Now that Samsung has jumped into the crowded AI-powered glasses arena alongside Apple, Google, Meta, and others, CISOs and IT leaders are again having to think through whether it makes sense to establish enterprise restrictions on such devices, given the likely data leakage and privacy and compliance issues.
And even if those tech leaders decide that such policies might make sense, the logistical hurdles to universally enforcing them outside the office are all but insurmountable.
For example, it is up to individual wearers to choose their device’s settings, making it difficult for IT policies around data acquisition and usage to be enforced. Worse, AI devices have a history of ignoring guardrails. That means that a setting that limits how data is used may not necessarily be obeyed.
One possible mitigating factor is that smart glasses typically have a light on the frame that activates when the device is recording, but there are also many easy ways for workers to defeat or cover up those lights to conceal their activities.
Enforcement is virtually impossible
However, said independent technology analyst Carmi Levy, “although some organizations have tried to physically ban smart glasses from their in-person and virtual workplaces, the sad reality for corporate technological gatekeepers is there is no way to completely keep any device out of the workplace.”
There is nothing stopping employees from wearing eyewear of any type, smart or not, he noted, “and attempting to do so might put employers on the wrong side of a disability lawsuit launched by a worker who needs prescription smart glasses to accommodate vision issues.”
As well, Jitesh Ubrani, an IDC director focusing on worldwide device trackers, pointed out that the biggest challenge in creating rules around usage of smart glasses is that the data leakage problem with devices is both not new and certainly not limited to glasses.
“The instinct to ban AI smart glasses outright is understandable, but it misses that the underlying risk isn’t new. A smartphone has been able to record a whiteboard, a screen, or a conversation for close to two decades,” he said. “What’s changed is the friction. Glasses make covert capture nearly effortless and far harder to notice because there’s no phone being visibly raised or pointed. That’s a real escalation in ease of misuse, but it’s a difference of degree rather than a fundamentally new capability.”
In fact, Ubrani argued, “where this gets hard for CISOs is enforcement. A ban on paper is easy to write. Enforcing it inside a corporate office is already difficult, since most current-generation devices, including Meta’s Ray-Bans, are visually indistinguishable from ordinary eyewear.”
And, he added, “enforcing it in a hybrid or work-from-home setting is close to impossible. IT has no practical way to confirm what someone is wearing on a home Zoom call, and even in-office detection options, like scanning for Bluetooth or BLE advertising signals tied to known manufacturer IDs, only catch devices that haven’t been reconfigured or that happen to be broadcasting at the time.”
Additional risk
Connected glasses have a history going back decades, but enterprises didn’t take them seriously until this year.
But Anshel Sag, principal analyst at Moor Insights & Strategy, characterized the problem as more psychological than technological.
“People want to ban it because they don’t know how to handle it. But that just creates more problems than it solves. It’s a very kneejerk fear reaction,” Sag said. “We live in an era where cameras are everywhere.”
Meghan Hollis, a senior principal analyst for Gartner, agreed that the focus on smart glasses is misplaced, given that even headphones can today capture audio for translation and transcription. The change is not in the data capture, Hollis said, but the fact that it is adding video.
This creates additional risk, with the new capability brought into the corporate environment causing “a potential exposure for corporate intellectual property,” Hollis said.
One other often-overlooked issue is data sovereignty. Even if the glasses manufacturer agrees to store data only in specific countries, it could easily change that policy or simply switch third-party vendors.
“There could be export control issues, possibly violating regulatory controls in transmitting information,” Hollis noted.
However, Hollis said, threatening to punish workers if they are caught using unauthorized devices “is your last line of defense,” and that the best initial approach should not be enforcement, but education.
“You need to be educating your end-users, with constant reinforcement, telling them, ‘If you do this, here’s how you can harm the company and our clients/customers.’ Combine that with, ‘And if you do this, we will take action against you.’”
Tiered policies required
Hollis noted that the risk goes beyond an employee initially recording something they shouldn’t. Consider, for example, a technical meeting where an employee asks the rest of the attendees for permission to record the discussion. They agree and he starts to record.
At the end of the meeting, he leaves to return to his office, fully intending to turn off the recording function when he gets there. But on the way, he has a brief hallway meeting with an SVP who tells him, without warning, “FYI, but the board just decided to greenlight our hostile takeover of Smith Corp. We’ll explore the specifics at a 10 a.m. tomorrow. Have your team there.” The executive then walks off.
