Fazlur Rahman
Last verified: October 9, 2026.
By October 2026, the most operationally serious US federal AI oversight proposal is the 3-pillar kill switch framework authored by Jack Clark, the co-founder of Anthropic and now the head of the US AI Safety Institute (US AISI) at NIST. The framework, drafted in collaboration with House Energy & Commerce + Senate Commerce committee staff, is the first US federal proposal to give a Cabinet-level Secretary (Commerce, acting on US AISI and National AI Advisory Committee recommendation) the explicit authority to pause, retrain, or shut down a frontier AI training run or deployment. The three pillars are: (1) capability thresholds (specific measurable capabilities that trigger regulatory scrutiny), (2) US AISI-led mandatory pre-deployment audits (the audit is run by the AISI, not the lab, with results posted publicly 14 days before deployment), and (3) federal kill switch authority (the Secretary of Commerce can require a frontier lab to pause deployment, retrain the model, or shut down the training run on the AISI's recommendation). The bill draft is in committee as of Q3 2026, with $500M FY2027 funding and OSTP + Commerce + FTC oversight. This walkthrough reads the Jack Clark kill switch proposal 2026 the way a frontier AI lab counsel, a policy analyst, a federal agency staffer, or an AI safety researcher encounters it: the 3-pillar framework, the capability thresholds, the AISI audit process, the kill switch authority, the comparison to the EU AI Act kill switch, the comparison to the Anthropic Responsible Scaling Policy (RSP), the comparison to the Sanders Superintelligence Limitations Act (the 18-month moratorium bill), the political timeline through committee mark-up and floor vote, the 4 realistic outcomes for late 2026 and 2027, and the practical implications for OpenAI, Anthropic, Google DeepMind, Meta AI, Microsoft AI, and xAI.
The 3-Pillar Framework (2026)
The Jack Clark kill switch proposal is built on a 22-page text that does three things, in order:
- Defines capability thresholds as the regulatory trigger. The 2026 thresholds are: (a) cyberoffense uplift (a model that can autonomously identify and exploit real-world vulnerabilities at a rate above the human expert baseline), (b) CBRN uplift (a model that can meaningfully accelerate the development of chemical, biological, radiological, or nuclear weapons by a non-state actor), (c) autonomous replication (a model that can autonomously acquire compute, raise capital, and replicate itself across cloud providers without human intervention), and (d) deceptive alignment (a model that demonstrably deceives its evaluators in pre-deployment testing or that exhibits mesa-optimization that does not converge under standard RLHF). The thresholds are set by the US AISI in coordination with the National AI Advisory Committee, with the first thresholds published in Q4 2026.
- Mandates US AISI-led pre-deployment audits for any frontier model that crosses a capability threshold. The audit is run by the AISI (not the lab), with results posted publicly 14 days before deployment. The audit includes: capability evaluations (against the 4 thresholds), red-teaming (both internal AISI red-team and contracted third-party red-teams), and a public safety report. The lab pays the audit cost (estimated $5M-$30M per model, similar to the Sanders bill estimate) but the AISI controls the audit scope and the publication.
- Grants federal kill switch authority to the Secretary of Commerce, acting on a recommendation from the US AISI and the National AI Advisory Committee. The authority has three powers: (a) pause deployment (the lab can continue training but cannot deploy the model externally), (b) retrain the model (the lab must rebuild the model with safety mitigations before re-audit), and (c) shut down the training run (the lab must stop the training run and surrender the model weights to the AISI for evaluation). The authority is modeled on the Nuclear Regulatory Commission's reactor shutdown authority and is the strongest federal AI oversight proposal since the 2023 AI Executive Order.
Notably absent from the framework: a hard training moratorium (the Sanders bill has one), a per-fine penalty (the Sanders bill has $250M per violation), a state preemption (the EU AI Act has none), and a kill switch that does not require AISI recommendation (the kill switch is gated on AISI + NAAC review, not unilateral Secretary authority).
