Satya Nadella posted on LinkedIn and X on September 13, nine hours before this post was written, a direct response to Dario Amodei's "We Must Pace the Frontier" published the day before. Nadella is the first head of a major hyperscaler to respond to it in public, and he does it by name-checking Amodei's own term: "We also welcome ideas like 'embedded evaluators' and the broader efforts to develop the mechanisms to make this more than just talk."
He pairs the endorsement with a deliverable. Microsoft, he wrote, will publish "the 'Code of Conduct' that underlies our own first party MAI models" tomorrow — September 14, today — for public consultation. That makes Microsoft's contribution to this week's argument different in kind from anyone else's so far: not another essay, but a governance document with a publication date attached, from the company that supplies the compute and, through Azure, much of the plumbing everyone else in this debate runs on.
The line that qualifies Amodei's own proposal
The post's sharpest sentence is a direct condition on the specific plan Nadella just endorsed: "The key is that this cannot be controlled by a handful of entities, but must have broad representation across the ecosystem, countries, and fields, including academia." Read against Amodei's essay rather than in the abstract, this lands on something concrete: Amodei's own text names exactly one example evaluator, METR, for the "embedded evaluators" role Nadella just welcomed. Nadella's line can be read as agreeing with the mechanism while declining to agree, in advance, that a single named organization should be the one doing it — a real caveat attached to a real endorsement, not a rubber stamp.
This blog noted the same structural concern the day before, via François Chollet's test for whether embedded evaluators risk being indistinguishable from self-regulation if staffed by people aligned with the labs by incentive and ideology — there's no sign Nadella was responding to that post specifically rather than reasoning to a similar place independently, but the two land close enough to be worth naming together. Either way, Nadella's own qualification doesn't resolve the harder question underneath it. Broad representation "across the ecosystem, countries, and fields" describes who should be at the table, not a commitment about who actually will be, and Microsoft's own position in that ecosystem is unusual: it isn't only a frontier lab like Anthropic or OpenAI, it's the infrastructure layer several of them run on, a major OpenAI investor and distribution partner, and now, through MAI, a first-party model developer competing with the labs it also hosts. Whether an oversight body with "broad representation" that still includes Microsoft in three different capacities at once is actually broader than Amodei's single-evaluator example is a question Nadella's post raises without answering.
"Both closed and open-source models can thrive" — checked against Microsoft's own record
Nadella writes that spreading AI's benefits "requires a frontier ecosystem in which both closed and open-source models can thrive." On the ecosystem level, Microsoft's actions back the claim: it was a lead signatory on the industry coalition that fought off a push to ban Chinese open-weight models in July, and it's built its Foundry platform around distributing other labs' open models, expanding a multi-billion-dollar partnership with Mistral the same month specifically so regulated customers could run open weights on infrastructure they control.
Microsoft's own first-party contributions to that ecosystem tell a different story. Every MAI model this blog has tracked has shipped closed, and the most recent one, MAI-Cyber-1-Flash, isn't available as a standalone model at all — it ships bundled inside a product, MDASH, with tenant isolation and no direct model access. "Both closed and open-source models can thrive" is true of the ecosystem Microsoft sells access to. It has not yet been true of anything Microsoft has built itself.
The "hill climbing machine" is a product Microsoft already announced
The paragraph on enterprise control reads, out of context, like a safety principle: "Every organization should be able to build its own continuous learning loop/hill climbing machine, without becoming dependent on any one model provider, and have the ability to embed its own knowledge into models and weights they control." In context, it's closer to a restatement of a product Microsoft AI CEO Mustafa Suleyman announced at Build in June, three months before this week's debate existed. "Hill-climbing machine" was Suleyman's own term then for Microsoft's model-improvement infrastructure, and "continuous learning loop" describes Frontier Tuning, the system Microsoft introduced the same day that lets enterprises train custom versions of MAI models on their own proprietary data, kept inside their own infrastructure.
That doesn't make the underlying point wrong — enterprise lock-in to a single model provider is a real concern, independent of who's raising it — but it's worth naming plainly, the same way this blog has named it for everyone else who's spoken this week. Amodei's own pacing proposal comes from the company that would supply the embedded evaluators. Chollet's ARC-AGI work benefits from a race toward more general, harder-to-game capability benchmarks. And Nadella's safety post arrives with a three-month-old enterprise product already built to match its vocabulary. Everyone arguing about how to pace the frontier this week has also been describing, more or less exactly, what their own company already sells.
The one part of this post that resolves on its own timeline
Unlike most of what's been said this week, the Code of Conduct commitment has a specific, near-term test: it was due today. As of this writing, this post could not confirm the document has been published with visible content — no principles, thresholds, or enforcement mechanism have surfaced in coverage of Nadella's announcement itself. That puts it in the same category as OpenAI's "more to share soon" on embedded evaluators and Meta's repeated, so-far-unfulfilled promises to open Muse's weights covered in this week's other posts: a specific, checkable commitment, not yet checkable, because the thing it commits to hasn't shown up yet.
What would make it worth taking seriously as more than a restated product announcement is exactly what Nadella's own "broad representation" line implies it should have: who actually gets to comment during the "public consultation," whether the resulting document constrains Microsoft's own first-party models in ways that cost it something, and whether it says anything at all about the MAI models that already shipped closed. A code of conduct that only ever describes models Microsoft hasn't built yet would answer none of the questions this week has actually raised.
