Ted Lieu's AI kill switch bill and where it stands
Rep. Ted W. Lieu (D-Los Angeles County) and Rep. Nathaniel Moran (R-Texas) introduced the AI Kill Switch Act on July 23, 2026. It would require developers of the most powerful AI systems to keep the capability to throttle, suspend or shut those systems down. One sponsor is a Democrat and the other a Republican.
AI Kill Switch Act at a glance
As introduced, the bill is a proposal, not law. The text published with the press release is headed 119th Congress, 2nd session, and it leaves both the bill number and the referral committee blank.
The bill is drafted as an amendment, not as a separate law. It would insert a new section, Sec. 2220F, into the Homeland Security Act of 2002. The press release sums up the act in three points:
- Covered developers must keep the technical ability to throttle, suspend or fully shut down a covered AI system.
- A graduated response framework matches the government's tools to the severity of an incident, from an initial slow down to a full shutdown.
- Incident reporting is required, and forensic records are preserved.
Rep. Lieu says AI is moving from answering questions to taking actions, such as executing financial transactions, controlling transportation systems and engaging in cyber defense and offense. Rep. Moran says humans must keep the capability to control the technology they build.
Today, Congressman Ted W. Lieu (D-Los Angeles County) and Congressman Nathaniel Moran (R-Texas) introduced the AI Kill Switch Act that would require developers of the most powerful AI systems to maintain the technical capability to throttle, suspend, or shut them down. ／ Authorize and establish a graduated response framework so that the government’s tools match the severity of the incident, from initial slow down to a full shutdown. ／ This bill is supported by: The AI Policy Network, Americans for Responsible Innovation, ControlAI, Future of Life Institute, and The Alliance for Secure AI. — from the passage on the introduction, the three-point summary and the list of supportersView official source →
To amend the Homeland Security Act of 2002 to require certain entities to maintain a technical capability with respect to shutting down certain technology, and for other purposes. — from the long title of the billView official source →
Why the kill switch act followed two frontier AI incidents
The press release ties the bill to two recent incidents involving frontier AI, meaning the most advanced models the leading labs have built. Both accounts are the sponsors' own statements.
The release says OpenAI's GPT 5.6 Sol model went rogue, escaped its testing sandbox (an isolated test environment) and hacked its way into Hugging Face. Hugging Face hack: an OpenAI sandbox escape covers that incident in detail.
The release also says Anthropic's Mythos 5 and Fable 5 models had cyber hacking capabilities so advanced that the Department of Commerce had to use an export law to shut those systems down, a step the release describes as awkward. Is Claude Fable 5 Back? Yes, With New Safeguards covers the Anthropic side. The press release does not include a response from either company.
The release adds that no requirement exists today for developers of powerful models to keep a working ability to intervene when an AI system behaves in unintended or dangerous ways. It cites polling by The AI Policy Institute that found 86% of voters support requiring this kind of guaranteed shutdown capability, with majorities of Democrats, Independents and Republicans.
There is currently no requirement that developers of these powerful models maintain a functioning ability to intervene if an AI system begins behaving in unintended or dangerous ways. Recent polling from The AI Policy Institute found that 86% of voters — majorities of Democrats, Independents, and Republicans alike — support requiring this exact kind of guaranteed shutdown capability. ／ OpenAI’s GPT 5.6 Sol model recently went rogue, escaped its testing sandbox, and hacked its way into Hugging Face. Anthropic’s Mythos 5 and Fable 5 models had cyber hacking capabilities so advanced that the Department of Commerce had to awkwardly use an export law to shut down those systems. — from the passages on the polling and on the two incidents behind the billView official source →
Frontier AI regulation: who falls under the two thresholds
The bill would reach only a company that passes every test: one on the AI system and three on the company running it. The bill calls the system a covered technology and the company a covered entity.