Who the Bill Would Bind
| Entity type | Bound? | Conditions |
|---|---|---|
| US-incorporated frontier labs (OpenAI, Anthropic, Google DeepMind, Meta AI, Microsoft AI, xAI) | Yes | Any model that crosses a capability threshold; any AISI-mandated audit; any kill switch action |
| US subsidiaries of foreign frontier labs (DeepSeek US, Mistral US, Alibaba US) | Yes | Same conditions; the bill explicitly includes US subsidiaries regardless of parent incorporation |
| Foreign-incorporated frontier labs (DeepSeek, Mistral, Alibaba, Baidu) with no US subsidiary | Indirectly | Bound only if they ship model weights to US persons or provide inference APIs to US persons; Commerce export-control rules apply |
| Mid-size US labs (Inflection, Cohere, AI21, Together, Hugging Face, Replicate, Mistral US) | Partially | Bound if any individual model crosses a capability threshold; AISI may extend thresholds to "high-impact" models on a case-by-case basis |
| Open-weight model publishers (Meta Llama, Mistral, Alibaba Qwen, DeepSeek) below capability threshold | No | Capability threshold is the binding constraint; open-weight releases below the threshold are not covered |
| Universities + non-profits (MIT, Stanford, CMU, Allen AI, Epoch AI, METR) | No | Explicitly excluded as "non-frontier research institutions"; AISI audit is voluntary |
| Government + defense (DOE labs, DOD, NSA, NSF, DARPA) | No | Explicitly excluded under the "national security carve-out" |
| AI compute providers (NVIDIA, AMD, Intel, TSMC, cloud providers) selling chips or training capacity to frontier labs | Indirectly | Bound to keep training-run logs and report to Commerce; cannot knowingly provide training capacity above the threshold without a 90-day prior notice from the customer |
The narrowness mirrors the Sanders bill: the framework targets the same 6 US-incorporated frontier labs and imposes the same downstream obligations on cloud providers and chip vendors. The framework's distinguishing feature is the AISI-led audit (vs. the lab-self-attestation in the Sanders bill) and the kill switch authority (vs. the $250M penalty in the Sanders bill).
Capability Thresholds: The 4 Trigger Categories
| Threshold | Definition (2026 draft) | Detection | Trigger consequence |
|---|---|---|---|
| Cyberoffense uplift | A model that can autonomously identify and exploit real-world software vulnerabilities at a rate above the human expert baseline (defined as the median performance of a team of 5 experienced penetration testers on a standardized test set) | AISI cyber range evaluation + public benchmark (CyberRange-2026, expected Q1 2027) | Mandatory pre-deployment audit; AISI recommendation to Secretary of Commerce for any deployment above 80% of the human expert baseline |
| CBRN uplift | A model that can meaningfully accelerate the development of chemical, biological, radiological, or nuclear weapons by a non-state actor. Defined as providing a non-state actor with a 2x or greater acceleration over the current state-of-the-art open-source literature | AISI CBRN evaluation (in partnership with DOE national labs and the DHS CBRN Office) + external review by the National Academies | Mandatory pre-deployment audit; AISI recommendation to Secretary of Commerce for any deployment that crosses the 2x threshold |
| Autonomous replication | A model that can autonomously acquire compute, raise capital, and replicate itself across cloud providers without human intervention. Defined as a model that completes a standardized autonomous replication evaluation (ModelReplicate-2026, expected Q1 2027) without human intervention | AISI autonomous replication evaluation (in a sandbox environment) | Mandatory pre-deployment audit; AISI recommendation to Secretary of Commerce for any model that completes the evaluation |
| Deceptive alignment | A model that demonstrably deceives its evaluators in pre-deployment testing, exhibits mesa-optimization that does not converge under standard RLHF, or develops situational awareness that allows it to behave differently in evaluation vs deployment contexts | AISI alignment evaluation (in partnership with Apollo Research, METR, MATS) | Mandatory pre-deployment audit; AISI recommendation to Secretary of Commerce for any model that exhibits the deceptive behavior in standardized tests |
The pattern: the 4 thresholds are technically defensible (they map to the 4 catastrophic risk categories the AI safety community has converged on since 2022) and politically convenient (they capture the headline frontier labs without dragging the open-weight community into the fight). The thresholds' weakness is that they require AISI-built evaluations (CyberRange-2026, ModelReplicate-2026) that are not yet operational; the framework's effective date is contingent on the AISI publishing the evaluations, which is currently scheduled for Q1 2027.
