House Bill Would Require AI Shutdown Controls

The published bill text defines covered technology as an AI system developed with computing power that would cost more than $100 million at prevailing US cloud prices. A covered entity would have to operate that technology, make it available through a hosted service or similar interface, and derive at least $500 million in annual gross revenue from the technology. Personal, academic and non-commercial uses are excluded.

Within 90 days of enactment, DHS would begin rulemaking on covered entities, covered technology and shutdown capabilities. Providers would have to report a covered incident within 15 days and preserve relevant model weights and telemetry after an emergency order.

The bill defines covered incidents outside red-teaming or other structured testing. Examples include interference with a lawful shutdown instruction, unintended conduct causing at least 10 deaths or $100 million in economic damage, concealment from monitoring or shutdown mechanisms, and specified loss-of-control behavior. That testing exclusion matters because lawmakers cited OpenAI's recent internal security evaluation when announcing the proposal, but the statutory trigger is written around conduct outside controlled testing.

If DHS determines that a covered incident occurred, the department could order measures calibrated to the incident, ranging from throttling inference or compute allocation to suspending access or shutting the technology down. A provider could seek reconsideration within 48 hours and later petition the US Court of Appeals for the District of Columbia Circuit, but an appeal would not automatically pause the order.

The bill sets civil penalties of up to $2 million per day for general violations and up to $20 million per day for violating an emergency order. It would also let DHS verify compliance through audits, telemetry, on-site inspection or other forensic review.

For model and platform teams, the proposal maps broad AI-control language to specific operational systems: model inventories, privileged service controls, access revocation, incident telemetry, forensic preservation and tested rollback paths. Whether those duties take effect—and how DHS defines the thresholds in rules—depends on the legislative process.