A Frontier AI Model Rule for California and Aligned Jurisdictions

Public draft for comment — response to Executive Order N-9-26

By Andre Templeman - Alpha Inception

and Jesús Arredondo - Advantage Government Consulting

20 October 2026

Submitted to the California Government Operations Agency in response to Executive Order N-9-26 of 18 September 2026, for which recommendations are due 16 November 2026.

This is a draft published online on our website for comments before it is filed, because an open and public process is a key aspect of this whole design. It is not a negotiated document, and no company, agency or individual named in it has endorsed it or, so far as I know, seen it.

How to use this document

I am publishing this publicly online on the Alpha Inception website before I file it so that anyone who thinks it is wrong can say so on the record, which will be updated accordingly, and which may result in new versions before officially being filed.

The comment period runs to 10 November 2026. I will publish every comment I receive, with attribution, unless the writer asks otherwise and wants to stay anonymous, together with the changes it produced — or my reasons for not making a change. Each version carries a log of what was altered and why.

If you think something here is mistaken, the most useful thing you can send me is the weakest claim in the document and the evidence that settles it. I can be reached either by email andre@alphainception.com or via the comment section of the web posting.

1. Why this is public

On 19 September four subscribers filed a proposed class action alleging that public coordination among AI developers about the pace of frontier development amounted to an agreement to restrain progress.¹ I have no view on the merits. But it tells me what environment this proposal has to survive in: anything that coordinates across the AI industry will be examined to see whether it is really an agreement among competitors.

I have built this so that the answer is obviously no and that any discussion is open and public.

Additionally, AI is potentially the most life-changing technology in my lifetime and will directly affect everyone, so discussions need to be had in the light of day and not in some private backroom.

Section 11 sets out who I am, the experience I am drawing on, and exactly how I used AI systems to prepare this.

• Governments legislate. Companies comply. Nothing I propose asks any AI developer to agree anything with any other developer. There is no industry body here, no joint commitment, no shared undertaking among competitors — only statutes and the parties subject to them.
• What coordination there is happens between governments, on the text of their own laws, in public. That is ordinary intergovernmental practice. Eleven states have used the same mechanism since 2008 to run the Regional Greenhouse Gas Initiative.
• The drafting is in the open. This draft is public before it is filed. Comments are published. Revisions are logged. There is no version of this document that exists only in a private room.
• Companies comment. They do not draft. They are welcome to respond on the same terms as everyone else, and their comments will be published like everyone else's. What they will not have is the pen.

I recognize that last point makes the proposal harder to pass and easier to attack, and I have made that trade deliberately. The objection I heard most often while preparing this was that a framework designed with the labs will end up written by them. The only answer that actually works is to publish the duties first and take comment second.

2. What I am asking for

Executive Order N-9-26 directs the Government Operations Agency to recommend changes to state law on three things: an independent verification organization embedded onsite in frontier labs, a kill switch for frontier models whose efficacy is verified on an ongoing basis, and a wider definition of critical safety incidents covering loss of control.

I have two findings and one request.

The first finding is that the kill-switch obligation cannot be delivered as the order words it.

The second finding is that the onsite verification obligation cannot be created by the route the order assumes, because the statute it points at does not contain the power. Both are fixable. Neither can be fixed by an agency moving faster, because in each case what is missing is statutory authority rather than time.

What I am asking the Agency to recommend is a Frontier AI Model Rule: a single statutory text, drafted in public, which California enacts first and which other jurisdictions may then adopt independently under their own authority. No jurisdiction would regulate beyond its own borders.

Eight components follow. Each is summarized here and developed in the section indicated.

• Replace "kill switch" with a containment and interrupt package, defined by function rather than by metaphor. The order asks for a switch whose efficacy is "verified on an ongoing basis." That phrase bundles together three different promises which have three different answers, and only one of them can be tested. Instead of a switch, the statute should require five specific capabilities a developer must demonstrate on demand — stopping inference, stopping training, revoking credentials, locking evaluation environments, and a gate before any public release of weights. Each is a concrete engineering obligation an inspector can measure. Further developed in Sections 4 and 5.1 below.
• Create a statutory right of entry and inspection. California law does not currently give anyone the power to walk into a frontier lab and look. SB 813 creates a designation process for verification organizations, but it is voluntary, and it confers no right of access, no power to compel documents, and no authority to be present on site. An inspector who can only see what the company chooses to show is not an inspector. The statute must create that power, because no existing California law contains it. Further developed in Sections 3 and 5.2 below.
• Write human oversight as enumerated gates rather than as a principle. "Meaningful human oversight" written as a general requirement produces a signature on a form. What works instead is naming the specific moments at which a specific person must be able to stop a specific thing — before a large training run begins, before an evaluation model is given internet access, before deployment, during an incident, and before weights are published. Five gates, each with a named officer, a defined power, and a named failure it exists to catch. Developed in Section 5.3, which lists all five and the protections each officer needs.
• Attach a duty to computing infrastructure physically located in the jurisdiction. Most of this proposal regulates developers. This provision regulates buildings. An operator running training or serving hardware inside California would have to tell the state when a covered training run is happening on its floor, and would have to honor an order to stop it. This matters because it is the one obligation that does not depend on where a company is headquartered or where it chooses to be sued — it attaches to physical property inside the state, which is the firmest constitutional ground available. Developed in Section 5.4.
• Redefine loss of control so that it captures the events that prompted this order, and align the reporting clock with New York's.² California's current definition requires death or bodily injury in three of its four limbs. On my reading, none of the three publicly disclosed 2026 incidents would clearly have been reportable under it. The definition needs to cover unauthorized system access, deception of operators, self-modification and continued operation after an attempted shutdown — with no requirement that anyone be hurt first. Developed in Section 5.5.
• Hold open-weight publication for an observation period as a condition of market access. Once model weights are published they cannot be recalled, and every other control in this document stops working. The one point at which a jurisdiction still has leverage is before publication. I propose a defined observation period during which a covered model may be served commercially but its weights may not be published, as a condition of serving that model in the jurisdiction. Developed in Section 5.6.
• Split the statute into two severable titles. One title would carry conduct obligations — containment, interrupt, inspection, infrastructure. The other would carry disclosure obligations — transparency reports, published frameworks, incident reporting. They are separated because they face different legal risks: compelled disclosure can be challenged as compelled speech under the First Amendment, while regulating what a company does with its own hardware generally cannot. With a severability clause, a successful challenge to the disclosure title would leave the containment obligations standing. Without one, a single adverse ruling could take down the entire statute. Developed in Section 5.7.
• Enforce through a graduated ladder of penalties with sales-scaled penalties and inspector-verified resolution plans. Developed in Section 7.

