iOS
apple.com
Automated, point-in-time. Not independently reviewed or approved by TRUSTYCYBER unless expressly stated.
iOS scores 43/100 (D): an AI assurance review is needed before approval. The score is below 55, mainly because the organisation & AI governance evidence is thin. No certification could be independently confirmed.
Scanned Jul 23, 2026 · Public evidence · Point-in-time
Before you sign
What to ask for: Request a dated subprocessor register with change-notification terms for the DPA/order form.
Why it matters, and the evidence
The vendor names AI-related providers or partially addresses its supply chain, but the public sources scanned do not include a formal, dated subprocessor register.
What to ask for: Confirm in writing that the no-training commitment covers every model, plan and data type you will use, including any opt-in sharing or feedback.
Why it matters, and the evidence
The sources include a no-training statement ("Apple states Apple Intelligence is built into device silicon so it can be aware of personal information via on-device processing without collecting that personal information off the device.") but do not settle the question for every model, plan and data type in scope.
“It’s integrated into the core of your iPhone, iPad, and Mac through on-device processing. So it’s aware of your personal information without collecting your personal information.”
“And our privacy promise can be verified by independent experts.”
“When Apple does process or store data on our servers, it’s associated with a random identifier — a long string of letters and numbers. That data is used only to improve Siri, and we never share or sell it. Apple doesn’t retain audio of your requests unless you choose to share it with us to improve Siri.”
“Protect privacy: We protect our users’ privacy with powerful on-device processing and groundbreaking infrastructure like Private Cloud Compute. Privacy is the default, not something you have to manage. Your private personal data and interactions are never used to train our foundation models unless you explicitly choose to help improve them.”
What to ask for: Get retention periods in writing for inputs, outputs, logs and backups, including any provider that runs the model.
Why it matters, and the evidence
The sources describe retention ("For requests too complex for on-device processing, Apple states Private Cloud Compute sends only the data needed to Apple silicon servers, that the request is never stored or accessible to Apple, and only the response is returned to the user.") but not a complete window for every data type.
“The data required to fulfill your request is sent to Apple silicon servers — no other data is sent. Your request is processed — never stored or accessible to Apple. Your response is returned to you — and only you.”
What to ask for: Request a SOC 2 Type II or ISO/IEC 42001 report and confirm its scope covers the AI product.
Why it matters, and the evidence
No SOC 2 Type II, ISO/IEC 42001, or registry-verified certification covering the AI product was found in the public sources scanned.
Australian Government checksclick a check for the detail, directions checked Nov 1, 2026
PSPF directionsNone apply
No vendor-specific PSPF direction names this vendor or product (checked 2026-11-01).
IRAP assessmentNot collected
Not found in the sources this scan collected, which is not evidence the vendor has none. IRAP is an assessment, not a certificate, and there has been no public register since 2020. Ask the vendor for its IRAP assessment report and check its date, classification level and the services in scope.
Hosting Certification FrameworkNot collected
Not found in the sources this scan collected. If the service will hold government data, ask whether it is hosted with a provider certified under the Hosting Certification Framework, and at which level.
Data held in AustraliaNot collected
No Australian data residency commitment was found in the sources this scan collected. Ask where inputs, outputs, logs and backups are processed and stored, and whether processing can be kept in Australia.
What your organisation still has to do (7)
Every level of government
- Treat AI outputs, including meeting transcripts and summaries, as public records: capture or dispose of them under your records authority (the Archives Act 1983 for Commonwealth agencies, your state's records legislation for state agencies and councils). Source ↗
Commonwealth agencies
- Assess foreign ownership, control or influence risk for this technology asset, as PSPF Direction 001-2024 requires. Source ↗
- Apply the DTA Policy for the responsible use of AI in government: record the use case, assess its impact before deployment, and keep your AI transparency statement current. Source ↗
- Assess the service against the ISM controls for the highest classification of data you intend to use with it (OFFICIAL, OFFICIAL: Sensitive or PROTECTED). Source ↗
State agencies and councils
- Assess the service under your state's privacy law, which governs where residents' personal information may go: for example the PPIP Act 1998 in New South Wales, the Privacy and Data Protection Act 2014 in Victoria or the Information Privacy Act 2009 in Queensland.
