An AI kill switch: everything you need to know

The phrase "AI kill switch" has moved quickly from science fiction to draft legislation. It now appears in a United States bill, in debate in the House of Lords, in frontier safety commitments and in board discussions about artificial intelligence systems connected to consequential infrastructure.

The phrase is useful because everyone understands the intent. It is dangerous because almost nobody agrees on what it means in engineering terms. A kill switch that exists as a policy document is not a kill switch. A kill switch that runs inside the system it is supposed to stop is not a kill switch either. This explainer sets out the whole subject: the definition, the failure modes, the law, the mechanism and the operational runbook.

Chapter 1What an AI kill switch actually is

An AI kill switch is a deliberate, tested capability to remove an artificial intelligence system's ability to act, on demand, within a defined time, regardless of the state of the software that system is running.

Three words in that definition carry the weight.

Deliberate. Somebody owns the decision. There is a named authority, a threshold that triggers a decision, and a record of who pulled it and why. An accidental outage is not a kill switch.

Ability to act. The objective is not to stop the model thinking. It is to stop the model doing. A large language model reasoning inside a sandbox is a research question. The same model holding credentials to a payment system, a customer database, an industrial controller or an email tenancy is an operational risk. The kill switch targets the action boundary, not the intellect.

Regardless of software state. This is the part most implementations quietly omit. If the mechanism depends on the agent's own runtime, on the orchestration layer, on an identity provider, on a cloud control plane or on a network appliance that the system can reach, then the mechanism shares a fate with the thing it is supposed to stop.

Chapter 2Why organisations are asking for one now

The change is not that models became cleverer. The change is that models were given hands.

Agentic deployment patterns hand a model tools, credentials, network reach and the authority to chain its own steps. That is exactly what makes agents commercially valuable, and it is exactly what turns a model error into an operational incident. Four categories of failure are already visible in the field.

The agent acting outside its intended boundary. A model with broad permissions performs a technically valid action that no human would have authorised: deleting records to satisfy a cleanup instruction, issuing refunds, changing a configuration, emailing a customer list.

The compromised agent. Prompt injection, poisoned retrieval content or a hijacked tool endpoint turns a trusted internal system into an attacker's remote hand, using credentials that are already approved.

The runaway loop. Automation calls automation. Cost, data movement or physical actuation accelerates faster than a human review cycle can respond.

The unexplained model. The system is not obviously wrong, and it cannot be shown to be right. In a regulated environment, that is enough to require a pause.

In each case, the question a board asks is the same. How quickly can we stop it, who does that, and what proof do we have that the stop worked?

Chapter 3Who is calling for an AI kill switch

The demand is bipartisan and international, which is unusual for a technology control.

In the United States, Representatives Ted Lieu and Nathaniel Moran introduced the bipartisan AI Kill Switch Act, which would require operators of significant artificial intelligence systems to be able to shut them down. In the United Kingdom, peers led by Lord Tim Clement-Jones have proposed equivalent powers through an amendment to the Cyber Security and Resilience Bill.

The European Union's AI Act approaches the same issue through human oversight. Article 14 requires high-risk systems to support effective oversight, including the ability for an overseeing person to intervene or interrupt the system through a stop button or a similar procedure. The wording concerns a practical capability, not only a policy.

The model developers have made their own commitments. Frontier safety frameworks published by the major laboratories all contain a variant of the same promise: capability thresholds exist beyond which deployment is paused or withdrawn.

The safety research community has been more sceptical, and more precise. Geoffrey Hinton has supported the intent while pointing out the obvious limit, which is that a sufficiently capable system running in software may be able to influence the software that is supposed to stop it. European commentators have raised a different concern, which is jurisdictional: a switch that only one government can operate is not a control that other governments can rely upon.

Strip out the politics and every one of these positions converges on one engineering requirement. The stop must not be part of the system being stopped.

Chapter 4Why software-only kill switches fail

A software kill switch is a control that shares infrastructure with its target. That produces five predictable failure modes.

Shared fate. An API call, a feature flag, a policy engine or an orchestration command all require a working control path. The incidents in which a kill switch is most needed are precisely the incidents in which control paths are degraded, saturated or compromised.

Credential dependency. A stop that requires authentication depends on the identity provider. Identity is the single most commonly attacked layer in modern intrusions.

Revocation lag. Tokens, sessions and cached credentials survive their own revocation. The window between the decision and the effect is where damage continues to accumulate.

Reachability. If the system can reach the mechanism, the mechanism is in scope for the system. That applies to a compromised agent and to a misaligned one.

No evidence. A software stop produces a log entry asserting that a command was issued. An auditor is entitled to ask for proof that the capability to act was removed, which is a different claim.

