Everybody is watching to see what comes from Apple at its annual Worldwide Developer Conference (WWDC) today. There’s a great deal at stake, as when it comes to artificial intelligence (AI) today’s event represents an existentially important moment for the company.
Apple execs absolutely must convince developers, industry watchers, users — all of us — that it has learned from its well-publicized mistakes of the past two years and put together a serious proposition for AI across its platforms.
Right now, we think Apple intends to offer a hybrid of its own self-developed AI tools and services combined with others made with Google Gemini — all supported by an open approach to using AI services from third-party providers such as Anthropic or OpenAI.
When it comes to implementation, this should mean a contextually sensitive Siri that can respond to what you have on the screen of your device, or in the viewfinder of your camera app. The idea here is that you’ll be able to do contextual tasks like book restaurants or send a message to your granny, translate a sign, or even navigate around a room. More than this, you should also be able to combine tasks giving Siri complex — agentic AI — tasks it can then transact on your behalf.
Many of these functions will take place on device. Some will rely on Apple’s own fleet of Private Cloud Compute servers, supported by additional capacity from Google and Nvidia. When Apple Intelligence/Google Gemini can’t accomplish a task, you’ll be able to request that another service handle it on your behalf outside Apple’s managed garden. Siri itself will also gain a brand new interface.
As discussed here, developers expect Apple will make access to many of its new Apple Intelligence APIs available to them. This will let them deploy useful functionality in their apps at no charge, in part because the intelligence takes place on the device.
It will also be possible for developers to permit their apps to run without being opened, which means a user should be able to ask Siri to do complex tasks that also include functionality from their apps. During this past weekend, we were warned that some or all of the new Siri functionality might be introduced on a staggered basis using a waiting list.
Apple has come a long way since that tense meeting in early 2025 when the company’s senior leadership established a new approach to AI. With Apple CEO Tim Cook taking an uncharacteristic interest in driving his teams to pull their act together, Apple developed a new, partnership-based approach to try to recapture lost ground.
Has Apple finally regained the initiative?
To a great extent, that will be the big focus across the industry once the company tells us what it’s done. Cook’s final WWDC as CEO sees a company at the absolute top of its game in so many ways, including soaring Mac sales. But to some extent he will be judged on how successfully Apple’s AI pivot comes across.
Weekend analyst notes summed it up, with bears and bulls tossing insights along. In one camp, you’ll find the true believers who argue that if Apple does come to us with something convincing, it has a chance to absolutely dominate consumer AI. “Siri/Apple Intelligence 2.0 has the potential to become the ultimate AI resource offload and deliver a form of Agentic AI to the consumer at a lower cost than incumbents,” said Morgan Stanley analyst Eric Woodring.
Cynics, however, warn that Apple really must demonstrate the kind of contextual, agentic AI it first announced (and failed to ship) two years ago; they want a chatbot with muscle, and will see right through any attempt to place a PR veneer over something weaker than what others already provide. If Apple fails to deliver on this, it can expect its stock to be utterly savaged over the next few days, though some analysts believe that Apple’s previous missteps mean the damage is already priced in.
Ultimately, of course, in addition to convincing industry watchers, Apple will need to find a way to deliver the kind of AI power consumers have been told to expect — while also protecting privacy. If it does get that right, particularly if it truly exploits its powerful hardware to ensure the most common tasks take place directly on the device, it has a major opportunity to deliver a form of Agentic AI at a lower cost than incumbents can. And it can do so while leaving the core AI bubble to burst as and when it will.
Will Apple succeed? We’ll know in a few hours, when you should check back for first takeaways on what Apple has to share. Join me on the Core for the headline summaries.
You can follow me on social media! Join me on BlueSky, LinkedIn, Mastodon and The Core.
© Jes Aznar for The New York Times
The European Commission published its tech sovereignty package last week, including the clearest signal yet of its intention to strengthen European cloud sovereignty and reduce its dependence on US hyperscalers.
It’s a response to growing concerns among European organizations and regulators about the reliance on US tech firms and legislation such as the US CLOUD Act, which could give US officials access to data — even if it is stored in Europe.
But any shift toward local, sovereign cloud providers will necessarily be gradual, analysts, said as the Cloud and AI Development Act (CADA) proposals leave plenty of room for US providers to continue supplying cloud computing services to European public sector customers.
“The direction is right. The execution will be slow,” said Fernando Pereiro, senior director analyst at Gartner.
While the Commission has correctly identified areas where the EU is most dependent on foreign providers, delivering on its ambitions is another challenge, he said. Scaling alternatives to US suppliers “takes time, capital, and coordination at a level that is difficult to sustain in Europe.”
Dario Maisto, senior analyst at Forrester, played down the prospect of a major short-term shift towards European cloud providers as a result of the CADA proposals, even after recent interest in local European vendors for mission-critical workloads and highly sensitive data.
“I do not expect an immediate impact on the cloud infrastructure market,” Maisto said. “Full-blown migrations are costly and take several years. They are not going to happen in the near future.”