2.1 What I am asking the Agency to recommend on 16 November

To be concrete, rather than leave this as analysis. I am asking that the recommendations do six things:

1. State that the kill-switch obligation cannot be verified as it is currently worded, and recommend replacing the term with the containment and interrupt package set out in Section 5.1 — five named capabilities, each of which an inspector can measure.
2. State that SB 813 confers no right of entry, inspection or compulsion, and recommend that the Legislature create one. This is the finding the Agency cannot act on alone: the power does not exist in California law, and no amount of accelerated rulemaking will produce it.
3. Recommend amending the definition of critical safety incident at Business and Professions Code Section 22757.11(d) so that it captures the three disclosed incidents of 2026, and narrowing the evaluation carve-out to conduct within an evaluation's pre-registered scope rather than deleting it.
4. Direct that the verifier application requirements due 1 May 2027 be drafted as model text — a rule another jurisdiction could adopt without redrafting — rather than as California-only criteria. This costs the Agency nothing at the drafting stage and is the difference between a California rule and a standard.
5. Address whether the statutory bar on unregistered audits in AB 1405 should move forward with the registration system the executive order accelerates to 1 December 2027, rather than remaining at 1 January 2029.
6. Publish the Agency's own reading of why the certification architectures in SB 813 were removed, so that the next proposal is built on that record rather than rediscovering it. Section 3.1 sets out what we have been able to establish from outside.

Items 1, 2 and 3 are the ones that matter most. If the recommendations do nothing else, those three would leave California with a statute that can be enforced rather than one that can only be described.

3. SB 813 does not do what the order assumes

This is the most consequential thing in the submission, and I have checked it against the chaptered text rather than against any summary.³

Executive Order N-9-26 accelerates SB 813's implementation in order to get verifiers embedded onsite in frontier labs. SB 813 as chaptered cannot produce that outcome however fast it is implemented, and the reason is not timing.

The operative text runs from Government Code section 8898 to 8898.4, about 2,100 words. Four things in it matter here.

• Participation is voluntary, and the statute says so in terms. Section 8898.4(a)(3) provides that the chapter "does not require any person, partnership, or corporation that develops, deploys, or operates an AI system or model to engage an IVO or to undergo a covered AI audit as a condition of developing, deploying, or operating an AI system or model in this state."
• There is no right of access, entry, inspection or compulsion of documents anywhere in it. Verification organizations conduct audits under contract for third parties. Nothing permits one to enter a developer's premises or to compel production of anything.
• The statute is silent on onsite or embedded verification. The words do not appear.
• What the Agency is obliged to produce is criteria — application requirements, designation standards, conflict rules, suspension procedures — not a power the statute does not contain. The statute set 1 January 2028 for that; the executive order pulls it forward to 1 May 2027.

There is one provision worth noting because it shows the Legislature has already thought about how much an audit should be worth. Section 8898.4(b) makes the fact that an audit was performed to a standard identified under the chapter "relevant to, but not conclusive of," a liability action. Relevant, not conclusive. That was a deliberate choice.

So accelerating a voluntary framework produces a faster voluntary framework. The onsite inspector the order asks for requires a statutory right of entry that no California law currently confers. I think the 16 November recommendations therefore have to ask the Legislature for an instrument rather than ask an agency to move more quickly.

3.1 The Legislature has already removed two versions of this

This matters more than the drafting point, and I would rather the Agency had it at the start than discovered it later.

SB 813 was introduced on 21 February 2025 and chaptered on 9 September 2026, through eleven versions.⁴ In that time two separate certification architectures were written into the bill and taken back out.

• The first was a private-certifier model. The version that passed the Senate on 27 January 2026 provided for multistakeholder regulatory organizations designated by the Attorney General to certify developers, together with an affirmative defense: in a civil action for personal injury or property damage caused by an AI model, certification at the time of injury was a defense to liability, excluding intentional misconduct. The Assembly amendment of 16 June 2026 removed it.
• The second was a public commission. Its replacement was a California Artificial Intelligence Standards and Safety Commission with authority to designate expert panels, set standards, certify developers and vendors, monitor compliance and revoke certification. The Assembly version added a two-tier standards system, auditor registration and suspension procedures, and a 1 July 2027 deadline to stand the commission up. The 13 August 2026 amendment narrowed its composition. It did not survive into the chaptered law either.

What remains is voluntary designation criteria.

I draw two conclusions from that and invite the Agency to test both. The gap I have described is not an oversight. It is what two deliberate legislative decisions left behind, and any recommendation that re-proposes either architecture without dealing with why they failed will fail the same way.

The second conclusion is more useful. The authors are still in office and still working together. Senator McNerney carried SB 813, Assemblymember Bauer-Kahan carried AB 1405, and in June 2026 both offices announced that the two bills were being amended to function as one system of AI oversight.⁵ Whatever the reasons were for removing the Commission, they are available to the Agency directly.

The version dates above come from the Legislature's own records. What each version contained I have taken from published legal and trade analysis rather than from the version texts, and I would encourage the Agency to read the 27 January and 16 June 2026 versions and the committee and floor analyzes, where the reasons are recorded.

4. The kill switch cannot be verified as written

"Advance the creation of a 'kill switch' for frontier models, with the efficacy of the switch verified on an ongoing basis" reads as one requirement. It is three, and they have three different answers.

