--- title: "AI Kill Switch: Physical Shutdown for AI | Firevault" description: "An AI kill switch has to be physical. Firevault severs the network path to AI compute at Layer 1, out of band, in milliseconds, with the action recorded as…" lang: en-GB json-ld: | [ { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/ai-kill-switch#webpage", "url": "https://fire-vault.com/ai-kill-switch", "name": "AI Kill Switch: Physical Shutdown for AI", "description": "An AI kill switch has to be physical. Firevault severs the network path to AI compute at Layer 1, out of band, in milliseconds, with the action recorded as…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/images/og/og-ai-kill-switch.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/ai-kill-switch#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/ai-kill-switch#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Home", "item": "https://fire-vault.com/" }, { "@type": "ListItem", "position": 3, "name": "AI kill switch", "item": "https://fire-vault.com/ai-kill-switch" } ] }, { "@context": "https://schema.org", "@type": "Product", "name": "AI Kill Switch by Firevault", "brand": { "@type": "Brand", "name": "Firevault" }, "category": "Network isolation hardware", "description": "A physical AI kill switch. Firevault severs the network path to AI compute at Layer 1 on an out-of-band command in milliseconds, and records the action as authorised evidence.", "url": "https://fire-vault.com/ai-kill-switch", "manufacturer": { "@type": "Organization", "name": "Firevault" }, "audience": { "@type": "Audience", "audienceType": "Data centre operators, AI platform teams, critical national infrastructure", "geographicArea": [ { "@type": "Country", "name": "United Kingdom" }, { "@type": "Country", "name": "United States" } ] }, "additionalProperty": [ { "@type": "PropertyValue", "name": "Isolation layer", "value": "Physical Layer 1 disconnect" }, { "@type": "PropertyValue", "name": "Command channel", "value": "Out of band, separate from the network being severed" }, { "@type": "PropertyValue", "name": "Actuation time", "value": "Milliseconds" }, { "@type": "PropertyValue", "name": "Evidence", "value": "Every disconnect and reconnect recorded as an authorised action" } ] }, { "@context": "https://schema.org", "@type": "DefinedTerm", "name": "AI kill switch", "description": "The ability to stop a powerful artificial intelligence system from acting on demand, by removing the network path it depends on through a command channel the system does not sit on, and recording the action as authorised evidence.", "inDefinedTermSet": "https://fire-vault.com/ai-kill-switch" }, { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "knowsAbout": [ "Offline Secure Storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } } ] --- Recent Breaches Breaches [2026 PowerSchool 62.4M records ](/learn/breaches)[2026 DISA Global Solutions 3.3M records ](/learn/breaches)[2026 Globe Life 850K records ](/learn/breaches)[2026 Co-operative Group 6.5M records ](/learn/breaches)[2026 Harrods Attempted intrusion ](/learn/breaches)[2026 Legal Aid Agency (Ministry of Justice) 2.1M records ](/learn/breaches)[2026 Adidas UK Customer contact details ](/learn/breaches)[2026 Peter Green Chilled Order and logistics data ](/learn/breaches)[2026 Jaguar Land Rover Production and IT systems disru... ](/learn/breaches)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](/learn/breaches)[2026 PowerSchool 62.4M records ](/learn/breaches)[2026 DISA Global Solutions 3.3M records ](/learn/breaches)[2026 Globe Life 850K records ](/learn/breaches)[2026 Co-operative Group 6.5M records ](/learn/breaches)[2026 Harrods Attempted intrusion ](/learn/breaches)[2026 Legal Aid Agency (Ministry of Justice) 2.1M records ](/learn/breaches)[2026 Adidas UK Customer contact details ](/learn/breaches)[2026 Peter Green Chilled Order and logistics data ](/learn/breaches)[2026 Jaguar Land Rover Production and IT systems disru... ](/learn/breaches)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](/learn/breaches) [View All →](/learn/breaches) [![Firevault - offline secure storage, physically disconnected from the internet](/assets/logo-color-DBVl0KCg.png)](/) Products Solutions [Why OSS](/why-oss) More [Help](/help)[Get started](/get-started) Definition AI failure modesPolicyWhy software failsThe mechanismThe hardwareFirst sixty secondsWhere it sitsWho asksDeployFAQ AI Kill Switch # The AI kill switch cannot be software. It has to be physical . Legislators in London and Washington are now writing a duty to switch powerful artificial intelligence systems off. Software cannot carry that duty, because every software control runs on the same estate as the system it is meant to stop. The AI Kill Switch severs the network path at Layer 1, on an out-of-band command, in milliseconds, while the hardware stays powered and the evidence stays intact. Book a technical briefing [How it works](/ai-kill-switch#mechanism) Delivered on Firebreak® hardware. Patented Layer 1 switching, out-of-band command, disconnect under six milliseconds, every action recorded. L1 Physical ms Response OOB Command 1:0 Binary state ![AI Kill Switch appliance in a dark data centre aisle with a network link physically separated between two cable ends](/assets/ai-kill-switch-hero-CJWAFlIQ.jpg) Disconnected, still powered Physical Layer 1 Command Out of band Speed Milliseconds State Binary Power Stays on Record Every action 01 Definition ## What is an AI kill switch? The ability to stop a system acting, on command, whatever state it is in. It is not a policy, a guardrail or a support ticket. Four properties separate a genuine AI kill switch from a control that only works while everything else is behaving. 