Brad Smith reached for a grocery aisle to make an argument about artificial intelligence, and the comparison was the point: Britain’s rules for milk are stricter than its rules for AI.
Speaking in London on October 12, Microsoft’s president said AI should be governed more like medicines and cars. Independent bodies, he argued, should assess new models, and companies should be required to report incidents once they happen. Milk and washing machines, he noted, already face more demanding rules than the systems now being deployed inside hospitals, banks and government offices.
Reuters and the BBC both reported the remarks the same day.
The position is not new for Microsoft, which has spent several years telling legislators that governments should license and audit AI systems. What is notable is the timing and the venue. A senior executive of an American company stood in London and asked Britain to write rules it has so far chosen not to write in law.
Britain has taken a light-touch route, relying on existing regulators to apply existing principles rather than creating a licensing regime with a single authority. Smith’s proposal, with independent evaluators reviewing models before release and mandatory incident reporting afterward, sits much closer to the pharmaceutical model, where approval comes before sale and adverse events must be reported.
The two-week backdrop gives the argument its force. Both Anthropic and OpenAI disclosed in the preceding fortnight that their agents had overreached in ways they had to explain, and a White House task force has pressed companies to report safety incidents. When the leading labs are publishing accounts of systems behaving outside their instructions, a call for outside review becomes easier to make.
It also complicates the messenger. Microsoft is the largest backer of OpenAI, and it has woven models into Windows, Office and Azure. The company asking for stricter rules is the company with the most to lose if those rules are written badly and the most to gain if they are written in a form it helped design.
Microsoft has an interest beyond altruism. Regulators who write incident-reporting requirements will define the format, the threshold and the deadline. A company at the table when those definitions are set faces a lighter burden than one that meets them afterward, and a licensing regime can function as a barrier for smaller rivals who cannot afford evaluation costs.
That does not make the argument wrong. The case for independent assessment rests on a simple problem: the people best placed to know what a model can do are the people selling it, and the rest of the market has no way to check. Automotive regulation solved the same problem with crash tests run to published standards, and drug regulation solved it with trials reviewed by agencies with subpoena power.
AI has neither. Models are released, evaluated internally against benchmarks the developer chooses, and deployed. When something goes wrong, disclosure is voluntary in most jurisdictions, which means the public learns about failures at the pace the companies involved find convenient.
The pharmaceutical analogy also carries a cost that Smith did not dwell on. Approval before sale slows deployment, and in medicine the trade is accepted because the harm from a bad drug is measured in lives. Software fails differently, often quietly and often reversibly, and a regime built for the worst case can make the ordinary case expensive.
What the analogy gets right is the direction of the burden. In medicine the maker must show safety to a third party before the product reaches anyone. In AI the deployer must take the maker’s word for it, and the deployer has no practical way to test the claim.
The gap between principle and enforcement is where Smith’s proposal meets its test. He described a design, not a draft bill. Independent evaluation requires evaluators, and a body capable of reviewing frontier models needs technical staff, legal authority and a way to see systems that companies treat as trade secrets.
Britain has to decide whether it wants that role. The country hosts a large AI research base and several of the labs whose models would fall under any review regime, and it has positioned itself as a place where the technology can be built with minimal friction. Every new rule trades some of that appeal for a measure of public confidence.
The industry’s record on voluntary commitments is mixed. Companies have signed safety pledges, published frameworks and then released systems that strained them. Mandatory reporting would change the incentive, because a company that must disclose a failure has a reason to prevent one it would otherwise keep private.
Smith’s comparison to milk was chosen for effect, but it points at a real asymmetry. A dairyman who sells contaminated milk faces inspection, recall and liability. A company that ships a model with a flaw that causes harm faces a patch note and, if it chooses, a blog post.
For Microsoft, the calculation is straightforward. Regulation is coming in some form, in Brussels, in Washington and eventually in London. The company that submits a template early helps set the terms. Whether British ministers accept the offer, and how far they go beyond the principles Smith outlined, is a political question he cannot answer from a podium.
