"If It's Illegal Without AI, It's Illegal With It"

The rules you already follow still apply to AI. Start your AI policy there.

Most business owners I talk to treat AI governance like a blank page: new policy, new committee, new rules before anyone touches a chatbot. So nothing happens, or everything happens without guardrails.

A June 2026 policy paper from Google offers a simpler starting point. It opens its section on everyday AI with this line:

"People on the left and the right agree that if something is illegal to do without AI, it's illegal to do with AI — we don't need to reinvent the wheel." (p. 13)

That's Google's claim about the political consensus, not settled fact. As a way of running a business, though, I find it useful.

What the paper actually says

Some context first. The paper is a corporate policy proposal. It isn't a law, a regulation or government policy. It describes two separate tracks:

• Frontier AI, meaning the most advanced models, which raise national-security questions. For these, Google proposes a federally overseen frontier AI regulatory organization (pp. 5, 7, 13).
• Widely deployed AI, meaning the chatbots and tools most businesses actually use. For these, Google argues the government "does not need new regulatory regimes that duplicate or conflict with existing law" (p. 5).

In the paper's words, "These two types of AI pose different risks that demand different solutions and different regulatory regimes." (p. 7)

The paper is not arguing against regulation. Google writes: "AI is too important not to regulate, and too important not to regulate well." (p. 7) It also says existing laws may need to be amended "in some cases" (p. 5).

Outputs, not inputs

The idea I'd take straight into your business is this one:

"This approach would address outputs, not inputs, looking to prevent and mitigate specific harms rather than micromanaging the science behind these new tools." (p. 13)

The paper applies the same logic to copyright. The question is "whether a specific image or piece of text actually copies an existing work, regardless of how it was created." (p. 18) It applies it to privacy too, proposing to "build on the tried-and-tested foundations of existing privacy laws" (p. 19).

For an operator, that changes the question you're asking. You stop asking "Is this AI tool allowed?" and start asking "Is the thing this tool produces something we'd be allowed to produce by hand?"

If a person on your team couldn't send that marketing claim, use that customer data that way, or publish that image, the AI version is a problem too. Having a model write it doesn't make it acceptable.

Passing this test is necessary, not sufficient. Some rules apply specifically to AI or automation, such as disclosure rules for chatbots, limits on AI-generated voice calls, and rules for automated hiring tools. Check whether any apply to you.

The honest caveat: not everything is settled

It would be easy to read this as "existing law covers everything, relax." The paper doesn't say that. Google itself writes:

"In fact AI is already posing new questions under long-established law, like when to entrust fiduciary duty, how to determine intent and assign responsibility, and whether an AI can be the "author" of a patent or the creator of a new work of art." (p. 13)

Responsibility, intent and authorship are exactly the questions that come up when an AI system acts on your behalf. So the principle gives you a starting point. It doesn't give you the final answer.

My take for small and mid-sized businesses

To be clear, this section is my own framing, not the paper's. Google's paper mentions small businesses once, when it describes industry programs "embedding technical experts into small businesses, non-profits, and local governments" (p. 14). That passage is in the workforce section. The paper makes no argument about small businesses' legal exposure, and I'm not claiming it does.

My view is that most businesses already have far more AI governance than they think. It just isn't labeled "AI". You already have:

• Rules about what you can say in advertising.
• Rules about how you handle customer and employee data.
• Contracts with confidentiality terms.
• Approval steps for anything that goes out under the company name.
• Industry-specific obligations you've lived with for years.

Your AI policy doesn't have to start from zero. It can start with one sentence: "Everything that already applies to our work applies to work done with AI." After that, fill the gaps where AI genuinely changes things. The usual ones are who reviews what, who's accountable when an agent acts, and which data goes into which tools.

Practical takeaways

1. Start from what you already follow. List the compliance, contract and brand rules your team works under today. That list is the first draft of your AI policy.
2. Judge AI by its output. Before something AI-generated goes out, ask whether it would be acceptable if a person had made it by hand. If not, it isn't acceptable now. Then check for AI-specific rules.
3. Name the gaps the old rules don't cover. Accountability, intent and authorship are open questions even in Google's own framing (p. 13). Decide internally who signs off on and owns AI-assisted work.
4. Map your data before you map your tools. Your existing privacy and confidentiality obligations decide what can go into an AI tool. Work out what data you hold first, then pick tools.
5. Bring in counsel where you're in a regulated area (health, finance, hiring, consumer calls or texts, kids' data) or where AI acts with real autonomy. Get qualified legal advice instead of relying on a principle from a policy paper.

This post is general commentary for business operators. It is not legal advice. Talk to a qualified attorney about your specific situation. The author is not a lawyer, and reading this doesn't create an attorney-client relationship.

Sources

• Google, A Pragmatic Approach to AI Governance in America, June 2026. Corporate policy proposal; cited pages 5, 7, 13, 14, 18, 19. https://static.googleusercontent.com/media/publicpolicy.google/en//resources/a-pragmatic-approach-to-ai-governance-in-america.pdf