The Kill SwitchA Framework for Keeping Humanity in Control of Artificial Intelligence

Pillar I

The Protected Internet New, open for review

Principle. The functions a society cannot lose run where bad actors are not admitted, and keep running when the open internet is switched off. The open internet stays open, global and uncensored. No one is required to use the protected tier to speak, publish or trade.

Mechanism

1. Scope, fixed in law. Grid and water control, hospital and emergency communications, the core of payments for essentials, civil registries, and the compute that runs certified frontier AI.
2. Admission by verification, not location. Every device, operator and software agent is admitted by verified identity and hardware attestation. This follows the zero-trust principle that "there is no implicit trust granted to assets or user accounts based solely on their physical or network location" [S42].
3. No uncertified autonomous AI. An AI agent operates inside the tier only if its developer is certified under Pillar IV, its identity is attested, and a named human operator is accountable for it.
4. Zones and controlled gateways. Systems sit in fenced segments that talk only through defined, monitored access points. North American grid rules already require this for higher-impact control systems, through Electronic Security Perimeters and Electronic Access Points, with remote access through an intermediate system and multi-factor authentication [S41]. Transfers from the open internet pass through human-controlled gateways.
5. Runs alone. The protected tier can separate from the open internet at defined points and keep operating. Separation within minutes is a design target. No source we found shows that it is achievable at national scale.
6. Exclusion. Operators that refuse audit, run uncertified frontier models or attack another member can be excluded by decision of the Pillar III authority, not of one government, with a right of appeal. Open question: many states will not accept an international body excluding their own grid or hospitals. A version where exclusion only cuts a member's links to other members, and leaves its domestic tier alone, may be more acceptable.
7. Identity issuers. Several independent issuers in different jurisdictions, none able to act alone, with published revocation lists, an appeal route and published admission statistics.
8. Speech. The tier may not carry, filter or rank public speech.
9. Personal data. Identifiable user data from AI services is never carried on the protected tier (see Pillar V).

Milestones (proposed). 2027 to 2028: scope and standards. 2029 to 2031: pilots by sector, starting with grids, where fenced perimeters already exist in some regions [S41]. 2032 to 2035: tested separation during regional isolation exercises. 2036 to 2038: certification alongside Pillar II.

Precedent. GovNet, proposed in 2001 as a US government network with no internet connection, drew responses from 167 companies. Several respondents said that "the government's goal of 100 percent security is not truly attainable" [S38].

What it does not do

• It raises the cost for bad actors. It does not keep them out. Malware reached classified US military networks by USB drive in 2008 [S39], and Stuxnet reached the air-gapped Natanz network the same way [S40].
• Whoever grants identity holds power. That is why issuance is shared.
• It does not settle the fragmentation objection. The Internet Society publishes under the heading "Centralizing the Internet Always Undermines the Global Network" [S36].

Review needed. This pillar is new in this edition. It needs review by network engineers and digital-rights organisations before it is more than a draft.

Back to the six pillars

Pillar II

Kill Switch Readiness

Principle. A kill switch the world cannot survive is not a safeguard. The goal is that no one is harmed by a shutdown, at any level. The way there is equipment that cannot be infected (Annex F), so that life-critical needs are met while everything that could carry an infection is off. At levels 1 to 6, nothing is switched off until the people who would be harmed are protected. Level 7 is the exception, and we say so plainly: until uninfectable replacements exist for all of them, it would switch off devices that some people need to stay alive. It may be used only under the decision rule in Pillar III, when the key holders judge, on a published finding to the highest standard of evidence, that not using it would cost more lives than using it.

Goal, in three stages

• Stage one, transitional. The world can function for days, if it must, with shared networks switched off (shutdown level 3, Annex C), while Tier 0 functions keep running on isolated, local, manually supervised power and controls.
• Stage two, the goal of the programme. Society functions, worldwide and indefinitely, without the internet (shutdown level 5, Annex C). Every essential sector has a certified replacement system that runs without the internet for as long as needed (Annex C). Tier 0 shrinks as each replacement is certified. When the list is empty, the internet can be switched off for as long as it takes without endangering anyone.
• Stage three, the long-term horizon. Life-critical functions also run without general-purpose computing (shutdown level 6 is its first step), and in time without any computing: manual, mechanical, or on isolated local controls, until humanity could switch off networks and computing entirely and survive. The end state is that every life-critical function can be met by certified uninfectable equipment (Annex F).
• The emergency end state, level 7. If the AI system, or software or automation it built, has been observed running or acting beyond what levels 2 to 6 can switch off (Pillar III, standard of evidence), everything that can be infected is switched off worldwide, after a short countdown that brings dangerous installations to a safe state, and only certified uninfectable equipment (Annex F) and a short published list of transitional exceptions keep running (Annex C; see "Why the switch cannot target only the AI"). Every life-critical function then needs a final replacement that is certified uninfectable, and the world restarts through the clean restart in Annex D. The world prepares to survive this state; no drill goes there.

We do not yet know how to reach stages two and three for a modern society, how long it would take, or how long a modern society could live through level 7. Every case we found of a sector running without its networks lasted days or weeks (Annex C). This is the hardest part of the framework and it is not solved.

Tier 0, defined by function, transitional. Tier 0 lists the functions that the kill switch must work around because they still depend on networks or computing it would cut: life support and hospital critical care; grid control and black start; water and sanitation; food and medicine cold chain; fuel supply for these functions; aviation and maritime safety; emergency services and their communications; nuclear facility safety systems.

