Apple's Approach to AI: Why On-Device Processing Matters If You Handle Client Data

Most coverage of Apple’s approach to AI is a product review. The more durable question is architectural, and it has a consequence that applies well beyond Apple: where does the computation happen, and therefore where does the data go?

That question matters commercially to anyone whose work involves confidential records. For an accountant, a lawyer, a clinician or a small business owner holding client financial information, the difference between a feature that runs on the device in your hand and one that ships your input to a server in another country is not a preference. It is a compliance fact.

The bet Apple made

The industry’s dominant strategy has been scale: very large models, in very large data centres, reached over the network. It works, it produces impressive results, and it means your input travels. The other way of keeping data in the building is to download the model and run it yourself, which is the comparison I have worked through in hosted against open-weight models.

Apple’s strategy has been to push as much inference as possible onto the device itself, supported by dedicated silicon. The Neural Engine built into its A-series and M-series chips exists specifically to run machine learning workloads locally at low power. Features like text recognition in images, subject identification, dictation and on-device search indexing run without a network round trip.

Where a request exceeds what the device can do, Apple’s stated design routes it to server infrastructure built to avoid retaining the request, rather than to a general-purpose cloud.

Neither column is simply better. The trade is real: on-device models are smaller and less capable than the largest cloud models, and Apple’s features have at times lagged competitors’ in raw ability. Whether that trade was correct is a commercial judgement that is still playing out.

What is not in doubt is that the trade has a compliance dimension the marketing rarely mentions.

The Canadian rule almost nobody applies to AI tools

Here is the concrete reason this matters for a Canadian business.

The CRA requires that books and records be kept at a place of business or residence in Canada, or another place designated by the Minister. Records held on servers outside Canada and merely accessed from here are not considered to be records in Canada. Authorisation to keep them elsewhere can be granted in writing, on request, with conditions attached.

Most people apply this rule to accounting software and stop there. It applies to anything that becomes the record. If you dictate client notes into a service that transcribes them abroad, or summarise a set of financial statements through a tool hosted in another jurisdiction, you have made a decision about where your records live, whether or not you framed it that way.

The CRA’s electronic record keeping circular adds the second half: electronic records must be retained in an electronically readable, processable format for six years, and the CRA recommends keeping backup copies within Canada regardless of where the primary system sits.

On-device processing sidesteps the question entirely, which is the practical argument for it. Data that never leaves the device has no residency problem to solve. That is a narrower benefit than “privacy” as a slogan, and it is a more useful one.

Confidentiality is a separate obligation from data residency

A second distinction worth holding separately.

Data residency is about geography. Confidentiality is about who can see the information and what they may do with it. A tool hosted in Canada can still retain your input, train on it, or expose it through a support channel. A tool hosted abroad may contractually do none of those.

For a professional, the obligation to keep client information confidential arises from professional standards and from privacy legislation, and it is independent of the CRA’s record location rule. Both have to be satisfied, and satisfying one says nothing about the other.

The questions worth asking any vendor, in order:

1. Is my input used to train models? If yes, and you handle client data, that is usually the end of the conversation.
2. Is it retained, and for how long? “Not used for training” and “not retained” are different promises.
3. Where is it processed, and where is it stored? These can be different places.
4. Who at the vendor can access it? Support access is the common gap.
5. What happens on account termination? Six years is longer than most subscriptions.

Nothing in that list is specific to AI. It is the same diligence that applies to any cloud service, and it is covered further in cyber security for small business finance and digital record keeping and the CRA.

The unglamorous tax question about the hardware

Because on-device AI depends on capable silicon, the practical consequence of adopting this approach is buying hardware. Which raises the question people actually ask.

A computer, tablet or phone bought for business use is generally a capital expenditure, not a current expense, and is deducted over time through capital cost allowance rather than in full in the year of purchase. General-purpose computer equipment and systems software fall into their own class with their own rate, listed in classes of depreciable property.

Two points that come up constantly:

Mixed use gets prorated. A phone used 60% for business supports 60% of the cost, and the CRA expects the split to be supportable, not asserted. The underlying principle is in business expenses and the mechanics in capital cost allowance explained.

Subscriptions are different from hardware. A monthly AI service fee is a current expense, deductible in the year, while the device running it is capitalised. The same overall spend lands on two different lines.

What to take from this

Apple’s approach to AI is a wager that a smaller model running privately beats a larger model running remotely for the majority of what people actually do. The wager may or may not pay off commercially.

The transferable lesson does not depend on the outcome. When you evaluate any AI tool for work involving other people’s financial information, the first question is not what it can do. It is where the computation happens, because that determines what obligations you have just taken on. The broader practice implications are in AI in accounting.

If you are bringing AI tools into a practice or a business that holds client records and want the residency and retention questions settled before rollout, that is worth mapping out first. It is a short exercise in advance and an awkward one during a review.