AI Is Less Regulated Than Milk, Says Microsoft’s Brad Smith

AI is less regulated than milk, according to Microsoft President Brad Smith, who is calling for stronger safeguards around artificial intelligence. The comparison raises a practical question: when software can access information or take actions on your behalf, who checks that it is safe?

Smith’s argument concerns independent testing, incident reporting, and the ability to stop dangerous systems. It does not mean AI operates outside every existing law. For consumers and businesses, that distinction matters more than the headline: legal protection and preventive safety checks are different things.

What Brad Smith said

In an ITV News interview published October 8, 2026, Smith compared AI oversight with the safety requirements surrounding washing machines and milk. He advocated independent testing, incident disclosure, emergency shutdown capabilities, and liability when negligent development causes catastrophic harm.

His message that AI is less regulated than milk also appeared in BBC reporting updated October 12. That interview emphasized global safety rules, notifying people affected by rogue AI agents, and determining when outside evaluators should review products before release.

These are proposals for stronger oversight. An executive calling for a safeguard does not establish that governments have adopted it.

Why compare AI with a carton of milk?

Milk is an everyday product backed by a long-established safety framework. The US Food and Drug Administration publishes the Grade “A” Pasteurized Milk Ordinance alongside documents covering laboratory evaluation and the cooperative interstate milk program.

That framework makes Smith’s analogy easy to understand. Buyers should not have to investigate an entire production process before trusting a product.

However, saying AI is less regulated than milk is a rhetorical comparison, not a standardized measurement. Smith’s interviews do not provide a country-by-country count of applicable rules or a method for comparing their strength.

There is another limitation: milk has a relatively specific intended use. AI can mean software that suggests a sentence, screens job applications, or operates tools. A useful safety regime must distinguish those activities rather than treat every system as equally dangerous.

AI already falls under existing laws

The phrase AI is less regulated than milk should not be read as a legal exemption for technology companies.

United States: existing protections still matter

In an April 2023 joint announcement, the Federal Trade Commission and other federal agencies emphasized that their existing enforcement powers apply to automated systems. The announcement addressed areas including discrimination, deceptive practices, and consumer protection.

The relevant distinction is between laws that prohibit harmful conduct and requirements that check a particular system before deployment. Having the first does not automatically mean every AI product receives the second.

United Kingdom: personal data remains protected

The UK Information Commissioner’s Office explains that organizations using AI to process personal data need a lawful basis. Additional conditions apply to sensitive categories of personal information.

The ICO is also seeking evidence about agentic AI, with its consultation scheduled to close November 20, 2026. Its questions cover security, transparency, accountability, and automated decisions.

That helps explain why AI is less regulated than milk can be a useful conversation starter but an incomplete description of the regulatory landscape.

European Union: a dedicated AI framework

The European Commission describes the AI Act as a framework organized around risk. Prohibitions on specified practices began applying in February 2025, and obligations for general-purpose AI models followed in August 2025.

Other requirements have separate implementation dates. The lesson for readers is straightforward: artificial intelligence laws and policies differ by jurisdiction, application, and timing. A global headline cannot replace those distinctions.

What stronger safeguards would look like

The practical question behind AI is less regulated than milk is what additional protection users should expect. Four measures deserve separate scrutiny.

Safeguard	What readers should ask
Independent evaluation	Who tested the system, what did they test, and what remained outside the assessment?
Incident reporting	Which failures trigger disclosure, and who receives the report?
Emergency controls	Who can suspend access or stop actions, and how quickly?
Accountability	Which organization investigates harm and provides a route to challenge the outcome?

These questions form an assessment framework, not a claim that every provider must currently satisfy identical legal requirements.

An evaluation is more informative when its scope is clear. Testing a chatbot’s written answers does not, by itself, establish that the same system can safely manage payments or customer records.

Likewise, an emergency control needs a defined purpose. Stopping new actions, revoking access, and repairing damage already done are different tasks. A shutdown promise should explain which of them it covers.

A hypothetical example: an AI assistant with account access

Imagine a small retailer considering an assistant that reads customer messages, drafts replies, and issues refunds. This is a hypothetical example, not a reported incident.

Initially, the owner allows the assistant to prepare replies for human approval. Later, the owner considers letting it issue refunds automatically.

The significance of AI is less regulated than milk becomes clearer at that moment: the permission to act deserves closer attention than the quality of a demonstration.

Before enabling automatic refunds, the owner could require a transaction limit, approval for unusual requests, an activity log, and a tested way to disconnect the assistant. Those controls would not guarantee safety, but they would establish boundaries and make errors easier to investigate.

The same reasoning applies to individuals connecting an assistant to email or cloud storage. Start with the minimum access necessary, and expand permissions only when there is a clear reason.

How to judge Microsoft’s position

When a major supplier argues that AI is less regulated than milk, readers should evaluate the proposed obligations as carefully as the warning.

To assess the claim that AI is less regulated than milk, ask whether a proposal identifies who is covered, what evidence must be produced, and what happens after a failure. Another is whether compliance requirements are proportionate to the risk, allowing smaller developers a workable path while maintaining meaningful protections.

These are policy design questions, not proof of Microsoft’s motives. Supporting regulation and demonstrating that a particular regulation will work are separate achievements.

Responsible AI development also requires attention inside organizations. For the workplace side of this issue, see Daily US Wire’s coverage of using AI instead of colleagues for help.

What users can do now

You do not need to settle whether AI is less regulated than milk to make a better purchasing decision. Before adopting a tool, ask:

• What information can it access?

• Can it take actions without approval?

• What testing evidence does the provider disclose?

• How can you report a problem and reach a person?

• Can you revoke its access quickly?

Match the depth of that review to the consequences of failure. A brainstorming tool and an assistant authorized to change business records deserve different levels of scrutiny.

The lasting value of the warning that AI is less regulated than milk is the demand for evidence behind assurances. Before giving a system more authority, look for a clear explanation of its limits, a way to intervene, and an accountable organization when something goes wrong.