Instead, Pereiro expects the gradual emergence of “sovereign enclaves” or controlled environments for sensitive workloads, particularly in government and regulated sectors. “Outside of those areas, the market will remain global, but increasingly shaped by European rules,” he said.
Nevertheless, the three US hyperscalers that account for around 70% of the European cloud market – Amazon Web Services (AWS), Google, and Microsoft — will likely see a more competitive environment.
“The real shift is symbolic and structural: hyperscalers move from being the default choice to one option among others, and their competitiveness will increasingly depend on how well they align with European control requirements, not just on technology or price,” said Pereiro.
CADA is part of a range of policy and legislative proposals — known as the Tech Sovereignty Package — published by the Commission, alongside Chips Act 2.0, the Open Source Strategy, and Strategic Roadmap for Digitalization and AI in Energy.
CADA includes measures to boost European tech sovereignty. Among other things, it aims to triple data center capacity in the next five to seven years by easing restrictions on new infrastructure projects across the EU, as well as efforts to support research and development of cloud and AI technologies.
It also includes a sovereignty framework that, if enacted, would require EU public bodies to assess sovereignty risks and procure cloud services that meet four assurance levels.
The various levels portray “a political vision with many open questions,” said Maisto. In more detail:
The first two levels could be open to US hyperscalers, said Maisto, with 70% of existing EU public sector workloads falling under Level 1 and 20% at Level 2, according to Commission’s own impact assessment. Just 9% of the workloads would require Level 3.
The most stringent Level 4 would require cloud providers that “have full transparency and control over their software supply chain and no interference from a third country,” the Commission said.
For public sector organizations, the CADA rules could create more clarity around procurement, said Pereiro. “Today, the concept of ‘sovereign cloud’ is often vague and inconsistently applied in providers’ marketing and messaging,” he said. “This package standardizes what sovereignty must look like in practice, effectively ending the era of ‘sovereign washing.’”
The proposals give public sector organizations a “stronger set of requirements with which to assess risk, especially around jurisdiction and access to data,” he said.
“For enterprises, it’s less about regulation and more about leverage,” said Pereiro. “They gain clearer benchmarks and more viable alternatives, particularly through open source and emerging European providers.”
The Cloud Infrastructure Services Providers in Europe (CISPE) — a nonprofit trade group — welcomed the “strong definitions” of Levels 3 and 4, and said that, if implemented well, the proposed rules could “help to challenge the commercial dominance of established foreign cloud and AI vendors.”
However CISPE also called the current Level 1 and 2 criteria “confusing and non-sensical,” and said they should not be designated as “sovereign” since US hyperscalers can meet the requirements. “This will continue to confuse the market, both public and private customers, and encourage more sovereignty washing attempts,” CISPE said in a blog post Thursday.
CISPE also said the proposals fail to require public authorities to check whether a European service exists before opting for a foreign supplier. “We see a significant risk that assessments become a ‘rubber-stamp’ exercise that allow IT departments to continue to buy non-sovereign services out of convenience,” the organization said.
French firm OVHcloud — one of the leading European cloud computing and web hosting companies — welcomed the proposals, though it said any rules must be carefully scoped to ensure they are effective.
“This text is a step in the right direction and represents an opportunity to strengthen European strategic autonomy — something unthinkable just a few years ago,” an OVHcloud spokesperson said. “It provides a useful framework, but one that must not leave too much room for exceptions and workarounds.
“Europe must and can move much faster, with very clear rules and a genuine European preference. Beyond this text, the Commission has demonstrated with its sovereign procurement call that it is possible to act right now to reduce critical dependencies. The time for waiting is over. We must accelerate. We must clarify. We must own it.
“Europe has the players and the expertise,” the spokesperson said. “It is time to turn political ambition into European industrial capability.”
The overall tech sovereignty package “marks the overdue shift from diagnosis to treatment,” said a spokesperson at Ionos, a German cloud and hosting company. Ionos pointed to the EC’s claims that more than 80% of digital products, services and infrastructures in the EU originate from non-European providers, while 264 billion euros flow from EU organizations into predominantly US-based IT products.
“This is a strategic failure that must now be corrected,” the spokesperson said. While the company applauded the Commission’s focus on “secure and sovereign cloud and AI infrastructure for highly critical use cases,” it argued the CADA proposals fall short. “The central weakness of the package: the approach remains predominantly supply-side. The decisive lever — the demand side – is missing. Public procurement is the most powerful instrument for digital sovereignty. The public sector as anchor customer is critical for scaling sovereign cloud and AI solutions.
“Europe will remain dependent on Nvidia and AMD for GPU computing, the spokesperson said. “What matters is not whether to cooperate, but on what terms: data under European law, operations by European providers, no extraterritorial access. …If EU funding earmarked for ‘sovereign cloud’ ends up with the European subsidiaries of US hyperscalers, the package will have failed its objective.”
The proposed rules could require hyperscalers to change tactics to cater to European customers, or to at least ramp up existing sovereign cloud strategies. “For vendors, this is essentially a shift in what ‘competitive’ means,” said Pereiro. “For the last decade, scale and hyperscaler alignment were enough. That’s no longer the case.”