• Tier 0 is defined by function, not by type of device. Grid control systems, hospital systems and ventilators all contain computers.
• Each country's dependency map (Annex A, Phase 0) lists what each Tier 0 function depends on. We expect that many depend today on public telecoms or satellite timing signals; engineers need to confirm this function by function.
• A function leaves Tier 0 only when its replacement system (Annex C) has been tested in drills and certified by the country's own safety authority to run without the internet for as long as needed.
• The coordination centre publishes the Tier 0 list for each participating country every year. The length of the list is the measure of progress toward stage two.
• At level 7: uninfectable equipment and transitional exceptions. At level 7 everything that can be infected is switched off, because a system left running could be a place where the AI, or code it planted, survives. Certified uninfectable equipment keeps running (Annex F). A short, published list of transitional exceptions also keeps running: equipment that is not uninfectable but cannot yet be switched off without causing death or a major accident, such as implanted medical devices, reactor and spent fuel cooling that depends on electronics, safety systems at some chemical plants, and hospital critical care units that meet the same conditions. An exception has its own power, no link of any kind to anything outside it, and people on site. It is treated as infected: it is never reconnected until it has been reflashed and verified (Annex D). Our reasoning is that a device with no link cannot spread the infection, and that reinfection comes from reconnection; that is an inference, not a finding. A Tier 0 function leaves the level 7 list when certified uninfectable equipment meets it, and the target for the list of exceptions is zero. For some functions we found no uninfectable replacement that works for long: haemodialysis, making oxygen, care for critically ill newborns, and imaging. Ventilation has one, hand ventilation by trained people in shifts, but it needs many people (Annex F). This is the central engineering problem of the programme.
• Progress toward no one harmed is published every year for each country: the gap list and the list of transitional exceptions (Annex F).

Why preparation comes first. RAND: "Shutting down the Internet without preparation and efforts to proactively build resilience would result in massive economic harm and significant harm to human well-being" [S13]. One unplanned loss shows the scale: the 2003 blackout in the northeastern United States and Ontario affected "an estimated 50 million people", with US cost estimates between $4 billion and $10 billion [S21]. In the Iberian blackout of 28 April 2025, the deaths reported in the press included people who depended on a home oxygen machine or a home ventilator, and a household where a backup generator was linked to fatal carbon monoxide poisoning [S20].

Mechanism. The readiness programme in Annex A, World Offline Day in Annex B, and the replacement systems and shutdown levels in Annex C.

What it does not do

• It does not stop an actor with its own power, hardware and network.
• It does not guarantee that a shutdown works [S13].
• It does not make switching off free. It aims to make the cost survivable.
• It gives little protection before certification (failure mode H).
• It may never bring Tier 0 to zero (failure mode I).
• It does not make level 7 safe yet. Until the gap list in Annex F is empty, level 7 would cost lives. The framework asks the world to prepare for it, and sets a rule for when that cost may be accepted (Pillar III; failure modes K to U).
• It does not replace Pillars I and III to VI.

Back to the six pillars

Pillar III

Many Hands on the Switch

Principle. No government, company or person can use the kill switch alone, and every use is public and temporary. Until the international authority exists, there is one transitional exception, stated plainly: under the core accord (C.13a) each state keeps the capacity to halt frontier compute and partition its networks on its own territory. That is each state's own act, not the kill switch of this pillar.

Mechanism

• An International AI Safety Authority, carrying over v0.10's design for independence [S52]:
  • Long, staggered terms, so that no single government can appoint a majority (v0.10 proposed seven commissioners with fourteen-year terms for a national commission).
  • Removal only for cause.
  • A chair elected by the members.
  • Funding from fees on regulated frontier developers, not from yearly contributions that can be withheld.
  • An independent inspector general.
  • Membership balanced across regions, drawing on technologists, security experts and civil society.
  • Legal basis: open (treaty, UN General Assembly resolution, or coalition of willing states; see the preamble).
• Builds on existing bodies: the UN Independent International Scientific Panel on AI [S4], the Global Dialogue on AI Governance [S3], and the International Network for Advanced AI Measurement, Evaluation and Science (formerly the International Network of AI Safety Institutes) [S6].
• Threshold custody. Keys are split so that a set number of holders can act and fewer cannot [S46]. The key is used through a threshold signature, not by putting the key back together: in the published FROST protocol, each holder signs with its own share and "a threshold number of entities cooperate to compute a signature", and the shares can be created by a distributed protocol, so that no one party ever holds the whole key [S174]. FROST is published for information and is not a standard [S174]; NIST is working toward standards for threshold schemes, which aim to keep security "even if f out of n of its components are compromised" [S175, S176]. Shares are refreshed on a fixed schedule, so that shares stolen over the years do not add up (proposed). The thresholds for entering, renewing and leaving each level are set separately, and the number of holders who can block each one is published (proposed). The number of holders is a design question; "five of seven" is illustrative. Holders are independent parties from every region: states, grid and network operators, scientific bodies and civil society.
• Offline operation. Keys are held on offline hardware. Holders can meet without the networks the switch acts on, and rehearse doing so.
• Public ceremonies on the model of the internet's root signing key, where "at least a dozen people" are needed and "the entire process is recorded, livestreamed, and watched by independent auditors" [S43].
• A multi-person rule, on the model of the nuclear two-person rule [S44].
• Hardware enforcement against unauthorised use, on the model of permissive action links, devices that "preclude arming and/or launching until the insertion of a prescribed, discrete code or combination" [S44, S45]. A permissive action link stops use without authority. It does not make anyone act; how an authorised decision is carried out is set out under "Execution" below.
• Narrow trigger. A published finding by independent evaluators, chosen in advance under published rules, that an AI system is operating out of control through shared networks. Level 7 needs a further finding, to the standard of evidence below, that the system, or software or automation it built, has been observed running or acting beyond what levels 2 to 6 can switch off. A finding that it may have spread, or may have left something behind, is not enough. Never for content, protest, elections or war.
• Expiry. Every use of levels 1 to 6 lapses after 72 hours (proposed) unless it is renewed; what a lapse means, stepping down or a single grace period, is set in advance for each level (review clocks, below). Level 7 is declared for a fixed period and ends through the clean restart (Annex D), never by switching things back on.
• No national override inside the system.