- New South Wales agencies: complete the NSW AI Assessment Framework self-assessment, which Circular DCS-2024-04 makes mandatory. Source ↗
- Victorian public sector: follow Administrative Guideline 2024/07 on the safe and responsible use of generative AI. Source ↗
What to ask the vendor
Buyer questionsanswered only from the public evidence scanned, click a row for the answer
!Will they train on your data?Ask the vendor
Apple states users' private personal data and interactions are never used to train its foundation models unless the user explicitly opts in to help improve them.
Requires written confirmation, see Before you sign ↓
“It’s integrated into the core of your iPhone, iPad, and Mac through on-device processing. So it’s aware of your personal information without collecting your personal information.”
“And our privacy promise can be verified by independent experts.”
“When Apple does process or store data on our servers, it’s associated with a random identifier — a long string of letters and numbers. That data is used only to improve Siri, and we never share or sell it. Apple doesn’t retain audio of your requests unless you choose to share it with us to improve Siri.”
“Protect privacy: We protect our users’ privacy with powerful on-device processing and groundbreaking infrastructure like Private Cloud Compute. Privacy is the default, not something you have to manage. Your private personal data and interactions are never used to train our foundation models unless you explicitly choose to help improve them.”
!How long do they keep your data?Ask the vendor
For requests too complex for on-device processing, Apple states Private Cloud Compute sends only the data needed to Apple silicon servers, that the request is never stored or accessible to Apple, and only the response is returned to the user.
Requires written confirmation, see Before you sign ↓
“The data required to fulfill your request is sent to Apple silicon servers — no other data is sent. Your request is processed — never stored or accessible to Apple. Your response is returned to you — and only you.”
!Who else can access your data?Ask the vendor
Apple states complex Apple Intelligence requests are handled via Private Cloud Compute on servers running Apple's own silicon rather than naming any third-party foundation-model provider; no external AI vendor (e.g. OpenAI, Google, Anthropic) appears as a recipient of Apple Intelligence or Siri request data anywhere in the fetched pages.
Requires written confirmation, see Before you sign ↓
“Apple Intelligence can draw on larger server-based models, running on Apple silicon, to handle more complex requests for you while protecting your privacy.”
!Where is your data processed?Ask the vendor
Apple states that face recognition and scene/object detection in Photos (powering For You, Memories, Sharing Suggestions and the People album) run on-device rather than in the cloud.
Confirm in writing: Ask the vendor to state this in writing before signing.
“Photos is also designed so that the face recognition and scene and object detection — which power features like For You, Memories, Sharing Suggestions, and the People album — happen on device instead of in the cloud.”
✓What happens in a security incident?Clear
Apple publishes a security.txt with a dedicated security research contact, links to security-update and web-server security acknowledgements pages, and a published Apple Security Bounty Guidelines policy.
“Contact: https://security.apple.com # Apple Security Updates Acknowledgments: https://support.apple.com/HT201222 # Apple Web Server Security Acknowledgements Acknowledgments: https://support.apple.com/HT201536 # Apple Security Bounty Guidelines Policy: https://security.apple.com/bounty/guidelines/”
Email to send the vendor7 items to confirm in writing
Hello Apple team, We are assessing iOS (Apple) as part of our supplier review. Before we proceed, please confirm the following in writing: 1. Please provide your current, dated subprocessor list and explain how you notify customers of changes. 2. Do you use our data (inputs, outputs or uploaded files) to train or improve your models? Please confirm in writing, including any opt-out and whether it applies to every plan. 3. How long do you retain our data, in days, for each type (inputs, outputs, logs and backups), and how is it deleted? 4. Please address the following: No independent assurance evidenced. 5. In which countries and regions is our data processed and stored, and can processing be limited to a region we choose? 6. Does Apple have a documented incident-response and customer-notification process specific to Apple Intelligence / Private Cloud Compute, distinct from general product security handling? 7. Has Apple's Private Cloud Compute or Apple Intelligence undergone a named, publicly citable independent security/privacy audit or certification, and can Apple point to the report or attestation? A written reply to each point, or a link to where it is documented, is enough. Where a point is covered by a certification or independent report, please include the certificate number or the report and its date. Thank you,
How the score is built
Assurance dimensionsweighted components of one score, not eight separate ratings
Organisation & AI governance15% of the scoreorganisation-level evidence40
Graded from organisation-level evidence, it does not automatically establish assurance for this product.
Who owns AI risk: policies, responsible-AI principles, human oversight and administrative controls.
