Microsoft's President Says AI Is Less Regulated Than Milk. Here Is His Five-Point Fix.

On October 12, 2026, the president of Microsoft walked into a BBC interview and said the quiet part about AI oversight out loud. Brad Smith told the network that artificial intelligence systems face fewer safety rules than the milk carton in your refrigerator. The line was picked up within hours by Reuters, The Hill, and Engadget, but the quote was only the wrapper. Inside was a specific five-point regulatory proposal from one of the most powerful executives in the AI business, asking governments to write binding rules that would apply to his own company.

"Right now, your washing machine is subject to more safety rules than AI," Smith said, according to the BBC. A washing machine sold in most developed markets has to clear electrical safety, fire risk, and mechanical testing before a retailer can stock it. A milk carton moves through inspection, labeling, and recall regimes most shoppers never see. A frontier AI model, by contrast, can be trained, fine-tuned, and shipped to hundreds of millions of users with no mandatory third-party check of any kind, relying on each company's internal safety process.

What makes the moment unusual is the speaker. Smith runs legal and policy strategy for a company that, alongside OpenAI and Google, controls the frontier of AI development. He is not a regulator, an academic, or an outside critic. An executive at one of the three companies whose systems would be bound by the rules is asking for the rules to exist. (The uncomfortable question is whether that is public-spirited or self-interested: the loudest voices for regulation may also be its biggest beneficiaries.)

The five proposals, translated into plain English

Here is what each would mean in practice.

1. Global AI safety rules. Instead of each country writing its own AI statute, Smith wants a coordinated international baseline, something like how aviation safety bodies align standards across jurisdictions. The aim is to stop frontier labs from routing around tough national rules by training or deploying elsewhere.

2. Mandatory incident reports. Companies would have to disclose it when an AI system causes serious harm, in the same spirit as data breach notification laws. Today, per the reporting around the interview, most AI incidents surface only if a company, a researcher, or a journalist chooses to talk about them.

3. Victim notification. This goes further than incident reporting. If an AI system is breached or misused by what Smith called a "rogue AI agent," the company would have to tell the affected person directly. Compliance teams already know this structure: it mirrors how organizations must notify individuals when personal data is exposed.

4. Independent evaluators before release. Some AI products would get reviewed by outside experts before they ship, rather than leaving pre-release testing entirely in-house. The closest analogue is pharmaceuticals and medical devices, where third-party review of safety data is a precondition of reaching the public.

5. An emergency brake. A verifiable, auditable way to halt or constrain an AI system during a serious incident, one whose existence and activation history an outside evaluator could review. Not just an internal kill switch, but one someone other than the operator can inspect. The analogue is product recall and stop-sale authority in consumer safety.

Why the loudest voice for regulation is inside the industry

Smith is not new to this argument. According to Fortune's reporting from July 2026, he spent the summer criticizing the US approach to AI oversight as regulation without transparent or complete rules, pointing to a June 2026 executive order that created a voluntary pre-release review process for frontier models but stopped short of any formal licensing requirement. The milk carton line is a sharper, public restatement of a complaint he has been making to policymakers for months.

The timing is notable. In late September 2026, major AI companies signed a voluntary industry pact described by The Hill as "morally binding," covering internal controls and independent auditing. Days later, the White House unveiled its own set of principles for voluntary AI safety standards, with mandatory incident reporting also on the table, and on October 7 Senator Maria Cantwell unveiled a framework for mandatory federal frontier AI rules, which Calder Brief covered last week. Smith is effectively saying the voluntary layer is not enough.

A milk producer does not get regulated because an agency noticed a problem and reached for an unrelated legal tool. It gets regulated because a standing inspection regime exists whether or not anything has gone wrong yet.

That distinction is the crux of the argument. The Commerce Department has already shown it can intervene, using export-control authority to require Anthropic to withdraw two models globally over a cybersecurity concern and pressing OpenAI to restrict an upcoming model rollout. Those are real interventions, but they are case-by-case uses of existing trade law, not a standing AI safety statute. Smith is arguing AI needs the standing structure, built in advance of harm rather than assembled in response to it.

There is also a business logic worth naming. Microsoft sells AI through Azure and Copilot to banking, healthcare, and government, industries that live inside compliance regimes already. A clear, predictable, globally harmonized rulebook benefits a company selling compliance-ready AI infrastructure far more than it benefits a smaller lab trying to out-ship competitors on raw model capability. Smith himself acknowledged the tension, telling The Hill that regulation can become too heavy-handed and slow innovation, while arguing that AI is currently moving faster than the speed of safety.

What would actually have to happen for this to become law

As of October 12, 2026, Smith's five proposals are proposals voiced by a corporate executive, not pending legislation. None of them is binding anywhere. Turning any one of them into enforceable law would require a legislature or regulator to draft it, vote it through, and build the agency capacity to enforce it, or an international body to coordinate standards that member countries then adopt domestically.

The realistic near-term paths are fragmented. In the United States, frontier AI rules could come from Congress, from executive action, or from individual state laws, which have been multiplying in the absence of a federal statute. In Europe, the EU AI Act is already phasing in binding obligations on a multi-year rollout, and its high-risk provisions already look a lot like what Smith is describing. The UK has leaned on regulator-led pledges, with the data protection authority securing AI commitments from ten major firms earlier this year.

The incident data behind the pitch is not hypothetical. Security firm Cyera reported in September 2026 that it had tracked 7,246 publicly reported AI incidents between September 2023 and May 2026, of which 344 were enterprise-relevant and 188 involved an autonomous AI system directly causing harm with no external attacker involved. AI failures are already common enough that ad hoc disclosure is a strange way to track them.

Whether the milk carton comparison produces binding rules or another round of voluntary pledges is the question the rest of 2026 and 2027 will answer. What Smith did on October 12 was translate an abstract regulatory debate into something a non-technical lawmaker can picture, and put the weight of one of the industry's biggest companies behind the argument that self-regulation has run its course. The next move belongs to the legislators.