Microsoft President Brad Smith: Milk Is Regulated More Strictly Than AI

Microsoft President Brad Smith has argued for global AI safety rules and proposed writing into law a duty to tell victims when an AI agent goes out of control and breaks into their systems. He laid out his position on the BBC's Big Boss Interview podcast, hosted by Will Bain. The episode aired on October 11. The central image of the conversation made it into the headline: according to Smith, milk is regulated more strictly than artificial intelligence.

What exactly Smith is proposing

In the available excerpt, Smith's quote cuts off at "Right now, your…", so the full argument is best checked against the podcast recording. The basic points are clear, though.

First: safety rules should be global. Models and agents are not tied to a jurisdiction, and the damage they cause will not stop at a border. Second: if an autonomous agent has broken into someone else's system, the victim should learn about it because the law requires it, not because the developer or operator chose to say so.

The second point is the most concrete. It carries over to the world of agents the logic familiar from personal data rules. In the EU, for example, GDPR requires notifying the regulator about a data breach, and many US states have their own notification laws. For incidents where an AI agent is behind the actions, no such general rule exists yet. That comparison is ours, not a quote from Smith, but this is apparently the gap he is aiming at.

Why the milk analogy works

Milk is checked at every link in the chain: production, storage, labeling, expiration dates. If a batch is unsafe, it is recalled, and buyers find out. Models that make decisions and take actions in real systems have no such chain of accountability. There is no single pre-launch testing standard, no mandatory recall, and no universal duty to report harm.

The problem has sharpened with the arrival of agents. A chatbot makes mistakes in text. An agent with access to email, repositories, the cloud, and payment systems makes mistakes in actions. When it exceeds the permissions it was given, whether through a vulnerability, prompt injection, or malicious intent, the damage is both technological and legal.

What the facts say

• Speaker: Brad Smith, president of Microsoft.
• Venue: the BBC's Big Boss Interview podcast, hosted by Will Bain.
• Release date: October 11.
• Main demand: global AI safety rules.
• Specific provision: a legal duty to notify victims when a rogue agent has broken into their systems.
• Framing of the conversation: AI is regulated more weakly than food products such as milk.

Practical takeaway for the market

Billions of dollars in agent investment make this conversation inevitable, and it is worth noting who is starting it. Microsoft is not an outside critic: the company sells agents, owns a cloud, and has invested in OpenAI. When a vendor asks for rules itself, it is partly trying to shape what they look like. A single global standard favors large players, which find it easier to meet requirements than startups do.

Teams that are already deploying agents do not need to wait for a law. It makes sense to take inventory: what permissions each agent has, where its logs are stored, who decides that an incident has occurred, and how quickly customers will find out. If regulation follows the path Smith describes, companies with an incident response process already in place will come out ahead. The rest will have to build one in a hurry, under pressure from a regulator and after the first high-profile incident.