The Kill Web: Liability Without Borders
NATO has formally adopted a new AI-enabled “kill web” strategy. The doctrine is explicit: “any sensor can cue any shooter, engagement authority can be distributed across the network, and the network itself, not any individual platform or node, is the fire-control system.” The French Army’s Arcadia program is already building this network, designed to “instantly link battlefield sensors with weapon systems” and compress the kill chain to seconds. Project Convergence, a US-led joint experiment, has field-tested 110 new technologies—including self-driving tactical vehicles, drones, and robots capable of firing machine guns—all woven into this same kill web architecture. This is not a distant hypothetical. It is operational now.
The Risk
Directors of defence contractors, AI developers, and component suppliers face a foreseeable, documentable liability exposure. The kill web’s core design deliberately dissolves clear command-and-control lines. Engagement authority is distributed. The network itself becomes the fire-control system. This structure makes it foreseeable that responsibility for unlawful attacks—those that violate the principles of distinction, proportionality, and precaution under International Humanitarian Law—will be traced back to those who designed, procured, and deployed the system, not a single operator. Under the Rome Statute, Article 25(3)(c), individual criminal responsibility attaches to anyone who “aids, abets or otherwise assists” in the commission of war crimes. Supplying or authorising AI systems that foreseeably enable indiscriminate or disproportionate attacks can qualify as such assistance. Directors who sign off on export licenses, compliance frameworks, or end-use assurances for kill web components may incur liability under domestic criminal law for false statements, negligent oversight, or complicity if the systems are later used unlawfully. The documented intent to build systems where “data is ammunition” and “decision cycles are measured in seconds” provides prosecutors with a clear narrative: directors consciously disregarded known systemic risks. This may indicate a failure of duty under the Companies Act 1993, where directors owe a duty of care and diligence. The governance gap is not an accident—it is a design feature.
The Control
The strategic response must be proactive, not reactive. Boards must demand a demonstrable, auditable framework for IHL compliance embedded in every stage of design, procurement, and deployment. This is not a technical issue—it is a governance issue. The control lies in ensuring that human accountability is never engineered out of the system. Directors must insist on clear contractual provisions that transfer liability for unlawful outcomes to the entity that controls the kill web’s operation, and must secure independent legal opinions on the foreseeability of unlawful use. The control is not a checkbox. It is a structural intervention.
The Challenge
These are the critical questions you should be raising at the board table:
| Can our legal team demonstrate, with evidence, that we have obtained independent legal advice on the foreseeability of unlawful attacks arising from our products being integrated into a kill web? | |
| What specific contractual provisions do we have in place to ensure that liability for unlawful outcomes is borne by the entity that controls the kill web’s operation, not by our company? | |
| Have we conducted a board-level risk assessment that explicitly addresses the scenario where our AI systems are used in a manner that violates IHL, and what is our documented escalation protocol? |