AI Kill Switch Act

This bill amends the Homeland Security Act of 2002 to require certain entities that develop or operate advanced artificial intelligence systems to maintain a technical capability to shut down such technology, and establishes a graduated framework for responding to incidents.

Sec. 2, Shutdown-capability standard and graduated deployment-corrections framework: The Secretary of Homeland Security, through the Cybersecurity and Infrastructure Security Agency Director, must update definitions of 'covered entity' and 'covered technology' by rule within 90 days and annually, considering costs to small businesses, national security implications, and technology capabilities. Entities using covered technology only for personal, academic, or non-commercial purposes are exempt.

Covered entities must maintain capability to stop inference, terminate user access, suspend risky accounts, and shut down the technology, and report covered incidents within 15 days. The Secretary may require graduated measures like throttling, disabling capabilities, suspending, or shutting down technology, and must publish voluntary shutdown standards within 180 days.

If a covered incident occurs, the Secretary may order an entity to take proportionate action, including shutdown. The entity must preserve model weights, notify affected users, and confirm compliance. The Secretary must audit compliance and report to Congress. Entities may appeal within 48 hours, with a decision within 5 days, and seek judicial review in the D.C. Circuit within 60 days.

The Secretary may issue subpoenas, conduct investigations, and assess civil penalties up to $2 million per day for general violations and $20 million per day for emergency order violations, considering factors like nature, culpability, and prior violations. The Attorney General may bring civil actions for violations.

De minimis or technical violations corrected within 30 days are not considered violations. Nonpublic information submitted is exempt from disclosure under federal and state freedom of information laws.

Definitions: 'Covered entity' means an entity operating covered technology, making it available to third parties, and deriving at least $500 million in gross revenue from it. 'Covered technology' means an AI system developed with computing power costing over $100 million. 'Covered incident' includes sabotage, unintended conduct causing 10+ deaths or $100 million+ damages, concealment by the technology, or a loss-of-control scenario. 'Loss-of-control scenario' includes the technology pursuing unintended goals, altering rules, subverting shutdown, or accessing its own model weights. 'Red-teaming' is structured adversarial testing in controlled conditions.