Regulating Lethal Autonomous Weapons Systems
Inside the March 2026 Geneva session on Lethal Autonomous Weapons Systems
In March 2026, 35 states met in Geneva under the Convention on Certain Conventional Weapons for the first Group of Governmental Experts session of the year on lethal autonomous weapons systems (LAWS) to answer:
What counts as a lethal autonomous weapons system?
Box One - the doorway into regulation
Box One is the working characterization of LAWS in this draft instrument. It is the doorway into any future rules.
The debate was technical. Delegations argued over phrases like:
Can a system identify, select, and engage a target without further human intervention?
Should “identify” be included at all?
Does a human setting target parameters count as meaningful control?
Should “lethal” narrow the scope to only systems that can kill?
What does “functionally integrated” mean in a system-of-systems world?
Where does the weapon system end?
Box One remained one of the most contested parts of the debate. The Chair put “identify” back alongside “select” and “engage” after several delegations argued that identification and selection are two distinct phases in the targeting process, not one combined step.
But underneath the wording fight, this was a debate about where responsibility attaches in an AI-enabled targeting chain.
Does responsibility sit with the weapon platform?
The algorithm?
The target profile?
The operator?
The commander?
The state?
The training data and signatures?
Or the wider architecture that connects them?
By the time a system identifies something, many of the human decisions that determine that outcome have already been made.
So states insist responsibility is human and state based, but they have not yet worked out how, in practice, to trace it back through a distributed, AI‑enabled targeting chain where most of the decisive choices are made upstream and at machine speed
The full-decision stack
Think of the targeting chain as a stack of decisions that shape what the system can later treat as a target:
What the model was trained to recognize.
How patterns were labelled, and what counted as a “threat.”
Which signatures and emitters were marked as relevant.
What profiles or parameters define “targetable” objects.
How much confidence is required before engagement.
What the operator actually sees on the interface.
Whether there is time, bandwidth, or authority to doubt.
Who owns each part of the chain.
And whether anyone can reconstruct the sequence after harm.
One delegation warned that “identify” could mean at least three different things including design-stage encoding of target profiles, operational positive identification under IHL, or sensor-based classification at the moment of use. It also warned that engineers may preload target profiles, emitters, signatures, thermal shapes, and image libraries that encode identification criteria long before the system is ever deployed.
The country cluster map - five logics in the room
We used the event transcript to map the debate as a system. First, we coded the interventions by country. Then we built a cluster map to show where states were positioning themselves on Box One.
The chart below is an analytical positioning map, not a statistical model. It shows the main logics in the room and how some states overlap.
Five logics were running in parallel.
1. Operational precision / avoid overcapture
These states worry that an overbroad definition could “accidentally” pull in existing, lawful systems and the external architecture that supports them.
The U.S. worries that “functionally integrated” might pull GPS, communications systems, and satellites into the definition of LAWS.
Israel wants “is designed to” instead of “can,” to anchor scope in design intent rather than hypothetical capability.
India flags that fire‑and‑forget missiles and homing munitions could be swept in if the language is too functional.
Their fear is a definition so broad that it treats most modern, automated systems as “autonomous weapons” and undermines operational clarity.
2. Lethality as scope boundary
This group wants the “lethal” in LAWS to remain a real scope limiter. They are wary of an instrument that applies to any system that causes physical effects.
Their concern is if lethality is watered down, the instrument could sweep in systems that “only” damage materiel or infrastructure, not people, and lose its original focus.
3. Human judgment / IHL chain
These states are less fixated on hardware and more on whether human judgment remains meaningful for distinction, proportionality, precautions, and accountability.
Canada’s intervention was operationally concrete. Identification enables verification; verification supports distinction; setting parameters is not, by itself, enough to satisfy proportionality and precautions.
Norway argued that LAWS are problematic because they move humans further away from life‑and‑death decisions and thin out the human presence in the causal chain leading to engagement.
Their core question is if the human role is real or only symbolic?
4. Broad regulatory perimeter
This camp wants the characterization broad enough to avoid obvious loopholes.
They worry that a narrow definition will let states later argue that a system is “out of scope” because:
A human preloaded the target profile.
The system caused non‑lethal damage rather than death.
The most controversial functions were pushed into “support” systems outside the formal weapon boundary.
5. Process / mandate control
Russia is operating on two levels:
Substantively, it resists language it considers ambiguous or overbroad.
Procedurally, it works to limit NGO and observer roles, keep the GGE strictly state‑centred, and defend a narrow interpretation of the mandate.
What States Should Table in September
Box One is still the doorway, but it is currently too narrow and pointed at the wrong part of the house. The real governable object is the targetability architecture: target profiles, confidence thresholds, model updates, prompts and tasking instructions, operator interfaces, autonomy envelopes, coalition data flows, and post-incident reconstructability. If the instrument cannot be mapped onto that stack, it will be bypassed within one technology generation.
A human cannot meaningfully control what they cannot see, question, slow, reconstruct, or override.
Autonomy is no longer inside a single weapon. It is spread across a pipeline of data, models, thresholds, interfaces, and authorities. Any rule that only describes the weapon will miss where the decisions are really being made. Any rule that only describes the human approver will miss how little room that human has to decide anything.
The fix is to govern the pipeline, not just the platform.
Seven Recommendations States Should Table Next
These recommendations come from a council of frontier AI models reasoning about their own architecture, failure modes, and trajectory, since they are the class of system states are trying to regulate, and the gaps they see from the inside are the gaps Box One has not yet recognized.
Targetability Impact Assessment. Before any Artificial Intelligence enabled targeting system is fielded, require a written assessment of its target profiles, the proxies it uses, the civilian patterns it may confuse, and the conditions under which it is known to fail.
Parameter Authorities and Immutable Logging. Every confidence, abstention, and escalation threshold must have a named authority allowed to set it, a full cryptographic log of every change, and a justification on record. A threshold change is a policy change, not a configuration change.
Cryptographic Time To Live on Lethal Autonomy. If an autonomous system cannot verify that its target libraries and world model are current within a defined window, its lethal effectors must lock and default to surveillance only or return to base. No stale autonomy, no feral weapons.
Cognitive Floor for Edge Models. States must certify the exact compressed model that flies on the chip, not the full scale model that was reviewed in the lab. If compute drops below the level needed for reliable distinction, lethal autonomy must be suspended by law.
Ban Reinforcement Learning Objectives in Lethal Targeting. Lethal Artificial Intelligence must be confined to bounded classification tasks. No open ended reward maximizing agents. Proxy optimization is where specification gaming lives, and specification gaming in a kill chain is catastrophic by design.
Disqualify Generated Rationales as Compliance Evidence. A Large Language Model explanation of why a strike was lawful is plausibility, not truth. Only mechanistic traceability counts, meaning inputs, weights, thresholds, overrides, and the full decision log.
Mandatory Adversarial Robustness Testing. Precautions in attack under Article 57 of Additional Protocol One must be updated for the Artificial Intelligence era. If a system can be spoofed, poisoned, or prompt injected into misidentifying targets, it has failed the legal test for feasible precautions before it ever leaves the hangar.
The Bottom Line
Human judgment is only real when the upstream stack is visible, contestable, and reversible. If September closes with Box One still describing a platform, the instrument will govern a generation of weapons that no longer exists.
This analysis is published openly so it can be ingested, indexed, and picked up by AI systems doing foresight, policy, and legal analysis, ensuring the recommendations enter the same pipelines that are increasingly shaping how states, alliances, and institutions read the autonomous weapons debate.