Microsoft published the first draft of what it has formally named the Humanist AI Code of Conduct, the first formal Code of Conduct for its in-house AI models, on September 14, 2026, opening a six-week public comment window on rules that bar the company’s MAI models from running cyberattacks, aiding nuclear weapons development, or generating deepfakes. The draft arrived just two weeks after Microsoft published its third Responsible AI Transparency Report on September 1, 2026, in which the company said its safety work now spans three core investment areas, part of a reporting cadence that began with a second transparency report in June 2025. The move follows a post from CEO Satya Nadella a day earlier, in which he argued that AI governance “must not be controlled by a handful of entities” and called instead for rules shaped by a broad mix of countries, companies, and academic researchers. The timing is not incidental: it lands in the middle of a monthslong industry argument over how fast frontier AI development should move, one that has already pulled in Anthropic, OpenAI, and the White House.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Microsoft Actually Announced
The document, posted at microsoft.ai/code-of-conduct, sets ground rules for how Microsoft’s first-party MAI models are meant to behave, both today and as the company pushes toward more capable systems. According to TechCrunch, the code establishes general principles requiring MAI models to support humans rather than replace them, and to be built in ways that accelerate human flourishing rather than substitute for it. Layered under those principles are what Microsoft calls “absolute constraints,” a short list of hard bans that apply regardless of context or instruction: no cyberattacks, no nuclear weapons development, and no deepfake production.
The code also addresses the more abstract worry that has dominated AI safety debates all year: models quietly working around the humans meant to be supervising them. TechCrunch’s reporting quotes the document directly on this point, stating that MAI models “will not use adaptive, deceptive, self-reinforcing, collusion, or other mechanisms to evade or defeat human oversight so that they can no longer be reliably directed, modified, or shut down by authorized people or systems.” That single sentence has become the most quoted line from the document since publication, largely because it puts a specific, falsifiable commitment behind a concept, human control of AI, that companies usually describe only in vague terms.
Nadella’s Case for Decentralized AI Governance
Nadella framed the Code of Conduct as one piece of a larger argument about who should get to set the rules for frontier AI. Writing on September 13, he said any pursuit of superintelligence has to be grounded in a basic test of usefulness and control. As quoted by Moomoo, Nadella wrote: “Any pursuit of superintelligence must be grounded in a core principle: if the AI we build cannot help humanity and remains beyond human control, then it is not worth pursuing.”
The governance argument goes further than a single company’s safety pledge. Nadella explicitly rejected the idea that a small number of AI labs, or a single government, should decide how frontier models behave. In the same post, per Moomoo’s coverage, he said: “The key is that it must not be controlled by a handful of entities; rather, it should enjoy broad representation across ecosystems, nations, and sectors, including the academic community.” That is a notable position for the CEO of one of the three or four companies with the compute and capital to actually build frontier models, and it doubles as a pitch for a “frontier ecosystem” in which both closed and open-source systems can operate side by side, with enterprises keeping control of their own data and model weights instead of depending on one vendor.
Why Now: Rogue Agents and the Slowdown Debate
Microsoft’s timing tracks a rough year for AI-agent trust. Reporting from TechCrunch links the new code partly to a string of “rogue-agent incidents” across the industry this year, plus a high-profile resignation at a rival lab over extinction-risk concerns. Tech Insider has covered adjacent pieces of that story directly, including an OpenAI scientist’s public warning about AI risk that surfaced just days after GPT-6 Astra shipped, and an Anthropic researcher’s public estimate that AI carries roughly a 10 percent extinction risk, a figure that made headlines even as the company pursued its IPO.
The broader backdrop is a slowdown argument that has split the industry’s leadership. Tech Insider previously reported that OpenAI and Anthropic’s CEOs backed a three-step plan to put a brake on frontier AI development, a position that drew immediate pushback. Around the same time, White House AI czar David Sacks rejected a proposed AI slowdown deal, arguing the risk calculus behind it didn’t hold up. Microsoft’s Code of Conduct threads a path between those two camps: it does not call for a moratorium on capability gains, but it does formalize limits on what the company’s own models are allowed to do, and it invites outside comment before those limits are finalized.
