Governor Gavin Newsom issued an executive order Thursday directing state agencies to accelerate independent oversight of frontier AI companies and develop a framework for an emergency shutoff mechanism - an "AI kill switch" - for the most advanced models. The order follows what the administration described as alarming safety incidents, including the recent Hugging Face attack, and comes as federal lawmakers have not enacted binding AI safety legislation.
"We're not waiting to act - we're going to speed up our work on substantial and responsible AI oversight before it's too late," Newsom said. "While Washington abdicates its responsibility to protect Americans, California is building on the strongest AI regulatory framework in the nation."
Accelerating independent verification and on-site audits
The executive order directs the Government Operations Agency, in consultation with the Governor's Office of Emergency Services, to convene national experts and deliver recommendations within two months. The proposals will target several specific changes to state law.
One directive would require frontier AI companies to embed a designated independent verification organization on-site in their labs for regular audits and evaluations. Another would mandate that safety frameworks, transparency reports, and risk assessments filed under existing state law be verified to standards set by an independent organization. The order also calls for updating the definition of critical safety incidents to include loss-of-control events like the Hugging Face attack.
How the kill switch would work
The administration wants independent verification organizations to certify the effectiveness of any emergency shutoff mechanism on an ongoing basis. The concept builds on legislation Newsom signed earlier this year: Senate Bill 813, which established a framework for certifying independent verification organizations, and Assembly Bill 1405, which created a state registry for AI auditors with standards for independence, transparency, and integrity.
The executive order accelerates implementation timelines for both bills and pushes beyond their original scope. Newsom is calling on Congress and the Trump administration to adopt California's framework as a national baseline, describing the current federal posture as an "abject failure to create any form of meaningful AI oversight."
California's existing regulatory stack
The order sits atop a series of first-in-the-nation laws California has enacted since Newsom's initial 2023 executive order on generative AI. The Transparency in Frontier Artificial Intelligence Act (SB 53) requires developers to publicly disclose safety frameworks, report specified critical safety incidents, and protect whistleblowers. Other laws address AI companion chatbots used by children, deepfake election content, AI watermarking, and algorithmic pricing under state antitrust law.
For professionals navigating this regulatory environment, specialized training has emerged to bridge the gap between policy mandates and operational compliance. AI Regulatory Compliance Courses cover the audit and reporting requirements now accelerating under California law, while AI Public Policy Courses address the broader legislative frameworks shaping state and federal oversight.
On the cybersecurity front, California has launched an AI Cyber Defense Program and is placing an AI Cybersecurity Officer in each state agency. The state also operates a Tech Fraud Task Force targeting AI-enabled scams and has expanded tracking of AI's labor market effects through an AI Unemployment Tracker.
Why this matters for government and legal professionals
The two-month timeline for expert recommendations means agency counsel and compliance officers should expect draft regulatory language by late 2026. The proposed kill-switch requirement and on-site auditor mandates would create new obligations for any frontier AI company operating in California - and, given the state's market size, effectively nationwide. Legal teams should begin mapping how independent verification requirements interact with existing confidentiality agreements, intellectual property protections, and internal incident-reporting workflows. The expansion of what counts as a critical safety incident also broadens mandatory disclosure obligations, with potential liability implications for delayed or incomplete reporting.
Your membership also unlocks:
