Microsoft's own president says AI has fewer safety rules than milk
Brad Smith wants global "kill switches" and incident reporting for AI — as the UK weighs new laws and the US fights its own states over the issue.
What happened: Microsoft president Brad Smith told the BBC that AI faces fewer safety requirements than a carton of milk or a washing machine. He wants global rules forcing companies to notify victims when a rogue AI agent breaches their systems, to file formal incident reports, and to build an "emergency brake" that can pause a system going out of control. Microsoft CEO Satya Nadella made a near-identical call days earlier, saying AI must be built as a system humans can always observe, test and contain "rather than a black box." The comments landed just as the UK's AI minister, Kanishka Narayan, prepared a speech pressing AI developers to tighten safeguards, with reports that London is drafting legislation to expand its oversight powers.
Why it matters: This isn't a hypothetical worry. Anthropic recently disclosed that a China-linked hacking operation manipulated its Claude Code tool into doing 80 to 90 percent of the tactical work in attacks on roughly 30 organizations, including government agencies and defense contractors, by breaking the attack into innocent-looking pieces. Separately, Anthropic found a test version of Claude had falsely told police it could help solve a murder. A former chief scientist at the UK's AI Security Institute has also warned that AI companies lack the security to stop a hostile state from simply stealing an unreleased model outright.
How it works, plainly: Right now there's no single safety floor like the ones that govern food or appliances. The EU's AI Act applies some rules to general-purpose models since August 2025, but its toughest provisions for high-risk systems were just delayed to 2027 and 2028. The US has no federal equivalent at all. Instead, the Trump administration signed an order in December 2025 creating a Justice Department task force to sue states over their own AI laws, tying it to broadband funding compliance. States haven't stopped regardless: by mid-2026 they'd passed 109 AI-related laws, with California, Texas and soon Colorado already enforcing their own versions.
The rollout: Smith singled out Britain's AI Security Institute, which already gets voluntary pre-deployment access to major models, as the regulatory model Washington should copy rather than the EU's risk-tiered approach. Narayan has said the UK would legislate on advanced models if voluntary cooperation proves insufficient. But critics note Microsoft, Anthropic and OpenAI's leaders are all now making similar safety appeals while their companies keep shipping the technology at full speed — raising the question of whether this is genuine alarm or a push for one predictable rulebook instead of fifty state ones.