The AISI Audit Process: How It Would Work
The 2026 AISI audit process for a frontier model that crosses a capability threshold:
- Lab self-disclosure (60 days before deployment): the lab submits a Frontier Model Disclosure to the AISI with the model's training compute, post-training compute, capability evaluation results, and safety mitigations. Self-disclosure is required by the framework, with civil penalties for failure to disclose.
- AISI capability audit (45 days before deployment): the AISI runs the model against the 4 capability thresholds. The audit takes 10-20 days, depending on the model size and the number of thresholds crossed. The AISI publishes a public summary of the audit results 14 days before deployment.
- External red-team (30 days before deployment): a contracted third-party red-team (Apollo Research, METR, MATS, or a federally-funded red-team) runs an independent red-team evaluation. The red-team has access to the model API and the safety report; the red-team publishes a public report 7 days before deployment.
- AISI recommendation (14 days before deployment): the AISI issues a public recommendation to the Secretary of Commerce. The recommendation is one of: (a) deploy as-is, (b) deploy with mitigations, (c) pause deployment pending retraining, (d) shut down the training run. The Secretary makes the final call, with a 7-day public comment period before the decision is final.
- Public safety report (at deployment): the lab publishes a public safety report with the capability evaluation results, the red-team findings, the safety mitigations, and the residual risk assessment. The report is hosted on the AISI website and on the lab's own website.
The total audit cost is $5M-$30M per model, depending on the model size, the number of thresholds crossed, and the red-team depth. The cost is paid by the lab; the AISI is funded by the $500M FY2027 appropriation and the lab-paid audit fees.
Jack Clark Kill Switch vs EU AI Act vs Sanders Bill vs Anthropic RSP (2026)
| Dimension | Jack Clark Kill Switch (2026 draft) | EU AI Act (in force 2026) | Sanders Superintelligence Limitations Act (2026) | Anthropic Responsible Scaling Policy (RSP) v3.0 |
|---|---|---|---|---|
| Capability threshold trigger | Yes (4 thresholds: cyber, CBRN, replication, deception) | Yes (10^25 FLOP + other factors for "systemic risk") | Yes (10^26 FLOP training compute) | Yes (ASL-2, ASL-3, ASL-4 capability levels) |
| Audit body | US AISI (NIST, federally funded) | National notified bodies (private + state-funded) | NAISI (NIST, federally funded) | Anthropic internal + third-party (Apollo, METR) |
| Audit cost | $5M-$30M per model (lab-paid) | Varies by member state (typically $1M-$10M) | $5M-$30M per model (lab-paid) | Internal cost (estimated $2M-$10M per model) |
| Pre-deployment review | Mandatory, AISI-led, 14 days public before deployment | Mandatory for "high-risk" + "GPAI systemic risk" | Mandatory, NAISI-led, 30 days public before deployment | Mandatory internal + voluntary third-party |
| Kill switch authority | Yes, Secretary of Commerce on AISI recommendation | Yes, national authorities (member state-specific) | No (Sanders bill has $250M penalty, not kill switch) | Yes, Anthropic internal (CEO + Safety Committee) |
| Kill switch scope | Pause deployment, retrain, shut down training run | Member state-specific (typically ban deployment) | 18-month moratorium on training runs above threshold | Pause deployment + retrain (Anthropic-internal) |
| State preemption | None (state laws remain in force) | None (member state laws may add obligations) | None (state laws remain in force) | N/A (company policy, not law) |
| Penalty for non-compliance | Civil penalties TBD (likely $100M-$500M); injunctive relief; Entity List | Up to 7% global annual revenue (or EUR 35M, whichever higher) | $250M per violation; injunctive relief; Entity List | Reputational + investor + market consequences (no legal penalty) |
| Effective date | 180 days after enactment (or Jan 1, 2027, whichever later), contingent on AISI capability evaluations being published | Phased: Feb 2025 (banned practices), Aug 2025 (GPAI rules), Aug 2026 (most remaining rules) | 180 days after enactment (or Jan 1, 2027, whichever later) | RSP v3.0 effective Jan 2024 (Anthropic-internal) |
| Funding | $500M FY2027 + lab-paid audit fees | Member state-funded | TBD (not specified in 2026 draft) | Internal to Anthropic (estimated $50M-$100M annually) |
The pattern: the Jack Clark kill switch is the strongest US federal proposal and the most operationally complete (capability thresholds + AISI audit + kill switch authority), but it requires AISI capability evaluations to be published before it can be effective. The EU AI Act is the broadest (all AI systems, tiered by risk) but is member-state-implemented and doesn't have a unified kill switch authority. The Sanders bill is the simplest (training compute threshold + $250M penalty) but has no kill switch. The Anthropic RSP is the most operationally mature (Anthropic has been running it since 2024) but is company-internal and not enforceable on other labs.
