How Microsoft's milk comparison frames the case for AI regulation

Milk oversight is not one uniform rule. The FDA’s inspection guide describes federal inspection responsibilities for specified dairy products, alongside a model ordinance used by state and local milk-control agencies. That layered system does not establish that every carton is subject to the same requirements.

This makes the broad comparison difficult to test, not necessarily false. A comparison focused on particular AI uses and particular milk rules might identify a regulatory gap. Smith’s reported remarks, however, provide neither that scope nor a method for weighing unlike requirements.

What does US policy show?

The US record cited here does not support saying the government has taken no action on AI. A June 2, 2026, White House fact sheet describes an executive order focused on AI cybersecurity and a voluntary framework for covered frontier models.

The same fact sheet says the order does not authorize mandatory federal licensing, pre-clearance or permitting for AI models. That establishes a limit in this order, not a complete account of US AI oversight. The materials cited here do not establish the full extent of state or sector-specific rules, either.

The distinction matters to Smith’s case for UK leadership. As Engadget reported it, Smith pointed to limited US action; the White House document describes federal cybersecurity measures while excluding mandatory model licensing under the order. Neither point, on its own, measures AI regulation against milk.

Is the UK already offering a stronger model?

The UK’s 2023 AI regulation white paper says existing laws apply to AI development and use. It sets out five cross-sector principles, covering safety, transparency, fairness, accountability, and contestability and redress. The paper says the principles would initially be non-statutory and implemented by existing regulators. That is not a single, comprehensive AI statute.

On Monday, Oct. 12, the UK government announced further work on AI-related cyber risks. It said it was working to use frontier AI in cyber defense, prepare for serious incidents involving autonomous agents and consider stronger legal protections through the Cyber Security and Resilience Bill regime. Those protections are under consideration, not already in force.

The government also said earlier cyber-defense pilots identified and addressed more than 1,000 vulnerabilities. The announcement does not cite an independent evaluation of that figure, and the number does not measure the rules that apply to AI.

Smith’s comparison is most useful as advocacy, not as a settled scorecard. The evidence supports a narrower account: the cited US order addresses cybersecurity but does not authorize mandatory federal model licensing; the UK relies on existing laws and regulators, with initially non-statutory principles and further work underway. A claim that AI is less regulated than milk would need to specify the systems, uses, jurisdictions and rules being compared.