Governing AI: A Blueprint for the Future

Governing AI:
A Blueprint for the Future

May 25, 20231

Governing AI: A Blueprint for the Future

Table of contents
Foreword

3

By Microsoft Vice Chair and President Brad Smith

Part 1 Governing AI: A legal and regulatory blueprint for the future

9

Implementing and building upon new government-led AI safety frameworks

10

Requiring effective safety brakes for AI systems that control
critical infrastructure

12

Developing a broad legal and regulatory framework based on the technology
architecture for AI

15

Promote transparency and ensure academic and nonprofit access to AI

22

Pursue new public-private partnerships to use AI as an effective tool to address
the inevitable societal challenges that come with new technology

Part 2 Responsible by design: Microsoft’s approach to building AI
systems that benefit society

26

28

Microsoft’s commitment to developing AI responsibly

29

Operationalizing Responsible AI at Microsoft

30

Case study: Applying our Responsible AI approach to the new Bing

34

Advancing Responsible AI through company culture

36

Empowering customers on their Responsible AI journey

39

Conclusion

412

Governing AI: A Blueprint for the Future

Foreword: How Do We Best Govern AI?

Brad Smith, Vice Chair
and President, Microsoft“Don’t ask what computers can do, ask
what they should do.”to put these principles into practice. Today we have nearlyThat is the title of the chapter on AI and ethics in a book I

transparent AI systems designed to benefit society.

coauthored in 2019. At the time, we wrote that “this may be
one of the defining questions of our generation.” Four years

350 people working on responsible AI at Microsoft, helping
us implement best practices for building safe, secure, andworld’s capitals, but around many dinner tables.

New opportunities to improve thehuman condition

As people have used or heard about the power of OpenAI’s

The resulting advances in our approach have given us the

GPT-4 foundation model, they have often been surprised

capability and confidence to see ever-expanding ways

or even astounded. Many have been enthused or evenfor AI to improve people’s lives. We’ve seen AI help saveexcited. Some have been concerned or even frightened.

individuals’ eyesight, make progress on new cures for

What has become clear to almost everyone is somethingcancer, generate new insights about proteins, and provide

we noted four years ago—we are the first generation inpredictions to protect people from hazardous weather.

the history of humanity to create machines that can make

Other innovations are fending off cyberattacks and helping

decisions that previously could only be made by people.

to protect fundamental human rights, even in nations

later, the question has seized center stage not just in theCountries around the world are asking common questions.

afflicted by foreign invasion or civil war.

How can we use this new technology to solve our problems?

Everyday activities will benefit as well. By acting as a

How do we avoid or manage new problems it might create?

copilot in people’s lives, the power of foundation models

How do we control technology that is so powerful?

like GPT-4 is turning search into a more powerful tool for

These questions call not only for broad and thoughtful
conversation, but decisive and effective action. This paper
offers some of our ideas and suggestions as a company.
These suggestions build on the lessons we’ve been learning
based on the work we’ve been doing for several years.
Microsoft CEO Satya Nadella set us on a clear course when
he wrote in 2016 that “perhaps the most productive debate
we can have isn’t one of good versus evil: The debate
should be about the values instilled in the people andinstitutions creating this technology.”

research and improving productivity for people at work.
And for any parent who has struggled to remember how tohelp their 13-year-old child through an algebra homeworkassignment, AI-based assistance is a helpful tutor.
In so many ways, AI offers perhaps even more potential
for the good of humanity than any invention that has
preceded it. Since the invention of the printing press withmovable type in the 1400s, human prosperity has been
growing at an accelerating rate. Inventions like the steam
engine, electricity, the automobile, the airplane, computing,and the internet have provided many of the building blocks

Since that time, we’ve defined, published, and implemented

for modern civilization. And like the printing press itself,

ethical principles to guide our work. And we’ve built out

AI offers a new tool to genuinely help advance humanconstantly improving engineering and governance systems

learning and thought.

3

Governing AI: A Blueprint for the Future

Source: Maddison Project Our World in Data¹

Guardrails for the future
Another conclusion is equally important: it’s not enough tofocus only on the many opportunities to use AI to improve

however, that the guardrails needed for AI require a
broadly shared sense of responsibility and should not beleft to technology companies alone.

people’s lives. This is perhaps one of the most important

When we at Microsoft adopted our six ethical principles forlessons from the role of social media. Little more than a

AI in 2018, we noted that one principle was the bedrock for

decade ago, technologists and political commentators

everything else—accountability. This is the fundamental

alike gushed about the role of social media in spreadingneed: to ensure that machines remain subject to effective

democracy during the Arab Spring. Yet five years after

oversight by people and the people who design andthat, we learned that social media, like so many otheroperate machines remain accountable to everyone else. In

technologies before it, would become both a weapon and ashort, we must always ensure that AI remains under human

tool—in this case aimed at democracy itself.

control. This must be a first-order priority for technology

Today, we are 10 years older and wiser, and we need to put

companies and governments alike.

that wisdom to work. We need to think early on and in aThis connects directly with another essential concept. In aclear-eyed way about the problems that could lie ahead. As

democratic society, one of our foundational principles istechnology moves forward, it’s just as important to ensurethat no person is above the law. No government is above

proper control over AI as it is to pursue its benefits. We are

the law. No company is above the law, and no product orcommitted and determined as a company to develop andtechnology should be above the law. This leads to a critical

deploy AI in a safe and responsible way. We also recognize,

conclusion: people who design and operate AI systems¹ Visit the Our World in Data site to download a CSV file of thefull dataset used in the chart.

4

Governing AI: A Blueprint for the Future

cannot be accountable unless their decisions and actions

just four months ago by the U.S. National Institute ofare subject to the rule of law.

Standards and Technology, or NIST. Part of the Department

In many ways, this is at the heart of the unfolding AI policy
and regulatory debate. How do governments best ensureof Commerce, NIST has completed and launched a new AI
Risk Management Framework.

that AI is subject to the rule of law? In short, what form

We offer four concrete suggestions to implement and build

should new law, regulation, and policy take?

upon this framework, including commitments Microsoft ismaking in response to a recent White House meeting with

A five-point blueprint for the public
governance of AI

leading AI companies. We also believe the Administrationand other governments can accelerate momentum throughprocurement rules based on this framework.

Part 1 of this paper offers a five-point blueprint to address

Second, require effective safety brakes for AI systems

several current and emerging AI issues through publicthat control critical infrastructure. In some quarters,

policy, law, and regulation. We offer this recognizing

thoughtful individuals increasingly are asking whether wethat every part of this blueprint will benefit from broader

can satisfactorily control AI as it becomes more powerful.

discussion and require deeper development. But we hope

Concerns are sometimes posed regarding AI control ofthis can contribute constructively to the work ahead.

critical infrastructure like the electrical grid, water system,

First, implement and build upon new government-led

and city traffic flows.

AI safety frameworks. The best way to succeed is often toThis is the right time to discuss this question. Thisbuild on the successes and good ideas of others. Especially

blueprint proposes new safety requirements thatwhen one wants to move quickly. In this instance, there

in effect would create safety brakes for AI systems

is an important opportunity to build on work completed

that control the operation of designated critical

A five-point
blueprint forgoverning AI

1Implement and build upon new government-led AI
safety frameworks

2

Require effective safety brakes for AI systems that
control critical infrastructure3

Develop a broader legal and regulatory framework
based on the technology architecture for Al

4

Promote transparency and ensure academic andpublic access to Al

5

Pursue new public-private partnerships to use Al asan effective tool to address the inevitable societal
challenges that come with new technology

5Governing AI: A Blueprint for the Future

infrastructure. These fail-safe systems would be partThird, develop a broad legal and regulatory frameworkof a comprehensive approach to system safety thatbased on the technology architecture for AI. We believe

would keep effective human oversight, resilience, andthere will need to be a legal and regulatory architecturerobustness top of mind. In spirit, they would be similar

for AI that reflects the technology architecture for AI itself.

to the braking systems engineers have long built into

In short, the law will need to place various regulatory

other technologies such as elevators, school buses, andresponsibilities upon different actors based upon their rolehigh-speed trains, to safely manage not just everyday

in managing different aspects of AI technology.

scenarios, but emergencies as well.

For this reason, this blueprint includes information aboutsome of the critical pieces that go into building and using

In this approach, the government would define the

new generative AI models. Using this as context, it proposes

class of high-risk AI systems that control criticalthat different laws place specific regulatory responsibilities

infrastructure and warrant such safety measures as parton the organizations exercising certain responsibilities atof a comprehensive approach to system management.

three layers of the technology stack: the applications layer,

New laws would require operators of these systems to

the model layer, and the infrastructure layer.

build safety brakes into high-risk AI systems by design.
The government would then ensure that operators test

This should first apply existing legal protections at thehigh-risk systems regularly to make certain that theapplications layer to the use of AI. This is the layer where thesystem safety measures are effective. And AI systems thatsafety and rights of people will most be impacted, especiallycontrol the operation of designated critical infrastructure

because the impact of AI can vary markedly in different

would be deployed only in licensed AI datacenters thattechnology scenarios. In many areas, we don’t need newwould ensure a second layer of protection through thelaws and regulations. We instead need to apply and enforce

ability to apply these safety brakes, thereby ensuringexisting laws and regulations, helping agencies and courts

effective human control.

develop the expertise needed to adapt to new AI scenarios.

KY3C:
Applying to AI services the “Know Your Customer“
concept developed for financial services

Know your Cloud

Know your Customer

Know your Content

6Governing AI: A Blueprint for the Future

There will then be a need to develop new law andAI resources. While there are some important tensions

regulations for highly capable AI foundation models,

between transparency and the need for security, there exist

best implemented by a new government agency. This will

many opportunities to make AI systems more transparent

impact two layers of the technology stack. The first willin a responsible way. That’s why Microsoft is committing torequire new regulations and licensing for these models

an annual AI transparency report and other steps to expand

themselves. And the second will involve obligations fortransparency for our AI services.

the AI infrastructure operators on which these models aredeveloped and deployed. The blueprint that follows offers
suggested goals and approaches for each of these layers.

We also believe it is critical to expand access to AI resources
for academic research and the nonprofit community.
Basic research, especially at universities, has been of

In doing so, this blueprint builds in part on a principle

fundamental importance to the economic and strategic

developed in recent decades in banking to protect against

success of the United States since the 1940s. But unlessmoney laundering and criminal or terrorist use of financial

academic researchers can obtain access to substantially

services. The “Know Your Customer”—or KYC—principle

more computing resources, there is a real risk that scientificrequires that financial institutions verify customer identities,

and technological inquiry will suffer, including relating to AI

establish risk profiles, and monitor transactions to help

itself. Our blueprint calls for new steps, including steps we

detect suspicious activity. It would make sense to take thiswill take across Microsoft, to address these priorities.

principle and apply a KY3C approach that creates in the
AI context certain obligations to know one’s cloud, one’s
customers, and one’s content.

Fifth, pursue new public-private partnerships to use AI
as an effective tool to address the inevitable societal
challenges that come with new technology. One

In the first instance, the developers of designated, powerfullesson from recent years is what democratic societies can

AI models first “know the cloud” on which their models areaccomplish when they harness the power of technology

developed and deployed. In addition, such as for scenariosand bring the public and private sectors together. It’s athat involve sensitive uses, the company that has a direct

lesson we need to build upon to address the impact of AI

relationship with a customer—whether it be the model

on society.

developer, application provider, or cloud operator on which
the model is operating—should “know the customers” thatare accessing it.

We will all benefit from a strong dose of clear-eyed
optimism. AI is an extraordinary tool. But like othertechnologies, it too can become a powerful weapon, andAlso, the public should be empowered to “know thethere will be some around the world who will seek to use

content” that AI is creating through the use of a label orit that way. But we should take some heart from the cyberother mark informing people when something like a video

front and the last year and a half in the war in Ukraine.

or audio file has been produced by an AI model rather than

What we found is that when the public and private sectors

a human being. This labeling obligation should also protect

work together, when like-minded allies come together,

the public from the alteration of original content and theand when we develop technology and use it as a shield, it’screation of “deep fakes.” This will require the development

more powerful than any sword on the planet.

of new laws, and there will be many important questions
and details to address. But the health of democracy andfuture of civic discourse will benefit from thoughtful
measures to deter the use of new technology to deceive or
defraud the public.