With the recording still running, that ultra-sensitive data has just been transmitted to the cloud.
IDC’s Ubrani pointed out that situations like this make smart glasses governance more challenging. “Enterprise IT and security leaders need to stop framing this as ‘ban versus allow,’ and instead build a tiered policy based on where the actual risk sits,” he said. “Boardrooms, R&D labs, and any space where trade secrets or regulated data are visible or discussed out loud deserve strict no-wearables rules, enforced the same way phone bans already are in those rooms.”
Open floor plans and general office space probably don’t need that level of restriction, he said, but meeting policies should require disclosure when a device capable of recording is present, similar to the way in which some companies already handle personal recording devices in sensitive briefings.
“Companies that try to write one blanket rule for every environment are going to find it’s either unenforceable or so restrictive it interferes with accessibility, since some employees rely on these devices as assistive technology,” he said.
However, Brian Jackson, a principal research director at Info-Tech Research Group, argued that enterprise CISOs and IT Directors need to take a far more strict position.
“Organizations should update their acceptable use policies for personal technology ASAP,” he said. “Look back about 15 years ago at how smartphones moved from consumer life into the workplace, and we may be at the beginning of a redefinition of BYOD here. But it needs to start with an extremely restrictive policy against the use of AI wearables and similar devices.”
He added, “organizations need to hold the line against making personal recordings in the workplace and maintain not only their compliance standards, but their workplace culture. This restriction cannot go as far as an outright ban; look at how Walt Disney World got caught up in a lawsuit after telling an employee she could not use Meta glasses. Still, this exception can be made narrow, and it should be made clear that other employees must be alerted when they are being recorded.”
EU tech regulation, Digital Markets Act, Apple Europe sales, Apple regulation, European Union, Siri AI, iPhone features, device interoperability, App Store changes, alternative marketplaces, iPhone Mirroring, AirPods translation, Apple privacy, iPhone security, app sideloading, platform competition, DMA compliance, Apple Intelligence, European technology, government control
EU tech regulation is no longer limited to App Store payment rules or competition disputes hidden from ordinary consumers. It is beginning to determine which features reach European devices, how quickly they arrive and how deeply third-party companies can interact with the iPhone, iPad and Mac.
The Digital Markets Act was designed to reduce the control of large technology platforms over software distribution, payments, browsers, digital assistants and connected hardware. For Apple, compliance has already produced alternative app marketplaces, web distribution, third-party payment options, additional default-app controls and expanded access to iPhone technologies.
The next phase reaches much deeper into the operating system. European regulators want competing accessories, cloud services and AI assistants to receive access to capabilities traditionally reserved for Apple’s own products.
Apple argues that some of those demands could weaken privacy and security. The European Commission says the company is responsible for creating compliant systems that preserve both competition and user protection.
Between those positions sits a large and commercially significant group of customers. Europe generated $28.06 billion in Apple sales during the quarter ending March 28, 2026, up from $24.45 billion one year earlier. Six-month European sales reached $66.20 billion, compared with $58.32 billion during the same period of fiscal 2025.
Europe therefore represented more than one-quarter of Apple’s latest quarterly revenue. It is too valuable to leave behind, but increasingly difficult to serve with the same software experience available elsewhere.
EU Tech Regulation Is Splitting Feature Availability
Regional differences once centered mainly on language support, licensing agreements or local services. EU tech regulation is creating a more structural divide.
Apple has blamed Digital Markets Act requirements for delaying Siri AI across the European Union. The company says regulators expect competing AI assistants to receive extensive access to personal information, apps and device actions before Apple can reserve those capabilities for its own assistant.
The disagreement concerns more than answering questions. Siri AI is designed to read personal context, understand onscreen information and complete actions across apps. That may include finding messages, accessing files, making purchases or sending information on the user’s behalf.
Opening those capabilities to outside AI systems requires new permission structures, technical interfaces and safeguards. Apple says it cannot release its assistant first and add competing access later without risking regulatory action. The Commission says Apple had sufficient time to design an interoperable solution.
Other delayed European features have included iPhone Mirroring on Mac, Live Translation through AirPods and certain location-based Maps capabilities. Each feature touches a different part of the ecosystem, but all depend on privileged communication between Apple devices, software and services.
