Apple Intelligence Now Runs on Google Cloud: What AI Meeting-Notes Buyers Who Trusted 'On-Device Apple' Need to Know

Is Apple Intelligence on-device or cloud? The honest answer in late 2026 is both — and the second half of that answer just changed shape. On June 8, 2026, Apple announced that Private Cloud Compute (PCC) is expanding beyond Apple's own data centers, with Apple Intelligence workloads now running on Google Cloud using Nvidia GPUs. For buyers who chose an AI meeting-notes app because it ran "on Apple," the architectural map changed overnight.

If your organization handles privileged conversations — attorney-client calls, M&A diligence, patient discussions, internal investigations — the question "where does the audio actually go?" matters more than any marketing badge. This article unpacks the June 2026 shift, explains the real difference between on-device processing and Private Cloud Compute, and walks through what to verify before you trust any "private AI" meeting notetaker that leans on Apple's stack.

What Actually Changed on June 8, 2026

At WWDC 2026, Apple confirmed a milestone that reshapes its two-year privacy narrative. According to Help Net Security's coverage of the announcement, Apple collaborated with Google and NVIDIA to extend PCC's security and privacy guarantees to Google Cloud infrastructure, built on NVIDIA Confidential Computing, Intel CPUs with TDX, NVIDIA GPUs, and Google's Titan security chip.

Data Center Dynamics reported that Apple is tapping Nvidia Blackwell GPUs with Confidential Computing for confidential inference workloads for Apple Foundation Models that were custom-built by Apple and Google. Previously, Private Cloud Compute ran solely in Apple's own data centers.

Apple frames the move as a continuity story — same stateless computation, same verifiable transparency, same "no privileged runtime access" posture — now extended to a third-party operator. For engineers that's a reasonable claim. For compliance officers trying to describe where their meeting audio lives, it's a brand-new line to add to the data-flow diagram.

The Hybrid Architecture Most Users Never Noticed

The confusion starts with Apple's own messaging. For two years, "Apple Intelligence" has been pitched as a privacy-first alternative to cloud AI. The reality is more nuanced. Apple's Machine Learning Research team describes the third-generation Apple Foundation Models as running exclusively on-device and on Private Cloud Compute. Both tiers, same brand.

The Apple Newsroom post from June 2026 is explicit: Apple Intelligence "takes full advantage of a bold new architecture, including the next generation of Apple Foundation Models that run on device and on servers using Private Cloud Compute." The on-device tier handles everyday work. The server tier handles the hard stuff. From the user's perspective, the split is invisible.

Apple's developer documentation echoes this split. In the WWDC26 session "Build with the new Apple Foundation Model on Private Cloud Compute," Apple engineers describe PCC as "the easiest server LLM you'll ever use" — and note explicitly that the on-device model works offline while PCC requires an internet connection. If your app leans on PCC, your "private" workflow fails on an airplane.

On-Device vs Private Cloud Compute vs Cloud AI: A Side-by-Side

The table below captures the three architectural tiers meeting-notes buyers actually encounter in 2026 — and where audio physically lives in each.

Why This Matters for Attorney-Client, PHI, and MNPI Conversations

Private Cloud Compute is, by cloud standards, remarkably well-designed. Apple's PCC security model promises stateless computation, enforceable guarantees, no privileged runtime access, non-targetability, and verifiable transparency — and Apple has published the node firmware and software images for independent inspection through its bounty program. For many workloads, that is more than enough.

But for conversations where even the existence of a vendor-side copy creates risk, the calculus is different. Attorney-client privilege can be waived by inadvertent third-party disclosure. HIPAA's minimum-necessary principle disfavors sending protected health information to additional subprocessors unless there's a documented reason. Material non-public information routed through any extra operator becomes another incident-response surface. The strongest architectural answer for these conversations remains the simplest: don't send the audio anywhere.