Important work is needed now to use AI to protect
democracy and fundamental rights, provide broad accessto the AI skills that will promote inclusive growth, and use
the power of AI to advance the planet’s sustainability needs.
Perhaps more than anything, a wave of new AI technology

Fourth, promote transparency and ensure academic

provides an occasion for thinking big and acting boldly. In

and nonprofit access to AI. We believe a critical publiceach area, the key to success will be to develop concrete

goal is to advance transparency and broaden access toinitiatives and bring governments, respected companies,

7Governing AI: A Blueprint for the Futureand energetic NGOs together to advance them. We offer

and testing systems that continue to mature rapidly. This issome initial ideas in this report, and we look forward to

supported by additional governance processes that include

doing much more in the months and years ahead.

monitoring, auditing, and compliance measures.
As with everything in life, one learns from experience.

Governing AI within Microsoft

When it comes to AI governance, some of our most

Ultimately, every organization that creates or uses

required to review specific sensitive AI use cases. In 2019,advanced AI systems will need to develop and implement
its own governance systems. Part 2 of this paper describes
the AI governance system within Microsoft—where webegan, where we are today, and how we are moving into
the future.
As this section recognizes, the development of a new
governance system for new technology is a journey inimportant learning has come from the detailed work
we founded a sensitive use review program to subject
our most sensitive and novel AI use cases to rigorous,
specialized review that results in tailored guidance. Since
that time, we have completed roughly 600 sensitive usecase reviews. The pace of this activity has quickened tomatch the pace of AI advances, with almost 150 such
reviews taking place in the last 11 months.

and of itself. A decade ago, this field barely existed. Today

All of this builds on the work we have done and will

Microsoft has almost 350 employees specializing in it, andcontinue to do to advance responsible AI through company

we are investing in our next fiscal year to grow this further.

culture. That means hiring new and diverse talent to growAs described in this section, over the past six years we havebuilt out a more comprehensive AI governance structureand system across Microsoft. We didn’t start from scratch,borrowing instead from best practices for the protectionof cybersecurity, privacy, and digital safety. This is allpart of the company’s comprehensive Enterprise Risk
Management (ERM) system, which has become a critical

our responsible AI ecosystem and investing in the talent wealready have at Microsoft to develop skills and empower
them to think broadly about the potential impact of AI
systems on individuals and society. It also means that much
more than in the past, the frontier of technology requires amultidisciplinary approach that combines great engineers
with talented professionals from across the liberal arts.

part of the management of corporations and many otherAll this is offered in this paper in the spirit that we’re on aorganizations in the world today.

collective journey to forge a responsible future for artificial

When it comes to AI, we first developed ethical principles
and then had to translate these into more specificcorporate policies. We’re now on version 2 of the corporate

intelligence. We can all learn from each other. And nomatter how good we may think something is today, we will
all need to keep getting better.

standard that embodies these principles and defines more

As technology change accelerates, the work to govern

precise practices for our engineering teams to follow.

AI responsibly must keep pace with it. With the right

We’ve implemented the standard through training, tooling,commitments and investments, we believe it can.

Brad Smith
Vice Chair and President, Microsoft

8

Governing AI: A Blueprint for the Future01
Governing AI:
A Legal and Regulatory
Blueprint for the FutureGoverning AI: A Blueprint for the Future

Governing AI: A Legal and Regulatory
Blueprint for the Future

Around the world, governments are looking for ordeveloping what in effect are new blueprints to govern
artificial intelligence. There, of course, is no single or rightapproach. We offer here a five-point approach to help
governance advance more quickly, based on the questions
and issues that are pressing to many. Every part of thisblueprint will benefit from broader discussion and require
deeper development. But we hope this can contributeconstructively to the work ahead.
This blueprint recognizes the many opportunities to use
AI to improve people’s lives while also quickly developing
new controls, based on both governmental and private

1. Implement and build upon new
government-led AI safety frameworks.
One of the most effective ways to move quickly is to build
on recent advances in governmental work that advance
AI safety. This makes far more sense than starting fromscratch, especially when there is a recent and strong footingon which to start.
As events have it, just four months ago, the National
Institute of Standards and Technology in the UnitedStates, or NIST, completed a year and a half of intensive
work and launched an important new AI safety initiative.
This new AI Risk Management Framework builds on

initiative, including broader international collaboration. It

NIST’s years of experience in the cybersecurity domain,

offers specific steps to:where similar frameworks and standards have played a•

Implement and build upon new government-led AI
safety frameworks.

•

Require effective safety brakes for AI systems that
control critical infrastructure.

•

Develop a broader legal and regulatory framework
based on the technology architecture for AI.

•

Promote transparency and ensure academic andpublic access to AI.

•

critical role.
We believe the new AI Risk Management Frameworkprovides a strong foundation that companies andgovernments alike can immediately put into action toensure the safer use of artificial intelligence. While no single
such effort can answer every question, the immediate
adoption of this framework will accelerate AI safety
momentum around the world. And we can all build upon it
in the months ahead.
Part of the U.S. Department of Commerce, NIST developed

Pursue new public-private partnerships to use

its new framework based on direction by Congress in

AI as an effective tool to address the inevitable

the National Artificial Intelligence Initiative Act of 2020.

societal challenges that come with new

The framework is designed to enable organizations totechnology.

help manage AI risks and promote the trustworthy andresponsible development and use of AI systems. It wasThis plan responds in part to the White House’s recent calldeveloped through a consensus-driven and transparent

for commitments from AI companies to ensure AI safety

process involving work by government agencies, civil

and security, and it includes several specific commitmentssociety organizations, and several technology leaders,that Microsoft is offering in response.

including Microsoft.

10

Governing AI: A Blueprint for the Future

NIST brings years of experience to the AI risk management

In addition to continually monitoring, tracking, andspace from its years of work developing critical tools toevaluating our AI systems, we will use metrics to measureaddress cybersecurity risks. Microsoft has long experienceand understand systemic issues specific to generative AI

working with NIST on the cybersecurity front, and it’s

experiences, such as the extent to which a model’s output isencouraging to see NIST apply this expertise to help

supported by information contained in input sources. (Weorganizations govern, map, measure, and manage theare releasing the first of these metrics this week as part ofrisks associated with AI. We’re not alone in our highour Azure OpenAI Service at Build, our annual developer

regard for NIST’s approach, as numerous governments,

conference.)

international organizations, and leading businesses havealready validated the value of the new AI Risk Management
Framework.

Third, we believe the Administration can accelerate
momentum through an Executive Order that requires
vendors of critical AI systems to the U.S. Government

Now the question is how to build upon this recent progress

to self-attest that they are implementing NIST’s AI Risk

so we can all move faster to address AI risks. We believe

Management Framework.

there are at least four immediate opportunities:
First, Microsoft is committing to the White House, in
response to its recent meeting, that we will implement
NIST’s AI Risk Management Framework. Microsoft’sinternal Responsible AI Standard is closely aligned with theframework already, and we will now work over the summer

It’s important for governments to move faster, using bothcarrots and sticks. In the United States, federal procurement
mechanisms have repeatedly demonstrated their value in
improving the quality of products and advancing industry
practice more generally. Building on similar approaches
used for key technology priorities like cybersecurity, theto implement it so that all our AI services benefit from it.

U.S. Government could insert requirements related to

Second, we are similarly committing that we willprocurement process for AI systems.

augment Microsoft’s existing AI testing work with new
steps to further strengthen our engineering practices

the AI Risk Management Framework into the federal

As a starting point, we believe it makes sense to scope such

relating to high-risk AI systems.

procurement requirements to focus on critical decision

Under Microsoft’s Responsible AI Standard, our AI

meaningfully impact the public’s rights, opportunities, or

systems, meaning AI systems that have the potential toengineering teams already work to identify potential

access to critical resources or services. This would align withharms, measure their propensity to occur, and build

the approach set out in the Blueprint for an AI Bill of Rights,

mitigations to address them. We have further developed

released last year by the White House’s Office of Science

red teaming techniques using multidisciplinary teams,

and Technology Policy.

which were originally developed to identify cybersecurity
vulnerabilities, to stress test AI systems with a wide range ofexpertise, including privacy, security, and fairness.

Finally, we are committed to working with otherindustry leaders and those in government to develop
new and additional standards relating to highly

For high-risk systems, Microsoft is committing that red

capable foundation models. We recognize that the paceteaming is conducted before deployment by qualified

of AI advances raises new questions and issues related

experts who are independent of the product teams

to safety and security, and we are committed to working

building those systems, adopting a best practice fromwith others to develop actionable standards to help

the financial services industry. We will rely upon theseevaluate and address them. Already, leaders at OpenAI,

red teams, together with our product teams who are

Google, Anthropic, and other AI companies have advanced

responsible for systematic evaluations of the products

important ideas that will help provide a foundation forthat they build, to help us identify, measure, and mitigate

future progress. We look forward to working with them andpotential harms.

many others as these types of efforts move forward.

11

Governing AI: A Blueprint for the Future

Using an Executive Order toimplement the NIST AI Risk
Management Framework

be directed to develop voluntary, standard contract
language for agencies that are procuring criticaldecision systems, obligating a baseline set of actions inline with the framework’s recommendations.

The following steps could be considered as part of a

Additionally, NIST’s important work to build out AI

comprehensive approach to implementing the NIST AI Risk

RMF “Profiles” (guides on how the NIST AI RMF applies

Management Framework using an Executive Order.
•

to specific sectors and/or systems) could include theRequire self-attestation by vendors of NIST AI RMF

development of specific profiles for public sector usesalignment. Self-attestation is used by the governmentof critical decision systems.

to advance cybersecurity standards amongst federal
suppliers. A similar mechanism can be applied to the•Program Office, coupled with GSA and Agency Equity

NIST AI RMF. The Office of Management and Budget•(OMB) could issue guidance requiring federal agencies

Teams, could deliver training on AI trustworthinessprocuring AI services for use in critical decision systems

for individuals responsible for acquiring or procuring

to only do so from suppliers that have self-attested

critical decision systems. This would support

that they meet a minimum bar for implementation for

acquisition professionals in important roles that

the NIST AI RMF. The minimum bar could be set by thedefine the scope of contract solicitations, set contract

NIST AI RMF Program Office mentioned below.

requirements, or make vendor determinations.
Training would cover the technology’s risks andEstablish a NIST AI RMF Program Office to advancebenefits in order to help acquisition professionals

coordination and enablement. We suggest thedetermine whether the software under consideration

creation of a NIST AI RMF Program Office to provide

meets standards for performance and does not

ongoing guidance for the framework and promote

unlawfully discriminate.

adoption of it across agencies. This Program Office
could also work with the new “Agency Equity Teams,”
required by EO 14091 on Advancing Racial Equity, toinclude guidance that helps small- and medium-sizedorganizations.
•

Advance training and education. The NIST AI RMF•

Augment baseline AI governance requirements
for agencies. Federal agencies could be required
to implement the NIST AI RMF in their own AI
development. In time, this could be supplemented

Develop responsible procurement resources. The

with mandatory responsible AI controls for

General Services Administration (GSA) and OMB could

government systems.

2. Require effective safety brakes
for AI systems that control criticalinfrastructure.
History offers an important and repeated lesson about
the promise and peril of new technology. Since the adventof the printing press, governments have confronted theneed to decide whether to accept or reject new inventions.
Beginning in the latter half of the 1400s, Europe embraced
the printing press, while the Ottoman Empire mostly

banned it. By 1500, citizens in the Netherlands werereading more books per capita than anyone else. It’s not acoincidence that the small nation soon found itself at theforefront of economic innovation.
Ever since, inventors and governments have typicallyconcluded that the best path forward is to harness thepower of new technology in part by taming it. The historyof technology is replete with examples.
Modern cities would not be possible without tall buildings,

12

Governing AI: A Blueprint for the Future

but tall buildings would not be possible without elevators.

have emergency brakes with bus drivers trained to use

And in the 1800s, most people understandably were

them. Planes today have ground proximity detectors anduncomfortable getting into what all of us today do without

airborne collision avoidance systems that have helped

even thinking about—entering a metal box and being

to make commercial air travel incredibly safe, while

hoisted several stories into the sky by a cable. Elisha Otis,

empowering pilots—not machines—to make decisions in

the American inventor of the elevator, found in the 1850s

safety-critical scenarios.

that the public was slow to accept his machines, deeming
them too dangerous.

