On September 18, Governor Newsom signed an executive order directing California's Government Operations Agency to accelerate independent oversight of frontier AI companies — including a mandate to advance development of an emergency "AI kill switch."
This isn't a proposal or a talking point. It's a governor's executive order with a named state agency, a named state office, and a two-month clock. It's also the clearest sign yet that "kill switch" is moving from a vendor feature into a regulatory requirement — which changes the question for every enterprise running AI agents in production from "should we have one?" to "can we prove it works when a regulator, auditor, or incident asks?"
What the order actually requires
The order targets frontier AI companies — the labs building the most advanced AI models — and directs four concrete things:
1 Independent verification organizations, embedded onsite. Outside organizations get direct access inside AI company labs to conduct regular audits — not a self-attested compliance questionnaire.
2 Verified safety frameworks and risk assessments. A lab's own safety claims have to be independently checked, not just published.
3 An emergency AI kill switch, with ongoing efficacy verification. Development of a mechanism to rapidly suspend a frontier model — and proof, checked on an ongoing basis, that the mechanism actually works when triggered.
4 Updated definitions of critical safety incidents to explicitly include loss-of-control incidents — a model acting outside the bounds its operator intended, not just a data breach or outage.
The timeline
- September 18, 2026 — Executive order signed.
- Within two months — California's Government Operations Agency, in consultation with the Governor's Office of Emergency Services, convenes experts and returns formal recommendations on independent oversight and kill-switch implementation.
- Ongoing — The order accelerates implementation timelines already set by two pieces of state legislation, SB 813 and AB 1405, rather than waiting for their original schedules.
"We're not waiting to act – we're going to speed up our work on substantial and responsible AI oversight before it's too late." — Governor Gavin Newsom
Where the order stops — and where RuntimeAI already goes further
Read carefully, the order is aimed one layer up from where most enterprises actually live: it's about frontier model developers — Anthropic, OpenAI, Google, and peers — being independently audited and building a kill switch for the model itself. That's necessary, and it's a serious step. It's also not the layer that stops an enterprise's own deployed agent from taking an unauthorized action tomorrow, regardless of which model sits behind it.
That's the layer RuntimeAI operates at — and, honestly stated, some parts of that containment surface are shipped and live-fire proven today, and some are still in progress. Here's exactly where each stands:
Agents Shipped, live-fire proven. Data-path block plus credential revocation is live. Process-level termination — a genuine OS-level kill, confirmed via the process's own exit code, not just an API response reporting success — is real for both a single agent and an entire tenant.
NHIs Functional. Non-human identities are suspended via a database status write with a live recheck on the next action — the permanent, documented mechanism.
MCP / tool calls Per-tool-call kill is live. A single tool can be killed on an agent without taking its other tools down — checked on every tool invocation in the gateway's own proxy path, not a periodic poll.
Cloud workloads Partial, honestly. The control-plane side of the dispatch is real and audited. The actual cloud-provider-side action — revoking IAM, stopping an instance — is not yet built; a kill event is recorded, but it doesn't yet change real cloud state. We're not claiming otherwise.
Three tiers of containment, three scopes — already live
Every agent action is re-evaluated against current policy at call time, not against whatever a prior call already decided — so drifted intent or scope gets denied on the very next call, even mid-session. When containment triggers, it escalates through three tiers: a sub-50ms gate block on the agent's next request, non-human-identity credential revocation across every downstream service, and cryptographic certificate revocation at the source. All three tiers work at three scopes — a single entity, an entire tenant, or global — triggered automatically on a drift signal or manually with a signed, human-approved audit record.
That's the honest comparison: the executive order is asking frontier labs to build and prove a kill switch for the model. RuntimeAI already runs the enforcement layer for what enterprises actually deploy on top of those models — the agents, the non-human identities they authenticate as, and the tool calls they make — with independent, per-call verification and a real audit trail, not a self-attestation.
Why the two-month clock matters to you now
A state government just put a formal deadline on "does your AI kill switch actually work" — for frontier labs first, but the direction of travel is unmistakable: emergency shutoff capability with verified efficacy is becoming a governance expectation, not a nice-to-have. Enterprises deploying agents today don't need to wait for that expectation to reach their own layer of the stack. The enforcement point already exists — the only question is whether it's independently verifiable before an auditor, a regulator, or an incident asks.
See the kill switch live against your own agent fleet
We'll walk through the three tiers and three scopes, live, against a real tenant — agents, NHIs, and MCP tool calls included.
Subscribe to RuntimeAI Security Weekly — one issue per week, the AI-agent incidents and defensive control gaps that matter.