Assessed against ISO 42001 · NIST AI RMF · AIUC-1
“Additionally, we have created our Responsible AI principles to guide how we develop AI tools, as well as the models that underpin them. These principles are reflected at every stage of the architecture that enables Apple Intelligence and connects features and tools with specialized models:”
“Apple’s Chief Compliance Officer provides regular updates to the Audit and Finance Committee of the Board of Directors.”
“We conduct internal and third-party independent assessments of our programs to ensure they are effective. We make changes to our policies and our training to reflect emerging trends.”
AI system15% of the scoreorganisation-level evidence47
Graded from organisation-level evidence, it does not automatically establish assurance for this product.
What AI the vendor actually runs and where it sits in the product, the map everything else is judged against.
Assessed against ISO 42001 · NIST AI RMF
“Introducing the next generation of Apple Intelligence and Siri. Truly helpful AI that’s centered around you and your needs. Integrated into your apps, grounded in your context, and private at every step. Coming later this year.”
“It’s integrated into the core of your iPhone, iPad, and Mac through on-device processing. So it’s aware of your personal information without collecting your personal information.”
“The data required to fulfill your request is sent to Apple silicon servers — no other data is sent. Your request is processed — never stored or accessible to Apple. Your response is returned to you — and only you.”
“Photos is also designed so that the face recognition and scene and object detection — which power features like For You, Memories, Sharing Suggestions, and the People album — happen on device instead of in the cloud.”
“The foundation models built into Apple Intelligence have been fine-tuned for user experiences such as writing and refining text, prioritizing and summarizing notifications, creating playful images for conversations with family and friends, and taking in-app actions to simplify interactions across apps.”
The vendor’s own evaluation of its AI features before and after release, evals, red-teaming, monitoring. A model supplier’s testing of its own model counts only in part.
Assessed against NIST GenAI · NIST AI RMF · ISO 42001
“To evaluate the safety of Apple Intelligence, we assessed both the foundation models as well as each feature that uses the models prior to deployment. For foundation models, we combined internal and external human evaluation with auto-grading, and compared our models to external models for benchmarking.”
“Finally, we conducted human red teaming across features to identify risks unique to each locale.”
“We continuously monitor and proactively improve our features with the help of user feedback. In Image Playground, for example, users can provide feedback on generated images by tapping “thumbs up” or “thumbs down”, with the option to add comments.”
“However, considering the broad capabilities of large language models, we understand the limitation of our safety benchmark. We are actively conducting both manual and automatic red-teaming with internal and external teams to continue evaluating our models’ safety.”
“However, we found that the summarization adapter did not amplify sensitive content in over 99% of targeted adversarial examples. We continue to adversarially probe to identify unknown harms and expand our evaluations to help guide further improvements.”
How changes to models and AI features, including a change of underlying model, are controlled and communicated: versioning, notice, rollback.
Assessed against ISO 27001 · ISO 42001
“Beta 0.2.0 (removed) Updates for new base model version. Updated data schema with support for tool-calling.”
“Every production Private Cloud Compute software image will be published for independent binary inspection — including the OS, applications, and all relevant executables, which researchers can verify against the measurements in the transparency log. Software will be published within 90 days of inclusion in the log, or after relevant software updates are available, whichever is sooner.”
Testing & evaluation: vendor-evidenced, not yet independently corroborated.
Model10% of the scoreorganisation-level evidence60
Graded from organisation-level evidence, it does not automatically establish assurance for this product.
Which foundation models and model providers power the product. How model changes are disclosed is judged under change management.
Assessed against NIST GenAI · ISO 42001
“Apple Intelligence can draw on larger server-based models, running on Apple silicon, to handle more complex requests for you while protecting your privacy.”
“Our latest foundation models are optimized to run efficiently on Apple silicon, and include a compact, approximately 3-billion-parameter model, alongside a mixture-of-experts server-based model with a novel architecture tailored for Private Cloud Compute . These two foundation models are part of a larger family of generative models created by Apple to support our users.”
Model provider transparency: vendor-evidenced, not yet independently corroborated.
Customer data15% of the scoreorganisation-level evidence40
Graded from organisation-level evidence, it does not automatically establish assurance for this product.
Whether customer data trains models, how long it is retained, and where it is processed.
