The AI for the Enterprise D was run from three computer cores on the ship (two in the saucer, one in the engineering section), made up of Isolinear Chips subjected to a small warp field (iow, it makes computes using light faster than the speed of light). Subspace communication bandwidth is too limited (and potentially affected by latency, since it had to travel through repeaters throughout the galaxy) to provide realtime cloud computing as we experience it.
There are some cannon exceptions to this (such as in Nemesis where the subspace communication interruption affected the star charts), but even then the functionality of the ship was not impacted.
The Star Trek ships are very analogous to our own ocean-bound ships, where satellite communication is possible almost anywhere, but they don't rely on it.
So, yes, the AI is completely confined to the ship.
What about when someone was (permanently) transferred between ships?
Was there ever an indication that their AI-level data was transferred along with their personnel file? For example did the replicator know what food to offer them on day one?
If so, then it's seems reasonable to assume that the Enterprise's AI data was backed up at Federation HQ during routine maintenance, and that the "IT department" at Federation knew exactly what you liked to do on the Holodeck.
Through specific indication from the user. Recall the constant utterance of "tea, earl grey, hot"?
Ultimately, I imagine the user's information (documents, etc) was passed directly between ships, or through (as you say) Federation HQ.
> Enterprise's AI data was backed up
Ultimately, I think this is where AI will differ from ML. An AI won't have data that isn't a part of the AI - i.e. you couldn't separate out information specific to Picard from the rest of the AI code. An AI might be able to "scribble" down some notes about interacting with Picard and pass them off to another ship's AI, but the second AI would never treat Picard quite the same way as the first, even with those notes.
This stems from my belief that how ML interprets data is different from how an AI would. If you were to copy all of the data used to build a ML model and apply it again, you'd end up with the same ML model. An AI, on the other hand, if built twice twice from the same data would end creating two separate AIs.
There are some cannon exceptions to this (such as in Nemesis where the subspace communication interruption affected the star charts), but even then the functionality of the ship was not impacted.
The Star Trek ships are very analogous to our own ocean-bound ships, where satellite communication is possible almost anywhere, but they don't rely on it.
So, yes, the AI is completely confined to the ship.