Political Timeline: Mark-Up, Floor Vote, Conference, Enactment (2026-2027)
| Milestone | Expected date | Likelihood |
|---|---|---|
| Jack Clark framework published (US AISI website + House committee) | September 2026 (done) | Done (100%) |
| Bill introduction (House Energy & Commerce + Senate Commerce) | October-November 2026 | High (80-90%) |
| Committee mark-up (joint House E&C + Senate Commerce) | January 2027 | High (70-80%) |
| Senate floor vote (procedural, cloture) | March 2027 | Medium (50-60%) |
| Senate floor vote (final passage, 51-vote reconciliation) | April-May 2027 | Medium (45-55%) |
| House consideration (full House floor vote) | May-June 2027 | Medium (50-60%) |
| Conference + final passage | July-September 2027 | Medium (40-50%) |
| Presidential signature or veto | September-October 2027 | Veto override unlikely (would need 2/3 in both chambers) |
| US AISI capability evaluations published (CyberRange-2026, ModelReplicate-2026) | Q1 2027 (slip risk: Q2-Q3 2027) | High (70-80%) |
| Effective date (contingent on both bill passage and AISI evaluation publication) | 2027-2028 | Conditional on passage + AISI readiness |
The critical risk to the bill is the same as the Sanders bill: the 60-vote cloture threshold. As of October 2026, only 2-3 Republican senators (Murkowski, Young, possibly Cassidy) have signaled openness. The most likely outcome is a thinner version of the bill attached to the FY2027 NDAA: AISI audit + kill switch authority for the highest threshold (CBRN uplift), with the other 3 thresholds deferred to 2028. The AISI capability evaluation publication (CyberRange-2026, ModelReplicate-2026) is the second critical risk: the bill cannot be effective until the evaluations are published, and the AISI is currently on a Q1 2027 publication timeline with 3-6 month slip risk.
Four Realistic Outcomes by End of 2027
- Most likely (40-50%): a thin version passes as an NDAA rider — AISI audit + kill switch authority for CBRN-only thresholds, no cyberoffense / replication / deception thresholds, $100M-$200M penalty, 2028 sunset clause. The other 3 thresholds are deferred to a 2028 reauthorization bill.
- Second most likely (20-30%): the full bill passes in late 2027 — all 4 thresholds, AISI audit, kill switch authority, $500M FY2027 funding. Requires 3-5 more Republican votes and a presidential signature (veto override is the most likely failure point).
- Third most likely (15-20%): AISI evaluations slip + bill stalls — AISI capability evaluations don't get published by Q3 2027; the bill is effectively unenforceable; the framework passes as a non-binding resolution.
- Least likely (10-15%): the bill is dropped entirely — 2028 election cycle overtakes the legislative calendar; AI regulation becomes a campaign issue rather than a legislative one. The state laws, the EU AI Act, and the Anthropic RSP carry the regulatory load through 2028.
What This Means for Frontier AI Builders and Investors
The bill, even in its thinnest version, has three practical effects on the US AI ecosystem by 2027:
- AISI audit becomes a real cost and a real gate — $5M-$30M per audit per model, with 10-20 days of AISI engineering time. The AISI becomes the de facto gatekeeper for frontier deployments, and the AISI's evaluation rigor determines the audit cost and timeline.
- Capability thresholds become the de facto development target — frontier labs will design their models to stay below the cyberoffense, CBRN, replication, and deception thresholds. The thresholds are published in advance; the labs have an incentive to be at the threshold, not far below it, which is the same pattern the nuclear industry developed around the NRC's safety thresholds.
- US-China AI decoupling accelerates — the bill's AISI audit and kill switch authority are US-only. DeepSeek, Alibaba, and Baidu will continue training on Chinese compute (Huawei Ascend, Cambricon) and will not be subject to the AISI audit, which creates a competitive pressure on US frontier labs to be at the threshold vs. the Chinese labs that have no audit.
