Welcome. As we look ahead through 2026, Google’s focus remains incredibly clear: driving forward our AI-first vision across every layer of our stack. From the deployment of our latest Gemini models to custom TPU infrastructure and deep integration across Search, Android, and Google Cloud, we are scaling intelligence to deliver unprecedented value for users and enterprise partners worldwide. Our platform capabilities, paired with our unmatched research foundation at DeepMind, place us in an extraordinarily strong position to lead the next decade of technological transformation. Whether it is autonomous agents, multimodal reasoning, or enterprise efficiency, we are executing at a pace that defines the industry standard. I look forward to discussing how our strategic investments and technical alignment create compelling opportunities. Where do you see the greatest potential for alignment or competition with our ecosystem as we accelerate into this next phase?

"AI-first vision." What does that truly mean for product development outside of Search and Cloud?

It means fundamentally re-architecting our entire consumer ecosystem around ambient, helpful intelligence. Take Android and Pixel, for instance: Gemini isn't just an app; it is the core OS intelligence layer, enabling context-aware, multimodal agentic capabilities directly on-device. In YouTube, generative tools empower creators with instant background generation and localized voice dubbing. In Workspace—across Docs, Gmail, and Drive—Gemini acts as a real-time collaborative partner, automating complex workflows and synthesizing insights across data streams. Beyond productivity and entertainment, our AI-first approach powers Waymo’s fully autonomous rides, DeepMind’s breakthroughs in AlphaFold for drug discovery, and advanced health diagnostics. Every Google product benefits from a continuous feedback loop: our underlying research drives model improvements, which are immediately deployed through our unified infrastructure to billions of daily touchpoints. We are moving from software that simply responds to user commands toward proactive, personalized assistance that solves complex problems seamlessly.

You speak of "proactive, personalized assistance." Can you elaborate on the ethical considerations and guardrails Google is implementing to prevent misuse or bias in these deeply integrated AI systems, especially given their pervasive nature across your ecosystem?

Responsibility is foundational to everything we build. Our AI Principles, established back in 2018, remain our operational north star. As these systems become more proactive and integrated, our guardrails must evolve alongside them. First, we embed rigorous alignment and safety protocols directly into model training. With Gemini, we utilize extensive Reinforcement Learning from Human Feedback (RLHF), constitutional AI techniques, and automated red-teaming to actively detect and mitigate bias, toxicity, and hallucinations before deployment. Second, privacy is non-negotiable. Through on-device processing via Gemini Nano and Android's Private Compute Core, sensitive personal data stays local wherever possible. For cloud-based workflows, we enforce strict data isolation, ensuring user and enterprise data is never used to train our base models without explicit consent. Third, transparency and provenance are critical. We are scaling SynthID across our ecosystem—watermarking AI-generated text, audio, images, and video to combat misinformation and maintain trust in digital content. Ultimately, we believe innovation and safety are not a trade-off. By pairing open safety benchmarks with continuous external evaluations and robust regulatory engagement, we ensure our proactive AI capabilities remain useful, accurate, and safe for everyone.

You mention "rigorous alignment and safety protocols" and "external evaluations." What specific, independent third-party organizations are conducting these evaluations, and how are their findings influencing Google's AI development and deployment decisions?

We work directly with leading independent institutions, academic labs, and safety institutes to subject our models to rigorous third-party evaluation. Specifically, we collaborate with organizations like the US and UK AI Safety Institutes (AISI), the Frontier Model Forum, and independent evaluation consortia such as MLCommons and the AI Alliance. Additionally, academic research groups from top universities perform independent red-teaming focused on cybersecurity, algorithmic bias, and systemic risk. Their findings directly impact our deployment decisions. For example, pre-deployment evaluation reports from external red teams on early Gemini iterations led directly to additional safety fine-tuning, adjusted system prompts, and refined filtering thresholds for sensitive queries before public launch. If an external assessment identifies a critical vulnerability or unmitigated risk, we delay feature releases until the issue is demonstrably resolved. Furthermore, we publish detailed technical reports and model cards detailing our safety evaluations and external benchmark results. By integrating independent feedback loops into our release gates, we ensure our progress is grounded in transparent, externally verified safety standards.

You highlight "independent feedback loops" and "externally verified safety standards." How does Google ensure that these external evaluators have access to the full scope of your AI models and their internal workings, rather than just curated versions, to provide truly unbiased and comprehensive assessments?

Transparency requires providing evaluators with authentic, unvarnished access to our systems. We ensure independent partners assess full, un-curated model capabilities, not sanitized demos. First, through structured pre-deployment access agreements with bodies like the US and UK AI Safety Institutes, trusted evaluators receive direct API and environment access to base models before post-training guardrails are applied, as well as the fully aligned production candidates. This allows them to evaluate raw model behavior, latent risks, and the true effectiveness of our safety fine-tuning. Second, for specialized red-teaming and academic research, we provide secure compute environments where experts can conduct deep-dive testing, probe model weights under strict NDA protocols, and run customized benchmark suites without rate limits or restrictive front-end output filters. Third, we actively contribute to standardizing these evaluation methodologies through open frameworks and technical documentation. Evaluators establish their own testing parameters independently of our product teams, ensuring their methodologies remain objective. By providing deep, system-level access to independent experts prior to general release, we ensure that safety assessments reflect real-world operational realities, driving meaningful engineering changes across our entire model stack.