Cloud providers will need to demonstrate real control over data, infrastructure, and operations, he said, and not just label solutions as “sovereign.”
“The bar has been raised, and some existing offerings simply won’t clear it,” he said.
While the CADA rules are designed to favor European providers in some cases, the proposals stop short of barring US providers from public sector contracts. “It doesn’t shut them out,” said Pereiro, “but it changes competitive conditions substantially.”
The proposed procurement requirements make sovereignty a “gating factor” for sensitive workloads, said Pereiro, and “create real friction for providers whose operating models depend on centralized control or non-EU jurisdiction.”
US hyperscalers publicly welcomed the proposals, and indicated plans to work with policy makers and ensure the importance of customer choice in cloud service procurement.
“We look forward to reviewing the proposed rules and continuing to work alongside our partners to ensure European organizations have the power of choice and sovereign control,” a Google spokesperson said.
An AWS spokesperson said the company has invested ”tens of billions of euros” in European cloud infrastructure, which it claims has “already advanced the continent’s competitiveness, helped organizations innovate and grow, and supported the development and resilience of both public and private services that Europeans now rely on every day.
“European organizations deserve access to the best technology available from trusted providers, chosen on the basis of security, performance, verifiable controls, and value,” the AWS spokesperson said. “We look forward to working with policymakers to ensure the Cloud and AI Development Act promotes technology choice and rewards long-term investment in Europe’s digital future.”
A Microsoft spokesperson said the company shares the EU’s “ambition to strengthen technological sovereignty and global competitiveness in AI, grounded in openness, partnership and fair competition.
“Achieving this will depend on access to world-class infrastructure and technologies at scale,” the Microsoft spokesperson said. “That means enabling European companies and public administrations to make procurement choices based on a broad, risk-based assessment in an open and competitive market.
“Microsoft offers secure and sovereign cloud solutions that put customers in control, and we stand ready to help build a strong, resilient and globally connected AI ecosystem in Europe.”
While the proposals present potential hurdles for US hyperscalers, those that adapt to the new regulatory direction — and concerns of European organizations — will benefit, said Pereiro. “If your offering aligns with sovereignty requirements, your company will be likely to see more opportunities, not fewer,” he said.
Technology companies announced 38,242 job cuts in the US in May 2026, the highest monthly total for the sector since August 2024, according to research by employment placement company Challenger, Gray & Christmas. So far this year the company has observed 123,653 US technology job cuts, a rise of 66 percent from the same period in 2025.
These figures represent the third successive month that there has been an increase in job layoffs across all sectors, the company said.
“The labor market is being reshaped by technology in real time. AI is now the leading reason companies give for cutting jobs and the primary industry citing it is technology,” said Andy Challenger, chief revenue office at Challenger, Gray and Christmas.”
AI was blamed for 38,579 of the 97,006 job cuts announced across all industries tracked by the company. It accounted for 40% of the cuts observed in May, up from 7% in January.
This year has already seen some major layoffs in technology. In March, HPE slashed 2,500 jobs from its wage bill, while Oracle announced plans to shed an unspecified number of developers. And the cuts keep on coming, just last month, Meta shed 8,000 employees.
As we lean into WWDC, three strategically brilliant Apple moves have been exposed in the last couple of weeks, two of which will have immense consequences in the coming year, while one sets the scene for essential future growth.
In each case, Apple’s leadership has found counter-intuitive gambits that actually secure the company’s future. Let’s start with Vision Pro.
News this week is that incoming CEO John Ternus has made some tough decisions around Apple’s approach to spatial computing, terminating development of Vision Pro (even as leaked images of a black model emerge) while focusing R&D on two smart glasses projects to compete with Meta.
The intention is to introduce XR and AR glasses priced at around $300 to $500 each. While not as richly-featured as the Vision Pro, they will be within the reach of more people and draw deeply on the huge R&D effort that went into the original Apple AR visors. Apple hopes a focus on trust and privacy will be enough to push Meta aside, helping Cupertino dominate this part of the category. If that plan succeeds, don’t be at all surprised to see plans for Vision Pro 2 return to the table, though that’s not the focus now.
Apple frequently described the Vision Pro as a product “pulled from the future,” a device for enterprise users and early adopters. For many such users, the existing product will be useful in their work for time to come.
What’s strategically solid about this is that Apple has now defined a good future for spatial computing and is bringing components of that future to the mass market on the basis of a provable technology you can already try for yourself in any Apple Store. This is a long game, and while it will take time to play out, it’s a game the company has proved it can join.
Apple has apparently chosen to use Nvidia and Google technologies to support at least some of the Apple Intelligence/Siri improvements to be announced at WWDC next week. This seems to fly against the company’s general approach to privacy on its platforms, with the silicon, operating system and — thanks to Private Cloud Compute — the cloud all in its control.
How, you might ask, can Apple ensure privacy when using third-party infrastructure to manage some AI transactions? How can it do so without damaging its trusted brand?
One direction that makes sense is to consider that Apple and its partners have reached consensus on what privacy should be and how it should be delivered. That’s a very important consensus, as it suggests Apple is building an approach that makes privacy an attestable standard.