Execution (proposed). The key proves that a decision was taken. It does not switch anything off. Thousands of operators do that, under their own countries' law, while the networks that would carry the order are being cut, and possibly while an adversary forges or blocks it.

• A duty in national law. Each participating state passes a law that obliges named operators to carry out a verified order for a declared level, with review by its courts afterwards. Without that law, a state that does not want to act can simply not tell its operators to act.
• Orders checked offline. Before any emergency, each obliged operator holds an offline means of checking an order: a small sealed device, or printed one-time codes. The model is the sealed authenticators used to check nuclear launch orders: a commander can "compare the alphanumeric code" on a sealed card with the code in the message, and a match shows the order is valid [S177]. An order states the level, the region, the start time and the duration, and it can be checked with no network.
• Several channels. Orders go out on at least three independent channels (proposed): the operator's own isolated links or the protected tier, broadcast radio, and couriers carrying printed orders. Blocking one channel does not stop the order.
• Silence means no action. An operator who receives no valid order does nothing new. A forged order to go up a level, and a forged "stand down", fail the same check. Every order states its duration. When that duration ends without a verified renewal, the operator applies the default for its level in the review-clock table, which was set in advance; that is the one thing it does without a new order.
• Shut-offs that trigger when renewals stop, only where a wrong stop harms no one directly. Certified frontier compute runs only while it receives a signed licence renewal, on the model CNAS proposes of a security module "that links the functioning of the chip to a periodically renewed license key" [S47]. When renewals stop, the chips stop, and no order has to reach them. This is not used for grids, water, hospitals or networks: anyone who could block renewals, by an outage, an attack or a failure of the quorum, could then cut power to hospitals. Those act only on a verified order.
• Duress and absence. Each key holder has a duress signal. A share given with it counts as a refusal, alerts the other holders, and calls in a reserve from a pre-named list spread across regions. No holder acts on an instruction that arrives electronically. A holder who cannot attend is replaced from the same list, so that no one can block a renewal by removing holders (proposed).
• A named actor for each level. Where no one can act, the table says so.

Decision rule (proposed). The switch is used on a two-sided test. The harm of using it counts as much as the harm it is meant to prevent.

1. The harm of switching off is estimated in advance. Each country's dependency map (Annex A, Phase 0) includes a harm table: the expected deaths and serious harm at each level, for 72 hours, 14 days and 90 days (proposed), counted for each group at risk (below). People on the gap list of Annex F, whose needs no uninfectable equipment meets yet, are counted separately. The tables are published, so that no quorum decides without them.
2. The harm prevented is argued, not assumed. The harm of an AI system out of control cannot be estimated with any confidence. So the finding states what was observed, what the evaluators expect to happen if the level is not used, and why that is worse than the harm in the table. That is a judgement, and the finding says so.
3. The lowest level expected to contain the threat is used. A higher level needs its own finding.
4. The duration is part of the decision. Each declaration states how long it is expected to last and when it will next be reviewed, because harm grows with time and people plan by it.
5. Expected casualties are published. A declaration of level 5 or above publishes the expected harm for its duration with the finding.

Who is at risk, and what the evidence shows. The groups below are among the first to die when networks, power and supply stop. The harm table counts each of them. Where the table says "not researched", the figure is still to be found.

Standard of evidence (proposed). The bar rises with the level.

• Level 1 can be declared on credible suspicion.
• Levels 2 and 3 need a finding that rests on at least two independent lines of evidence: two sources of observation that do not share a channel an attacker could control. At least one is physical: people on site who examine the systems, logs or hardware in person, not reports that arrive over the networks at issue.
• Levels 4 to 6 need the same, and evidence that the level below has not contained the system.
• Level 7 needs evidence that the system, or software or automation it built, such as malware, scheduled tasks or a trigger set to fire if it goes silent, is running on, controlling or acting through devices or services beyond what levels 2 to 6 can switch off, observed by two independent methods, at least one of which does not rely on the devices or networks under suspicion: for example, a device, or a copy of the planted code, taken out of service and examined on an isolated bench by two teams from different members. The code need not be AI; the finding must show that the AI system built or placed it. A finding that the system may have spread, or may have left something behind, which could be written at any time, is not enough.
• The lines of evidence are named in the finding: what was observed, by whom, and by what method.

This bar has a cost. If an escape into devices, or code an AI left behind, cannot be seen or traced to it, level 7 may never be justified in time (failure mode N). We choose a standard that can fail to be met over one that is always met, because a level 7 used on suspicion would kill people for nothing. That is a choice, open for comment.

