Microsoft President: AI Has Less Regulation Than a Carton of Milk — and the Policy Gap Is a Real Risk

Microsoft President Brad Smith has offered a striking analogy: the rules governing artificial intelligence today are fewer than those regulating a carton of milk or a washing machine. What sounds like hyperbole actually cuts to the heart of AI governance's real predicament — as model capabilities expand at breakneck speed, the safety standards and accountability mechanisms meant to keep pace have fallen dramatically behind.

Everyday Consumer Products Have Rules. AI Operates in Near-Vacuum.

Smith's core argument rests on a sharp contrast: everyday consumer products like milk and washing machines must pass a battery of mandatory standards — food safety, electrical safety — before they ever reach store shelves. Yet the powerful AI models driving today's technological revolution exist largely outside any comparable mandatory constraints.

This gap isn't merely a philosophical debate about regulatory theory — it has direct implications for cybersecurity. As model capabilities grow stronger, so does their potential threat to the security of global digital systems. Smith was explicit: the time to act is now. Continuing to rely on loose industry conventions may prove wholly inadequate for the increasingly complex risk scenarios ahead.

The analogy resonates precisely because it brings an abstract problem of technical governance down to a level any consumer can grasp. When a technology capable of affecting critical infrastructure faces a lower bar for market entry than a carton of milk, the design of our institutions clearly has a serious blind spot.

Accelerate or Pump the Brakes: The Battle Over Direction

The disagreement over AI regulation is, at its core, a disagreement over pace.

The Industry and the White House: Diverging Positions

One striking dynamic: some major U.S. AI companies had previously advocated for slowing the pace of development to create a safety buffer. President Donald Trump has taken the opposite view — arguing that American industry must accelerate to stay ahead of China and that heavy-handed government regulation would only stifle innovation.

Trump has favored industry self-regulation, announced plans to host a tech summit, and designated a special representative for the sector. Under this framework, a number of tech company leaders signed an agreement covering self-regulation, safety assurances, and audits by independent experts.

Is the Self-Regulation Agreement a Real Safeguard — or a Smokescreen?

Yet this seemingly constructive agreement has not won universal approval. Critics told the press that the agreement's fundamental flaw is that it allows companies to define what "safe" means for themselves. In other words, the referee and the athlete are the same person.

These critics further argue that such self-regulatory arrangements effectively serve as a distraction — using the posture of proactive commitment to defuse calls for mandatory legislation, without necessarily delivering meaningful safety improvements. This is precisely the institutional hollow space Smith's "milk analogy" points to: a governance framework that exists on paper is not the same as one with real teeth.

---

The "athlete-referee" dilemma is hardly new to the tech industry. Content moderation on internet platforms and the transparency of algorithmic recommendations both went through similar self-regulatory phases, ultimately requiring legislative intervention only after major incidents or sustained public pressure. AI self-regulatory agreements typically center on "responsible AI principles," "red-line commitments," and "third-party audits" — but critics note that such audits are often commissioned by the companies themselves, with the scope and depth of review also determined by those same companies, raising serious questions about independence. By contrast, the EU's AI Act takes a mandatory, risk-tiered regulatory approach, with clear compliance obligations and penalties for "high-risk AI systems" — a fundamentally different institutional philosophy. The contest between these two models is, at its core, a dispute between "trusting corporate self-restraint" and "enforcing external accountability through law."

---

A Window of Opportunity for the UK

America's hesitation at the federal level has inadvertently created space for others.

Smith argues that U.S. inaction gives the UK a unique opportunity to emerge as a leader in AI regulation. For a country seeking a strategic foothold in the AI era, regulatory leadership is itself a form of soft power and a driver of industrial attractiveness.

There is a clear logic here: when a major tech power chooses to wait and see, the economy that first establishes a clear, credible framework — one that balances safety with innovation — has a chance to become the global standard-setter for AI governance. The power to write the rules is fast becoming one of the most underappreciated yet valuable prizes in the AI competition.

---

The UK already has some foundational work in this area. In 2023, it hosted the inaugural Global AI Safety Summit at Bletchley Park, bringing together multiple nations and leading AI companies to sign the Bletchley Declaration, which identified catastrophic risks from frontier AI as a priority and established an international AI safety research network. The UK government currently pursues a light-touch approach — building on existing regulators and applying sector-by-sector oversight based on use case — rather than establishing a dedicated AI regulator or passing specific AI legislation. This contrasts with the EU's mandatory legislative model and gives the UK relatively flexible policy conditions for attracting AI companies. The "window of opportunity" Smith references is set precisely against this backdrop: if the UK can find the right balance between flexibility and trustworthiness, it has a real chance to claim agenda-setting authority as the international AI governance architecture takes shape.

---

Why This Debate Really Matters

Smith's remarks deserve attention in part because of where they come from: a senior executive at one of the core beneficiaries of the AI wave. Microsoft is a major backer of OpenAI and the driving force behind products like Copilot. Calls for regulation from inside the industry typically carry more weight than criticism from outside it.

Ultimately, the phrase "fewer rules than a carton of milk" raises a question that cannot be avoided: when a technology's reach and impact so vastly exceeds that of ordinary consumer goods, does society have an obligation to build a proportionate system of accountability? The accelerationists fear regulation will kill competitiveness; the cautious camp fears the risks of unchecked development; and whether voluntary self-regulation agreements can fill the institutional void between those two poles remains an open and deeply contested question.