You didn't say but I'm going to guess you're using Java. Although Java Crypto (JCA) in general supports ciphers (and also digests, MACs, and signatures) with a 'streaming' interface (
init then any number of
update ended by
doFinal), the 'standard' (Oracle/OpenJDK) provider that implements AES-GCM (SunJCE) obeys the requirement implicit in SP800-38D and often stated generally for AEAD that when verification fails none of the plaintext (at least some of which is probably wrong) is returned. To do this it cannot return partial decrypted results for an
update call but instead must buffer all the ciphertext until
doFinal when it verifies and decrypts all of it.
In which case, neardupe Plain text size limits for AES-GCM mode at 2GB with Sun JCE implementation? (which links to several other related Qs).
If you use the BouncyCastle provider instead, it does not obey this requirement and does return partial results as you wish.
This does pose a danger. Consider a situation where Company X (maybe remote working due to COVID) has a procedure where the CFO approves large payments and then sends them, in a standard form created by their business software and GCM-encrypted, to the bookkeeper to be executed, and has a very large contract with Company Y that is nearly complete, and Company Y being very up to date and fashionable wants to be paid in Bitcoin. Company Y submits its payment request for say the equivalent of 100 million dollars, which is is valid and the CFO approves it and puts it first because of its importance. Attacker, knowing the payment is first, can easily change the ciphertext so it decrypts without verification to the attacker's Bitcoin address instead -- this ia called 'malleability' and is the main reason AEAD modes were developed; there are numerous existing Qs about it you should be able to find easily. Bookkeeper decrypts the first, important payment and pays the 100 million to the attacker, then breaks for lunch; after lunch they finish the decryption and discover the MAC mismatch meaning the data has been changed -- but after one hour Bitcoin is irreversibly gone, and if the attacker is careful, untraceable. Company X still owes the 100 million to Y and can't pay it, so they go bankrupt. Some people wouldn't consider this a good system design.