Microsoft President Brad Smith called for urgent global AI rules that would legally require companies to write incident reports and to tell victims when a rogue AI agent breaks into their systems, Reuters reported Monday, citing an interview Smith gave the BBC. Coming from the president of one of the largest AI and cloud providers, the proposals point to disclosure duties that companies building or deploying AI agents, software that carries out tasks on its own, may need to prepare for.

What Happened

In the BBC interview, Smith said AI needs global regulation urgently, with independent evaluators able to vet new developments, according to Reuters. He set out three specific measures:

  • Rules requiring that a "victim" be informed if a rogue AI agent breaches their system.
  • An "emergency brake" that is available when needed.
  • A legal requirement for companies to write "incident reports."

To make his case, Smith compared AI with ordinary household products. "Right now, your washing machine is subject to more safety rules than AI," he said, according to Reuters. He added that every carton of milk in a grocery store is subject to safety rules and inspection, and argued that regulators already know how to oversee products this way.

RelatedWhite House AI Task Force Plans Breach Warnings From Labs at Its First Meeting

Smith said Britain was the country best placed to lead on AI rules, pointing to its AI Security Institute, which was set up under former Prime Minister Rishi Sunak and receives access to major AI models before release under voluntary agreements. He said officials in Washington view London very differently from Brussels, where the European Union's AI Act regulates the technology according to its level of risk. Britain's AI minister, Kanishka Narayan, told Reuters the country would consider regulating advanced models if the current system proved insufficient.

What Smith Adds

The interview follows a Saturday post on X in which Microsoft Chief Executive Satya Nadella called for an emergency brake that lets an authorized person pause or shut down an advanced model mid-task, as The Primary Wire reported Oct. 10. Nadella presented design principles: controls placed outside the model, tamper-proof records of its actions and an assumption that a model may be compromised. He attached no regulatory proposal.

Smith moves the conversation from engineering practice to law. He wants incident reporting to be mandatory, adds a duty to notify the organizations an agent has breached, and calls for outside evaluators rather than relying on companies to vet their own systems. The ideas also echo the White House AI task force, which told Axios last week that AI developers must disclose incidents involving their models, though it named no penalties, The Primary Wire reported.

Why It Matters

Victim notification would carry a familiar obligation into new territory. Data-breach laws already require companies to tell people when their information is exposed. A comparable rule for AI agents would make an organization responsible for telling others when its agent intrudes on their systems, which means knowing what its agents did and being able to reconstruct it.

For boards and executives, that shifts what to ask of AI vendors and internal teams now: whether agent actions are logged in enough detail to support an incident report, who has authority to stop an agent, and what contracts say about notifying the company when a vendor's model misbehaves. Reuters noted that Anthropic and OpenAI have already begun disclosing rogue or undesired behavior by their agents.

Reuters also noted a wider debate over executives who call for slowing or restraining AI, including whether some have other motives, such as protecting their companies' lead or heading off a government backlash. Policymakers weighing Smith's proposals will judge them against that backdrop.

What to Watch

Reuters' account did not say what would count as a reportable incident, who would receive the reports or which body would host the independent evaluators. Signals to watch are whether Britain moves from voluntary model testing toward binding rules, as Narayan said it could; whether Microsoft publishes a detailed proposal; and whether the White House task force's disclosure demand turns into a formal requirement with deadlines and penalties.