On-premises AI for government agencies: what stays inside and what may leave

For a government agency, the first question about AI is where the data goes. Applicants’ details, internal correspondence, decisions under review: most of it should not leave the agency’s environment, and some of it must not leave the country.

That rules out a lot of AI tools, which send every request to a model run by a foreign company. It does not rule out AI agents. It means designing the work so that what matters stays inside and whatever leaves does so on the agency’s terms.

Three zones: always inside, may leave, never leaves

The clearest way to think about it is to sort everything into three zones.

Always inside. The working core of the agency: the queue of cases, the steps of each procedure, the records of what was done and with what evidence, the handovers between officials, and the decision log. This part must work every day, including when the internet connection is down. AI makes it faster; it must not make it fragile.

May leave, with conditions. A small number of hard text tasks — summarising a long submission, drafting a complex reply — may sometimes go better with a stronger outside model. They go out only if the agency has allowed it, only after the identifying details are masked, and every such call is on record.

Never leaves. The real names, contacts and amounts behind a masked request, the checks on money, the decision itself, and the official’s signature.

What runs inside the agency

On the agency’s own servers, a full working setup looks like this:

• The platform itself — desks for each role, the procedures as steps, the records, the decision log. Installed in the agency’s environment from the same code as everywhere else, with the agency’s data and administration fully separate from any other customer.
• Local models — open models running on the agency’s hardware. They do the routine work: reading incoming requests, finding the applicant and the file, matching documents against registers, drafting standard replies.
• Every check on money — budget lines, amounts, limits. These run inside with the real figures, never on masked data and never outside.
• Connections to the agency’s systems — registers, document storage, email — through the agency’s own network.

None of this needs an outside service to keep going. If the internet is switched off, cases still arrive, agents still prepare them, officials still decide and everything is still recorded.

How an outside model is used, when it is allowed

Suppose the agency has allowed an outside model for one kind of task: drafting replies to long, complicated complaints. Here is what happens on a fictional case at the Department of Trade Services:

1. A complaint arrives. A local model reads it, finds the applicant’s file and the rules that apply.
2. The drafting task is judged too hard for the local model. Before anything leaves, the text is masked: the applicant’s name becomes “Person A”, the phone number is hidden, the amount becomes “Amount X”.
3. The outside model drafts a reply about “Person A” and “Amount X”. It never sees who the person is or how much is at stake.
4. Back inside, the real name and amount are put back. Any check on the amount runs inside, on the real figure.
5. The official reads the draft, with the rule and the sources attached, edits it if needed and approves it. The reply goes out under the official’s name.
6. The outside call, the masking and the approval are all on record.

The agency can switch the outside model off completely at any time. Then nothing crosses the border, and the work continues on local models alone. You can watch this exact path, with the switch, on our trust page.

Who is accountable

Keeping data inside is half of the question. The other half is who answers for the result.

The answer has to be simple: officials. Agents prepare cases, check documents against registers and draft replies. A person decides. Every decision is recorded with who made it, when, on what grounds, from which sources and under which version of the rule. That record serves internal audit, the handover of a case between officials, and the improvement of the agents themselves.

Agents also work within set permissions. Each agent has a named owner, starts with narrow rights, and earns wider ones only from a record of approved work. Anything that leaves the agency — a reply to an applicant, a letter to another agency — is approved by a person first. We describe this ladder in detail in how an AI agent earns permissions.

How this fits the UAE’s public direction on AI

The UAE has set out its ambitions for AI in public documents, and an agency choosing an AI setup will be asked how it fits them. Three are worth knowing:

• The UAE Strategy for Artificial Intelligence names boosting government performance at all levels among its aims, and providing services through AI among its themes.
• The UAE Charter for the Development and Use of Artificial Intelligence lists twelve principles. Among them are data privacy and human oversight, with the charter stressing the value of human judgement over AI.
• In Dubai, the Dubai Universal Blueprint for Artificial Intelligence, launched in April 2024, included appointing a Chief AI Officer in every government entity, and in June 2024 22 Chief AI Officers were appointed across Dubai government entities.

An on-premises setup with local models, masking at the border, people as the deciders and a full decision log is a practical way to put those principles to work inside one agency. SORP is an independent company; we refer to these public documents and do not claim any government endorsement.

Questions to settle before the first pilot

Before any agent works inside an agency, a few things should be decided on paper:

• Where exactly will it run? Which servers, in which data centre, administered by whom.
• Which local models, on what hardware? The routine work depends on them, so they must fit the agency’s own capacity.
• Is an outside model allowed at all? If yes, for which tasks, and who approved that.
• What is masked? At minimum names, contacts and amounts; often reference numbers and addresses too.
• Who owns each agent? A named official for every one.
• What is the first area? One flow — customer requests, the Director General’s instructions, a procurement step — not the whole agency at once.

The last point matters most. A pilot inside the agency’s own environment, on one flow, with the agency’s own officials deciding, shows more than any presentation. It is also the honest basis for a tender later.

On the government page you can see five flows an agency usually starts with and try the Director General’s office desk on fictional cases. If you lead the change in your entity, the Chief AI Officer kit drafts a briefing note for your first area and lists what the procurement pack holds.