H.R. 9917 is a bill of the 119th Congress introduced in the House of Representatives on July 23, 2026 by Rep. Ted Lieu (D-CA-36) "for himself and Mr. Moran," referred to the Committee on Homeland Security and, on July 24, 2026, to its Subcommittee on Cybersecurity and Infrastructure Protection. It would amend subtitle A of title XXII of the Homeland Security Act of 2002 (6 U.S.C. 651 et seq.) by adding a new section 2220F, requiring certain AI developers to maintain a technical shutdown capability and granting the Secretary of Homeland Security emergency authority to order proportionate corrective action. This page summarizes the Introduced-in-House text, the only version available (Source: congress.gov). The topic page is AI Kill Switch Act (Lieu–Moran).
Throughout the new section, the Secretary of Homeland Security acts "through the Director" — the Director of the Cybersecurity and Infrastructure Security Agency, the officer defined by the subtitle the section is inserted into. Every duty and authority in the section runs through that channel.
Rulemaking and scope
Proposed section 2220F(a)(1) requires the Secretary, not later than 90 days after enactment "and annually thereafter," to update by rule the definitions of "covered entity" and "covered technology." The rulemaking is recurring rather than one-off. Subsection (a)(2) directs the Secretary to weigh four factors: whether compliance costs would unduly burden a small business concern (as defined in section 3 of the Small Business Act, 15 U.S.C. 632); the need to cover entities whose activities could advance AI capabilities in national security, "including with respect to cybersecurity and chemical, biological, radiological, or nuclear capabilities"; the capabilities and deployment of covered technology and "the manner in which the model weights of such technology are made available"; and any other factor the Secretary finds relevant.
Subsection (a)(3) exempts an entity that operates or makes available a covered technology "for personal, academic, or non-commercial utilization only."
Shutdown capability and incident reporting
Subsection (b)(1)(A) requires covered entities, by rule issued on the same 90-day-and-annual schedule, to maintain a technical capability to carry out four actions: stop inference of the covered technology; terminate user access to it; suspend access with respect to "an account, user, or use pattern" identified by the covered entity or the Secretary as posing a risk of a covered incident or of a violation of law or of the technology's terms of service; and shut the technology down.
Subsection (b)(1)(B) requires a covered entity to report a covered incident to the Secretary "not later than 15 days after such covered entity becomes aware" of it.
Subsection (b)(2) directs the Secretary, in issuing those rules, to consider requiring the capability to rest on "a graduated deployment-corrections framework" that applies "when there is evidence of a credible risk of a covered incident" and whose measures are "calibrated to the severity and immediacy of such risk." The enumerated measures run from throttling or altering the inference rate, user access, or compute allocation; through disabling or restricting a capability; suspending the technology; shutting it down; and transitioning a dependent operation "to a backup system or an earlier version of such technology." The Secretary must also consider "[t]he risk that such a measure could disrupt critical infrastructure."
Subsection (b)(3) requires the Secretary to publish voluntary shutdown standards on a public CISA website not later than 180 days after enactment.
Emergency authority
Under subsection (c)(1), if the Secretary — acting through the Director and "in consultation with the Secretary of Commerce and the Director of National Intelligence" — determines that a covered incident has occurred, the Secretary may order the covered entity "to take action proportionate to the nature and immediacy of such incident," which may include any of the four capabilities in (b)(1)(A).
Subsection (c)(2) imposes three duties on the entity receiving an order, to be carried out "as soon as practicable": preserve the model weights and telemetry of the technology; notify "to the extent practicable" each operator or user of the order and of the extent to which they might be affected; and confirm to the Secretary that the order has been carried out. On that confirmation, subsection (c)(3) requires the Secretary to verify compliance "through audit, telemetry, on-site inspection, or other forensic review." Subsection (c)(4) requires a report to Congress on the determination that prompted the order, each action ordered, and the entity subject to it.
The appeal structure at subsection (c)(5) is narrow. A covered entity may petition the Secretary for reconsideration not later than 48 hours after the order, "but such petition does not stay such order." The Secretary must decide within five days; failure to decide "is deemed to be a determination in the negative." Judicial review lies in the U.S. Court of Appeals for the District of Columbia Circuit on a petition filed not later than 60 days after the order.
Investigative authority and penalties
Subsection (d)(1) authorizes the Secretary to administer oaths, to require testimony and the production of documents by subpoena, and to conduct investigations both within the United States and, "consistent with applicable law, outside the United States."
