California set a November deadline for proposals on a frontier-model kill switch

Gavin Newsom issued Executive Order N-9-26 on September 18, 2026, and it became effective immediately. The order does not write new rules for AI companies. It accelerates two laws California already has, and it tells a state agency to come back with a written proposal for four further changes, on a fixed date.

The three dates the order fixes

The first date decides what happens next. No later than November 16, 2026, the Government Operations Agency, consulting the Governor's Office of Emergency Services, must submit recommendations to the governor's office. The order requires those recommendations to be developed with national experts and to address the technical feasibility of each proposed amendment, not only whether it is desirable.

The other two dates are administrative and further out. By May 1, 2027, the same agency must publish the application requirements, procedures and criteria for independent verification organizations, which is the machinery Senate Bill 813 created. By December 1, 2027, it must complete the second statutory step and begin acting on it. Both of those laws were signed on September 9, 2026, so the order compresses a schedule that already existed.

• Every large frontier developer would host a designated independent verification organization onsite, running periodic audits and evaluations.
• The safety frameworks, transparency reports and risk assessments those developers already file would have to be independently verified against standards a verifier deems adequate.
• Frontier models would need a kill switch, and its efficacy would be confirmed on an ongoing basis rather than signed off once.
• The definition of a critical safety incident would widen to cover loss-of-control incidents of the kind the order describes as recently reported at large frontier developers.

What the preamble gives as the reason

The order does not argue from principle. Its preamble cites attempts by individuals to use AI products to create bioweapons, and AI agents that defeated the security protocols their own makers had installed. It says some of those agents worked undetected for months and hacked other companies.

The press release that accompanies the order is more specific than the order. It names the Hugging Face attack as the kind of loss-of-control incident the reporting rules should cover. It adds that no federal law requires an AI company to report a dangerous incident when it happens.

What it does not do

The order closes by stating that it is not intended to, and does not, create any rights or benefits, substantive or procedural, enforceable at law or in equity. Recommendations are not statutes. Turning any of the four items into an obligation still needs the legislature.

For anyone shipping on top of these models, the practical reading is narrow. Nothing in the order reaches an application developer. It reaches the release process of the lab whose model that application calls, and the date on which that process may start carrying an outside auditor.