Google Decides What Counts as Harm — And That Should Concern Everyone

NewsOnScale Staff

September 19, 2026

There is a version of this story that gets told as progress. A major technology company, under pressure from regulators, researchers, and the public, publishes a detailed framework explaining how it thinks about harm in its AI systems. Definitions are offered. Categories are established. Lines are drawn. The narrative writes itself: accountability is happening.

That version is incomplete.

Google's newly released AI governance plan does something that deserves more scrutiny than applause: it positions a single private corporation as the authoritative classifier of harm for systems that now touch hundreds of millions of people's daily lives. The document may be detailed, transparent by some measures, and earnest in its intent. None of that resolves the structural problem at its center.

## Defining Harm Is a Political Act

When a governance document decides what qualifies as harmful content, dangerous capability, or acceptable risk, it is not making a technical determination. It is making a values determination — one that reflects the priorities, blind spots, legal exposure, and commercial interests of the institution writing it.

Every meaningful category in a harm taxonomy carries embedded assumptions. Does "harm" include economic displacement caused by automation? Does it include the psychological effects of algorithmic recommendation patterns? Does it include suppression of political speech that a platform deems misleading but a user considers legitimate dissent? These are not engineering questions. They are contested civic questions, and the answers have consequences that extend well beyond any single company's product roadmap.

When Google draws those lines internally, with limited external binding authority over those choices, the framework functions less like governance and more like self-certification.

## The Preemption Problem

This matters especially now because the regulatory environment in the United States remains fragmented. Federal AI legislation has not materialized in any comprehensive form. State-level efforts are inconsistent. The current administration has signaled skepticism toward aggressive AI oversight. Into that vacuum, corporate governance frameworks are quietly becoming the de facto standard.

That is not how accountability is supposed to work. When private definitions of harm go unchallenged by binding public frameworks, companies effectively preempt democratic deliberation. They decide first, and regulators — if they ever arrive — are left negotiating with existing infrastructure rather than shaping it.

OpenAI made headlines this week calling the current moment an open policy window. They are right, though not entirely for the reasons they mean. The window is open because the rules have not been written. What fills that space in the interim is corporate governance documentation, however well-intentioned.

## What Transparent Opacity Looks Like

Google's framework may be more transparent than what most competitors have published. That transparency deserves acknowledgment. But transparency about a process is not the same as democratic legitimacy over the outcomes of that process. A company can publish exactly how it makes decisions while still making decisions that no public body has authorized it to make.

The questions that governance documents like this one consistently fail to answer are the structural ones: Who appeals a harm classification? What external body has oversight authority? What happens when Google's definition of harm conflicts with a government's, a community's, or a researcher's? What commercial considerations influenced where the lines landed?

These are not gotcha questions. They are the basic architecture of accountable governance, and their absence from even the most detailed corporate framework tells you something important about what kind of accountability is actually on offer.

## The Stakes of Getting This Wrong

AI systems are increasingly embedded in hiring, healthcare navigation, legal research, financial access, and information consumption. The harm taxonomies that govern those systems are not abstract policy documents — they determine whose experiences get flagged, whose concerns get addressed, and whose risks get categorized as acceptable.

Getting those taxonomies right matters. Getting the process by which they're set right matters even more. Right now, that process runs almost entirely through corporate planning cycles, not public deliberation.

Google publishing its thinking is a starting point. Mistaking it for an endpoint would be a significant error.