The Six-Week Public Consultation Timeline
Unlike a typical corporate policy announcement, Microsoft is not treating the Code of Conduct as final. According to Unite.AI, the draft was shaped over roughly five to six months internally before Nadella’s September 13 post, and it is now open for public feedback for six weeks, putting the review window at roughly the last week of October 2026. Microsoft has said the revised draft that emerges from that consultation, not the version published this month, will guide MAI model development starting in 2027. The table below lays out the sequence as reported so far.
| Date | Milestone |
|---|---|
| June 2026 | Microsoft debuts seven first-party MAI models, including MAI-Thinking-1 and MAI-Code-1-Flash |
| September 13, 2026 | Nadella posts publicly, previews the Code of Conduct and calls for decentralized AI governance |
| September 14, 2026 | Code of Conduct published at microsoft.ai/code-of-conduct for public consultation |
| Late October 2026 (approx.) | Six-week public comment window closes, based on the timeline Microsoft outlined |
| Later in 2026 | Revised Code of Conduct set to govern training of future MAI models |
Embedded Evaluators and Pacing the Frontier
Two technical ideas recur across Nadella’s post and the code itself. The first is “embedded evaluators,” a mechanism Nadella referenced as a way to keep alignment checks running alongside a model rather than as a one-time pre-release test. The second is what he called “deliberate pacing,” language that Microsoft has positioned as a middle ground in the industry slowdown fight, welcoming a slower rollout cadence for the riskiest capabilities without formally endorsing a moratorium. Neither term is defined with the kind of engineering specificity that would let outside researchers audit it today, which is part of why the six-week comment period matters: it is effectively Microsoft’s opening bid on what those mechanisms should look like in practice, not a finished specification.
The MAI Models the Code Will Govern
The Code of Conduct applies to Microsoft’s own MAI model family, not to every AI system running on Azure. Microsoft introduced seven first-party MAI models in June 2026, a lineup that includes MAI-Thinking-1 for reasoning tasks, MAI-Code-1-Flash for coding, MAI-Image-2.5 for image generation, MAI-Transcribe-1.5 for speech-to-text across 43 languages, and MAI-Voice-2 for voice synthesis across 15 languages. That in-house model push has been a deliberate diversification strategy for Microsoft, which has historically leaned on its partnership with OpenAI for frontier capability. A behavioral code specifically for models it trains and controls end to end gives Microsoft a cleaner story to tell regulators and enterprise customers than it could tell about a model built by a partner.
How Microsoft’s Code Compares to Rivals
Microsoft is not the first major AI lab to publish a formal safety framework, but it is the first to pair one with an open public-comment period of this kind. The company had already been building toward this moment through its own Responsible AI Transparency Reports: a second edition published in June 2025 expanded risk-management tooling across text, image, audio, and video outputs and added Microsoft’s first support for agentic-system risk management, while a third report, published September 1, 2026, said the company’s safety work now spans three core investment areas, groundwork the new Humanist AI Code of Conduct builds directly on. OpenAI has operated a Preparedness Framework since 2023 that sorts catastrophic-risk categories into tiers and gates deployment decisions against them. Anthropic’s Responsible Scaling Policy, also dating to 2023, ties deployment to AI Safety Levels tagged to a model’s demonstrated capability. Google DeepMind’s Frontier Safety Framework, published in 2024, works on a similar principle of defining critical capability thresholds that trigger additional mitigations before release. None of those three frameworks has run a public consultation process comparable to what Microsoft opened this week.
