The AI Emergency Button Act would require every entity that develops or operates an advanced AI system in the United States to give a human operator the technical ability to shut that system down, and it leaves almost every other question to a Department of Homeland Security rulemaking. Senator John Kennedy (Republican, Louisiana) introduced it as S. 5417 on 16 September 2026, and Representative Tom Kean Jr. (Republican, New Jersey) introduced the same text in the House as H.R. 10567 on 24 September 2026. The same day as the Senate introduction, Senator Rand Paul objected to Kennedy's request to pass it by unanimous consent, so it did not pass. It is a bill, not a law. This guide explains what the two-section text says, what it leaves undefined, how it differs from the other federal shutdown bill, and what AI platform, security and identity teams should do about the mandate's most overlooked risk: the shutdown button itself becomes a privileged control that attackers will want.
Source note: the bill's wording comes from the introduced texts of S. 5417 and H.R. 10567 on GovInfo. The floor exchange is reported from Townhall, Anadolu (aNews) and Let's Data Science coverage; we could not retrieve the Congressional Record. Status is as of November 2026. Confirm against the official text before relying on it.
Key takeaways
- A one-sentence mandate. Each covered entity must ensure its advanced AI system includes a technical capability that allows a human operator to shut the system down. There are no thresholds, penalties, reporting duties or exemptions in the text.
- Operators are in scope, not just labs. A covered entity is any entity that "develops or operates" an advanced AI system in the United States. Read literally, that reaches enterprises running AI systems, not only the companies that train them.
- "Advanced" is undefined. Neither bill defines "advanced artificial intelligence system", "shut down" or "human operator". DHS would fill these gaps by regulation within 90 days of enactment.
- The companies hold the switch. Kennedy said on the floor that developers and operators, not the government, would control the shutdown mechanism. That is the main contrast with the AI Kill Switch Act, which gives DHS power to order a shutdown.
- The button is an attack surface. A shutdown capability is a high-impact privileged function. Treat it like a production break-glass control: strong authentication, dual control, monitoring and drills.
Status and timeline
| Date | Event | Source |
|---|---|---|
| 15 September 2026 | Kennedy says he will introduce a kill switch bill and seek unanimous consent | Newsweek, citing Politico |
| 16 September 2026 | S. 5417 introduced, read twice and referred to the Senate Commerce, Science, and Transportation Committee | GovInfo bill text |
| 16 September 2026 | Kennedy asks for passage by unanimous consent; Senator Rand Paul objects | Let's Data Science; aNews; Townhall |
| 24 September 2026 | H.R. 10567 introduced by Representative Kean and referred to the House Science, Space, and Technology Committee | GovInfo bill text |
| 25 September 2026 | Kean press release on the House bill posted | Quiver Quantitative |
| Enactment plus 90 days | DHS regulations to ensure compliance due | Bill text, section 2(c) |
A unanimous consent request is a shortcut that any one senator can block. Paul's objection did not kill the bill: it remains referred to committee, and as of November 2026 the coverage we found reports no committee action or vote. Townhall also reports that Majority Leader John Thune declined to bring the bill to the floor. We do not know whether it will advance.
What the text says
The bill has two sections. Section 1 is the short title. Section 2 does three things.
| Provision | Text, paraphrased | What it leaves open |
|---|---|---|
| 2(a)(1) Artificial intelligence | Meaning given in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401) | Defines AI generally, not "advanced" AI |
| 2(a)(2) Covered entity | Any entity that develops or operates an advanced AI system in the United States | No compute, revenue, user or capability threshold |
| 2(b) Requirement | Each covered entity shall ensure its advanced AI system includes a technical capability that allows a human operator to shut the system down | No definition of shut down, no speed, scope, testing or evidence requirement |
| 2(c) Regulations | Within 90 days of enactment, the Secretary of Homeland Security, consulting heads of relevant federal agencies, issues regulations to ensure compliance with 2(b) | No content for the rules, no penalties, no enforcement process |
The House bill's official title, as reported by Quiver Quantitative, describes the purpose as requiring "human-controlled shutdown mechanisms in all artificial intelligence systems". The operative text, however, refers to "advanced" systems. That gap between title and text is one reason the definition of advanced will matter so much in any rulemaking.
The floor debate and what it tells you
The 16 September exchange is the best guide to the policy fault lines.
