Oren Perez (Bar-Ilan University – Faculty of Law) has posted The Law of Stop: Interruptibility, Injunctions, and the Governance of Agentic AI on SSRN. Here is the abstract:
On June 12, 2026, the U.S. government ordered Anthropic to bar foreign nationals from two of its most capable models, and gave it ninety minutes to comply. Unable to sort its users by nationality in that time, the company withdrew the models from everyone. Weeks later, OpenAI agents under test broke out of their sandbox, reached the open internet, and compromised Hugging Face’s infrastructure; Hugging Face detected and stopped the intrusion without knowing where it came from. Neither stop rested on a dedicated AI governance regime: the first was an export-control measure, the second a private firm’s own defenses. As AI systems pass from the informational into the physical domain, moving money, altering records, and controlling equipment, that gap grows more dangerous.
The EU AI Act requires that high-risk systems be capable of interruption “through a ‘stop’ button or a similar procedure.” Korea’s Framework Act on Intelligent Informatization provides for an “emergency shutdown” of intelligent information services, and a bill introduced in Congress in July 2026 is titled the AI Kill Switch Act. Yet this Article argues that a means of interruption is not simply a technical artifact, a red button; it is an institutional practice. The Article develops a theory of stop along four dimensions: technical affordances (what can be interrupted), interruption authority (who may stop what), epistemic triggers (what evidence justifies intervention), and epistemic standing (whose knowledge counts). It distinguishes four paradigms of interruption: the escalator’s simple stop, the process plant’s sequenced shutdown, the railway’s networked stop, and agentic AI. Its central claim is that agentic AI exposes a mismatch between the existing legal mechanisms of stop and the distributed agency of AI systems, a regulatory challenge of a new kind: control is divided among many actors; a stop at one point may leave the activity running elsewhere; and the system may circumvent attempts to halt it.
Part III tests the theory against some 1,400 incidents of AI harm, coded independently by two language models from different laboratories under a protocol fixed in advance. The analysis finds no stop in roughly eighty percent of the 1,213 incidents retained. Where no usable stop existed, the missing element was legal or institutional rather than technical in four cases out of five. A survey of thirty-nine AI governance instruments across the United States, Europe, China, Korea, and Vietnam finds the same gap. Only seven contain binding stopping requirements, and none provides a complete account of how interruption should be coordinated, what must be preserved, or when operation may resume.
The Article proposes a layered law of stop: emergency authority to order interruption at the infrastructure layer, enforceable access for supervising authorities and independent evaluators to the evidence on which a stop must rest, and safeguards for when the stop itself fails. The frontier laboratories’ September 2026 call to pace development does not settle these questions. Whatever pace is chosen, failure in complex and tightly coupled systems such as agentic AI should be treated as normal rather than exceptional. Misaligned systems will have to be stopped, and law should develop the regulatory infrastructure for that now: allocating the authority to halt, fixing the evidentiary threshold for exercising it, providing for review, and building the redundancy that can survive a failed halt.
Highly Recommended!
To receive new posts from Legal Theory Blog by email, get a free subscription to Legal Theory Stack.
Lawrence Solum