The consequence is becoming visible at purchase. Two customers can buy the same iPhone model at similar prices and receive different capabilities because one lives inside the European Union.
Image Credit: Apple Inc.
Feature Adoption Becomes Slower and Less Predictable
Delayed availability can weaken the adoption of new hardware features even when the devices themselves continue selling well.
Siri AI is intended to become a central part of newer iPhones, iPads and Macs. Buyers who cannot access it lose part of the justification for newer chips, additional memory and on-device AI processing. Developers also face a smaller addressable audience for apps built around the new assistant.
AirPods Live Translation presents a similar problem. A feature designed to demonstrate the combination of iPhone processing, microphones and wearable audio becomes unavailable in a region built around dozens of languages and frequent cross-border travel.
iPhone Mirroring affects the relationship between iPhone and Mac. Users outside the EU can interact with the phone from macOS, while European users may receive notifications without gaining the complete experience.
These differences do not necessarily stop hardware sales. Apple’s newest results show strong European demand despite years of regulatory conflict. They can, however, reduce the speed at which customers use the ecosystem’s newest capabilities.
The effect may grow as software becomes a larger part of hardware differentiation. A faster processor has limited emotional value when the feature designed to demonstrate it is unavailable.
Apple Sales Show Why Europe Cannot Be Ignored
Apple does not report European Union revenue separately. Its Europe segment also includes countries outside the bloc, along with India, the Middle East and Africa. The official segment remains the best regularly published measure of the region’s commercial weight.
European sales rose approximately 15% year over year in Apple’s latest reported quarter. During the first six months of fiscal 2026, the segment expanded by roughly 14%.
Those figures weaken the argument that regulation is already driving customers away from Apple hardware. Demand remains strong, supported by the iPhone 17 family, Mac sales, services and the company’s installed base.
The financial risk is more gradual. Regional software fragmentation can raise engineering costs, delay launches and make European devices less competitive against products able to offer complete feature sets.
Apple must maintain separate distribution rules, payment systems, browser options and eligibility checks. Developers must decide whether alternative stores, external payments or EU-specific business terms justify additional work. Support teams must explain why features differ between countries using the same operating-system version.
A market responsible for more than $28 billion in one quarter can absorb considerable compliance expense. It can also influence Apple’s global product decisions when regulators demand interfaces that cannot be restricted to Europe easily.
A Slow Transfer of Ecosystem Control
The escalating regulatory environment also creates a more fundamental concern: control over complex technology ecosystems can gradually move away from the companies that designed them and toward government committees, regulatory bodies and administrative processes.
That transfer rarely happens through one dramatic order. It develops through repeated obligations covering app distribution, payment systems, browser engines, digital assistants, hardware access, data portability and interoperability. Each requirement may appear narrow when considered alone. Together, they can redefine who determines how the ecosystem operates.
Apple built its platform around tight integration between hardware, software, services and security. Regulators increasingly treat parts of that integration as market power that must be opened to competitors. The danger is that an ecosystem designed as one coordinated environment becomes subject to decisions made by committees that do not carry direct responsibility for product quality, reliability or long-term maintenance.
This can become a slow trap. Once a platform is required to expose one layer, regulators may use that access as the basis for demanding another. A payment exception can be followed by alternative app stores. Alternative stores can lead to broader installation rights. Device interoperability can expand into access for AI assistants, personal data and system actions.
The boundaries of the platform are then set less by engineering judgment and more by regulatory negotiation.
Government agencies have legitimate authority to address competition and consumer harm. The concern appears when regulation shifts from preventing abusive conduct to directing product architecture. At that point, public authorities begin influencing feature design, release timing, software permissions and the relationship between first-party and third-party services.
That creates consequences beyond Apple. Any company considering a tightly integrated product may decide that deep integration invites intervention. Businesses could avoid building ambitious ecosystems if successful coordination later becomes grounds for forced access.
Innovation then becomes shaped by what regulators are likely to permit rather than by what engineers believe will produce the safest or most coherent experience.
Image Credit: Ink Drop / Alamy Stock Photo
Competition Gains Come With Real Consumer Choices
EU policy has produced benefits that Apple rarely emphasizes. Users can install apps through alternative marketplaces or directly from authorized developers. Developers can offer external payment methods, promote different prices and avoid relying entirely on Apple’s distribution system.