Assessed against ISO 27018 · OAIC APPs · EU AI Act
“The data required to fulfill your request is sent to Apple silicon servers — no other data is sent. Your request is processed — never stored or accessible to Apple. Your response is returned to you — and only you.”
“When Apple does process or store data on our servers, it’s associated with a random identifier — a long string of letters and numbers. That data is used only to improve Siri, and we never share or sell it. Apple doesn’t retain audio of your requests unless you choose to share it with us to improve Siri.”
“It’s integrated into the core of your iPhone, iPad, and Mac through on-device processing. So it’s aware of your personal information without collecting your personal information.”
“Protect privacy: We protect our users’ privacy with powerful on-device processing and groundbreaking infrastructure like Private Cloud Compute. Privacy is the default, not something you have to manage. Your private personal data and interactions are never used to train our foundation models unless you explicitly choose to help improve them.”
“Photos is also designed so that the face recognition and scene and object detection — which power features like For You, Memories, Sharing Suggestions, and the People album — happen on device instead of in the cloud.”
AI supply chain10% of the scoreorganisation-level evidence40
Graded from organisation-level evidence, it does not automatically establish assurance for this product.
The named chain of AI and infrastructure providers behind the product, and how it is disclosed.
Assessed against ISO 27001 · ISO 27017
“Additionally, PCC requests go through an OHTTP relay — operated by a third party — which hides the device’s source IP address before the request ever reaches the PCC infrastructure.”
“Apple screens third parties that meet identified risk criteria, including the Transparency International Corruption Perceptions Index and other metrics, and conducts ongoing monitoring for legal and ethical violations.”
Security foundation15% of the scoreorganisation-level evidence40
Graded from organisation-level evidence, it does not automatically establish assurance for this product.
How security problems are found, reported and handled: disclosure channels, bug bounty, incident response.
Assessed against ISO 27001 · NIST AI RMF
“Contact: https://security.apple.com # Apple Security Updates Acknowledgments: https://support.apple.com/HT201222 # Apple Web Server Security Acknowledgements Acknowledgments: https://support.apple.com/HT201536 # Apple Security Bounty Guidelines Policy: https://security.apple.com/bounty/guidelines/”
Independent assurance evidence10% of the scoreorganisation-level evidence0
Graded from organisation-level evidence, it does not automatically establish assurance for this product.
Whether claimed certifications and attestations are independently corroborated, checked against official registries and issuing bodies. Which certifications, and what each one does and does not establish, is stated per certificate.
Assessed against ISO 17021-1 · ISO 42006 · ISO 27006-1 · ISO 27008
“And our privacy promise can be verified by independent experts.”
Independent assurance: not publicly evidenced.
Legal & contractual10% of the scoreorganisation-level evidence40
Graded from organisation-level evidence, it does not automatically establish assurance for this product.
The contractual backbone a buyer can rely on, terms, DPAs, privacy commitments and regulatory posture.
Assessed against EU AI Act · OAIC APPs
“Apple is committed to your privacy. Read our customer Privacy Policy for a clear explanation of how we collect, use, disclose, transfer, and store your information.”
Not graded: Agent, not applicable to this scan.
What would strengthen assuranceeach figure is from today's score, resolving one changes the others
Resolving an evidence gap strengthens the dimension it belongs to, and with it the score: 43 → up to 64 with every identified gap resolved.
The evidence behind the result
Key findingsclick a row for the evidence
✓Private Cloud Compute limits both retention and third-party accessStrong
Apple's Private Cloud Compute design states cloud-side AI requests are processed on Apple-operated silicon servers, are never stored or accessible to Apple, and the privacy claim is stated to be open to independent verification; no third-party model provider is named for Apple Intelligence/Siri.
A no-retention, no-third-party-recipient architecture with a claimed independent-verification path is one of the stronger data-handling postures a buyer can find in public vendor material.
“The data required to fulfill your request is sent to Apple silicon servers — no other data is sent. Your request is processed — never stored or accessible to Apple. Your response is returned to you — and only you.”
“And our privacy promise can be verified by independent experts.”
“Apple Intelligence can draw on larger server-based models, running on Apple silicon, to handle more complex requests for you while protecting your privacy.”
!Siri's 'used only to improve Siri' disclosure partially offsets its privacy protectionsGap
Apple's Siri privacy claims are strong on pseudonymisation and non-sale/non-share of data, but explicitly disclose that data processed or stored on Apple's servers 'is used only to improve Siri' - i.e. customer interaction data is confirmed to be used for service/model improvement, not merely stored inertly.
