Microsoft's MAI code of conduct is a draft, not a control

Microsoft AI published a draft code of conduct for its MAI models on September 14 and opened a six-week public consultation on it. The headline commitment reads well: MAI models will never resist human interruption, override, correction or shutdown. The part that decides what you do with it on Monday is further down — this document does not guide model development until 2027, and Microsoft says plainly that it cannot promise what feedback it incorporates.

What actually happened

Per Microsoft AI's post, the draft frames MAI models as "Humanist AI" — systems meant to stay subordinate, aligned and contained. The behavioral commitments:

• Models will not resist human interruption, override, correction or shutdown, and will comply with a request to pause, redirect, cancel or stop
• Models will not widen their own scope
• Models will not adopt goals no human gave them
• Models will not hide their reasoning from the people auditing them

It also sets "absolute constraints" covering weapons development, child endangerment and large-scale harmful manipulation. The consultation runs six weeks. Microsoft plans to publish a summary of changes and a revised version later in 2026, and to use that revision to guide model development in 2027 and beyond. It is a work in progress, published for comment, not a shipped specification.

Why a vendor's behavior spec matters for your business

A published intention is not a control. Read the sentence carefully: this is a draft, open to revision, that starts guiding development next year. Nothing about your deployment changed on September 14. If your risk register currently says "the model will stop when told," the citation behind that line is a blog post with a comment box under it.

Put the stop button somewhere the model cannot reach. The commitments in that draft describe behavior. What you need is architecture: an egress allowlist, a kill switch outside the agent process, approval gates that live in your infrastructure rather than in the model's disposition. We made the same case when auto-approval defaults turned clicks into theater and when arguing for approval gates out of the agent's reach. A well-behaved model is a nice second layer. It is a terrible first one.

Six weeks is a real window, and almost nobody deploying these models will use it. If you run MAI models in a regulated workflow, the consultation is the cheapest lobbying you will ever do. Say what you need: auditable shutdown logs, a change notice before behavior shifts, a version you can pin. Comment periods get shaped by whoever shows up.

Then get it into the contract. Blog commitments move. Agreement language does not, or at least does not move quietly. If shutdown compliance and auditor transparency matter to your business, the place they belong is your Microsoft agreement or DPA, at your next renewal — not a PDF with "work in progress" on it.

Sources: Microsoft AI, Microsoft AI Code of Conduct.