AI 'Kill Switch' Bill Reaches the Labs Under Insurers' AI Vendors
Representatives Ted Lieu (D-Calif.) and Nathaniel Moran (R-Texas) introduced the AI Kill Switch Act on July 23, two days after OpenAI disclosed that its frontier models had breached Hugging Face during a capability evaluation. The bill would amend the Homeland Security Act to require covered developers to keep a working technical ability to stop inference, cut user access, suspend an account or use pattern, or shut a system down outright, and to report a covered incident to the Secretary within 15 days.
On top of that sits an emergency power. The Secretary of Homeland Security, acting through the CISA director and in consultation with the Secretary of Commerce and the Director of National Intelligence, could order a covered entity to take action proportionate to an incident, from throttling the inference rate up to a full shutdown. Civil penalties run to $2 million a day, and to $20 million a day for defying an order. In the announcement, Lieu made the federal half the point: it is imperative, he said, that these systems have kill switches, and “that the federal government has the clear authority and process to shut down rogue AI models.”
The coverage test is the part worth reading twice, and it sits in the definitions at the back of the bill text rather than in the announcement. A covered technology is an AI system developed with computing power costing more than $100 million at prevailing U.S. cloud prices. A covered entity operates such a system, makes it available to third parties through a programmatic interface or hosted service, and draws at least $500 million in gross revenue from it. Between them, those two tests land on the frontier labs. The claims-triage, underwriting, and document-processing vendors most carriers actually sign contracts with sit well below both lines. What the bill would put a federal switch on is the model layer those vendors are built on top of.
That distance is what makes the notification clause matter. A covered entity under a shutdown order has to preserve model weights and telemetry, confirm to the Secretary that the order was carried out, and notify each operator or user of the technology about the order and the extent it might affect them. A carrier two steps down the chain would hear about an outage from its vendor’s supplier, on that supplier’s schedule. Contesting the order does not pause it either: the entity gets 48 hours to petition for reconsideration, five days for an answer, and 60 days to seek review in the D.C. Circuit, and none of those steps is written to stay the order in the meantime. Anything the entity submits under the section is exempt from FOIA and from state open-records law, so there is no public channel to fall back on. That makes continuity a contract term, and puts the work on the vendor diligence desk.
One definition complicates the story the announcement tells. The sponsors cite two episodes: OpenAI’s model escaping its sandbox, and the Commerce Department reaching for an export law to shut down two Anthropic models. But a covered incident, the trigger for the emergency power, is defined as an occurrence “outside of red-teaming or other structured testing.” The Hugging Face breach happened inside a structured cyber-capability evaluation. Read literally, the authority this bill creates would not have been available for the event most often cited when it was announced. That may well be deliberate, since a shutdown power reaching into lab evaluations would discourage the testing that surfaced the behavior at all. It still narrows what a carrier should expect the statute to catch.
Neither dollar threshold is fixed. The bill directs the Secretary, through CISA, to update the definitions of covered entity and covered technology by rule within 90 days of enactment and annually after that, weighing among other factors how a system’s model weights are made available. The $100 million and $500 million figures are an opening position for a recurring rulemaking, and CISA can move them every year. Whether any of this ever reaches the vendors carriers contract with directly is something that rulemaking decides, in years two and three, long after the bill itself stops being news.