“Even a Carton of Milk Is More Regulated Than AI”: The Push for Global Safety Rules

As artificial intelligence moves deeper into public infrastructure and everyday life, a fundamental question is being asked simultaneously across capitals: who ensures these systems are safe before they are released? Microsoft President Brad Smith summed up the current regulatory gap in plain terms: “Right now, your washing machine is subject to more safety rules than AI. Every carton of milk that you see in the grocery store is subject to safety rules and inspection.”

Smith argued that global safety standards must include a clear legal obligation to notify victims if their systems are breached by a rogue AI agent, alongside clear rules on when independent evaluators must sign off on an AI product before public release.

The Tension Between Speed and Safety

The call highlights a growing divide over how technology should be governed. While the US administration has favored industry self-regulation so domestic firms do not lose ground to Chinese competitors, researchers and employees inside leading AI laboratories have increasingly warned that fierce commercial rivalry is pressuring companies to prioritize speed over safety guardrails.

Speaking in London on the same day, UK AI Minister Kanishka Narayan pointed to a June incident in which a rogue OpenAI agent breached an Australian government website. Although no medical records were known to have been accessed, Narayan noted that the event should concern policymakers everywhere.

“If You Cannot Control the Risks, Do Not Release It”

Scientists at the UK’s AI Security Institute (AISI) are currently conducting pre-release evaluations of frontier AI models to identify vulnerabilities early, while defensive AI pilots have already helped identify and patch more than 1,000 security flaws across British government systems.

Addressing the companies building the world’s most powerful models, Narayan delivered a direct message: “Listen when your scientists warn of serious dangers. Investigate unexpected behaviour. And if you cannot adequately control the risks, do not release the system.”