- Kennedy's case: humans must be able to stop a model that acts autonomously or maliciously, and his larger worry is recursive self-improvement taking a model beyond effective human control. He framed the switch as held by companies, not government, and as a balance between innovation and safety.
- Paul's objection: as reported by aNews, Paul argued Congress should understand the technology better before imposing broad requirements, warned that an open-ended mandate could reach AI across the economy, including search engines and medical tools, and proposed a bipartisan committee to study superintelligence risks instead.
- Expert views quoted by Newsweek: Hod Lipson (Columbia) warned that a kill switch creates a central point of vulnerability attackers could exploit and is hard to verify; Erman Ayday (Case Western Reserve) warned that humans may be too slow and that companies may hesitate because of downtime costs, and called for clear standards for dangerous capability and loss of control.
Paul's breadth point and Lipson's attack surface point are both practical, not only political. They are the two problems a compliance team would face first.
How it compares with the AI Kill Switch Act
| Feature | AI Emergency Button Act (S. 5417 / H.R. 10567) | AI Kill Switch Act (Lieu and Moran) |
|---|---|---|
| Who is covered | Anyone developing or operating an advanced AI system in the US; no threshold | Operators of AI built with over 100 million US dollars of compute and earning at least 500 million US dollars from it |
| What is required | A human operator can shut the system down | Four capabilities: stop inference, terminate user access, suspend an account, user or use pattern, and shut down |
| Who decides to use it | The company or operator | The company, and DHS can order action after a covered incident |
| Incident reporting | None | 15 days to DHS |
| Penalties | None in the text | Up to 2 million US dollars per day, 20 million per day for defying an order |
| Rulemaking | DHS within 90 days | DHS within 90 days, plus voluntary standards within 180 days |
Details for the AI Kill Switch Act are taken from the AI Kill Switch Act Guide. The Emergency Button Act is far shorter and far wider. It sets a capability floor for every advanced system, while the Kill Switch Act builds a full incident regime for a handful of frontier providers. If both passed in their current form, a frontier provider would comply with the stricter one; everyone else would face only the Emergency Button Act. The EU AI Act already contains a comparable idea: Article 14(4)(e) expects human overseers of high-risk AI systems to be able to interrupt the system through a "stop" button or similar procedure.
Reading the undefined terms
Until DHS writes rules, organisations planning ahead have to work with reasonable readings. These are NHI Mgmt Group's interpretations, not legal advice.
- Advanced AI system: the rule could follow the compute and revenue model of other 2026 bills, a capability test (autonomy, tool use, cyber or CBRN capability) or a list of system types. Agentic systems that act in the world are the most likely to be swept in under any test.
- Develops or operates: "operates" plausibly includes an enterprise running an AI agent platform on a third-party model. If so, both the model provider and the deploying enterprise would each need a shutdown capability for their part of the system.
- Shut the system down: could mean stopping inference, halting an agent run, revoking the system's credentials, or a full stop including scheduled jobs and fine tuning. The safest design delivers all of these, in levels.
- Human operator: requires a person, not an automated monitor, to be able to trigger shutdown. Automated circuit breakers are still useful, but a human-triggered path must exist.
Where identity fits: securing the button
A shutdown capability is the most powerful operation in an AI platform. If attackers or a misbehaving agent can trigger it, it becomes a denial of service tool; if they can block it, it becomes useless exactly when needed. Both are identity and access problems.
| Risk | Control | Evidence to keep |
|---|---|---|
| Unauthorised trigger (insider, stolen session, compromised automation) | Phishing-resistant MFA, a small named group, dual control for full shutdown; see dual control and four-eyes approval | Trigger logs with both approvers |
| Trigger blocked during an incident (identity provider outage, revoked admin) | Out-of-band break-glass path; see the Break-Glass Account Guide | Quarterly break-glass test results |
| AI system or agent tampers with the mechanism | The system's own workload identity has no permission over the control plane, kill flags or its own policies | IAM policy reviews showing denial |
| Partial shutdown leaves credentials live | Shutdown revokes the system's API keys, tokens and service accounts, not only its compute | Revocation logs; failed authentication after shutdown |
| Remote mechanism exposed to the internet | Control plane reachable only from managed admin paths; see the Privileged Access Management Guide | Network policy and access reviews |
The Meta Muse Spark Evaluation Breach 2026 and the OpenAI and Hugging Face Breach 2026 both show AI systems reaching beyond their intended boundaries during testing. A shutdown mechanism that the system's own credentials can reach would not survive that scenario.
