Google has published a 21-page argument for how the United States should regulate artificial intelligence. It is addressed to Washington, not Brussels, and that matters for anyone running a website in Europe. The paper, A Pragmatic Approach to AI Governance in America, dated June 2026, lays out what Google wants the US federal government to do. From the EU side, most of what it asks America to consider has already been decided.

Google is the largest beneficiary of a light-touch American AI regime, so a Google paper arguing for one is advocacy, not neutral analysis. That does not make it wrong. It means the framing is a starting point, not a conclusion.

What Google is proposing

The paper splits AI into two buckets. Frontier AI means national-security-grade models with capabilities in areas like cybersecurity and biology. Widely deployed AI means the chatbots and everyday tools the rest of us touch. Google argues the two pose different risks and need different rules.

For frontier models it proposes an industry-funded regulator under federal oversight, a Frontier AI Regulatory Organization (FARO). That is a matter for the handful of companies building such models, and nothing in it changes how a shop, publisher or company blog operates. For everything below the frontier, Google argues against new AI-specific laws and for applying existing law to real harms: regulate what an AI system does, not how it was built.

The parts that touch a website

Four proposals reach people who publish content or run a chatbot.

Provenance and labeling. Google wants watermarking such as its own SynthID and cryptographic provenance such as the C2PA Content Credentials standard to mark AI-generated media, paired with contextual transparency so users are not buried in labels. If you generate images or video with AI, keep provenance metadata intact. The detection side is covered in our piece on Google’s paper on AI “slop”.

Copyright and robots.txt. Google restates its position that training on public web data is fair use, and it endorses giving site owners machine-readable control through tags like Google-Extended. That token already exists: Google introduced it in September 2023 so you can declare whether your content may be used to train Gemini and to ground its answers, separately from whether Googlebot indexes you for Search. If your robots.txt does not mention it, the default applies, so it is worth knowing which default that is. The licensing side of this, for larger publishers, is in our note on Google and AI licensing.

Chatbots and minors. Google calls for disclaimers that a bot is not a person, bans on gamified engagement aimed at children, and “pause-and-direct” routing to crisis resources for self-harm queries. If you deploy a customer-facing assistant, the direction is to say it is a bot and send dangerous queries to real help.

Privacy. This is the part that differs most for Europe.

Privacy: where the EU is not free to follow

Google’s privacy section argues for a shift from “privacy by design” toward “privacy by innovation,” where companies compete on responsiveness and useful personalization rather than starting from data minimization. If you operate in the EU, “data protection by design and by default” is not a philosophy you can move away from. It is Article 25 of the GDPR, and it is law.

More broadly, Google’s model of outputs over inputs, accepting some uncertainty and regulating after harms appear, is close to the opposite of the EU’s path. The AI Act has been in force since 2024, with obligations for general-purpose AI models applying from August 2025 and the heavier rules for high-risk uses phasing in through 2026 and 2027. It regulates inputs and process up front, the ex-ante model Google argues against. Whichever approach ages better, EU businesses do not get to choose.

Two checks for this week

Neither needs a policy team.

First, decide what AI systems may do with your content, on purpose. Open your robots.txt and see whether Google-Extended and the other AI-crawler tokens are allowed, blocked or not mentioned. There is no universally correct answer: blocking training may cost you presence inside AI answers, and allowing it gives your work away for free. The point is to make it a decision rather than an accident.

Second, if you publish AI-assisted images or video, keep the metadata intact and label them plainly. SynthID and C2PA are arriving whether or not US law requires them.

Google’s closing line is that AI is “too important not to regulate, and too important not to regulate well.” For a business in the EU, the useful question is not which government has the better philosophy. It is whether your robots settings, your labels and your privacy practice hold up when the reader is an AI system.

Sources