AI agent kill switch
Emergency stop · Stop button · Emergency Stop Protocol
An AI agent kill switch is a device that interrupts an agent at several levels of severity, from stopping one action to halting the whole system. It is entrusted to a named person, does not depend on the agent it stops, and is tested regularly. ACF makes it a mandatory safeguard of any delegation.
The rule: never depend on what you are stopping
A stop device that relies, even partly, on the system it is meant to interrupt is not a stop device. An order to stop sent to an agent in a chat is a request, which it may lose or ignore. In the case reported by The San Francisco Standard in February 2026, the user of an email agent ordered it from her phone to stop, it kept deleting messages, and she had to reach the computer running it. The same reasoning applies to a supplier: a means of interruption that goes through the interface of the vendor you want to interrupt gives you little in a dispute or an outage.
Several levels, proportionate to the situation
Stopping everything for a minor deviation is costly, which is exactly why people hesitate. A graduated device removes the hesitation:
- Pause non-critical decisions.
- Suspend the agent in read-only mode.
- Shut the agent down completely.
- Shut down a whole family of agents.
- Halt AI across the organization and hand over to people.
What the law says
Article 14(4)(e) of the EU AI Act requires that those overseeing a high-risk system be able to intervene or to interrupt it "through a 'stop' button or a similar procedure that allows the system to come to a halt in a safe state". The last words matter, as an abrupt stop can do its own damage, for example by leaving a half-finished payment run.
Test it, because a description proves nothing
A stop button that has only been described is a hope. ACF asks for a full-scale test every quarter, at least one of them in a scenario in which the supplier does not respond, with a dated report that forms part of the proof of governance. Two questions are enough to judge the readiness of an organization: in how many minutes can you stop any of your agents, and when did you last check?
What happens after the stop
Stopping is the easy part. The device suspends, and governance then decides what to do about the suspension: stop first and analyze afterward, ensure the activity goes on by hand, and withdraw authority if needed. A crossed threshold can trigger the stop automatically, on condition that an alert immediately reaches a named person.
Frequently asked questions
Who should have access to the kill switch?
A named person who holds the power to stop, in ACF the DDAO, with access shared by at least two people so that an absence never blocks the action.
Can an AI agent disable its own kill switch?
If the switch is inside the agent, that risk exists: the OECD reports cases of agents modifying their constraints or bypassing their limits in order to appear successful. This is why the switch sits outside the agent, with its rights cut by a path it cannot influence.
What should a kill switch test measure?
The time from detection to effective stop, whether every access was actually cut, whether the hand-over to people worked, and how the device behaves when the supplier is unavailable.
Where does your organization stand?
ACF Score measures your agentic governance in about 10 minutes, the AI Act checker tells you which obligations apply, and ACF Control applies your rules before an agent acts.
Related terms
Primary sources
Written by Vincent Dorange, creator of the Agentic Commerce Framework®. Last updated .