Apple rewrote two lines of its App Store rulebook on October 16, adding artificial intelligence to the list of tools developers must police and closing a door that some had been walking through for years.
The first change sits in section 1.2 of the App Review Guidelines, the clause that requires apps with user-generated content to filter objectionable material. The revision names AI-generated intimate images made without consent as content that must be blocked and removed rather than reported afterward.
The second change targets a method rather than a category. Section 2.5.19 now covers apps that hide features during review and switch them on after approval. Apple said such apps will be removed and their developers expelled from the developer program.
That second rule addresses a problem Apple has described for years without naming it in the guidelines. Reviewers see a build submitted for approval; a server-side switch can change the app afterward, and the version that reaches phones need not match the version that was checked.
The mechanism Apple controls is the developer account, not the app. Removing an app from the store is reversible and often is reversed. Terminating the account takes away the certificates that let any app from that developer run on an iPhone, which is why the threat is taken seriously by people who build for the platform.
The timing of the AI clause reflects a year in which image generators became cheap and the apps that wrap them multiplied. Apple’s guidelines already banned content that is obscene or defamatory. Naming non-consensual intimate imagery removes the argument that a developer did not know which category applied.
On the same day, in London, a different kind of rulemaking was moving. The Financial Times reported that the Competition and Markets Authority will consult on requiring Apple to open the iPhone’s near-field communication chip to third-party wallet providers for contactless payments, and that Apple is preparing to challenge the move in court.
The NFC chip is the part of an iPhone that talks to a payment terminal. Apple has kept it under its own control, routing contactless payments through Apple Pay and taking a fee from issuing banks. The company has argued that the arrangement protects security, because the payment credentials sit in a dedicated chip that the operating system cannot read.
Britain’s regulator has been building toward this for two years. The Digital Markets, Competition and Consumers Act gave the CMA power to designate firms with strategic market status and to impose conduct requirements on them. The CMA designated Apple’s mobile ecosystem last year, and the penalties for breach run to 10 percent of global revenue.
Apple has said it will fight the designation in the courts, arguing that the regulator has overstepped and that the security model for contactless payments cannot be separated from the hardware. The company made a similar argument in Brussels and lost, then opened NFC access in Europe under the Digital Markets Act.
That precedent is why the British process is being watched closely. Once a wallet from a third party can complete a contactless payment on an iPhone in one jurisdiction, the technical argument that it cannot be done safely elsewhere becomes harder to sustain.
The economics are small in absolute terms and large in principle. Apple Pay generates fees that are a rounding error against iPhone revenue and a meaningful sum against services revenue, the line item investors watch for margin. Opening the chip would put those fees under competitive pressure.
For banks and wallet providers, the question is whether a third-party wallet can offer the same tap-to-pay experience without routing through Apple’s servers. For merchants, it is whether more wallets mean lower acceptance costs. Neither group has been shy about telling the regulator what it wants.
The two stories from October 16 are not connected by anything except the date. They are connected by the argument underneath. Apple’s position, stated in filings and in testimony, is that it sets rules for its own platform because it understands the security model better than a regulator does.
The CMA’s position is that a company with that much control over how software reaches phones and how payments leave them is making public policy whether it says so or not, and that public policy is written by governments.
That disagreement is being resolved in three places at once: Brussels, where the DMA is in force; London, where the statute is new; and Washington, where the antitrust case against Apple’s App Store rules is in the pretrial phase. Each will produce a different answer, and developers will build to the most permissive one.
The practical effect for a developer is that the cost of compliance is rising. A company that ships an app in forty markets now needs to know which content rules apply where, which payment paths are permitted and which features must be switched off in which storefront.
Apple’s guidelines run to thousands of words and are revised several times a year. Each revision adds a category, and categories accumulate into a body of rules that no small team can track without help.
What the October 16 changes do not do is settle the question the regulators keep returning to: whether the company that writes the rules should also be the one that enforces them. Apple has answered yes since the store opened in 2008. The answer is now being tested in three jurisdictions at once.
