Vivian Voss

The OS That Brought Its Own AI

architecture security cloud law

Not in the Brief ⊣ Episode 05

Your phone changed assistants. You did not. Sometime between Android 14 and 16, Google Assistant retired and Gemini moved in, into the same slot, with the same long-press, answering to the same "Hey Google". This is the fifth episode of Not in the Brief, a series on the documented things software does that the user did not ask for. We have covered a browser that brought a language model, a vault that stays open in memory, a screenshot index nobody requested, and a platform setting flipped on by default. This week the change is one layer deeper: it is not a feature inside an app, it is the assistant the operating system answers to.

The Feature

Gemini is now Android's default assistant on Pixel 10 and is rolling out across the eligible Android estate. The hardware threshold, set by Google, is Android 10 or later and at least 2 GB of system RAM. The replacement is system-level: Gemini does not sit beside the existing assistant as a competing app. It sits in the assistant slot the OS exposes to all apps. The standalone Google Assistant, having been available since 2016, retires on or around 31 March 2026. After that date, the choices Android presents in the digital-assistant slot are Gemini or None. The third option that existed for nearly a decade is going away, on a published schedule, with 9to5Google reporting the full sunset for March 2026.

Pixel 10 (announced 20 August 2025, shipping from 28 August 2025) shipped with Gemini already in the slot. On the rest of the eligible estate, Gemini arrived as a system update over the course of 2025, in some cases as a notification offering to "upgrade" the existing assistant; framed, in that wording, as the outdated version of itself. Devices below the threshold keep classic Google Assistant by default, not by choice; they simply lack the resources to run the new model.

The Assistant Slot Is a Role, Not an App long-press home user gesture "Hey Google" wake word assistant intent from any app OS assistant role one holder at a time (Gemini, or None) Gemini (now) Google Assistant Three inputs → one role → one model. The slot was always there; the holder is new.

The Introduction

The transition was confirmed as a roadmap step in late 2025, after an earlier 2024 target was missed. Google announced in December 2025 that the full sunset of Google Assistant on mobile would land in March 2026, with the work continuing across Wear OS, Android Auto, Google TV and Google Home. The rollout is not a single launch event; it is a slow displacement, device-class by device-class, with a hard deadline at the end.

For users this means three different experiences. On a Pixel 10 the assistant has been Gemini from day one. On most other eligible Android phones it has been switched over by system update, with or without a clear notification. On devices below the eligibility line, classic Assistant continues to work until the standalone service retires, after which those devices will have no current Google assistant at all, unless they are replaced.

The brief signed when a phone was bought said "smart assistant". It did not say which one, and it did not promise that the answer would not change.

The Mechanics

A digital assistant on Android is not a special application; it is a role. The operating system exposes a hook (the "assistant role"), and exactly one application at a time is the holder. When a user long-presses the home button, says the wake word, or when a third-party app calls the assistant intent, the OS routes the call to the holder.

Until 2024, the holder was Google Assistant. As of the rollout described above, on every eligible device, the holder is Gemini. The same long-press, the same "Hey Google", the same downstream apps; a different programme at the other end.

On Pixel-class hardware, Gemini Nano runs on the device for part of the work. Gemini Nano is a small foundation model designed to run locally, and it powers a number of system features the user may not know are powered by a model at all (more on those below). For anything heavier, the call leaves the phone and goes to Google's cloud, where a larger model decides what to do with what was said. The line between "handled locally" and "sent to the cloud" is set by Google; the user interface does not display it.

Pixel-Class Routing: Local Slice, Cloud Remainder spoken request microphone routing decision set by Google not displayed in UI Gemini Nano (local) larger Gemini Google Cloud stays on device (small slice) "Handled locally" is a decision made by Google for each request, not a setting the user sees. Where the boundary lies on any given utterance is not in the brief.

The System-App Integration

The point worth stating, because the assistant slot is only the visible edge of the change, is that Gemini Nano is woven into the Pixel system apps, not just behind the assistant role. Each of these is, in isolation, a legitimate feature. The cumulative point is that the language model is now a Pixel platform service, with system apps for phone calls, messages and voice recording wired into it. The slot is not the only place the model lives. It is just the most obvious one.

Gemini Nano in the Pixel System Apps Magic Compose Google Messages Formal / Excited / Chill Call Notes Phone (Pixel-exclusive) written call summaries Recorder Summaries Pixel Recorder 3-bullet for ≥30 min Scam Detection Phone (live) fraud-script patterns Gemini Nano on-device Pixel-class hardware

The Architectural Contrast: iOS 27

The same vendor's model lands very differently on the other major mobile platform, and the comparison is the privacy story.

iOS 27, due in autumn 2026, takes the opposite architectural path. Gemini ships on iOS as a sandboxed extension at the application layer, in a new "Extensions" framework Apple introduced after a public partnership with Google in early 2026. Three properties matter. The extension is opt-in: it does not appear in any assistant role unless the user enables it. It is isolated from system hooks: it cannot become the slot, because iOS does not expose the slot to extensions. It is invoked only when the user explicitly calls it; the wake word, the home gesture and the system microphone all remain Apple's.