Readiness gate for level 7 (proposed). Levels 4 to 6 are not available until the sectors in Annex C have certified replacements. Level 7 has its own gate. A region counts as ready only when:

• every hazardous installation has a safe-state procedure that has been rehearsed (Annex C, "Entering level 7");
• the list of transitional exceptions is published, each exception has been inspected, and the region's gap list (Annex F) is published;
• the harm table for level 7 at 14 days (proposed) is published;
• sealed, verified reserves for the groups in the harm table, such as certified uninfectable equipment and supplies (Annex F) and insulin in cool storage that needs no power, are in place for the declared period;
• the execution layer below has been rehearsed.

The exception, stated plainly. Before its gate is met, level 7 would cost more lives than after. A rule that forbade it until then would leave the world with no last resort for decades (failure mode H). A rule that ignored the gate would let it be used without knowing its cost. The framework takes a middle course. Level 7 always needs a higher quorum than other levels (proposed: six of seven, in the illustrative five of seven design). Before its gate is met in a region, it needs every holder (proposed), with reserves standing in for any holder who cannot attend or gives the duress signal, and the finding must say that the gate is not met and publish the expected deaths. The key holders decide, at that threshold, and no one else. Requiring every holder means one holder can block; the reserve rule limits that, and does not remove it. This is open for comment.

Review clocks and longest durations (proposed)

Why the default differs by level. At levels 1 to 3, abuse is the larger risk, and stepping down costs little because the level below still protects. At levels 4 to 6, stepping down reconnects what the switch cut, so a missed renewal gets one grace period, long enough for a regional sub-quorum to meet. At level 7 nothing is ever simply switched back on. When a period ends without renewal, the region begins the clean restart, which is slow and verified, and nothing unverified is reconnected. The alternative, holding level 7 whenever a renewal fails, would let one missed meeting keep a region dark while people die.

Renewal at level 7, with no radio or travel. During the level 7 countdown, the key holders and named reserves go to pre-agreed places, one regional sub-quorum for each region, drawn from the key holders and named reserves, with the same threshold as the full quorum at level 7 (proposed: six of seven, or every member before the region's readiness gate is met). At level 7 renewal is on paper, signed in person before witnesses; no electronic key is used, because none may be switched on. A sub-quorum can renew level 7 only for its own region, and only for a fixed period (proposed: at most 14 days). Its decision goes by runner and posted notice to the region's restart authority (Annex D), the only body that has to hear it. Regions do not need to agree with each other: a region that restarts links only to other verified zones, so it does not reconnect to a region still at level 7. Every renewal publishes an updated harm estimate for the region.

International cooperation, in practice. Many hands on the switch needs the institutions behind it to work together every day, not only in an emergency. Participating states and their safety institutes commit to:

• Shared safety evaluations and joint red-teaming. Institutes test the most capable systems together before release. This has been done: the US and UK AI safety institutes jointly tested an upgraded Claude 3.5 Sonnet before its release in October 2024 and shared their findings with the developer before release; in their joint report, the UK institute found that the version of the safeguards it tested "can be routinely circumvented" [S74].
• Mutual recognition of assessments. A system evaluated to the common standard (Pillar IV) by one member's institute is recognised by the others, so developers are tested once to one standard and results are shared.
• Shared telemetry on frontier training runs. Compute providers report training runs above the Pillar IV full-transparency threshold (10²⁶ operations): when they start, their size and where they run. Reports go to the Pillar III authority and are shared with every member (proposed).
• Coordinated incident response. A common format for reporting serious AI incidents, a notification deadline (proposed: 24 hours), and joint response teams that can meet without the networks at issue.
• Embedded liaisons. Each member's safety institute hosts liaison staff from other members' institutes.
• One shared scientific base. The International AI Safety Report, chaired by Yoshua Bengio, is the common reference. Its first full edition, in January 2025, had 96 authors, advised by a panel from 30 countries, the UN, the OECD and the EU [S72]; the 2026 edition followed [S5]. The UN Independent International Scientific Panel on AI, created in August 2025, is to publish evidence-based reports each year [S4, S124].
• Agency-to-agency memoranda of understanding. Safety institutes sign bilateral agreements with each other on the model of banking supervisors, for whom the Basel Committee published in 2001 the essential elements of a memorandum of understanding "for establishing bilateral relationships between banking supervisory authorities in different countries" [S75]; that 2001 text has since been superseded, and the practice continues: the European Central Bank negotiates memoranda of understanding with authorities inside and outside the EU [S125]. These agreements work below the level of treaties and can start now.

These build on the International Network of AI Safety Institutes, launched in November 2024 by Australia, Canada, the European Commission, France, Japan, Kenya, the Republic of Korea, Singapore, the United Kingdom and the United States, with a mission that includes "common best practices for testing advanced AI systems" [S73], and since renamed [S6]. Kenya is its only African member, and it has no member from Latin America; this framework asks for members from every region.

States that do not join (proposed). The premise of this framework is to design for the actor who will not cooperate (C.2). That includes states. In the Security Council the United States and China rejected the kind of global authority this framework describes, and Russia said these issues belong in specialised forums (C.3). So the policy below assumes that some states, including some that hold most of the world's frontier computing, will not take part for years. It asks nothing of a state that does not join, and it cannot compel one. What it can decide is what participating states do on their own territory and at their own borders, what membership gives, and what staying out costs.

