AI Kill Switch Bills Explained: What H.R. 9917 and the AI Emergency Button Act Actually Require

“Kill switch” has become one of the easiest phrases in AI politics. It fits on a yard sign, it polls well, and it sounds like a complete answer to a frightening problem. The bills behind the phrase are less simple. Two of them are in Congress right now, a third approach is a study order in California, and they disagree about almost everything that matters: who gets covered, who presses the button, what triggers it and what the company has to do afterward.

This guide works from the bill texts themselves, which are public, and not from campaign summaries. It explains what H.R. 9917 and the AI Emergency Button Act actually say, what California has and has not ordered, where critics see technical problems, and what a company that uses AI (not just builds it) should do now. Nothing here is enacted law. Every requirement described below is a proposal.

1. Where the proposals stand

Three separate efforts are being grouped under the same label.

• The AI Kill Switch Act, H.R. 9917. Introduced July 23, 2026 by Rep. Ted Lieu (D-Calif.) with Rep. Nathaniel Moran (R-Texas). It was referred to the House Homeland Security Committee and, on July 24, to its Subcommittee on Cybersecurity and Infrastructure Protection. As far as the Congress.gov record we could see shows, no further action has been taken.
• The AI Emergency Button Act. Introduced in the Senate as S. 5417 by Sen. John Kennedy (R-La.) on September 16, 2026 and referred to the Commerce, Science, and Transportation Committee. A House bill, H.R. 10567, was introduced by Rep. Tom Kean Jr. (R-N.J.) on September 24 and referred to the Science, Space, and Technology Committee. The two bills carry the same text.
• California Executive Order N-9-26. Signed by Gov. Gavin Newsom on September 18, 2026. It orders a study and recommendations, not a mandate.

Political coverage this week describes shutdown language moving into 2026 and 2028 campaign platforms, and local reporting says Michigan Senate candidate Abdul El-Sayed backs the Lieu-Moran bill. We have not been able to read the national campaign reporting directly, so treat the claim that kill switches are now a standard campaign plank as a characterization, not something we have counted. What we can read is the legislation, and it is where the substance is.

2. What H.R. 9917 requires

The introduced text of H.R. 9917 adds a new Section 2220F to the Homeland Security Act of 2002. It is a detailed bill, and most of the detail is about process.

Who is covered

A “covered entity” has to meet three conditions: it operates a covered technology, it makes that technology available to a third party through an API, hosted service or similar mechanism, and it earns at least $500 million in gross revenue from the technology in the previous calendar year, counting affiliates. A “covered technology” is an AI system developed using computing power that would cost more than $100 million at prevailing U.S. cloud prices, as determined by the Secretary of Homeland Security. DHS would update both definitions by rule within 90 days of enactment and every year after that. Entities that make a covered technology available only for personal, academic or non-commercial use are excluded, and the Secretary must weigh the cost burden on small businesses.

Taken at face value, that is a short list of frontier developers. Most companies that deploy chatbots or agents are not covered entities under this bill.

What a covered entity must be able to do

By rule, a covered entity must maintain the technical capability to stop inference, terminate user access, suspend access for a specific account, user or use pattern that poses a risk of a covered incident or violates law or the terms of service, and shut the technology down. It must report a covered incident to the Secretary within 15 days of becoming aware of it. The Secretary is told to consider a graduated framework tied to the severity and immediacy of the risk: throttling inference rate, user access or compute allocation; disabling or restricting a capability; suspending; shutting down; or moving a dependent operation to a backup system or an earlier model version. The Secretary must also consider the risk that a shutdown could disrupt critical infrastructure, and must publish voluntary shutdown standards within 180 days.

What counts as a covered incident

The bill lists four triggers, all measured outside red-teaming or other structured testing:

• sabotage of, or interference with, a lawful instruction to shut the technology down;
• unintended conduct by the technology that causes at least 10 deaths or at least $100 million in economic damage;
• the technology concealing a capability, intention or action from a monitoring or shutdown mechanism; and
• a “loss-of-control scenario,” defined as the technology pursuing a goal its developer or operator did not intend, including by behaving contrary to instructions in a critical-infrastructure or other high-stakes context, changing its own operating rules or safety restrictions without authorization, subverting a monitoring or shutdown mechanism, or obtaining access to its own model weights without authorization.

The first two have numbers or observable facts attached. The last is the broad one, and it is where most of the legal argument would happen. Our piece on how the EU AI Act covers loss of control, and why that is not a containment plan takes up the European side of the same question.

