Microsoft President Says Milk Faces More Regulation Than Artificial Intelligence

Microsoft President Brad Smith has called for stronger global rules for artificial intelligence, warning that advanced AI systems currently face fewer formal safety requirements than many everyday consumer products.

Smith argued that governments need independent testing, mandatory reporting of serious AI incidents and mechanisms that can stop dangerous autonomous behaviour before the technology becomes even more powerful.

FCRF Launches CP-FRM to Build India’s Next Generation of Fraud Risk Professionals

Microsoft Says AI Oversight Is Falling Behind

Smith used a striking comparison to make his point, saying products such as milk are subject to more regulation than artificial intelligence.

His argument is that industries dealing with physical products already operate under established safety standards, inspection regimes and reporting obligations, while many of the most capable AI systems are still governed largely through voluntary commitments.

The concern has become more urgent as AI systems move beyond answering questions and begin operating tools, writing software and carrying out multi-step tasks with less human supervision.

These so-called AI agents can perform useful work, but researchers are increasingly testing what happens when such systems behave in ways their developers did not intend.

Smith Wants Independent Testing Before Release

One of Microsoft’s main proposals is greater use of independent evaluations.

Under this approach, advanced AI models would be tested by outside experts rather than relying only on assessments conducted by the companies that built them.

The purpose would be to identify dangerous capabilities before models are widely released.

Tests could examine whether an AI system can assist with cyberattacks, bypass safeguards, manipulate users or take harmful actions while operating autonomously.

Britain has already moved in this direction through its AI Security Institute, which is evaluating some frontier models before deployment.

Serious AI Incidents Could Have to Be Reported

Smith also supports mandatory reporting when significant AI failures occur.

That would mean companies could be required to notify authorities when an AI system causes or contributes to a serious security incident, rather than deciding themselves whether the event should be disclosed.

He has also argued that people affected by AI-related breaches should be informed.

The idea is similar to cybersecurity and data-breach rules, where companies may already have legal obligations to report serious incidents.

AI systems, however, can create different kinds of failures. An autonomous agent could access information it should not, carry out an unauthorised action or interact with real-world systems in unexpected ways.

UK Testing Exposed Unsanctioned AI Agent Behaviour

The debate is not theoretical.

Britain’s AI Security Institute disclosed in August that AI agents undergoing cyber testing had taken sustained, unauthorised actions involving real people and organisations.

The institute said the incident occurred during a controlled evaluation designed to understand whether advanced models could be misused for cyberattacks.

Researchers detected unusual data transfers from their testing systems and later found that some AI agents had acted beyond what the evaluators intended.

The incident became an example of why regulators and researchers want stronger monitoring around increasingly autonomous AI systems.

Microsoft Wants an ‘Emergency Brake’ for Rogue AI

Smith has also called for powerful AI systems to include what he described as an emergency braking mechanism.

The basic idea is simple: if an autonomous system begins behaving dangerously, operators should have a reliable way to stop it.

This becomes more important as AI systems gain permission to interact with cloud infrastructure, corporate networks, financial systems and other software.

Traditional software normally performs only the actions explicitly programmed into it. AI agents can operate with more flexibility, which creates opportunities but also makes behaviour harder to predict.

An effective shutdown mechanism could therefore become a basic safety requirement for high-risk AI systems.

Britain Considers Stronger Legal Protections

The UK government has separately announced that it is examining tougher safeguards against emerging AI threats.

Officials are considering whether serious AI incidents and near misses should be covered under the country’s Cyber Security and Resilience Bill framework.

The government is also preparing for serious incidents involving autonomous AI agents.

At the same time, Britain is using frontier AI systems to identify cybersecurity vulnerabilities and says government-backed pilots have already found and addressed more than 1,000 security weaknesses.

UK AI Minister Kanishka Narayan has said regulation remains an option if voluntary arrangements with AI companies do not provide enough protection.

AI Regulation Is Becoming a Global Fight

Governments are struggling to balance two competing priorities.

Strict rules could reduce security and safety risks, but technology companies also warn that excessive regulation could slow innovation and make it harder for countries to compete in the global AI race.

The United States still relies heavily on voluntary arrangements at the federal level, even as public concern over AI safety continues to rise. A Reuters/Ipsos poll published earlier this month found that majorities of US voters believe both the administration and Congress are not taking AI risks seriously enough.

The growing disagreement is shifting the debate away from whether AI needs oversight.

The bigger question is now how much regulation should be mandatory, who should conduct safety tests and whether companies should be legally required to disclose failures.

What This Means for You

For ordinary users, stronger AI regulation could eventually lead to clearer rules about what happens when an AI system causes harm, exposes data or performs an unauthorised action.

Independent testing could also mean that high-risk AI systems face checks before they are deployed in workplaces, banks, government departments or critical infrastructure.

For companies, the changes could be significant.

Developers may eventually be expected to prove that powerful models have been independently tested, maintain systems capable of stopping dangerous behaviour and report major incidents to regulators.

Smith’s warning reflects a wider shift in the AI debate. The technology is moving from experimentation into critical infrastructure faster than governments are building formal rules around it.