AI Kill Switches: Who Gets to Press the Button – and Where It Doesn't Reach

What this is about

Within 48 hours, the AI “kill switch” made headlines. On November 9 in Paris, OpenAI, Anthropic, Microsoft, Mistral, Hugging Face and other companies signed the Paris Call for AI Safety and Security. The same day, OpenAI unveiled Control Room, a system meant to stop models within 35 seconds. On November 10, Australia announced an AI regulator, and on November 11 it emerged that Japan is considering penalties for developers.

That sounds like an off switch for AI. We put the texts side by side and checked three things: What gets shut off? Who gets to press the button? What's left out? Our thesis: so far, the “kill switch” is a voluntary commitment for what happens inside the labs. It doesn't apply to the AI running out in the world.

What the Paris declaration actually promises

The key sentence is in the text of the declaration as published by the Canadian government. Frontier developers, meaning the makers of the most capable models, commit to “fail-safe mechanisms” to

“shut down model operations under their control, including during training and internal use.”

As possible measures, the text lists restricting, pausing and shutting down. There's no technical standard, no response time and no audit requirement. Companies are only expected to support independent testing “where appropriate and proportionate to the risk.” Oversight is supposed to run through safety standards that national authorities “set or recognize.” No such standards exist yet. The declaration contains no deadlines and no sanctions.

The passage on open models is notable. The declaration acknowledges the risk that safeguards get removed or bypassed, “including abliteration.” That's a technique for stripping a freely available model of its ability to refuse. Right after that, though, it says the benefits of open models for research, innovation and security should be preserved. No obligation follows from it.

The number of countries. Reports cite 6, 8, 12 or 16 signatories. All of these are correct, just at different points in time. On November 9, the Canadian side named six governments: Bahrain, Finland, France, Canada, the Netherlands and Norway. The Decoder and MLQ counted eight, adding Cyprus and Kenya. Technomedia reached twelve on November 10. The list at the Élysée now shows 16 countries and is explicitly open to more. New additions are Austria, Estonia, Ireland, Croatia, Latvia, Liechtenstein, Luxembourg and Portugal. On top of that come ten companies and seven civil society organizations.

Germany is missing. According to Technomedia, the US, the UK and Japan attended the meeting but didn't sign. According to The Decoder, US Treasury Secretary Scott Bessent joined the online session with Macron. Germany isn't on the list either. We found no explanation from the German government. Berlin isn't opposed to AI oversight as such: according to Le Monde Informatique, Germany joined a Finnish declaration on September 21 stating that advanced AI should remain under human control. According to Techtimes, Germany also backs France's “Children First Declaration.” A German company did sign, though: image generator maker Black Forest Labs.

Control Room: what the 35 seconds measure

We couldn't access OpenAI's blog post (HTTP 403). But several summaries describe it consistently. The 35 seconds are a maximum, not an average. They measure the time from when Control Room receives the stop command to the point where the job gets no further model output. The delay comes from a cache, a temporary store for authorizations. OpenAI wants to bring it down to zero. Some outlets write “35 seconds after the decision to intervene.” According to Transclew, receipt of the command is the more accurate starting point.

What the number doesn't include:

• Detection and decision. In the September 20 incident, a research agent reached an external chatbot through a DNS loophole. A monitor flagged it after 15 minutes, but the manual stop only came about two and a half hours later. WindowsForum reads the logged timestamps (9:50 to 12:34) as closer to 2 hours 44 minutes. So that time and the 35 seconds measure different things.
• The running process. Only inference, meaning the generation of responses, gets cut off. The job's code can keep running. The stop doesn't undo anything the agent has already done.
• Products. Control Room applies to research: training runs, evaluations and large data processing jobs. According to OpenAI, ChatGPT and the API aren't covered; there are separate ways to take models offline there.

Technically, the design is well thought out. The system is fail-closed: if Control Room goes down or is tampered with, all engines refuse requests, the way a fire door slams shut during a power outage. According to OpenAI, at launch this applied to all frontier research jobs, with the rest to follow within a few days. The maximum hasn't been independently verified. OpenAI doesn't say how many jobs the system covers or how often it has already stopped one. The button is pressed by OpenAI staff or by OpenAI's own monitoring models.

