Apple is moving Private Cloud Compute beyond its own data centers and onto Google Cloud so new Apple Intelligence workloads can run on third‑party infrastructure, the company announced today.
The change means Apple’s private‑AI inference stack — introduced in 2024 — will no longer be limited to hardware Apple controls. For this next phase Apple says it has worked with Google and NVIDIA to run the new Apple Foundation Models on Google Cloud systems; those models, Apple says, power Apple Intelligence features and will operate across a range from on‑device execution to cloud inference.
Technically, the Google Cloud deployment stitches together confidential compute components: NVIDIA Confidential Computing with NVIDIA GPUs, Intel CPUs using TDX, and Google’s Titan chip are all part of the mix. Apple says it retains complete control of the Private Cloud Compute software and that devices will only trust software cryptographically approved by Apple. Core requirements — stateless computation, enforceable guarantees, no privileged runtime access, non‑targetability, and verifiable transparency — remain the baseline regardless of where the infrastructure runs.
Apple also says it collaborated with Google to leverage technologies behind the Gemini family of models in building the next generation of Apple Foundation Models. Those technical ties are intended to let Apple scale heavier inference and reasoning workloads that exceed what devices can handle alone, while keeping the confidentiality protections that distinguish Private Cloud Compute.
Not everything moves at once. Private Cloud Compute on Google Cloud will roll out through a summer preview period and Apple says the deployment will gradually ramp toward the full set of protections during that preview. Apple will publish all binaries for public inspection, provide research tooling, and allow access to live Private Cloud Compute nodes in research mode through the Apple Security Bounty Program as part of that phased exposure.
For users, the immediate practical effect is that more demanding Apple Intelligence tasks can be shifted off‑device when required, letting Apple run larger models and heavier inference without abandoning the framework of verifiable, cryptographically constrained execution. Apple will also share additional technical detail at the Confidential Computing Summit later this month and will update the Private Cloud Compute Security Guide and research program details later this year.
The complication is operational: Apple is extending its privacy commitments into third‑party data centers for the first time, relying on a combination of confidential compute primitives rather than only Apple silicon. Apple maintains those primitives had not previously been integrated into an end‑to‑end confidential inference pipeline at global scale; the Google Cloud rollout is designed to show how those pieces operate together under Apple’s control model.
Apple’s approach to transparency — publishing binaries and opening research access — is intended to let outside experts verify whether the third‑party implementation meets Apple’s stated guarantees. Public disclosures at the upcoming summit and subsequent updates to the security guide will be the principal checkpoints for independent scrutiny.
One clear question remains unanswered: Apple has not specified which Apple Intelligence workloads will be the first to run on Google Cloud. That detail will determine how quickly users see cloud‑backed features and how sensitive tasks are routed between devices and third‑party infrastructure. Expect the summer preview and the technical briefings later this month to show whether the Google Cloud extension delivers the same enforceable protections Apple has promised.