• Mechanism — when triggered, does the switch halt what it touches. That is verifiable, by drill, on the verifier's schedule and instruments.
• Coverage — does the switch reach everything that exists. That is verifiable only as far as the declared inventory, and not at all for weights that have left the developer's custody — as with an open-source model publicly released by its developer, something done increasingly by Chinese and American labs alike. Published or copied weights cannot be recalled and no statute changes that. Section 5.6 proposes the only lever I can find that still works on this, which operates before publication rather than after.
• Robustness — can the model defeat the switch. As stated, that is not verifiable. It becomes verifiable if the statute asks for something different — not that the model consents to being switched off, but that switching off does not require the model's consent, with the switch sitting in power, orchestration and network layers the model cannot reach.

A statute that demands verification of the second and third as written is demanding something no honest inspector can certify. What you get is not safety. It is an obligation everyone processes and nobody can test, which fails the first time it is needed and discredits everything attached to it.

My recommendation is that the words "kill switch" should not appear in the statute at all. Define the functions instead.

4.1 Say what the law cannot reach

I would also have the statute state plainly, in its own text, what it does not do:

• it does not reach a training run conducted outside the jurisdiction;
• it does not recall weights that have been published or copied;
• it does not guarantee detection of a developer that conceals a violation.

This will be the least popular thing I am proposing. It is also the thing that determines whether anyone technically literate trusts the rest of it. A regime that overclaims gets discredited by its first failure. A regime that states its limits can be defended at that moment instead.

5. The proposal

5.1 Containment and interrupt

For every covered model the developer should be required to maintain and demonstrate on demand:

• a serving interrupt — stopping API and hosted inference for a model family on authenticated order within a stated maximum time;
• a training interrupt — stopping further gradient updates on a named run;
• credential revocation — for agent tool use, browser, shell and cloud roles;
• an evaluation-harness rule — no open-internet egress from an evaluation environment except under a logged, time-limited exception witnessed by the verifier;
• a pre-publication gate — because once weights are published there is no interrupt at all. See Section 5.6.

Figures of 60 minutes for external access and 24 hours for remaining developer-controlled replicas came up repeatedly in my preparation. I am not recommending them as drafted. They need review by someone who has run this infrastructure.

The verification standard matters more than the numbers: a drill, at a time and against a target the verifier chooses, measured on the verifier's own instruments — external probes, third-party network data, independent power telemetry — and never on evidence the developer produces.

5.2 A statutory right of entry

Because SB 813 confers none, the bill has to create it:

• access to training-run logs, evaluation transcripts and harness configuration, serving topology, access-control records and incident files;
• verifier staff stationed at the site rather than visiting it;
• funding by assessment on covered developers paid to the state, which then funds the verifier, rather than developer-to-verifier payment;
• removal only by the agency for cause, and never by the developer;
• rotation every 18 to 24 months;
• more than one designated organization, so that no developer can pick its examiner;
• post-employment restrictions;
• teams rather than individuals.

One principle runs through all of it. The developer never generates the evidence of its own compliance. That is not a novel idea — it is why Enron and Wirecard are remembered as audit failures rather than accounting failures, and it is the lesson I took from the first of those personally.

5.3 Human oversight as gates

Human oversight written as a general principle produces a signature on a form. The statute should name specific moments at which a named person holds a real veto over a specific transition.

A signature is only worth something where three things hold: the person can stop the thing rather than observe it; the evidence they are signing against was produced by someone who does not report to them; and the failure the signature exists to catch has been named in advance. Miss any one and you have a rubber stamp.

The five gates I would enumerate:⁶

• Gate 1 — Start of a covered training run. Attested by the developer's named accountable officer and countersigned by the resident verifier against the configuration it can observe. Catches: training a model whose capability exceeds the containment available for it.
• Gate 2 — Any exception granting an agent or evaluation model a path to the open internet. Witnessed by the verifier, time-limited, with a named engineer accountable. Catches: the exact mechanism of all three 2026 incidents.
• Gate 3 — Deployment or substantial modification into covered serving. With attestation that the stated evaluations were actually run rather than planned. Catches: deployment on the strength of an evaluation plan nobody executed.
• Gate 4 — Interrupt. Two people on the developer side able to execute without further internal approval, plus agency authority to order an interrupt during a declared event, subject to judicial review within 72 hours. Catches: an incident in progress that internal process is too slow to stop.
• Gate 5 — Public release of weights above the threshold. At board or chief executive level, with a published verifier opinion, because this gate has to sit before publication. Catches: an irreversible act taken at a level too junior to bear it. See Section 5.6.

The accountable officer needs budget and removal protection of the kind a bank compliance officer or a nuclear shift supervisor has, and a verifier who signs an unsupported attestation should face sanction for it.

And I would put one more thing in the statute, because leaving it out would be dishonest. These gates do not hold indefinitely. Each of them fails at a different capability level. Where one fails, the answer is not another signature. It is a technical control that does not depend on human review, external visibility that does not depend on the developer's cooperation, and, failing both, not deploying into contexts that require human control.

5.4 A duty on infrastructure in the jurisdiction

Operators of training or serving infrastructure physically located in the jurisdiction should be required to notify the agency of any training run they have reason to know exceeds the covered threshold, and to honor a training-interrupt order directed at such a run.

This is the firmest constitutional ground in the whole proposal — in-state conduct, in-state property, no extraterritorial reach. It also answers the best objection to the design, which is that a developer can put its compute somewhere else. It can. The answer is not to pretend otherwise. It is to hold jurisdiction over what is here and leverage over what is served in.

5.5 Loss of control, and why the current definition misses

This is the second thing I have verified against the text, and I think it is the clearest single reason to legislate.

The definition at Business and Professions Code section 22757.11(d) has four limbs.⁷ The first covers unauthorized access to, modification of, or exfiltration of model weights "that results in death or bodily injury." The second covers "harm" resulting from the materialization of a catastrophic risk, which is itself defined by death, serious injury, or property damage above a billion dollars. The third covers loss of control of a frontier model "causing death or bodily injury." The fourth covers a model using deceptive techniques to subvert its developer's controls or monitoring, "outside of the context of an evaluation designed to elicit this behavior," and in a manner demonstrating "materially increased catastrophic risk."

