Microsoft’s president has a simple comparison for where AI regulation stands in late 2026: behind the dairy aisle. Speaking on the BBC’s Big Boss Interview podcast, Brad Smith — who has run Microsoft’s regulatory playbook for over a decade — said that “right now, your washing machine is subject to more safety rules than AI. Every carton of milk that you see in the grocery store is subject to safety rules and inspection,” and argued it is time to build AI rules on that foundation, as BBC News reported on 12 October.
Smith’s proposal is more specific than the usual call to “regulate AI.” In the BBC interview he laid out four mechanisms drawn from existing product-safety regimes: legal “emergency brakes” — the industry’s kill switches — to pause systems that slip out of control; mandatory incident reports when AI systems cause harm; a legal obligation to tell the “victim” when a rogue AI agent breaches their systems; and independent government evaluators who sign off on new AI products before release, on the model of other regulated products. “We know how to do this for other products,” he said. “We should build on that knowledge and think about how to apply it to AI.”
Two days of “less regulated than your kitchen”
Smith timed the intervention deliberately. In September, the White House secured voluntary safety commitments from major AI developers — a code President Donald Trump and Elon Musk brandished on the White House lawn — including independent audits of frontier systems. Smith welcomed Microsoft’s own signature but told the BBC the voluntary era is over: “It’s a good step, it’s a necessary step… But I don’t think it’s sufficient any longer.” The gap, as he framed it to the BBC, is asymmetrical compliance: “The good companies will do what you want. It’s the companies that are not as responsible that you need to worry about.”
The milk line landed. On the same day, Mashable’s report carried the quote alongside the sharpest counterpoint from outside the industry — Pete Furlong of the Center for Humane Technology, warning that “it can’t be entirely up to these companies to dictate the terms of their transparency” — and Quartz, in its write-up, noted the proposal lands in the middle of an argument Washington has spent 2026 refusing to have. The White House position, as the BBC framed it, is Smith’s own president’s: Donald Trump has repeatedly said “whoever wins AI, wins,” and that the sector should regulate itself so US firms don’t lose ground to Chinese rivals. Smith’s bet is that the UK can thread that needle — that Washington treats London differently from Brussels, and that the AI Security Institute (founded under Rishi Sunak as the AI Safety Institute) gives Britain the technical credibility to write standards others adopt. “In the world of technology,” he told the BBC, UK testers are regarded as “the best.”
That argument got same-day reinforcement from the institute itself. British AI minister Kanishka Narayan told Reuters on 12 October that AISI is now running evaluations on the latest generation of models — naming Gemini 4 Argon — and working with the US government and major developers, access he confirmed after a rocky month: in September, Politico reported that the White House had asked OpenAI and Anthropic to withhold new models from British testers pending a US review. AISI’s access, Narayan said, stands.
The same day, a former attorney general called the milk framing too modest
The BBC interview was not even the day’s most dramatic contribution to the genre. Writing in The Guardian on 12 October, Richard Hermer — until recently attorney general for England and Wales — took the kitchen-appliance comparison and turned it into an argument about international law. “There is more regulation governing the safety of your fridge than the work being undertaken by frontier AI labs,” Hermer wrote, framing the threat in national-security terms from his two years overseeing that brief: the risk from AI is “of an altogether different magnitude,” an existential matter with “a limited time window to address it.” His prescription was not Smith’s product-safety mechanisms but treaty-level coordination — “robust use of international law,” coalitions of like-minded states, and a public debate he argues has barely begun, citing the Hugging Face breach and Jacob Coxon’s resignation from Anthropic as the moments the issue finally gained traction.
The two prescriptions differ in everything except the diagnosis. Smith’s package assumes the unit of governance is the product and the regulator is the state that hosts the evaluator; Hermer assumes the unit is the frontier itself and no single state can reach it. Both, notably, route through England: Smith wants London to write the standards, Hermer wants London to convene the treaties. Our coverage of the AISI’s expansion into an enforcement era and OpenAI’s own urging of UK lawmakers to move inside the “political window” in September showed labs converging on Britain for exactly this reason — a rule-writer the White House can live with.
Why a regulated company arguing for regulation is still a story
It would be easy — and it is partially right — to read Smith’s intervention as Microsoft defending itself from the irresponsible: a company that has already invested in safety infrastructure asking regulators to make its competitors match it. Microsoft published its own internal code of conduct in September, including bars on weapons assistance, and Smith told the BBC the September voluntary pledge was one Microsoft was “happy to sign.” Regulation that raises the compliance floor raises costs for smaller labs and startups faster than for the $4-trillion company proposing it.
But the counterweight in the same week makes dismissal harder. OpenAI’s firing of three safety researchers over information policy (our coverage of their open letter), Anthropic’s model filing a false homicide tip with Philadelphia police (reported here on 10 October), and the Hugging Face breach in July (covered at the time) sketch the incident record that makes victim-notification and incident-reporting more than abstractions — they are the exact mechanisms whose absence made each of those stories news. And Nadella’s own emergency-brake doctrine from 11 October — assume every model is compromised, build the brake anyway — shows the same instinct arriving from Microsoft’s engineering side two days before its policy side. When a regulated company, its own CEO, and a former attorney general all argue for brakes in the same week, the disagreement is no longer about whether; it is about who, and at what level.
For New Zealand the practical question is narrower: this country has no frontier lab and no seat in any of these negotiations, but its AI Safety and Security framing — the governance skills NZ job ads already prize — will be borrowed from whichever regime wins the standards race. Smith argued that should be London; Hermer argued the race itself is the problem. Wellington will import the winner either way.