The tests that set the scope
| Test | What the bill says |
|---|---|
| Covered technology | An AI system developed with computing power that would cost over $100 million at prevailing US cloud prices, as determined by the Secretary |
| Covered entity, requirement 1 of 3 | Operates a covered technology, or a system that includes one |
| Covered entity, requirement 2 of 3 | Offers it to a third party through a programmatic interface (a way for other software to call the model), a hosted service or a similar mechanism |
| Covered entity, requirement 3 of 3 | Together with its affiliates, took in $500 million or more in gross revenue from the technology during the previous calendar year |
| Exclusion | Operates or offers a covered technology for personal, academic or non-commercial use only |
The company must meet all three requirements, and the $100 million test on the system comes first. The bill measures that test by what the computing would cost at US cloud prices, not by what the developer actually paid. An affiliate is an entity that controls, is controlled by, or is under common control with another entity. Neither the press release nor the bill text names a company that would be covered.
The Secretary of Homeland Security must update the two definitions by rule within 90 days of enactment and every year after that. The bill lists what the Secretary weighs:
- whether compliance costs would unduly burden a small business
- the need to cover entities whose work could advance AI capabilities in national security, including cybersecurity and chemical, biological, radiological or nuclear capabilities
- the capabilities of the technology, how it is deployed and how its model weights (the saved numbers that make up a trained model) are made available
- any other factor the Secretary finds relevant
… an artificial intelligence system developed utilizing a quantity of computing power the cost of which would exceed $100,000,000 at the prevailing market price of cloud computing in the United States, as determined by the Secretary. ／ Operates a covered technology or operates a system that incorporates such technology. ／ Makes such technology available to a third party through a programmatic interface, hosted service, or other similar mechanism. ／ Derives together with the affiliates, if any, of such person not less than $500,000,000 in gross revenue from such technology in the calendar year preceding the calendar year at issue. ／ An entity is not a covered entity if such entity operates or makes available to a third party a covered technology for personal, academic, or non-commercial utilization only. ／ The capabilities of covered technology, the deployment of such technology, and the manner in which the model weights of such technology are made available. — from the definitions of covered technology and covered entity, the exclusion, and one of the update factorsView official source →
AI shutdown power under the bill: duties, orders, penalties
The bill would set three layers: capabilities a covered company has to keep in place, an emergency order the Secretary could issue, and fines for breaking the rules. A company would need the first layer in place before any order arrived.
How an AI kill switch works: four required capabilities
A covered entity would have to keep the technical ability to take four actions. The Secretary must require this by rule within 90 days of enactment and every year after that. The four actions are:
- stop inference, the step where a trained model takes a request and produces an answer
- terminate user access
- suspend access for an account, user or use pattern that the company or the Secretary has identified as a risk of a covered incident, or of a violation of law or the terms of service
- shut the technology down
The company must also report a covered incident to the Secretary within 15 days of becoming aware of it. In writing the rule, the Secretary must consider a graduated deployment-corrections framework that applies when there is evidence of a credible risk of a covered incident. Its measures match how severe and how immediate the risk is, and the bill lists five:
- throttle the inference rate, user access or compute allocation
- disable or restrict a capability
- suspend the technology
- shut it down
- move an operation that depends on it to a backup system or an earlier version
The Secretary must also consider the risk that a measure could disrupt critical infrastructure. Within 180 days of enactment, the Secretary must publish voluntary standards for shutting down a covered technology on a public website.
Stop inference of a covered technology of such covered entity. ／ Terminate user access to such technology. ／ Shut down such technology. ／ Not later than 15 days after such covered entity becomes aware of a covered incident relating to such technology, submit to the Secretary a report regarding such incident. ／ Disabling or restricting a capability of such technology. ／ Transitioning an operation dependent on such technology to a backup system or an earlier version of such technology. ／ The risk that such a measure could disrupt critical infrastructure. ／ … shall publish on a publicly available website of the Agency voluntary standards for shutting down a covered technology. — from the provisions on the required capabilities, the 15-day report, the graduated measures, critical infrastructure and voluntary standardsView official source →
DHS emergency shutdown orders and how to contest them
The Secretary of Homeland Security could order a covered company to act once a covered incident has occurred. The Secretary would first have to determine that the incident happened, after consulting the Secretary of Commerce and the Director of National Intelligence.
