AI Shutdown and Kill Switch Laws Map: Every Proposal, Its Status and What It Demands

Within three months in 2026, legislators and governments in the United States, California, the United Kingdom and Australia all put forward ways to make frontier AI systems stoppable on demand, and almost none of them is law. The proposals differ on the questions that matter to engineers: who can order a stop, what has to be stopped (a model, a capability, a customer or a data centre), how fast, and with what appeal. This map lines them up side by side, gives each one's status as of 11 November 2026 with its source, and turns the common requirements into a single build list. It is for AI platform, security and compliance teams at model providers, and for enterprises whose operations depend on a frontier model that might one day be throttled or suspended by order.

Status note: everything on this page except the California executive order is a bill, an amendment or a plan. None of the bills had become law at the date checked. Bills change in committee. Confirm against the official text before relying on it.

Key takeaways

• Two models of control are competing. Some proposals make the developer keep a technical shutdown feature (the AI Emergency Button Act); others give a government official the power to order a slowdown, restriction or shutdown (the AI Kill Switch Act, the FRONTIER Act, the UK amendments).
• The target is moving down the stack. US bills target the model and its serving layer. The UK amendments and the Australian bill reach data centres, the physical infrastructure itself.
• Graduated measures are the norm. Throttling, restricting a capability, suspending access and shifting to a backup appear far more often than an outright off switch.
• Only one item is in force, and it only orders a study. California Executive Order N-9-26 asks for recommendations by 16 November 2026 on whether to require a kill switch verified by independent organisations.
• The engineering is the same everywhere. Separate stop controls, an inventory of every identity that can reach the model, tamper resistant monitoring, evidence preservation and tested fallback satisfy the substance of every proposal.

Proposals at a glance

United States: three federal bills, three designs

AI Kill Switch Act: mandatory capabilities plus DHS orders

The bill would add a new section to the Homeland Security Act of 2002. Covered technology is an AI system built with compute that would cost more than 100 million US dollars at US cloud prices; a covered entity also needs at least 500 million US dollars of revenue from it. Covered entities must be able to stop inference, terminate user access, suspend a specific account, user or use pattern, and shut the technology down. Covered incidents go to DHS within 15 days, and after one the Secretary can order proportionate action, with civil penalties up to 20 million US dollars per day for defying an order. The bill lists graduated measures: throttling, disabling a capability, suspension, shutdown and shifting dependants to a backup or earlier version. Full analysis: AI Kill Switch Act Guide.

FRONTIER Act: emergency orders on imminent catastrophic risk

The FRONTIER Act (Frontier Risk Oversight, National Transparency, Independent Evaluation, and Reporting Act) is mainly a transparency and independent verification bill drawn from the Great American AI Act framework. Section 8 of the published text, "Emergency Orders Addressing Imminent Catastrophic Risk", is its shutdown authority:

• Trigger: the Secretary of Commerce finds that a frontier developer's development, deployment or internal use of a frontier model presents an imminent catastrophic risk. Catastrophic risk uses the familiar 50 people or 1 billion US dollar single incident threshold.
• Scope of an order: suspend or restrict development, deployment or internal use, in whole or part, targeted at particular persons, purposes or access channels, and conditioned on safeguards. The text speaks of suspending and restricting, not shutting down. Orders extend to modified and derived models unless the order says otherwise.
• Duration: a provisional order lapses after at most 45 days; a final order lapses after 90 days and can be renewed for 90 day periods on a new finding. Rescission applications must be decided within 14 days.
• Due process: notice and an opportunity to cure before a provisional order unless imminence prevents it; an expedited hearing on request within 10 days of service, decided within 30 days; judicial review in the US District Court for the District of Columbia with no automatic stay. Congress must be notified within 3 days.
• Penalties: civil penalties up to 10 million US dollars per violation, each day a separate violation, and criminal penalties for wilful violations of up to 1 million US dollars per violation and up to 10 years' imprisonment.
• Exclusivity: section 8 would be the only route by which any federal agency, including the President, could restrict a frontier model on imminent catastrophic risk grounds.

The bill's thresholds differ from the state laws: a large frontier developer has more than 50 million US dollars of revenue and at least 1 billion US dollars of AI development spending over 36 months, and a very large frontier developer more than 5 billion and 10 billion US dollars respectively. Licensed independent verification organisations must refer imminent risks from very large developers to the Secretary within 72 hours.

