Can AI be shut down? What fail-safe shutdown pledges cover and what they leave out

Can an AI model be switched off? For most deployed systems the honest answer is yes, in the way any cloud service can be switched off: the operator stops running it. The hard cases are different. They involve models that act during training, systems used inside a lab, and weights that anyone has downloaded. The Paris Declaration on AI Safety and Security, signed November 9, 2026, puts a shutdown pledge in writing. Here is what it covers.

What the pledge says

Under the declaration's accountability commitment, developers pledge to implement "fail-safe mechanisms to shut down model operations within their control." The Dutch government's copy, published November 10, 2026, frames this as one part of a broader principle of responsibility for all actors in the AI ecosystem.

Commentator Xenospectrum, reading the Élysée-published signatory list as of November 11, says the pledge is to restrict, pause or fully shut down models, including during training and internal use, and that it is limited to "model operations under the developer's control." Of five developer provisions, the commentator says only disclosure of capabilities, limitations and known risks is unconditional, and third-party evaluation applies where "appropriate and proportionate to risk."

What it does not cover

Three gaps stand out in the text and in the commentary.

• No outside kill switch. Neither governments nor third parties gain power to halt a model. The pledge asks developers to build a mechanism, not to hand control to a regulator.
• Open weights. Once weights are published, copies run in third-party environments outside the developer's control. The declaration itself acknowledges that safeguards can be removed or circumvented, naming abliteration. Researchers call the editing technique abliteration, and a download cannot be recalled.
• Verification. The text does not say who tests whether a mechanism works. Where it mentions third-party evaluation, it is conditional.

The declaration does point to a possible path to enforcement: actors should comply with safety standards set or accredited by national authorities, under supervision and independent evaluation. If those standards later require shutdown mechanisms, the pledge could become a binding obligation. As of November 15, 2026, we found no such standards, and neither official text states a legal status.

How this differs from earlier pledges

The Seoul Frontier AI Safety Commitments of 2024 are a useful comparison. According to the UK government's page, 20 organizations signed, 16 initially and four added later. Outcome 1, paragraph II requires thresholds at which severe risks "would be deemed intolerable," and paragraph IV commits organizations "not to develop or deploy a model or system at all" if mitigations cannot keep risks below the thresholds. The page does not mention shutdown. In other words, Seoul covers the decision to deploy, and Paris adds a mechanism to stop something already running.

Why shutdown is harder than it sounds

The difficulty is not only technical. A model that runs in a developer's own data center can be stopped by cutting power or revoking access. The harder question is what a model can do before it is stopped, and whether anyone notices. The UK AI Security Institute's work on unsanctioned actions, which we cover in our explainer on AI loss of control, is about that detection gap. A kill switch helps only if someone knows to press it.

A second difficulty is training. The pledge explicitly includes training and internal use, which are the phases where developers have the most control and the public has the least visibility. Without a requirement to report tests of the mechanism, outsiders cannot tell whether it exists.

What we do not know

We could not find in the Dutch or Canadian texts any description of the technical design of a shutdown mechanism, any test requirement or any reporting duty. Nor do we know whether Google, Meta or xAI will sign, since they do not appear on the Canadian list. The signatory lists also differ between official sources, so who is bound is itself unsettled.

Questions that make a pledge testable

A shutdown claim from any lab can be checked against five questions.

• Authority: Who can trigger the shutdown, and can a safety team do it without executive sign-off?
• Scope: Does it cover training runs and internal deployments, which the pledge explicitly includes, or only public products?
• Testing: Has the mechanism been exercised, and is the result shared with an evaluator?
• Copies: What happens to checkpoints, fine-tunes and published weights?
• Reporting: Is an invocation reported as an incident, and to whom?

Our overview of which rules bind frontier labs shows where binding duties already exist, and incident reporting rules in California, the EU and Congress set the clocks that apply when something goes wrong. Those are the places a shutdown duty is most likely to attach first, because they already define who reports what and when.

Why the timing matters

The pledge arrives in the same week as a lawsuit by nonprofits asking a San Francisco court to bar the largest labs from building more capable systems, citing the labs' own warnings about catastrophic risks, according to Reuters as summarized by The Neuron. Whatever the court decides, the juxtaposition shows the gap the declaration is trying to fill: labs say they can manage frontier risk themselves, and critics ask for evidence. A shutdown mechanism that is described, tested and reported would be evidence. One that exists only in a pledge is not.

Our take

A shutdown pledge is worth having, and worth little until it is tested. The three questions to put to any lab that signed are: who has the authority to trigger it, how often is it exercised in practice, and what does it do to copies of the model outside the lab's own servers. For open weights, the answer to the last is nothing. We would watch for the first standard from a national authority that names shutdown mechanisms, and for any signatory that publishes evidence it has run a drill.