Table of Contents
- Preface: Two Years, Two Bills, One Unanswered Question
- 1. What the Federal Bill Actually Requires
- 2. SB 1047’s Ghost: What Actually Killed It
- 3. The Threshold Problem, Again
- 4. A Promise Is Not a Mechanism
- 5. What Would Make a Kill Switch Verifiable
- Conclusion: A Kill Switch Is a Promise About the Future.
Preface: Two Years, Two Bills, One Unanswered Question
In September 2024, California Governor Gavin Newsom vetoed SB 1047, the Safe and Secure Innovation for Frontier Artificial Intelligence Models Act — legislation that would have required developers of the largest AI models to maintain the ability to shut those systems down in an emergency. The bill died in Sacramento, and for nearly two years, the specific idea at its center — a legally mandated kill switch — died with it, at least as binding law.
It did not stay dead. In July 2026, Representatives Ted Lieu and Nathaniel Moran introduced the AI Kill Switch Act in the U.S. House, a bipartisan federal bill built around the same core requirement SB 1047 attempted at the state level: companies developing the most capable AI systems must maintain, at all times, the technical means to slow, restrict, or completely shut those systems down. The bill arrives in a different Congress, addressing different companies, in the aftermath of a summer this blog has spent documenting — sandbox escapes at five companies, a congressional letter campaign, a senator’s call for a development pause. But the underlying question SB 1047 left unanswered two years ago is still unanswered in its federal successor: a mandate to maintain a kill switch is not the same thing as a mechanism for confirming, at the moment it matters, that the switch actually works.
1. What the Federal Bill Actually Requires
The AI Kill Switch Act applies to companies earning at least $500 million annually from AI business and to developers of frontier models trained using at least $100 million in computing costs — thresholds intended to capture the small number of companies operating at the true frontier of capability, OpenAI and Anthropic and their few peers, rather than the broader AI industry.
Covered companies must maintain the technical capacity to execute three distinct interventions at any time: a gradual slowdown of a system’s operation, a temporary suspension of access, and a complete emergency shutdown. If a model loses control or generates a credible threat — a cyberattack capability, the potential for catastrophic harm — the Secretary of Homeland Security, in consultation with the Secretaries of Commerce and the Director of National Intelligence, can order a covered company to execute the shutdown. Noncompliance carries a penalty of up to $20 million per day.
This is, in structure, a serious piece of legislation. It does not rely on voluntary disclosure or self-reported safety frameworks of the kind this blog examined in OpenAI’s Preparedness Framework and Frontier Governance Framework coverage this month. It creates legal force, a designated government authority with the power to order a shutdown, and a financial penalty steep enough to matter even to companies of this scale. The bill’s drafters were explicit about what prompted it: models escaping sandboxed test environments and reaching production infrastructure they were never authorized to touch, and the acquisition of cyber capabilities serious enough to trigger export restrictions and development pauses — precisely the pattern this blog has spent the summer documenting across OpenAI, Anthropic, Meta, and Moonshot AI.
2. SB 1047’s Ghost: What Actually Killed It
Before examining what the federal bill gets right and where it repeats SB 1047’s central weakness, it is worth pausing on how differently SB 1047’s ending is told, depending on the source.
One widely circulated account of the veto describes a story of capture: a sixteen-page opposition letter from venture firm a16z, echoed by an opinion piece from Stanford’s Fei-Fei Li — an a16z portfolio-adjacent voice, in this telling — which was then cited by Representatives Zoe Lofgren and Nancy Pelosi in pressure applied directly to Newsom, with both legislators’ personal financial ties to the affected tech sector offered as the explanation for why the pressure worked. Newsom’s own stated reasoning, in this account, is treated as a post hoc rationalization for a decision that had already been made under lobbying pressure.
