On August 1, 2024, the European Regulation on Artificial Intelligence (EU AI Act) came into force. It aims to ” foster responsible artificial intelligence development and deployment in the EU (…)” and, according to its first recital, to support innovation at the same time. Whether the EU AI Act will achieve this objective remains a matter of controversy. However, another question is of considerable importance: Does the EU AI Act jeopardize Europe’s defense readiness?
What does the EU AI Act say about AI systems used for military purposes?
AI systems used solely for the protection of national security are excluded from the scope of the AI Act. Article 2 (3) of the EU AI Act provides as follows:
“This Regulation does not apply to areas outside the scope of Union law, and shall not, in any event, affect the competences of the Member States concerning national security, regardless of the type of entity entrusted by the Member States with carrying out tasks in relation to those competences.“
In which cases are “dual-use” AI systems nevertheless subject to the EU AI Act?
Although it has been pointed out on various occasions that so-called dual-use AI systems are nevertheless subject to the EU AI Act,[1] this should not lead to the false conclusion that the civilian use of such systems would mean that their concurrent or later use for the protection of national security would also be subject to the EU AI Act. Rather, the scope of the EU AI Act must always be determined on a functional basis for each respective use of AI systems, distinguishing between the following use cases explained in the EU AI Act:
(i) The AI system is developed, placed on the market, put into service, or used for military, defense, or national security purposes. However, the AI system is then used temporarily or permanently (also) for other purposes, such as civil or humanitarian purposes, or for law enforcement or public security purposes. In this case, “the entity using the AI system for other than military, defence or national security purposes” that do not fall under the scope of the exemption in Article 2(3) of the EU AI Act must ensure that the AI system complies with the EU AI Act, unless it already complies with it.
But even if the same AI system is then used without any modifications in the military domain -which will rarely be the case- such (further) use of the AI system by armed forces to preserve territorial integrity and/or protect national security remains unaffected by this and does not require the AI system to comply with the EU AI (Recital 24, sentences 4 and 5 of the EU AI Act).
(ii) The AI system is placed on the market or put into service for defense or for protecting national security, but also for civilian purposes, for law enforcement or other purposes. In this case, the provider of the AI system must ensure that its system complies with the EU AI Act so that its AI system does not pose any risks to public safety, public order, or the internal or external security of the Union when used for such civilian or other non-military purposes, which must be addressed in accordance with the EU AI Act. Here too, however, the military use of the AI system to preserve territorial integrity and/or protect national security is excluded from the scope of the EU AI Act (Recital 24, sentences 6 and 7 of the EU AI Act)[2].
(iii) The AI system is placed on the market for civilian or law enforcement purposes, but is then used, with or without modifications, exclusively for military, defense, or national security purposes. In this case, the provider of the system is not obliged to ensure that the system complies with the EU AI Act. Even so, its military use is still excluded from the scope of the EU AI Act (Recital 24, sentence 8 of the EU AI Act).
For the sake of completeness, it should finally be noted that an AI system that is developed, placed on the market, put into service and used, with or without modifications, exclusively for military, defense, or national security purposes is not a dual-use system in the first place. According to Article 2(3), sentence 2 of the EU AI Act, such an AI system does not fall within the scope of the EU AI Act. Neither the provider of the system nor the entities that use the AI system solely for these purposes are obliged to ensure the system’s compliance with the EU AI Act.
Does the EU AI Act jeopardize Europe’s defense readiness? As the use cases explained above show, this is generally not the case, as the EU AI Act does not apply to the use of AI systems by the armed forces for the protection of national security. But does the EU-AI Act indirectly stifle military innovation? Read on.
Does the application of the EU AI Act depend on which institution uses an AI system?
Since the sectoral exemption in Article 2 (3) of the EU AI Act refers to the functions of the Member States specified therein and the use for certain purposes in the exercise of those state functions, in cases where the specific use does not fall within the scope of the EU AI Act, it is irrelevant which entity has been entrusted by the Member States with the performance of national security tasks or which entity carries out activities for such a use exempted from the EU AI Act (Article 2(3) and Recital 24 of the EU AI Act).
This means that the exception in Article 2 (3) of the EU AI Act also applies when Member States use private individuals or organizations/companies to perform national defense and/or national security tasks, or when the police, criminal investigation departments, or law enforcement authorities of Member States are involved in such activities.[3]
Could the EU AI Act indirectly stifle military innovation and military capabilities?
Such a reflex effect of the EU AI Act would be conceivable in cases where an AI system is initially developed and marketed only for civilian applications, but then, due to its compliance with the EU AI Act, cannot be expanded or adapted with innovative functions for use in defense and national security, or can only be done so with disproportionate effort. However, this should be avoidable if the potential military use of AI systems is always considered during their development. Providers such as Palantir have proven that this is possible.
Furthermore, it can be assumed that AI innovations will also originate from the defense sector in the future if novel AI systems are developed for specific military requirements that civilian AI systems cannot meet. This should prevent the dual-use problem from arising in the first place.
Should AI systems used for defense purposes be subject to additional EU regulation?
Some felt that the exemption in Article 2(3) of the EU AI Act went too far,[4] while others saw military innovations as being jeopardized by the EU AI Act.[5] The first view begs the question whether AI systems used for defense purposes should still be subject to EU law during such use.
According to Recital 24 of the EU AI Act, the exemption in Article 2(3) of the EU AI Act is justified
“both by the fact that national security remains the sole responsibility of Member States in accordance with Article 4(2) TEU and by the specific nature and operational needs of national security activities and specific national rules applicable to those activities.“
This is correct. AI systems intended for military use are subject to specific technical and legal requirements that are not addressed by the EU AI Act for good reason. However, if there is a demand to regulate AI systems used for military purposes through (additional) European Union legislation, this could only be met if the EU had jurisdiction in this area.