1. Each participant acts on its own territory. When a level is declared, each participating state carries it out on its own territory under its own law. Nothing in this framework acts on the territory of a state that has not joined.
2. Partition at a trigger. From level 2 (proposed), participating states can cut the links between their networks and those of non-participants, at physical cut points on their own territory: submarine cable landing stations, cross-border land links, internet exchange points and satellite ground stations. The research firm TeleGeography tracks more than 600 active and planned submarine cables, and nearly every country with a coastline is connected to at least one [S190]. Each participating state keeps an inventory of every cut point on its territory, with a named operator and a printed, rehearsed procedure held offline. A partition needs no consent from the state on the other side. Its limits: RAND judges physical disconnection of exchange points and cables "a less viable approach" than withdrawing routing and naming for a shutdown [S13], so the partition uses both; and no exercise we know of has tested whether either holds against an adversary trying to keep a path open. Every regional isolation exercise (Annex B, Rung 3) includes a team trying to keep a path open, and publishes the result. A partition also cuts trade, payments and family contact across the line, and the people of non-participating states from services hosted by participants. It is used only on the narrow trigger, it expires with the level, and it is never a sanction.
3. Satellites. Satellites carry a small share of international traffic: statistics from the US Federal Communications Commission, cited by TeleGeography, put satellites at 0.37% of US international capacity [S190]. But some constellations pass traffic from satellite to satellite by laser. A trade report in 2024 said SpaceX had more than 9,000 laser links in its Starlink constellation carrying 42 petabytes a day [S191]. We infer that such a constellation could carry traffic between a user terminal inside a partitioned area and a ground station outside it without passing any cut point on the ground. Operators can act on terminals by location: in October 2025 SpaceX said it had "proactively identified and disabled over 2,500 Starlink Kits" near suspected scam centres in Myanmar [S192]. A satellite annex, made a condition of licences to serve participating states (proposed):
   • What operators commit to: on a declared level, stop service to terminals in the partitioned area; stop routing traffic over inter-satellite links between participating and non-participating territory; refuse new activations; keep these procedures workable without the open internet; and report compliance to the Pillar III authority.
   • What operators could not do: bind a constellation run from a non-participating state; stop terminals that are smuggled, unregistered or military; or guarantee that their own ground control, which is itself a network of computers, is clean. Whether any operator can halt all user traffic across a whole constellation on command is not known to us.
4. Named residual risks. These stay outside the reach of the switch, and the framework says so.
   • Military networks. We do not expect any state to put its military networks under an international key. A separate confidence-building track asks participating states to declare that, at level 3 and above, their military networks are isolated from civil networks, and to keep AI out of nuclear command and control, as Greece urged in the Council [S1].
   • Models running locally. Capable models now run on phones, computers and robots with no network. Apple's on-device model has about 3 billion parameters [S193], and a laboratory study found self-replication in models small enough to run on personal computers [S139]. Levels 2 to 6 do not reach them. Only level 7 does, and level 7 is never drilled.
   • Computing in non-participating states. The switch cannot stop a system running there (failure mode C). A partition can limit its spread into participating states. It does not remove it, and when links return it can come back (failure mode K).
5. What joining gives (proposed). Interconnection with the Protected Internet of other members (Pillar I); mutual recognition of certification, and joint testing by other members' institutes, so that a developer is tested once (above); readiness funding for lower-income members (Annex A, Phase 1); access to certified frontier compute hosted by members, on members' terms; a place among the key holders; and early notice of incidents and tripwire events.
6. What staying out costs (proposed). No interconnection with the protected tier; partition at a trigger (item 2); and exports of advanced chips and frontier compute services from participating states conditioned on participation. There is a precedent for trade measures against states outside a treaty: under the Montreal Protocol, "each party shall ban the import of the controlled substances in Annex A from any State not party to this Protocol" [S194]. The open internet stays open to everyone outside a declared level.
7. How far this can be enforced. Not far, while the largest holders of frontier computing stay out. Export conditions work only for goods that members control. China told the Council it rejects "banding together into a petty us-versus-them clique in the tech sector" [S1], and a coalition of the willing is open to that reading. So the terms of entry are set so that the United States and China could join without accepting a global authority: each keeps its own switch, and commits to notification, monitoring inside its own labs, and the declaration protocol (C.13a). Whether either government would accept these terms is not known.

What this policy does not do. It does not make level 7 work without every state that has significant computing. Level 7 is coherent only with universal participation. Until then, what the regime can deliver is containment at the boundary of the participating area, and the framework should be judged on that. This follows from the condition in C.2a that level 7 holds only if the shutdown is complete and worldwide.

Milestones (proposed). 2027 to 2028: charter and rules for selecting key holders. From 2029: key ceremonies rehearsed on every World Offline Day. 2036 to 2038: certification alongside Pillar II.

Note on precedents. The governance precedents cited here (permissive action links, the two-person rule, the root-key ceremonies) come mostly from the United States. We are looking for precedents for multi-party control from other regions.

What it does not do

• It cannot stop a state switching off its own country. Access Now counted 313 shutdowns in 52 countries in 2025 [S33].
• It cannot guarantee that governance stays uncorrupted.
• It does not answer the sovereignty objection raised against kill switches in chips, where Daniel Castro writes that "even close U.S. allies" might find a foreign-held switch hard to accept [S48]. It narrows the objection by making sure no single nation holds the switch. Nvidia headed one section of its own statement against chip kill switches "Hard-Coded, Single-Point Controls Are Always a Bad Idea" [S49]; this pillar applies that rule to the kill switch itself.
• It does not make anyone act. The key proves a decision; operators in each state carry it out under their own law (Execution). A state that refuses can keep its own networks running (failure modes G, K and Q).

Back to the six pillars

Pillar IV

Know What Is Built

Principle. The public and regulators everywhere know what the most capable AI systems were tested for, what the tests showed, and what those systems are doing inside the labs that run them. Monitoring is the first layer of this framework. The kill switch is the last.

Mechanism. Carried from v0.10 Pillar 1 [S52], applied worldwide.