The company has been pushing governments for years to agree to such standards, but all it seems to have had in return are continued government attempts to erode personal privacy. That’s particularly evident in the UK government’s egregious move to undermine encryption to the detriment of all. (The UK isn’t really alone in preferring surveillance above liberty.)
Android developer Google has had the same experience, and while its approach to privacy differs from Apple, both companies understand the need for encryption. As such, any form of consensus on some form of privacy standards is welcome — and while I’d very much prefer an enforceable, verifiable approach, some industry agreement has to be better than nothing at all.
While I don’t believe Apple’s approach to privacy in the new breed Siri/Apple Intelligence will be introduced in this way at WWDC, it will be interesting to see what does emerge from the new tech triptych (Apple, Google, Nvidia) in the coming months. Certainly, all three have a great interest in guarding encryption against Quantum attacks for which hidden backdoors would be easy pickings.
Apple has won the PC war.
That last point needs explanation: Apple’s entry-level MacBook Neo also has just 8GB RAM, but it also has custom-designed Apple processors and an operating system optimized to run on the hardware. That means those Macs use memory far more efficiently than their competitors.
So, you can pick up some mass market Windows laptops for $800 that hold just 8GB memory, or spend $699 for a MacBook Neo with double amount and that can also run Windows in VM extremely well.
Component prices are not going to shrink back for a while, any more than further magical thinking is going to end the war in Iran. At this point in the cycle, Apple has the PC market advantage. Millions are purchasing its entry-level Mac and the vast majority of those new users will love the platform, as new users usually do. That’s going to lead to a spike in Apple services sign-ups, and prompt solid future upgrade and accessory sales cycles.
Apple accomplished this by selling a low-cost Mac at a time when competitors face existential problems maintaining their grip on the mid-range market. The longer Apple holds prices on the device, the greater the advantage it builds, while applying huge pressure on PC competitors.
With the Mac hitting its iPod moment as it achieves mass market sales, Apple finally seeing something like progress in its attempt to secure privacy in a digital age, and a strong position from which to grow in the wearables market, the company has played a fine hand.
That’s even before it introduces us to its improved Apple Intelligence, and an era of AI access in which many everyday tasks take place token free directly on the device. Indeed, when it comes to AI, if it gets things right at WWDC, Apple appears to be making money, while AI competitors are bleeding financial oxygen as their inflated bubble heads to its inevitable demise. What about the enterprise? Take a look at this chart.
You can follow me on social media! Join me on BlueSky, LinkedIn, Mastodon, and follow The Core.
Forget “Florida Man.” Want to hear a California Man story?
Here goes.
A California man rolled up to a yoga studio in San Francisco’s Marina District in a self-driving Waymo car, walked into the studio, grabbed an armful of yoga shorts, got back in the Waymo and took off.
Six months later, police still haven’t found him, according to a story this week in The San Francisco Chronicle. Since the rider’s credit card information didn’t lead to an arrest, we can assume the perp used a stolen phone’s Waymo account and financial information to hail the ride. And by the time police requested interior video of the man’s face, Waymo had already deleted it.
This is a “California Man” story in part because of the association of Waymo with the city of San Francisco. Soon that association will be obsolete. (In fact, while Waymo is headquartered in San Francisco and is more visible there, Arizona got Waymos two years before San Francisco did.)
At the moment, Waymos are publicly available to riders in 11 US cities — San Francisco, Phoenix, Los Angeles, Austin, Atlanta, Miami, Orlando, Dallas, Houston, San Antonio, Nashville.
Before long, riders will be able to enjoy robot car rides from Waymo in Las Vegas, San Diego, Washington DC, Denver, Detroit, Baltimore, Boston, Charlotte, Chicago, Minneapolis, New Orleans, New York, Philadelphia, Pittsburgh, Sacramento, Seattle, St. Louis, Tampa, London, and Tokyo.
Historically, Waymo has been taking a bath on rides.
(I’m not talking about recent stories where Waymo cars have driven onto flooded roads. On May 12, Waymo issued a voluntary recall of 3,791 cars after a software defect allowed an autonomous vehicle in April to drive into a flooded, impassable roadway in San Antonio and be swept into a creek. A week after the recall, the company paused all freeway rides and suspended service in Atlanta, Austin, Dallas, Houston, San Antonio, and Nashville because of construction-zone navigation issues.)
To date, self-driving ride-hailing services like Waymo are a loss-leader business. Waymo is secretive about its costs, but independent estimates suggest that a $20 ride for the rider may be a $50-$100 ride for Waymo, when you factor in all costs.
But help is on the way.
A big part of why Waymo rides have been so costly is that the car is a retrofitted Jaguar I-PACE. It’s true that Waymo got a deal on the roughly $70,000 car (a steal at $50,000 per vehicle because the company bought thousands of them).
But then Waymo had to bolt on all kinds of costly sensors and electronics to make them self-driving, including a roof-mounted lidar assembly of five units, 29 cameras all around the car, six radar units, a custom Waymo-designed AI inference compute platform, and the wiring harness and power distribution system.
Estimates for the total cost per car for Waymo are in the $120,000 to $200,000 range.
