Faulty bottle checks on a juice filling line

Your company bottles juice in one plant with 6 filling lines. Each line fills 10 bottles a second. A camera photographs every bottle, and a model decides whether its cap and label are faulty. An arm pushes a faulty bottle off the belt 1 second after its photo. Today 2 people per line check bottles by eye.

The model takes 30 ms (milliseconds) to check a 300 KB photo on one CPU core. The plant's internet line is 200 Mbps, and a round trip to your cloud takes about 40 ms. The line goes down a few times a year, and filling must not stop when it does. Quality engineers retrain the model every 2 weeks.

Where does the model run, on how much hardware, and how does a new model take over a line safely?