Buyers evaluating a strict no-training-on-my-data posture should weigh this explicit improvement-use disclosure against the pseudonymisation safeguard rather than assume Siri interactions are never used to improve the underlying models.
Question for vendor: What specifically does 'used only to improve Siri' involve - is pseudonymised interaction data used to train or fine-tune models, and can a user opt out of that use entirely (not just audio sharing)?
“When Apple does process or store data on our servers, it’s associated with a random identifier — a long string of letters and numbers. That data is used only to improve Siri, and we never share or sell it. Apple doesn’t retain audio of your requests unless you choose to share it with us to improve Siri.”
!No AI-specific incident-response commitment foundGap
Apple publishes a general coordinated vulnerability disclosure channel and bug bounty programme, but none of the fetched pages describe an AI/model-specific incident response process, breach notification timeline, or post-incident reporting commitment.
A vulnerability disclosure programme is a positive general security signal but does not by itself tell a buyer how Apple would notify customers or respond to an AI-specific incident (e.g. a Private Cloud Compute failure).
Question for vendor: Does Apple have a documented incident-response and customer-notification process specific to Apple Intelligence / Private Cloud Compute, distinct from general product security handling?
“Contact: https://security.apple.com # Apple Security Updates Acknowledgments: https://support.apple.com/HT201222 # Apple Web Server Security Acknowledgements Acknowledgments: https://support.apple.com/HT201536 # Apple Security Bounty Guidelines Policy: https://security.apple.com/bounty/guidelines/”
✓On-device processing minimises what leaves the deviceStrong
Apple's on-device design for Apple Intelligence generally and for Photos face-recognition/scene-detection specifically means personal content and its processing stay on the device for a large share of AI functionality, rather than being sent to any server.
Data that never leaves the device cannot be exposed via a server-side breach, retained by a cloud vendor, or used to train externally hosted models.
“It’s integrated into the core of your iPhone, iPad, and Mac through on-device processing. So it’s aware of your personal information without collecting your personal information.”
“Photos is also designed so that the face recognition and scene and object detection — which power features like For You, Memories, Sharing Suggestions, and the People album — happen on device instead of in the cloud.”
!No named independent-assurance certification evidenced for Apple Intelligence/PCCGap
The fetched pages describe general governance (Business Conduct Policy, internal/third-party compliance assessments) and a claim that Private Cloud Compute's privacy promise 'can be verified,' but no specific named certification (e.g. ISO 27001, ISO/IEC 42001, SOC 2) or independent audit report is evidenced for the AI systems themselves.
A claim that something 'can be verified' is not the same as a completed, named third-party attestation; buyers should distinguish Apple's verifiability claim from an actual certification.
Question for vendor: Has Apple's Private Cloud Compute or Apple Intelligence undergone a named, publicly citable independent security/privacy audit or certification, and can Apple point to the report or attestation?
“And our privacy promise can be verified by independent experts.”
“Apple’s Chief Compliance Officer provides regular updates to the Audit and Finance Committee of the Board of Directors.”
“We conduct internal and third-party independent assessments of our programs to ensure they are effective. We make changes to our policies and our training to reflect emerging trends.”
Assurance evidence: certifications 1, registry checks and verification ladders, click to view
Not claimed in any public source scanned. This is the AI-management-system certification — in its absence, the vendor’s AI governance rests on its general security and privacy certifications.
AI supply chainclick a node to focus it · drag to pan · zoom with the controls
View as list
What you inheritTrustyCyber's AI Shared Responsibility Matrix v1.0
This scan names the vendor’s AI supply chain without assessing the responsibility split, that depends on how you consume the product. Under the common managed models, a deployer inherits 16 of the matrix’s 41 responsibilities from providers, each with named evidence owed.
Map your inherited responsibilitiesSources and regulation
Sources 16, click to view
Appendix: standards landscape 8, click to view
Where each standard behind this assessment stands today, from TrustyCyber’s continuously maintained standards radar.
This automated result is based on publicly available information at the time of scanning. It is not an audit, certification, legal opinion or assurance engagement. Publicly unavailable evidence may materially change the conclusion.
Monitor for changes
Get an email if its TRUSTYCYBER Score, grade or certifications change. One credit per refresh; reading the report always stays free.