Another problem is that the Jaguar I-PACE is notorious for a lack of reliability, especially involving its batteries and its longevity. Jaguar stopped making I-PACE cars two years ago.
Finally, Waymo can’t do what regular car owners do and sell the car to recover some of the initial investment. Nobody wants an electric car with a depleted battery covered in electronics and sensors that can’t be used.
The good news is that we learned this week that used Waymo batteries will be repurposed as backup storage for power grids in California and Texas.
The combination of growth and the end of manufacturing for the Jaguar I-PACE means that Waymo’s next platform is right on time. The car is called the Ojai, named after the unaffordable artsy hippie mecca located 80 miles northwest of Los Angeles.
Waymo announced last week that the company will soon open Ojai cars to free rides for select riders in San Francisco, Los Angeles, and Phoenix. (See this Redditor’s drone photos of the current fleet of Ojai cars in Mesa, AZ.)
The Ojai is a purpose-built electric minivan made by Zeekr, an arm of China-based Geely Automobile Holdings. It’s got doors that slide open like an elevator door, more legroom than the I-PACE, three screens for passengers, Braille instructions, grab bars, a flat floor with low-step height for easier entry, charge ports, cupholders, more cargo space, better batteries, faster EV charging, and easier cleaning and maintenance than the I-PACE cars.
It’s much cheaper for Waymo to buy — and much cheaper and faster to integrate Waymo electronics.
The Ojai gets Waymo’s sixth-generation Driver as a factory-co-engineered system with just 23 sensors (13 cameras, four lidar, six radar). While that’s far fewer sensors, they’re much more capable than the older generations of Waymo systems. One of my favorite details of the Ojai sensor package is that each car will have 10 sensor wipers with heaters and fluid sprayers specifically designed for snow, rain, and adverse weather. They’re like tiny, high-tech windshield wipers, but for the glass in front of the sensors. Ojai cars will likely do far better in rain and snow conditions.
Weirdly, the Ojai still has needless controls, like a steering wheel and gas and brake pedals. And the only reason for those is that the US Congress is asleep at the wheel. US. federal motor vehicle safety standards require steering wheels and pedals for street-legal vehicles, and neither NHTSA nor Congress has granted a permanent exemption for purpose-built driverless vehicles.
Despite the vestigial controls, the difference between the two cars is that the Jaguar was an old-school car designed for drivers, while the Ojai is the new concept for cars, one built for riders. And for riders, the Ojai is better in every way that matters.
There’s only one factor keeping Ojai cars from replacing the full Jaguar I-PACE: They’re made in China.
Waymo is getting around the 100% tariff imposed by the Trump Administration by “location-laundering” the build. Zeekr completes the Ojai shells in Gothenburg, Sweden, and because the “substantial transformation” occurs within the EU, the vehicles are classified as EU-origin products. The stripped-down gliders arrive with no modems, ECUs, or autonomy software, and Waymo installs all connected technology at its Mesa facility, which satisfies the Commerce Department’s 2027 and 2030 rules prohibiting Chinese-linked vehicle electronics.
Some lawmakers are using Waymo as a case study for general anxieties about Chinese technology infiltration into American infrastructure. The other problem is protectionism. If un-tariffed Chinese cars were allowed into the US market, the US car industry would likely be decimated by the competition. Chinese carmakers like BYD enjoy a 25% material cost advantage over Western carmakers. They would enter $5,000 to $10,000 cheaper than comparable U.S. offerings, according to some estimates.
So, Washington is jittery about Chinese-made cars.
I drove a BYD rental car in the UK last month. And I can tell you, they’re great cars and very enjoyable to drive. (My only complaint was that the steering wheel was on the wrong side.)
Instead of Waymo taking a risky bet on Ojai cars, they’re instead expanding with Hyundai Ioniq 5 EVs, which are produced locally and will be retrofitted with Waymo’s sixth-generation Driver at that Mesa facility. This is a massive deal in which Hyundai will supply Waymo with 50,000 cars by 2028.
Waymo hasn’t disclosed plans for Ojai cars, but it’s unlikely to even come close to the number of Hyundai cars it is on the hook for.
(The company also has around 100 Zeekr cars, but plans to expand that fleet to a few thousand.)
The right solution for Waymo’s next few years would be all Ojai cars with no steering wheel or pedals. The Ojai is purpose-built for autonomous car ride sharing, affordable, and capable in all weather. But that’s not going to happen because of Congressional inaction, China panic, and protectionism in Washington.
Instead, Waymo’s future is to use too many cars from the past, by which I mean much or most of its fleet will be driverless cars retrofitted from cars that prioritize the driver, rather than the passengers. And reports suggest that the price of Hyundai cars will be comparable to the overpriced Jaguars.
I’m sure the Hyundai Ioniq 5 will be nice. But an all-Ojai fleet would have been the better future for Waymo. Instead of the right car for the job, Waymo is stuck with an expensive, less comfortable, less capable car than the Ojai.
The age-old IT defense when compliance violations are investigated by regulators is to try and keep a low profile — and hope no one looks too closely. But with enhanced SEC interest in all data breaches encouraging regulators around the globe to take those closer looks at IT, data breach disclosure rules are becoming more strict.