Do AI systems used for military purposes fall within the competence of the EU legislator?
According to Article 4 paragraph (2) sentence 3 of the Treaty on European Union (TEU) [6], national security remains the sole responsibility of each Member State. As pointed out in legal literature, this exception should not be understood as a mere obligation on the part of the European Union to respect the regulatory competence of the Member States in matters of national security, but as “a genuine rule on the division of competences”[7]. As a result, the protection of national security falls within the exclusive competence of the Member States and is not subject to the legislative competence of the Union.
What exactly falls within the exclusive competence of the Member States for the protection of national security?
The term “national security” is not synonymous with “public security” and must be interpreted autonomously under Union law. However, in its judgment of July 15, 2021, the European Court of Justice (ECJ) provided legal clarity on this question of interpretation. The Court ruled
“that the principal tasks of the armed forces of the Member States, which are the preservation of territorial integrity and safeguarding national security, are expressly included among the essential functions of the State which the European Union must respect in accordance with Article 4(2) TEU.”[8]
AI systems that serve and are (or are intended to be) used to fulfill principal tasks of armed forces are therefore clearly not subject to the competence and regulatory authority of the Union. As such, they are the sole responsibility and competence of the Member States. These principal tasks of the armed forces of EU Member States include not only the use of AI systems in autonomous weapon systems. They are also met by many other applications. The use of AI systems in military logistics or military intelligence, surveillance, and reconnaissance (ISR) are just two examples..
However, as the European Court of Justice (ECJ) also clarified in its above-mentioned ruling of July 15, 2021, questions of military organization are not generally excluded from the scope of EU law. Regulations governing the working hours of members of the armed forces are therefore subject to EU law. However, such regulations are not covered by the EU AI Act.
The question of whether the EU’s regulatory competence extends to the military use of AI systems must therefore be answered in the negative for all AI systems that serve to fulfill the principal tasks of armed forces. In the absence of competence on the part of the EU legislator to regulate such uses of AI systems by law, they are also not subject to the EU AI Act. On the other hand, AI systems used by the armed forces of EU Member States for humanitarian missions or peacekeeping in other countries fall within the scope of the EU AI Act for these purposes.
Conclusion
Does the EU AI Act jeopardize Europe’s defense readiness? If Article 4(1) sentence 3 TEU and the sectoral exemption in Article 2(3) of the EU AI Act are interpreted correctly, this should not be the case. There is no scope for the demand that the risk-based provisions of the EU AI Act should also apply to AI systems that fall under the sectoral exemption. However, providers and operators of AI systems should carefully examine whether the sectoral exemption applies to a specific use of an AI system or not. To this end, they should seek legal advice in good time if they are unable or unwilling to clarify the related legal issues themselves.
Calls for the European Union to also regulate the military use of AI systems are already precluded by the fact that this is the exclusive responsibility of the Member States, insofar as it affects the principal tasks of the armed forces.
However, AI systems for civilian applications that are also suitable for military use should be developed in such a way that the necessary adjustments can be made at a reasonable economic cost so as not to hinder military innovation. For their part, the European Union and the Member States should, in view of the current geopolitical tensions and the continuing increase in the number of armed conflicts, do their utmost to promote military innovation financially and ensure that the armed forces contribute their sector-specific requirements for AI systems to their development.
The case studies discussed in this article serve to illustrate the scope of the exemption in Article 2(3) of the EU AI Act. They do not represent an exhaustive treatment of all conceivable cases in which an AI system must comply with the EU AI Act. Likewise, this article does not cover all cases in which an AI system does not fall within the scope of the EU AI Act.
A legally certain assessment of the applicability of the EU AI Act to a specific AI system can only be made on a case-by-case basis, taking into account the specific purposes for which the system is used. Future decisions by the ECJ and/or changes in the law may require a different assessment of the issues discussed in this article.
[1] See Powell, The EU AI Act: National Security Implications, https://t1p.de/xpwle;
[2] See also Ceyhun Necati Pehlivan, Nikolaus Forgó, Peggy Valcke (eds.), The EU Artificial Intelligence (AI) Act, 3.3 Article 2(3): Exemption for Military, Defense, and National Security
[3] Peukert, EuR 2023, 535, 561; also for the performance of such tasks by private entities Ceyhun Necati Pehlivan, Nikolaus Forgó, Peggy Valcke (eds.), The EU Artificial Intelligence (AI) Act, 3.3 Article 2(3): Exemption for Military, Defense, and National Security
[4] European Center for Not-for-Profit Law, Scope of the EU Artificial Intelligence Act (AIA): Military Purposes and National Security, available at https://t1p.de/r2016; see also Kulueva, Blind Spots in AI Governance: Military AI and the EU’s Regulatory Oversight Gap, https://t1p.de/n7nj
[5]Center for a New American Security, The EU AI Act could hurt military innovation in Europe by Noah Greene, https://www.cnas.org/publications/commentary/the-eu-ai-act-could-hurt-military-innovation-in-europe
[6]Treaty on European Union (consolidated version), OJ EU C 326/15 of October 26, 2012
[7]Peukert, EuR 2023, 535, 545 with reference to Karpenstein/R. Sangi, National Security in Union Law: On the Significance of Art. 4 II 3 TEU, GSZ 2020 p. 163 and W. Obwexer, in: von der Groeben/Schwarze/Hatje (eds). European Union Law, 7th ed. 2015, Art. 4 TEU, para. 46.
[8]Judgment of the Court of Justice of 15 July 2021 in Case C-742/19 B.K. v Republika Slovenija (Ministrstvo za obrambo)
Are you planning to develop or put into operation an AI system in the military domain? If so, check out my legal advice for operators and users of AI systems or better still, get in touch with me.