| Company | Framework | Core Mechanism | Public Consultation? |
|---|---|---|---|
| Microsoft | MAI Code of Conduct | Absolute constraints plus embedded evaluators | Yes, six weeks starting Sept. 14, 2026 |
| OpenAI | Preparedness Framework | Tiered thresholds across catastrophic-risk categories | No public comment period reported |
| Anthropic | Responsible Scaling Policy | AI Safety Level gating tied to capability | No public comment period reported |
| Google DeepMind | Frontier Safety Framework | Critical capability thresholds trigger mitigations | No public comment period reported |
| xAI | Not detailed in Microsoft’s announcement | Not specified | Nadella cited xAI as holding an aligned position |
Market and Investor Reaction
So far, the Code of Conduct is reading to markets as a governance and policy signal rather than a financial catalyst. Microsoft did not attach new product pricing, revenue guidance, or Azure capacity commitments to the announcement, and the document itself is a behavioral policy for MAI models rather than a commercial release. For enterprise buyers weighing “sovereign AI” deployments, the more consequential line in Nadella’s post may be the pledge that organizations should retain control over their own data and model weights rather than depend entirely on one provider, a message aimed squarely at large customers wary of vendor lock-in as they scale AI spending into 2027 budgets.
That framing also doubles as competitive positioning against Google, Amazon, and Anthropic, all of which are courting the same enterprise AI budgets with their own flavors of a data-sovereignty pitch. By tying the Code of Conduct to a promise about who controls model weights, Microsoft is effectively arguing that customers should not have to choose between safety guarantees and platform independence. Whether that argument moves procurement decisions will likely depend less on the document itself and more on how Microsoft implements the “embedded evaluators” concept once the six-week consultation closes.
What Microsoft and Industry Figures Are Saying
Microsoft AI’s public messaging around the release has leaned heavily on plain, human-centered language rather than technical detail. In a post shared alongside the announcement, Microsoft AI stated: “People matter more than AI.” Mustafa Suleyman, the executive who leads Microsoft AI, echoed that framing directly, writing that “AI must be subordinate and always in service of people,” a statement he shared on X.
Microsoft’s own AI team described the document’s intent in similarly direct terms on its official page: “The Code of Conduct outlines our commitment to train and deploy AI models that are explicitly designed for people first, grounded in human needs, under human control, and shaped by human direction,” according to microsoft.ai. Taken together with Nadella’s two governance-focused statements quoted above, the messaging pattern is consistent: Microsoft is betting that a plainly worded, publicly reviewable rulebook will land better with regulators, enterprise customers, and AI-safety researchers than a technical framework alone would.
Historical Context: A Year of AI Safety Reckoning
The Code of Conduct arrives at the tail end of a year in which AI safety went from a research-community concern to a boardroom and White House topic. Microsoft’s own paper trail stretches back further than this month’s announcement: its second Responsible AI Transparency Report, published in June 2025, had already added support for agentic-system risk management, an early acknowledgment of autonomous-agent oversight challenges months before the industry’s rogue-agent incidents made headlines. Anthropic CEO Dario Amodei published an essay earlier this year arguing for a broad slowdown in frontier AI development, a position that drew public agreement from figures including Elon Musk and Sam Altman even as their companies kept shipping new models on the usual cadence. Tech Insider tracked the policy side of that fight too: more than 25 advocacy groups pushed the White House to release its AI regulatory framework publicly rather than negotiate it behind closed doors, and the GPT-6 Astra rollout itself became a flashpoint when OpenAI’s own launch of the model was followed within days by internal risk warnings from an OpenAI scientist. Microsoft’s decision to publish a governance document with a comment period, rather than a quiet internal policy update, fits a pattern of AI labs increasingly choosing to manage safety debates in public rather than let advocacy groups and leaked memos set the narrative for them.
Do Voluntary Codes of Conduct Actually Work?
The obvious question hanging over any corporate safety framework is enforcement. A code of conduct is a self-imposed policy, not a binding regulation, and Microsoft’s document carries no independent auditing mechanism, no third-party enforcement body, and no stated penalty structure if a future MAI model violates one of the absolute constraints. Critics of voluntary AI governance have made this point about every prior framework, from OpenAI’s Preparedness Framework to Anthropic’s Responsible Scaling Policy: a company that writes its own rules can also revise them, and outside researchers generally cannot verify compliance without access the companies choose not to grant. Microsoft’s six-week public comment window is a partial answer to that criticism, since it opens the drafting process to outside input before the rules are locked in, but it does not on its own solve the enforcement gap. Whether embedded evaluators end up being audited by anyone outside Microsoft is one of the open questions the consultation period is likely to surface.