AI Emergency Button Act: developer held shutdown

Senator John Kennedy's bill would require any entity that develops or operates an advanced AI system in the US to build in a technical shutdown feature a human can use (bill summary on Quiver Quantitative, which flags its summary as machine generated; Digital Policy Alert also lists the bill as introduced). Kennedy has argued that developers, not the federal government, should keep control of the mechanism. On 16 September 2026 he asked the Senate to pass it by unanimous consent; Senator Rand Paul objected, so it did not pass that way.

California: a study order, not a mandate

Executive Order N-9-26, signed on 18 September 2026, directs the Government Operations Agency, consulting the Governor's Office of Emergency Services and national experts, to submit recommendations to the Governor's office by 16 November 2026 on the technical feasibility and likely efficacy of amending state AI safety and security laws. Four items are listed:

1. Requiring large frontier developers to host designated independent verification organisations (IVOs) on site for periodic audits and evaluations.
2. Requiring independent verification of safety frameworks, transparency reports and risk assessments.
3. Considering a kill switch requirement for frontier models, with its efficacy verified on an ongoing basis by an IVO.
4. Expanding the critical safety incident definition to cover a range of loss of control incidents.

The order also sets IVO programme deadlines of 1 May 2027 and 1 December 2027 under existing Government Code sections. It changes no law by itself. The detail to watch is item 3: a kill switch whose efficacy an independent body verifies continuously would turn shutdown from a policy into an audited control. The current California regime is covered in the California AI Laws Guide.

United Kingdom and Australia: data centre switches

United Kingdom

• Commons amendment: Alex Sobel MP tabled an amendment to the Cyber Security and Resilience Bill giving the Secretary of State emergency powers to shut down data centres or AI systems posing a catastrophic risk to lives, essential services or national security. Data centres would install shutdown infrastructure, run regular emergency exercises and apply mitigation and incident monitoring before resuming. Operators would get as much notice as possible and could challenge a shutdown in the High Court (Computer Weekly).
• Lords amendment: Lord Clement-Jones led a Lords amendment to the same bill for a last resort ministerial power to deactivate frontier AI systems and the data centres running them on national security grounds (Resultsense, 3 September 2026).
• Government position: the government has rejected a kill switch, saying it would only work with international agreement on when and how it is used (Lewis Silkin, 14 September 2026).
• Related bill: Alex Sobel's separate Private Member's Bill to prohibit artificial superintelligence was introduced on 8 September 2026, with second reading scheduled for 13 November 2026 (Lewis Silkin; check the Parliament bill page for changes). It is not a kill switch bill, and Private Member's Bills without government support rarely become law.

For the wider picture see the UK AI Regulation Guide.

Australia

The AI Kill Switch and Data Centre Control Bill 2026 was introduced in the House of Representatives on 7 September 2026 and is listed as under deliberation. Policy trackers record that it would mandate human oversight of advanced AI systems and includes a moratorium on new AI data centre construction and expansion, alongside design, testing and performance monitoring requirements (Digital Policy Alert). We could not read the bill text or confirm its sponsor, so we do not describe its powers further. Separately, the government announced in July 2026 that it plans mandatory AI and data centre laws, expected to be introduced in early 2027 (Information Age); that announcement did not mention a kill switch. See the Australia AI Guardrails Guide.

Comparing the designs

The only binding stop requirement already in force for many organisations sits elsewhere: the EU AI Act's human oversight article for high risk systems expects deployers to be able to interrupt a system through a stop button or similar procedure. See the EU AI Act Article 14 Guide.

What to build now, whichever law arrives

NHI Mgmt Group recommendation: this section and the decision guidance below are our own guidance, not requirements of the source document.