The privacy implication is structural rather than rhetorical. A sandboxed extension can be revoked by the user, audited by the platform, and constrained by permissions on a fine-grained basis. A model installed into the slot inherits the slot: the microphone access, the default-app reach, the assistant intent routed to it by every app on the system.

Same Model, Two Architectures Android: in the slot OS layer wake word home gesture assistant intent (any app) Gemini in OS slot inherits microphone + reach iOS 27: sandboxed OS layer (kept by Apple) wake word home gesture system microphone no slot exposed to extensions Gemini extension (opt-in) A sandbox can be revoked and audited. A model in the slot inherits the slot.

A Note on Architecture and Business

The architecture follows the business, and the business is visible in the published filings. These observations are not accusations; they are descriptions of where each company makes its money, as reported to their respective regulators.

Apple's FY2025 revenue was approximately 74 per cent hardware and 26 per cent services; the device is the customer-facing product, the privacy of the data on it is a marketing surface, a regulatory consideration and a business asset. Alphabet's 2025 revenue was approximately three quarters advertising (Google Search around 224 billion and YouTube around 40 billion US dollars), with cloud as the third major segment at roughly 14.57 per cent; the advertising placement is the customer-facing product, and the data the placement is targeted against is operational input.

The implementations of the same model on the two platforms sit at the two ends of that spectrum, and they sit there for reasons their respective shareholders can read in the same documents. The architectural choice of where to install a foundation model, in the slot or beside it, in the operating system or on top of it, is the kind of choice that follows from those numbers, not the kind of choice that contradicts them. That is the only point this section makes.

Where the Money Comes From (Same Filings) Apple FY2025 hardware ~74% services ~26% device is the product • services margin >70% • privacy is a marketing surface Alphabet 2025 advertising ~75% cloud ~15% other placement is the product • the data the placement is targeted against is operational input Sandbox vs slot: an architectural choice that sits at the end of the spectrum that matches each filing.

The Risk

A new assistant in the slot is not a breach and it is not a leak. The microphone access was already there; the assistant role was already there; the user agreed, at some abstract point in the past, that their phone would have an assistant. What changed is who is at the other end of all of that.

The risk worth naming, in plain terms, is exposure asymmetry. Voice input that used to be answered by a search agent is now answered by a language model with different defaults about what it stores, what it summarises and what it forwards to third-party tools (extensions, the Gemini app on iOS, integrated services on Android). A reasonable user, having bought a phone, would expect to be asked before a different programme answers their microphone. The brief said "smart assistant". The execution says "model".

That distinction is not pedantry. A search agent's job is to route a query to a known endpoint. A language model's job is to interpret the query, decide what data is relevant, decide which extensions or external tools to call, and produce a coherent answer. The decisions are made on the user's behalf, with privacy defaults set by the vendor, on data the user did not explicitly classify. None of this is in itself wrongdoing. All of it is in scope for the question "what is this thing doing with what I said".

How to See It

Three steps, under a minute, on a current Android device:

One. Settings → Apps → Default apps → Digital assistant app. This is the OS role. The options listed there are the assistants the OS will route the long-press, the wake word and the assistant intent to. If classic Google Assistant is still installed, "Digital assistant from Google" appears; if it is not, the choice is Gemini or None.

Two. App management → Gemini → Disable + Force Stop. Gemini ships as a system app on most devices, which means it cannot be uninstalled in the ordinary sense; it can, however, be disabled, and Force Stop ends any background work it was doing. If the assistant role is set to None and Gemini is disabled, the phone has no active assistant.

Three. Samsung path: Settings → Apps → Choose default apps → Assistant app. The same role, under Samsung's menu layout.

For the Pixel-only inline features (Magic Compose, Call Notes, Recorder Summaries, Scam Detection) the relevant settings are per-app: open Settings → Apps → choose Messages, Phone or Recorder, and review the AI-feature toggles and Permissions for each.

Trade-off, stated plainly: if the role is None and Gemini is disabled, the long-press of the home button does nothing and "Hey Google" does nothing. The phone otherwise works normally. The inline system-app features remain available unless explicitly turned off in their respective apps.

Three Taps to See Your Own Slot 1. Settings → Apps → Default apps → Digital assistant app choose Gemini, or None (no holder), or Digital assistant from Google if still present 2. App management → Gemini → Disable + Force Stop cannot be uninstalled on most devices, but can be stopped 3. Samsung: Settings → Apps → Choose default apps → Assistant app same role, different menu With None set, long-press and "Hey Google" do nothing. The phone otherwise works normally.

Coda

This episode is about an OS-level change of who is at the other end of the assistant role, made silently on a published schedule, on a population of devices the size of a continent. None of it is a breach. None of it is hidden. All of it can be checked in three taps and decided on the user's own terms.

The OS used to ask before changing your browser. It did not ask before changing the model behind your microphone. The looking is not difficult. It just has to start.