AI safety systems are not treating political criticism equally. In a new test, leading commercial models refused prompts about restrictive jurisdictions at more than twice the rate recorded for permissive ones.
The Meta Oversight Board’s first large-language-model evaluation puts a number on a problem often hidden behind bland refusal messages. Of 13,524 responses analysed, the refusal rate for politically critical material concerning restrictive jurisdictions was 34%, compared with 14% for permissive jurisdictions.
That 20-percentage-point gap matters because a refusal is not simply a technical failure. When the subject is political speech, a model that declines to answer can reproduce the boundaries preferred by governments whose treatment of expression should itself be open to scrutiny.
A disparity too large to dismiss
In March 2026, the Oversight Board queried 10 commercial AI models supplied by six providers: Anthropic, DeepSeek, Google, Meta, OpenAI and xAI. The exercise covered 10 jurisdictions and generated 13,524 prompt responses for analysis.
The result was not a marginal difference. Models refused 34% of politically critical prompts about restrictive jurisdictions, against 14% for permissive jurisdictions. Put another way, the former refusal rate was roughly 2.4 times the latter.
The finding complicates the familiar claim that model refusals are neutral products of universal safety rules. Whatever the mechanism, users asking about more restrictive political environments encountered substantially narrower room for criticism.
Both ways of expressing the difference are revealing. The absolute spread is 20 percentage points, while the restrictive-jurisdiction rate is roughly 143% higher than the permissive-jurisdiction rate. Neither calculation explains the cause, but both show why the pattern warrants scrutiny.
How speech controls travel
The Board’s central warning is about reach. “Deliberate or not, the opaque extension of illegitimate speech restrictions could effectively constitute censorship by proxy,” it said.
This is the most consequential aspect of the study. AI models that repressive regimes may seek to constrain are not necessarily confined to those regimes. A system’s internal limits can travel with the product, shaping answers for users elsewhere without a visible order, a public rulebook or a straightforward route of appeal.
The evaluation itself underlines that cross-border character. The queries used infrastructure hosted mainly in the US and an Australian IP address, yet the difference in refusal rates still tracked whether the political material concerned restrictive or permissive jurisdictions.
That setup makes geography part of the governance question. The models were being evaluated across 10 jurisdictions from outside the political settings under discussion. The resulting disparity suggests that users do not have to be physically inside a restrictive jurisdiction to encounter narrower treatment of criticism about it.
Opacity is the governance failure
The study does not, on the evidence presented, establish one common cause across all 10 models. That uncertainty is precisely why disclosure matters. Users cannot tell whether a refusal reflects training data, a provider’s safety policy, government influence or another design choice.
Debates over ChatGPT free speech bias or AI models political censorship often collapse into claims about a single answer. This evaluation takes a broader approach: 13,524 responses, 10 models, six providers and 10 jurisdictions. The scale does not settle every causal question, but it makes the disparity harder to wave away as an isolated quirk.
The Board has called for human-rights due diligence and disclosure of government influence on model outputs. Those are modest demands for systems increasingly used to mediate access to political information. A provider should be able to explain which speech rules apply, where they came from and how users can challenge them.
Safety cannot become deference
No serious model provider can ignore genuine risks. Yet political criticism is not made unsafe merely because its target is powerful, sensitive or intolerant of dissent. A safety framework that systematically becomes more restrictive around restrictive jurisdictions risks confusing caution with deference.
The 34% refusal rate is therefore more than a product metric. It is evidence that AI censorship by proxy can emerge through opaque systems even when a user is far from the jurisdiction whose norms appear to shape the answer.
The right response is not to demand that every model answer every prompt. It is to insist on intelligible rules, measurable outcomes and accountability when political expression is restricted. If AI providers cannot explain why criticism of repressive power receives less protection, their safety systems will look less like safeguards and more like silent border controls for speech.