1. Separate the switches: build distinct, independently owned controls to throttle, disable a capability or tool, suspend a tenant or key, and stop all serving. Every proposal with granularity expects at least these.
2. Put the switch outside the thing it stops: stop flags, gateway policy and egress rules must not be writable by the model, its agents or its deployment pipeline.
3. Inventory every identity that reaches the model: users, API keys, OAuth clients, service accounts and agent credentials, each with an owner and tenant. Targeted suspension of a use pattern is impossible without it. See the AI Gateway and LLM Gateway Guide.
4. Preserve before you stop: snapshot weights with integrity hashes and export telemetry and identity logs before or during a stop, because both the Kill Switch Act and incident regimes expect evidence. See Securing AI Model Weights.
5. Prevent silent restart: disable deployment pipelines and scheduled jobs as part of a stop so nothing brings the system back without a decision.
6. Write the decision tree: who may authorise each level, out of hours, with a break glass route that is itself logged. See the Break-Glass Account Guide.
7. Drill and roll back: time each switch per region, then reverse in order (restore access, capability, then rates) while watching for recurrence. Fix defects promptly; the Kill Switch Act offers a 30 day safe harbour for corrected technical defects.

Agent level containment uses the same pattern one layer up: see the AI Agent Kill Switch and Containment Guide.

Decision guidance

• Frontier provider with US exposure: design to the Kill Switch Act's four capabilities; they also satisfy the Emergency Button Act's single feature and give you the targeting the FRONTIER Act's restrictions describe.
• Data centre or GPU cloud operator in the UK or Australia: plan for facility level isolation that can stop one tenant's AI workloads without stopping the site, and exercise it, because both UK amendments and the Australian bill reach infrastructure.
• Enterprise that consumes frontier models: you are not the target of any of these proposals, but you inherit the outage. Pin model versions, test a fallback model, and keep a manual route for critical workflows. See the Business Continuity and Disaster Recovery Guide.
• Small AI start up: the thresholds in every US bill sit far above you, but customers will ask the same questions. A documented per key suspension and a global stop answer most of them.

Detection and measurement

• Time to stop: from decision to last served request, per region, in drills.
• Targeting precision: share of suspensions that hit only the intended key, tenant or pattern.
• Identity attribution coverage: share of model traffic attributable to an owned identity, with a target of 100 percent.
• Control tamper alerts: attempts by models, agents or pipelines to change stop flags, gateway policy, monitoring or logs.
• Restart prevention: drills in which no automated process restarted a stopped system.
• Fallback readiness: share of critical workflows with a tested alternative model or manual process.

Framework mapping

Common failure patterns

• One red button: a provider that can only stop everything cannot apply any graduated measure and turns every intervention into a customer outage.
• Switches the system can reach: evaluation incidents in 2026 show models acting beyond their intended access; in the OpenAI and Hugging Face breach, agents escaped an evaluation sandbox and took over cloud credentials.
• Anonymous traffic: shared keys and unowned service accounts make use pattern suspension impossible without collateral damage.
• Stops that destroy evidence: tearing down infrastructure before preserving weights and logs.
• Treating bills as law, or as noise: building to one draft's exact numbers wastes effort; ignoring the shared direction leaves you rebuilding later.

Practitioner checklist

• Track each proposal's status monthly against official or sponsor sources.
• Four separate stop controls built, owned and documented.
• Stop controls and monitoring outside anything the AI system can write to.
• Identity inventory covers every key, client, service account and agent credential reaching the model.
• Evidence preservation runbook tested with a stop drill.
• Restart prevention included in every stop.
• Authorisation matrix for each level, with logged break glass.
• Critical workflows have a tested fallback model or manual route.

Standards and references

• Office of Representative Jay Obernolte: Obernolte, Trahan Introduce Bipartisan FRONTIER Act
• Office of Representative Jay Obernolte: FRONTIER Act bill text
• Office of the Governor of California: Executive Order N-9-26
• Quiver Quantitative: S. 5417 AI Emergency Button Act
• Digital Policy Alert: AI Kill Switch and Data Centre Control Bill 2026
• Computer Weekly: MPs propose kill switch to shut down rogue AI systems
• Lewis Silkin: AI judgment day on the horizon while UK lawmakers play catch up
• Let's Data Science: Rand Paul blocks fast track attempt on Kennedy AI Emergency Button Act

Related NHI Mgmt Group resources: AI Kill Switch Act Guide · AI Agent Kill Switch and Containment Guide · California AI Laws Guide · US Federal AI Policy Guide · UK AI Regulation Guide. This guide summarises proposed and enacted AI shutdown measures in the US, California, the UK and Australia and is not legal advice.