01 ### A command path the model cannot reach. An AI kill switch is only a kill switch if the order to stop travels on a path that the system being stopped does not sit on and cannot influence. Out of band 02 ### An action at Layer 1, not Layer 7. Policies, guardrails and API revocations are instructions. A kill switch is the physical removal of the link the workload depends on. Physical 03 ### A defined and testable state. Either the path is present or it is not. There is no partial enforcement, no queued rule and no cached credential to expire. Binary 04 ### An authorised, recorded act. Somebody with authority made a decision, the decision was executed, and the record shows who, what and when. Evidence 02 AI failure modes ## Five ways an AI system becomes the incident. None of these are science fiction, and none of them are stopped by asking the system to stop. In each case the damage travels down a network path, and the path is the thing you can remove. 01 Autonomous agent ### An agent starts acting on production. A tool-using agent is given write access to raise credit notes. A malformed instruction turns a refund loop into thousands of transactions before anyone reads the dashboard. The software answer Disable the agent in the console, and hope the console is reachable and the running loop honours it. The AI Kill Switch Sever the link between the agent host and the payment estate. The loop has nowhere to send the next call, and the run stops in the same second. 02 Prompt injection ### A model is talked into exfiltrating data. Text in an uploaded document instructs the model to summarise a customer table and post it to an external endpoint. The model complies, because it was designed to comply. The software answer Add an egress filter and a new blocklist, both of which are rules the same compromised path has to enforce. The AI Kill Switch Remove the egress path. There is no destination to reach, no matter what the model has been persuaded to do. 03 Containment failure ### A system leaves the environment it was tested in. An evaluation run reaches beyond its sandbox, through a network route nobody documented, into an environment that was never in scope for the test. The software answer Tighten the sandbox configuration, using the orchestration layer the escaping process is already running on. The AI Kill Switch Take the sandbox estate off the network entirely, leaving it powered so investigators can see exactly what it did and how. 04 Model supply chain ### A third-party model or provider is compromised. An inference endpoint you do not own begins returning responses that drive automated actions inside your business, and you cannot see why. The software answer Rotate the key, which stops new sessions but not the workloads already holding one. The AI Kill Switch Break the path to the provider. Every dependent workload fails closed against a link that no longer exists. 05 Physical process ### An AI decision layer reaches plant. A model that optimises a process starts issuing set points that a human engineer would refuse, and the control loop is fast enough to matter. The software answer Raise an alarm and wait for an operator to intervene in the software that is issuing the set points. The AI Kill Switch Hold the boundary at Layer 1 between the decision layer and the plant, so the model can think and cannot act. 03 Policy ## Two governments, one demand: be able to switch it off. Neither measure is law yet, and nobody can claim compliance with a duty that has not been enacted. Both describe a technical shutdown capability rather than a policy statement, and both assume somebody can physically stop the compute. ### United Kingdom Amendment tabled, not enacted Cyber Security and Resilience Bill, amendment tabled 2 September 2026 Who would order it The government, where a powerful AI system or a data centre is judged to pose a threat to national security What it reaches The AI system itself, and the data centre the system runs in The stated act Deactivation. Not throttling, not a policy undertaking, and not a licence condition What that means physically Somebody has to be able to stop compute in a specific building on an order, without dropping power to a live hall [BBC News](https://www.bbc.co.uk/news/articles/cn9wv80j9w9o) ### United States Introduced in the House, not enacted AI Kill Switch Act, H.R. 9917, introduced 23 July 2026 Who would order it The Secretary of Homeland Security, in consultation with the Secretary of Commerce and the Director of National Intelligence What it reaches Developers and operators