As we look to a future with artificial intelligence, it’s worth
remembering that the same fundamental approach has

This changed in 1854 at the World’s Fair in New York, when

worked repeatedly in managing the potential dangers

Otis demonstrated a new safety brake for his elevator. He

associated with new technology. Namely, identify when asevered the cable holding his machine above the watching

new product could become the equivalent of a runaway

crowd, and the brake immediately caught the car, halting

train, and as for the locomotive itself, install an effective

its fall. People were reassured, and in an important respect,safety system that can act as a brake and ensure that thethe modern city was born.

right people will use it quickly if it’s ever needed—whether

This pattern has repeated itself for everything fromto slow something down or even bring it to a halt.

electricity to railroads to school buses. Today houses and

Not every potential AI scenario poses significant risks, and inbuildings have circuit breakers to protect against a surge

fact, most do not. But this becomes more relevant when one

in the electrical current. City codes require them. Similarly,

contemplates AI systems that manage or control infrastructure

hundreds of millions of people put what they hold most

systems for electricity grids, the water system, emergency

precious in the world—their children—on morning school

responses, and traffic flows in our cities. We need “safety

buses, based in part on regulations that require buses tobrakes” to ensure these systems remain under human control.

Four steps governments can take to secure effective safety
brakes for AI systems controlling critical infrastructure
1

Define the class of high-risk AI systems being deployed2

Require system developers to ensure that safety brakes are built bydesign into the use of AI systems for the control of infrastructure

3

Ensure operators test and monitor high-risk systems to ensure AI
systems that power critical infrastructure remain within human control

4

Require AI systems that control operation of designated criticalinfrastructure to be deployed only in licensed AI infrastructure13

Governing AI: A Blueprint for the Future

We believe that the following steps would help address

bear to the engineering of AI systems that control criticalthese issues:

infrastructure. We should establish a layered approach toFirst, the government should define the class of highrisk AI systems that are being deployed to control

AI safety, with the “safety brake” concept implemented at
multiple levels.

critical infrastructure and warrant safety brakes as part

While the implementation of “safety brakes” will vary acrossof a comprehensive approach to system safety.

different systems, a core design principle in all cases is thatIn the United States, the Secretary of Homeland Security
is responsible for identifying and prioritizing criticalinfrastructure in coordination with other government
agencies. Most notably, this includes the Cybersecurity
and Infrastructure Security Agency, or CISA, which has

the system should possess the ability to detect and avoid
unintended consequences, and it must have the ability todisengage or deactivate in the event that it demonstrates
unintended behavior. It should also embody best practicein human-computer interaction design.

identified 16 critical infrastructure sectors, including theThird, the government should ensure operators test andcommunications sector, the emergency services sector, andmonitor high-risk systems to make certain that AI-

the energy sector, to name a few.

systems that power critical infrastructure remain within

For the purposes of applying the safety brake concept to AI

human control.

systems, we need to focus on the AI systems that are used

Specific system testing will be needed in the context of ato control the operation of critical infrastructure. Thereplanned deployment for critical infrastructure. In otherwill be many AI systems used within critical infrastructure

words, the use of an advanced AI model must be reviewed

sectors that are low risk and that do not require the samein the context of how it will be used in a specific product or

depth of safety measures—employee productivity tools

service.

and customer service agents are two such examples.

In accordance with system safety best practices, the system

Instead, one should focus on highly capable systems,

and each of its components should be tested, verified, andincreasingly autonomous systems, and systems that crossvalidated rigorously. It should be provable that the system

the digital-physical divide. For the purposes of spurring
further discussion, one place to start might be to focus on
AI systems that:•

Take decisions or actions affecting large-scale
networked systems;

operates in a way that allows humans to remain in control
at all times. In practice, we anticipate that this will require
close and regular coordination between a system operator,
their AI infrastructure provider, and their regulatory
oversight bodies.
Fourth, AI systems that control the operation of•Process or direct physical inputs and outputs;•

Operate autonomously or semi-autonomously; andonly in licensed AI infrastructure.

•

Pose a significant potential risk of large-scale harm,

We believe it would be wise to require that AI systems that

including physical, economic, or environmental harm.

control the operations of higher-risk critical infrastructure

Second, the government should require systemdevelopers to ensure that safety brakes are built bydesign into the use of AI systems for the control ofcritical infrastructure.

designated critical infrastructure should be deployedsystems be deployed on licensed AI infrastructure. This
is not to suggest that the AI infrastructure needs to bea hyperscale cloud provider such as Microsoft. Criticalinfrastructure operators might build AI infrastructure andqualify for such a license in their own right. But to obtain

System safety is a well-established discipline that wesuch a license, the AI infrastructure operator should be

have put to work in the aviation, automotive, and nuclear

required to design and operate their system to allow

sectors, among others, and it is one that we must bring toanother intervention point—in effect, a second and14

Governing AI: A Blueprint for the Future

separate layer of protection—for ensuring human control

models. But we should also heed the Alignment Researchin the event that application-level measures fail.

Center’s call for ongoing research on these topics andThese proposals might leave some wondering how realistic
or futureproof “safety brakes” are if we are on a path todeveloping AI systems that are more capable than humans.
They might ask: couldn’t the AI system itself work aroundsafety brakes and override them? Won’t the AI systemknow how humans will respond at every step of the way
and simply work around those responses?
In posing those questions, it’s important to be clear
about the facts as they stand today. Today’s cutting-edge
AI systems like GPT-4 from OpenAI and Claude from
Anthropic have been specifically tested—by qualified thirdparty experts from the Alignment Research Center—fordangerous capabilities, such as the ability to evade humanoversight and become hard to shut down. Those tests
concluded that GPT-4 and Claude do not have sufficientcapabilities to do those things today.

recognize the need for industry-wide commitment to AI
capability evaluations. Put simply, we need to ensure that
we have the right structures in place not only to understandthe status quo, but to get ahead of the future. That isprecisely why we need action with respect to the small but
important class of highly capable AI models that are on thefrontier—a topic that our next section addresses.

3. Develop a broad legal and regulatory
framework based on the technology
architecture for AI.
As we have given more thought to the various potential
legal and regulatory issues relating to AI responsibilities,
it has become more apparent that there will need to bea legal and regulatory architecture for AI that reflects thetechnology architecture for AI itself. In short, the law will

This rigorous testing and the conclusions drawn provide us

need to place various regulatory responsibilities uponwith clarity as to the capabilities of today’s cutting-edge AI

different actors based upon their role in managing different

The technology stack for AI foundation models
Applications

Software programs where the output of an AI model isput to work

API Services

APIs (Application Program Interfaces), or endpoints,
through which applications access pre-trained models

Powerful Pre-Trained
AI Models

Pre-trained models like GPT-4 that can be used to solve
similar problems without starting from scratch

Machine Learning
Acceleration Software

Software that speeds up the process of developing anddeploying large Al models

AI Datacenter
Infrastructure

Advanced supercomputing infrastructure, including
clusters of advanced GPUs (Graphics Processing Units)with high bandwidth network connections

15

Governing AI: A Blueprint for the Future

Made in Iowa

aspects of AI technology. For this reason, it’s helpful toconsider some of the critical pieces that go into building
and using new foundation AI models.

A grounding in the technology architecture for AI
foundation models
Software companies like Microsoft build a “tech stack” withlayers of technologies that are used to build and run theapplications that organizations and the public rely uponevery day. There’s no single right way to describe an AI techstack, and there’s a good chance that any two developers
will describe it differently. But for purposes of thinking
about the future of AI regulation, a good way to start is toconsider the chart on the previous page.
An advanced pretrained AI model like GPT-4 is shownon the third row above, in the middle of the stack. It’s
created by developers and research scientists at a firm likeabove, located just west of Des Moines, in Iowa.
As Microsoft announced when it opened this datacenter
in March 2020, this datacenter contains a single
supercomputing system that ranked upon opening in the
top five supercomputers in the world. Built by Microsoft
in collaboration with and exclusively for use by OpenAI todevelop its GPT models, the supercomputing system has
more than 285,000 Central Processing Unit (CPU) cores.
(The CPU is perhaps the most fundamental component inany modern PC or laptop.) The system also has more than
10,000 of the most advanced Graphics Processing Units, orGPUs. Less advanced versions of such chips are containedin a gaming console or gaming laptop and can process alarge number of mathematical equations simultaneously.
Each GPU server in the datacenter has network connectivity
that can process 400 gigabits of data per second.

OpenAI based on the two layers below it. In the case of

As Microsoft Chief Technical Officer Kevin Scott said

GPT-4, OpenAI technical staff in San Francisco, California,

when we made this announcement in 2020, “the exciting

did their model development work by harnessing the AI

thing about these [new GPT] models is the breadth ofsupercomputing infrastructure that Microsoft created andthings they’re going to enable.” As OpenAI and Microsoft

built exclusively for them in the datacenter complex shown

explained in 2020, machine learning experts had

16Governing AI: A Blueprint for the Future

historically built separate, smaller AI models with many

consumer applications, including those that are alreadylabeled examples to learn a single task such as translatinghousehold names. Many others will be created in-house

between languages.

by companies, governments, and nonprofits for their own

But using this type of massive supercomputing
infrastructure—and with the help of customized machinelearning acceleration software—it became possible tointernal use or by their customers. In short, a new wave of
applications powered by generative AI will soon become
part of daily life around the world.

create a single massive AI model that could learn by

Such applications access the capabilities of an AI model

examining huge amounts of data, such as billions of pages

through endpoints called APIs, or Application Programof publicly available text. As Microsoft said in the 2020

Interfaces. APIs have long been one of the most importantannouncement and as the world now recognizes in 2023,

methods of accessing core technology building blocks“this type of model can so deeply absorb the nuances ofthat our customers are not running themselves on theirlanguage, grammar, knowledge, concepts, and context

infrastructure.

that it can excel at multiple tasks: summarizing a lengthy
speech, moderating content in live gaming chats, finding
relevant passages across thousands of legal files or evengenerating code from scouring GitHub.”By way of illustration, Microsoft has created the Azure
OpenAI Service to provide API access to OpenAI models like
GPT-4. This API provides access to the model that is hosted
on Microsoft’s infrastructure. In short, this means that ourAs all this reflects, the core of what has struck some as thecustomers can harness the power of GPT-4 by building an

most surprising technological development of the decade

application of their choosing and simply calling the API to

was preannounced in plain and public view in just the third

submit prompts and receive outputs from GPT-4. Theremonth as the decade began. The good news, at least fromis no need for customers to maintain the sophisticatedthe perspective of Microsoft and OpenAI, is that we’ve been

infrastructure that is needed to run an advanced model likeable to work the past several years to strengthen safety andsecurity protocols to prepare for the more powerful AI models.
This brings one to how these large AI models
are deployed for use. Given the very substantial
computational resources required, these take place inmultiple countries in advanced datacenters with large
amounts of GPUs and advanced network connectivity,

GPT-4, and our customers benefit from Microsoft’s longstanding trust and compliance commitments, as well as thesafety systems that we have built on top of the GPT-4 as partof the Azure OpenAI service.

Creating a regulatory architecture that reflects
AI’s technology architecture

running in the case of GPT-4, on Microsoft’s Azure

It likely will make the most sense to design an AI regulatory

platform. This requires in its own right very substantialarchitecture based on the AI technology architecture

additional investments and deployment of the mostdescribed below. At least as we’ve thought about theseadvanced digital technology, but it does not require theissues in recent months, we believe that law and regulation

same highly specialized infrastructure that is needed to

can probably have their most positive impact by focusingbuild an advanced AI model in the first place.

on three layers of the tech stack, with differing obligations

The actual use of these models involves the top half of thetechnology stack. Users interact with a model like GPT-4
through an application, as shown at the top of the stack.
ChatGPT, Bing Chat, and GitHub Copilot are all examples
of such applications. Companies and organizations large
and small will no doubt create new or modify existing
applications to incorporate features and services thatharness the power of generative AI models. Many will be

at each level. The chart below illustrates this proposed
approach, with further analysis and commitments webelieve we can offer as a company to help advance theserequirements.