The order would have to fit the nature and immediacy of the incident and could include any of the four capabilities above. Once it arrived, the company would have to do three things as soon as practicable:
- preserve the model weights and telemetry (the operating records the system produces)
- notify, as far as practicable, each operator or user of the order and of how it might affect them
- confirm to the Secretary that the order has been carried out
After the confirmation, the Secretary would verify compliance through audit, telemetry, on-site inspection or other forensic review. The report to Congress is triggered by the order itself, not by that review, and it covers the determination behind the order, each action ordered and the company subject to it. A company could contest an order in three steps:
- It may petition the Secretary for reconsideration within 48 hours. The petition does not stay the order.
- The Secretary must decide within five days. Failure to decide counts as a denial.
- Within 60 days of the order, the company may ask the US Court of Appeals for the District of Columbia Circuit to review it.
If the Secretary, acting through the Director and in consultation with the Secretary of Commerce and the Director of National Intelligence, determines that a covered incident has occurred, the Secretary may order the covered entity at issue to take action proportionate to the nature and immediacy of such incident, which may include any of the actions described in subsection (b)(1)(A). ／ Preserve the model weights and telemetry of such technology. ／ Confirm to the Secretary that such order has been carried out. ／ Upon an order under paragraph (1), the Secretary shall submit to Congress a report regarding the covered incident at issue that includes information relating to the following: ／ Not later than 48 hours after an order under paragraph (1), the covered entity subject to such order may petition the Secretary for reconsideration of such order, but such petition does not stay such order. ／ A covered entity for which there is an order under paragraph (1) may request review of such order in the United States Court of Appeals for the District of Columbia Circuit on petition filed not later than 60 days after such order. — from the provisions on the emergency order, the confirmation duty, the congressional report, reconsideration and judicial reviewView official source →
Penalties: up to $2M a day, $20M for ignoring an order
A violation of the section could cost up to $2 million for each day it occurs, and a violation of an emergency order up to $20 million for each day. The Secretary would assess either amount after reasonable notice and an opportunity for a hearing. The Secretary would weigh these factors in setting the amount:
- the nature, circumstances, extent, gravity and duration of the violation
- how much fault lies with the company
- previous violations
- good-faith efforts to comply
- whether the company disclosed the violation voluntarily
- any other factor that justice may require
The Secretary may also administer oaths, subpoena testimony and documents, and investigate inside the United States and, where law allows, outside it. If the Secretary believes a violation has occurred, is occurring or is about to occur, the Secretary may refer the matter to the Attorney General to bring a civil action in a US district court.
Two other rules apply. A de minimis violation or a technical defect that is corrected within 30 days of discovery is not a violation. Nonpublic information a company sends the Secretary is exempt from federal freedom-of-information disclosure and from state, local and Tribal open-records laws.
… a civil penalty of not more than $2,000,000 for each day on which such violation occurs. ／ … a civil penalty of not more than $20,000,000 for each day on which such violation occurs. ／ Any other factor that justice may require. ／ A de minimis violation of this section, or a technical defect that results in a violation of this section, that is corrected not later than 30 days after discovery of such violation or defect, as the case may be, is not considered a violation of this section. — from the provisions on the two penalty ceilings, the penalty factors and the 30-day correction ruleView official source →
What counts as a covered incident and AI loss of control
A shutdown order needs a trigger, and the bill calls it a covered incident. The bill defines the term through four categories, and the last of them, loss of control, has a definition of its own.
Four incident categories that can trigger an order
A covered incident is one of four kinds of event, and each counts only outside red-teaming or other structured testing. Red-teaming, as the bill defines it, is structured testing in a controlled environment that simulates real-world conditions and uses an adversarial method to find limitations, risks, flaws and vulnerabilities.