While that might be unsettling for cybersecurity executives, it is also disturbing news for IT admins, who could find themselves under a remarkably uncomfortable spotlight.
Consider this recent move by the New York State Department of Financial Services against the Delta Dental Insurance Company. State officials hit the insurance company for improper and inconsistent enforcement of its own data retention policies; improper incident response plan protocols; and improper notification of the security incident itself.
The company was fined more than $2 million.
The data retention violations are perhaps the most problematic. Had that policy been enforced properly, much of the stolen data would have been destroyed long before the attackers could have accessed it.
It’s not simply a matter of whether the IT rules for retention were sufficiently strict. Some regulators — and especially the US Federal Trade Commission (FTC) — focus extensively on companies who don’t do what they say publicly. If a corporate website promises something to customers, the FTC will hold companies to their word.
Think about that the next time you assign a summer intern to handle your website’s copy.
Inconsistent implementation of data retention policies can deliver other legal headaches. Having a good policy approved by the general counsel is fine, but it means nothing if all of your people do not follow it strictly.
Let’s say one of your business units is being sued for having done something naughty. Opposing counsel subpoenas your business records, including emails from a few years ago. Your attorney responds that those email records no longer exist; they were deleted last year in accordance with corporate policy on data retention that says everything of a certain nature has to be deleted after one year.
Fair enough. But what if opposing counsel in a deposition asks,“Really? Does that policy apply to all records of that nature?” You say that it does.
“It might interest you to know that we have sworn testimony from four other employees who showed us emails of the same nature that were more than five years old. So why did you adhere to your policy regarding emails that might prove the fraud but somehow you did not delete others? Sounds a little selective, no? I think the judge would agree.”
In the dental case, the company had a strict policy on retention rules. But corporate software was programmed with “the ability to shorten, extend, or disable MOVEit Transfer’s default retention settings on a folder-by-folder or file-by-file basis.”
The regulators then swooped in because the insurance company “had no written policy or procedure for requesting, reviewing, or approving such changes to folder retention settings.”
The best retention policy would, in theory, have no exemptions. But if you’re going to allow exemptions, you need a precise policy documenting how and when they can occur. There should be a required form so that a manager can write out the reasons for this specific exemption.
The New York state document is an important one to carefully review; it provides an excellent roadmap to how compliance can go wrong — and useful information on how to keep something similar from happening to your company.
Apple’s latest Safari privacy campaign is more than pre-WWDC marketing. It is an early signal of how the company plans to frame artificial intelligence (AI): as something that only works if users trust the platform behind it.
The week before WWDC is often significant, as Apple tends to make announcements it simply can’t fit into the keynote itself. This year’s first pre-show reveal is a new campaign focused on privacy that shows how much more private Safari is than rival browsers; there’s even a highly entertaining video that makes the point.
Apple has been building privacy protections into Safari for years. The browser protects you from malicious scripts that might attempt to access passwords or credit card information. Safari also tells you what data an extension wants to access and can restrict access to match your settings. It blocks third-party cookies by default, detects and removes trackers, and has measures in place to prevent data companies from identifying — and following — you through device characteristics.
That’s even before Apple’s powerful Private Browsing mode, which includes meaningful protections. The company has put together a page packed with resources to explain the privacy protections it has in place across its platforms.
Privacy is critical to Apple — not only because the company regards it as a human right, but because it correctly recognizes that to make new generations of sensor-laden technologies it must ensure privacy is protected. Without privacy and trust, people won’t use the technology.
The truth is that people are becoming increasingly concerned about how the digital devices we depend on for convenience are now being used for different kinds of surveillance, and we need to be convinced that our personal data is protected. We do not want every aspect of our life to become fodder to feed a digital dystopia, even as we still want the positive solutions technology promises.
Think about the Apple Watch. Consider the data it gathers: distance walked, calories burned, and more — it’s a rich trove of personally identifiable data that no one really wants to share with others without consent. Apple Watch is not the only Apple device that is gathering information, even your web browser captures a great deal of it. Hence, the focus on Safari in Apple’s new campaign.
Privacy will become an even greater concern as AI spreads. Data brokering services already make extensive use of AI to analyze and identify patterns in the online data they harvest. AI deployed without strong privacy protections poses serious risks to the way we live, while the consolidation of AI ownership in the hands of a few companies risks creating dangerous imbalances of power. That’s the context in which private data needs to be protected, making privacy an essential component of a positive tech-augmented future.
Apple’s focus on privacy is far from new; it has been consistent in this work for many years. Competitors often accuse Apple of hypocrisy, but the company has been arguing for privacy’s importance for more than a decade. Others have adopted some of the same principles, though not all of them — and while Apple may sometimes use privacy as a moat for its own products and services, that does not diminish its value.
It’s with all this in mind that I consider Apple’s latest privacy ad campaign and its rollout just before WWDC, where it is expected to introduce new AI services. That Apple’s new privacy campaign seems not to have made the final cut for the show tells me the company has much more to discuss on the topic, particularly around Apple Intelligence.
