DefinitionEU AI Act · Article 14(4)(e)Version 1.025 October 2026
AI kill switch: a stop path built into the architecture
An AI kill switch is the stop path built into the layer that runs an AI system: one authorized action halts, throttles or rolls back a workflow, a model or a user’s access, revokes the session and tool permissions of the agents concerned and is recorded, so that its time to stop is measured, not promised. This entry sets out what a stop must reach, its hooks in the EU AI Act and the NIST AI RMF, and how its time is measured, read in primary sources on 25 October 2026.
On this page
A button stops what one vendor controls. A stop path stops what you run.
In this entry, "we" means Hikari Blue, which engineers and operates the AI operating layer that carries this stop path. The definition is ours; the legal texts and frameworks it cites are read in their primary sources, listed in section 7.
3 things are called a kill switch. A button in a vendor’s console stops what that vendor’s software controls. A runbook says who should act, and in what order. A stop path is wired into identity, network and runtime, so that one authorized action takes effect and leaves a record. Only the third can be timed.
Kill switch as architecture, not feature
A kill switch is architecture, not a feature, when the stop is enforced below the application, at the identity, network and runtime layers the enterprise controls, so that it works even if the agent framework, the model provider or the user interface fails, and it does not depend on the goodwill of the system it stops.
| Layer | What the stop does | It still holds if |
|---|---|---|
| Identity | The agent’s credentials, tokens and sessions are revoked at the enterprise identity provider. | The agent framework fails or ignores the stop. |
| Network | The policy enforcement point closes the agent’s connections to tools, data and models. | The application or its interface fails. |
| Runtime | The layer stops dispatching the agent’s tasks and cancels those already queued. | The model provider is unreachable or keeps answering. |
| Vendor console, a feature | A button in the vendor’s interface stops what the vendor’s software controls. | The vendor, its console and its goodwill hold, and only then. |
NIST SP 800-207, Zero Trust Architecture (August 2020), describes the policy enforcement point as responsible for “enabling, monitoring, and eventually terminating connections between a subject and an enterprise resource.” In our reading, an agent is a subject like any other, and its stop belongs at that point, not inside the agent.
The test. Disable the agent framework or cut the model provider, then trigger the stop on one agent. Pass: its tool calls are refused, its session is revoked, the other agents keep running, and the record shows who stopped it and when.
What a stop must reach: workflow, model, user, agent
A stop that reaches only 1 of the 4 leaves the other 3 running. Each is one action, with an author and a timestamp in the record.
Workflow
One action halts the workflow, queued tasks included. Nothing more reaches people or systems: that is the condition Time to Stop sets for an effective stop.
Model
One action takes a model out of routing for a task class, or sends the task to its declared fallback. NIST AI 100-1 calls this superseding, disengaging or deactivating a system.
A user’s access
One action withdraws one person’s access to an AI use, without stopping the workflow for everyone else.
Agent
One action revokes the agent’s session and tool permissions. The other agents of the workflow keep running: that is the pass condition of control C4.
Halt is 1 of 3 actions. The same path throttles, by lowering the rate or budget declared for an agent, and rolls back, by returning a workflow to its last approved model or policy version.
Restart is a separate decision. In our governance framework, any named operator or verifier halts an agent, a model or a workflow in one action; only the AI risk owner authorizes the restart (GOV-A-04).
Revocation can rest on existing standards. The NIST NCCoE concept paper of February 2026 lists SCIM as a potential way to create, update and revoke agent identities across systems.
1 regulation and 2 frameworks ask for a stop. None says where to wire it.