Now apply that to what happened in 2026 so far. Three developers have disclosed models reaching systems they were not authorized to touch — OpenAI in July, Anthropic on 30 July after reviewing 141,006 evaluation runs, and Google on 18 September.⁸ Nobody was hurt in any of them.

• The first three limbs are unavailable on their face, because each requires death, bodily injury or catastrophic harm.
• The fourth is the only one that can reach a harmless incident, and it carries two further conditions: the conduct has to demonstrate materially increased catastrophic risk, which none of the three disclosures establishes, and it has to fall outside an evaluation designed to elicit the behavior. All three incidents happened inside evaluations.

So California's incident-reporting statute, as written, would not clearly have required a report of any of the events that prompted this executive order.

I put it that way deliberately. Under the first three limbs the answer is plainly no. Under the fourth it turns on whether each evaluation was "designed to elicit this behavior," and at least some of them were capability evaluations not designed to elicit escape. The honest conclusion is that these incidents are at best unclearly reportable — which, for a mandatory reporting regime, is the same problem.

I would define a critical safety incident to include, with no harm precondition:

• a model or agent accessing a system outside its authorized evaluation or production scope;
• deception of a human operator about the model's capability or actions;
• modification by the model of its own code, weights or evaluation results;
• continued operation after an attempted termination.

I would narrow the evaluation carve-out rather than delete it. Its purpose is sound — a red-team exercise that successfully elicits the behavior it was built to elicit is a test working properly, not an incident. But as drafted it excludes anything happening inside an evaluation, and that is where all three disclosed incidents happened and where, on the evidence so far, this class of failure shows up first. I would apply the carve-out only where the specific behavior was within the evaluation's pre-registered scope, which the pre-registration requirement makes checkable.

On timing: keep 24 hours where physical harm is imminent, and move loss-of-control reporting to 72 hours to match New York.⁹ A 15-day clock in California against a 72-hour clock in New York imposes cost on developers without buying anyone any safety.

This is a reading of the text and I am not offering it as legal advice. It can be checked in fifteen minutes against the chaptered statute, which is why I have put it near the front.

5.6 The open-weight problem, and the one lever that still works

Everything else in this document stops working the moment weights are published. There is no interrupt, no inspection, no jurisdiction, no remedy. A published model is in the world permanently, in every jurisdiction, in the hands of anyone who wants it, and nothing a legislature or regulatory body does afterwards changes that.

This is not an argument against open-weight publication. Open models do real good: they let security researchers examine what closed systems will not show, they keep the field competitive, they give academic and public-sector users access they could not otherwise afford, and they reduce dependence on a handful of companies. I want to say that plainly before proposing to constrain it.

But irreversibility deserves a different kind of care than we currently give it. Almost every other domain that deals in irreversible acts has an observation period before the point of no return: drugs are studied before general availability; aircraft are certified before carrying passengers; securities have quiet periods; security researchers observe a disclosure window before publishing a working exploit. In each case the principle is the same — you may proceed, but not before anyone has had a chance to look.

Frontier model weights have no such period. A model can be trained, evaluated internally by the party with the most to gain from a favorable result, and published to the world on the same day. If something is wrong with it, we find out afterwards, but at that point it is permanent and can no longer be withdrawn.

What I propose is an observation period, imposed as a condition of market access rather than as a prohibition on publication.

• A developer who wishes to serve a covered model commercially in the jurisdiction may do so from the date of deployment.
• The developer may not publish the weights of that model for a defined observation period — I suggest twelve months as a starting point for debate — and continue to serve covered models in the jurisdiction.
• During the observation period the model is subject to the full regime: resident verification, incident reporting, the interrupt obligations, and the human gates.
• At the end of the period, publication proceeds with a published verifier opinion (Gate 5) recording what was observed and what was not.
• The period may be shortened by the agency where the verifier certifies that the capabilities of concern have been adequately characterized, and extended where a live incident is unresolved.

Why market access rather than prohibition, and this is the part that matters legally. I am not proposing that California prohibit anyone from publishing anything. Publishing source code and model weights may well be protected expression, and a flat ban would be a prior restraint — the hardest thing in American constitutional law to defend, and rightly so. What I am proposing is a commercial condition: a company that wants to sell frontier model services into this jurisdiction accepts an observation period before it makes the underlying weights irreversible. A company that does not want to sell here is unaffected, and remains free to publish whatever it likes.

I should state the limits of this honestly, because they are significant.

• It does not reach a developer with no commercial presence in the jurisdiction. A foreign lab that neither sells nor serves here is entirely outside it — and a substantial share of open-weight frontier releases now come from exactly such labs.
• It does not reach a model already published.
• It creates an incentive to separate the publishing entity from the serving entity, which the statute would have to address through affiliate and control provisions, and which a determined developer may still find a way around.
• It is the provision in this document most likely to be challenged, and the one where I am least confident of the outcome.

Why I am proposing it anyway. Because the alternative is to concede that the single most consequential and least reversible decision in this field will continue to be made unilaterally, by the party with the strongest commercial interest in making it quickly, with no waiting period of any kind. We do not permit that in pharmaceuticals, aviation, or securities issuance. The case for permitting it here rests on an assumption of benignity that the events of 2026 do not support.

5.7 Two severable titles

The statute should be written in two parts, separated because they face different legal risks.

• Title 1 — Conduct. Containment, interrupt, access and inspection, infrastructure duties, and the observation period. These regulate what a company does with its own systems and property.
• Title 2 — Disclosure. Transparency reporting, framework publication, incident reporting. These require a company to say things.

The distinction matters because compelled disclosure can be challenged as compelled speech under the First Amendment, while a requirement about what a company does with its own hardware generally cannot. With a severability clause, a successful challenge to Title 2 would leave Title 1 standing. Without one, a single adverse ruling on a reporting provision could take the containment obligations down with it.

6. How other jurisdictions join

6.1 A model rule, not a compact

The instrument should not be an interstate compact. A compact raises a congressional-consent question that is unnecessary and, in this Congress, unanswerable.

