Siri Model Delegation: Apple Built a Swappable Model Layer — and Kept the Switch
Apple shipped a swappable model layer inside Siri and left the switch off. That is your client's question, one layer down.
Two private hooks in iOS 27 and macOS 27 Golden Gate let a third-party model take Siri's place at two depths: one registers a model as a Siri extension and answers inside Siri's own surface, and the other replaces the server-side model behind Siri while Siri keeps its interface and voice.
At least ten published writeups already name both mechanisms. What none of them cover is the decision this creates for a client: switching cost, procurement language, and the questions worth asking now.
What the iOS 27 code actually shows
Code researcher pdfu posted two demonstrations on September 13, 2026; MacRumors and CNET reported them the next day, and iOS 27 was released on September 14, 2026.
Two labels, two depths. Delegation adds a model inside the assistant; replacement becomes the assistant's model for the request. Both are server-side: nothing published shows the on-device model being swapped.
Delegation vs replacement: two different trust boundaries
The two hooks collapse easily into one headline, but they are not the same risk: they move the trust boundary to different places.
On the delegation path, Apple's execution layer stays in the middle. The third-party model interprets the request; when it needs a system action, “control routes back to Siri's own execution layer.” A reminder is still created by Siri. On the replacement path, the third-party model is in the data path. It receives the planner prompt and tool definitions, calls system tools, and works with what they return, including personal data. Same interface, same voice, different log.| Question | Model Delegation (extension) | Model Manager Services (inference provider) |
|---|---|---|
| Who holds the execution layer | Siri — the system action runs through Apple's layer | The provider model reasons; Siri presents the result |
| What the third-party model sees | The request it was asked to interpret | Planner prompt, tool definitions, and tool results including personal data |
If you route workloads across models by cost, this is that decision moved up a layer: the routing table now sits in your client's operating system. Our workload-to-model routing guide covers the cost half; this is the platform half.
What is live and what is not
State the gap precisely: infrastructure shipped, capability off.
iClarified is unambiguous — “None of this is enabled for users yet.” MacRumors narrows it further: the “Ask…” menu “implementation”, and “Apple has not yet opened up the model delegation entitlement to third parties and it isn't front-facing to users” The outside analysis agrees from the framework side: “Apple hasn't opened Model Delegation or Model Manager Services to third-party developers” Apple has announced neither mechanism, and Apple, OpenAI and Anthropic had not responded to press requests as of September 14, 2026.
One independent developer published a working experimental implementation of the delegation path, and its own documentation is why not to over-read it: it requires macOS with security protections disabled, handles text only, and has no verified system-wide default.
So the honest 2026 answer: not by you, not yet, and not through any surface procurement can buy. What changed is that the architecture assumes the model is swappable.
Why this is the same question your client asked last quarter
Your client asked a version of this last quarter: which model should we build on, and what happens if we picked wrong. The standard answer keeps the workflow portable — versioned prompts, evals, a second provider kept warm. Siri model delegation is that answer inside a platform vendor's own product.
That is the reframing worth putting in front of a client: model choice is becoming a configuration layer rather than a platform commitment — cheaper to change and governable, but only if the abstraction exists in your client's stack, and today it exists in a leaked build instead.
The lock-in question moves with it. The interesting version is not which lab you picked, it is who owns the switch. If the platform chooses the assistant's model, the switching cost and the governance sit with the platform; if the client's stack chooses it, both sit with the client. Only one of those contracts can be priced.
Both founding reports describe the Digital Markets Act as the backdrop, and MacRumors's wording is careful: it “The European Union's Digital Markets Act may have helped shape Apple's approach here, as it requires Apple to give third parties effective access to iOS hardware and software features available to Apple's own services, and the European Commission has specifically said this principle extends to Siri.” Apple's approach. Apple has not said the DMA produced this design, and commenters asked why the capability is not available in the EU.
Four questions for the next client proposal
Four questions a client's procurement or legal reviewer would ask. None has a vendor-supplied answer today: ask them now and you are the agency that saw it coming.
- Who holds the entitlement? Model Delegation is gated on a private entitlement Apple has not opened, so a delegated assistant is a platform capability rather than a vendor relationship you can contract.
- What leaves whose infrastructure? Delegation keeps the system action inside the platform assistant's own layer; replacement hands the third-party model the planner prompt, the tool definitions and the personal data the tools return. That is what a data-protection review asks.
- What is logged, and where can you read it? The replacement demo's session is visible in the model vendor's platform, not only in the device history. Can your logs distinguish the assistant answered from a delegated model answered? If not, you have no incident artefact, and the fix is a logging change, not a policy.
- What does the exit cost? Swapping a model behind an assistant is cheap for the platform and expensive for anyone whose workflows were built on the assistant's behaviour. Price the exit before the switch is offered.