Applying existing legal protections at theapplications layer to the use of AI
For a great many individuals and organizations, the legal

17

Governing AI: A Blueprint for the Future

A proposed AI regulatory architecture
Applications

Ensure that the use of Al in the application complies
with all existing and evolving laws and regulations

API Services
Powerful Pre-Trained
AI ModelsRegulate through pre-release safety and security
requirements, then license deployment for permitted
uses in a licensed Al data center with post-deployment
safety and security monitoring and protection

Machine Learning
Acceleration Software
AI Datacenter
Infrastructure

License for training and deployment of powerful AI
models based on security protections, export control
compliance, and safety protocols to ensure humancontrol over autonomous systems that manage
critical infrastructure

rubber will meet the road as applications use AI to deliver

they will do just that. This will be especially relevant to theinformation and services to others. This is the layer where

many applications that are being created to use new andthe safety and rights of people will most be impacted,

more powerful AI. And this will be important for companies

especially because the impact of AI can vary markedly inand other organizations in every economic sector and indifferent settings. As a result, we will need the laws andevery country.

regulations that govern conduct and societal impact toapply to applications that use the output from AI models todeliver services to individuals and organizations.

For example, it’s unlawful for a bank to discriminate today
based on race or gender when deciding who to approvefor a mortgage. If a bank now wants to use AI to help it

We have long had a wide variety of laws in place to protect

make its lending decisions, it will need to ensure that thisthe public. In the United States, many of these laws are

does not lead to unlawful discrimination. And what’s true

grounded in long-standing societal values that go back tofor banks and mortgages is true in every field. Existing

our Constitution and the Bill of Rights. Repeatedly over thelaws will continue to apply to the decisions and actions ofpast two centuries, our courts and agencies have adaptedorganizations and individuals alike. No one is proposing a

to uphold values we regard as timeless amidst constant

new defense to illegal conduct that will enable people totechnological change. Rapid advances in AI mean they will

stand up in court and proclaim, “but Your Honor, a machineneed to do so again.

made me do it.”

The good news is that in many areas, we don’t need new

While this conclusion is simple, its consequences arelaws and regulations. We instead need to apply and enforce

profound. It means that every organization that uses AI

existing laws and regulations, and it has been encouraging

needs to master not only the technology itself but theto see several regulators around the world indicate thatability to evaluate how the technology impacts its wide-18

Governing AI: A Blueprint for the Future

ranging legal responsibilities. And courts and agencies alikeenable regulatory agencies to evaluate the use of AI. This

will need to develop new capabilities to analyze how AI wasis because models like GPT-4 and services like ChatGPT,

used in a particular system.

GitHub Copilot, and Microsoft M365 Copilot make it far

We believe that several steps can help achieve this,including those we can take as a company:

easier for people to harness the power of AI to accessdata and evaluate it more quickly. As Google rightly
recommended in a new white paper just last week, it will beFirst, we will work with our customers to help them

important for governments to “direct sectoral regulators

apply state-of-the-art best practices to deploy AI

to update existing oversight and enforcement regimes tolawfully and responsibly. One of the critical characteristics

apply to AI systems, including on how existing authorities

of AI is that the real-world impact on specific groups andapply to the use of AI.” Agencies will need the funding, staff,

issues is defined not just by the developer of an AI modeland commitment to put these new tools to work.

or system, but also in its implementation in a specificservice or application. In fact, in many circumstances it is
only at the application level that it’s possible to specifically
identify and test for these real-world impacts before AI is
deployed. As a result, responsibilities are often shared oreven distributed, with different organizations needing toplay different roles.

Third, we will support broad educational initiatives
to make information about AI technologies andresponsible AI practices available to legislators, judges,
and lawyers. Finally, rapid AI advances are creating newpressures on those who make or help enforce the law tolearn about new AI technologies and how they work. We
witnessed a similar need when the personal computer first

This helps explain why it’s so important for customers that

became popular in the 1980s. For example, judges needed

use AI in their services to develop their own capabilities toto decide cases that started to turn, in part, on evidence

do so responsibly. This also explains why it is so important

about or involving PC software and hardware.

for a leading tech company to share information andlend their expertise on state-of-the-art best practices andtooling for responsible AI deployment.

Beginning in the 1990s, Microsoft supported broad initiatives
to share information about how this new technology worked.
We continue to do this today in selected areas such as

We have been doing this type of work for two decades

electronic discovery. The accelerating use of AI means thaton other issues involving digital technology, including

new such efforts will be needed. We will support this work,

to implement legal compliance systems, advanceincluding by supporting bar associations and other public

cybersecurity, and protect privacy. We began five years ago

interest and civic groups and activities.

to do similar work relating to artificial intelligence, and wewith our customers in the year ahead.

Developing new laws and regulations for highly
capable AI foundation models

Second, we believe that regulatory agencies will need to

While existing laws and regulations can be applied andadd new AI expertise and capabilities. Very quickly, thisbuilt upon for the application layer of the tech stack, weneed will reach virtually every agency in most governments

believe that new approaches will be needed for the twoin the world. For example, an agency like the Food and Drug

additional layers beneath that reflect the new and more

Administration will need more AI experts who can help

powerful AI models that are emerging. The first of these isevaluate the use of cutting-edge AI systems by companies

for the development of the most powerful new AI models,in something like the clinical trials for new drugs. Similarly,

and the second is for the deployment and use of theseagencies like the Federal Aviation Administration will needmodels in advanced datacenters.

will expand this initiative to work more broadly and deeply

additional AI experts to help evaluate the new uses of AI byaircraft manufacturers in developing new planes.
Generative AI itself will be a powerful tool that will better

From our work on the frontiers of AI, we have seen a newclass of model emerge. Highly capable foundation models
are trained on internet-scale datasets and are effective out-19Governing AI: A Blueprint for the Future

Microsoft commitments to an AI licensing regime
Microsoft will share our specialized knowledge about advanced AI models
to help governments define the regulatory threshold
Microsoft will support governments in their efforts to define therequirements that must be met in order to obtain a license to develop
or deploy a highly capable foundation model
Microsoft will support government efforts to ensure the effective
enforcement of a licensing regime

of-the-box at new tasks—a model like GPT-4 allows you

intentioned or well-equipped to address the challenges

to create a never-seen-before image using words in one

that highly capable models present. Some actors will use AI

prompt, and a speech in the style of Franklin Roosevelt inas a weapon, not a tool, and others will underestimate thethe very next.

safety challenges that lie ahead.

At the cutting-edge, the capabilities of these foundation

Last week, Sam Altman, the CEO of OpenAI, testified before

models are at once very impressive and can be harder topredict. As the models have been scaled up, we have seen
anticipated advances in capabilities, as well as surprisingones that we and others did not predict ahead of timeand could not observe on a smaller scale. Despite rigorous
prerelease testing and engineering, we’ve sometimes only
learned about the outer bounds of model capabilities
through controlled releases with users. And the workneeded to harness the power of these models and alignthem to the law and societal values is complex andevolving.
These characteristics of highly capable models present
risk surfaces that need to be addressed. To date, we havebenefited from the high safety standards self-imposedby the U.S. developers who have been working at thefrontiers of AI model development. But we shouldn’t leave

Congress and called for the establishment of a licensing
regime for this small but important class of highly capablemodels at the frontiers of research and development.
As Microsoft, we endorse that call and support theestablishment of a new regulator to bring this licensing
regime to life and oversee its implementation.
First, we and other leading AI developers will needto share our specialized knowledge about advanced
AI models to help governments define the regulatory
threshold.
One of the initial challenges will be to define which AI
models should be subject to this level of regulation. The
objective is not to regulate the rich ecosystem of AI models
that exists today and should be supported into the future,these issues of societal importance to good judgment

but rather the small number of AI models that are veryand self-restraint alone. We need regulatory frameworks

advanced in their capabilities and in some cases, redefiningthat anticipate and get ahead of the risks. And we need to

the frontier. We refer to this small subset of models as

acknowledge the simple truth that not all actors are well-highly capable AI models in this white paper.

20

Governing AI: A Blueprint for the Future

Defining the appropriate threshold for what constitutes a

To achieve safety and security objectives, we envisionhighly capable AI model will require substantial thought,

licensing requirements such as advance notification

discussion, and work in the months ahead. The amount ofof large training runs, comprehensive risk assessments

compute used to train a model is one tractable proxy forfocused on identifying dangerous or breakthroughmodel capabilities, but we know today that it is imperfectcapabilities, extensive prerelease testing by internal andin several ways and unlikely to be durable into the future,external experts, and multiple checkpoints along the way.

especially as algorithmic improvements lead to compute

Deployments of models will need to be controlled based

efficiencies or new architectures altogether.

on the assessed level of risk and evaluations of how well-

A more durable but unquestionably more complex
proposition would be to define the capabilities that are
indicative of high ability in areas that are consequential tosafety and security, or that represent new breakthroughs

placed users, regulators, and other stakeholders are to
manage residual risks. Ongoing monitoring post-release
will be essential to ensuring that guardrails are functioning
as intended and that deployed models remain underthat we need to better understand before proceeding

human control at all times.

further. Further research and discussion are needed to

In practice, we believe that the effective enforcement of

set such a capability-based threshold, and early efforts
to define such capabilities must continue apace. In themeantime, it may be that as with many complex problems
in life, we start with the best option on offer today—asuch a regime will require us to go one layer deeper in thetech stack to the AI datacenters on which highly capable AI
models are developed and deployed.

compute-based threshold—and commit to a program of

Third, we will support government efforts to ensure

work to evolve it into a capability-based threshold in shortthe effective enforcement of a licensing regime fororder.

highly capable AI models by also imposing licensing

Second, we will support governments in their efforts todefine the requirements that must be met in order torequirements on the operators of AI datacenters thatare used for the testing or deployment of these models.

obtain a license to develop or deploy a highly capable

Today’s highly capable AI models are built on advanced

AI model.

AI datacenters. They require huge amounts of computing

A licensing regime for highly capable AI models should
be designed to fulfill three key goals. First and foremost, it
must ensure that safety and security objectives are achievedin the development and deployment of highly capable AI
models. Second, it must establish a framework for close
coordination and information flows between licensees andtheir regulator, to ensure that developments material to theachievement of safety and security objectives are shared
and acted on in a timely fashion. Third, it must provide afooting for international cooperation between countries
with shared safety and security goals, as domestic initiatives
alone will not be sufficient to secure the beneficial uses ofhighly capable AI models and guard against their misuse.
We need to proceed with an understanding that it iscurrently trivial to move model weights across borders,

power, specialized AI chips, and sophisticated infrastructureengineering, like Microsoft’s facilities in Iowa, describedabove. Such AI datacenters are therefore critical enablers oftoday’s highly capable AI models and an effective control
point in a comprehensive regulatory regime.
Much like the regulatory model for telecommunications
network operators and critical infrastructure providers, we
see a role for licensing providers of AI datacenters to ensurethat they play their role responsibly and effectively toensure the safe and secure development and deploymentof highly capable AI models. To obtain a license, an AI
datacenter operator would need to satisfy certain technicalcapabilities around cybersecurity, physical security, safetyarchitecture, and potentially export control compliance.

allowing those with access to the “crown jewels” of highly

In effect, this would start to apply for AI a principle

capable AI models to move those models from country todeveloped for banking to protect against money

country with ease.

laundering and criminal or terrorist use of financial services.

21

Governing AI: A Blueprint for the Future

The “Know Your Customer”—or KYC— principle requiresof those measures, including those that attach at thethat financial institutions verify customer identities,

infrastructure and model layers of the tech stack.

establish risk profiles, and monitor transaction to help
detect suspicious activity.

Fourth, as discussed above, the AI infrastructure operator
will have a critical role and obligation in applying safety

In a similar way, it would make sense for a similar KYC

protocols and ensuring that effective AI safety brakes

principle to require that the developers of powerful AI

are in place for AI systems that manage or control criticalmodels first “know the cloud” on which their models

infrastructure. It will be important for the infrastructure

are deployed. The use of authorized and licensed AI

operator to have the capability to intervene as a second

datacenters would ensure that those who develop

and separate layer of protection, ensuring the public that

advanced models would have several vendors fromthese AI systems remain under human control.

which to choose. And it would enable the developer ofan advanced model to build or operate their own cloudinfrastructure as well, based on meeting the requisite

These early ideas naturally will all need to be developed
further, and we know that our colleagues at OpenAI havetechnical standards and obligations.

important forthcoming contributions on these topics too.

