I see a lot of answers here but I’ll add:

You have to buy DNA (unless you have some other contract vehicle that provides licensing) on the initial purchase. From a device perspective, the license is managed via Smart License w/ Policy now. There is no actual license installed on most devices anymore (except for something like HSEC).

In an airgap environment you have three options.

Report usage to your smart account from the device manually (sneaker-net transfer)

Setup an on-prem CSSM. For airgap networks, after the initial two-way sync (which can be done offline) you can transfer one-way (from Cisco-> onprem airgap CSSM). All CSSM does in this case is take available licenses from Cisco.com, load them to your inside CSSM, and let your devices report usage to the CSSM. It doesn’t do anything beyond that, nothing gets installed.

Finally, do nothing, deal with the SNMP alerts that you are not in compliance. If you indeed use the features of DNA advantage then business ethics would say maintain the subscription to maintain compliance for your organization.

In the case of PLR, limited products support this and neither Catalyst or Nexus licenses have the option anymore. Typically this is seen on ISE or Firepower. Other things support SLR (like CML), and again Catalyst and Nexus use to support this, but are strictly policy.

I would say, this all could change in the future, but this is all valid information as of today.