Apple Runs Private AI on Google Cloud Servers

According to MacRumors, Apple is extending Private Cloud Compute (PCC) beyond Apple data centers by running some Apple Intelligence workloads on Google Cloud servers that use NVIDIA GPUs. CNBC reported Apple discussed a new AFM Cloud Pro (Apple Foundation Model Cloud Pro) model during WWDC and described it as comparable to Google's Gemini frontier models, with Apple executives saying more advanced, agentic, or reasoning-heavy requests will be handled in the cloud rather than fully on-device. 9to5mac published direct remarks from Craig Federighi and other Apple executives about the integration between on-device systems and cloud models.

Per MacRumors, the PCC-on-Google implementation layers several technologies: NVIDIA Confidential Computing with NVIDIA GPUs, Intel CPUs with TDX, and Google's Titan chip. MacRumors reports Apple asserts the server-side components and software will be part of a trusted computing base with verifiable transparency and no-privileged-runtime guarantees, and that Apple will maintain cryptographic control over which PCC software devices will trust. MacRumors also reports Apple will keep a cryptographically verifiable ledger of Google Cloud hardware that participates in the PCC fleet. MacRumors states PCC on Google Cloud is not yet fully implemented and will be rolled out through beta testing, with PCC binaries made available for public inspection and research-mode access via Apple's Security Bounty Program.

Companies that combine on-device models with cloud-hosted frontier models typically rely on confidential computing, attestation, and software signing to bridge trust boundaries. Observed patterns in comparable deployments include using hardware-backed isolation (for example, TEE-enabled CPUs, vendor confidential-compute stacks, and supply-chain attestation) and cryptographic verification of allowed software images. Those patterns match the technical building blocks Apple reportedly cites for PCC on Google Cloud.

Reporting that Apple will run private AI workloads on Google Cloud and NVIDIA hardware represents a material shift from early messaging that emphasized Apple Silicon and in-house-only processing. Multiple outlets, including CNBC, Macworld, and The Information (snippet), frame the move as an operational compromise to handle higher compute demands for advanced assistant features while preserving privacy properties through architectural controls. For practitioners, this highlights the operational complexity of delivering low-latency, private assistant experiences at scale when on-device compute alone cannot meet frontier-model resource needs.

For practitioners: Monitor three signals closely:

• •the technical documentation and public PCC binaries Apple provides during the beta, which will reveal the attestation and signing workflows
• •how Apple and Google integrate confidential computing stacks end-to-end, including auditing/attestation tooling
• •performance and cost implications when routing advanced assistant workloads to AFM Cloud Pro on NVIDIA Blackwell-class hardware

Also watch for third-party research access Apple advertises through its Security Bounty and research-mode PCC nodes, which will be important for independent verification of the stated protections.

MacRumors reproduces a direct Apple quote used in its coverage: "Our core PCC requirements remain exactly the same: stateless computation, enforceable guarantees, no privileged runtime access, non-targetability, and verifiable transparency." 9to5mac quotes Craig Federighi describing the integration between on-device system software and cloud-hosted models and stressing that Apple's assistant does not use Google Search or Google's customer-deployed models directly.

Outlets reporting this story draw on Apple briefings and follow-up tech talks. Public reporting to date includes asserted technical guarantees and planned beta steps; independent audits or third-party verification of the claimed protections have not yet been published.