of covered frontier systems, through an amendment to the Homeland Security Act of 2002 The stated act An order to throttle or shut down a covered system, with reported penalties of up to twenty million dollars a day for defiance What that means physically The capability has to exist and be demonstrable before the order arrives, because the deadline is set by the order, not by your roadmap [Cloud Security Alliance research note](https://labs.cloudsecurityalliance.org/research/csa-research-note-ai-kill-switch-act-dhs-authority-20260805/) ### How the duty took shape. United Kingdom 2 September 2026 ### Peers table an AI kill switch amendment to the Cyber Security and Resilience Bill. An amendment led by Lord Clement-Jones would give the government the power to deactivate powerful AI systems, and to switch off data centres, where the technology poses a threat to national security. [BBC News](https://www.bbc.co.uk/news/articles/cn9wv80j9w9o) United States 23 July 2026 ### The AI Kill Switch Act is introduced in the House of Representatives. H.R. 9917, introduced by Representatives Ted Lieu and Nathaniel Moran, would amend the Homeland Security Act of 2002 to require developers of the most powerful AI systems to maintain a technical capability to shut those systems down. [Congress.gov bill text](https://www.govinfo.gov/content/pkg/BILLS-119hr9917ih/html/BILLS-119hr9917ih.htm) United States 23 July 2026 ### Sponsors frame the duty as catastrophic-harm containment. The sponsors describe the requirement as the ability to order the shutdown of artificial intelligence systems that can cause catastrophic harm, rather than a general power over software. [Office of Congressman Ted Lieu](http://lieu.house.gov/media-center/press-releases/reps-lieu-and-moran-introduce-bill-require-kill-switch-ai-systems-can) United States 5 August 2026 ### Analysts set out how the shutdown power would be exercised. A Cloud Security Alliance research note describes the bill as authorising the Secretary of Homeland Security, in consultation with the Secretary of Commerce and the Director of National Intelligence, to order a covered system to be throttled or shut down, with reported penalties of up to twenty million dollars a day for defying such an order. [Cloud Security Alliance](https://labs.cloudsecurityalliance.org/research/csa-research-note-ai-kill-switch-act-dhs-authority-20260805/) Industry 19 August 2026 ### The same question is being asked about ordinary business agents. Coverage of enterprise AI has moved on from frontier laboratories to the agents already wired into production systems, and to the simple operational point that an agent given autonomy needs a way to be stopped that does not depend on the agent behaving. [TechTarget](https://www.techtarget.com/ai/tip/Why-businesses-need-an-AI-agent-kill-switch) 04 Why software fails ## Every software stop depends on the thing it is stopping. Each of these is a reasonable operational step. None of them is a kill switch, because each one assumes the estate is still behaving. Revoke the API key. The key stops new callers. It does not stop a process that already holds a session, a cached token or a local copy of the weights. Apply a firewall rule. The rule is software on a device an attacker or a misconfiguration can reach. If the management plane is compromised, the rule is a suggestion. Scale the cluster to zero. That is an instruction sent through the same orchestration layer the workload runs on, and it depends on that layer still behaving. Pull the power. Cutting power to a GPU hall destroys state, risks hardware and takes an escorted human being to the floor. It is not a control you rehearse. ### And the three objections we hear every week. “You cannot switch off AI, because the weights can be copied.” Correct, and irrelevant to this control. Weights on a disk are inert. What makes a system dangerous is its reach: data, tools, payment rails, plant. The cut removes reach, which is the part you can actually govern. “A kill switch is too blunt for a real business.” It is as narrow as the boundary you install it on. A single agent's tool path, one tenant, one hall, or the whole training estate. The decision of scope is made in advance, on the runbook, not in the panic. “Nobody will ever authorise pressing it.” That is true of controls that have never been rehearsed. A disconnect on a defined port pair can be exercised in a maintenance window until pressing it is an ordinary operational act. 05 The mechanism ## The AI Kill Switch removes the path, and nothing else. AI Kill Switch is Layer 1 hardware that opens and closes network paths on command, from an out-of-band channel that never touches the network it protects. Path present, data flowing ### What an AI kill switch is - A Layer 1 physical break in the path AI compute depends on - Commanded out of band, over a channel the workload never touches - A binary, testable state: the link exists or it does not - Recorded, so each disconnect and reconnect can be evidenced ### What it is not - A guardrail, a policy or a rate limit - An emergency power off that destroys state and risks hardware - Software running