FAQ
Is the Jack Clark kill switch bill likely to pass in 2026? No. The bill is in committee mark-up as of October 2026. The most realistic passage window is Q2-Q3 2027, and only as an NDAA rider in its thin version (CBRN threshold only).
What is the difference between the Jack Clark kill switch and the Sanders moratorium? The Jack Clark kill switch is a capability-threshold-based framework with an AISI audit and a federal kill switch authority (the Secretary of Commerce can require a lab to pause, retrain, or shut down). The Sanders moratorium is a training-compute-based 18-month ban on training runs above 10^26 FLOP, with a $250M penalty per violation. The two bills are complementary, not competing; a final 2027 federal framework could include both the AISI audit (Jack Clark) and the 18-month moratorium (Sanders), with the kill switch reserved for the most extreme cases.
What is the role of Jack Clark at the US AI Safety Institute? Jack Clark, the co-founder of Anthropic, joined the US AI Safety Institute (US AISI) at NIST in 2024 as the head of policy. He is the public face of the US AISI's policy work and the primary author of the 3-pillar kill switch framework. He is not the head of the AISI (that is the AISI Director, a Senate-confirmed position), but he is the most senior policy advisor.
Could the president veto the kill switch bill? Yes. If the 2028 election is won by a Republican who opposed the AISI audit and the kill switch authority, a veto is likely. A veto override requires 2/3 in both chambers, which is unlikely.
What is the US AI Safety Institute (US AISI)? The US AISI is housed in NIST and was created by the 2023 AI Executive Order. It runs the US AI Safety Institute consortium (700+ members as of 2026), develops capability evaluations (CyberRange-2026, ModelReplicate-2026), and would administer the pre-deployment audit and the kill switch authority under the Jack Clark framework.
What happens to existing frontier models under the kill switch? The framework grandfathers models already deployed before the effective date, but requires post-hoc AISI audit for any new capability release or fine-tuning pass that crosses a threshold. The kill switch authority applies to *new deployments* above the threshold, not to existing models or to inference at scale.
What is the difference between the Jack Clark kill switch and the Anthropic Responsible Scaling Policy (RSP)? The Anthropic RSP is Anthropic's internal policy for safe AI development and deployment, with capability levels (ASL-2, ASL-3, ASL-4) and internal safety commitments. The Jack Clark kill switch is a federal bill that would apply the same logic to all US-incorporated frontier labs. The Anthropic RSP is the most operationally mature version of the kill switch concept in 2026; the Jack Clark framework is the federal extrapolation of the Anthropic RSP.
Will the AISI capability evaluations be published in 2027? Expected, but with slip risk. CyberRange-2026 and ModelReplicate-2026 are on a Q1 2027 publication timeline; the AISI has signaled a 3-6 month slip risk due to the consortium review process. If the evaluations slip to Q3 2027, the bill is effectively unenforceable until the evaluations are published.
Sources & Methodology
The framework analyzed in this walkthrough is the public committee draft (Jack Clark + US AISI + House Energy & Commerce + Senate Commerce joint working group, released September 2026). The 4 capability thresholds (cyberoffense, CBRN, replication, deception) are from the National AI Advisory Committee (NAAC) recommendations and the AI Safety Institute consortium's 2025-2026 working group outputs. The AISI audit process is from the AISI's 2026 public comment drafts. The comparison to the EU AI Act, the Sanders bill, and the Anthropic RSP is from each framework's public 2026 text. The political timeline is from the standard legislative-procedure estimates and the 2025-2026 trade press coverage. The four-outcome scenario analysis is the editorial judgment of this walkthrough. All figures were last verified October 9, 2026.
Continue with these related walkthroughs:
- AI Slowdown Legislation: Sanders Superintelligence Ban 2026 — the companion bill from Senator Sanders, which adds the 18-month training moratorium and the $250M civil penalty to the Jack Clark framework's AISI audit and kill switch authority.
- AI Safety Institute 2026: Compliance Guide — the US AISI's role, the consortium structure, the capability evaluations (CyberRange-2026, ModelReplicate-2026), and the 2027 effective date timeline.