The last question is where our AI vendor risk assessment applies: a model that can be swapped out from under you is the same subject as a vendor whose behaviour changes on you — can I trust this vendor — with a different failure mode.
Who is accountable when the OS hands the action back
The output-ownership argument is already running in public. On Hacker News (226 points, 161 comment blocks, September 14, 2026) one commenter asked who users will blame when a non-Apple model's answers are garbage, and another drew the technical line: being able to swap the model in code is not the same as letting end users choose it. That is commentary, not a finding.
For an audit the useful framing is narrower than blame, because the two hooks produce two evidence trails. Delegation keeps the system action, and the record, in the platform assistant's own layer. Replacement left the planner prompt, the tool definitions and the tool-returned personal data with a third party, and the session is visible in that vendor's dashboard.
That is why “who is liable when a delegated AI agent acts” is, today, a question about artefacts rather than blame: which logs exist, whose consent state was recorded, and whether anyone can prove which model produced an answer the user read as Siri's. No court has addressed OS-level model delegation and the entitlement is unopened, so this quarter's deliverable is log readiness, not a policy. Our canonical treatment of accountability lives at who is liable when your AI agent acts; this page is the mechanism behind it.
Frequently asked questions
Can you replace Siri with ChatGPT?
Not as a user-facing setting today. In the macOS 27 Golden Gate release candidate the “Ask…” menu is limited to the ChatGPT extension, and no public entitlement lets another developer register a model there. The demos show the reverse: an inference provider replacing Apple's server-side model.
What is Model Delegation in iOS 27?
It lets a third-party model register as a Siri extension through App Intents — the slot the built-in ChatGPT extension occupies. In the demonstrated build Claude interprets the request and hands the system action back, so Siri creates the reminder. It needs the private entitlement com.apple.developer.model-delegation, unopened by Apple.
What is Model Manager Services?
It is the second mechanism: an Inference Providing protocol that lets an inference provider replace Apple's own server-side Siri model rather than answer one request inside it. In the demonstration GPT-5.6 Terra receives Apple's planner prompt and tool definitions, calls system tools and works with the personal data they return.
Is Siri model delegation available to third-party developers or in the EU?
No developer entitlement is open, and Apple has not announced either mechanism or said whether third-party developers will get access. Both founding reports describe the EU Digital Markets Act as the backdrop, in MacRumors's phrasing that it may have helped shape Apple's approach.
What does multi-model assistant architecture mean for an agency stack?
It means the model choice becomes a configuration layer with an owner. Multi-model assistant architecture is the routing decision agencies already make on cost, moved into the assistant a client's staff use all day: a default model, a routing rule, a fallback, and a log saying which model answered.
Sources
- MacRumors — “Apple's Siri AI Can Be Swapped Out for Claude, ChatGPT, Code Shows” (Tim Hardwick, September 14, 2026, 4:37 a.m. PDT): www.macrumors.com
- CNET — “Siri AI Will Have Deep Integration With ChatGPT and Claude Models, Leaked Build Shows” (Tyler Graham, September 14, 2026, 5:35 p.m. ET): www.cnet.com
- iClarified — “Hidden iOS 27 Code Shows Siri AI Can Be Replaced by ChatGPT or Claude [Video]” (both demo videos; names the private entitlement): www.iclarified.com
- pdfu (@itspdfu) — first demonstration post, September 13, 2026 (Claude / Model Delegation): x.com
- pdfu (@itspdfu) — second demonstration post, September 13, 2026 (GPT-5.6 Terra / Model Manager Services): x.com
- TLDR AI — September 15, 2026 newsletter, subject line leading with “Siri model swapping”: tldr.tech
- explainx.ai — analysis of both mechanisms (September 14, 2026; source of the “control routes back to Siri” framing): www.explainx.ai
- opoinstall.com — App Intents architecture analysis of the delegation path: www.opoinstall.com
- byteiota — developer framing of the delegation entitlement: byteiota.com
- GitHub — mpociot/claude-siri-ai (independent experimental implementation, with its own documented limits): github.com
- Hacker News — discussion thread, 226 points, 161 comments, September 14, 2026 (commentary only): news.ycombinator.com
Accuracy note: this page describes private frameworks in iOS 27 and macOS 27 Golden Gate as reported September 13–15, 2026, from two demonstrations by code researcher pdfu. Neither mechanism is user-facing: the “Ask…” menu ships with the ChatGPT extension only in the release candidate, the entitlement com.apple.developer.model-delegation is private and unopened, and Apple has announced neither mechanism. The replacement findings concern Apple's server-side Siri model; nothing published shows the on-device model being swapped. The EU Digital Markets Act is described as backdrop, in MacRumors's wording, not as a confirmed cause. Details in shipping frameworks change without notice — re-verify before building a client proposal on them. Sources were fetched and checked on September 18, 2026.