A carton of milk must meet safety standards. According to Microsoft president Brad Smith, artificial intelligence faces fewer safeguards than the products sitting in our refrigerators. His comparison raises an uncomfortable question: why do we accept corporate discretion over technology whose consequences could extend far beyond its customers?
In a BBC interview published on October 12, Smith called for global AI safety rules, independent evaluations, mandatory incident reports and notification of victims when AI agents breach their systems. He also advocated emergency mechanisms to stop dangerous behavior. These are basic demands for accountability from an industry helping shape how people work, communicate and access information.
The public deserves more than promises
Smith’s comparison works because product safety is familiar. Consumers should not need specialist knowledge to discover whether an everyday purchase poses an unreasonable danger. Likewise, people affected by AI should not have to rely entirely on a developer’s assurances that its systems are safe.
Speaking to the BBC, Smith contrasted his position with President Donald Trump’s preference for industry self-regulation in the race against China. He argued that governments needed to establish safety requirements, including circumstances in which outside evaluators should assess products before release.
International competition does not remove the public’s interest in protection. If anything, pressure to release products faster creates another reason for independent scrutiny. A company racing its rivals has commercial incentives that do not always align with the interests of everyone exposed to its technology.
Voluntary commitments can contribute to safety. However, they leave an obvious question unanswered: what happens when following a promise becomes expensive, inconvenient or commercially damaging? Enforceable obligations should make essential protections survive those pressures.
AI is not entirely unregulated
Nevertheless, Smith’s comparison needs qualification. “Less regulated than milk” is a rhetorical description, not a comprehensive measurement of every jurisdiction’s laws. It should not become the misleading claim that AI operates without legal restrictions anywhere.
The European Union’s AI Act already establishes obligations for providers of general-purpose AI models. Providers of models posing systemic risks face additional requirements, including risk assessment, model evaluations, serious-incident reporting and cybersecurity protections. The European Commission’s guidance sets out these duties and their implementation.
The debate therefore concerns the coverage, strength and enforcement of safeguards. Existing rules deserve scrutiny, but so does the suggestion that governments have done nothing. A serious argument for stronger protection should identify the gaps it intends to close.
Nor would counting regulations settle the issue. A long rulebook can fail if authorities lack resources or companies can evade enforcement. The useful test is whether the public receives meaningful protection and whether developers face consequences when they breach their obligations.
Independent testing needs independence
Britain’s AI Security Institute offers one approach to external scrutiny. On October 12, AI Minister Kanishka Narayan said its scientists were evaluating the latest generation of models. Reuters reported that voluntary agreements give the institute access before deployment so it can examine capabilities and risks.
Such testing can provide valuable evidence. However, access based on cooperation raises a policy question: should an evaluator’s ability to examine a powerful system depend on the developer’s continuing consent? Governments should establish clear conditions for access where the potential consequences justify it.
Independence also requires more than a different name on the assessment. Evaluators need adequate expertise, freedom to report unwelcome findings and protection from commercial pressure. Otherwise, an impressive safety process could offer reassurance without sufficient scrutiny.
Emergency controls deserve similarly careful treatment. A proposed shutdown mechanism should come with evidence about its scope, reliability and limitations. Calling something an emergency brake does not establish that it will work under the conditions in which people need it.
Regulation must also restrain corporate power
Microsoft’s support for regulation deserves attention, but its preferred rules should face the same scrutiny as anyone else’s. A major technology company has commercial interests in how governments define safety, assign responsibility and set compliance costs.
Poorly designed requirements could favor established firms that can afford large legal and compliance departments. That possibility strengthens the case for transparent policymaking. Rules should match the risks involved, while governments examine whether proposed safeguards would unnecessarily exclude smaller competitors or independent researchers.
The public also needs a voice beyond choosing which company’s product to buy. Workers, educators, civil society groups and people affected by automated decisions should help determine acceptable uses and protections. Decisions with broad social consequences require democratic participation.
Smith’s warning gives governments a useful starting point. The next step is to turn demands for safety into specific, enforceable responsibilities—and ensure that the companies calling for regulation do not become its sole authors.
A carton of milk should meet safety standards. Powerful AI should, too. The public should not have to wait for a preventable disaster before that principle becomes ordinary policy.
