Personal assistant

A personal assistant is software that responds to a request in ordinary language and does something on the user's behalf: sets a reminder, sends a message, plays a track, looks up a fact, or switches on a light. The category sits between a search engine and a human aide, and its history is a record of narrowing that gap.

Assistants differ from chatbots in intent. A chatbot is built to converse; an assistant is built to complete tasks, which means it must know what the user has, what the user is allowed to do, and when to ask rather than act.

The distinction is blurring as general models acquire tools, and that convergence is the most consequential development in the category.

Three capabilities define the class. The first is natural-language understanding: the system accepts a request phrased as a person would phrase it, rather than a menu selection. The second is access to services: a calendar, a messaging app, a music library, a search index. The third is a persistent identity, so that preferences and history carry across sessions. Siri's launch release described exactly this combination, promising an assistant that would find a contact or infer a location from the question rather than wait for a command 1.

Systems missing the third capability are usually called bots or command interfaces. Systems missing the second are chatbots. The boundary is conventional rather than technical, and vendors apply the label to products that do little more than answer questions.

A useful distinction is between an assistant that retrieves information and one that changes state. Reading a weather forecast is harmless if wrong; sending a message, booking a flight, or unlocking a door is not. Most of the engineering and nearly all of the regulation concern the second kind.

The mass market arrived with the smartphone. Siri, introduced on the iPhone 4S in 2011, combined speech recognition with a small set of integrated services and demonstrated that people would talk to a phone in public 1. It launched in beta, in a handful of languages, and handled a narrow set of intents — calls, messages, reminders, search — but it set the pattern that competitors followed.

Google Now followed in 2012, emphasising prediction over request by surfacing information the system judged relevant. Microsoft's Cortana, announced in 2014, was built into Windows Phone and then Windows, before being retired in stages from 2023 as the company moved assistant features into Copilot 2. Amazon's Alexa, launched with the Echo speaker in 2014, took the assistant off the phone and into the home, and opened the platform to third-party devices and skills 3. Google Assistant, announced in 2016, consolidated search, speech, and device control.

The pattern in each case was a platform seeking a default position in the user's daily routine. The assistant became a channel through which services were reached, and the company that supplied the assistant could influence which services were offered first.

By the mid-2020s the centre of gravity had moved again. Generative assistants were embedded in operating systems, browsers, and messaging apps rather than in separate speakers, and the voice interface became one option among several. The speaker did not disappear, but the assistant's identity became less a piece of hardware than an account that follows the user between devices.

First-generation assistants were command systems. They recognised a fixed set of intents, mapped each to an action, and failed gracefully or not at all when the request fell outside the set. Their competence was narrow but their failure modes were visible: the device said it did not understand.

Generative models changed the interface. An assistant built on a language model can interpret an unusual request, ask a clarifying question, chain several steps, and explain what it did. The chaining is the substantive change: a command system performs one action, while a conversational assistant can plan a sequence and report it, and the same design choice lets it act on an instruction it has misread 4. It can also invent a capability it does not have, or claim to have completed an action it did not perform.

The engineering consequence is that capability and reliability diverge: the system appears more competent while becoming harder to test exhaustively. A command system that supports twenty intents has a finite test space; a conversational assistant has an unbounded one, and the failure that matters is often the one nobody thought to try.

A voice assistant is a pipeline. Audio is captured, a wake word is detected locally, speech is transcribed, the transcript is interpreted, an action is selected, the action is executed against a service, and a spoken response is synthesised. Each stage has its own error rate, and errors compound across the chain.

Text assistants skip the audio stages but share the rest. The orchestrator assembles context — the request, the user's calendar, location, recent activity, available tools — and decides whether to answer, ask, or act. Permissions determine which services the assistant may touch, and latency budgets determine how much model reasoning is affordable before the user gives up.

On-device processing is growing for wake words, transcription, and simple commands, because it is faster and keeps audio local. Complex requests still go to a data centre, which means the privacy properties of an assistant depend on which stage handles which request.

Identity is the hardest part of the plumbing. An assistant needs credentials for the services it acts on, and those credentials determine whether it acts as the user or merely for the user. Account linking, scoped tokens, and per-service permissions are the mechanisms that make the difference, and guidance for building agents treats the boundary of authority as something to define in advance rather than infer at runtime 5.

Assistants are data-hungry by design. Wake-word detection requires a microphone that is always listening locally; request processing usually sends audio or text to a server; personalisation requires a history of requests, locations, and contacts. Each of those is a point where sensitive information leaves the user's control.