Alternative browser engines can compete with WebKit, while users have more control over default apps. Contactless payment access has expanded beyond Apple Pay, allowing competing wallet providers to use the iPhone’s NFC technology under approved conditions.
Interoperability requirements could also improve third-party accessories. Smartwatches, headphones and other devices may gain better notification access, background connectivity and proximity pairing with the iPhone.
These changes can increase competition and reduce the advantage Apple gives its own services and accessories. A third-party smartwatch should not become artificially less useful simply because it was not made in Cupertino.
The difficulty is separating legitimate platform access from unlimited access. A notification interface is one thing. An autonomous AI assistant capable of reading messages, accessing files and acting across apps introduces a different level of sensitivity.
Privacy and Security Risks Are Not Theoretical
Alternative app distribution increases user choice, but it also moves some responsibility away from the App Store. Apple continues to notarize apps distributed through approved alternative channels, checking for known malware and severe fraud. That process is narrower than a complete App Store review.
Purchases made outside Apple’s payment system also fall outside its normal refund and billing support. Users may need to resolve disputes directly with the developer or payment provider.
A malicious marketplace, deceptive payment page or compromised developer account can create opportunities for fraud. Enterprise users face additional concerns when employees install software from sources their organization has not approved.
The AI question reaches further. A third-party assistant may need permission to access messages, photos, calendars, documents and app controls. Even a reputable provider can collect more information than the user expects or introduce vulnerabilities through poorly designed integrations.
Apple can build permission prompts, app isolation and revocation controls, but technical access always creates some exposure. Security depends on how narrowly permissions are defined, how visibly they are used and whether the operating system can stop unauthorized actions.
The Commission maintains that interoperability and privacy can coexist. Apple maintains that regulators are demanding access before adequate protections are ready. Both positions contain a legitimate concern: dominant platforms should not block competition, and competition should not require users to surrender control of personal data.
When regulators require a company to alter its architecture, responsibility can become blurred.
Apple remains the company customers blame when an iPhone feature fails, a third-party marketplace distributes a harmful app or an outside assistant misuses personal data. Regulators may have required the access, but they do not operate the device, provide technical support or repair the damage to the platform’s reputation.
This creates an accountability gap. Government committees can mandate openness without assuming the commercial and security consequences of that openness. Apple must comply, maintain the system and explain the outcome to users.
The same problem applies to delayed features. Regulators may argue that Apple chose not to release a service, while Apple may argue that the required conditions made the launch unsafe or technically impractical. Customers are left with less functionality and no simple way to determine who caused the delay.
Over time, the ecosystem can become a negotiated compromise rather than a product with one coherent direction. That may satisfy formal compliance while producing a weaker experience for everyone involved.
The risk is not that governments will literally operate Apple’s software. It is that committees increasingly define the conditions under which Apple can design, connect and release its own features. Control shifts through constraints.
The Industry Will Follow Europe’s Experiment
The consequences extend beyond one company. Google, Meta, Microsoft, Amazon and other platform operators face related European obligations. Hardware makers must consider whether ecosystem advantages can survive when core services are required to support rivals.
Smaller developers may gain new distribution and payment choices, but they may also inherit more compliance, customer-service and security responsibilities. Accessory companies could compete more effectively while becoming accountable for handling sensitive device data.
Other governments are watching. Rules introduced in Europe can influence legislation elsewhere, particularly when companies decide that maintaining one global technical framework is easier than operating several regional versions.
Apple is unlikely to abandon Europe or stop adapting its products. Its sales provide too much evidence of the region’s importance. The company will continue negotiating, appealing decisions and building compliance systems while withholding features it considers unsafe under current demands.
European customers may receive more app stores, payment choices and accessory compatibility. They may also wait longer for headline features included with the same hardware elsewhere.
The deeper consequence may be a technology industry that becomes more cautious about building tightly integrated products. Companies may design around anticipated regulatory demands from the beginning, limiting exclusive features, reducing private-system integration or avoiding innovations that depend on controlled access.
EU tech regulation began as an effort to constrain dominant platforms. Its long-term effect may be to transfer part of the power to shape those platforms from companies and users to regulatory institutions.
That shift deserves scrutiny equal to the market power it is intended to correct. Competition rules can restrain abuse. They can also become a slow mechanism for placing product design, security choices and ecosystem evolution under government supervision.
Shady Control and Bureaucracy
The danger grows when regulatory discretion becomes buried beneath permits, approvals, negotiations and technical committees that operate beyond meaningful public scrutiny.