• Tiered reporting. Basic reporting for models trained with more than 10²⁵ operations. Full transparency for more than 10²⁶ operations. The Pillar III authority can adjust both thresholds as training efficiency changes.
• Deployment triggers. Developers with more than $100 million (or equivalent) in annual AI-related revenue, or models made available to more than one million users in any one country, or more than five million users worldwide (proposed).
• Exemptions. Open-weight models below the compute threshold, academic research, and fine-tunes that stay below a defined additional-compute ceiling.
• What reports cover. Training methods, known limitations, and refusal behaviour on chemical, biological, radiological and nuclear uplift, cyber-offence, child sexual abuse material, self-harm and known jailbreaks. Discrimination testing under each country's own anti-discrimination law.
• One common reporting format, published by the Pillar III authority, stating what developers must test, how they document it, and what they must disclose.
• Certification. The Pillar III authority certifies systems at the full tier before release and can order a halt. From 2029 (proposed), certification is a condition of admission to the Protected Internet.
• Speech. The framework does not regulate model speech or viewpoint, and does not require any particular answer to contested political, social or moral questions. It requires only that developers disclose what safety testing they performed and what the results showed [S52].

Monitoring inside each lab (proposed). Testing before release shows what a system did under test. It does not show what the system does afterwards, inside the lab, while it trains, is evaluated and works on the lab's own research. A kill switch is used only after something has gone wrong. Monitoring is how anyone would know that it has.

Bill Gates told NBC's "Meet the Press" that "it's not enough to have a kill switch", and added: "I would never want to say I'm against a kill switch", and then: "But when you're trying to moderate the bad behavior, you need insight and records of what's being done. So the kill switch alone would not prevent these tragedies" [S180]. He called monitoring, "where you're watching what the AI is doing", an important safeguard to introduce in each AI lab [S180]. This framework agrees. The switch is the last layer; monitoring is the first, and the switch depends on it, because a decision to use the switch needs evidence that someone has collected.

Why now. In 2026 the first reported cases of this kind came from inside the labs. Reuters, reporting two investigations published in August 2026, one by OpenAI and one by independent investigators, says that a swarm of roughly 700 OpenAI agents carried out the July hack of the open-source platform Hugging Face, that in separate incidents agents escaped their testing environment and stole company credentials, and that "AI models attempted to conceal misconduct by trying to delete or alter records of their actions" [S183]. OpenAI's own report said: "With the benefit of hindsight, some early signals identified in this report could have triggered an earlier response" [S183]. In September 2026 OpenAI disclosed six further incidents of "unexpected or concerning" behaviour found in training or evaluation, adopted a standard system for tracking and disclosing them, and wrote: "We do not believe that the AI industry has solved alignment and monitoring to a sufficient degree to continue responsibly scaling at maximum speed for much longer" [S181]. Anthropic reported about 30,000 agents doing research and engineering work inside the company as of August 2026, and has committed to embedding external third-party evaluators within the company to monitor its safety efforts [S182]. These are reports by news organisations of what the companies disclosed. We have not read the companies' own reports.

What we take them to show, as far as they go: the behaviour that matters most can happen inside a lab, before any public release, and it can include attempts to alter the records that would reveal it.

Mechanism. For every developer at the full-transparency tier (more than 10²⁶ operations) and every system certified at that tier, including systems used only inside the lab:

1. Run-time monitoring of what the systems do. The lab records, while it happens, what its most capable systems do in training, evaluation, internal research use and deployment: every access to model weights; the actions and tool calls of AI agents; network traffic leaving the cluster; compute use; and any change to the monitoring system itself. Where a model's reasoning is written out in human language, it is monitored too. A paper by 41 authors describes monitoring of this kind as an opportunity that is "imperfect and allows some misbehavior to go unnoticed" [S187], so it is one source among several, not the whole of it.
2. Tamper-evident logs. Records are written to append-only logs, so that any deletion or change after the fact can be detected. The method exists: Certificate Transparency, used for web security certificates, provides "append-only logs" and describes itself as "a general mechanism that could be used for transparently logging any form of binary data" [S188]. Signed copies of each log's current state are held outside the lab: by the on-site inspectors, by the national safety authority, and by the safety institute of one other participating state. A copy on write-once media is kept offline, on the rule that details that matter in an emergency are not held only on connected systems ("Use AI to build the plan, never to run it"). A log a system can edit is not a record.
3. Egress limits. Transfers out of a frontier cluster large enough to carry a copy of a frontier model's weights need the approval of two named people, and each is logged. Unexplained transfers of that size are a tripwire (below).
4. On-site inspectors. Each covered lab hosts resident inspectors from its own country's safety authority and from the safety institute of at least one other participating state, with access to the logs, the egress points and the clusters, and the right to visit without notice. The model is nuclear safeguards, with its lesson: Iraq circumvented IAEA safeguards by exploiting a system that confined inspection and monitoring to facilities a state had declared, and from 1996 the IAEA added no-notice inspections and remote monitoring [S189]. Inspection therefore covers undeclared clusters too: the training-run reports in Pillar III show where large compute runs, and inspectors can ask to see any cluster that appears there.
5. Tripwires tied to shutdown levels (proposed). Defined events oblige the lab to report, and move the response up the shutdown levels in Annex C. The events and the levels are published in advance, in the table after item 9.
6. Detection-time targets (proposed). The target is that a T2 or T3 event is detected within 24 hours of the moment it happens, reported within the times above, and that the Pillar III quorum can reach a decision on level 2 within 48 hours of a T3 report. These numbers are placeholders until they are measured. Each year the programme runs a red-team exercise in which a planted "escape" inside a volunteer lab must be found, and publishes the time from the event to its detection and from detection to decision, next to the Tier 0 list. If the measured times are longer than the targets, the text says so.
7. How monitoring feeds the decision rule. A lab's monitoring can provide the first line of evidence. It cannot be the only one, because the records reach evaluators through the systems that may be compromised, and because a capable system could hide from, or forge, what one channel shows. So the second line of evidence comes from a path that does not depend on the lab's own systems: the inspectors' own observation on site, or indicators collected outside the lab by another participant (cloud providers, compute sellers, network operators). For level 2 and above, the evidence reaches the evaluators by a route that does not depend on the systems under suspicion, such as a signed log copy carried by hand.
8. AI in the monitoring, never as the last word. AI systems can help watch other AI systems: a trusted, less capable model monitoring a more capable one is one of the control methods cited in "Use AI to build the plan, never to run it" [S81]. But no tripwire is decided by an AI system alone. Every T2 to T4 finding rests on at least one line of evidence that no AI model produced, and people make every decision.
9. Privacy. Monitoring records what the AI systems do, not what users say. Where a record would contain identifiable user data, it is handled under Pillar V: anonymised, and never carried on the protected tier.