The licensed AI datacenter operator would then need toregime will only become more important as AI models on themeet ongoing regulatory requirements, several of which

frontiers become more capable, more autonomous, and moreare worth considering.

likely to bridge the digital-physical divide. As we discussed

First, operators of AI datacenters have a special role to playin securing highly capable AI models to protect them frommalicious attacks and adversarial actors. This likely involves
not just technical and organizational measures, but also
an ongoing exchange of threat intelligence between the

What is clear to us now is that this multitiered licensing

earlier, we believe there is good reason to plan and implement
an effective licensing regime that will, among other things,
help to ensure that we maintain control over our electricity
grid and other safety-critical infrastructure when highly
capable AI models are playing a central role in their operation.

operator of the AI datacenter, the model developer, and a
regulator.
Second, in certain instances, such as for scenarios thatinvolve sensitive uses, the cloud operator on which themodel is operating should apply the second aspect of the
KYC principle – knowing the customers who are accessing
the model. More thought and discussion will be needed
to work through the details, especially when it comes todetermining who should be responsible for collecting andmaintaining specific customer data in different scenarios.

4. Promote transparency and ensure
academic and nonprofit access to AI.
One of the many AI policy issues that will require
serious discussion in the coming months and years
is the relationship and tension between security andtransparency. There are some areas, such as AI model
weights (which are components of a model that are core
to a model’s capabilities), where many experts believe that
secrecy will be essential for security. In some instances,

The operators of AI datacenters that have implemented

this may even be needed to protect critical national

know-your-customer procedures can help regulators

security and public safety interests. At the same time,

get comfortable that all appropriate licenses for model

there are many other instances where transparency will be

development and deployment have been obtained. One

important, even to advance the understanding of security

possible approach is that substantial uses of compute thatneeds and best practices. In short, in some instances

are consistent with large training runs should be reported

tension will exist and in other areas it will not.

to a regulator for further investigation.
Third, as export control measures evolve, operators of AI
datacenters could assist with the effective enforcement

Transparency as a critical ethical principle for AI
When Microsoft adopted ethical guidelines for AI in22

Governing AI: A Blueprint for the Future

Microsoft commitments to promote transparency for AI
Microsoft will release an annual transparency report to inform the public
about its policies, systems, progress, and performance in managing AI
responsibly and safely
Microsoft will support the development of a national registry of high-risk AI
systems that is open for inspection so that members of the public can learn
where and how those systems are in use
Microsoft will commit that it will continue to ensure that our AI systems aredesigned to inform the public when they are interacting with an AI systemand that the system’s capabilities and limitations are communicated clearly
We believe there is benefit in requiring AI generated content to be labeled inimportant scenarios so that the public “knows the content” it is receiving

2018, we made transparency one of our six foundational

have a role to play in the responsible AI context too,principles. As we’ve implemented that principle, we’veand so we will release an annual transparency report tolearned that it’s important to provide different types of

inform the public about our policies, systems, progress,

transparency in different circumstances, including making

and performance in managing AI responsibly and safely. Ifsure that people are aware that they are interacting withadopted across the industry, transparency reports would be

an AI system. Generative AI makes this principle more

a helpful mechanism for recording the maturing practice ofimportant than in the past, and it’s an area where ongoing
research and innovation will be critical. To help spur newwork in this area, Microsoft is making three commitments
to the White House.
First, Microsoft will release an annual transparency
report to inform the public about its policies, systems,
progress, and performance in managing AI responsibly
and safely.
Transparency reports have proven to be an effective
measure to drive corporate accountability and help the
public better understand the state-of-the-art and progress
toward goals. Microsoft believes transparency reports

responsible AI and charting cross-industry progress.
Second, Microsoft will support the development of anational registry of high-risk AI systems that is open
for inspection so that members of the public can learn
where and how those systems are in use.
Public trust in AI systems can be enhanced by demystifying
where and how they are in use. For high-risk AI systems,
Microsoft supports the development of a national registry thatwould allow members of the public to review an overview ofthe system as deployed and the measures taken to ensure thesafe and rights-respecting performance of the system.
For this information to be useful to the public, it should be23

Governing AI: A Blueprint for the Future

expressed at the system level, providing details about thebenefit from thoughtful measures to deter the use of newcontext of use, and be written for nontechnical audiences.

technology to deceive or defraud the public.

To achieve this, the United States could implement theapproach of several European cities in adopting the
Algorithmic Transparency Standard and developing
accessible explanations of how it uses AI (see, for example,
the City of Amsterdam’s Algorithm Register).
Third, Microsoft will commit that it will continue toensure that our AI systems are designed to inform thepublic when they are interacting with an AI systemand that the system’s capabilities and limitations arecommunicated clearly.
We believe that transparency is important not only throughbroad reports and registries, but in specific scenariosand for the users of specific AI systems. Microsoft will

Access to AI resources for academic research andthe nonprofit community
We believe there is another element that adds totransparency and that deserves more prominent attention.
This is the need to provide broad access to AI resources foracademic research and the nonprofit community.
The high cost of computational resources for the trainingof large-scale AI models, as well as other AI projects, isunderstandably raising concerns in the higher educationand nonprofit communities. We understand this issue wellbecause Microsoft’s large technology investment in OpenAI
in 2019 originated from precisely this need for OpenAI

continue to build AI systems designed to support informed

itself, due in part to its nonprofit status.

decision making by the people who use them. We take

Basic research, perhaps especially at universities, hasa holistic approach to transparency, which includes not
only user interface features that inform people that they
are interacting with an AI system, but also educational
materials, such as the new Bing primer, and detailed
documentation of a system’s capabilities and limitations,such as the Azure OpenAI Service Transparency Note. This
documentation and experience design elements are meant
to help people understand an AI system’s intended uses
and make informed decisions about their own use.
Fourth, we believe there is benefit in requiring AIgenerated content to be labeled in important scenarios
so that the public “knows the content” it is receiving.
This is the third part of the KY3C approach we believe
is worth considering. As we are committing above forMicrosoft’s services Bing Image Creator and Designer, we
believe the public deserves to “know the content” that AIis creating, informing people when something like a video
or audio has been originally produced by an AI model

been of fundamental importance to the economic andstrategic success of the United States since the 1940s. Muchof the tech sector itself owes both its birth and ongoing
innovation to critical basic research pursued in colleges
and universities across the country. It’s a success story thathas been studied and emulated in many other countries
around the world. The past few decades have seen hugeswaths of basic research in almost every field propelled
by growing computing resources and data science. Unlessacademic researchers can obtain access to substantiallymore computing resources, there is a real risk that scientificinquiry and technological innovation will suffer.
Another dimension of this problem is also important.
Academic researchers help ensure accountability to the
public by advancing our understanding of AI. The public
needs academics to pursue research in this area, including
research that advances AI accountability by analyzing the
behavior of the models the commercial sector is creating.

rather than a human being. This labeling obligation should

While new and smaller open-source AI models are emerging

also inform people when certain categories of original

and clearly are important, other basic research projects

content have been altered using AI, helping protect against

involving AI will almost certainly require more computational

the development and distribution of “deep fakes.” Thispower than in the past. And unless new funding sources

will require the development of new laws, and there will

come together to provide a more centralized resource for the

be many important questions and details to address. But

academic community, academic research will be at risk. This

the health of democracy and future of civic discourse will

has led us to offer two focused commitments:24Governing AI: A Blueprint for the FutureFirst, Microsoft will support the establishment ofSecond, we will increase investment in academic

the newly proposed National AI Research Resource

research programs to ensure researchers outside(NAIRR) to provide computing resources for

Microsoft can access the company’s foundation models

academic research and would welcome and support

and the Azure OpenAI Service to undertake research

an extension to accommodate access by academic

and validate findings.

institutions in allied nations abroad, including Japan,
the United Kingdom, the European Union, and otherlike-minded countries.

This expanded commitment builds on the success of ourTuring Academic Program and Accelerating Foundation
Models Research Program. It is designed to help the

The National AI Research Resource has its origins in theacademic community gain API-based access to cutting-National Initiative AI Act of 2020, passed by Congress.

edge foundation models from Microsoft, as well as OpenAI

The Act called on the National Science Foundation, inmodels via Microsoft’s Azure OpenAI Service. This willconsultation with the White House Office of Science

ensure that researchers can study frontier applications andand Technology Policy, to create a task force to create athe sociotechnical implications of these models. Microsoft

roadmap for “a shared research infrastructure that would

will ensure that its program design accommodates

provide AI researchers and students with significantly

API-based access by a diverse community of academic

expanded access to computational resources, high-quality

researchers, including researchers at Minority Serving

data, educational tools, and user support.” This January,

Institutions across the United States.

the Task Force completed its work, publishing a final reportcalling for the creation and funding of a federated mixof computational and data resources, testbeds, software,and testing tools, based on a platform that can reduce thebarriers to participation in the AI research ecosystem andincrease the diversity of AI researchers.

An important complement to providing such access isthe development of governance best practices for theacademic community engaged in frontier research on
applications and the safety and security implications ofhighly capable models. Microsoft would welcome theopportunity to develop such practices by supporting andMicrosoft supports the establishment of the National AI

collaborating with a multistakeholder group, including

Research Resource and believes it to be of fundamental

representatives across the academic community.

importance to the United States’ leadership in AI
innovation and risk mitigation. We will collaborate with
the National Science Foundation to explore participation

Third, Microsoft will create free and low-cost AI
resources for use by the nonprofit community.

in a pilot project to inform efforts to stand up the

Finally, we deeply appreciate the critical role that nonprofit

National AI Research Resource, including by facilitatingorganizations play in addressing societal needs around the

independent academic research relating to the safety ofworld. Given their role as great incubators of innovative

AI systems.

solutions, we believe it is critical for nonprofits to have

We also would welcome and support an extension of
the NAIRR to provide access by academic institutions inlike-minded nations. Already we’re seeing similar andsubstantial interest in these other countries. For example,
Japan’s recent “National Strategy in the New Era of AI” calls
for work to expand the computing resources for public
and private use. We believe that a multilateral AI researchbroad, easy, and inexpensive access to new AI models andfeatures for their work. Microsoft Philanthropies, including
its Tech for Social Responsibility arm, supports 350,000
nonprofits in the Microsoft Cloud. It provides more than
$4 billion annually in cash and technology donations anddiscounts to nonprofits worldwide, a figure comparable toone of the 10 largest government foreign aid budgets.

resource would accelerate existing efforts to establish

Last week we expanded this support by announcing

global norms and interoperable approaches to risk

AI solutions to Microsoft Cloud for Nonprofit. These AI

mitigation, including those underway in the U.S.-EU Trade

solutions are designed to improve the ability of nonprofit

and Technology Council and the G7.

organizations to optimize operations, engage with donors,

25

Governing AI: A Blueprint for the Future

and manage campaigns. This is the first of several steps webegan when the Russian military unleashed waves ofwill take to reduce technical and cost barriers and enablecyberattacks on Ukraine on February 23, 2022. As we noted

nonprofits to harness the latest advances in AI.

last year, this reflected an age-old lesson from history:
countries wage wars using the latest technology, and the

5. Pursue new public-private
partnerships to use AI as an effective
tool to address the inevitable societal
challenges that come with newtechnology.
Finally, we believe there is enormous opportunity to bring
the public and private sectors together to use AI as a tool toimprove the world, including by countering the challenges
that technological change inevitably creates. We are cleareyed about the future and realize that some will seek to use
AI as a weapon rather than a tool. And even when peopleof goodwill do their best, technological change inevitably
creates unforeseen bumps in the road ahead.

wars themselves accelerate technological change.
But the role of technology in the war in Ukraine hasbrought a new dimension to the defense not only of
Ukraine, but of democracy itself. The war has required a
new form of collective defense. It has pitted Russia, a major
cyberpower, not just against an alliance of countries, butalso against a coalition of tech companies and NGOs.
Across the tech sector, companies have stepped up to
support Ukraine’s remarkable tenacity and innovation.
Individual and collective technology measures havesustained Ukraine’s digital operations, defeatedcyberattacks, documented war crimes, and enabledstudents to stay in school even when their schools aredamaged or destroyed. Microsoft has now provided $450

But we’ve also learned from numerous efforts over the

million of financial and technology assistance to Ukraine,

years what democratic societies can accomplish when they

an amount that is unprecedented in the company’s history.

harness the power of technology and bring the public andprivate sectors together. Two examples are perhaps themost profound.

The lessons from the Christchurch Call and the war in
Ukraine should guide us on the role of AI in the future.
One key is to focus on specific problems that can benefit

The first is the Christchurch Call, born from the tragic

from new initiatives and concrete action. Another is toterrorist tragedy that took place in Christchurch, New

bring governments, companies, and NGOs together on

Zealand, on March 15, 2019. The attack claimed the lives ofan international basis not only to move faster, but to

51 innocent Muslims at two mosques and was livestreamed

accomplish more than any single organization or evenworldwide. The internet provided a stage not only tocountry can achieve on its own. Microsoft is committed tobroadcast the attack but perhaps provided an incentive topursuing and supporting similar initiatives in the months

pursue the assault in the first place.

ahead.

