The company's AI principles document ran to twelve pages. It had a foreword from the CEO, five numbered principles, a glossary, and a reference to an internal review process. It had been downloaded 40,000 times and cited in three industry reports.
A policy analyst who read it carefully found it committed the company to nothing specific, created no accountability mechanisms, and excluded the AI use cases most likely to cause harm from its scope. The document was not dishonest. It was, in a precise technical sense, empty.
Most major tech companies have published AI principles, responsible AI frameworks, or AI ethics documents. These documents have become an expected part of corporate AI practice — investors, regulators, civil society, and journalists all look for them. Understanding their typical structure is the first step to reading them critically.
A standard corporate AI policy typically contains some combination of: Preamble and vision statement — explaining why the company is committed to responsible AI, usually featuring values language (fairness, transparency, accountability, human-centeredness). Principles or values — a numbered or bulleted list of commitments, typically 5–10 items, often overlapping significantly with those published by other companies. Governance description — a description of internal governance structures, often vague about actual authority and process. Scope statement — defining what AI systems the policy covers, often with exclusions. Process references — mentions of review processes, impact assessments, or testing procedures, typically without specifics.
Analysis of corporate AI principles documents finds striking convergence across companies — most include some version of fairness, transparency, accountability, safety, and privacy. This convergence creates a signal problem: when all companies publish the same principles, the principles themselves provide little information about how any specific company actually governs AI.
Corporate AI policies serve multiple functions simultaneously — and understanding these functions helps explain why policies look the way they do. External legitimacy: Demonstrating to regulators, investors, and civil society that the company takes AI governance seriously. Internal alignment: Communicating values and expectations to employees. Regulatory positioning: Establishing a posture before regulation arrives — companies with published AI principles can claim to have been ahead of the regulatory curve. Liability management: Creating a documented governance commitment that may be relevant in litigation. Competitive signaling: Differentiation in talent markets and enterprise sales where AI ethics is a decision criterion.
None of these functions requires the policy to contain enforceable commitments. A policy can serve all five functions while committing to nothing specific. This is not cynicism — it is the structural reality of voluntary corporate governance documents, and it is why reading them critically matters.
Individual principles within corporate AI policies have a characteristic structure. Typically: a label (Fairness, Transparency, Accountability), a definition (what the company means by the term), a commitment statement (what the company will do or strive for), and sometimes examples of how the principle manifests in practice. The critical questions for each principle: Is the commitment specific or aspirational? Does it create an obligation or express an aspiration? Is there a mechanism that enforces or tracks adherence? Does the definition of the term match how the term is used in technical or regulatory contexts?
Effective policy critique requires reading the document carefully before evaluating it. Many critiques miss important nuances — exclusions buried in scope definitions, commitments that are actually specific, or genuine governance substance in process descriptions. Read the whole document, including footnotes and linked pages, before concluding it is empty.
Go to the AI principles page of one of these companies: Google (ai.google/responsibility/principles), Microsoft (microsoft.com/ai/responsible-ai), Meta (ai.meta.com/responsible-ai), IBM (ibm.com/artificial-intelligence/ethics), or Anthropic (anthropic.com/responsible-scaling-policy).
Map the document's anatomy: (1) What sections does it contain? (2) For each principle, identify the label, definition, commitment statement, and any examples. (3) Does the scope statement include exclusions? What is excluded?
The policy said the company was committed to fairness. It defined fairness as ensuring AI systems do not discriminate based on protected characteristics. It described a bias testing process. It said outcomes would be monitored.
What it did not say: which specific AI systems were in scope. What the bias testing methodology was. What monitoring metrics were used. What would happen if monitoring found bias. Who was responsible for remediation. Whether results would be published. Whether affected individuals had any recourse.
The commitment was real. The governance was absent.
Reading for gaps requires knowing what to look for. Corporate AI policy gaps fall into several categories:
Scope gaps: Systems, use cases, or contexts excluded from the policy's coverage. Scope is often defined broadly in the abstract and narrowed in practice through exclusions — "third-party AI," "AI used for internal operations," "AI in products not marketed to consumers." Each exclusion removes a category of AI deployment from accountability.