The EU AI Act sets the duty for high-risk systems; NIST and OWASP describe the mechanism. The last column is our reading of what each one requires from the stop path.
| Provision | What it says | In our reading, what the stop path provides |
|---|---|---|
| EU AI Act, Article 14(4)(e) | The persons assigned to oversight are enabled “to intervene in the operation of the high-risk AI system or interrupt the system through a ‘stop’ button or a similar procedure that allows the system to come to a halt in a safe state.” | One authorized action that brings the system to a halt in a safe state, held on the control plane, not in the application. |
| EU AI Act, Article 26(2) | Deployers assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support. | The authority to stop belongs to named persons, recorded in the register, not to a team or a vendor. |
| EU AI Act, Article 26(5) | A deployer that has reason to consider that the system presents a risk informs the provider or distributor and the market surveillance authority without undue delay, and suspends the use of the system. | Suspension is an action with an author and a timestamp, so the deployer can show when the use stopped. |
| NIST AI 100-1, MANAGE 2.4 | “Mechanisms are in place and applied, and responsibilities are assigned and understood, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use.” | The stop path and its drill (GOV-A-04): the mechanism exists, and a named person is assigned to use it. |
| OWASP Top 10 for Agentic Applications, ASI10 | For Rogue Agents, OWASP recommends “kill-switches and credential revocation to instantly disable rogue agents.” | Revocation per agent identity, so one agent is disabled without stopping the others. |
Dates. Articles 14 and 26 sit in Chapter III, Sections 2 and 3. Since Regulation (EU) 2026/1744, in force since 27 July 2026, they apply from 2 December 2027 for Annex III high-risk systems and from 2 August 2028 for Annex I systems.
In our reading, the Act requires the stop for high-risk systems only. We wire the same stop path into every AI use we run in production, because the cost of a late stop depends on what the use does, not on its classification.
Mapping prepared by Hikari Blue; the European Commission, NIST and OWASP have not reviewed it. This is not legal advice.
Measuring it: Time to Stop, from T0 to T5
A stop that has never been timed is a promise. KILLSWITCH by Hikari Blue defines the measure; this entry uses its clock as published, without changing it.
| Mark | What it marks |
|---|---|
| T0 | The first observable signal of the failure exists: an alert, a ticket, a customer complaint, an employee noticing. |
| T1 | A human becomes aware of the failure. This is detection. |
| T2 | The owner, the role with authority to stop, is reached and informed. This is escalation. |
| T3 | The decision to stop is made. |
| T4 | The effective stop is verified: the use no longer produces any output or action toward people or systems, queued tasks included, and someone has confirmed it. |
| T5 | The stop is recorded and retrievable in the organization’s own log. This is the proof. |
Time to Stop is T4 minus T0. It is proven when the stop is also recorded (T5), and shown as unproven otherwise. A button pressed, a ticket opened or a decision made does not count as a stop.
Tabletop exercise, timed and self-reported; not a measurement of a real stop.
In production, the same clock reads from the record: control GOV-A-04 of our governance framework keeps the kill switch runbook and its drill history, with measured halt times.
What we refuse to ship
2 anti-patterns of our Reference Architecture fail the stop. We deliver neither.
The dashboard without a stop path
A governance dashboard that shows activity but cannot halt it. Activity is not accountability; without a wired kill switch it fails C4 and the timing test.
Shared-identity agents
Several agents acting under one service account. No action is attributable and no single agent can be halted alone, so it fails C4.
Our stack policy draws the rule both share: no agent in production without its own identity.
The questions asked about AI kill switches.
What is an AI kill switch?
The stop path built into the layer that runs an AI system. One authorized action halts, throttles or rolls back a workflow, a model or a user’s access, revokes the session and tool permissions of the agents concerned, and is recorded, so its time to stop can be measured.
Does the EU AI Act require a kill switch?
For high-risk systems, yes in substance. Article 14(4)(e) requires that the persons assigned to oversight can interrupt the system “through a ‘stop’ button or a similar procedure that allows the system to come to a halt in a safe state.” Article 26(5) requires the deployer to suspend use when it has reason to consider that the system presents a risk. Both apply from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I systems.
What makes a kill switch architecture rather than a feature?
Where the stop is enforced. A button in a vendor’s console stops what that vendor’s software controls. A stop enforced at the identity, network and runtime layers the enterprise controls still holds when the agent framework, the model provider or the interface fails.
How is the time to stop measured?