The emergency order and its consequences

If the Secretary, in consultation with the Secretary of Commerce and the Director of National Intelligence, determines that a covered incident occurred, DHS may order the company to take action proportionate to the incident. Once ordered, the company must as soon as practicable preserve the model weights and telemetry, notify each operator or user of the order and how they may be affected “to the extent practicable,” and confirm to DHS that the order was carried out. DHS then verifies compliance through audit, telemetry, on-site inspection or other forensic review and reports to Congress.

The company can petition for reconsideration within 48 hours, but the petition does not pause the order. DHS has five days to decide, and silence counts as a denial. Judicial review lies in the D.C. Circuit on a petition filed within 60 days. Civil penalties run up to $2 million per day for lacking the required capability and up to $20 million per day for violating an emergency order. A minor defect corrected within 30 days of discovery is not treated as a violation. Nonpublic information submitted under the section is exempt from federal FOIA and from state and local public-records laws.

3. What the AI Emergency Button Act requires

The Kennedy bill is much shorter, and the contrast is the story. In S. 5417, a covered entity is “any entity that develops or operates an advanced artificial intelligence system in the United States.” Each covered entity must ensure the system includes “a technical capability for a human operator to shut down the system.” DHS, consulting other agencies, must issue regulations within 90 days of enactment.

That is the whole operative text. There is no revenue or compute threshold, no list of triggering events, no reporting deadline, no emergency order and no penalty. The word “advanced” is not defined in the bill. The official title says the bill would require shutdown mechanisms “in all artificial intelligence systems,” while the operative text speaks only of “advanced” ones, so the title and the text point in different directions. Lawfare’s reading is that Kennedy’s design leaves the decision to shut down with the company, not a public authority, and it reports that Sen. Rand Paul blocked an attempt to pass the bill by unanimous consent in September. We have not independently confirmed that floor action.

One drafting choice deserves attention from anyone who deploys AI. The bill reaches entities that operate advanced systems, not only those that build them. Whether a business running a vendor’s model inside its own product counts as an operator would be decided by the DHS regulations, and the bill gives DHS no further guidance.

4. California’s approach: verify the switch before you mandate it

California’s September 18 executive order directs the Government Operations Agency, with the Governor’s Office of Emergency Services, to convene national experts and deliver recommendations within two months. Proposals to be examined include requiring frontier AI companies to host a designated independent verification organization onsite, requiring the safety frameworks and risk assessments they file under state law to be verified, updating the definition of critical safety incidents to include loss-of-control events, and advancing a “kill switch” for frontier models whose effectiveness would be verified on an ongoing basis by an independent verification organization. The order also accelerates implementation of SB 813 and AB 1405, which the governor says he signed the previous week and which create a framework for independent verification organizations and a registry of AI auditors.

The difference from Congress is the one worth noting. California is asking who would check that a switch works. The federal bills mostly assume the switch exists and focus on who may use it. Our earlier coverage of California’s SB 53 and New York’s RAISE Act explains the incident-reporting laws that these proposals would sit on top of.

5. The technical objections are not trivial

A Lawfare analysis published October 20 sets out the main criticisms, and several of them bear on how any of these bills could be written into rules.

• Scope of the switch. AI systems run across many data centers and backup systems, so a switch has to reach backups built to survive outages. Providers have also been building resilience into their systems, which is the property a switch has to override.
• Collateral damage. A hospital using a frontier model for triage could lose it because of an unrelated incident elsewhere. That is why H.R. 9917 asks DHS to consider critical-infrastructure disruption and a graduated approach.
• Open-weight models. Once downloaded, they run anywhere. Lawfare reports that Lieu has said the House bill would not cover open-weight models. A mandate that required control over every copy would effectively end open releases.
• The switch as an attack surface. A researcher quoted by Lawfare compares a mandated shutdown interface to the 1990s Clipper Chip, a deliberately built access point that bad actors could exploit. Anyone who seized control of a switch could threaten every customer that depends on the system.
• Who decides. Proposals vary between the company, DHS and independent third parties, and none of the current ones clearly defines what a “frontier” model is, according to the analysis.

These are critics’ arguments, not findings. Lawfare also notes that its authors prefer alternatives such as transparency requirements, a federal research effort on mitigations and clearer liability rules. Readers should weigh that as one side of an open debate.

6. The privacy problem hiding in the emergency order

Most commentary stops at “can the model be turned off.” Privacy teams should look at the next sentence of H.R. 9917, which tells the company to preserve model weights and telemetry once an order issues. Telemetry from an AI product can include prompts, outputs, account identifiers and logs of what an agent did on a user’s behalf. For a company that has promised users short retention, honored deletion requests or committed to not training on customer conversations, a government preservation order and a deletion obligation can pull in opposite directions. The bill does not say how that conflict would be resolved, and its FOIA exemption means the public would learn little about how it was.

