Why Air-Gapped POCs Take 3x Longer to Budget

A hosted AI proof of concept in a ministry can be stood up in a fortnight if someone is willing to put non-production data into a vendor tenant. An air-gapped POC that uses a government rack, a deny-outbound VLAN, hashed media and an officer who will actually log in usually is not a fortnight. Teams that have done both often plan the second as about three times the calendar of the first. That 3x is a planning heuristic from repeated files. It is not a laboratory result, not a GeM dashboard metric, and not a promise that your district will finish in week twelve.

Procurement still writes the hosted number into the air-gapped indent. Finance then treats any extra month as slippage. The secretary treats slippage as incompetence. The vendor treats the extra month as unpaid professional services. Everyone is angry at a number that was never a real estimate.

This article walks the weeks that hosted POCs skip. Use it to write a longer, duller timeline into the note before the first steering committee. If your institution already has a staffed SDC cage, a media desk and spare GPUs, your multiplier will be smaller. If you have none of those, it will be larger. The heuristic is a warning, not a benchmark you should print as science.

What the hosted fortnight actually skipped

It skipped hardware that you do not already own. A GPU node, or even a clean CPU box with enough RAM, is not a credit-card SKU on a government file. It is a specification, a GeM or OEM path, an inspection, and a rack slot. Even a borrowed card from a university lab needs a movement order and an NIC lead who will accept it.

It skipped identity. Hosted POCs use vendor logins. A government POC that officers will trust uses their existing accounts or a time-boxed AD group. Creating that group, and removing it later, is a ticket with a wait. It skipped the air-gap itself. A deny-outbound VLAN, a dirty/clean media bench, a scanner host, and a change window are people. Those people already have a change advisory board calendar. Your POC is not at the top of it. It skipped data permissions. An air-gapped POC that wants real circulars, let alone a masked extract of tickets, needs an owner to say yes. That yes is a note, not a Slack.

The 3x heuristic is these streams in series, not a slower installer.

Workstream	Hosted POC (typical skip)	Air-gapped POC (what you should plan)	Why it stretches
Hardware	Vendor cloud GPU	Indent, cage, power, maybe GeM	Lead times and inspection, not installation hours
Network	Default HTTPS out	VLAN, deny rule, DNS, time	CAB slots and fear of breaking something else
Media / images	Helm pull	Manifest, scan, hash, load	Two-person protocol and courier
Identity	Vendor users	AD / NIC accounts, joiner-leaver	Another team's backlog
Data	Enthusiast dump	Owner permission, masking	Legal and application-owner fear
Eval / success	Demo wow	Written score on agreed tickets	Nobody scheduled the scoring week
Exit of the POC	Ignore the tenant	Delete, certificate, reclaim rack	Always under-asked

How to use 3x without lying

Write it as a range. If a comparable hosted demo took four weeks of elapsed time, plan ten to fourteen for air-gapped, and say which streams are on the critical path. If hardware is already in the cage and the VLAN exists, you may be near 1.5x. If GPU procurement has not started, hardware alone can exceed the hosted POC's entire life.

Do not average other departments' press notes. A 100-day AI mission that used a public API is not your comparator. Find a file that actually isolated a VLAN. Those files are quieter and more useful. Budget people, not only rupees. The hidden cost is the NIC lead, the CISO reviewer, the application owner and the officer who must score drafts. If those four people can give you one morning a week, your calendar is arithmetic. If they can give you a meeting in week six, your calendar is fiction.

Separate POC success from production readiness. An air-gapped POC can succeed as a scored eval on circulars. It should not be asked to finish CERT-In logging design, DPDP role maps and a GeM catalogue in the same window. Those belong to the programme that follows. Stuffing them into the POC is how 3x becomes 6x.

What to tell finance when they want the hosted number

Tell them the hosted number buys a different object. It buys a URL. The air-gapped number buys a temporary government system: metal, a VLAN, a media path, and a deletion plan. Those are not overhead on the same SKU. They are the SKU. Show the workstream table with owners and start dates. Finance can argue with a padded month. They cannot honestly argue with a CAB calendar they already approved for other work.

If political time is truly immovable, shrink the POC, do not shrink the hygiene. Score ten circulars on a borrowed isolated laptop with hashed weights, then stop. A tiny clean POC beats a large dirty one that finishes on time and cannot be shown to audit.

• Never put 3x in a press note as if it were measured science.
• Always attach the workstream table to the indent.
• Always name the four people whose mornings you need.
• Always write what will not be finished in the POC.
• Always budget the last week for teardown, not for another feature.

Objections you will hear — and what to do with them

These are the lines that stall the file. Answer them in the room, then put the answer in the note. A spoken answer without paper will be forgotten by the next officer.

Vendors will pad if we admit 3x.

Vendors pad anyway. A written workstream table lets you reject padding that is not hardware, CAB, media or scoring. Silence is how they pad everything.

We will do hygiene after the POC succeeds.

Then you are running a hosted POC on a government floor. Call it that. Do not call it air-gapped in the minutes. The later hygiene will be a second project with a second political cost.

Assembly / the visitor / the day is fixed.

Shrink scope. Do not skip hashes, deny rules or teardown. A short clean demonstration on circulars is allowed. A rushed dirty one becomes the production path by inertia.

Write the calendar before you write the tweet

1. Day 0: take the hosted comparator, if any, and refuse to reuse its date.
2. Day 1: fill the workstream table with names and the next real CAB / GeM / movement-order dates.
3. Day 2: apply 3x only as a check — if your sum is far below, you forgot a stream; if far above, you stuffed production into the POC.
4. Day 3: write what the POC will not decide.
5. Day 4: get the four people to put mornings on a calendar.
6. Day 5: file the timeline as a heuristic plan, not as a KPI.

How this shows up in the file

The note should say: this is an air-gapped POC; the 3x figure is a planning heuristic, not a measured study; the critical path is hardware / VLAN / permission / scoring; success is a scored eval, not a press note; teardown is in scope. If finance initials only the rupee line and not the calendar, you will be back in their room in week seven. Get both initials.

A worked calendar you can steal — and then rewrite

Suppose a hosted demo took four elapsed weeks. An air-gapped analogue that has to borrow a blade, open a VLAN, and get permission for twenty redacted tickets looks more like this. Weeks 1–2: movement order and cage. Week 3: CAB for the VLAN. Weeks 4–5: media protocol and first hashed load. Week 6: identity group. Week 7: officers score. Week 8: write-up and teardown. That is roughly 2x if everything hits, and closer to 3x if CAB or hardware slips once. It is a story problem, not a regression.

A skeleton, not a SLA. Rewrite the dates; keep the owners.

Week	Hosted skip	Air-gapped ask	Owner
0	Credit card	Indent / borrow letter	Procurement + SDC
1–2	Tenant ready	Metal in cage	SDC
3	HTTPS works	Deny-outbound VLAN	Network + CAB
4	Helm pull	Hashed media load	Vendor + media desk
5	Vendor users	Officer accounts	Identity
6	Enthusiast PDFs	Permissioned corpus	Application owner
7	Wow demo	Scored eval	Programme owner
8	Leave tenant	Teardown + certificate	DPO + SDC

What not to stuff into the POC

Do not stuff GeM onboarding, Make in India workings, a statewide rollout design, and a DPDP notice redesign into the same eight weeks. Those are programme objects. The POC answers one question: can this workflow draft acceptably on our metal, isolated, for these officers?

This article is informational field guidance for Indian public institutions, not legal, procurement or engineering advice. Confirm against the current Gazette, GFR, GeM portal terms, OEM quotations and your counsel before you file it.