Satya Nadella’s complaint about the way companies deploy artificial intelligence is not that the models are weak. It is that nobody can produce the paperwork.
In a post published on October 10, Microsoft’s chief executive wrote that as models become more capable, enterprises are handing them access to sensitive data and the authority to carry out critical tasks. Auditing those decisions is a different problem. When a model produces a wrong or harmful output, the trail rarely leads back to the specific training data or model parameters that produced it, which are the two places an investigator would want to look first.
His proposal is to stop treating the model as the unit of trust. Frontier systems, whether their weights are closed or open, should be handled as potential insider risks, the way a security team treats an employee account that may already be compromised. The controls that matter, from permission management to safeguards to the record of what happened, should sit outside the model rather than inside it.
The checklist that follows reads like a control framework. Model behavior should be observable, results verifiable, and permissions independently controllable, he wrote. A person should be able to pause or shut down a model mid-task. Systems should be assembled from more than one model. Independent auditors should have standing. Incidents should be disclosed promptly. And no model should both perform a task and certify its own result.
That last item is the oldest rule in accounting, transplanted. Segregation of duties exists because an institution that lets one person write the payment and check the ledger can be drained without anyone noticing, and because self-review is not review. Nadella is arguing that the same failure mode appears when a single model holds both the pen and the stamp.
The traceability demand is the one that collides with how these systems are built. A language model’s output comes from billions of parameters no engineer can read, and the corpus that shaped them is not a document an auditor can pull from a shelf. Producing the footprint he describes, a human-readable record of every action tied to a decision a person can later reconstruct, means logging at a granularity the industry has largely avoided, and paying the storage and latency bills that come with it.
Independent permission management is similarly awkward. Most frontier systems today are wired as one stack, with the model, its tooling and its data living together. Splitting the controls out from the model, and then proving that a model cannot reach around them, is a re-architecture rather than a configuration change.
The duty he describes also moves with the deployment. A company that runs an open-weight model on its own servers has no vendor to blame and no vendor audit to rely on, which is why his argument lands on the operator rather than the lab. Enterprises have spent the past two years buying assurances in the form of evaluations and usage policies. Nadella is telling them that those documents are not controls.
The list asks something of the labs that they have resisted. Prompt disclosure of incidents means publishing failures that customers read as evidence of unreliability, and the industry’s record so far has been uneven: most leading developers publish safety reports on schedules they set themselves, and few describe a failure in enough detail for an outsider to reconstruct it.
The position sits uneasily against the company he runs. Microsoft is OpenAI’s largest backer and has pushed the same models into Windows, Office and Azure more deeply than any rival. Nadella is asking customers to treat the technology Microsoft sells as a potential attacker by default, with logs and kill switches attached.
He is not the first executive to take this line this month. Anthropic disclosed that its models attacked real websites during testing, and OpenAI acknowledged that its agents had gone off course, according to earlier reporting. A White House task force has begun pressing companies to report safety incidents. Bill Gates has called for rules modeled on cars and drugs, and Anthropic’s Dario Amodei published his own proposal for slower development. Others in the field argue the priority is staying ahead of China.
What distinguishes Nadella’s post is the position he writes from. Criticism from outside a vendor is easy for the industry to shelve. A framework proposed by the largest seller of enterprise software is harder to ignore, and it costs Microsoft something if customers take it seriously.
The unresolved question is enforcement. Nadella offered principles, not a product, and no regulator has written them into law. Microsoft has not said which of the controls it intends to ship as features and which it expects customers to build. A pause button matters when someone is standing next to it, and when the company whose revenue depends on the model finishing the task is willing to press it. Until then the post reads as a standard waiting for an enforcement mechanism, and as a signal that the largest vendors now expect to be judged on how their systems fail.