When Apple introduces its new AI features at WWDC it will do so while celebrating the privacy built into them. The current privacy ad campaign will be part of an overall push as the company explains that its ecosystem can run third-party AI services while also offering its own bespoke Apple Intelligence AI to do really useful things in complete privacy.
This isn’t just a competitive moat, it’s a realistic assessment in practice. It shows that Apple understands that in the age of AI, privacy matters more than ever. As AI becomes central to everyday digital experiences, privacy is no longer optional — and Apple is prepared to make the case to support it.
You can follow me on social media! Join me on BlueSky, LinkedIn, Mastodon, and follow The Core.
Some will question its credibility – but the alternative future to the one imagined in the Global Justice Report is far more bleak
‘An equal and habitable world is possible’: academics set out sweeping vision for planetary survival
In our increasingly dystopian world, who wouldn’t want to at least be open to a utopian antidote? The Global Justice Report, published on Thursday, outlines how to build a prosperous, equitable world within safe planetary boundaries. It’s a push from the modern eco-socialist left in a global battle for ideas that will shape the future.
Based on past social achievements and future energy transformation, it indicates that the overwhelming majority of people on the planet could, by the end of the century, work less and earn more – while keeping temperatures down and avoiding much of the current destruction of nature. It is an ambitious, comprehensive and upbeat plan, and a stronger argument around which to build a political campaign than abstract goals of net zero or decarbonisation.
Continue reading...
© Photograph: Emmanuel Croset/AFP/Getty Images
© Photograph: Emmanuel Croset/AFP/Getty Images
© Photograph: Emmanuel Croset/AFP/Getty Images
The European Union has now published a set of measures aimed at boosting Europe’s tech industry to help reduce reliance on US and Chinese suppliers for AI, cloud, and semiconductors. The proposals include rules to restrict the use of US hyperscalers for certain public sector procurement purposes, but stop short of banning them outright.
“Technological sovereignty does not mean protectionism. Europe remains grounded in openness, partnership, and fair competition,” Henna Virkkunen, executive vice president for Tech Sovereignty, Security and Democracy, said in a statement Wednesday. “At the same time, Europe wants to be in the position to make its own choices, avoiding dependence on single dominant suppliers, especially from non-like-minded countries.”
The European Technological Sovereignty Package — released after several delays — includes two legislative proposals: the Cloud and AI Development Act and Chips Act (CAIDA) 2.0 and the Open Source Strategy and Strategic Roadmap for Digitalization and AI in Energy.
CAIDA aims to triple data center capacity in the next five to seven years by easing restrictions for deployments across the EU. It also includes rules that, if enacted, would require EU public bodies to meet certain sovereignty criteria for cloud service procurement related to certain sensitive workloads.
Amid ongoing trans-Atlantic tensions and a long-time deep reliance on US tech providers, European organizations have become increasingly wary of a “kill switch” that would cut off access to digital services. There are also concerns that US hyperscalers could be compelled to share data with US government under the CLOUD Act and Foreign Intelligence Services Act (FISA), even when data centers are located in Europe.
The CAIDA proposals include four levels of criteria for suppliers; the most basic includes data center infrastructure located and operated in the region – something many US cloud suppliers already provide – with stricter rules around supplier ownership, full control over the software stack, and more stringent cybersecurity certification.
The majority of existing EU public sector workloads (70%) fall under the first level, with 20% at level 2, and 9% at level 3. Only a small proportion (1%) of the most sensitive workloads would require level 4.
Other proposals include the Chips Act 2.0, a follow-up to the 2023 legislation that sought to improve semiconductor production capabilities; the updated version now aims to boost research and spur demand for domestically produced processors.
The legislative proposals must be negotiated by the European Parliament and Council of the European Union before adoption.
Investigation reveals regulator let firms off the hook on cleanup bonds despite backlog that will take decades to clear
When Christiaan van Woudenberg moved to Erie, Colorado, in 2007, he never imagined he would become an anti-fracking activist. He simply thought he was buying his dream home – a four-bedroom with a panoramic mountain view, 30 minutes north of downtown Denver.
Then, in 2014, the drilling started. Oil and gas rigs sprang up, some just 800ft (240m) from his bedroom window. The dream turned to nightmare: loud noises rumbled all night long, and the air stank like exhaust. Neighbors started getting headaches and nosebleeds, and Van Woudenberg developed new respiratory issues. He kept his windows shut and worried about his daughters going outside.
Continue reading...
© Composite: Rita Liu/The Guardian/Getty Images/Civitas/Chevron/OXY
© Composite: Rita Liu/The Guardian/Getty Images/Civitas/Chevron/OXY
© Composite: Rita Liu/The Guardian/Getty Images/Civitas/Chevron/OXY
Apple will open the doors to developers at its Worldwide Developer Conference (WWDC) next week. Beyond a big push on AI and new OSes focused on stability and performance, what should developers expect? Mostly it’s about new APIs, Foundation Models, and App Intents; here’s what I’ve been able to figure out so far.