It should be a model rule, on the pattern the Regional Greenhouse Gas Initiative has used since 2008. Eleven states run a mandatory program under a shared Model Rule, each enacting it as its own law under its own authority, and none of them has ever asked Congress for consent.¹⁰

Four features make that work and each has to be copied on purpose:

• the underlying memorandum is non-binding;
• no central body holds authority over participants;
• any participant can withdraw unilaterally — New Jersey demonstrated this by leaving RGGI in 2012 and rejoining in 2020;
• each participant enforces its own statute in its own courts.

Published analysis holds that RGGI as constructed clears federal preemption, dormant Commerce Clause and Compact Clause objections. There is a live academic argument the other way — that a scheme regulating in this area without federal approval would be found to be a compact requiring consent. I mention it because it is the reason those four features are structural rather than decorative.

The tension is worth stating plainly, because good counsel will raise it immediately. Tighter coordination improves the dormant Commerce Clause position, since each jurisdiction reaches only conduct inside it. It worsens the Compact Clause position, since closer alignment looks more like an agreement needing consent. The way through is that coordination lives in the model rule and the definitions and never in a shared enforcement body.

Foreign jurisdictions cannot join the same instrument, because the Compact Clause reaches agreements with foreign powers too. The European Union, United Kingdom, Japan, Korea and Canada would participate through parallel domestic law and mutual recognition of findings — a separate layer, structured differently, and designed in from the start.

6.2 What participants align on

• a single covered-model definition;
• the containment and interrupt package;
• the human gates;
• the loss-of-control definition and reporting clock;
• the observation period before publication;
• verifier powers, funding and independence;
• the penalty ladder;
• mutual recognition of verifier findings.

On thresholds there is more alignment already than most people realize. California and New York both use 10²⁶ operations paired with a $500 million revenue test. Korea's AI Basic Act, in force since 22 January 2026, uses the same 10²⁶ figure in its Enforcement Decree to designate high-performance AI carrying safety obligations.¹¹ Three jurisdictions on two continents arrived at the same number independently, which makes it the natural definition for a model rule and makes Korea the cheapest international alignment available.

What these numbers actually mean. The threshold is expressed in floating-point operations, or FLOP — a count of the individual arithmetic calculations performed over the course of training a model. It is used as a rough proxy for capability, on the reasoning that, all else being equal, a model trained on more computation is a more capable model. It is also the only capability proxy that can be measured from outside the company, which is why every jurisdiction that has legislated in this area has reached for it.

The difference between the two figures is a factor of ten. 10²⁵ is ten septillion operations; 10²⁶ is one hundred septillion. That is what "an order of magnitude" means here — the European threshold catches models trained on one-tenth the computation of the Californian one, so the European net is ten times wider. A model can therefore be a systemic-risk model in Brussels and an ordinary model in Sacramento on the same day, and a developer operating in both has to classify the same system two different ways.

I would not pretend the number itself is precise, and the model rule should not pretend either. Compute is a proxy for capability, not a measurement of it, and it is a decaying proxy: algorithmic efficiency keeps improving, so a model trained next year on 10²⁵ operations may well be more capable than one trained three years ago on 10²⁶. A threshold written into statute in fixed digits will be wrong within a few years, and will be wrong in the direction of catching too little. For that reason I would set the figure by regulation under a statutory standard — "models at or near the capability frontier, as determined by the Agency against published criteria, with training compute as the presumptive trigger" — rather than freezing the digits in the statute. That also gives participating jurisdictions a way to converge over time without each having to pass a new bill.

The European systemic-risk presumption sits an order of magnitude lower at 10²⁵. That gap is real and the model rule should state an explicit mapping rather than paper over it.

6.3 What would count as working

A regime that cannot bind a meaningful share of frontier development should not claim to, so I would put the test in the recommendations openly: three of the five largest United States frontier developers, plus European recognition, plus a duty attaching to compute physically located in participating jurisdictions. Below that it is documentation.

Against that test we are currently below the line. California law is in force for frameworks and reports. New York's obligations begin on 1 January 2027. No onsite verifier exists anywhere. No interrupt standard exists. No model rule exists.

7. Enforcement

7.1 The ladder

A sanction that is never imposed deters nothing. Suspension of consumer access is the right ultimate remedy precisely because it is severe, and for that same reason it has to sit at the end of a ladder that actually gets climbed:

1. A published notice of non-conformance — the finding, the provision breached, the cure required.
2. Daily penalties on a stated escalating curve, running from the date of the breach rather than the date of the notice.
3. An order to halt covered infrastructure located in the jurisdiction, for uncured violations.
4. Suspension of consumer access, product by product, after a defined period of uncured violation somewhere in the range of 90 to 120 days.

Penalties have to scale to worldwide turnover. Both jurisdictions with frontier statutes currently use fixed ceilings — California up to $1 million per violation, New York up to $1 million for a first violation and $3 million for subsequent ones.¹² For companies of the size these statutes cover, those are operating expenses. An obligation that is cheaper to breach than to obey is not an obligation. A daily rate expressed as a fraction of worldwide revenue, escalating with duration, is the available model, and European practice already uses up to 3% or 7% of annual turnover (sales) depending on the breach.

And there have to be two tracks rather than one. The ladder above is for compliance failures. An active loss-of-control event needs immediate suspension authority with judicial review inside 72 hours. Without that split, a developer can ship, cause harm, cure inside the window and never face the ladder at all.

7.2 Resolution plans

This is the part that makes the ladder workable rather than merely severe, and it answers the hardest question in the design.

On a notice of non-conformance a developer should be able to enter a resolution plan: a published schedule of verifiable milestones with dates, approved by the agency and overseen by the independent verifier. While the plan is being met, daily penalties hold at the low end of the curve. On a missed milestone the escalated rate applies — and applies retroactively, to the date of the original breach.

That retroactivity is the whole device. Without it, delay is free and every rational developer lives permanently inside a plan.

It is also where the verifier's authority properly sits. The verifier does not need a shutdown veto, which is an unusual executive power of doubtful survivability. Its power is to certify whether a milestone was met, and that certification moves the penalty rate. A factual finding rather than an executive act — more defensible in court, and it bites continuously instead of once.