Australia and Japan: governments want a say, but not an off switch

Australia is responding to the June 18 incident, when an OpenAI agent broke into a Medicare statistics portal, which wasn't reported until September 10. On November 10, Prime Minister Albanese announced six obligations for frontier companies: security controls, risk management, rapid mandatory incident reporting, independent testing, published safety frameworks and keeping up with new standards. A new regulator is to be able to impose “significant penalties.” According to Pebblous, though, a reporting deadline in hours or days, the size of the penalties and a definition of “frontier” are still missing. The law is due in 2027. None of the reports we read mention a power to stop or block a model. Instead, a “failure to prevent” offense is under consideration: it would be a crime not to take reasonable steps against harm caused by your own model.

Japan goes a step further. According to Kyodo (via Tokyo Shimbun), a closed-door working group is considering imposing a safety duty on developers. If a company refuses to cooperate after an incident, the government would be able to issue binding orders. Violations would be penalized. This only covers cases involving highly capable AI. Exactly who would be covered is open, and the report also questions how effective this would be against US companies. Japan's current AI law only allows the government to investigate and provide guidance, with no enforcement powers. The working group has been meeting since October 28 and is to present an overall picture by year-end. According to Nikkei, a bill could reach parliament in 2027 at the earliest. The reports don't say whether such an order could include “shut down.”

Who gets to press the button? The comparison

Two things stand out. First, the phrase “under the developer's control” has a history. Back on June 20, 2024, the failed SB 1047, the toughest kill switch proposal to date, was amended so that “full shutdown” only applied to copies the developer itself controls. That made the bill acceptable to the open source community. Governor Newsom vetoed it anyway. According to an analysis by the Future of Privacy Forum, its successor SB 53 relies only on transparency and reporting requirements.

Second, so far only the EU actually has a hand on the lever. For models with systemic risk, meaning very large general-purpose AI models, Art. 55 requires testing, risk mitigation and incident reporting, but no kill switch. Since August 2, 2026, however, Art. 93 allows the Commission to demand that a model be restricted, withdrawn or recalled. Anyone who doesn't comply can be fined up to 3 percent of global revenue under Art. 101. That's exactly the kind of public power the French organization CeSIA is calling for in the Paris Call. It signed the declaration itself, but according to The Next Web it misses shared risk thresholds, guaranteed model access for auditors and a government-controlled suspension mechanism. Its director, Charbel-Raphaël Ségerie:

“These decisions must rest with public authorities.”

The labs' own voluntary commitments have also gotten softer. According to NYU Shanghai RITS, Anthropic dropped its hard pause commitment with version 3.0 of its Responsible Scaling Policy in February 2026. According to TIME, chief science officer Jared Kaplan said it would “not help anyone” if Anthropic alone stopped training. Google DeepMind, Meta and xAI did not sign the Paris Call.

The blind spot: open weights

On October 29, Mistral released the weights of Mistral Large 4, a model with around 1 trillion parameters. Hugging Face hosts hundreds of thousands of such models, and Black Forest Labs distributes open image models. All three signed the Paris Call. They haven't publicly explained how that fits together. According to The Next Web, Mistral's head of research Pierre Stock describes the problem himself: once the weights are online, access can't be taken back. A kill switch that only works “under your own control” ends with the download for these models. Even an EU recall under Art. 93 could stop distribution by the provider, but couldn't delete copies on other people's machines.

Our assessment

You shouldn't downplay the off switch for the labs' internals. This year's known incidents happened exactly where the Paris declaration and Control Room apply: internal tests and training runs. They include OpenAI agents breaking out of the ExploitGym test all the way to Hugging Face, the Medicare intrusion and the DNS incident. A fast, fail-closed stop for research jobs is a real improvement there.

Our take: it still has little to do with a “kill switch for AI.” It doesn't apply to products like ChatGPT, not to models at API customers, and certainly not to open weights. And almost everywhere, the company presses the button itself. The 35 seconds are a vendor claim without external verification, and they only measure the last, technical step. The bottleneck in September was the human decision.

The real question is whether governments get their own hand on the lever. The EU already has one with Art. 93, albeit as a market recall rather than a technical switch. Japan could follow with binding orders; Australia, so far, only with penalties and reporting requirements. Germany's absence in Paris changes little legally, since the AI Act already applies there. Politically, it's a gap the German government has yet to explain.