New Zealand Prime Minister Jacinda Ardern vowed that

In recent years, there has been a growing focus on

the world would learn from the attack and take steps

addressing the new risks to democracy and the public

to prevent technology from being used this way again.

from the potential weaponization of AI to alter content

Partnering with French President Emmanuel Macron,and create “deep fakes,” including videos. The concern

she brought leading tech companies together to pursue

about future technology is well-placed (although we areconcrete steps to prevent the livestreaming and internet

concerned that countries are doing too little to address

distribution of similar violent attacks in the future. Exactly

foreign cyber influence operations that are prolific andtwo months after the attack, on May 15, 2019, government

impactful already). In short, we will all need to do more

and tech leaders met at the Elysée in Paris to sign thecollectively to combat this type of threat.

Christchurch Call and commited to collective action thathas continued in the four years that have followed.
This work provided inspiration for the larger assault that

As we do so, it will be important to start with importantbuilding blocks that exist already. One of the mostimportant is the Coalition for Content Provenance and26

Governing AI: A Blueprint for the Future

Authenticity, or C2PA. Co-founded by companies suchthat a piece of content was generated by AI. The service

as Adobe, the BBC, Intel, Microsoft, Sony, and Truepic,

implements the C2PA specification. Microsoft will initially

C2PA unifies the efforts of the Adobe-led Content

support major image and video formats and release theAuthenticity Initiative (CAI), which focuses on systems toservice for use with two of Microsoft’s new AI products,

provide context and history for digital media, and Project

Microsoft Designer and Bing Image Creator.

Origin, a Microsoft- and BBC-led initiative that tackles
disinformation in the digital news ecosystem.

This is an important step, but just a single one. Fortunately,

As Microsoft’s Chief Scientific Officer, Eric Horvitz, saidmeasures. We will need the right combination of focusedlast year, success will require “a multi-pronged approach,including education aimed at media literacy, awareness,and vigilance, [with] investments in quality journalism.”
There will be opportunities in the coming months to take
important steps together.
This week, Microsoft will deploy new state-of-the-art
provenance tools to help the public identify AI-generated
audio-visual content and understand its origin. At Build,
our annual developer conference, we are announcing thedevelopment of a new media provenance service. The

many others are moving forward with similar and criticalsteps and broader initiatives.
Perhaps more than anything, a wave of new AI technology
provides an occasion for thinking big and acting boldly.
Important work is needed to use AI to protect democracy
and fundamental rights, provide broad access to the AI
skills that will promote inclusive growth, and use the powerof AI to advance the planet’s sustainability needs. In eacharea, the key to success will be to bring governments,
respected companies, and energetic NGOs together.

service will mark and sign AI-generated videos and images

There will be no shortage of opportunities or challenges.

with metadata about their origin, enabling users to verify

We need to seize the moment.

27

Governing AI: A Blueprint for the Future02
Responsible by Design:
Microsoft’s Approach to Building
AI Systems that Benefit Society28

Governing AI: A Blueprint for the Future

Responsible by Design: Microsoft’s Approach
to Building AI Systems that Benefit Society

Microsoft’s commitment to developing AI
responsibly

We deepened our efforts in 2019 by establishing the Office of

For the past seven years, we have worked to advancefirst version of the Responsible AI Standard, a framework for

responsible AI—artificial intelligence that is grounded in

Responsible AI. This team coordinates the governance of ourprogram, and collaborated across the company to write thetranslating high-level principles into actionable guidance forstrong ethical principles. We have approached our work

engineering teams building AI systems.

with a humble recognition that trust is not given but
earned through action, and a deep understanding of our

In 2021, we spoke publicly about the key building blocks

responsibility not just to Microsoft but our communitythat we had put in place to operationalize our program. We

more broadly. This has led us to be focused both onenvisioned expanding training, processes, and tools to help

meeting our own commitments, and helping our customers

us to implement and scale our responsible AI efforts. 2022

and partners do the same.

brought a new iteration of our Responsible AI Standard,
evolving it into the version we use today, which we have

Our responsible AI journey began in 2016 with Satya
Nadella, Microsoft’s Chairman and CEO, sharing his visionof humanity empowered by AI. Satya expressed thealso made publicly available. It sets out how Microsoft
will build AI systems using practical methods to identify,
measure, and mitigate potential risks ahead of time. This

beginnings of our core AI principles—values that endure

responsible-by-design approach establishes repeatable

today. Building on this vision, we launched Microsoft’s

processes to minimize potential harms and magnify the

Aether Committee, comprised of researchers, engineers,and policy experts who provide subject matter expertise on

benefits of AI from the outset.

the state-of-the-art and emerging trends with respect to

We are proud of our progress over the last seven years.

our AI principles. This led to the creation and adoption ofThose efforts have brought us to where we are today—

our AI principles in 2018.

deepening our commitment to embed safety and

Our Responsible AI Journey

Satya Nadella’s
Slate article

2016

Aether committee
established

2017

2018

Responsible AI
Dashboard

Office of Responsible
AI established

2019

AI principles
adopted2021

Responsible AI
Standard2022

29

Governing AI: A Blueprint for the Future

Responsible AI Governance Framework

Auditing
Implementation
Training | Tools | Testing

Monitoring

RAI Policies and Standard

Compliance

RAI Principles

Reportingresponsibility into the lifecycle of our AI systems. This isleadership. Chairman and CEO Satya Nadella and the entire

possible only when responsible AI principles and practices

senior leadership team at Microsoft have made responsible

transcend traditional silos and multidisciplinary teams work

AI a company-wide mandate.

together. With the opportunity and the potential risks at
hand, we believe we must share what we have learned andhelp all organizations apply responsible AI practices to theirwork. That is precisely what we at Microsoft are doing, andwe hope to lead by example.

Microsoft’s leadership recognized that a single team ordiscipline tasked with responsible AI would not be enough.
Taking lessons from long-standing, cross-company
commitments to privacy, security, and accessibility,
we realized that responsible AI must be supported by
the highest levels of leadership in the company andOperationalizing Responsible AI at
Microsoft
Setting foundational governance structures

championed at every level across Microsoft.
To that end, Microsoft’s Office of Responsible AI developed
a governance system that incorporates many diverse teams
and functions across the company. At the working level,

As the pace of AI continues to advance, we continue tocore teams within engineering, research, and policy play

evolve the governance structure we established to enable

critical roles to advance responsible AI across the company,

progress and accountability as a foundational piece ofeach bringing a set of unique skills. Responsible AI roles

our responsible AI program. The creation of Microsoft’s

are also embedded within product, engineering, and sales

governance structure—as well as the decision to scaleteams by the appointment of “Responsible AI Champions”

responsible AI across the company—was driven by

by leadership. Our Responsible AI Champions are tasked30

Governing AI: A Blueprint for the Future

Our ecosystem
Microsoft Board

Executive LeadershipResponsible AI Council

Office of Responsible AI

Research

PolicyEngineeringwith spearheading responsible AI practices within theirwell as engineering leaders and senior business partners who

respective teams, which means adopting the Responsible

are accountable for implementation.

AI Standard, issue spotting and directly advising teams
on potential mitigations, and cultivating a culture of
responsible innovation. The Office of Responsible AI helps
to orchestrate these teams across the company, drawing on
their deep product knowledge and responsible AI expertise
to develop a consistent approach across Microsoft.
At the next level, the Responsible AI Council is a forum forleadership alignment and accountability in implementing
Microsoft’s responsible AI program. The Council is chaired

At the highest level, the Environmental, Social, andPublic Policy Committee of the Microsoft Board provides
oversight of our responsible AI program. Our regular
engagements with the Committee ensure the full rigor
of Microsoft’s enterprise risk management framework is
applied to our program.

The need for standardization

by Microsoft’s Vice Chair and President, Brad Smith, and ourFrom crafting an AI system’s purpose to designing how

Chief Technology Officer, Kevin Scott, who sets the company’s

people interact with it, we must keep people at the centertechnology vision and oversees our Microsoft Researchof all AI decisions. While our responsible AI principles state

division. The Responsible AI Council convenes regularly, andthe enduring values we seek to uphold, we needed morebrings together representatives of our core research, policy,

specific guidance on how to build and deploy AI systems

and engineering teams dedicated to responsible AI, including

responsibly. This is why we developed our Responsible

the Aether Committee and the Office of Responsible AI, as

AI Standard, a more practical guide that memorializes a31

Governing AI: A Blueprint for the Future

set of rules of the road for our engineering teams so that
upholding our AI principles is a daily practice.
The Responsible AI Standard provides engineering teams
with actionable guidance on how to build AI systems
responsibly. It was the result of a multi-year, cross-company
effort that reflected a vast array of input from researchers,
engineers, lawyers, designers, and policy experts. We
consider it to be a significant step forward for our practiceof responsible AI because it sets out much more concrete,
practical guidance on how to identify, measure, andmitigate harms ahead of time. It also requires teams to
adopt tools and controls to secure beneficial uses while
guarding against potential misuses of their products.
There are two ways in which the Standard offers concrete

Red teaming AI systems
The term red teaming has historically described systematic
adversarial attacks for testing security vulnerabilities. With
the rise of large language models (LLMs), the term has
extended beyond traditional cybersecurity and evolved incommon usage to describe many kinds of probing, testing,and attacking of AI systems. With LLMs, both benign andadversarial usage can produce potentially harmful outputs,
which can take many forms, including harmful content suchas hate speech, incitement or glorification of violence, or
sexual content.
Red teaming is an essential practice in the responsible
development of systems and features using LLMs. Red

direction to our engineering teams working across an AI

teamers help to uncover and identify harms and, in turn,product’s lifecycle:

enable measurement strategies to validate the effectiveness•

Articulating goals. These define what it means toof mitigations.

uphold the responsible AI principles. They break down

Microsoft has conducted red teaming exercises anda broad principle like accountability into definitive

implemented safety systems for its Azure OpenAI Service

outcomes, such as ensuring AI systems are subject tomodels and applications of these models in consumer

impact assessments, data governance, and human

products, such as Bing chat.

oversight.

The Anatomy of the Responsible AI Standard
Principles
Goals

Which enduring values guide our responsible AI work?
What are the outcomes that we need to secure?

Requirements
Tools and practices

What are the steps we must take to secure the goals?
Which aids can help us meet the requirements?

32

Governing AI: A Blueprint for the Future•

Outlining a playbook. These specific procedures
and steps are required of teams throughout an AI
system’s lifecycle in order to achieve the goals set in our

Responsible AI Standard in action:
fairness in speech-to-text

Responsible AI Standard. The steps map to available

Speech-to-text technology can improve individuals’ lives,

resources, tools, and practices to equip teams to makefrom sending hands-free texts to helping people withthese goals a reality. For example, one of our Responsible

hearing loss communicate. Yet an academic study revealed

AI Standard goals is to minimize the time to remediatethat this technology produced nearly double the error

predictable or known failures of an AI system, and torates for members of some Black and African American

secure that goal, we ask teams to identify potential

communities than for white users.

harms through iterative red teaming. We then ask
teams to measure the prevalence of those harms andmitigate them by testing and implementing various
tools and established strategies. This cycle of identifying,measuring, and mitigating potential harms of an AI
system underpins many of the requirements in the
Responsible AI Standard.

Ensuring checks and balances
When building and updating the Responsible AI Standard,
we recognized early on that it is impossible to reduce all thecomplex sociotechnical considerations—for many different
use cases—into an exhaustive set of pre-defined rules. This led
us to create a program and process for ongoing review andoversight of high-impact cases and rising issues and questions,which we call Sensitive Uses.

These results spurred us to take a closer look at the AI
systems that power Microsoft speech-to-text technologies,
to ensure they had been sufficiently trained on the richdiversity of speech patterns. We turned to an expert
sociolinguist and expanded our data collection efforts tonarrow the performance gap in our solutions. During theprocess, we involved stakeholders from outside Microsoft,
such as experts and people from diverse communities.
These lessons were invaluable, and we’ve sinceincorporated them into the Responsible AI Standard tofurther articulate specific steps teams must take to ensure
Microsoft AI systems are designed to provide a similar
quality of service for identified demographic groups,
including marginalized groups, to help us and otherorganizations harness the benefits of these technologies
and avoid potential harms in the future.