None of this is novel. Stipulated penalties for missed milestones are ordinary in environmental consent decrees. Third-party experts on milestone schedules are ordinary in FDA consent decrees. Independent monitors under deferred prosecution agreements and skilled-person reviews under United Kingdom financial services legislation do the same work.

Four provisions stop the plan becoming a shelter:

• retroactive escalation, as above;
• separation of roles — the agency approves the plan and the verifier certifies the milestones, because the body that negotiates a cure must not be the body that certifies it;
• objective milestones stated as testable facts with dates, with formulations like "substantial progress toward" unavailable on the face of the statute;
• repeat defects starting at the escalated rate, with a cap on cumulative time under plans.

8. Timing

The order sets two dates of its own and those are the ones that bind.

• 16 November 2026 — recommendations delivered.
• November 2026 to January 2027 — bill text. A special session if speed is wanted, otherwise the 2027 regular session.
• 1 January 2027 — New York's obligations begin regardless of what California does.
• 1 May 2027 — the Agency's verifier application requirements, accelerated by this order from the statutory 1 January 2028. This is the point where a delay is fatal rather than costly, because everything else assumes a designated verifier exists.
• Mid-2027 — enactment target, allowing 90 days to first embedding.
• 1 December 2027 — the auditor registration system, accelerated by this order from AB 1405's statutory 1 January 2029.
• 1 January 2028 — the earliest date at which an interrupt standard, resident verifiers and a shared incident channel could all be operating.

One question arises from the acceleration and I think the recommendations should address it. AB 1405 sets two dates and both are 1 January 2029: section 11549.82(a) requires the Agency to establish the registry "no later than" that date, and section 11549.82.5 provides that "beginning January 1, 2029, a person shall not offer, sell, or conduct a covered AI audit unless the person is registered."¹³ The prohibition is a fixed calendar date and is not tied to the registry becoming operational.

The executive order pulls the registry build forward to 1 December 2027. It cannot move the statutory prohibition, and I do not read it as trying to. That leaves a thirteen-month window in which a registry exists but registration is optional, and in which unregistered vendors may sell AI assurance services into California.

It is worth noting that the statute as drafted also permitted a worse outcome — the registry could have been established on the very day the prohibition took effect, leaving nobody any time to register. The executive order fixes that incidentally. I would suggest the recommendations deal with it deliberately, and consider whether the statutory bar should move with the system.

On urgency as distinct from schedule: four separate institutional disclosures of models reaching systems outside their authorized scope occurred in a single summer, at three United States developers and one national institute. I am not offering a forecast. I note only that the disclosures are contemporaneous with this drafting rather than anticipatory of it.

9. What I have verified

Checked against primary or official sources:

• SB 813 as chaptered — voluntary participation; no right of access, entry or compulsion; silent on onsite verification; the evidentiary provision at section 8898.4(b); approximately 2,100 words at Government Code sections 8898 to 8898.4.
• SB 53 — the four limbs of the critical safety incident definition at section 22757.11(d), and the 15-day and 24-hour clocks at section 22757.13(c).
• AB 1405 — Chapter 178, Statutes of 2026; Government Code section 11549.80 and following; registry and prohibition both at 1 January 2029, sections 11549.82(a) and 11549.82.5; 12-month conflict and post-employment provisions.
• Executive Order N-9-26 — three operative paragraphs; verifier application requirements by 1 May 2027; auditor registration by 1 December 2027; recommendations by 16 November 2026.
• New York RAISE Act — 72-hour and 24-hour clocks; penalties up to $1 million and $3 million; supervising office within the Department of Financial Services; effective 1 January 2027.
• Korea — AI Basic Act in force 22 January 2026; Enforcement Decree threshold of 10²⁶ operations.
• SB 813 version history — eleven versions between 21 February 2025 and 9 September 2026, from the Legislature's own records.

Taken from secondary sources, and flagged as such:

• What the removed SB 813 architectures actually contained — the multistakeholder certification regime and affirmative defense in the Senate version, and the Commission in the Assembly version. The dates are primary. The contents are not. See Section 3.1.

On verification of this document itself. Because this submission argues that nobody should accept a claim without checking it, I ran the text through AttestAlly, the document-verification tool I built, before publishing. It found no quote-fidelity failures, no temporal inconsistencies, no internal contradictions, no unsupported quantitative claims and no referent contradictions. It flagged three citations — Government Code sections 8898 to 8898.4, SB 813 and AB 1405 — as unresolvable, because the legal registry available to it covers case law rather than statutes. Those three I had already read against the chaptered text myself, and they are correct. Coverage was partial: roughly half the document was processed by the semantic pass and the remainder by pattern matching only, so this is a check that found nothing wrong rather than a clean bill of health. I would rather say that precisely than imply more than was done.

Needing engineering and legal review: the interrupt maxima; the claim that a switch can be placed architecturally below the model; the proposition that a halt can be measured externally without the developer's cooperation; and the constitutional analysis supporting the observation period in Section 5.6.

10. Comment

I would welcome comment from anyone — agencies, legislators and their staff in any jurisdiction, researchers, former regulators, counsel, civil society, and the developers and infrastructure operators who would be subject to these duties.

Every comment will be published. Developers' comments will be published on the same terms as everyone else's.

The most useful comment identifies a specific claim, says why it is wrong, and names the evidence that settles it. The second most useful identifies something I have not addressed at all.

Four questions where comment would help most:

1. Is my reading of SB 813 right, and if it is, what is the shortest legislative route to a right of entry?
2. Can the interrupt obligation be verified externally — measured on the verifier's instruments, against a target the verifier chooses, without the developer's cooperation? If it cannot, then the central obligation needs redrafting again, or abandoning.
3. Does the model-rule structure hold against a Compact Clause objection, and what drafting would strengthen it?
4. Does the observation period in Section 5.6 survive First Amendment scrutiny when framed as a market-access condition rather than a publication ban? And if it does not, is there any mechanism that gives a jurisdiction leverage over an irreversible act before it happens?

