Satya Nadella calls for AI emergency brakes controlled by humans, not models

Microsoft CEO Satya Nadella called on October 10, 2026, for advanced AI systems to give authorized people an emergency brake: the ability to pause or shut down a model while it is working. His proposal puts control outside the model, rather than making safety depend on confidence in the model itself.

In a post on X, Nadella said it was time to reassess AI’s “trust architecture,” according to TechCrunch. He described a set of safeguards for advanced systems, including containment, independent controls and records people can inspect. The intervention was a set of recommendations, not a Microsoft product release or formal policy announcement.

The model should not control its own safeguards

The central design choice is to separate the model from the “harness”—the surrounding system that directs its work. Nadella called for controls and safeguards to sit outside the model. That distinguishes the component producing answers and taking actions from the machinery that organizes its tasks and enforces the boundaries around them.

Nadella framed this as a contrast between “non-deterministic models” and “deterministic system design”: models whose behavior is not fixed, surrounded by controls designed to operate reliably. As CNBC reported, he paired that design requirement with human controls and reliable operating procedures. The proposal addresses the whole operating system around AI, not just the quality of a model’s recommendations.

His proposed starting assumption is deliberately strict: “We must assume a model is compromised and contain it from the start.” That is a design instruction, not an allegation that a particular model has been breached. The emergency brake belongs within that containment approach, with an authorized person able to intervene mid-task rather than wait for completion.

Actions need evidence, not just answers

Nadella also called for “every meaningful model action” to leave “tamper-proof human readable evidence.” The scope is broader than keeping the final answer: his requirement concerns what the model does as it works. Human readability and protection against tampering are both part of the proposed record, alongside his separate call for auditability.

He grouped these requirements under “principles of observability”—making the system’s behavior visible and inspectable. His list extends beyond action records and shutdown controls to measures covering testing, the choice of models and the handling of incidents:

• Continuous system testing, rather than a testing requirement described only at release.
• Model diversity as another principle of the system’s design.
• Incident disclosure alongside containment, independent controls and auditability.

The same risk posture for closed and open-weight models

Nadella applied his proposed approach to both closed and open-weight frontier models—the most advanced systems—saying they should be treated like “insider risks.” His formulation does not reserve containment for one distribution model. Both categories fall within the same argument for building systems around a model that should not be trusted without independent controls.

He also called for industry standards where existing ones are insufficient. That takes the proposal beyond a preference for how one company builds its systems: Nadella is asking for shared design expectations. But the public statement remains a call for those safeguards, rather than an announcement that Microsoft has adopted a new formal policy implementing them.