Our Sensitive Uses program provides an additional layer ofoversight for teams working on higher-risk use cases of ourAI systems. The program began under the Aether Committee
in 2018 and has operated out of the Office of Responsible AI

1.

life opportunities;

since that office’s inception in 2019. From July 2019 to May
2023, we have processed over 600 Sensitive Use case reviews
from across Microsoft, including almost 150 cases during the2.

and guidance framework: it starts with a mandatory reporting

Present the risk of significant physical or psychologicalinjury; or

period July 2022 to May 2023.
Think of the Sensitive Uses program as a reporting, review,

Have a consequential impact on a user’s legal status or

3.

Restrict, infringe upon, or undermine the ability to realize
an individual’s human rights.

requirement, which then begins a hands-on responsible

Once reported, the Office of Responsible AI’s Sensitive Uses

AI project review and consulting process with the Office ofteam engages to triage and begin the review process with

Responsible AI’s Sensitive Uses team. It culminates in project-members of the project team, their Responsible AI Champion,

specific guidance and requirements that are additional to theand other relevant stakeholders. To help structure the

Responsible AI Standard’s baseline requirements. The Sensitive

review and drill into issues, we use not only artifacts such as

Uses review process is triggered when Microsoft personnel

the team’s Responsible AI Impact Assessment and productare involved in developing or deploying an AI system and the

documentation, but also close, ongoing interactions with

foreseeable use or misuse of that AI system could:

the project team itself. During the review process, we also33

Governing AI: A Blueprint for the Futureoften call on subject matter experts from across Microsoft
through focused consultations. For particularly high-impact ornovel-use cases, we elevate the project for review and advice

Sensitive Uses review in action:
Azure Custom Neural Voicefrom our Sensitive Uses Panel, which is a group of Microsoft

Azure AI’s Custom Neural Voice is an innovative Microsoft

experts spanning engineering, research, human rights, policy,

speech technology that enables the creation of a synthetic

legal, and customer-facing organizations from around thevoice that sounds nearly identical to the original source.

world. Our Sensitive Uses team is also multidisciplinary bydesign—its members have backgrounds in social sciences, law,engineering, and policy, and prior professional experiences asdata scientists, academic researchers, policy analysts, lawyers,international diplomats, and machine learning engineers.
At the conclusion of its review, the Sensitive Uses team issues
its requirements for the project to move forward. Again, these
are additional requirements that go beyond our Responsible
AI Standard and are tailored to the specific project at hand.
We have even declined opportunities to build and deploy
specific AI applications as a result of a Sensitive Uses review
because we concluded that the projects were not sufficientlyaligned with our Responsible AI Standard and principles.
For example, Microsoft Vice Chair and President Brad Smith
has spoken publicly about how, through our Sensitive
Uses review process, we determined that a local California
police department’s real-time use of facial recognition on
body-worn cameras and dash cams in patrol scenarios waspremature, and he shared the fact that we turned down
the deal. In addition to navigating the technical challenges
presented by facial recognition operating in an uncontrolledenvironment, our Sensitive Uses review process helped us toform the view that there needed to be a societal conversation
around the use of facial recognition and that laws needed tobe established.

This technology has already been used by enterprisecustomers such as AT&T and Progressive; it also shows
potential in education, accessibility, and entertainment. Yet
one can imagine possible abuses, such as inappropriately
impersonating speakers and deceiving listeners.
Consistent with our measured approach for higher-risk
AI systems, Custom Neural Voice has undergone several
Sensitive Use reviews as it has evolved and progressed tobroader availability. The review led us to adopt a layered
control framework for Custom Neural Voice. For example,
we limited customer access to the service, ensured
acceptable use cases were defined and communicatedthrough an application form, implemented speakerconsent mechanisms, created specific terms of use,
published transparency documentation detailing risks andlimitations, and established technical guardrails to help
ensure the speaker’s active participation when creating a
synthetic voice.
Through these and other controls, we are helping protect
against misuse while maintaining beneficial uses of thetechnology. One such beneficial use includes what is known
as “voice banking.” Custom Neural Voice allows people whoare at risk of losing their voice to “bank” their voice for lateruse, or in other words, recreate their voice by training a
synthetic voice model through Custom Neural Voice.

Another important outcome of the Sensitive Uses process
was our Limited Access policy for more sensitive AI
on the use and deployment of those services. Under

Case study: Applying our Responsible AI
approach to the new Bing

this policy, we not only implement technical controls to

In February 2023, Microsoft launched the new Bing, an

platform services, which adds an extra layer of scrutiny

mitigate risks, but also require potential customers to

AI-enhanced web search experience. It supports users

submit an application for use, disclose their intended use

by summarizing web search results and providing a chatso that it meets one of our predefined acceptable use cases,

experience. Users can also generate creative content, such as

and acknowledge that they have reviewed and agree to thepoems, jokes, letters, and, with Bing Image Creator, images.

terms of service. Only applications for uses that align with

The new AI-enhanced Bing runs on a variety of advanced

our responsible AI principles are approved.

technologies from Microsoft and OpenAI, including GPT-4,

34

Governing AI: A Blueprint for the Future

a cutting-edge large language model (LLM) from OpenAI.
Responsible AI teams across Microsoft worked with GPT-4
for months prior to its public release by OpenAI to develop
a customized set of capabilities and techniques to join thiscutting-edge AI technology and web search in the new Bing.

MeasureRed teaming can surface instances of specific harms, but
in production, users will have millions of different kinds ofconversations with the new Bing. Moreover, conversations are
multi-turn and contextual, and identifying harmful responses

In preparing for the launch, Microsoft harnessed the fullwithin a conversation is a complex task. To better understandpower of our responsible AI ecosystem. The new Bingand address the potential for harms in the new Bing AI

experience has been developed in line with Microsoft’s

experiences, we developed additional responsible AI metrics

AI Principles, Microsoft’s Responsible AI Standard, and inspecific to those new AI experiences for measuring potential

partnership with responsible AI experts across the company,

harms like jailbreaks, harmful content, and ungrounded

including Microsoft’s Office of Responsible AI, our engineeringcontent. We also enabled measurement at scale throughteams, Microsoft Research, and our Aether Committee.

partially automated measurement pipelines.

Guided by our AI Principles and our Responsible AI Standard,

Our measurement pipelines enable us to rapidly perform

we sought to identify, measure, and mitigate potential harms

measurement for potential harms at scale, testing eachand misuse of the new Bing while securing the transformativechange before putting it into production. As we identify

and beneficial uses that the new experience provides. In the

new issues through the preview period and beyond, as

sections below, we describe our approach.

Identify
At the model level, our work began with exploratory
analyses of GPT-4 in the late summer of 2022. This included
conducting extensive red teaming in collaboration withwell as ongoing red teaming, we continue to expand themeasurement sets to assess additional harms.

Mitigate
As we identified and measured potential harms and misuse,
we developed additional mitigations to those used for

OpenAI. This testing was designed to assess how the latest

traditional search. Some of those include:

technology would work without any additional safeguards•

applied to it. Our specific intention was to produce harmful

Preview period, phased release. Our incremental
release strategy has been a core part of how we move

responses (responses are outputs from the AI system—in

our technology safely from the labs into the world, andthis case, a large language model—and may also be

we’re committed to a deliberate, thoughtful process

referred to as “completions,” “generations,” and “answers”),

to secure the benefits of the new Bing. Limiting theto surface potential avenues for misuse, and to identify

number of people with access during the preview period

capabilities and limitations. Our combined learnings

allowed us to discover how people use the new Bing,

advanced OpenAI’s model development, informed our

including how people may misuse it, before broader

understanding of risks, and contributed to early mitigation

release. We continue to make changes to the new Bing

strategies for the new Bing.

daily to improve product performance, improve existing
mitigations, and implement new mitigations in response

In addition to model-level red teaming, a multidisciplinary

to our learnings.

team of experts conducted numerous rounds of applicationlevel red teaming on the new Bing AI experiences before•

AI-based classifiers and metaprompting tomaking them available in our limited release preview. This

mitigate harms or misuse. The use of LLMs may

process helped us better understand how the system could be

produce problematic content that could lead to harms

exploited by adversarial actors and improve our mitigations.

or misuse. Classifiers and metaprompting are two

Non-adversarial testers also extensively evaluated new Bing

examples of mitigations that have been implemented

features for shortcomings and vulnerabilities.

in the new Bing to help reduce the risk of these types

35

Governing AI: A Blueprint for the Futureof content. Classifiers classify text to flag different

Our approach to identifying, measuring, and mitigating

types of potentially harmful content in search queries,

harms will continue to evolve as we learn more—and as wechat prompts, or generated responses. Flags lead tomake improvements based on feedback gathered during thepotential mitigations, such as not returning generated

preview period and beyond.

content to the user, diverting the user to a different
topic, or redirecting the user to traditional search.
Metaprompting involves giving instructions to
the model to guide its behavior. For example, theWe share more details about our responsible AI work for the
new Bing, including our efforts on privacy, digital safety, andtransparency, at https://aka.ms/ResponsibleAI-NewBing.

metaprompt may include a line such as “communicate in
the user’s language of choice.”•

Grounding in search results. The new Bing isdesigned to provide responses supported by the
information in web search results when users areseeking information. For example, the system isprovided with text from the top search results andinstructions via the metaprompt to ground its

Advancing Responsible AI throughcompany culture
Procedures and standards are a critical part of operationalizing
responsible AI and helps us build a culture committed to theprinciples and actions of responsible AI. These complementary
approaches help us turn our commitments into reality.

response. However, in summarizing content from

Our people are the core of Microsoft culture. Every individual

the web, the new Bing may include information incontributes to our mission and goals. To deepen our culture

its response that is not present in its input sources. Inof advancing responsible AI, we invest in talent focused on AI

other words, it may produce ungrounded results. We

and embed ownership of responsible AI in every role.

have taken several measures to mitigate the risk thatusers may over-rely on ungrounded generated content
in summarization scenarios and chat experiences. For
example, responses in the new Bing that are based on
search results include references to the source websites
for users to verify the response and learn more. Users
are also provided with explicit notice that that they areinteracting with an AI system and are advised to checkthe web result source materials to help them use theirbest judgement.
••

Limiting conversational drift. During the preview

Investing in talentOver the years, we have invested significantly in people as partof our commitment to responsible AI. We now have nearly
350 employees working on responsible AI, with more thana third of those dedicated to it full-time. These staff work inpolicy, engineering, research, sales, and other core functions,weaving responsible AI into all aspects of our business.
We ask teams who develop and use AI systems to look attechnology through a sociotechnical lens. This means weperiod, we learned that very long chat sessions canconsider the complex cultural, political, and societal factors of

result in responses that are repetitive, unhelpful, or

AI as they show up in different deployment contexts—and it

inconsistent with new Bing’s intended tone. To address

represents a fundamental shift in the conventional approach

this conversational drift, we limited the number of turns

to computer science. While the training and practices we have(exchanges which contain both a user question and adeveloped help teams foresee the beneficial and potentially

reply from Bing) per chat session, until we could update

harmful impacts of AI at the individual, societal, and global

the system to better mitigate the issue.

levels, this is not enough. Teams developing AI systems and

AI disclosure. The new Bing provides several
touchpoints for meaningful AI disclosure, whereusers are notified that they are interacting with an AI

the leadership to whom they answer could still have blind
spots. That is why diversity and inclusion are critical to our
responsible AI commitment.

system as well as about opportunities to learn more

The case for investing in a diverse workforce and an inclusive

about the new Bing.

culture is well established, yet it is hard to overstate the36Governing AI: A Blueprint for the Future

importance of diversity and inclusion for responsible AI.
That is why our ongoing and increasing investment in our
responsible AI ecosystem includes hiring new and diverse

Working toward a global, inclusive
future for AI

talent. As our annual Diversity and Inclusion Report shows,

The creation of AI systems and regulatory discussions

Microsoft continues to make incremental progress on diversity

around AI tend to be centered in advanced economies. Yet

and inclusion. Yet, as an industry, we still have a long way tothe responsible development and use of AI must reflect

go. The field of AI continues to be predominantly white anda diversity of global perspectives, including voices frommale: only about one-quarter of employees working on AI

developing countries.

solutions identify as women or racial or ethnic minorities,
according to McKinsey’s 2022 Global Survey on AI.