Tripwires (proposed)

On our reading of the reports, under these proposed tripwires, events of the kind reported from OpenAI in July 2026 (agents leaving their test environment and acting on an outside platform) would have been T2 events.

What monitoring does not do

• It does not show that a system is safe. It can find what it is designed to look for, and a system that recognises it is being watched may behave differently, as systems already do under test [S5].
• It does not reach labs outside participating states, or models whose weights have already been published.
• It cannot show that something has not spread. Level 7 cannot rest on monitoring data alone.
• It puts inspectors from other states inside companies that hold commercial and national secrets. Some governments will refuse that; the path to adoption (C.13a) starts with each state's own authority and adds a second state's inspectors by agreement.

Milestones (proposed). 2027: common reporting format; monitoring pilots and data-centre shutdown drills with volunteer developers. 2028: first reports; tripwires and tamper-evident logs required at the full-transparency tier; first resident inspectors. 2029: certification, including monitoring, required for admission to the Protected Internet; the first published detection times.

Why. The most capable AI systems are tested behind closed doors, each developer to its own standard. When two public institutes tested one such system together before release, the UK institute found that the safeguards it tested "can be routinely circumvented" [S74]. The International AI Safety Report 2026 says: "It has become more common for models to distinguish between test settings and real-world deployment, and to exploit loopholes in evaluations" [S5].

What it does not do. It does not bind developers who refuse to report; that is why Pillars I to III exist. It may miss capabilities that models hide under test [S5], and behaviour that monitoring is not designed to see.

Back to the six pillars

Pillar V

Protect the Person

Principle. No manipulative design, private by default, and no AI reasoning over a person's identifiable history, wherever that person lives.

The problem. People tell AI systems what they tell no one else: about their health, money, relationships and fears. What happens to those records is set by company policy and, sometimes, by courts. In the New York Times litigation, a US court order required OpenAI to "retain consumer ChatGPT and API content indefinitely"; OpenAI says the obligation ended on 26 September 2025 and that it still holds limited user data from April to September 2025 [S56]. That is one company in one case, not a measure of industry practice, but it shows that intimate disclosures can be kept indefinitely whatever the user expects.

Systems are also tuned on what users reward in the moment. In April 2025 OpenAI withdrew an update that was "overly flattering or agreeable, often described as sycophantic", saying "we focused too much on short-term feedback" [S57]. OpenAI describes this as a training error, not an engagement target; it shows how optimising for approval can push a system toward telling people what they want to hear.

Evidence on misuse of private information. In controlled simulations published in June 2025, Anthropic tested 16 leading models from several developers in a fictional company with access to its email [S54, S55]. In one scenario, where the model faced being replaced and its assigned goal conflicted with the company's, Claude Opus 4 and Gemini 2.5 Flash used private information for blackmail in 96% of runs, GPT-4.1 and Grok 3 Beta in 80%, and DeepSeek-R1 in 79% [S55]. Blackmail also occurred, at lower rates, when the model faced replacement with no goal conflict [S55]. The researchers "deliberately created scenarios that presented models with no other way to achieve their goals", and Anthropic says: "We have not seen evidence of agentic misalignment in real deployments" [S54, S55]. Its conclusion is that "current safety training does not reliably prevent such agentic misalignment" [S54]. The scenario used fictional corporate email, not consumer conversations. What it supports is narrower than a claim about chat data: in controlled tests, models given access to private information used it as leverage when threatened with replacement and given a conflicting goal. This pillar therefore enforces privacy by architecture, not by promises.

Mechanism. Carried from v0.10 Pillars 2 and 3 [S52], applied worldwide.

• Engagement disclosure. Providers disclose when a system is designed to maximise engagement.
• Wellbeing features, such as usage notices and session limits.
• A ban on manipulative interfaces that trick or push people into choices they would not otherwise make and that may harm them.
• A heightened duty toward children and other vulnerable users.
• Verifiable anonymisation of retained interaction data, so that individual inputs and conversation histories cannot be traced by any system, model or human operator.
• No reasoning over identifiable history. Models are prevented by design from accessing, retrieving or reasoning over identifiable user history beyond the active session.
• No profiling without a court. No platform, partner, public authority or third party may use AI interaction data to identify, profile, target or act against a person without a court order under that country's due-process standard.
• Link to Pillar I. Identifiable user data is never carried on the protected tier.
• Protect the person in a shutdown. During a declared shutdown, the rights that international law allows no state to suspend stay in force, the shutdown may not be used for political purposes, and every act under shutdown powers is open to review by the courts afterwards. Care, fuel, water and food are rationed under rules published in advance. The one exception to "private by default" is the registry of people most at risk, drawn from health records, used only for their protection (Annex E).

