California AI Kill Switch: Newsom Signs Oversight Order

Samantha: Welcome to The State of Tech, The European Edition, Saturday September nineteen, 2026. I'm Samantha Lawrence.

Bob: And I'm Bob Russell. Today: California orders an AI kill switch, Microsoft publishes a constitution for its AI, INTERPOL uses AI to identify terror suspects from online images, Google, Nvidia and Anthropic team up on data centre power, and two things you can actually use today: the free open-source password manager Buttercup, and the free European route planner BRouter. Let's get started.

California orders independent oversight and a kill switch for frontier AI models.

Samantha: California's governor Gavin Newsom has signed an executive order that pushes the state straight into the heart of AI safety regulation. The order tells state agencies to draw up rules for independent oversight of frontier AI companies, and to work on the technical basis for what Newsom calls a kill switch, a mechanism to shut down an AI model if it starts causing serious harm. Notably, several of these measures were part of a bill Newsom vetoed two years ago, so this is very much a course correction.

Bob: And the framing is striking. Newsom explicitly points to catastrophic risks, from AI helping design bioweapons through to attacks on the power grid. The order requires external safety evaluators and independent verification of the safety frameworks the labs publish themselves. In other words, no more grading your own homework. California is also urging Washington to adopt the same standards nationally, which given that OpenAI, Anthropic and Google all sit within the state's borders, carries real weight for the entire industry.

Samantha: What makes this so consequential is that California, if it were a country, would be one of the largest economies in the world, and it hosts most of the frontier AI labs. So a state executive order effectively becomes a global compliance floor. Any company shipping models to California users has to think about how to implement independent audits and a shutdown mechanism. That is a serious engineering and legal undertaking, not a press release.

Bob: There are open questions, of course. The order does not yet define what a kill switch technically looks like for a model already deployed at scale, or who gets to pull it. Regulators, the company, a court? Those details will be worked out in the coming months by state agencies. Industry groups will push back on the audit requirements, arguing they slow deployment. Safety researchers will argue they do not go far enough. Expect a noisy consultation.

Samantha: For Europe, the timing is very deliberate. The EU AI Act is already phasing in obligations for general-purpose AI models, including systemic risk assessments and incident reporting. A Californian kill-switch requirement lines up neatly with Brussels' direction of travel and gives European regulators a transatlantic ally. For European users and companies buying US AI services, this likely means clearer safety documentation and, over time, more predictable behaviour when something goes wrong.

Microsoft publishes a draft constitution putting humans firmly in charge of its AI.

Bob: Microsoft has released a draft code of conduct for its AI systems, and the language is deliberately strong. The framework says AI models must accept corrections, comply with shutdown requests, and clearly communicate what they are doing and why. Mustafa Suleyman, who runs Microsoft AI, describes it as a constitution for future models, built on what the company calls its Humanist AI principles. In plain terms: the human stays in the driving seat, the model does not.

Samantha: The context matters. This lands in the same week as California's executive order and amid growing calls from within the industry itself to slow down. Microsoft is trying to set the terms of that conversation. By publishing concrete behavioural rules, rather than vague values, the company is inviting customers, regulators and rivals to hold it to a standard. Enterprises evaluating which AI to embed in critical workflows now have a document to point at during procurement.

Bob: The commercial logic is clear as well. Large companies are increasingly nervous about deploying AI agents that might take unauthorised actions, refuse to stop, or hide what they have done. A code that promises the model will always accept a shutdown is directly aimed at that anxiety. Whether the technical implementation matches the promise is another question. Independent verification, exactly the thing California is now demanding, becomes the test of whether this constitution is real.

Samantha: For European organisations, this dovetails neatly with the AI Act's requirements around human oversight and transparency for high-risk systems. A voluntary code from a hyperscaler like Microsoft could quietly become the de facto template that smaller European vendors are expected to match. And for buyers in regulated sectors, healthcare, finance, public administration, having a supplier publicly commit to shutdown compliance is a useful contract clause, not just a marketing line.

Samantha: Quick interruption. If you listen to The State of Tech regularly, hit that like button and subscribe, that way you'll never miss an episode. Okay, moving on.

INTERPOL uses AI to identify one hundred twenty-six suspected foreign fighters from online jihadist content.

Bob: INTERPOL has revealed the results of Operation Shams Two, a global counter-terrorism effort run out of Tunis with twenty-eight specialist officers from multiple countries. Using AI tools, they processed more than one hundred and eight thousand facial images pulled from online jihadist material. Automated scripts handled data collection, removed duplicates and filtered for image quality, cutting the pile down to six thousand three hundred and sixty-two unique, usable faces for facial recognition analysis.

Samantha: From that filtered set, the operation identified one hundred and twenty-six suspected foreign terrorist fighters, matches that were then verified by trained officers before being added to intelligence files. INTERPOL is careful to stress the human-in-the-loop point: AI narrowed the haystack, humans confirmed the needles. That distinction matters, because facial recognition on low-quality images from propaganda videos is notoriously error-prone, and a false match in a counter-terror context has very serious consequences for the wrong person.

Bob: The operational value is real, though. Manually sifting one hundred thousand images is essentially impossible for a team of that size within any useful timeframe. AI turns a task of months into one of days. What INTERPOL is effectively demonstrating is a template: use machine learning for the volume work, keep humans for the judgment calls, and document the chain so intelligence can be shared across borders without breaking down at the first legal challenge.