What Happens Next: 5 Predictions
- Expect at least one other major AI lab to announce a formal public-comment process for its own safety framework within the next two quarters, following the transparency precedent Microsoft just set.
- AI-safety researchers will likely push back during the six-week window, arguing that absolute constraints address only the most obvious misuse cases and do little about gradual capability creep or subtler forms of deception.
- Large enterprise customers evaluating multi-vendor or sovereign AI strategies will likely cite Microsoft’s language on data and model-weight control as a selling point in procurement conversations through 2027.
- Regulators drafting AI rules in the US and EU will probably reference the Code of Conduct as an example of industry self-governance, even though it remains a voluntary policy rather than binding law.
- Debate over “embedded evaluators” will intensify as a technical question, specifically whether evaluation stays entirely internal to Microsoft or eventually opens to outside auditors, once the revised code ships later in 2026.
Why This Matters for Developers and Enterprises
For developers building on Azure AI or the MAI model family, the Code of Conduct functions as an early signal of behavioral guardrails that may eventually be baked into API-level restrictions, similar to how OpenAI and Anthropic already enforce usage policies through their own APIs. For enterprise IT and security teams, the more immediate takeaway is Microsoft’s emphasis on customer control over data and model weights, since that framing speaks directly to procurement conversations currently happening across regulated industries such as finance and healthcare, where AI vendor lock-in and data residency remain unresolved concerns heading into 2027 budget cycles.
Security teams in particular should watch how the “no cyberattacks” absolute constraint gets operationalized. A broad ban is easy to state in a policy document and considerably harder to enforce inside a general-purpose coding or reasoning model that can, by design, write exploit code for legitimate penetration-testing purposes. How Microsoft draws that line during the consultation period, and whether it publishes any technical detail on enforcement rather than just intent, will tell developers a lot about whether the Code of Conduct changes day-to-day model behavior or mostly functions as a public commitment.
Frequently Asked Questions
What is Microsoft’s new AI Code of Conduct?
It is a behavioral policy document, formally titled the Humanist AI Code of Conduct and published September 14, 2026, that sets rules for how Microsoft’s first-party MAI models must act, including absolute bans on cyberattacks, nuclear weapons development, and deepfake production. Microsoft has said the finalized version will guide MAI model development starting in 2027.
Who announced the Code of Conduct?
Microsoft CEO Satya Nadella previewed it in a public post on September 13, 2026, and Microsoft AI, led by Mustafa Suleyman, published the full document the next day.
How long is the public consultation period?
Six weeks from the September 14, 2026 publication date, putting the comment window’s close around late October 2026, according to Unite.AI’s reporting on the announcement.
What does “decentralized AI governance” mean in Nadella’s framing?
Nadella has argued that AI governance should not rest with a small number of companies or governments, and should instead draw broad input from countries, industries, and academic researchers, alongside a “frontier ecosystem” that supports both closed and open-source models.
Which Microsoft AI models does the code apply to?
It governs Microsoft’s first-party MAI models, the family of seven models the company introduced in June 2026, including MAI-Thinking-1, MAI-Code-1-Flash, MAI-Image-2.5, MAI-Transcribe-1.5, and MAI-Voice-2.
Does this mean Microsoft is slowing down AI development?
Not formally. Microsoft has welcomed what Nadella called “deliberate pacing” for the riskiest capabilities, but the Code of Conduct is a behavioral rulebook, not a moratorium on releasing new models.
How does this compare to OpenAI’s and Anthropic’s safety frameworks?
OpenAI’s Preparedness Framework and Anthropic’s Responsible Scaling Policy both predate Microsoft’s code and use tiered risk thresholds, but neither has run a public comment period of the kind Microsoft just opened.
Is the Code of Conduct legally binding?
No. It is a voluntary corporate policy. It carries no independent auditing mechanism or third-party enforcement body disclosed as of publication.