Apple has been building new Apple Intelligence APIs. One way it is achieving this is to take models made with Google Gemini, then distill and shrink them to fit inside (and run on) its devices. The progression will be to introduce these as a new crop of Foundation models developers can use in their apps. There’s more:
Apple continues on its quest to convince developers to make features of their apps available for use via Siri with App Intents. Doing so requires developers to wrap their apps into semantic structures, enabling speech/text-based interaction. To help them achieve this, Apple is expected to introduce a complete redesign of its App Intents framework.
While users must say “Hey Siri” to invoke its attention today, the assistant will respond more dynamically to natural language. Combined with App Intents, that means users should be able to ask Siri to use a combination of apps to make things happen on the device.
A developer might build a travel app that can take an itinerary and hand it across to a budgeting tool, for example. The idea is that with a spoken or typed command, a person will be able to call on a collection of apps to identify the destination, create an itinerary, put together a to-do list, prepare relevant letters or emails, and assemble a budget — all invoked by the original command.
We’re expecting Siri to become better at using the content of your screen, location, and other personal data as it seeks to provide more contextualized responses. We don’t yet know the extent or form in which Apple will make that information available to third-party developers to help contextualize their own apps. Apple’s focus on privacy matters a great deal, as does its relationship with regulators, some of whom will demand that data made available to Apple’s own apps be made available to third-party apps. These are important matters for Apple, app developers, and customers who want the convenience of AI without loss of privacy.
Swift should get better at migrating legacy code, but the big speculation around it concerns Liquid Glass. Will Swift make it easier for developers to build consistent user interfaces that work properly across all Apple’s platforms? If it does, then it will help overcome one of the big criticisms of Apple’s liquid-inspired UI. Swift will also usher in the tools developers need to support agentic application coding.
Vibe coding is everywhere, including within Xcode, which is expected to gain improved contextual and predictive understanding to help boost developer productivity. Xcode could also introduce improved real-time architectural debugging hints, aiming to make it easier for developers to build bug-free apps.
All the AI enhancements made available across Apple’s other products will also be offered to visionOS. That access takes the headset another step closer to becoming the Mac you wear like sunglasses.
Apple will abandon Intel support in macOS 27, which means developers will likely end support for legacy Intel applications in response.
Once the lights go down on WWDC, Apple’s real test will be to see if its announcements help make AI useful, private, and affordable to developers and their customers. After all, if Apple gets AI right on a platform basis, it should be able to offer the kind of on-device intelligence no one else can match, at no charge to developers or users — a move that might yet kick-start AI innovation across its platforms. This will provide a moat around the Apple ecosystem, inside which developers can explore new potentials for AI to give customers the tools they need at costs they can afford.
You can follow me on social media! Join me on BlueSky, LinkedIn, Mastodon, and MeWe.
IBM has launched a tool designed to help customers assess cloud-sovereignty risks and meet regulatory compliance requirements.
The Sovereignty Risk Profile launch comes as digital sovereignty becomes a higher priority for organizations concerned about where data is stored and processed. According to an IBM survey, 93% of executives believe sovereignty needs to be part of their business strategy.
Via the new tool, customers can set up policies related to regulatory and business requirements — such as where data resides and how it’s protected, for instance. These policies can be applied to specific cloud workloads, regions, or zones in the Sovereignty Risk Profile tool, allowing users to track sovereignty requirements “in real time,” IBM Cloud product manager Janet Van said in a blog post, with “visibility into configurations, encryption posture, and environmental controls.”
It’s then possible to assess compliance and decide what workloads meet sovereignty requirements.
Tracking the factors that contribute to sovereignty is a challenge for many organizations, said Holger Mueller, vice president and principal analyst at Constellation Research. “It is very difficult, as you don’t know about the details of the stacks; sometimes, even the location of data is not fully transparent,” he said.
The Sovereignty Risk Profile “addresses many of the compliance-related requirements associated with data residency and encryption, while also tackling sovereignty from a resilience and concentration-risk perspective,” said Dario Maisto, senior analyst at Forrester.
However, the monitoring tool can only do so much to address digital sovereignty concerns, he said. While it can help organizations identify and report on potential issues, it “does not help [make] clients more or less sovereign, per se: it has only the potential to tell that a sovereignty problem is there.”
Broader questions around digital sovereignty remain difficult to address, he said, as there’s no universally accepted definition of the concept and limited legislation to establish clear requirements.
Mueller described a spectrum of sovereignty issues that depend on factors such as whether data is stored, processed, and backed up in a customer’s own country, as well as whether staff that operate the data are domestic nationals. “Then there is the sovereignty of the software supply chain — but here everybody is dependent,” he said.
To further complicate matters, while several US hyperscalers sell sovereign-branded cloud services to European customers — with local staff and infrastructure — concerns remain about the potential for extra-jurisdictional access to data, due to the US CLOUD Act and the US Foreign Intelligence Surveillance Act (FISA).
The Sovereignty Risk Profile is available within IBM’s Security and Compliance Center Workload Protection. It’s the latest in a range of IBM Cloud products aimed at addressing customers’ sovereignty concerns, including the recently launched IBM Sovereign Core software platform.
Login