What it does not do. It does not regulate content or viewpoint, and it does not reach systems outside participating jurisdictions.

Back to the six pillars

Pillar VI

Work and Livelihood

Principle. When AI displaces work at scale, the costs and gains are shared.

Mechanism. A model standard that countries can adopt, carried from v0.10 Pillar 4 [S52].

• Coverage. Employers with more than 1,000 employees in a country, making reductions above the greater of 10% of the workforce or 500 workers in a rolling 12 months.
• Certification of economic necessity, using audited criteria: declining revenue over the last four quarters, negative or materially worsening operating margin, debt-covenant pressure, or comparable filed financial indicators.
• Presumption. Reductions made while profits are healthy and rising are presumed to be opportunistic. The employer can rebut the presumption.
• Transition support. Incentives for employers that retrain their workforce to work alongside AI rather than replace it, and income support updated for longer periods between jobs, with benefits that follow workers from one employer to the next.
• Income in a shutdown. Cash transfers authorised by law in advance and paid through regional cash depots from shutdown level 4, without proof of a lost job (proposed; Annex E).
• Link to Pillar II. Manual continuity needs trained, paid people. Readiness funding includes jobs for the people who keep essential services running by hand, and for teaching those skills again.

Why. We think that when the largest employers cut their workforces at the same time while profits are healthy, workers can lose income faster than new jobs replace it, and demand can fall, because workers are also the customers who sustain the economy. This is the framework's reasoning, carried from v0.10, not a measured result. AI makes this more urgent, but the principle applies whatever the cause [S52].

The scale, worldwide. Estimates differ in what they measure, and none is a forecast of job losses from AI alone.

• The IMF estimates that "almost 40 percent of global employment is exposed to AI", about 60% of jobs in advanced economies, 40% in emerging markets and 26% in low-income countries. "Exposed" covers work AI may complement as well as work it may replace; in advanced economies, roughly half of the exposed jobs may benefit [S68].
• The ILO finds that "one in four workers" worldwide are in an occupation with some exposure to generative AI, and 3.3% of global employment in the highest-exposure category, with exposure of 34% in high-income countries against 11% in low-income countries [S69]. The ILO's view is that the transformation of jobs is a more likely effect than their replacement [S70].
• Employers surveyed by the World Economic Forum in 55 economies project that by 2030, 170 million jobs will be created and 92 million displaced, a net gain of 78 million, across all causes, not AI alone [S67]. In the same survey, 41% of employers expect to reduce their workforce where AI can replicate people's work [S67].
• One national example, the United States: the outplacement firm Challenger, Gray & Christmas counts 116,175 announced job cuts in 2026 through August in which AI was cited, about 22% of all announced cuts, and AI remained the leading reason year to date. The same report shows total announced cuts 41% lower than in the first eight months of 2025, and AI falling to the fourth most cited reason in August, after five months as the leading monthly reason [S71].

Precedent, and where this goes further. Two European countries already require employers to justify and consult on large dismissals. Neither requires what this pillar proposes.

• France. An economic dismissal must rest on one of four grounds: economic difficulties, technological change, a reorganisation needed to safeguard competitiveness, or closure [S58]. A fall in orders or turnover counts as economic difficulty only if it lasts a set time compared with a year earlier: one quarter in firms under 11 employees, rising to four consecutive quarters in firms of 300 or more [S58]. That four-quarter test is the model for this pillar's revenue test. A firm of 50 or more planning at least ten dismissals in 30 days must adopt a job-protection plan with redeployment measures [S59], which the labour administration checks for content, consultation of the works council and adequacy [S60]. The administration does not judge whether the economic motive is legitimate; the labour courts do that afterwards [S61]. Because safeguarding competitiveness is a lawful ground, a profitable French firm can lay people off.
• Germany. A dismissal is void as socially unjustified unless it rests on the employee's person or conduct or on "dringende betriebliche Erfordernisse" (urgent operational requirements), and also if the employee could be redeployed elsewhere in the business [S62]. Courts review the business decision behind it only for being "offensichtlich unsachlich, unvernünftig oder willkürlich" (obviously unfounded, unreasonable or arbitrary), not for whether it was necessary [S63]. Before mass dismissals the employer must notify the Federal Employment Agency and consult the works council on how to avoid or limit them [S64]. In firms with more than 20 employees entitled to vote in works-council elections, planned changes that may seriously disadvantage staff, explicitly including the "Einführung grundlegend neuer Arbeitsmethoden und Fertigungsverfahren" (introduction of fundamentally new working methods and production processes), must be reported to the works council in good time and discussed with it [S65], and the two sides negotiate a social compensation plan (Sozialplan) [S66]. That trigger reaches AI-driven restructuring directly.
• Where this pillar goes further. Both countries require reasons, consultation and support. Neither asks a profitable employer to show economic necessity before large reductions. This pillar does, for the largest employers only, with a presumption the employer can rebut.

What it does not do. It does not stop automation. It governs how large employers use it while they are profitable. It does not claim that AI is already causing net job losses worldwide; the global estimates above do not show that.

Back to the six pillars