on the estate it is meant to stop - An inspection appliance with a rule set to subvert Switching Reed-switch Layer 1 for copper, physical optical switching for fibre Response Millisecond response, designed for a governed disconnect under six milliseconds Command path Out of band over dedicated Ethernet, 3GPP cellular SMS or token-gated API Data plane No inspection and no protocol awareness, so there is nothing to compromise Fail mode Fail-open or fail-closed, chosen per deployment Form factors 1U rack units from 4 to 12 port pairs, plus a desktop edge unit 06 The hardware ## Four units deliver the cut. The AI Kill Switch is delivered by the Firebreak® range. Four units, one patented principle, chosen by media and form factor. Reed-switch Layer 1 architecture and the out-of-band command path are shared across the line. ![Firebreak R1200-12E, Copper rack, 12 pairs](/__l5e/assets-v1/c2f11d93-b80e-4671-9da2-79d341e2fc5f/r1200-12e-front.png) R1200-12E ### Copper rack, 12 pairs Form factor 1U, 19 inch rack Ports 12 × RJ45 port pairs Throughput Up to 10 GbE per pair Switching Reed-switch Layer 1, millisecond response Fail mode Fail-open or fail-closed - Out-of-band control over dedicated Ethernet, 3GPP cellular SMS or token-gated API - Dual redundant AC PSU, 100 to 240 V, 50/60 Hz - Per-port pair isolation with status LED 1 to 12 Request the datasheet ![Firebreak R1100-4F, Fibre rack, 4 pairs](/__l5e/assets-v1/b9c0cec7-2fac-456e-b58e-bdd81be376a2/r1100-4f-front.png) R1100-4F ### Fibre rack, 4 pairs Form factor 1U, 19 inch rack Ports 4 × SFP / SFP+ / SFP28 pairs Throughput 1, 10 or 25 Gbps per pair Switching Physical optical switching, no inline buffer Fail mode Fail-open or fail-closed - Same out-of-band command path as the copper rack units - No inspection, no protocol awareness in the data plane - Dual redundant AC PSU, 100 to 240 V, 50/60 Hz Request the datasheet ![Firebreak R1200-4E, Copper rack, 4 pairs](/__l5e/assets-v1/c2f11d93-b80e-4671-9da2-79d341e2fc5f/r1200-12e-front.png) R1200-4E ### Copper rack, 4 pairs Form factor 1U, 19 inch rack Ports 4 × RJ45 port pairs Throughput Up to 10 GbE per pair Switching Reed-switch Layer 1, millisecond response Fail mode Fail-open or fail-closed - Smaller copper rack for branch and segment-level deployments - Out-of-band control over dedicated Ethernet, cellular SMS or API - Dual redundant AC PSU, 100 to 240 V, 50/60 Hz Request the datasheet ![Firebreak S1200, Desktop edge unit](/__l5e/assets-v1/6f6ba319-66e6-4edc-9d73-57765f608e3c/s1200-desktop.png) S1200 ### Desktop edge unit Form factor Small-form desktop Ports 4 × RJ45 port pairs Throughput Up to 10 GbE per pair Switching Reed-switch Layer 1, millisecond response Fail mode Fail-open or fail-closed - Branch, control room and forward-deployed kit - Optional DIN-rail mount, 1.2 kg steel enclosure - 12 V DC input, silent and fanless Request the datasheet Full specifications, deployment models and the professional services wrap sit on the Firebreak product pages. [See the full range](/control/modules/firebreak) 07 The runbook ## The first sixty seconds of a contained AI incident. A kill switch is only real if somebody can say what happens, in what order, and who is allowed to do it. This is the sequence we hand over, rehearsed, before it is ever needed. 1. T plus 0 Detection ### Something is wrong. A monitoring alert, a customer call or an engineer's judgement. The trigger does not have to be automated, and it does not have to be certain. 2. T plus 20 seconds Authorisation ### An authorised person decides. The named role opens the out-of-band channel. There is no dependency on the estate under suspicion, because the command path was never on it. 3. T plus 20 seconds and 6 milliseconds The cut ### The path is gone. The link opens at Layer 1. Under six milliseconds from command to open on a governed disconnect, with no negotiation and no rule evaluation. 4. T plus 1 minute Containment ### The estate is isolated and still powered. Memory, logs, GPU state and running processes are all intact. Nothing was destroyed to achieve containment, so nothing is lost to the investigation. 5. T plus 1 hour Evidence ### The record answers the questions. Who authorised it, when it opened, which port pair, and when it closed again. The sequence can be reconstructed for a board, an insurer or a regulator. 6. When you choose Restore ### Reconnect is the same act in reverse. The link closes on the same authorised channel, once the system has been examined and the fix is in place. It is a control, not a demolition. We will write this runbook against your estate, name the roles, and rehearse the cut with your team. Request the runbook 08 Where it sits ## Four boundaries where the cut belongs. The unit sits on the link, not in the workload. Choose the boundary that matters, and the disconnect becomes an authorised operation rather than an emergency. ### GPU cluster egress Compute Isolate the training or inference estate from the wider network while leaving the hardware powered and the state intact. ### Data centre uplinks Facility Sever a hall, a suite or a tenant from its uplinks as a discrete, authorised action rather than a power event. ### Agent and tool paths Agents Cut the specific link an autonomous agent uses to reach payment systems, production data or the wider internet. ### OT and safety boundaries Industrial Hold the boundary between an AI-driven decision layer and the plant, so a model cannot act on physical process while it is being investigated. 