That's not a knock on Apple's engineering. It's a function of threat modeling. Zero-egress is a stronger claim than any stateless-cloud promise — because it's an architectural fact, not a trust assertion. For related background, see our deep dive on why financial-services compliance officers are moving to on-device capture.

How to Tell If an "On-Device" App Actually Stays Off the Cloud

The June 2026 shift is a wake-up call: "built on Apple's AI stack" no longer tells you whether audio leaves the device. If a vendor says they use Apple Intelligence, they could mean the on-device foundation model, Private Cloud Compute, or both — and PCC now implicates Google Cloud.

Four questions to put to any vendor

1. Which specific Apple API handles transcription? On-device transcription uses the Speech framework — specifically SFSpeechRecognizer with requiresOnDeviceRecognition = true, or the new SpeechAnalyzer/SpeechTranscriber in iOS 26 and macOS 26. If the vendor can't name the class, assume cloud.
2. Do you make any calls to Private Cloud Compute? PCC is a server round-trip. If the answer is "yes, for summarization," audio or transcripts leave the device.
3. Do you call the Foundation Models framework's server tier? At WWDC26, Apple opened a server LLM running on PCC to third-party apps. Convenient — but not on-device.
4. What does the app do when the user is offline? If transcription still works on an airplane with Wi-Fi disabled, the architecture is genuinely local. If it stalls, something is phoning home.

What the Speech framework actually guarantees

Apple's Speech framework has two generations. The older SFSpeechRecognizer, available since iOS 10, defaults to server-side recognition — audio is sent to Apple's servers unless the developer explicitly sets requiresOnDeviceRecognition = true and the device supports local inference. This is a long-standing documented behavior, visible in Apple's SFSpeechRecognizer documentation, and it's a trap many "private" transcription apps fall into.

In iOS 26 and macOS 26, Apple shipped SpeechAnalyzer with SpeechTranscriber — a modern long-form, on-device-only replacement. No server fallback, no one-minute cap, model packs delivered by the OS. For meeting transcription in 2026, this is the correct primitive. If a vendor's app has moved to iOS 26 but hasn't adopted SpeechAnalyzer, ask why.

What Apple Says About Data Inside PCC (and What That Covers)

Apple's privacy claim for PCC is specific and worth quoting carefully. The Apple privacy page and the June 2026 newsroom post state that when PCC handles users' requests, their personal data is not stored nor made accessible to Apple or anyone else, and outside experts can continue to verify this privacy promise.

Three things to notice. First, the claim is about retention and access, not about traversal. Your audio has to reach Google-operated hardware before PCC can promise not to retain it. Second, the trust model requires readers to accept Nvidia Confidential Computing, Intel TDX, and Google Titan as cryptographic root-of-trust components — a reasonable position for most workloads, but not literally equivalent to "the audio never left my laptop." Third, verifiable transparency is powerful but requires sophisticated outside researchers to actually look. Most compliance teams won't.

How This Interacts With GDPR, HIPAA, and Legal Hold

Routing meeting audio to Google-operated infrastructure — even under Apple's stateless-processing promise — adds entries to the data-flow diagram. Under Article 28 of the GDPR, controllers are responsible for the subprocessor chain. If your "private AI" meeting app invokes PCC, your DPIA now has to account for Apple as processor and Google as sub-processor, both potentially outside the EU depending on routing. The strongest way to avoid that paperwork is to not use PCC at all.

For healthcare, HHS's own HIPAA Privacy Rule guidance treats any entity creating, receiving, maintaining, or transmitting PHI on a covered entity's behalf as a business associate. If PCC touches PHI, Apple and Google both come into scope. Most healthcare compliance programs would rather not expand that circle. On-device-only transcription keeps the circle at one: the covered entity's own device.

For litigation hold, zero-egress has one more benefit: there is no third-party server to subpoena or produce from. Discovery runs against the custodian's device, where it would run anyway. For more on how this shapes litigation strategy, see our analysis of AI notetakers for lawyers in client intake and depositions.

