AI Regulation: Brad Smith Calls for Binding Global Safety Rules

A dairy aisle comparison from inside Big Tech

Microsoft President Brad Smith has made one of the bluntest cases for binding AI regulation to come from a leading AI company. He argued that artificial intelligence currently faces fewer safety requirements than milk or washing machines, and he called for global rules to close that gap.7 In an interview published on October 12, Smith said a global safety framework should require companies to tell "victims" when a rogue AI agent breaches their systems. He also wants an "emergency brake" on AI systems and a legal duty for companies to file incident reports.7 He tied the proposals to how other consumer goods are already handled, noting that every carton of milk on a grocery shelf is covered by safety rules and inspection.7

Outlets disagree on where he first said it. Most attribute the remarks to a BBC interview released on Sunday.137 TechBriefly and CNET instead describe an ITV interview from late the previous week.49 The core quote is the same in every version: "your washing machine is subject to more safety rules than AI." That suggests Smith gave the line to several broadcasters deliberately, as a planned media push rather than an offhand comment.

What Smith is actually proposing

The soundbite has drawn most of the attention, but the details matter more for compliance teams. Taken together, the coverage describes five elements. The first is a set of global AI safety rules. The second is mandatory incident reporting. The third is notifying victims after a breach by a rogue AI agent. The fourth is review of some products by independent evaluators before release. The fifth is an emergency brake that can stop a dangerous system.2 Smith compared that brake to household circuit breakers and to emergency brakes on trains and buses.1

He admitted that government evaluators approving a product before launch "makes people nervous," especially in the United States. To argue the idea is workable, he pointed to aviation: a plane flying from London to New York has been certified as safe by regulators in both countries.1 That example is probably the most important part of his argument. He is describing a system where national regulators trust each other's approvals, not one international AI regulator. That is how aviation and many product-safety systems already work.

Why self-regulation is no longer enough, in Smith's telling

The timing matters. A few weeks earlier, Google, Anthropic, Meta, OpenAI, xAI and Nvidia signed a White House-backed pledge to keep strong internal controls and allow outside audits of their models.1 Smith praised that agreement but said it is "not sufficient any longer." His reason was that a self-regulatory system works for responsible companies and fails with the ones that are not.1

Outlets read his relationship with the Trump administration differently. Cryptopolitan describes a direct split, saying Smith's position contradicts President Trump's preference for letting the industry police itself to stay ahead of China.3 The Hill's account is more conciliatory. It reports Smith saying regulation can become too heavy-handed and slow innovation, and that the president is "right to remind us" of that risk.1 The second reading fits better. Smith is not openly fighting the White House. He is arguing that AI is "moving forward faster than the speed of safety," and he presents binding rules as good for the industry as well as the public.1

The US backdrop is a hands-off approach that still includes some forceful one-off actions. According to Fortune reporting cited by Tech Insider, a June 2026 executive order set up a voluntary review process for frontier models before release but did not require licenses. The same reporting says the Commerce Department used export-control powers to make Anthropic withdraw two models over a cybersecurity concern.2 Smith's point, in effect, is that a government stepping in with unrelated legal tools after a problem appears is not the same as a permanent safety regime.

Microsoft's own position on the line

Smith is not the only Microsoft executive making this case. CNET reports that CEO Satya Nadella posted at length on X, saying the largest companies lack a "mechanistic understanding" of the systems they deploy. Nadella called for slower development, incident reporting and independent review.9 CNET says this puts Microsoft closer to Anthropic's cautious camp, in contrast with OpenAI's Sam Altman, Meta's Mark Zuckerberg and Nvidia's Jensen Huang, who have resisted a coordinated slowdown.9

Skeptics see commercial motives as well. RTÉ notes that calls from AI companies to slow down have raised questions about whether the real aim is rules that protect incumbents' lead or heading off a broader government crackdown.7 Remio's analysis states the tension directly. Market-wide duties raise costs for smaller providers, while large firms already have compliance staff and close ties to government.6 Tech Insider goes further, predicting that a binding global regime would speed up consolidation in AI infrastructure rather than slow it.2

Both things can be true. The safety argument stands on its merits, and Microsoft would also be well placed to handle the compliance costs it is calling for. The fair test, as Remio puts it, is whether any eventual rules bind Microsoft as seriously as its smaller rivals.6

Britain, Brussels and the EU AI Act

Smith's choice of a regulator to lead was pointed. He said Britain is best placed, citing the AI Security Institute created under former Prime Minister Rishi Sunak. He also observed that Washington sees London very differently from Brussels, which regulates AI by risk level under its AI Act.7 TechBriefly reports that he called this difference a strength and said Microsoft hopes to help shape UK regulation.4

That comment, in effect, steps around the one major jurisdiction that already has a broad AI law. Remio notes that the European system has enforcement powers that voluntary programs lack. The EU's AI Office can request documents, evaluate models, demand fixes and fine companies that don't comply.6 By favoring London, Smith appears to be looking for a model the US government can live with politically, rather than endorsing the one with the most legal force.

Europe has also been adjusting its own timetable. The Digital Omnibus on AI, Regulation (EU) 2026/1744, took effect on July 27, 2026. It pushed obligations for stand-alone high-risk systems from August 2, 2026, to December 2, 2027, and moved product-embedded systems to August 2, 2028.13 The Cloud Security Alliance links the delay to late harmonized technical standards, and Formalize agrees that the main problem was missing standards, not lower expectations.1115 One European Parliament co-rapporteur nonetheless described it as "pressing the pause button on the AI Act," which shows how the delay is being sold politically.18

The postponement leaves a lot in place. Obligations for general-purpose AI models have applied since August 2025. Article 50 transparency duties, such as telling people when they are dealing with an AI system, took effect on schedule on August 2, 2026.16 On December 2, 2026, the Omnibus adds a ban on AI that generates non-consensual intimate imagery and child sexual abuse material. The same date is the marking deadline for generative systems already on the market.19 Fines for prohibited practices can reach €35 million or 7% of global turnover.17

The compliance read

Smith's warning and Europe's revised timetable point toward the same likely future: oversight built around specific triggering events. Incident reports, victim notification and stop mechanisms resemble the post-deployment monitoring and serious-incident duties already written into the EU's high-risk framework. The difference is that Smith wants them to cover frontier systems everywhere, not only listed use cases in one market.

For companies, the practical lesson holds regardless of which capital acts first. Advisers widely recommend starting with an AI inventory, risk classification and clear internal ownership.1215 Formalize adds that companies that deploy AI agents for purposes the provider never intended may themselves count as the provider of a high-risk system.15 That risk grows as agents gain wider access to company data and tools, which is exactly the situation Smith describes.

Some caution is warranted. Several commentators note that "less regulated than milk" is a figure of speech, not a measurement. Privacy, consumer-protection, cybersecurity and sector-specific laws already apply to many uses of AI.610 The more defensible version of Smith's claim is that oversight is patchy. What applies depends on location, sector and type of system, and deadlines arrive on different dates.6 As of his remarks, there was no binding global AI safety law in force.2

What to watch

The comparison will only matter if it leads to enforceable obligations. Three signals stand out. The first is whether Britain produces real legislation that defines which systems are covered, what counts as a reportable incident and what enforcement powers regulators get. The second is whether emergency brakes are independently tested rather than shown off in staged demonstrations.6 The third is whether Washington, which prefers voluntary pledges, accepts the cross-border mutual recognition that Smith's aviation example assumes. Until one of those happens, the milk comparison remains a memorable argument, not a rule anyone has to follow.