Microsoft just published an AI code of conduct telling its models not to hack systems or trick humans. My first reaction when someone asked me for comment: you mean to tell me you didn’t already have one of these?
Policy is not the problem here. Policy is where governance starts… it’s how you say what you stand for, and every real control traces back to one. That’s exactly why this lands funny. How are you this far down the road and only now writing it down?
Trustworthy AI is not new, either. The OECD set down its AI principles back in 2019, and the EU AI Act aligned its very definition of an “AI system” with the OECD’s. Principles have been table stakes for years.
Then you read the document itself. Microsoft’s models “will not use adaptive, deceptive… or other mechanisms to evade or defeat human oversight.” Good. But in Microsoft’s own words: “our current models are not yet trained on this document.”
So the principles ship now… and the safeguards are still a roadmap.
We already know the playbook. Curate the training data. Evaluate the models, then red-team them under real adversarial pressure. Align the outputs with reinforcement learning. Microsoft’s document names red-teaming and evaluations itself. What’s missing is the results.
When a vendor hands you a trustworthy-AI pledge, don’t file it. Ask for the red-team results, the evaluation pass rates, and how often a safeguard actually rejected an output. If that number is zero, you don’t have a control. You have a rubber stamp.
Source: Microsoft AI Code of Conduct
RationalAI helps organizations turn ideas like this into results: AI strategy and advisory services. Previous article: Agent Production Gap — Brakes Before You Ship
