Defence wants its AI inside its walls
Armies and ministries are buying AI fast. A year of contracts, disputes and closed networks shows why critical work wants a model of its own.
In July 2025 the Pentagon’s Chief Digital and AI Office awarded contracts with a ceiling of 200 million dollars each to Anthropic, Google, OpenAI and xAI, to build agentic workflows across its mission areas. In December it opened GenAI.mil, with Google’s Gemini for Government as the first model, for some three million civilian and military personnel. Google stated that the department’s data on it is never used to train its public models.
Within a year, defence went from experiments to purchasing. The harder question turned out not to be which model is best, but whose rules apply once the model is inside the mission.
A dispute about who decides
Anthropic had refused to let its models be used for mass domestic surveillance or for fully autonomous weapons. The Pentagon wanted use for all lawful purposes. On 27 February 2026 a deadline passed without agreement. President Trump ordered federal agencies to stop using Anthropic’s products, with six months to phase them out, and the defence secretary, Pete Hegseth, wrote that no contractor, supplier or partner doing business with the US military may conduct any commercial activity with Anthropic.
In March the Pentagon formally designated Anthropic a supply chain risk, which requires companies working with it to certify that they do not use Anthropic’s models. TechCrunch noted that such designations are typically reserved for foreign adversaries. The same day the deadline passed, OpenAI announced a deal to run its models on the Pentagon’s classified networks, with safeguards of its own. Axios reported that they would run only in the cloud, not at the edge.
The courts have split. In August a federal judge in California called the designation unlawful retaliation. On 25 September the appeals court in Washington upheld a parallel designation under a different law, by two votes to one. We do not judge the merits here. The lesson for everyone else is plainer: a model that runs in someone else’s building comes with someone else’s terms, and one decision in a capital can reach every supplier at once.
Europe builds inside its own walls
European ministries are choosing a different shape. In January the French armed forces ministry made official a framework agreement with Mistral AI, run by its defence AI agency, AMIAD, to deploy Mistral’s models and solutions on the ministry’s own infrastructure. The ministry said its tool is trained on the armed forces’ own language.
The French Army goes further. In June its deputy chief of staff, General Patrick Justel, presented Arcadia, a battlefield command system built with Mistral AI, Safran.AI, Thales and Airbus, as France’s answer to Palantir’s Maven Smart System, which NATO bought in 2025 in a procurement that took six months. Arcadia is meant to be decentralised: command posts connect to servers deployed in the field, and if links are lost, the remaining parts keep working on their own.
In Germany, BWI, the IT company of the Bundeswehr, has run an AI platform of its own since April 2026, with nine models on 27 GPUs in three data centres, Europäische Sicherheit und Technik reported in September. The reasons given were data protection, independence from foreign cloud providers, and operations in the field without a network.
Switzerland starts with the administration
Switzerland moves more quietly. On 18 September the Federal Council took note of a reprioritised plan for AI in the federal administration. Six of eight measures continue, among them an in house generative AI system for all federal employees. The administration counts 116 AI projects across its departments, and names a writing aid for confidential texts as one example.
On the defence side, the procurement agency armasuisse and the ETH domain launched a research programme for security and defence in October 2025, with AI among its key technologies.
Why the model has to come inside
The reasons repeat across these examples. Classified data cannot travel to a public cloud. Some networks never touch the internet at all. A unit in the field loses its connection exactly when it needs an answer. And a model that its maker can change, restrict or withdraw is a risk for a mission that has to run for years.
The vendors have noticed. In August 2025 Google made Gemini generally available on its air gapped Distributed Cloud, inside customers’ own data centres. The direction is the same everywhere: the model moves to the data, not the other way round.
What does not move is responsibility. NATO’s principles for responsible use begin with lawfulness, responsibility and accountability, and its revised AI strategy calls quality data a prerequisite for secure and reliable systems. A model can sort a thousand reports in an hour. A person still decides which one matters, and signs for what follows.
What it means for suppliers
The same logic reaches the companies that supply defence, aerospace and critical infrastructure. In the US, the contract rule for the Cybersecurity Maturity Model Certification took effect on 10 November 2025. Where a contract requires it, the Pentagon may not award it to a company that does not meet the required level, and prime contractors must ensure the same of their subcontractors. It covers systems that handle controlled information, and phases in over three years.
Switzerland has its own version. The Information Security Act has been in force since 1 January 2024, and companies that take on security sensitive federal contracts go through a facility security procedure. After the data leak at the supplier Xplain, the federal administration drew up further measures aimed at suppliers, including audits and the documented deletion of federal data that suppliers hold.
For an engineering firm, that changes the question about AI. Its drawings, test reports and specifications are part of someone else’s security, and the Anthropic case showed that a supplier’s choice of model can become a contract question overnight. Pasting them into a rented assistant is often not an option at all.
What a company can do
Sort the work first: what may go to a rented model under enterprise terms, what must stay inside, and what must never leave a closed network. Keep the right to switch models without rebuilding everything. Test every new version on your own tasks before it goes live. And name the person who answers for it.
This is the work Eigna was built for. Made by our partner Eigna Labs, it gives a company a private model of its own, trained on its files, rules and language, running in its own cloud or on its own servers, and designed to run fully offline in closed networks. It retrains in steps that go live only when they test better. crue was one of the first companies to test it and uses it for its own work, and Twin, a company’s AI brain, runs on Eigna when the work turns confidential. Eigna is in early access. If the work is critical, the architecture should begin inside the walls.