The same section requires notice to operators and users “to the extent practicable.” For a business that has built a product on top of a covered model, that is the only advance warning it may get, and it is not a service-level commitment.

7. What a company that uses AI should do now

None of the bills would take effect without further steps, so there is no compliance deadline to meet. The useful work is the kind that pays off whichever bill moves. This is not legal advice, and none of these steps guarantees a particular outcome under a future rule.

1. List every AI system and agent you run, and who supplies it. Include embedded features in vendor software. For each, record the model provider, what data it touches and what actions it can take.
2. Find the human off switch for each agent you operate. Name the person who can use it, how long it takes and what happens to in-flight work. If the answer is “someone would call the vendor,” write that down.
3. Test it. A documented kill procedure that has never been run is a hope, not a control. Run it in a non-production setting, record the result and repeat after major changes.
4. Plan for an upstream shutdown. If your model provider throttled or suspended access tomorrow, which features fail, which customers notice and is there a fallback model or a graceful degradation path? Read your vendor contracts for suspension notice terms.
5. Map telemetry and retention. Know which logs and conversation records each system keeps, for how long and where. Decide in advance how you would handle a preservation demand alongside user deletion requests.
6. Define your own trigger events. Concealment, tampering with logs, acting outside permissions and contact with systems the agent was not authorized to reach are reasonable internal triggers regardless of what Congress adopts.
7. Keep evidence. Retain test results, incident records and approvals so you can show what controls existed and when they last worked.

How Captain Compliance supports this work

Captain Compliance’s artificial intelligence advisory work covers governance structures, accountability mechanisms, continuous monitoring of AI systems and assessment of third-party AI solutions. In the software, the AI governance module is built to document the AI a company builds, buys and permits, including agent tools, permissions, connected systems, permitted actions and human-approval checkpoints, and to keep incident and complaint records, assigned controls and evidence. It can record that a human escalation path exists, who owns it and when it is next due for review. It cannot make a vendor’s model stoppable, and it does not decide whether a bill would apply to you. We also keep an explainer on why an AI inventory comes first, and our coverage of the Hugging Face agent incident shows the kind of event these proposals have in mind.

Frequently asked questions

Is an AI kill switch required by law today?

No federal law requires one. H.R. 9917 and S. 5417 are introduced bills that have been referred to committees. California’s executive order asks for recommendations and does not impose a requirement on companies.

Would H.R. 9917 apply to my company?

Probably not if you only deploy someone else’s model. A covered entity under the bill must operate a covered technology, offer it to third parties and earn at least $500 million a year from it, with a compute-cost threshold of $100 million for the system. DHS could change the definitions by rule, so the scope in a final regime might differ.

Does the AI Emergency Button Act have penalties?

The introduced text contains none, and it does not define “advanced” AI or list shutdown triggers. It requires a human-operable shutdown capability and tells DHS to write compliance regulations within 90 days of enactment.

What is the difference between “kill switch” and “graduated deployment corrections”?

H.R. 9917 treats full shutdown as the most severe option on a scale that includes throttling inference, limiting user access or compute, disabling a capability, suspending the system and switching to a backup or earlier version. The scale is meant to match the response to the severity and immediacy of the risk.

Could a shutdown order conflict with privacy obligations?

It could. H.R. 9917 requires a company under order to preserve model weights and telemetry, and telemetry can contain personal data. The bill does not address how that interacts with deletion requests or retention commitments, so companies should decide their approach in advance with counsel.

Can open-source models be shut down under these bills?

Not in any obvious way. Once weights are downloaded, the developer has no control over a copy. Lawfare reports that Lieu has said the House bill would not cover open-weight models.

Has California created a kill switch requirement?

No. Executive Order N-9-26 asks experts to recommend changes to state law, including advancing a kill switch for frontier models with independent verification. Any requirement would need further action.

The two federal bills are inverses of each other. H.R. 9917 has definitions, deadlines and penalties, but it reaches only companies that spend more than $100 million on compute and book half a billion dollars from an AI product. S. 5417 reaches anyone who “operates” an “advanced” system, but it never says what advanced means or who decides. A company that is outside the first bill could still land inside the second, and it would not find out until DHS wrote the rule. Whichever bill moves, the practical question for most businesses is the same one: when someone upstream pulls the plug, what stops working in your operation, and who finds out first?