1. The claim
Deployments that can harm people need a defined safe state.
That safe state must be reachable by non-AI means.
This is a deployment rule, not a model-weight rule.
2. Worked example
Driverless taxi: a stop control is available; a non-AI system executes the stop; doors open mechanically. The example is structural — length and facts only until voice pass.
3. Why this is not a new idea
Functional safety already separates the safety function from the process under control. Lineage includes IEC 61508 and IEC 61511 (independence of the safety function), ISO 13850 (emergency stop), layers of protection, and automotive degraded mode.
4. The distinction
This regulates deployments, not model developers. The objection that “it cannot work for open weights” does not apply to a deployment-side safe state requirement.
5. Precise formulation
A defined safe state reachable by non-AI means — not an off switch, and not a request to the model to behave.
6. The register
3 instruments tracked across 2 jurisdictions