Specificity gaps: Commitments that describe desired outcomes without specifying how they will be achieved. "We will ensure our AI is fair" without defining what fairness means, how it will be measured, or who is responsible for measuring it. Aspirational language is not governance.
Accountability gaps: Missing specification of who is responsible for what. Policies frequently describe processes in the passive voice — "AI systems will be reviewed," "assessments will be conducted" — without identifying who conducts the review, what authority they have, and what happens when reviews raise concerns.
Consequence gaps: Missing description of what happens when a principle is violated or a commitment is not met. Without consequences, principles are advisory rather than binding — even internally.
Redress gaps: Missing mechanisms for people affected by AI decisions to understand those decisions, raise concerns, or seek correction. Many policies describe governance obligations to the company without addressing obligations to affected individuals.
Passive voice in policy language is a reliable marker of accountability gaps. "Bias testing will be conducted" — by whom? "AI systems will be monitored" — by which team, with what metrics, reported to whom? Rewrite passive commitments in active voice and identify who performs each action. The result often reveals that specific accountability was never assigned.
Scope exclusions deserve particular attention because they define the boundary of accountability. Common scope exclusions to look for: Acquired or third-party AI: AI systems purchased from vendors or built into acquired products often fall outside the scope of policies written for first-party AI development. Research AI: AI used in internal research may be excluded from deployment-stage governance. AI embedded in existing products: When AI is added to an existing product, older policies written before AI was a component may not cover it. Geographic exclusions: Policies may apply only in specific jurisdictions, exempting AI deployed in markets without regulatory pressure.
One of the most revealing gaps to look for: does the policy create an audit trail? Could a regulator, journalist, or affected individual use the policy's own commitments to demonstrate that the company failed to meet them? Policies that create no documentable commitments create no audit trail — and no accountability beyond the company's own judgment about whether it has complied.
Using the same policy document from Lab 1 (or a different one), conduct a systematic gap analysis.
For each principle or commitment in the document: (1) Identify the gap type — scope, specificity, accountability, consequence, or redress. (2) Describe the specific gap. (3) Assess its significance — does this gap cover a high-risk AI use case, or is it a lower-stakes omission?
The researcher laid five corporate AI principles documents side by side. The words were different. The structure was nearly identical. Each had a principle called something like "Fairness." Each described bias testing. Each mentioned human oversight.
What was different: the scope of AI covered, the specificity of bias testing methodology, who oversight was owed to, what happened when oversight raised concerns. The differences were not in the principles. They were in the details that most readers skip.
Comparing AI policies across companies reveals several things that single-company analysis cannot: Industry norms — what commitments are standard practice vs. distinctive. Collective gaps — harms or use cases that no company's policy addresses, suggesting an industry-wide blind spot. Genuine differentiation — areas where companies have made meaningfully different choices. Regulatory arbitrage patterns — areas where policies are weakest correspond to areas without regulatory pressure.
Effective cross-company comparison requires a consistent framework. Useful dimensions to compare:
Scope coverage: Which AI systems and use cases are explicitly in scope? Which are excluded? How does coverage compare across companies in the same industry?
Specificity of commitments: For a given principle — say, fairness — how specifically does each company describe what it will do? Some companies specify protected characteristics, testing methodologies, and reporting obligations. Others use only abstract commitments.
Governance authority: Does any governance body have authority to block AI deployment? Or is all governance advisory? How does this compare across companies?
Transparency commitments: What does the company commit to publishing externally? Audit results? Incident reports? Bias testing summaries? Or nothing specific?
Redress mechanisms: What can affected individuals do? Are there appeals processes, correction mechanisms, or complaint pathways?
A common mistake in policy critique is judging a company against industry norms rather than against the actual harms its AI causes. If the entire industry has the same gap — say, no policies covering AI in content moderation — that gap does not become acceptable because it is universal. Industry norms tell you what is standard; they do not tell you what is sufficient.