The more power officials hold over which features, contracts or technologies may proceed—and when—the greater the opportunity for lobbying, favoritism and selective enforcement to influence outcomes. What begins as oversight can gradually become a system in which delay itself is leverage, while responsibility disappears inside layers of administration.
For the technology industry, that risks replacing transparent product decisions with political access, negotiated exceptions and regulatory influence exercised far from the consumers expected to live with the consequences.
Google, Microsoft, OpenAI, and others want to help enterprises demonstrate that their AI applications are behaving themselves through the creation of a new foundation.
The Appia Foundation will, it explained rather impenetrably, “establish modular specifications that provide a connecting layer to bridge foundational global standards with practical, trusted assessments across the global AI value chain.”
Those specifications will help AI users ascertain whether the systems they are using meet all the obligations that apply to them in the form of standards and regulations, it said. It’s a challenging task with so much regional variation in requirements, and where the EU, for example, is more tightly controlled than the US.
The Foundation has established a set of criteria to demonstrate conformity with what is expected. There are two layers: the Requirements and Guidance layers will help users determine what is actually required, while the Assessment Enablement layer will look at how those requirements are evaluated.
Appia stressed that what it is offering are not standards — which are set by recognized international bodies such as ISO/IEC — but a means of assessing what those standards mean and how they can be used by organizations. However, the Foundation said that some of the criteria that it is introducing may become standards themselves after a period of time.
The Appia Foundation is hosted by the Linux Foundation’s Joint Development Foundation, and its other members include Arm, Ericsson, Mastercard, Mitsubishi Electric, Omron, Schneider Electric, and Siemens. It is also looking to bring academics and government into the fold, so that it can establish an advisory board.
The age-old IT defense when compliance violations are investigated by regulators is to try and keep a low profile — and hope no one looks too closely. But with enhanced SEC interest in all data breaches encouraging regulators around the globe to take those closer looks at IT, data breach disclosure rules are becoming more strict.
While that might be unsettling for cybersecurity executives, it is also disturbing news for IT admins, who could find themselves under a remarkably uncomfortable spotlight.
Consider this recent move by the New York State Department of Financial Services against the Delta Dental Insurance Company. State officials hit the insurance company for improper and inconsistent enforcement of its own data retention policies; improper incident response plan protocols; and improper notification of the security incident itself.
The company was fined more than $2 million.
The data retention violations are perhaps the most problematic. Had that policy been enforced properly, much of the stolen data would have been destroyed long before the attackers could have accessed it.
It’s not simply a matter of whether the IT rules for retention were sufficiently strict. Some regulators — and especially the US Federal Trade Commission (FTC) — focus extensively on companies who don’t do what they say publicly. If a corporate website promises something to customers, the FTC will hold companies to their word.
Think about that the next time you assign a summer intern to handle your website’s copy.
Inconsistent implementation of data retention policies can deliver other legal headaches. Having a good policy approved by the general counsel is fine, but it means nothing if all of your people do not follow it strictly.
Let’s say one of your business units is being sued for having done something naughty. Opposing counsel subpoenas your business records, including emails from a few years ago. Your attorney responds that those email records no longer exist; they were deleted last year in accordance with corporate policy on data retention that says everything of a certain nature has to be deleted after one year.
Fair enough. But what if opposing counsel in a deposition asks,“Really? Does that policy apply to all records of that nature?” You say that it does.
“It might interest you to know that we have sworn testimony from four other employees who showed us emails of the same nature that were more than five years old. So why did you adhere to your policy regarding emails that might prove the fraud but somehow you did not delete others? Sounds a little selective, no? I think the judge would agree.”
In the dental case, the company had a strict policy on retention rules. But corporate software was programmed with “the ability to shorten, extend, or disable MOVEit Transfer’s default retention settings on a folder-by-folder or file-by-file basis.”
The regulators then swooped in because the insurance company “had no written policy or procedure for requesting, reviewing, or approving such changes to folder retention settings.”
The best retention policy would, in theory, have no exemptions. But if you’re going to allow exemptions, you need a precise policy documenting how and when they can occur. There should be a required form so that a manager can write out the reasons for this specific exemption.
The New York state document is an important one to carefully review; it provides an excellent roadmap to how compliance can go wrong — and useful information on how to keep something similar from happening to your company.
Login