Several providers have been criticised for retaining voice recordings longer than users expected, and for having contractors review samples to improve transcription. Some now offer opt-outs, automatic deletion, and on-device processing for common commands. Regulators have treated always-on audio and assistant data as personal data subject to purpose limitation, transparency, and deletion rights 6.

The design question is not whether an assistant collects data but whether the collection is proportionate, disclosed, and deletable. An assistant that records continuously in order to be ready to help is making a different trade-off from one that records only after a wake word, and the difference should be visible to the person in the room. Household devices complicate this, because a speaker in a kitchen captures the voices of visitors who never agreed to anything.

Assistants have proved genuinely valuable for people with disabilities. Voice control gives motor-impaired users access to messaging, calls, and home controls that would otherwise require fine motor movement. Screen-reader integration and spoken feedback support blind and low-vision users. Real-time transcription and captioning assist deaf and hard-of-hearing users in conversation.

The benefits depend on coverage. An assistant that handles the common cases but not the user's actual service is of little use, and accessibility features are often added late. Interfaces that rely on voice alone exclude people with speech impairments, and interfaces that rely on touch exclude people with limited dexterity; accessible design usually means offering several routes to the same action, which is the principle behind the W3C's success criteria 7.

Where assistants replace human support, they can also remove the flexibility that disabled users rely on. A chatbot that cannot be escalated to a person may be cheaper to run and worse for the user who needs an exception. Captioning quality varies in the same way: a transcript that is adequate for a lecture may be unusable for a conversation with overlapping speech, and the difference is rarely visible in a product demonstration.

An assistant that can act is an attack surface. Documented frauds have used cloned voices to impersonate relatives or executives, and smart speakers have been tricked by sounds from television or by commands shouted through a window. Unauthorised purchases and account changes are the commonest reported harms.

Agentic assistants add a second class of risk. An assistant that reads email or calendar invitations can encounter text instructing it to ignore its task, a form of prompt injection that is difficult to prevent because the model cannot reliably distinguish data from instructions. The same property that makes an assistant useful — access to many services — makes a successful attack more valuable 5. Voice authentication is a weak control in this setting, because a recording of a few seconds is enough to synthesise a convincing imitation of most speakers.

Mitigations are unglamorous: confirmation for consequential actions, spending limits, allowlists of services, device binding, separate credentials for different tasks, and logs that a person can review. NIST's framework treats the boundary of an assistant's authority as something to specify before deployment rather than discover in operation 5.

The current direction is action rather than answer. Assistants are being given the ability to book, purchase, fill forms, and operate other software, with the model choosing the sequence of steps rather than following a script.

That shift raises the stakes of error. A wrong answer can be corrected; an unwanted purchase or a deleted file cannot always be undone. Engineering guidance from practitioners emphasises narrow tools, explicit permissions, logging, and human checkpoints rather than maximal autonomy, and notes that the most reliable systems are often the least ambitious 4.

How far this will extend is unsettled. Demonstrations are frequent, reliable multi-step delegation is not, and the gap between the two is where the next few years of product work will happen. The regulatory question follows the technical one: a system that acts on a person's behalf is harder to classify as a tool than a system that only answers. Evaluation is the practical bottleneck, because a delegated task has many more ways to go wrong than a question has to be answered badly.

The commercial criticism is that assistants are a route to default status. A platform that controls the assistant controls which services are suggested, which payments are used, and which content is surfaced, and the assistant's answers become a form of placement. Regulators in several jurisdictions have examined default arrangements of this kind, and the assistant is one more layer in the same argument. Because the interface is conversational, the placement is harder to see than a list of search results, which makes the competition question harder to answer as well.

The design criticism is that voice is not always the right interface. Speaking is fast for short commands and poor for lists, comparisons, and corrections; people often prefer to type, and the most successful assistants are the ones that switch modes silently rather than insisting on conversation.

The social criticism is that ambient assistants normalise continuous listening in private spaces, and that the labour behind them — transcription review, annotation, and the writing of the responses — is invisible and poorly paid. Defenders reply that the conveniences are real, that processing is increasingly local, and that the alternative is doing everything by hand.

Underlying all three is a disagreement about what an assistant is for. One account treats it as a universal command line for digital life; another treats it as a branded layer over existing services; a third treats it as a companion. The products currently try to be all three, and the tensions between those aims are the reason the category keeps changing shape 6.