Where Cloud Notetakers Sit in the New Landscape

If PCC's move to Google Cloud is a nuance, mainstream cloud notetakers are a different conversation entirely. Vendors like Otter, Fireflies, and Zoom AI Companion route audio to their own infrastructure, run their own models (often with third-party inference providers in the chain), and retain content under their own policies. Otter's privacy policy grants Otter broad rights to use conversation content for product improvement; the Fireflies and Zoom equivalents extend similar permissions. Those are category-level trade-offs, not a reaction to any one June 2026 announcement.

The important distinction for buyers: Apple PCC is a stateless-by-design server, now operated on third-party hardware; mainstream cloud notetakers are retention-by-default servers operated by the vendor. Both are server-based. Only the on-device Speech framework path is not. For a broader side-by-side, our Granola vs Basil comparison walks through the architectural fingerprints to look for.

How Basil AI Handles This

Basil AI is architected around three concrete technical choices that keep the June 2026 PCC change irrelevant to our users.

1. Apple Neural Engine, not server inference. Transcription runs on the Neural Engine inside the user's iPhone or Mac. There is no server-side transcription path in Basil AI. The engineering trade-off — bounded context, bounded model size — is the point: it's what makes the privacy claim an architectural fact rather than a policy promise.

2. Speech framework, on-device mode only. Basil AI uses Apple's Speech framework configured to require on-device recognition — the SpeechAnalyzer/SpeechTranscriber path on iOS 26 and macOS 26, with SFSpeechRecognizer's requiresOnDeviceRecognition flag on older OS versions. Audio never reaches Apple's servers, which means it also never reaches PCC — regardless of whether PCC is running on Apple silicon in Cupertino or Nvidia GPUs on Google Cloud.

3. Zero egress for audio and transcripts. There is no Basil server that receives recordings. There is no account-side storage of audio or transcripts. iCloud sync of notes is a user-controlled, Apple-managed path under the user's own iCloud account — Basil never sees the contents. For buyers whose organizations are now re-reading vendor DPAs after the June 2026 PCC news, this is the structural answer.

Whether that architecture meets your organization's compliance program is a determination you make with your own legal and compliance team. We don't claim Basil AI is "HIPAA compliant" or "GDPR compliant" as a product label — those are deployment facts, not product facts. What we do say is that there's no vendor-side copy of your meeting audio to produce, breach, or train on. For related reading on how to translate that into a vendor checklist, see our guide to sending AI meeting notes to Notion, Obsidian, and Apple Notes without breaking privacy.

A Checklist to Bring to Your Next Vendor Demo

1. Which Apple Speech framework class is used, and is requiresOnDeviceRecognition set to true on supported devices?
2. Does the app ever call Private Cloud Compute, either directly or via the Foundation Models framework's server tier?
3. Does transcription work with the device in airplane mode, with no Wi-Fi and no cellular?
4. Where is summarization/action-item extraction performed — on-device, PCC, or a third-party LLM API?
5. What is the complete subprocessor list, and does it include Google Cloud via Apple PCC?
6. Is any audio or transcript content retained on vendor-controlled infrastructure, and for how long?
7. Does the vendor hold the ability to decrypt stored content server-side, or is encryption client-held?
8. What's the data-flow diagram during a legal hold or regulatory production request?

The Bottom Line

Apple's June 8, 2026 announcement is a reasonable engineering decision for scaling frontier AI with strong hardware-isolation guarantees. It is also a reminder that "on-device" and "Apple Intelligence" are no longer interchangeable terms — and that the burden now sits on buyers to ask which API their AI meeting notes app actually calls.

If your conversations are sensitive enough that you'd rather not add Google Cloud to your data-flow diagram, the answer isn't to abandon AI meeting notes. It's to pick an app that uses only Apple's on-device Speech framework and the Neural Engine, with no PCC round-trip. That's where Basil AI lives.

Private AI meeting notes that never leave your device

Basil AI runs 100% on-device on the Apple Neural Engine. No cloud. No PCC. No egress.