At Microsoft, we strive to include developing countries in
our advocacy for a globally coherent AI policy framework

We will continue to champion diversity and inclusion at

and globally relevant responsible AI practices. We are eager

all levels, especially within our responsible AI program. To

to share two examples of this commitment.

build AI systems that serve society as broadly as possible,
we must recruit and retain a diverse, dynamic, and engaged•

and Telefónica are co-chairing the effort to promote

employee community.

the adoption of UNESCO’s Recommendation on the
Ethics of Artificial Intelligence in Ibero-America. This

Embedding ownership of responsible AI in everyrole
We believe that everyone at Microsoft has the opportunity
and responsibility to contribute to AI systems that live up

UNESCO Ibero-American Business Council: Microsoft

represents the first globally coherent policy framework
signed by all 193 UNESCO member states.
•

Responsible AI fellowship program: This program
brings together representatives from civil society,to our responsible AI commitments. All employees, in every

academia, and private and public sectors fromrole, bring something to this work through their diverse skills,

developing countries. Launched by Microsoft andperspectives, and passions. This shift in perspective—that

Stimson Center’s Strategic Foresight Hub, it aims to

no matter your job title or team, everyone can advanceadvance the responsible development and use of AI.

responsible AI—requires a shift in culture.

Fellows will contribute to a discussion series covering

To support this cultural growth, we have invested inemerging best practices and the multifaceted impacts

developing employee skills and fostering collaboration.

of AI in developing countries.

Developing knowledge and skills
We have developed training and practices to empower our•teams to think broadly about the potential impact of AI
systems on individuals and society.
For example, when teams are at the earliest stages of

Articulating potential harms and benefits that may affecteach stakeholder; and•Describing preliminary mitigations for potential harms.

designing an AI system, our Impact Assessment guides

To help teams conduct their Impact Assessment, the Officethem through:of Responsible AI has developed on-demand training, inperson workshops, and supporting guidance documents with•

Articulating the intended use(s) of the AI system;•

Interrogating how the AI system will solve the problem it

to share best practices, our Impact Assessment template andis intended to solve;

guidance document are publicly available.

Identifying impacted stakeholders (and not justIn our broader responsible AI training courses available to

Microsoft’s immediate customer);all Microsoft employees, we orient employees to Microsoft’s•

examples and prompt questions. As part of our commitment

37

Governing AI: A Blueprint for the Future

Responsible AI built into Azure Machine Learning

Fairness

Explainability

Counterfactuals

Prompt FlowAssess fairness andmitigate fairness issues tobuild models for everyone.

Understand model
predictions by generating
feature importance values
for your model.

Observe feature
perturbations and findthe closest datapoints
with different model
predictions.

Create workflows forlarge language-based
applications to simplify
prompt building,evaluation, and tuning.

Causal analysis

Error analysis

Responsible AI scorecard

Azure Content Safety

Estimate the effect of afeature on real-world
outcomes.

Identify dataset cohorts
with high error rates andvisualize error distribution
in your model.

Get a PDF summaryof your Responsible AI
insights to share withyour technical and nontechnical stakeholders to
aid in compliance reviews.

Detect hate, violent,sexual, and self-harmcontent across languages
in both images and text.

approach to responsible AI, including deep dives on ourharms posed by AI systems as well as insights into the

responsible AI principles and governance processes, and we

exciting opportunities for AI innovation.

provide content specifically tailored for data scientists andmachine learning engineers.

•

responsible AI, including crafting the rules to guide theTeams also have access to a wide range of responsible AI

responsible development of AI systems. Our governanceexperts across the Microsoft ecosystem. They provide real-framework outlines roles and responsibilities across thetime engagement and feedback throughout the productorganization in a way that creates accountability andlifecycle. This community includes the Aether Committee, theencourages collaboration.

Office of Responsible AI, and a large and growing communityof Responsible AI Champions who drive adoption of the
Responsible AI Standard.

Fostering collaboration
We recognized early in our responsible AI journey the criticalroles that researchers, policy experts, and engineers at
Microsoft play in building our responsible AI practice. Eachgroup brings insights and expertise vital to our work, and we
strive to enable collaboration between them.
•

Policy experts define and operationalize governance for•Engineers design and develop AI systems that adhere to
the Responsible AI Standard. They automate and scale
the steps needed to identify, measure, and mitigate
potential harms posed by AI systems. They also create
wholly new responsible AI solutions that are feasible
based on learnings.

Frequent collaboration and reliance on each other’s
expertise—practices reinforced by leadership—have
helped us create a culture that leads to more beneficial andResearchers, with a range of expertise from machine

responsible solutions. Through ongoing dialogue, teams

learning to the humanities, help us envision the leading

consistently report that a human-centered and collaborativeedge of AI systems. They offer best practices in theapproach to AI results in not just a responsible product, but aidentification, measurement, and mitigation of potential

better product overall.

38

Governing AI: A Blueprint for the Future

Responsible AI Champions
Meet the Microsoft Responsible AI Champions
Microsoft has cultivated a network of Responsible AI Champions across the organization. These individuals are essential inadvancing a responsible-by-design culture.

Mihaela Vorvoreanu, Research

Ferdane Bekmezci, Data Science“Responsible AI is not only a technical“It takes time to inculcate a culture to

problem with technical solutions. It requires

an organization. I am passionate aboutcollaborating deeply and early with not only

championing its adoption across the

responsible AI experts, but also people experts.”

company because it’s important toensure that AI is developed and used in a way that is

Alejandro Gutierrez Munoz, Data Science“Championing of responsible AI is essential
for aligning AI systems with ethical principles,

ethically and socially trustworthy.”

Lisa Mueller, Design

fostering trust, ensuring compliance, and“AI is changing rapidly, so growing

promoting social responsibility.”

communities and company-wide
adoption around AI principles is

Shweta Gupta, Customer Engineering“I believe that applying responsible AI
principles by bringing together a diverse setof stakeholders while developing AI solutions

important to build, grow, and extend
trust in AI systems. As part of this approach, it is also
important to include many disciplines to contributeto this effort and really makes a difference.”

not only helps us identify and address
potential risks, but also ensures that the system being
developed holistically supports its objectives.”

Empowering customers on their
Responsible AI journeys
One of our most important responsible AI commitments is tohelp our customers on their responsible AI journey by sharing
our learnings with them. Our efforts alone are not enoughto secure the societal gains we envision when responsible AI
practices are adopted.
As part of this commitment, we provide transparency
documentation for our platform AI services in the formof Transparency Notes to empower our customers

our customers can understand when and how
to deploy our platform technologies. They also
identify use cases that fall outside the solution’s
capabilities and the Responsible AI Standard.
Transparency Notes fill the gap between marketingand technical documentation, proactively
communicating information that our customers
need to know to deploy AI responsibly. You can see
an example of our Transparency Note for the Azure
OpenAI Service here.

to deploy their systems responsibly. Transparency

Customers also need practical tools to operationalize

Notes communicate in clear, everyday language theresponsible AI practices. Over the years, responsible

purposes, capabilities, and limitations of AI systems so

AI research at Microsoft has led to the incubation

39

Governing AI: A Blueprint for the Future

Northumbria Healthcare NHS: Personalizing surgery assessments using AI
Opting for an elective surgery, such as a knee replacement,

and empower clinicians to understand how the model

is a big decision. Patients turn to their medical providers

arrived at its results. This transparency enables doctors

to weigh the pros and cons. Clinicians in the United

to explain risks and make recommendations so patients

Kingdom’s National Health Service (NHS) system used

can make informed decisions and even take steps totraditional statistics to analyze data, leading to general risk

reduce risks before a procedure.

assessments they could apply to patients. Northumbria
Healthcare NHS Trust surgeons envisioned a way to create
more personalized assessments using AI.

The model empowers clinicians to move away fromone-size-fits-all risk evaluations to an individualized
understanding of each patient. The personalized

The team consulted with Microsoft experts to build a surgery

assessments guide patient-doctor conversations, help

risk assessment model using Microsoft Azure Machine

providers assign patients to the surgery centers where

Learning and the Responsible AI Dashboard. The model

they can get the appropriate level of care, and identify

analyzes 220 data points from patients, including smoking

patients with heightened risks—before problems

history and age. It helped uncover that platelet countoccur. While the model is first being used to assess

carried a significantly higher weight in determining risk thancandidates for joint replacement procedures, clinicians

expected. Built-in tools within the dashboard help avoid bias

are expanding its use to other surgeries, too.

of tools such as Fairlearn and InterpretML. The collection

latest features added in preview include support forof tools has grown in capability, spanning many facets oftext and image data that enables users to evaluate

responsible AI practice including the ability to identify,

large models built with unstructured data during

diagnose, and mitigate potential errors and limitations of

the model-building, training, and evaluation stages,

AI systems. Since their original conception within Microsoft,and Prompt Flow, which provides a streamlined

these tools continue to improve and evolve externally throughexperience for prompting, evaluating, and tuning

the contributions of active open-source communities. The

large language models, including on measurements

collection of tools can be found under the Responsible AI

such as groundedness.

Toolbox GitHub repository. Our latest tool, which is in preview,is Azure Content Safety which helps businesses create safer
online environments and communities through models thatare designed to detect hate, violent, sexual, and self-harm

We have and will continue to invest in translating
research-led responsible AI innovations into practical
tools that support our customers on their responsible AI

content across languages in both images and text.

journeys.

Building on the Responsible AI Toolbox, Microsoft’s

The community involved in developing, evaluating,responsible AI program has invested in integrating someand using AI expands beyond our direct customers.

of the more mature responsible AI tools directly into

To serve this broad ecosystem, we publicly share key

Azure Machine Learning so our customers will also benefit

artifacts from our responsible AI program, including ourfrom the development of engineering systems and tools.

Responsible AI Standard, Impact Assessment template,

The collection of capabilities, known as the Responsible

and collections of cutting-edge research. Our digital

AI Dashboard, offers a single pane of glass for machinelearning paths further empower leaders to craft anlearning practitioners and business stakeholders to debug

effective AI strategy, foster an AI-ready culture, innovate

models and make informed, responsible decisions as they

responsibly, and more. These resources can be foundbuild AI systems or customize existing ones. Some of ouronline at https://aka.ms/rai.

40

Governing AI: A Blueprint for the Future

Conclusion: Advancing Responsible AI Together

We’ve long said that advancing AI responsibly is a journey,

We will continue to be transparent and share our learnings

and our own years-long effort to build a responsible AI

broadly. We know that our efforts will require adjustments

program at Microsoft has prepared us for this AI inflection

and course corrections, especially as we learn from thosepoint. As we continue to unlock greater benefits from theoutside the company. As societal conversations andlatest AI technologies, we remain clear-eyed about risks

government oversight of AI evolve, we will continue toand mindful of the important role we play in advancing

share our commitments for the responsible development

the state-of-the-art, not only for AI capabilities but forand deployment of AI. We will also share our thoughts

responsible AI governance, mitigations, and culture-and suggestions about policy, regulation, and the role thatbuilding.

private-public sector dialogue and partnerships can play,

Our governance approach begins with how we structure
and organize responsible AI at Microsoft, with coordination

as we have done in our blueprint for AI policy, law, andregulation.

from the Office of Responsible AI and essential involvement

The current AI moment calls for industry, governments,

across every part of the company—core responsible AI

academia, and civil society to come together to better

teams in engineering, research, and policy, embedded

define the boundaries for AI in society. We welcome a

Responsible AI Champions throughout organizations,robust, global, cross-sector discussion of how to build andexecutive leadership and accountability as embodied in

deploy safe, secure, and transparent AI systems. We hope

the Responsible AI Council, and oversight from Microsoft’sthat by sharing more details on our responsible AI efforts,

Board. Governance extends to creating, maintaining,

we are contributing useful information to this conversation.

and implementing a shared set of rules and policies tooperationalize responsible AI, which we do with our
Responsible AI Standard. It also requires additional

Together, we can build a future where AI advances the bestof humanity.

oversight and expert guidance for higher-risk or novel-use
cases like the development of the new Bing, which is where
our Sensitive Uses program of required reporting anddeeply engaged, case-specific review is so critical.
Cutting across all our work is the imperative to build andsustain culture and community. In addition to investingin existing people, hiring new talent, and developing
training and skills-building, we have and will continue toprioritize diversity, collaboration, and the capacity to see AI
systems through a sociotechnical lens. Finally, Microsoft iscommitted to proactive, practical steps that institutionalize
not just a culture of responsible AI within the company, buttangible tools and capabilities that make AI safer and morereliable for our customers and society.

41Governing AI: A Blueprint for the Future©2023 Microsoft Corporation. All rights reserved.

42