Apple Is Opening Its AI Garden – Without Handing Over the Keys
There was a tidy prediction about Apple and open-source AI: that Cupertino would keep arbitrary models off the iPhone, because a company that sells the whole experience inherits every failure inside it – the overheating handset, the drained battery, the app that swallows memory. The prediction got the incentive right and the response wrong. Apple has not prohibited third-party models. It has built a managed execution layer for them – and in doing so offers the clearest live case study of how a platform owner absorbs a disruptive technology: not by banning it, but by governing its runtime.
The evidence accumulated fast. At WWDC 2026 Apple replaced the nine-year-old Core ML with Core AI, a framework rebuilt for the large-model era that runs converted PyTorch models and pre-optimised open-source models – from compact 3-billion-parameter vision models to 70-billion-parameter reasoning models – entirely on device. The Foundation Models framework, which since 2025 has given every app free access to Apple’s 3-billion-parameter on-device model with guided generation and tool calling, now accepts any provider conforming to a common LanguageModel protocol: Anthropic shipped a Claude Swift package the day after the keynote, and Google plugged Gemini in through Firebase. Meanwhile MLX, Apple’s open-source framework built around Apple silicon’s unified memory, runs quantised versions of most major open-weight models, and Ollama rebuilt its Mac engine on MLX this spring, roughly doubling generation speed by its own benchmarks.
Yet every one of those freedoms operates inside boundaries Apple still draws. Apps remain sandboxed, entitlements remain gated, and iOS evicts processes that overreach on memory – which is why practical on-device deployments cluster around small, heavily quantised models. Thermal governance is non-negotiable: sustained inference gets throttled long before it damages hardware. Distribution is gated too. Even in the EU, where the Digital Markets Act forced Apple to permit alternative marketplaces and web distribution, every app must still pass Apple’s notarisation – a baseline review, combining automated checks and human oversight, focused on platform integrity. Apple no longer decides whether an open model may exist on an iPhone. It decides how any model obtains compute, memory, battery, and distribution.
The distinction that matters for strategists is between model freedom and hardware freedom. Generative models are unusually unpredictable workloads – general-purpose probabilistic engines whose future behaviour cannot be enumerated when an app ships – so Apple separates the two freedoms: run your preferred model, quantise it, fine-tune it, but through an execution environment that stops that freedom spilling into uncontrolled access to the device. Commercially, the arrangement is elegant. If open models become good enough for thousands of everyday tasks, Apple does not lose: on-device inference makes its silicon, unified memory, and Neural Engine the scarce asset, and the LanguageModel protocol makes rival models substitutable components behind an Apple-owned interface. Open intelligence, running inside closed infrastructure.
Three lessons travel beyond Cupertino. First, when a disruptive technology arrives, govern the runtime rather than ban the technology: control the genuine choke points – compute, memory, distribution – and you can afford generosity everywhere else. Second, convert openness into position at the interface: by defining the protocol through which all models are called, Apple commoditises the models themselves while keeping the orchestration layer, a textbook case of commoditising one’s complements. Third, keep the safety case honest: notarisation survived the Digital Markets Act because a baseline integrity review is defensible where full gatekeeping is not, and regulators will eventually open every garden – so decide in advance which walls you can justify keeping. The contest ahead is not open versus closed. It is who owns the layer where open things run.
Personal analysis. Views are mine, not my employer's.