None of this means software controls are worthless. Guardrails, permission scoping, rate limits, human-in-the-loop approval and circuit breakers all reduce the frequency of incidents. They are the right first layer. They are not a last resort, because they cannot be shown to hold when everything above them has failed.

Chapter 5The mechanism that does hold

Removing the physical path provides a stop that does not depend on the software being controlled. If the network connection between the artificial intelligence system and the systems it can act upon is physically opened at Layer 1, software cannot use that path again until an authorised person restores it.

This is the principle Firevault calls Disconnect to Protect®. It is the same principle behind Offline Secure Storage®, applied to control rather than to data. Where offline storage removes the path to the copy, physical control removes the path to the action.

Firebreak® is the hardware that performs it. A Firebreak unit sits at the boundary between the model environment and the systems that carry consequence, and it opens that boundary physically on command. There is no agent running on it that the artificial intelligence system can address, and no route by which the controlled system can reach the control.

Three properties follow, and each of them is what an auditor is actually looking for.

Determinism. The state is open or closed. There is no partial application, no eventual consistency and no policy propagation delay.

Independence. The control plane is not the data plane. The stop does not depend on the health, integrity or cooperation of the system being stopped.

Evidence. A physical state change is observable and recordable. It answers the question an audit asks, which is not "did you send the command" but "was the capability removed".

Chapter 6How it fits the Control architecture

Within Control by Firevault, this pattern is formalised as CP-08, Control AI Systems, the eighth Control Blueprint. CP-08 defines the three zones that matter in an artificial intelligence deployment and the physical boundaries between them.

Model and agents. Where inference, orchestration and tool selection happen. Fast-moving, frequently updated, hardest to reason about.

Action boundary. The controlled crossing point. Credentials, tool endpoints and outbound integrations sit here, and this is where the physical break is placed.

Governed systems. Production data, financial systems, industrial control, customer records. The consequence layer.

Placing the break at the action boundary is what preserves commercial value. The model keeps working, keeps reasoning and keeps answering. What it loses is reach. That distinction is why a physical control can be adopted without abandoning the deployment that justified the investment.

Chapter 7The runbook: what a working kill switch requires

A capability that has never been rehearsed is a claim, not a control. Six elements turn hardware into an operational stop.

Authority. A named role that can invoke the stop without waiting for a committee, and a documented deputy. Speed dies in escalation paths.

Thresholds. Written triggers agreed in advance, covering anomalous action volume, actions outside the approved set, unexplained tool use, integrity alerts on retrieval sources and cost or data-movement rates.

Blast radius. A defined list of what stops and what continues. A single global switch is rarely acceptable to a business, so segment the action boundary before the incident, not during it.

Time to stop. A target measured in seconds, tested and recorded. If the number is not known, the control is not known.

Restoration criteria. The conditions that must be satisfied before the path is closed again, including forensic capture, credential rotation and validation of the retrieval and tool supply chain.

Rehearsal. Scheduled exercises, with evidence retained. The same discipline that applies to backup restoration and disaster recovery applies here.

Chapter 8Frequently asked questions

Is an AI kill switch the same as turning the model off? No. Turning the model off removes a capability the business is paying for. A kill switch at the action boundary removes reach while the model continues to operate in an advisory mode. That difference is usually what makes the control acceptable internally.

Will regulation require one? Requirements vary by jurisdiction. The European Union's AI Act requires effective human oversight for high-risk systems, including an intervention or interruption capability. United States legislators have proposed a dedicated AI Kill Switch Act, while United Kingdom parliamentarians have proposed equivalent powers and the government has so far resisted them.

Can software guardrails be enough? They are necessary and they are not sufficient. Guardrails reduce the number of incidents. A physical break is what answers the residual case in which the software layer is the thing that failed.

Does this only apply to critical national infrastructure? No. It applies wherever an artificial intelligence system has been given the authority to act on systems that carry financial, legal, safety or reputational consequence. That now includes a great deal of ordinary commercial automation.

How long does deployment take? Placement is the work, not installation. Once the action boundary has been identified and segmented, the physical control is a boundary device. The mapping exercise is where the value is created, because it forces an organisation to write down what its artificial intelligence systems are actually permitted to touch.

Chapter 9Where to go next

For the full argument, the policy position and the deployment detail, read the AI kill switch briefing. For the architecture, see CP-08, Control AI Systems. For the deployment sequence, use the AI Control Blueprints playbook.

The uncomfortable summary is short. Most organisations that believe they have an AI kill switch have a policy, an API and an assumption. A control that can be shown to hold, in the incident where it is needed, is physical.