Well on the OS level anyway. Individual apps can still foist the request to turn on their AI on you (wtf iTerm? At least you provide enterprise controls to disable it)