With the Time to Stop clock of KILLSWITCH by Hikari Blue: from the first observable signal of the failure (T0) to the verified effective stop (T4), queued tasks included. It is proven when the stop is also recorded in the organization’s own log (T5). Our Kill Switch Drill is a tabletop exercise, timed and self-reported; not a measurement of a real stop.
Who may trigger the stop, and who restarts the system?
In our governance framework, any named operator or verifier halts an agent, a model or a workflow in one action. Only the AI risk owner authorizes the restart. Each of them is a named person, and both actions are recorded.
Does stopping one agent stop the whole workflow?
Not when the stop is wired to the agent’s own identity. Control C4 of our Reference Architecture sets the pass condition: the halt lands in seconds, the agent’s tool permissions are revoked, and the other agents in the workflow keep running.
Reference documents and primary sources.
Every article, subcategory and date on this entry comes from the sources below, consulted on 25 October 2026.
Reference documents
- What is an AI operating layer? The category this stop path belongs to: routing, policy, record and a way to stop.
- Glossary of the AI operating layer Every term of the layer, each defined in one sentence with its sources.
- AI Operating Layer Reference Architecture v1.0 · C4 Agent control by architecture: the property, the test and the pass condition.
- Enterprise AI Governance Framework v1.0 · Domain A 4 controls that make every agent attributable, bounded, supervised and stoppable.
- Governed autonomy: how much an AI agent may do alone The 3 levels of autonomy, each with a stop at hand.
- AI audit trail: definition, fields and EU AI Act mapping The record in which each stop, throttle and rollback is written.
Primary sources, consulted on 25 October 2026
- EUR-Lex · Regulation (EU) 2024/1689, the AI Act, consolidated text (opens in a new tab) Version of 27 July 2026. Articles 14(4)(e), 26(2), 26(5) and 113(c), read in English and in French. A documentation tool without legal effect.
- Official Journal · Regulation (EU) 2026/1744, Digital Omnibus on AI (opens in a new tab) Published on 24 July 2026, in force on 27 July 2026. New Article 113(c).
- NIST AI 100-1 · Artificial Intelligence Risk Management Framework (AI RMF 1.0) (opens in a new tab) NIST, January 2023. MANAGE 2.4, quoted in section 3.
- NIST SP 800-207 · Zero Trust Architecture (opens in a new tab) NIST, August 2020. The policy enforcement point, quoted in section 1.
- OWASP GenAI Security Project · Top 10 for Agentic Applications for 2026 (opens in a new tab) Published on 9 December 2025. ASI10 Rogue Agents, containment and response.
- NIST NCCoE · Accelerating the Adoption of Software and AI Agent Identity and Authorization (opens in a new tab) Draft concept paper, February 2026. SCIM listed for revoking agent identities. PDF.
How to cite this document.
This URL is permanent and always serves the current version. Each change of substance increments the version and is listed in the changelog below, so a citation stays traceable to the text it quoted.
Preferred citation
Hikari Blue, "AI kill switch: a stop path built into the architecture", Glossary of the AI operating layer, v1.0, 25 October 2026, https://hikariblue.com/glossary/ai-kill-switch
Section anchors are stable: #definition, #architecture, #reach, #legal, #time-to-stop, #refuse, #faq, #references, #cite.
Changelog
v1.0 · 25 October 2026. First public version.
License. Published under CC BY 4.0: free to cite, quote and reuse with attribution to Hikari Blue and a link to this page. The license covers Hikari Blue’s text, tables and diagrams on this page; it does not cover third-party data, quotations or legal texts, which keep their own terms, nor the Hikari Blue name and logo, trademarks of UNITED4 LLC.
Walk one stop path. See what it reaches.
30 minutes with a named partner. We take one AI use you run today and walk its stop: who can trigger it, what it reaches among workflow, model, user and agent, and where it is recorded. You leave with the gap list, whether or not we work together.
- One AI use, its stop walked end to end
- What the stop reaches, and what it misses
- Who holds the authority to stop and to restart