What changed
The private inference system that handles requests too heavy for the device was built, deliberately and publicly, on the company’s own chips in the company’s own buildings. That was the argument: nobody else’s hardware, nobody else’s software, nobody else’s employees anywhere near the data while it was being processed. Now the heaviest workloads — agentic tool use and complex reasoning, the ones that consume accelerators fastest — are being extended onto a competitor’s cloud, on a third party’s accelerators, with a fourth party’s processors and the cloud provider’s own security chip. Three vendors of silicon in the booth, and none of them the company whose name is on the service.
Read as a capacity story it is straightforward: the company’s silicon is excellent and does not exist in infinite quantities in data centres. Read as an architecture story it is more interesting, because of the part the company was careful to say had not moved.
What did not change
Five requirements, stated as unchanged: stateless computation, enforceable guarantees, no privileged runtime access, non-targetability, verifiable transparency. Devices will only trust software cryptographically approved by the company, wherever it runs. The words are load-bearing. Renting someone else’s servers is easy; renting them without loosening any of five commitments is the engineering.
The mechanism that makes it possible is confidential computing. A normal accelerator trusts whoever owns the machine it sits in, which puts the host’s privileged software above the workload. Confidential computing inverts that: the accelerator keeps its working data encrypted, and proves cryptographically that nothing has been tampered with before sensitive data is sent to it. The host can run the machine and still not see what is on it.
The enterprise version of the decision
Most organisations face this choice without the vocabulary. The data platform — the warehouse, the systems of record, the governed estate — is the asset, and it usually lives on premises or in a cloud the organisation controls. AI inference wants accelerators, which are scarce, expensive and, for many, only available for rent. The instinct is to treat this as a binary: keep everything in-house and starve the AI programme of compute, or send the data to whoever has the GPUs and hope the contract holds.
The company’s approach shows the third way, and it starts with a document rather than a purchase. Write down the properties the processing must have — for most organisations, some version of: the provider’s staff cannot access the data in use; nothing is retained after the request; the workload can be shown to be the approved one; a specific user’s data cannot be singled out; the whole thing can be checked by someone outside. Then evaluate infrastructure options against those properties, and let the implementation be whatever meets them, including a rented one.
Confidential computing is what moves “rented accelerators for sensitive data” from unacceptable to evaluable. It is now offered by the major clouds on current accelerators. It is not magic — the guarantees depend on the hardware roots of trust and on the software that attests to them — but it changes the question from “do we trust the provider?” to “can we verify the workload?”, and that is a question with an answer.
Verify, do not trust
The details of the announcement are a checklist for that verification. An append-only, cryptographically verifiable ledger of every piece of rented hardware in the fleet. For components that could exfiltrate data if compromised, attestation rooted in at least two independent vendors’ roots of trust, so that two suppliers must be wrong at once. Binaries published for inspection. Researchers given access to live nodes in a research mode, so someone outside the three companies can check whether the booth is soundproof. And a gradual ramp, with the full set of protections arriving over a preview period rather than declared on day one.
Few organisations will build all of that themselves. All of them can ask their providers for the equivalent: what is attested, by whose root of trust, what is published, who has independently checked it, and what is the provider’s own ramp plan.
The order of decisions
- Guarantees first. The non-negotiable properties of AI processing over your data, written down and owned, before any infrastructure is chosen.
- Data placement second. Where the platform is, what can reach it, and which derived tiers must stay near it.
- Compute last. Owned, rented or both, evaluated against the guarantees — with confidential computing as the mechanism that widens the options.
The company that made owning the whole stack its argument has just shown that the argument was always about the guarantees, not the ownership. An enterprise with a data platform to protect should draw the same conclusion, and write the guarantees down before the capacity runs out.
