UK could lead global AI safety rules, Microsoft’s president warns

Smith wants AI treated like other products that can hurt people, with basic legal duties for the companies that build and run it. His list includes:

• Emergency brakes: what the industry calls kill switches, so a company can pause or slow an AI system that gets out of control.
• Incident reports: a legal duty to write up what went wrong when AI goes rogue.
• Telling the victim: if an AI agent (software that acts on its own to complete tasks) breaks into someone’s network, the owner of that network should be notified, the same way companies already must tell customers about a data breach.
• Outside testing: rules for when independent government evaluators must sign off on a new AI product before it’s released.

“We know how to do this for other products,” Smith said. He compared it to how society handled faster cars, with stop signs, traffic lights, guardrails and speed limits, and argued that cloud providers like Microsoft, not just model makers, have a part to play.

Smith said Britain is the natural leader because of its AI Security Institute, the government lab set up under former prime minister Rishi Sunak as the AI Safety Institute. He said people in the tech sector see the UK as the country with the strongest technical ability to test advanced models.

There’s a political angle too. Smith suggested Washington would accept British-made standards more readily than rules from the European Union, because US officials don’t view London the way they view Brussels. That’s a pointed claim given how often the Trump administration has clashed with EU tech regulators.

President Donald Trump has argued that the AI industry should regulate itself so US firms don’t fall behind Chinese rivals, and he has repeatedly said whoever wins AI wins. Smith openly disagrees.

At the end of September, bosses from Google, Meta, Nvidia, OpenAI, SpaceX and Anthropic visited Trump and signed a “morally binding” pledge to work with independent auditors and make sure their systems don’t hack or reach into systems in ways nobody intended. Smith said Microsoft is happy to sign it and called it a good step, but said it is no longer enough. His reasoning: voluntary rules work for responsible companies, and the ones you need to worry about are the others.

He also pointed to Microsoft’s own record. About two and a half years ago, the company moved 34,000 engineers off product work and onto cybersecurity. Smith called it painful but right, and said slowing down when safety demands it is possible.

The UK government moved quickly. Within days, AI minister Kanishka Narayan told frontier AI labs to listen when their scientists warn of serious danger and not to release a system whose risks they can’t control. He said Britain would use every power available and would “legislate wherever necessary” to become one of the hardest countries to attack with AI.

Narayan said a government program had already fixed more than a thousand potential cyber weaknesses in government systems. Ministers are also looking at strengthening the Cyber Security and Resilience Bill so hospitals and utilities are better protected, and working with the National Cyber Security Centre and the AI Security Institute on how to respond to incidents caused by AI agents. He confirmed the institute still has access to test the latest US models, despite reports that the Trump administration had asked AI companies not to share them.

In Parliament, the business committee chair Liam Byrne said the government should take the lead on new regulation. Executives from Anthropic, OpenAI, DeepMind and Meta who gave evidence to his committee were split on whether government testing of new models should be mandatory. The UK’s coming G20 presidency is seen as the next big chance to push for international rules.

For most people, the most tangible idea here is the breach alert. Today, if a company loses your data in a hack, it generally has to tell you. Smith’s version would extend that to cases where an AI agent does the damage, so you’d know if a rogue system got into an account or network you rely on.

Independent testing before release would also mean the chatbots and assistants built into your phone, browser and office software had been checked by someone other than the company selling them. None of this is law yet, and the US and UK are pulling in different directions, so expect the fight to play out over the next year rather than the next month.