Microsoft's Brad Smith Says AI Faces Fewer Safety Checks Than Milk

Microsoft vice chair and president Brad Smith said AI is less regulated than milk.

The remark came in an ITV interview reported on 12 October 2026. BBC Smith, identified by Cybernews as Microsoft's vice chair and president, used everyday products to frame the gap between physical goods and foundation models, large AI systems trained on vast data that support many tools.

A washing machine is currently subject to more safety rules than AI, Smith said. Every carton of milk seen in a grocery store is subject to safety rules and inspection, he added. Engadget The point was comparative, not technical. Food and appliances enter markets through defined checks. Frontier systems, the most advanced models, do not face an equivalent gate.

Smith placed the threshold for action at cybersecurity. He said the moment for regulation has arrived when AI models are so powerful they are putting the world's cybersecurity at risk. He described AI as both "tool and a weapon."

He also argued the regulatory vacuum elsewhere creates an opening. The lack of US action on AI regulation gives the UK a unique opening to lead in regulating AI, Smith said.

The language echoes Smith's own earlier formulation. "We must ensure that AI remains a tool created by humanity for humanity."

The broader context here is why reach for milk and washing machines rather than software history. Physical safety is easy to picture. Inspection happens before sale. Liability is understood. Software ships differently. Updates are continuous. Behavior changes with prompts, data, fine tuning, extra training for a specific job, and deployment context. That mismatch is the core governance problem Smith is pointing to.

Looking at what this means for practitioners, the hard part is translation. What would a milk-style inspection test. The weights, the numbers inside the model. The system. The deployment. How often. Before release, after material change, continuously in operation. Who holds test access, and under what protections. None of that is settled by an analogy. It is where any UK-led regime would succeed or fail.

In my view, the cybersecurity framing is the most consequential part of Smith's argument. Safety debates often stall on speculative harm. Security is operational. Defenders already manage disclosure, patching, access controls and incident response. If models alter attacker economics, the cost and scale of attacks, that registers inside existing security budgets and risk registers. It gives regulators a narrower place to start than general purpose safety.

Worth flagging too is the dual use formulation. Tool and weapon is not new language, but it matters for enterprise buyers and builders. Tools get adopted. Weapons get controlled. Most AI systems will live between those poles, useful and abusable in the same deployment. Governance that ignores that duality will either overblock legitimate use or miss misuse.

The optimistic read, and the one I lean toward over long arcs, is that inspection does not have to mean stagnation. Food safety did not end food innovation. Appliance standards did not end appliance competition. Clear expectations can expand adoption because buyers trust what they deploy. For AI, trust is currently the bottleneck in many enterprises. Testable assurances could unlock use.