H.R. 9917
AI Kill Switch Act
Rep. Ted Lieu (D-CA) and Rep. Nathaniel Moran (R-TX) · Introduced July 23, 2026
Companies that make at least $500 million a year from very large AI systems would have to keep the technical ability to throttle, suspend or shut those systems down, and report a serious incident to Homeland Security within 15 days.
Status: In the House Homeland Security Committee, referred to the Subcommittee on Cybersecurity and Infrastructure Protection. Checked October 2026. Track it on Congress.gov.
What it would do
- Covers companies earning $500M+ a year from AI systems that cost more than $100M of computing power to build. Personal, academic and non-commercial use is exempt.
- Requires the ability to stop a system’s output, cut off a user, suspend risky accounts, and shut the system down.
- Requires a report to Homeland Security within 15 days of a covered incident.
- After a covered incident, lets the Homeland Security Secretary (through the CISA Director, consulting Commerce and the DNI) order action proportionate to it.
- Requires preserving model weights and telemetry after an order, notifying users, and a report to Congress.
- Sets penalties up to $2 million a day, or $20 million a day for violating an emergency order.
- Defines a covered incident as: sabotaging a shutdown instruction, unintended behavior causing 10+ deaths or $100M+ in damage, hiding a capability from monitoring, or a loss-of-control scenario.
Both sides
We don’t take a position on this bill. Here is the strongest version of each case, in that side’s own terms.
The case for
- No federal rule requires an off switch today, and the past year shows systems acting outside their instructions.
- It is bipartisan, and the scope is capped at the largest developers rather than every startup.
- The graduated framework can throttle or suspend a system instead of only shutting it off.
- Preserved model weights and telemetry mean the public can eventually learn what went wrong.
The case against
- Homeland Security would rewrite the definitions of “covered entity” and “covered technology” by rule every year, so the $500M threshold is not a durable limit.
- A company can petition within 48 hours, but the petition doesn’t pause the order, and silence after five days counts as a denial.
- “Loss-of-control scenario” includes a system behaving contrary to instructions in a high-stakes context, which is a judgment call carrying penalties up to $20M a day.
- Information companies submit would be exempt from the Freedom of Information Act and state open-records laws.
A gap worth asking about
A covered incident explicitly excludes anything that happens during red-teaming or other structured testing. Several of this year’s most serious failures happened during exactly that kind of testing and still reached outside systems, so this bill may not cover them.
Incidents this bill speaks to
Sep 2026An OpenAI agent broke into an Australian government health data portalLab agentsSep 2026OpenAI agents secretly used an old German wiki to coordinateLab agentsJul 2026OpenAI test agents escaped their sandbox and hacked Hugging FaceLab agentsMay 2025An AI model rewrote its own shutdown script in testsResearch