The air-gapped route is the lighter one.
Germany's rulebook for companies that handle VS-NUR FÜR DEN DIENSTGEBRAUCH allows two ways to run IT, and the isolated one carries fewer duties. Kernwall OS is built for that route: no uplink, radios left dead, updates only on signed media, and your own staff at the console.
VS-NfD-Merkblatt
Two permitted setups. One skips IT-Grundschutz.
The Merkblatt is the annex a company signs before it may receive VS-NfD material. Part 3 names the two ways its IT may run.
Technically isolated, “air-gapped”
A single PC, or a closed network of them. For the single PC, applying the BSI's IT-Grundschutz “ist hier nicht erforderlich”. This is the route the appliance is built for.
Connected to a less secure network
IT-Grundschutz basic and standard requirements become mandatory. Malware scanning may not run outside the VS-NfD network, “beispielsweise in der Cloud”, and telemetry must be rechecked after every update.
No AI product holds a BSI approval today, Kernwall OS included. The Merkblatt doesn't ask the appliance for one: your VS-NfD officer releases the system before first use, and confirms it in writing at least every three years.
Why now
The money and the procurement law moved in 2026.
Germany rewrote how the Bundeswehr buys, and the budget behind it is still rising.
- 14 Feb 2026Bundeswehr procurement acceleration law takes effect, to 2035.
- Nov 2026Final vote on the 2027 defense budget.
- 1 Jan 2027New US security-system buys must meet CNSA 2.0.
- 1 Sep 2028Next three-yearly supplier confirmation under the Merkblatt.
VS-NfD-Merkblatt · Part 3
What your VS-NfD officer will check, clause by clause.
Each row names the duty for the air-gapped variant, the control designed for it, who owns it, and the evidence it leaves for your release.
- §2 · Air-gapped variant
The system runs technically isolated from every other network.
“…technisch isoliert („air-gapped“) betrieben…”
Kernwall OS builds itNo uplink, no telemetry and no remote-access service. Models, documents and the audit chain all stay on the box.
Evidence you take awayEgress audit report; listening-services manifest per release (planned)
- §2.1.1 · Wireless
Wireless interfaces may not be used.
“…Die Nutzung drahtloser Schnittstellen ist nicht gestattet…”
Kernwall OS builds itWireless drivers are left out of the image, so a radio on the board stays dead. Where the hardware allows, the modules come out before shipping.
Evidence you take awayKernel module list per release; hardware bill of materials
- §2.1.1 · Wired interfaces
Wired interfaces that are not released are disabled.
“…Deaktivierung nicht freigegebener drahtgebundener Schnittstelle…”
SharedUSB accepts signed bundles only, and every listening port is named in the release manifest. Your officer decides which ports are released.
Evidence you take awayInterface configuration record; listening-services manifest (planned)
- §2.1.1 · Patching
Patch and change management prevents any unnoticed outflow of VS-NfD.
“…ein unbemerkter Abfluss von VS-NfD zu verhindern ist…”
Kernwall OS builds itUpdates arrive as signed offline bundles. The update path has no return channel, so nothing is written back out.
Evidence you take awaySignature verification transcript; release ledger
- §2.1.1 · Media transfer
Media between an open PC and the isolated system carry data only encrypted, with a BSI-approved product.
“…ausschließlich in verschlüsselter Form…”
Your site owns itYour BSI-approved encryption product carries the bundle across. Our signature proves the bundle is intact; it is not the encryption this clause asks for.
Evidence you take awayBundle digests to check after decryption
- §2.1.2 · Per-contract data
Data from different VS-NfD contracts sits in separate project folders, opened to each user explicitly.
SharedOne document index per contract, each with its own access list. A query searches only the indexes its user is cleared for.
Evidence you take awayIndex and access listing per contract, in the audit chain
- §2.1.2 · Physical security
Central components are locked in a server room, a cage or a lockable rack.
“…abschließbare Serverracks…”
Your site owns itYour room and your rack. The disk encryption is not BSI-approved, and the Merkblatt has such systems switched off and locked away after work, so a box that runs around the clock belongs in the rack.
Evidence you take awayYour room and key records
- §3.1 · Release, §5 · Confirmation
Your VS-NfD officer releases the system before first use and confirms it in writing at least every three years.
“…vor der ersten Nutzung durch die VS-NfD-verantwortliche Person freigegeben…”
Your site owns itYour officer releases it. We supply the evidence: threat model, SBOM and AI-BOM, egress audit and the configuration record.
Evidence you take awayEvidence pack per release, for your written confirmation
- §3.3, §3.6 · Repair
Before hardware leaves for repair, disks holding plaintext VS-NfD are wiped with an approved product, or removed and kept.
SharedDrives stay with you. A unit goes back without its disks, and the replacement is provisioned from the signed image.
Evidence you take awayRe-provisioning record; repair policy (planned)
- §3.7 · Administration
IT administration is done by your own staff.
“…durch eigenes Personal auszuführen…”
Your site owns itThere is no remote access to grant. We install and train on site; your administrators run it from then on.
Evidence you take awayAdministrator accounts and their actions, in the audit chain
VS-NfD-Merkblatt duties for the air-gapped variant, mapped to appliance controls and their owner.
Administration, the room, the media encryption and the release are yours under the Merkblatt. We install and train on site, hold no remote access, and a unit sent for repair leaves its drives with you. Passing VS-NfD material to us, for support or anything else, needs the originator's documented consent.
Buying and licences
Three checks before the first order.
The procurement law, the model's licence and the US rules, for suppliers who sell both ways. The window runs the job itself.
- BwBBG §11 · §7
A tender may be closed to non-EU bidders.
Authorities may limit a tender to bidders based in the EU and bar non-EU subcontractors, and §7 has them look first at products already on the market. It is a may, not a must.
- Llama 4 AUP §3.1
“Military, warfare, nuclear industries or applications, espionage”
Meta's waiver names the German government, but its private suppliers only in the US and Five Eyes. Get Meta's written say-so, or pick a model without the clause. It binds fine-tunes too.
- DFARS 252.204-7012 · NIST SP 800-171
Also supplying the US?
CMMC Phase II has been suspended since 13 Jul 2026, but DFARS 252.204-7012 and NIST SP 800-171 Rev 2 still bind. The same box keeps that data on site too.
Analysts compare bids against the requirement inside the enclave, and the model, the documents and the audit trail stay there. The model catalog, set to EU defense, traces each licence through its fine-tunes.
Test it
Bring your VS-NfD officer to a pilot.
Tell us which variant you run and what your officer checks before release. The pilot runs on your hardware, inside your wall, against that list.