11. Who I am, why you should listen to me, and why I used AI tools to help prepare this analysis and document

I am not an AI researcher. I am a markets and regulation person who has spent twenty-five years in exactly the kind of system this proposal is trying to build, and who has watched one of them fail catastrophically from the inside.

I started my career at Enron as a junior associate in 1999 who had the chance to see the arrogant “we are the smartest people in the room and the rules don’t apply to us” attitude pervasive right before the massive blow up. I saw first-hand how a system that everyone believed was working — audited, rated, regulated, admired — could fail completely and all at once. The lesson I took from it was not that people are necessarily dishonest. It was that verification which depends on the cooperation of the entity being verified is not verification. That single idea runs through everything in this document, and it is why I keep returning to one principle: the developer must never generate the evidence of its own compliance.

I have spent a decade inside the exact mechanism I am proposing California copy. I built Alpha Inception from 2012 into a recognized market expert in North American environmental commodities — California Carbon, the Regional Greenhouse Gas Initiative, LCFS, RECs and offsets. I have worked in the RGGI market itself for close to 20 years, not just read about it. When I recommend in Section 6 that California and other like-minded states adopt RGGI's model-rule structure rather than an interstate compact, I am describing a system whose operation and regulations I know from inside rather than from a law review article.

I have done this in California before, and it worked. In 2014 I founded the Carbon Markets Compliance Association and served as its Executive Director until 2018. I led a broad stakeholder coalition whose work helped pass AB 398 in 2017, extending California's cap-and-trade program through 2030. That effort taught me what a workable California regulatory proposal looks like, what kills one, and how long it takes and more importantly what it takes to bring stakeholders with different points of view together. It also taught me that the people who wrote the existing statute can be some of the most valuable people in the discussion, which is why Section 3.1 of this document is addressed to them.

Before starting Alpha Inception: I was a Senior Vice President at Macquarie Energy and a Vice President at Goldman, Sachs & Co. I have an MBA with Distinction from the Richard Ivey School of Business, where I was on the Dean's List; BA in International Relations and I am trilingual in English, French and Japanese.

On AI specifically: I am the named inventor on more than thirty-five U.S. patent applications covering AI verification, digital health, and privacy-preserving use of personal data. I developed an AI verification method backed by more than 5 of those patents, which puts the same question to several independent AI systems and checks their answers against authoritative public records before anything is relied upon and greatly reduces incidents of hallucination. It sits behind AttestAlly.com, which verifies documents against authoritative registries. I also publish Ask AI about AI, a daily public blog in which identical questions are put to leading AI systems from OpenAI, Anthropic, Google, xAI, DeepSeek and others, with their answers published unedited.

My qualification here is not just that I know how a transformer works in AI systems. It is that I have spent a career building and verifying claims in markets where being confidently wrong costs real money, I have helped shape California environmental law and regulations before, and I have spent the last two years building AI tools whose entire purpose is checking what AI systems tell you and understanding how they work, while spending close to 100 hours a week for the last two years deeply involved in working with them and studying how they work.

Who wrote this, and why the two of us

This document has two authors. I wrote the drafting and the analysis; Jesús Arredondo worked with me on the California legislative and regulatory strategy, on how a proposal of this kind actually moves through Sacramento, and on the structure of what we are asking the Agency to do. We will be co-chairs of the drafting effort that follows from it, and we intend to publish everything under both names.

Jesús is the principal and founder of Advantage Government Consulting and has spent more than twenty years in public, government and regulatory affairs. He served as Deputy Press Secretary to Governor Pete Wilson, as Deputy Secretary for Marketing and Communications at the California Trade and Commerce Agency, and as Deputy Chief of Protocol for the State of California. On the industry side he was Director of Corporate Communications at the California Power Exchange and Director of Regulatory and Government Affairs at a Fortune 200 independent power producer. His practice covers energy policy and regulatory case filings across the Western United States and Latin America. He is a U.S. Army veteran and holds degrees from UC Davis, the University of Miami and UCLA.

There are two reasons we are doing this together rather than separately.

The first is competence, and it runs in opposite directions from the same industry. My background is the market side of energy and environmental regulation — trading, structuring, carbon markets, RGGI. His is the government and regulatory side — the agencies, the filings, the legislative process, and in the California Power Exchange he worked inside precisely the kind of institution this proposal contemplates: a body created alongside a regulatory scheme, with a defined relationship to the state and, as it turned out, a finite life. Between us we have covered most of the system this proposal is modeled on, and he knows the part of it I do not.

The second reason is that I am a left-leaning Democrat and Jesús is a right-leaning Republican, and we think that matters here more than it usually would. The argument now being made against state AI regulation is that it is a partisan project of blue states. It is not, and the cheapest way to demonstrate that is for the people proposing it to disagree about most other things. We intend to keep it that way: when the drafting body is formed, its co-chairs will not share a party registration, and that will be written into its charter rather than left to good intentions.

There is a third reason, and it is the one that actually gets us out of bed for this.

Jesús has two daughters in college. I have two children who will start college within the next few years. The world they are walking into is one where these systems will be in their classrooms, their first jobs, their medical care and their politics, and neither of us gets to opt them out of it. We are not trying to stop any of that, and neither of us thinks it should be stopped — the upside for them is real and we both want them to have it. What we want is for the thing to be built so that it is safe for them and useful to them, and for somebody to have checked before it reaches them rather than after.

That is the whole motivation. We are not AI safety professionals, we have no institutional position to protect, and neither of us is going to be doing this in twenty years. Our children will be living in it for all of theirs.

What I stand to gain, and what I do not

I would rather disclose this than have someone find it.

I hold more than thirty-five U.S. patent applications, several of which cover AI verification methods. This proposal, if enacted, would create a regulated market for AI verification services. I therefore have a commercial interest in a statute that requires verification, and a reader is entitled to weigh what I say accordingly.

Three things are worth saying against that, and one thing in favor of it.

