Milk has more oversight than AI.
That is the comparison Microsoft President Brad Smith reached for this week, and it landed because it is uncomfortably literal. Dairy supply chains have inspection regimes. Washing machines have safety certification, electrical standards, and recall mechanisms. Frontier model developers shipping systems that take actions in the world have, mostly, their own internal policy documents and whatever they choose to publish about them.
Smith’s second claim is the more interesting one for anyone who builds agent systems. He argued the UK is best placed to drive global AI rules, pointing to its AI Security Institute, launched in 2023 under Rishi Sunak’s government as the AI Safety Institute. His phrasing was blunt: “In the world of technology, in the tech sector, most people that I know would say, if you ask them, name the country that is the leader in having this technical capability, they would say, it’s very simple. It’s the United Kingdom. They are the best.”
Why technical capability is the actual bottleneck
Note what he is crediting. Not legislative ambition. Not market size. Technical capability in AI safety. That distinction matters enormously once you look at how regulation of agent systems would actually have to work.
Regulating a washing machine is tractable because the device has a fixed function, a bounded failure surface, and testable physical properties. You can specify a standard, build a rig, and measure against it. The compliance question collapses into a measurement question, and the measurement is cheap and repeatable.
An agent is none of those things. Its behaviour is a function of model weights, system prompt, tool permissions, memory state, retrieval sources, orchestration logic, and whatever the environment throws at it mid-task. The same underlying model, wired into two different agent scaffolds, produces two different risk profiles. Swap a read-only API for one with write access and you have changed the safety case entirely without touching a single parameter.
This is why the institute model is more structurally interesting than most AI bills. A legislature can write a rule that says agents must not take harmful autonomous actions. Only an evaluation body with real engineering staff can answer what that means for a specific deployment, build the test use, run it against the system, and interpret the results. Rules without measurement capacity are aspirations with citations.
The evaluation stack nobody has finished building
From where I sit, the open technical problems are not subtle. They are just hard and unglamorous.
- Composition. We evaluate models. We deploy systems. There is no accepted method for propagating a model-level safety result through a scaffold to a system-level claim.
- Statefulness. Benchmarks mostly score single turns. Agent failure tends to accumulate across long horizons, where small misalignments compound into real-world action.
- Tool surface. Capability is defined by what an agent can reach. Any serious assessment has to treat the permission set as a first-class variable, not a footnote in the deployment config.
- Adversarial input. Prompt injection through retrieved documents and tool outputs remains an unsolved architectural problem, not a prompt-engineering inconvenience.
- Reproducibility. Stochastic systems querying live environments make identical reruns nearly impossible. Regulatory testing needs statistical standards, not pass/fail stamps.
A state body with researchers who can attack these problems directly is a different instrument from a ministry drafting text. If the UK’s advantage is real, it is because it is accumulating the second kind of knowledge, the kind you only get by having engineers put hands on frontier systems before release.
What the comparison gets right and what it hides
The milk line is rhetorically sharp, and it should prompt a question rather than end one. Food and appliance regimes work partly because the products are stable and the standards took decades to mature. Agent systems change monthly. Any regulatory architecture built on fixed technical specifications will be stale before it is enforced.
Which argues for exactly the shape Smith is implicitly endorsing. Capability-first institutions that can evaluate what exists today, publish methods, and update as architectures shift. Less statute, more measurement infrastructure. Less certification theatre, more open test methodology that developers can run themselves before they ship.
There is a genuine open question about whether an evaluation body inside one government can set norms that bind developers headquartered elsewhere. Credibility of method is the only real lever there, and method credibility is earned through published, reproducible work.
For those of us building agents, the practical reading is simple. The evaluation stack is going to get formalised by someone. Teams that already instrument their systems for permission scope, long-horizon behaviour, and injection resistance will find that process boring. Teams that treat safety as a model property rather than a system property will not.
đź•’ Published: