# BYO API key consent design and Notes for Review template for optional AI and alert features > Source-anchored research for BYO API key consent design and Notes for Review template for optional AI and alert features. Run status: COMPLETED. Parent: [Mac App Store Readiness: Residual Gaps for Sandboxed Monitors](https://llms-explorer.com/tree/mac-appstore-readiness-residual-gaps/) · 3 facets · 10 facts · page: https://llms-explorer.com/tree/byo-api-key-consent-design-and-notes-for-review-template-for-optional-ai-and-alert-features/ ## How it works - Apple has published no statement on whether 5.1.2(i) is relaxed when the user supplies their own API key and picks the provider. Developers raise the question publicly and no source answers it, so design BYOK consent as if the rule applies. (low confidence) (verified as of 2026-10-02) — [source](https://dev.to/arshtechpro/apples-guideline-512i-the-ai-data-sharing-rule-that-will-impact-every-ios-developer-1b0p) - Guideline 5.1.1(iv) says apps must not manipulate or force consent and should, where possible, offer alternatives when consent is declined; so the AI/alert feature must be off by default and declining must leave core monitoring fully working. (high confidence) — [source](https://developer.apple.com/app-store/review/guidelines/) - On-device processing (Core ML, Foundation Models) is reported not to trigger the 5.1.2(i) disclosure; only data leaving the device to a third-party AI does. A key-gated cloud provider does leave the device. (low confidence) — [source](https://stora.sh/blog/2026-05-06-apple-ai-consent-rule-5-1-2-i-implementation-guide) ## Problems, failure modes and limitations - Apple App Review sends Guideline 2.1 information requests (screen recording on a physical device, setup instructions and credentials for main features, external services used) when reviewers cannot reach a feature; the iOSSH case (2026-09-16) was returned for review information with no build defect cited. (low confidence) (verified as of 2026-09-16) — [source](https://github.com/m96-chan/iOSSH/issues/48) ## Facts and statements - Guideline 5.1.2(i) (added 2025-11-13) reads: 'You must clearly disclose where personal data will be shared with third parties, including with third-party AI, and obtain explicit permission before doing so.' (high confidence) (verified as of 2026-10-02) — [source](https://developer.apple.com/app-store/review/guidelines/) - Practitioner reading of 5.1.2(i): the consent screen must name the provider (not 'powered by AI'), say what the AI does, list concrete data types, require an affirmative tap, appear before the first API call, and be revocable from Settings. This is community interpretation, not Apple text. (medium confidence) — [source](https://stora.sh/blog/2026-05-06-apple-ai-consent-rule-5-1-2-i-implementation-guide) - Guideline 2.3.1(a) says new features, functionality and product changes must be described with specificity in Notes for Review (generic descriptions will be rejected) and be accessible for review; hidden or dormant features are prohibited. An optional key-gated AI feature counts. (high confidence) — [source](https://developer.apple.com/app-store/review/guidelines/) - Guideline 2.1(a) requires demo account info if the app includes a login, and allows a built-in demo mode only with prior Apple approval. A BYOK feature has no Apple-provisioned account, so the notes should either supply a reviewer-only key/endpoint with quota or state the feature is optional, off by default, and not required to use the app, ideally with a screen recording. (medium confidence) — [source](https://developer.apple.com/app-store/review/guidelines/) - Notes for Review template shape: keep to a few lines; state where the feature lives (menu path), default state, what data is sent to which named provider, how consent is revoked, that core features work without it, and credentials/demo path tested on a fresh install. Direct instructions beat marketing copy. (medium confidence) — [source](https://dev.to/shipdesk/how-to-write-app-review-notes-that-stop-the-information-needed-rejection-guideline-21-2e39) - Guideline 2.4.5(vi) bars Mac App Store apps from presenting a license screen at launch or requiring license keys. Putting the BYO API key prompt behind an optional Settings pane, never at launch, keeps it away from this rule; the guideline does not mention API keys for third-party services. (medium confidence) — [source](https://developer.apple.com/app-store/review/guidelines/)