01Kernwall OS · The operating system for offline AI
The operating system that installs, accredits and runs open-weight models on hardware you own, with no internet connection.
Pre-release · 2027 pilots
02Inside your walls
Your yield data, drawings and patient records are bound to your site by written rules. So Kernwall OS brings the model inside your walls.
Each documented refusal of cloud AI ended in a stack built by hand: the Bundeswehr on Kubermatic, France's armed forces on Mistral, Diablo Canyon on Atomic Canyon. Kernwall OS is designed to be that layer.
Your sector's rules, mapped clause by clause03Five layers
Today you assemble Kubernetes, GPU drivers, model files and consultants by hand. Kernwall OS is designed to ship the whole stack as one signed image.
On top, the Own Your Intelligence loop. Your evals and data are the asset; base models are replaceable.
Every layer, specified04Across the gap
One signed bundle carries your OS image, drivers, models and evidence, by USB or data diode. Kernwall OS checks it at the import station before anything touches your appliance.
Waiting for the bundleNothing reaches your appliance until every check passes.
05Every model cleared
Kernwall OS checks each model's origin, licence and lineage against your rules at import. A fine-tune of a barred base is caught there, not in your audit.
| Model, origin, licence and lineage | In EU industry |
|---|---|
| gpt-oss-120bUS · Apache-2.0 · base model | Allowed⚑ inherited |
| Mistral Small 3.2 24BFR · EU · Apache-2.0 · fine-tune of Mistral Small 3.1 24B Base | Allowed⚑ inherited |
| Llama 3.3 70B InstructUS · llama3.3 · base model | Review⚑ inherited |
| Qwen3-32BPRC · Apache-2.0 · base model | Allowed⚑ inherited |
| plant-sop-70bUS · Apache-2.0 (as claimed) · fine-tune of DeepSeek-R1-Distill-Llama-70B | Review⚑ inherited |
EU industry · Blocked: Non-commercial · Review: Custom licence
06The evidence
Your auditor asks you to prove what ran, and that nobody changed it. Kernwall OS hash-links every prompt, retrieval and tool call, and exports OSCAL for your assessor.
process.eng · 09:41:07
Evidence pack · Q1 2027 · OSCAL and CycloneDX
Mapped to NIST SP 800-53, CRA Annex I, ISO 27001, IEC 62443-4-2, AI Act Art. 12
Faster ATO, never “ATO included”. The certifications drawn around the appliance are planned; none is held today.
Every certification, with its target datePad conditioning first, per SOP-CMP-014 §3.2, then compare the endpoint trace with the golden lot.
✓ Answered on-site · 0 bytes egress
Why now
Four dates in 2027. Each asks every box on your network to show what it runs, and prove nobody changed it.
New US national-security buys need quantum-resistant roots of trust.
Cybersecurity becomes part of CE marking for machinery.
High-risk systems must log and keep their records.
Every product with digital elements needs CE conformity.
Hardware
Kernwall OS runs on OEM servers from a planned compatibility list. The only box Kernwall builds is Edge, fanless and sealed for your line.
Size your applianceJetson Thor, fanless and sealed. For the line or a vehicle.
DGX Spark class. 1–5 users, pilots and evaluation.
2–4× RTX PRO 6000. Up to 50 users on a 120B MoE.
8× RTX PRO 6000. 100–300 users.
HGX B300 nodes. Fine-tuning and 600B+ models.
Founder
Kernwall starts from systems the founder built in earlier roles. The new work is the part no one sells as a product yet.
Mantas
Founder · Entrepreneur First alumnus
German factories
Built secure-boot, dm-verity Linux with signed A/B OTA and rollback for AI stations
European semiconductor fab
Built RAG and real-time voice agents for production
Defense procurement
CTO of a defense-procurement AI startup
Book a demo
We show Kernwall OS offline, on the workload you name. EU fabs and manufacturers first, 2027 pilots.