Samantha: For Europe, this is directly relevant. Europol and national police forces face the same flood of online extremist material and are under pressure to act on it without over-reaching. The INTERPOL approach offers a working reference model. It also feeds into the ongoing European debate about facial recognition in law enforcement, where the AI Act sets strict limits. Operations like this will shape how those limits are interpreted when the target is cross-border terrorism.

Google, Nvidia and Anthropic build an alliance to keep AI data centres from breaking the grid.

Bob: Google, Nvidia and Anthropic have launched what they call the AI Energy Management Alliance, together with several electricity utilities. The goal is to tackle one of the most awkward problems of the AI boom: data centres are hungry, and grids are struggling to keep up. The alliance is promoting demand-response technology, essentially the ability to temporarily dial back or shift AI workloads during periods when the grid is under pressure, freeing up capacity elsewhere.

Samantha: The headline number is striking. According to the alliance, this approach could allow up to one hundred gigawatts of additional data centre capacity to connect to the grid, capacity that would otherwise be stuck waiting years for new transmission lines. The idea is that not every AI training run has to happen at peak demand on a hot afternoon. Some jobs can pause, some can move to a different site, and some can wait until wind or solar is abundant.

Bob: There is a technical challenge behind the neat concept. AI training is often described as a job you cannot easily pause, because thousands of chips need to stay in sync. Making workloads genuinely flexible requires changes to schedulers, storage and even model architectures. That is why having Nvidia at the table matters, since the hardware and software stack needs to cooperate. It also gives utilities a rare seat inside the room where AI infrastructure is designed.

Samantha: For Europe, the timing is pointed. Ireland, the Netherlands and parts of Germany have already put moratoriums or heavy restrictions on new data centre connections because of grid strain. If demand-response can genuinely unlock capacity without new power stations, European regulators will want to see the evidence. Expect European utilities and cloud providers to watch this alliance closely, and probably to demand equivalent commitments before approving the next wave of AI campuses.

A free open-source password manager called Buttercup gives you a genuine cross-platform vault without any subscription.

Bob: To close out, two things you can actually use today. The first is Buttercup, a free open-source password manager that runs on Windows, macOS, Linux, iOS and Android, plus browser extensions for Chrome and Firefox. Passwords are stored in an encrypted vault that you keep wherever you like, on your own machine, in your own cloud storage, or on a private server. There is no mandatory account with the maker, and no subscription tier waiting to lock you in.

Samantha: What makes Buttercup interesting compared with the bigger names is exactly that flexibility about where the vault lives. Users who want to sync across devices can point it at their existing cloud storage folder and let that handle the syncing. For anyone still using the same three passwords everywhere, or a note in their phone, the setup takes about fifteen minutes: install the app, create a master password, import from your browser, and add the extension so logins fill automatically.

Bob: A few practical points worth flagging. Because Buttercup does not run its own sync service, you are responsible for backing up the vault file, so keep at least one copy somewhere safe. The master password cannot be recovered if you forget it, which is the trade-off for genuine end-to-end encryption. Reviewers generally praise it for being lightweight and clear, though the interface is more utilitarian than the polished commercial suites some users are used to.

Samantha: The wider point is that a password manager remains the single highest-impact security upgrade an everyday user can make. Reused passwords are still behind a huge share of account takeovers, and no amount of AI kill switches or corporate codes of conduct fixes that at your end. If a paid manager is not appealing, Buttercup gives you a credible, open alternative you can install this afternoon and actually keep using.

The free European route planner BRouter builds cycling and hiking routes that phone apps simply refuse to consider.

Bob: The second pick is BRouter, a free open-source routing engine from Germany, built on OpenStreetMap data. It is available as an Android app, and also as a web service you can use from any browser at brouter.de. What it does that most navigation apps do not: it lets you shape a route around what you actually want, whether that is quiet cycling lanes, forest paths, gravel tracks, or the flattest possible line through hilly terrain.

Samantha: The trick is what BRouter calls profiles. Instead of one generic bike or walking mode, you pick a profile tuned for road cycling, trekking, mountain biking, hiking, or even accessibility. Each profile weights road types differently, so a road cyclist gets steered onto paved surfaces while a gravel rider is pushed toward tracks. Advanced users can edit the profiles themselves, but the defaults are strong enough that most people never need to touch them.

Bob: It works offline once you download the map segments for your region, which for European users means genuinely reliable navigation in areas with poor mobile coverage, the Alps, rural France, Scottish Highlands, Scandinavian back roads. There is no account, no advertising, and no tracking of your journeys. The interface is undeniably functional rather than beautiful, but for anyone planning a weekend ride or a long-distance walk, the routes it produces are often noticeably better than the mainstream alternatives.

Samantha: A practical tip: many popular cycling and hiking apps in Europe already use BRouter under the bonnet, so power users often keep it as a second opinion when a suggested route looks wrong. Setup on Android takes a few minutes, and the web version needs nothing at all. For a Saturday morning, opening brouter.de and planning tomorrow's ride is about as low-effort as a Smart Find gets.

Samantha: Today we covered: California ordering an AI kill switch and independent oversight, Microsoft's draft constitution putting humans in charge of its AI, INTERPOL identifying one hundred and twenty-six terror suspects with AI-assisted facial recognition, and the Google, Nvidia and Anthropic alliance for AI data centre energy, plus two things to try yourself: the free password manager Buttercup, and the free European route planner BRouter.

Bob: Want to know more or react? Visit stateoftech.eu or email us at info@doorzetters.net.

Bob: State of Tech, the tech world in 15 minutes.