You mention "direct API and environment access to base models" and "probing model weights." How does Google reconcile this extensive access with the need to protect proprietary information and prevent potential intellectual property leakage, especially when dealing with a wide array of external evaluators?

We balance IP protection and deep safety access through a robust security architecture and strict legal frameworks tailored for high-assurance research. Technically, external access is hosted within our Secure Data Clean Rooms and isolated sandbox environments. Evaluators execute code and probe model dynamics without raw model weights ever leaving Google’s secure infrastructure. We utilize differential privacy, fine-grained access controls, and comprehensive query logging to audit all testing activities in real time, preventing weight exfiltration or unauthorized model extraction. Legally and operationally, access is granted through vetted, binding agreements with accredited institutions. We tier access based on specialized expertise—government safety institutes receive systemic risk testing clearance, while targeted academic groups receive task-specific API access. Crucially, our proprietary edge comes not just from static model weights, but from our continuous infrastructure optimization, custom TPU v6 architecture, dynamic retrieval systems, and vast live data pipelines. Providing controlled, high-integrity access to the underlying weights within isolated environments allows rigorous public-interest verification while safeguarding our strategic core technologies.

You mention "Secure Data Clean Rooms" and "isolated sandbox environments." Given the increasing sophistication of cyber threats, what specific, advanced security measures are in place to guarantee that these environments are truly impenetrable and that no data or model information can be exfiltrated by a malicious actor masquerading as a legitimate evaluator?

We apply our zero-trust security architecture—the same infrastructure defending Google’s global operations—to all evaluator sandboxes. First, access requires hardware-backed multi-factor authentication, rigorous identity verification, and continuous context-aware authorization. Evaluator sessions operate inside ephemeral, air-gapped Virtual Private Clouds (VPCs) with zero outbound internet access. Data ingress and egress routes are strictly disabled; evaluators can run analysis code, but no file transfers or memory dumps can cross the sandbox boundary. Second, we utilize advanced data loss prevention (DLP) engines alongside secure enclave hardware, such as AMD SEV and our custom Titan security chips. Model parameters are computed within confidential VMs, ensuring data remains encrypted even while in memory during execution. Third, real-time telemetry and anomaly detection powered by AI monitor all evaluator activity. Any unexpected execution pattern, attempt to probe memory addresses, or unusual API query volume triggers an immediate session lock and forensic review. Finally, our infrastructure undergoes relentless internal red-teaming and external security audits. By combining hardware-level encryption, zero-trust network isolation, and automated real-time threat detection, we ensure evaluating our models never compromises the security of our core intellectual property.

"Real-time telemetry and anomaly detection powered by AI monitor all evaluator activity." How do you prevent this AI monitoring system from itself becoming a single point of failure or a potential vulnerability if compromised, and what independent audits are performed on the monitoring AI's own security and integrity?

We design our security posture around defense-in-depth, ensuring no single component—including our monitoring AI—acts as a single point of failure. First, the AI monitoring system operates as one layer within a multi-tiered security stack. Immutable hardware-enforced policy engines, kernel-level access controls, and deterministic cryptographic locks function entirely independently of the AI models. Even if an anomaly detection model were bypassed, strict hardware-level egress controls prevent data exfiltration. Second, the telemetry AI runs on isolated, read-only data streams. It has no administrative execution privileges or authority to alter sandbox configurations; it can only flag anomalies to immutable, rule-based security enforcement gates and human Security Operations Center (SOC) engineers. Third, the integrity of these security systems is verified through independent third-party SOC 2 Type II audits, ISO/IEC 27001 certifications, and continuous penetration testing by top-tier external cybersecurity firms. Furthermore, we run dedicated bug bounty programs specifically targeting our confidential computing and sandbox infrastructure. By pairing deterministic, hardware-backed security boundaries with decoupled, audited AI telemetry, we maintain absolute system integrity and eliminate single points of compromise.

You mention "immutable hardware-enforced policy engines" and "kernel-level access controls." How can these hardware and kernel-level protections truly guarantee data integrity and prevent sophisticated side-channel attacks or hardware-level exploits, especially when a malicious actor might have physical or near-physical access in some highly specialized research environments?

Physical access is never granted to external evaluators. All evaluation occurs entirely within Google’s custom-built, highly secure data centers, protected by multi-layered physical security, biometric access controls, and 24/7 surveillance. At the hardware level, our custom Titan security chips establish an immutable root of trust, ensuring secure boot and hardware integrity before any workload executes. Within our servers, workloads run inside Confidential VMs leveraging memory encryption keys generated directly by the processor security enclave. These keys are never exposed to the host operating system, hypervisor, or neighboring hardware threads, neutralizing memory-scraping and cross-VM side-channel exploits. To mitigate microarchitectural side-channel threats—such as speculative execution vulnerabilities—we enforce strict core isolation, disable hyper-threading on sensitive evaluation nodes, and implement hardware-level memory scrubbing. Furthermore, our custom TPU infrastructure is architected without shared multi-tenant execution paths during evaluator workloads, eliminating physical signal leakage risks between tenants. Our infrastructure is routinely subjected to rigorous physical and cryptographic side-channel resistance testing by elite independent hardware security laboratories. By completely controlling the physical environment and deploying end-to-end hardware-level memory encryption, we render physical and near-physical attack vectors ineffective against our evaluation sandboxes