycle time by more than 95%. Colrows deploys through forward deployed engineers, who build the agents with your team inside your environment.
Questions to ask before you buy AI for an air-gapped network
Take these five questions into any vendor meeting.
- What accuracy do you get on our schemas, offline, with the model we can run? Ask for a test on your three ugliest questions. Benchmarks on clean data mean little.
- Where are access rules enforced? Before the query runs, or as a filter on results afterwards? Afterwards means the data was already read.
- Can you reproduce last quarter's answer exactly? If the system cannot replay an answer with the definitions in force at the time, it cannot pass an audit.
- What calls out of the network? Ask for the full list of outbound dependencies: embeddings, telemetry, licence checks, update services. Each one is a hole in the air gap.
- Who maintains the context after go-live? If every schema change needs manual rework, the system will decay.
Our semantic layer evaluation checklist has 40 more questions in the same spirit.
Where the air-gapped economy goes next
The model gap is closing. Stanford's 2025 AI Index found that the gap between open-weight and closed models on some key benchmarks fell from 8% to 1.7% in one year. On-prem model quality will stop being the bottleneck.
Trust will replace it. Postdigitalist argues the startup opening lies in "accreditation and assurance: proving that a model is safe to run offline" (Postdigitalist). For data work, assurance means a buyer can check that the answer is correct, that the user was entitled to see it, and that the system can prove both. That proof comes from a governed context layer.
Our analysis of YC's Company Brain RFS found most entrants solving retrieval and leaving out metric consistency and governance. Inside the wall the stakes are higher: there is no hosted service to fall back on and no cloud vendor to patch the problem overnight. For the wider architecture, start with our guide to the semantic layer for enterprise AI, and see how context decays without upkeep in Stop Semantic Decay.
Frequently asked questions
What is YC's "AI for the Air-Gapped Economy"?
It is one of eleven Y Combinator Requests for Startups for the Winter 2027 batch, published in late October 2026 and written by partner Brad Flora. It asks founders to bring frontier AI inside the networks of defence contractors, banks, hospitals and nuclear plants, through on-prem models, deployment tooling, security accreditation and hardware.
What does air-gapped AI mean?
Air-gapped AI runs on a network with no connection to the internet. The model, its data, its updates and its monitoring all stay inside the organisation's own walls. Model updates cross the boundary by approved transfer, not by download.
Can open-weight LLMs work in an air-gapped network?
Yes. Models such as OpenAI's gpt-oss-120b run on a single 80 GB GPU. The harder problem is accuracy on the organisation's own data. In the original Spider 2.0 study, GPT-4o and o1-preview solved only 10 to 17% of real enterprise database tasks, so models need a context layer that supplies definitions, joins and access rules.
How does a semantic layer help air-gapped AI?
A semantic layer holds the business meaning of your data in one governed place inside the network. It turns a natural-language question into a correct, permission-checked query and records how the answer was produced. In Colrows' first-party benchmark, this raised execution accuracy from 14.5% to 98.2% on the same questions.
Does Colrows run fully on-premise?
Yes. Colrows deploys on-premise inside a closed network, with an open-weight LLM of your choice on your own servers, and queries your data where it already sits.
Sources
Every figure is the cited source's own published claim. Benchmarks are dataset-specific; treat the numbers as evidence of a directional pattern, not universal constants.
- Y Combinator, Requests for Startups (Winter 2027)
- Y Combinator company page: Ryvn
- Gartner: sovereign cloud IaaS spending to total $80 billion in 2026 (Feb 2026)
- McKinsey: Sovereign AI, building ecosystems for strategic resilience and impact (Mar 2026)
- The Motley Fool, Nvidia sovereign AI revenue (Oct 2025)
- Cisco 2024 Data Privacy Benchmark Study (Jan 2024)
- TechCrunch: Samsung bans generative AI tools (May 2023)
- IBM Cost of a Data Breach Report 2025 (Jul 2025)
- U.S. Department of War: CMMC Phase II suspended (Jul 2026)
- AZB & Partners: India DPDP phased rollout (Nov 2025)
- OpenAI: Introducing gpt-oss (Aug 2025)
- DefenseScoop: GPT-4o cleared for Top Secret in Azure (Jan 2025)
- Google Cloud: Gemini on Google Distributed Cloud (Apr 2025)
- AWS: Amazon Bedrock in the AWS Top Secret cloud (Jan 2025)
- Tian Pan: The Air-Gapped LLM Blueprint (May 2026)
- Spider 2.0 benchmark (arXiv 2411.07763)
- BIRD benchmark paper, arXiv 2305.03111 (Table 2)
- Colrows first-party research: 14.5% raw vs 98.2% compiled
- OWASP Top 10 for LLM Applications 2025
- NIST AI 600-1, Generative AI Profile (Jul 2024)
- Stanford AI Index 2025, via AIwire (Apr 2025)
- Postdigitalist: YC Requests for Startups analysis (Oct 2026)