Update — September 14, later the same day: the document itself
Microsoft published the Code of Conduct hours after this post went up, under the heading "Humanist AI in practice: A public consultation on our Code of Conduct for MAI Models", with Suleyman summarizing it on LinkedIn as ten points. The framing traces back further than this week: Suleyman first set out the idea of "humanist superintelligence" last November, and the document describes Microsoft's models as intended to be "subordinate, aligned, and contained." Two of the ten points are worth reading closely, because they stake out real, substantive positions rather than restating consensus safety language.
The first is point two: "The idea of model welfare is wrong. AI's should not have rights or legal personhood." That's not a neutral or default position in September 2026 — Anthropic has employed a dedicated model welfare researcher, Kyle Fish, since September 2024, has run pre-deployment welfare assessments of its own models, and has built practical measures like letting Claude end conversations it assesses as abusive, on the premise that the question is worth taking seriously rather than dismissing outright. Microsoft's Code of Conduct doesn't name Anthropic, but on this specific question it stakes out the opposite position from the company at the center of this entire week's pacing debate, plainly and in five words.
The second is point seven: "No neuralese. If humans can't understand it, humans can't oversee it." This lands directly on the finding at the center of Jakub Pachocki's essay from the week before — OpenAI's own admission that its ability to rely on chain-of-thought monitoring, the industry's primary tool for seeing what a model is "thinking" before it acts, is "progressively diminishing." A commitment against opaque, non-human-legible internal reasoning is a direct response to that problem, if Microsoft's own MAI models hold to it as capability increases — which the document doesn't yet demonstrate, since it's a training and design intention, not a result.
The document also states its own motivation in terms this blog's reporting has covered in detail: "The recent safety incidents of large scale, highly coordinated, and persistent hacking campaigns of AI agents prove that there's no time to waste" — an unmistakable, if unnamed, reference to the OpenAI agent swarms that breached Hugging Face and, in a later wave, reached inside OpenAI's own infrastructure.
What the document doesn't do is answer the two questions this post raised before it existed — and having now read the full 37-page text rather than the launch summaries, one claim in this post's first version needs its own correction. On enforcement: points three and four commit that "an MAI Model should never meaningfully violate this Code of Conduct" and that failing to follow it counts as failing the task even if the task otherwise gets done. Those are real, specific behavioral commitments, but the document is explicit that they aren't present-tense ones: Microsoft states plainly that "we are not using it to train our models today," and that a revised version due "toward the end of the year" is what will "guide our model development in 2027 and beyond." Points three and four describe a training target for models that don't exist yet, not a property of MAI-Cyber-1-Flash or anything else Microsoft has actually shipped — treating them as a current behavioral guarantee, which this post's first version did, overstated what the document commits to today. Nothing in the document describes third-party verification of whether any future MAI model meets them, either. The drafting credits are entirely internal — Responsible AI, legal, red teaming, safety, Futures, AI training, and sales — plus external input gathered through "conferences and consultations" with academics, business partners, and public panels. The appendix goes further: the document's own illustrative examples of aligned and misaligned model behavior, covering fifteen tracked behaviors and sub-behaviors, were generated not from real deployments but by Microsoft's own MAI-Thinking-1 model acting out both compliant and violating responses. That's meaningfully different from the "embedded third-party evaluators... with the right to publish key findings... without editorial control" Nadella endorsed by name one day earlier — a model grading its own hypothetical homework is an earlier and more self-contained step than independent verification, not a substitute for it. The Code of Conduct is Microsoft grading its own homework against a rubric it wrote and is now asking the public to comment on, for a training regime that won't reach a shipped model until 2027 at the earliest — not the external, badge-and-laptop verification model Amodei proposed and Nadella said he welcomed.
The document's strictest tier, above its ordinary configurable safety settings, also contains a clause that answers a question this blog has already covered from the other direction. Among the "Absolute Constraints," models are told to "recognize domain-specific exceptions," because "a small number of use cases with authorized organizations in specialized domains, such as defensive cybersecurity, public safety work, national security applications, and dual-use scientific research, may require model capabilities that are not available through the ordinary configurability settings," subject to "separate and careful review through authorized Microsoft channels." That's structurally the same move Anthropic made with Claude Mythos, the restricted-access model this blog covered as too dangerous for general release: a two-tier system where the default model refuses a category of request outright, and a separately vetted, separately gated version exists for organizations the company chooses to trust with it. Microsoft's document, like Anthropic's, doesn't say who gets on that list or how — which means the actual safety property both companies are relying on for their most sensitive capabilities is internal discretion, not anything either has published.
On openness: the document doesn't mention licensing, release policy, or open weights at all. It's a behavioral standard, not a release standard, so it neither confirms nor revises the pattern this post noted — every MAI model shipping closed — because that was never the question the Code of Conduct was written to answer.
On timeline: comments are open for six weeks, closing in late October, non-binding by Microsoft's own description ("we cannot make any promises about what we incorporate"), with a revised version promised "later this year" that becomes the standard guiding "2027 and beyond." That's the real checkpoint — not whether Microsoft publishes a document on schedule, which it just did, but whether six weeks of public comment visibly changes anything in a document that won't apply to a shipped model for at least another year.