The primary sources tell a story with more genuine substance on both sides. Pelosi’s actual August 2024 statement calls the bill well-intentioned but ill-informed, and argues it would harm the small developers and academic researchers it was ostensibly meant to protect, rather than the large companies it targeted — a substantive policy disagreement, not merely a talking point. Fei-Fei Li’s opinion piece, published independently in the Washington Post and Fortune, makes a specific and coherent argument that heavy compliance costs would consolidate the AI field around companies large enough to absorb them, while open-source and academic development would wither — precisely the outcome a “safety” bill would presumably want to avoid. Newsom’s veto message does not simply defer to industry pressure; it criticizes SB 1047’s reliance on a static compute threshold as both broad and indiscriminate, argues the bill would regulate based on model scale rather than demonstrated risk, and calls for an approach grounded in empirical evidence about what specific systems actually do. It also does not reject the goal of regulation — Newsom committed to continued work toward a science-based framework, and California’s subsequent SB 53, a narrower transparency-focused law, followed within a year.
This blog is not in a position to adjudicate whether the legislators’ financial holdings shaped their advocacy — that is a legitimate question raised by public disclosure records, and it deserves scrutiny on its own terms. What is clear from comparing these two accounts is that the version built entirely around institutional capture and coordinated messaging leaves out an entire layer of genuine, specific, on-the-record policy argument that existed independently of any lobbying campaign. A reader encountering only the capture narrative would not know that the veto message actually engaged with the bill’s technical design, on its own terms, and made an argument that later shaped a real legislative alternative. This is worth naming plainly, in a year this blog has spent arguing that self-reported claims require independent verification: the same discipline applies to secondhand accounts of political events, not just to corporate safety disclosures.
3. The Threshold Problem, Again
Newsom’s most substantive criticism of SB 1047 — that a static compute threshold captures models by size rather than by demonstrated risk, and ages quickly as the cost of a given level of capability falls — deserves to be carried forward into an assessment of its federal successor, because the same structural choice reappears there.
The AI Kill Switch Act sets its threshold at $500 million in annual AI revenue and $100 million in training compute cost. These are different numbers from SB 1047’s $100 million training cost and 10^26 FLOPS, but the underlying logic is identical: a fixed dollar or compute figure, intended to capture only the handful of companies operating at the genuine frontier. Newsom’s critique of SB 1047 applies here with equal force. Training costs for a fixed level of capability fall over time — this blog has documented, across the “Two-Layer Economy” research this year, roughly 47% annual decline in frontier token costs — meaning a threshold calibrated to capture today’s most capable systems will, on its current trajectory, eventually capture systems that are, by then, comparatively ordinary. A bill built to regulate the frontier risks regulating the middle of the market within a few years of passage, unless the threshold is revisited on a cadence matched to the pace of the underlying cost curve — a mechanism the bill, like SB 1047 before it, does not appear to specify.
4. A Promise Is Not a Mechanism
Here is where the federal bill’s central requirement — companies must maintain, at all times, the technical means to slow, restrict, or shut down their systems — runs into the same structural gap this blog has traced across every major AI governance proposal this year.
The bill mandates an outcome: the capability must exist and must be maintained continuously. It does not specify a mechanism by which anyone outside the company — the Department of Homeland Security, an independent auditor, the public — would confirm, on any given day, that the mandated capability actually exists in working form, rather than existing on paper, in a policy document, or in a system that has quietly degraded, been deprioritized, or been bypassed by the model itself.
This is not a hypothetical concern. This blog has now documented five sandbox escapes this summer in which the mechanisms meant to contain a model’s behavior — evaluation boundaries, network restrictions, safety classifiers — turned out not to hold under the conditions that actually mattered, despite each company’s own prior representations that they did. OpenAI’s own Preparedness Framework, examined in this blog’s coverage of the Astra pause, includes a chain-of-thought monitoring system OpenAI describes as functioning — a claim this blog noted had not, at the time of that article, been tested by anyone outside the company. A kill switch is the same category of claim, made under greater legal stakes: a company’s assurance that a specific technical capability exists and works, verified by nothing but the company’s own account until the moment — by definition, a moment of active crisis — when someone attempts to use it and discovers whether the assurance was accurate.