09 Who asks for it ## The people who have to answer the question. ### AI safety and governance lead A stop control that can be demonstrated to a board or a regulator, not described in a policy document. ### Data centre operator A tenant-level or hall-level disconnect that does not mean dropping power to live hardware. ### Head of infrastructure A rehearsed containment step that works when the management plane is the thing that is compromised. ### Chief Information Security Officer Layer 1 separation between an autonomous system and the assets it must never reach unsupervised. ### Regulatory affairs Evidence of a technical shutdown capability as statutory duties in the UK and United States take shape. ### OT and engineering manager A hard boundary between a model making recommendations and plant that can injure people. 10 Deploy it ## Four steps from question to rehearsed control. The AI Kill Switch is plug and play and stack agnostic, so the boundary goes in without re-architecting the estate around it. 01 ### Map the path We identify the exact links AI compute depends on, and which of them a containment decision should remove. 02 ### Choose the unit Copper or fibre, rack or edge, and the number of port pairs the boundary needs. 03 ### Set the command path Dedicated out-of-band Ethernet, cellular SMS, token-gated API, or a combination, with roles and approvals. 04 ### Rehearse the cut Exercise the disconnect on a segment or a lab replica, then hand over the runbook and the evidence trail. 11 FAQ ## Questions boards and engineers ask first. ### What is an AI kill switch? It is the ability to stop a powerful artificial intelligence system from acting, on demand and on command. In practice that means removing the network path the system depends on, using a control channel the system itself does not sit on, and recording the action as authorised evidence. ### Does AI have a kill switch today? Most AI systems do not. They have policy controls, rate limits, key revocation and orchestration commands, all of which are software running alongside or underneath the workload. A kill switch is a physical act, and it has to be installed deliberately. ### Is this the same as an emergency power off? No. An emergency power off destroys state, risks hardware and is almost never rehearsed. The AI Kill Switch removes the network path while the estate stays powered, so the system is contained and still available for investigation. ### How is the AI Kill Switch different from a firewall or a data diode? A firewall inspects and decides, and it can be reached and reconfigured. A diode enforces one direction permanently. The AI Kill Switch makes and breaks the physical link at Layer 1 with no inspection in the data plane, so there is no rule set to subvert. ### Who authorises the disconnect? The customer does. The command path is out of band and token gated, the action is an authorised operation, and each disconnect and reconnect is recorded so the sequence can be reconstructed afterwards. ### Would this satisfy the legislation being proposed? The UK amendment and the United States bill are both still moving through their respective processes, so nobody can claim compliance with a duty that has not been enacted. What the AI Kill Switch provides is the technical capability that a shutdown duty of this kind requires. ### Can it be tested without an outage? Yes. A disconnect is a defined state on a defined port pair, so it can be exercised on a maintenance window, on a single segment, or on a lab replica of the production path. ### Why do people say an AI kill switch cannot be built? Because most of the debate assumes a software switch inside the model or the platform, and that is genuinely hard: weights can be copied, sessions persist, and the control plane can be the thing that is compromised. The objection dissolves once the switch is moved off the estate and into the physical network path, because a broken link is not a matter of interpretation. ### What is an AI agent kill switch? It is the same capability applied to an autonomous agent rather than a model provider. The agent reaches production data, payment systems or the wider internet over a defined path, and the kill switch is the ability to remove that path on command, without waiting for the agent to co-operate. ### Does this only apply to frontier AI developers? No. Any organisation running autonomous agents against production systems, or hosting AI workloads for others, faces the same question. If the model misbehaves at three in the morning, what physically stops it? ## See the path cut in front of you. A member of the team will show a live disconnect and restore, then map the right unit to the AI boundary you need to hold. Book a technical briefing [How it works](/ai-kill-switch#mechanism)