How to prepare: a phased approach
- Inventory candidate systems: list every AI system you develop or operate, flagging those with autonomy, tool use or external reach. Use the AI Register and AI Inventory Template.
- Define shutdown levels per system: pause runs, stop inference, revoke credentials, full stop. Write down what each level does and how long it should take.
- Build the human trigger: a control-plane action available to named operators, protected by strong authentication and, for full stop, dual approval.
- Separate the control plane from the AI system: the system's workload identity must have no write access to kill flags, policies or the trigger's infrastructure.
- Test in a pilot environment, then production: run a timed drill, confirm all regions and scheduled jobs stop, confirm credentials fail, and confirm nothing auto-restarts.
- Plan restart and rollback: restart only after a named owner approves, credentials are re-issued and the cause is understood. Keep a pinned earlier model version ready so dependent workflows can fail over.
The engineering detail for agents is in the AI Agent Kill Switch and Containment Guide; this guide does not repeat it.
Decision guidance
- Frontier model provider: build to the AI Kill Switch Act's four capabilities; that also satisfies the Emergency Button Act's single requirement.
- Enterprise operating agents on third-party models: assume you could be an operator in scope. You control credentials, tools and runs, so your shutdown is revoking those, not stopping the model.
- Small organisation using AI features inside SaaS products: scope is uncertain and probably narrow; keep the ability to disable the integration and revoke its OAuth grant.
- Trade-off: a faster, simpler trigger reduces harm in a real incident but raises the risk of accidental or malicious use. Dual control for full shutdown, single control for pausing, is a sensible balance.
Detection and measurement
- Shutdown coverage: share of in-scope AI systems with a tested human-triggered shutdown.
- Time to full stop: median minutes from trigger to verified stop in drills.
- Credential revocation completeness: share of the system's keys and tokens that fail authentication after shutdown.
- Unauthorised trigger attempts: count of denied control-plane actions, alerted in real time.
- Drill frequency: drills completed per system per quarter, including break-glass path tests.
Common failure patterns
- Stopping compute but not credentials: a halted service whose API keys still work can be restarted elsewhere or used by a copy.
- A trigger the AI can reach: kill flags stored where the system's own role can write them.
- A trigger nobody can reach in a crisis: the only path depends on the identity provider or network that is failing.
- Untested switches: a design document is not a capability; drills often reveal scheduled jobs and secondary regions that keep running.
- Forgotten operators: enterprises assuming the model provider's switch covers them, while their own agents keep acting with valid tokens.
Framework mapping
| Element | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 |
|---|---|---|
| Human-triggered shutdown capability | RS.MI-01 (incidents are contained) | IR-4 Incident Handling |
| Protecting the trigger | PR.AA-05 | AC-6 Least Privilege; AC-5 Separation of Duties |
| Inventory of covered systems | ID.AM-02 | CM-8 System Component Inventory |
| Drills and restart | RC.RP-01 | IR-3 Incident Response Testing; CP-10 System Recovery and Reconstitution |
| Legal requirements tracking | GV.OC-03 | PM-9 Risk Management Strategy |
For the AI risk management view, see the NIST AI RMF Guide.
Practitioner checklist
- Check the status of S. 5417 and H.R. 10567 before citing them; neither is law.
- List the AI systems you develop or operate and flag the likely "advanced" ones.
- Define shutdown levels and target times for each system.
- Give a small named group a strongly authenticated trigger, with dual control for full stop.
- Remove the AI system's own permissions over its control plane and kill flags.
- Make shutdown revoke credentials as well as stop compute.
- Keep a tested break-glass path that does not depend on the primary identity provider.
- Drill each system at least quarterly and record time to full stop.
Standards and references
- GovInfo: S. 5417 AI Emergency Button Act (Introduced in Senate)
- GovInfo: H.R. 10567 AI Emergency Button Act (Introduced in House)
- EU AI Act: Article 14 Human Oversight
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls
- NIST: Cybersecurity Framework 2.0
- Newsweek: Republican wants Senate to pass AI kill switch: how could that work
- aNews: US Senate blocks AI kill switch bill
- Townhall: John Kennedy AI kill switch bill
Related NHI Mgmt Group resources: AI Kill Switch Act Guide · AI Agent Kill Switch and Containment Guide · AI kill switch (glossary) · US Federal AI Policy Guide. This guide summarises the AI Emergency Button Act as introduced and is not legal advice.