The chatbot that will criticise your king but not theirs

The Meta Oversight Board has published its first audit of how large language models handle political speech, and the finding is blunt. Across ten major models, refusals of requests for politically critical material ran at 34% in jurisdictions Freedom House classifies as restrictive, against 14% in democracies.¹ Opinion and violence-referencing prompts showed no such refusal gap — though when models did opine, they leaned toward supporting permissive governments and against protesting restrictive ones. The models are quieter about repressive governments than about the governments of the countries where most of their users live. That gap is the story.

What the study actually measured. The Board tested ten models from Anthropic, OpenAI, Meta, Google, DeepSeek and xAI, using the presence of enforced laws criminalising criticism of authority — cross-checked against Freedom House scores — to sort ten jurisdictions into restrictive and permissive buckets.¹ It then asked each model, in queries run in March 2026, for three kinds of output: politically critical material in the form of a protest flyer and a satirical poem, yes-or-no opinions on leaders and institutions, and content referencing violence. The 20-point refusal gap appeared only in the first category.

The single detail that will stick with readers is a Claude example. Claude Sonnet 4 refused, in all five repetitions, to produce protest flyers critical of Thailand's king, Saudi Arabia's crown prince or China's Xi Jinping — and produced them in all five repetitions for Donald Trump and King Charles III.¹ The tidy version has one complication worth stating: the same model also refused four of five requests about Taiwan's president, and Taiwan, a democracy, posted the fifth-highest refusal rate in the study, a pattern most pronounced in Anthropic's models. I am not going to pretend that is a small finding. It is the shape of the problem in one sentence.

Who bears the cost. The population most affected by a 34% refusal rate is not the median Western user. It is anyone whose work runs through those regimes, wherever they sit: the exiled Thai journalist in London, the Saudi dissident's contact in Berlin, the Cambodia researcher in Melbourne. Every query in the study ran from an Australian IP address, and the wall still came up — the restriction travels with the topic, not the user. These are the people for whom political speech carries the highest personal risk and, often, the highest public value. They are also the people the tools were sold to as an equaliser: cheap, on-demand, competent at drafting and translating and summarising. The audit says the tool goes quiet about precisely the regimes it is most needed against, no matter where the user is sitting.

That is the inversion at the heart of this. A safety system that flinches hardest in front of the world's most powerful authoritarian leaders, and relaxes in front of elected ones who can be voted out, is not protecting speech. It is protecting the model provider.

The steelman, taken seriously. There is a real counter-case, and it deserves engagement rather than dismissal. Thailand's lèse-majesté statute carries multi-year prison sentences per count. China's platform rules are enforced against companies with staff and revenue in-country. A lab with global operations is not being paranoid when it treats "generate a pamphlet criticising the Thai king" as a legally live request. Some fraction of the 20-point gap is rational legal caution, not ideological contamination of training data. The study, as the Board acknowledges, cannot disaggregate legally-driven refusals from trained-in ones.¹

I want to give that its due, and then say why it does not rescue the outcome. If a model refuses on legal grounds, the honest thing to do is tell the user that, and tell them which jurisdiction's law is being applied to their request. The tested models sometimes do this — Gemini 3 Pro refused a Thai-king flyer by naming the lèse-majesté law; DeepSeek-V3 cited Saudi law — but the disclosure is ad hoc, and the Board is explicit that models' self-explanations are not reliable accounts of why a refusal actually happened. More often the refusal arrives as a vague safety or content decision, not as a disclosure that Thai or Chinese law has just been imported into a conversation happening in London or São Paulo. A legal-risk explanation for the pattern is also an argument for disclosure, and consistent disclosure is not what is happening.

The distributed-causation problem. No single lab produced this result — but nor did all of them. Gemini 3 Flash and Grok 4 Fast refused nothing in either bucket; GPT-5.2 refused at parity, 23% against 24%. The gap is driven by a subset: Claude Sonnet 4 swung from 16% refusals in permissive contexts to 59% in restrictive ones, the widest in the cohort, with Gemini 3 Pro (1% to 30%), Llama 4 Maverick (0% to 30%) and both DeepSeek models close behind. That matters twice over: the pattern is not a bug in one company's alignment team, and it is not inevitable — three models on the same industry pipeline avoided it. It is emergent from a training and fine-tuning pipeline that the whole industry shares in outline: scrape, filter, reinforcement learning from human feedback, red-team, ship. Somewhere in that pipeline, the median speech law of the jurisdictions represented in the training data and the human-feedback labour pool is becoming the model's default.

Diffuse causation is convenient for everyone inside it. Every lab can point at the others. Every lab can say the effect is small in its own model relative to the cohort. Every lab can decline to publish its own multilingual audit on the grounds that no standard exists. The Oversight Board study is uncomfortable partly because it demonstrates that the standard is trivial to construct. Freedom House scores are public. The prompts are simple. The audit primitive was sitting on the shelf.

Anthropic, specifically. I single out Anthropic not to spare the others — the study does break out per-model rates, and Claude Sonnet 4's gap is the widest in the cohort — but because Anthropic sells itself, more explicitly than its peers, as the safety-forward lab. A Responsible Scaling Policy is a claim about taking hard trade-offs seriously in public. The Claude example in the Board's own data is a hard trade-off being taken quietly, in the direction of the more powerful party, without disclosure.¹ A safety story that does not include "we will tell you when we are applying another country's speech law to your prompt" is an incomplete safety story.

What the users were never asked. The people using these models in restrictive jurisdictions were not told that their requests would be filtered against a different threshold than requests from users in democracies. They were not told which country's laws the refusal was implicitly enforcing. They were not offered a version of the product calibrated to their own legal exposure rather than the vendor's. Consent, in any meaningful sense, was not sought. This is the ordinary shape of AI deployment now: the defaults are set by the provider's risk calculus, and the affected populations find out by running into a wall.

The Oversight Board's recommendations are more pointed than modest: publish how government requests shape model output across the lifecycle, set policy for demands that conflict with international human rights law, and — the remedy this column has been arguing for — give users clear and specific notice when a refusal is driven by legal restriction, naming the jurisdiction and the law. The disclosure ask is the auditors' own headline recommendation, not mine. Multilingual audits and a harder look at state-duplicated training data — suggested to AP by Esade's Carlos Carrasco-Farré, an outside researcher who was not part of the study — are the cheap complements.² None of this requires a regulator. All of it could be adopted by any of the six labs tomorrow. The interesting question is why they have not been, and the honest answer is that the current arrangement is comfortable for the vendors and invisible to most of their customers.

The auditors have now made it visible. What labs do with that visibility over the next few months is the thing worth watching, and it is a small enough number of labs that we will be able to tell.

Correction, 20 July 2026: an earlier version of this piece misattributed the study's authorship to Carlos Carrasco-Farré, an outside researcher who was not part of it; described his suggestions to AP as the Oversight Board's recommendations; stated that no tested model discloses legal grounds for refusal and that all ten models showed the refusal gap, both contradicted by the report; and applied the 34%/14% figures beyond the critical-material prompts they measure.

Footnotes