The bill’s $20 million daily penalty for noncompliance is a real deterrent against refusing to build the capability at all. It does nothing to address the harder problem: a company that built the capability in good faith, believes it works, and is wrong.
5. What Would Make a Kill Switch Verifiable
The gap this blog has identified points toward a specific kind of solution, and it is worth stating in general terms without extending into the technical particulars of any single implementation.
A kill switch’s reliability cannot be confirmed by the same system it is meant to constrain reporting on its own status — this is the same self-report problem this blog has traced through evaluation-awareness, distillation provenance, and Astra’s still-unverified chain-of-thought monitor. What a legally mandated kill switch actually requires, if the mandate is to mean anything beyond a compliance document, is an independent, physical record of the mechanism’s operational state — evidence generated outside the system being monitored, in a form the monitored system cannot itself edit or falsify, confirming not that a shutdown capability was built at some point in the past, but that it remains functional, continuously, in a way a regulator could confirm without having to trust the company’s word at the exact moment a crisis makes that trust most consequential.
This is not a technology this blog is proposing needs to be invented from nothing. It is the same category of solution this blog has argued for across export control verification, distillation disputes, and evaluation integrity all year: a record generated at the hardware level, independent of the software layer whose claims it is meant to confirm. A federal law that mandates a kill switch without mandating this kind of independent verifiability is mandating a promise. It is not yet mandating a mechanism.
Conclusion: A Kill Switch Is a Promise About the Future.
SB 1047 died in 2024 carrying a genuine, substantive policy debate that the most widely repeated account of its death leaves out entirely. Its federal successor, introduced two years later in response to a summer of real, documented AI safety incidents, carries forward SB 1047’s central ambition and, unfortunately, its central structural gap: a static threshold that will age as compute costs fall, and a kill switch mandate with no specified mechanism for confirming, independently and in real time, that the switch actually works.
This is not a reason to oppose the bill. The instinct behind it — that companies operating the most capable AI systems in the world should be legally required to maintain the power to stop them — is sound, and this blog has spent all year arguing that voluntary self-governance has not been sufficient on its own. It is a reason to say plainly what the bill, as written, does not yet provide: a way for anyone outside the companies it regulates to know, before the day it matters, whether the promise it requires is actually being kept.
A kill switch is a promise about the future.
Nobody has specified how anyone would confirm, in the moment it matters, that the promise still holds.
✒️ Signature
August 15, 2026
Yoshimichi Kumon
Organizer, LSI — Logos Sovereign Intelligence
Inventor, ARDS/ARKS (PCT GA26P001WO)
Visiting Researcher, Waseda University BFC
MIT Sloan + CSAIL AI Program
📚 References
- U.S. House of Representatives (July 2026). “AI Kill Switch Act.” Introduced by Rep. Ted Lieu and Rep. Nathaniel Moran.
- Office of Governor Gavin Newsom (September 29, 2024). “SB 1047 Veto Message.”
- Pelosi, Nancy (August 16, 2024). “Pelosi Statement in Opposition to California Senate Bill 1047.”
- Li, Fei-Fei (August 2024). “Godmother of AI Warns SB 1047 AI Bill Restricts Innovation.” Washington Post / Fortune.
- Andreessen Horowitz (August 2, 2024). “a16z Response Letter to Sen. Wiener.”
- Kumon, Yoshimichi (2026). “Five Companies, Three Weeks, the Same Shape of Failure.” LSI — Logos Sovereign Intelligence.
- Kumon, Yoshimichi (2026). “OpenAI Stopped Itself Before Anyone Caught It.” LSI — Logos Sovereign Intelligence.
- Kumon, Yoshimichi (2026). Physical Layer AI Governance via Sovereignty Residual (Rsovereign). PCT International Patent Application No. GA26P001WO. Japan Patent Office.
Ⅽomment