Consider how major tech companies handle AI used in hiring — both their own hiring processes and hiring AI they sell to other companies. Policy comparison reveals a striking pattern: companies with detailed, specific policies governing AI they sell to enterprise clients often have much less specific policies governing AI they use in their own HR processes. The AI that affects their own employees falls in a scope gap — governed by general HR policy rather than the AI ethics framework.
This asymmetry is not random. AI sold to enterprise clients faces commercial scrutiny and potential regulatory liability. Internal HR AI faces neither. The gap reveals the role of external pressure in shaping governance specificity.
Choose two companies in the same industry (two major tech platforms, two large banks, two healthcare AI companies) and compare their AI policies on one specific dimension.
Pick one comparison dimension: scope coverage, governance authority, transparency commitments, or redress mechanisms. For each company, describe what the policy says on that dimension. Then: (1) Identify genuine differences between the two. (2) Identify where they are the same — and whether the sameness reflects an industry norm or a collective gap. (3) Assess which company's approach is more meaningful, and why.
The company had published a detailed AI governance framework eighteen months before the draft regulation appeared. When the regulation was circulated, the company's lobbyists made a specific argument: the regulation was unnecessary because the company already governed itself to a higher standard than the draft required.
The company's framework contained no enforceable commitments, no external accountability, and no consequences for non-compliance. The regulation would have required all three. The company's argument was made with a straight face — and it worked in several jurisdictions.
The term "ethics washing" — adapted from "greenwashing" in environmental policy — describes the use of ethics language and governance structures to create the appearance of responsible practice without the substance. In AI governance, ethics washing serves to deflect regulatory pressure, reassure stakeholders, and capture the legitimacy of ethical commitment without its costs.
Ethics washing exists on a spectrum. At the mild end: companies genuinely committed to responsible AI that use language that overstates the maturity of their governance. At the severe end: governance theater explicitly designed to preempt regulation or deflect accountability. Most real cases fall somewhere between these poles.
Principle proliferation without implementation: Elaborate principles documents with no governance structures capable of enforcing them. The gap between documented values and operational reality is the tell.
Process theater: Governance bodies that meet but cannot block deployments. Review processes that are designed to produce approvals rather than genuine scrutiny. Ethics impact assessments completed after deployment decisions are made.
Definitional stretching: Redefining terms like "fairness," "transparency," or "human oversight" in ways that allow existing practices to qualify — rather than changing practices to meet standard definitions. If a company defines "transparency" as publishing a general description of its AI types rather than providing system-level explanations to affected individuals, it has stretched the term beyond its governance meaning.
Regulatory preemption framing: Using published principles as evidence that regulation is unnecessary. This is the clearest signal that governance documents are serving a regulatory rather than an accountability function.
Scope gaming: Deliberately designing scope exclusions to cover high-visibility AI while excluding the AI systems most likely to cause harm or face criticism.
Most policy critics err toward charitable interpretation — assuming good faith and reading gaps as oversights rather than design. This often produces inaccurate critiques. Some gaps are design choices that serve specific interests. Effective critique requires considering both interpretations and asking which better explains the pattern of gaps: random oversight, or consistent exclusion of areas with regulatory or reputational risk?
Distinguishing genuine governance from ethics washing requires knowing what to look for on the positive side. Indicators of substantive AI governance: Governance bodies with demonstrated blocking authority — documented cases where a review body required changes or rejected a deployment. Specific, verifiable commitments — commitments specific enough that external parties could assess compliance. External transparency — publication of audit results, incident reports, or testing summaries. Redress mechanisms — accessible processes for affected individuals. Regulatory engagement — participation in regulatory development that does not consistently argue against binding requirements. Governance funding stability — responsible AI teams that survive revenue pressure and leadership changes.
Using the policy you've been analyzing, or a new one, make an evidence-based assessment of where it falls on the spectrum from genuine governance to ethics washing.
Your assessment must cover: (1) Indicators of ethics washing present in the document — with specific quotes. (2) Indicators of substantive governance present — again with specific evidence. (3) Overall assessment: is this primarily accountability-creating or accountability-deflecting? (4) What specific changes would move the policy toward genuine governance?
Reading & Critiquing Real Corporate AI Policies — 15 questions · 80% to pass