Civil penalties at subsection (d)(2) are structured in two tiers, both assessed per day and both requiring "reasonable notice and opportunity for a hearing":
| Provision violated | Maximum penalty |
|---|---|
| The section generally, (d)(2)(A) | $2,000,000 for each day on which the violation occurs |
| Subsection (c), the emergency-authority provision, (d)(2)(B) | $20,000,000 for each day on which the violation occurs |
Subsection (d)(2)(C) lists six factors in setting an amount: the nature, circumstances, extent, gravity and duration of the violation; the entity's degree of culpability; previous violations of the section; good-faith compliance efforts; whether the entity voluntarily disclosed the violation; and "[a]ny other factor that justice may require." Subsection (d)(3) permits referral to the Attorney General for a civil action where the Secretary believes a violation "has occurred, is occurring, or is about to occur."
Subsection (e) provides a cure period: a de minimis violation, or a technical defect resulting in a violation, "that is corrected not later than 30 days after discovery" is not considered a violation. Subsection (f) exempts nonpublic information submitted under the section from disclosure under 5 U.S.C. 552(b)(3) and from any state, local, or Tribal freedom-of-information, open-government, or open-records law.
Definitions
The thresholds and triggers sit in subsection (g), and their structure differs from the summary in the sponsors' announcement.
Covered entity (g)(4) requires three conjunctive conditions: the entity operates a covered technology or a system incorporating it; makes that technology available to a third party "through a programmatic interface, hosted service, or other similar mechanism"; and "[d]erives together with the affiliates, if any, of such person not less than $500,000,000 in gross revenue from such technology in the calendar year preceding the calendar year at issue." The revenue test is affiliate-aggregated and specific to revenue from the covered technology, not to total technology revenue. "Affiliate" (g)(1) means an entity that controls, is controlled by, or is under common control with another.
Covered technology (g)(6) means an artificial intelligence system "developed utilizing a quantity of computing power the cost of which would exceed $100,000,000 at the prevailing market price of cloud computing in the United States, as determined by the Secretary." "Artificial intelligence" takes its meaning from section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401); "artificial intelligence system" (g)(3) extends that to "a system, software, hardware, tool, or other utility that operates autonomously through the utilization of such artificial intelligence."
Covered incident (g)(5) has four prongs, all qualified by the words "outside of red-teaming or other structured testing":
- Sabotage of, or interference with, a lawful instruction to shut down a covered technology.
- Conduct of the technology unintended by its developer or operator that "causes the death of not fewer than 10 individuals or economic damages of not less than $100,000,000."
- Concealment by the technology of a capability, intention, or action "from a monitoring or shutdown mechanism."
- A loss-of-control scenario.
Loss-of-control scenario (g)(7) is separately defined as a scenario in which a covered technology "pursues outside of red-teaming or other structured testing a goal that is not a goal intended by the developer or operator," including where the technology behaves contrary to instruction "in a context relating to critical infrastructure or another high-stakes context"; alters operational rules or safety restrictions without authorization; subverts a monitoring or shutdown mechanism; or attains unauthorized access to its own model weights. These four are limbs of the loss-of-control definition, not freestanding covered-incident prongs.
Red-teaming (g)(8) means structured testing that is in a controlled environment, simulates real-world conditions, and uses an adversarial method to identify limitations, risks, flaws and vulnerabilities — such as a harmful output, an unforeseen or undesirable behavior, or a misuse risk. Because both the covered-incident definition and the loss-of-control definition carve out red-teaming and other structured testing, conduct observed inside an evaluation does not by itself trigger the section.
Section 2(b) of the bill makes the conforming clerical amendment inserting section 2220F into the Homeland Security Act's table of contents after section 2220E.
Provenance
Fetched in full from congress.gov, the legislative-information system maintained by the Library of Congress, under the "ih" (introduced-in-House) version code; the page states there is one version of the bill and offers the same text as XML, TXT and PDF (Source: congress.gov). The document's own metadata records the bill number, title, sponsor and July 23, 2026 date, and the enrolling line reads "Mr. Lieu (for himself and Mr. Moran) introduced the following bill; which was referred to the Committee on Homeland Security." The capture removed site chrome, the sign-in form, share links and version navigation; no statutory text was altered or omitted.
Relationships
- supports: AI Kill Switch Act (Lieu–Moran) — the topic page, whose provisions were previously sourced only to the sponsors' press release and news coverage.
- related: DHS — Department of Homeland Security (AI Deployer) — the department that would hold the rulemaking and emergency authority.
- related: AI Autonomy Risk, Autonomous cyber-agents — the risk categories the covered-incident and loss-of-control definitions describe.
- related: H.R. 9965 — AI Threat Output and Monitoring Incident Containment Act (bill text) — a contemporaneous House bill using a comparable enforcement design of mandatory participation, per-day civil penalties, subpoena authority and a FOIA exemption.
- related: Ted Lieu — lead sponsor.