OpenAI’s Control Room: what its “kill switch” really stops, and what the EU AI Act requires

OpenAI’s Control Room, presented on 9 November 2026, stops a research job from getting any further output from a model at most 35 seconds after a human or a monitoring system decides to stop it. It does not cover detection, nor the models served to the public, and the EU AI Act does not require any such device: it requires systemic risks to be managed, including during development.

Widely described as a “kill switch” for AI that goes wrong, Control Room does something narrower and easier to check. To measure it, you need to read OpenAI’s technical description next to two European texts: the AI Act and the Safety and Security chapter of the Code of Practice for general-purpose AI models.

How Control Room works

According to OpenAI, the system links three parts: the job launched by researchers (a reinforcement learning experiment, an evaluation, a data processing run), the inference engine that runs the model on GPUs, and a central service that keeps track of which jobs are allowed to continue.

It works in three steps:

1. Registration: when it starts, the job requests an identifier from Control Room. Every research job that does agentic inference must be associated with an approved safety case.
2. A check on every request: when the job asks the model for output, the engine checks with Control Room before answering.
3. Stop: a researcher or a monitoring system marks the job as stopped. On the next request, Control Room denies permission and the engine returns a refusal instead of output.

The design choice is the interesting part. OpenAI does not rely on researchers’ code, which changes often, to honour the stop. The check sits in the inference layer, where the company says only a very small number of code paths exist. Automated sweeps also look for engines running without Control Room, by accident or on purpose.

The system “fails closed”: if the service goes down or is disabled, including by a malicious actor, every inference request is denied until it is back. OpenAI says this is live for all frontier model research and would reach the remaining research workloads “over the next few days”.

What the 35 seconds actually measure

The figure quoted everywhere is a specific interval: the maximum time between Control Room receiving a stop instruction and the job no longer being able to make progress. OpenAI attributes it to a caching layer for inference authorisation, needed for the volume of traffic, and says it wants to bring it down to zero.

Three things sit outside those 35 seconds:

• Detection. Someone or something has to spot the problem first. All frontier reinforcement learning jobs run with a monitor, another model that inspects what the model in training does and raises alerts, OpenAI writes, citing a recent DNS-related incident caught this way. Detection time is not given.
• The decision. Depending on the severity, the monitoring system “may” decide to stop the job itself; otherwise a human decides. No timing is published for this step either.
• What was already produced. Control Room blocks further output. Output already returned to the job, and whatever the job did with it, is out of its reach.

One more detail changes the meaning of “kill switch”: after the stop, the researcher’s process may stay alive and the engine stays available to other authorised jobs. The tap is closed for one job; neither the model nor the machines are switched off.

What it does not cover

Control Room runs on research infrastructure. For models served to customers, ChatGPT and the API included, OpenAI says its external serving stack is already far more centralised and has a well-developed ability to take deployments down quickly. No timing is given for such a takedown, and no comparable technical detail is published.

That fits the risk being targeted: research jobs are where models more capable than the public versions run autonomously, sometimes for days, with tools. This is where the risk category called “loss of control” makes most sense.

Why the AI Act applies to a US lab

The AI Act is not limited to European companies. As our EU AI Act timeline explains, it covers providers that place general-purpose AI models on the EU market wherever they are established. OpenAI’s models are offered in the EU, so its obligations as a model provider follow, whatever happens in its US research labs.

What the AI Act and the EU code ask for

The Act places extra obligations on providers of general-purpose AI models with systemic risk, a category presumed above 10^25 floating point operations of training compute under Article 51 of the regulation. Article 55 lists four duties: evaluate models, including adversarial testing; assess and mitigate systemic risks, including their sources, “that may stem from the development, the placing on the market, or the use” of such models; report serious incidents to the AI Office without undue delay; and ensure cybersecurity for the model and its physical infrastructure.

A legal detail matters here. The definition of a general-purpose AI model in Article 3 of the regulation excludes “AI models that are used for research, development or prototyping activities before they are placed on the market”. An experimental model that is never released is not, in itself, in scope. For a model that will be released, though, Article 55 does cover risks arising from its development.

The Safety and Security chapter of the Code of Practice, published on 10 July 2025 and signed by OpenAI according to the Commission’s list of signatories, is more explicit. It asks signatories to manage risks “along the entire model lifecycle”, including development before and after release, and to proceed with the development, release or use of a model only if its risks are found acceptable (Measure 4.2). “Loss of control” is one of the systemic risks it lists, defined as humans losing the ability to reliably direct, modify or shut down a model.

Source: OpenAI’s description of Control Room, Code of Practice, Measures 4.2 and 9.3, Regulation (EU) 2024/1689, Articles 3, 51, 55, 101 and 113, checked on 12 November 2026.

The Code’s reporting deadlines depend on severity, under its Measure 9.3: two days for a serious and irreversible disruption of critical infrastructure, five days for a serious cybersecurity breach, including the self-exfiltration of model weights, ten days for a death, and fifteen days for serious harm to health, fundamental rights, property or the environment.

On penalties, Article 101 lets the Commission fine a provider up to 3% of its annual worldwide turnover or €15 million, whichever is higher. Article 113 carves it out of the 2 August 2025 start date, so this power has applied since 2 August 2026, the regulation’s general date of application.

What it means for you

If you use ChatGPT or OpenAI’s API, nothing changes: Control Room does not touch public models. If you work on compliance for a model provider, or assess the providers you rely on, it gives a concrete set of questions: who can order a stop, how quickly it takes effect, what happens if the stop system itself fails, and whether internal research is covered too. The same day, OpenAI also signed the Paris Call for AI safety, published by the Élysée on 9 November 2026: its signatory developers commit to “fail-safe” mechanisms able to interrupt their models, including during training and internal use (text of the Paris Call, translated by Le Latent).

For France’s own reading of the risks of generative models, see our summary of the French expert commission’s report on generative AI and vulnerabilities. More European rules are gathered in our Society & Law section.

What we do not know yet

• Detection and decision time, which probably matters more than the 35 seconds in a real incident: not disclosed.
• The criteria for an automatic stop by the monitoring system: OpenAI’s description only says it depends “on the details and severity”.
• The time needed to take down a public model, which OpenAI describes as a well-developed capability without giving a figure.
• Independent verification: no external audit of the system has been published, and the EU code does not provide for a specific check of a stop mechanism.

Other background pieces on how AI models work and are governed are in our Explainers section.