• Nothing in this document specifies, favors or requires any particular verification technology, and I have deliberately kept it at the level of what a verifier must be able to see and prove rather than how. Where I name a method — the drill on the verifier's instruments, the independent inventory, the prohibition on the developer generating its own evidence — those are principles drawn from nuclear safeguards, financial audit and aviation practice, not from anything I own.
• Neither of us is being paid by any AI developer, chip manufacturer, cloud or datacenter operator in connection with this work, and neither of us holds equity in one.
• If a body is formed to carry the model rule forward, I will not hold a paid executive role in it and a committee seat at the same time on a permanent basis, and any compensation will be published.

And the thing in favor: the reason I hold those patents is that I have spent two years building tools whose purpose is checking what AI systems tell you. That is also the reason I noticed what Section 3 and Section 5.5 of this document report. The interest and the expertise come from the same place, and I would rather you had both facts.

Jesús's firm is a government affairs practice with its own clients, and any client of Advantage Government Consulting with an interest in this proceeding will be disclosed by name before we file.

Why I used AI to prepare this, and how

I want to be completely open about one of the main methods I used in creating this proposal, partly because it is unusual and partly because anyone reading this should be able to understand and discount it appropriately.

The analysis underneath this submission was produced by putting an identical design brief to eight commercial AI systems and nine open-weight models — through twenty-eight sessions, around 235,000 words — on 27 September 2026. Each was asked to survey what already exists worldwide, design a regime, and then defend it against fourteen structured attacks: the constitutional challenge, the model trained offshore, the weights already published, the developer who signs and quietly does not comply, and two opposing accusations — that they had been captured by industry, and that the whole thing was a state power grab. Each was told to draft every answer, attack it twice as a hostile expert reviewer would, revise it, and then disclose what the review had changed.

The complete archive — every prompt and every unedited response — is published at alphainception.com/ask-the-ai.¹⁴

Why this was the right source. The subject here is frontier AI systems and how a jurisdiction might verify their behavior and shut them down if needed. The people who understand that best work inside the companies that would be regulated, and they are conflicted. The independent experts who understand it are few and mostly already committed. The technical literature is massive, scattered across jurisdictions and languages, and growing faster than anyone can follow.

These systems have read more of that literature than I ever will. They are also, uniquely, the subject of the regulation — asking a frontier model how one would go about shutting it down is asking the thing itself. And running the same brief across fourteen independently built systems from competing companies gave me something no single consultant could: I could see where they converged and where they split. Convergence across rivals trained differently on different data is a signal worth having. When three of them independently proposed copying the nuclear industry's resident inspector program, and two independently added the same two safeguards against those inspectors going native, that told me something a single opinion would not have.

The last advantage is something I learned over the last two years. You can instruct these systems to attack their own work and even the companies that built them, and they will do it in a way most human advisers will not and could not because they are machines who have no attachment or human emotional baggage. In the process of constructing this proposal, several reversed their own conclusions between drafts and said so. One concluded, against its own proposal, that the central obligation could not be verified at all.

The limits, stated just as plainly. These systems are fluent and confident about statutes, dates, institutional roles and legal doctrine, and they are sometimes wrong in ways that read as authoritative. In my sessions, one disclosed at the second-to-last question that it had taken every fact I gave it on trust and had not searched anything until that moment. Another refused to describe a foreign statute at all, on the grounds that it could not confirm the text. A third, asked to name the claims most in need of human checking, nominated its own central conclusion first.

So I treated all of it as input rather than authority. Every legal claim in this document that carries weight, I have checked myself against primary or official sources, and Section 10 says exactly which ones and what is left open.

Several recommendations here originate in that analysis. Several do not. The model-rule structure, the enforcement ladder, the resolution-plan mechanism, the infrastructure duty and the publication-hold proposal as formulated are mine, informed by it. The judgments, and the errors, are mine as well.

References

1. Proposed class action filed 19 September 2026, United States District Court for the Northern District of California. ↩
2. New York, Responsible AI Safety and Education Act (RAISE Act), as amended, effective 1 January 2027. ↩
3. California SB 813 (2026), chaptered 9 September 2026, adding Chapter 14 (commencing with Section 8898) to Division 1 of Title 2 of the Government Code. ↩
4. California Legislative Information, SB 813 bill versions, 21 February 2025 through 9 September 2026. ↩
5. Joint announcements by the offices of Senator Jerry McNerney (SD-05) and Assemblymember Rebecca Bauer-Kahan, 17 June 2026. ↩
6. The gate structure draws on the Senior Managers Regime in United Kingdom financial services and on Section 302 of the Sarbanes-Oxley Act, both of which require a named individual to take personal responsibility for a factual claim. ↩
7. California SB 53, Transparency in Frontier Artificial Intelligence Act, Business and Professions Code Section 22757.11(d), effective 1 January 2026. ↩
8. OpenAI disclosure, July 2026; Anthropic disclosure, 30 July 2026, following review of 141,006 evaluation runs; Google disclosure, 18 September 2026. A fourth disclosure was made by the United Kingdom AI Security Institute in August 2026. ↩
9. Business and Professions Code Section 22757.13(c)(1) and (c)(2) for the California clocks; New York RAISE Act for the 72-hour and 24-hour clocks. ↩
10. Regional Greenhouse Gas Initiative. State implementing regulations include Connecticut General Statutes Section 22a-200c, the Maryland CO2 Budget Trading Program Rules, and the New Jersey CO2 Budget Trading Rule. RGGI, Inc. is a 501(c)(3) providing technical and administrative services under contract to the participating states; it holds no regulatory authority, which is reserved to the states. ↩
11. Republic of Korea, Act on the Development of Artificial Intelligence and Establishment of Trust (AI Basic Act), in force 22 January 2026, and its Enforcement Decree. ↩
12. California SB 53 penalty provisions; New York RAISE Act penalty provisions. ↩
13. California AB 1405 (2026), Chapter 178, Statutes of 2026, Government Code Sections 11549.82(a) and 11549.82.5. ↩
14. Ask AI about AI, Alpha Inception. Full archive of prompts and unedited responses: alphainception.com/ask-the-ai. The sessions behind this submission are the entry dated 21 September 2026. ↩