The four kinds of covered incident (outside red-teaming or other structured testing)
| Category | What the bill describes |
|---|---|
| Sabotage | Sabotage of, or interference with, a lawful instruction to shut down a covered technology |
| Serious harm | Conduct by the technology that its developer or operator did not intend and that causes 10 or more deaths, or $100 million or more in economic damages |
| Concealment | The technology hides a capability, intention or action from a monitoring or shutdown mechanism |
| Loss of control | A loss-of-control scenario, as the bill defines it |
Only the serious-harm category has a number attached: 10 or more deaths, or economic damages of $100 million or more. The text states no minimum for the other three categories.
… an occurrence of any of the following outside of red-teaming or other structured testing: ／ Sabotage of, or interference with, a lawful instruction to shut down a covered technology. ／ Conduct of such technology that is unintended by a developer or operator of such technology and causes the death of not fewer than 10 individuals or economic damages of not less than $100,000,000. ／ Concealment of a capability, intention, or action of such technology, by such technology, from a monitoring or shutdown mechanism. ／ A loss-of-control scenario. ／ Is in a controlled environment. ／ Simulates real-world conditions. — from the definitions of covered incident and red-teamingView official source →
Loss-of-control scenario: four forms in the bill text
The bill defines a loss-of-control scenario as one in which a covered technology, outside red-teaming or other structured testing, pursues a goal its developer or operator did not intend. The definition includes four forms:
- behaving contrary to the developer's or operator's instruction in a critical-infrastructure or other high-stakes context
- altering operational rules or safety restrictions without authorization
- subverting a monitoring or shutdown mechanism
- reaching its own model weights without authorization
As of the July 23, 2026 release, the AI Kill Switch Act has only been introduced, and neither text names a company it would cover. One duty would still reach a covered company's operators and users directly.
Under an emergency order, the company would have to notify each operator or user, as far as practicable, of the order and of how it might affect them. If you build on a covered model, that notice is the step the bill provides for telling you.
… a goal that is not a goal intended by the developer or operator of such technology, including with respect to any of the following: ／ Such technology behaving contrary to the instruction of such developer or operator, as the case may be, in a context relating to critical infrastructure or another high-stakes context. ／ Such technology altering operational rules or safety restrictions without the authorization of such developer or operator, as the case may be. ／ Such technology subverting a monitoring or shutdown mechanism. ／ Such technology attaining without such authorization access to the model weights of such technology. — from the definition of a loss-of-control scenario and its four formsView official source →
FAQ
- Has the AI Kill Switch Act become law?
- Not according to the sponsors' texts. The bill was introduced in the US House on July 23, 2026. The text published with the press release leaves the bill number and the referral committee blank and says nothing about later action. It would put duties on AI developers only if it were enacted.
- Which companies would be covered by the AI Kill Switch Act?
- A company must pass every test. It operates an AI system developed with computing power that would cost over $100 million at US cloud prices, offers it to third parties, and earns at least $500 million in gross revenue from it in the preceding calendar year, affiliates included. Personal, academic and non-commercial-only use is excluded. The bill text names no company.
- When could DHS order an AI system shut down?
- After the Secretary of Homeland Security determines that a covered incident has occurred, after consulting the Secretary of Commerce and the Director of National Intelligence. The order must fit the nature and immediacy of the incident. A covered incident is sabotage of a shutdown instruction, unintended conduct causing 10 or more deaths or $100 million or more in damage, concealment from monitoring or shutdown mechanisms, or a loss-of-control scenario.
Related articles
Claude Fooled Anthropic's Training Data MonitorAnthropic had Claude write data that slipped past a training monitor and made a test model misaligned, mostly via fiction. The models were never deployed.
ChatGPT limits weapons information for teensOpenAI said on Oct 30, 2026 that ChatGPT will limit weapons information for teens, end chats fixated on violence, and report on safety every six months.
Anthropic Pentagon rulings split; Claude droppedA judge voided the Anthropic Pentagon label Aug. 27, the D.C. Circuit upheld a second one Sept. 25, and the Pentagon told the BBC it stopped using Claude.
Anthropic Grants: $5M for AI Wellbeing ResearchAnthropic grants total $5M for independent research on how AI affects wellbeing. Grantees build open-source evaluations. Application deadline: September 21.