Estimated reading time: 17 minutes
On the battlefield, recognising who has left the fight is where soldiers can err, and they can err in two opposite directions. One error is to treat a man as protected when he is still dangerous. The other is to attack a man who is genuinely out of the fight. Both are failures of the same judgement. Article 41 of Additional Protocol I to the Geneva Conventions of 1949 (AP I) governs both through a single idea: a person who is recognised, or who in the circumstances should be recognised, as hors de combat “shall not be made the object of attack”.
That rule completes a sequence I have traced across this series. The principle of distinction settles who may be attacked at all. Precautions in attack settle how carefully an attacker must verify what he is looking at. Article 41 settles the moment at which a man who was a lawful target stops being one. It is the subject I promised at the close of my post on the legal adviser in AI-enabled operations.
This post is a refresher on a classic rule. It puts the recognition standard in the middle and works outward to the two ways recognition fails. From there it turns to what happens once a man is in enemy hands, to the criminal floor beneath the rule, and finally to what drones and autonomous systems do to any of it.
I. Recognising who is hors de combat: Article 41 and the reasonable person
Article 41 AP I turns the question of who may be attacked on a single idea: recognition. Its first paragraph protects any person who is hors de combat from being made the object of attack. That reach extends beyond those actually recognised as such. The protection also covers anyone who, in the circumstances, should be recognised as hors de combat.
That wording was deliberate, and the ICRC Commentary records why. The drafters framed the rule to reach persons who “should have been recognized by a reasonable man” as hors de combat (ICRC Commentary (1987), para. 1608, at p. 483). The test is therefore objective. It asks what a reasonable person would have recognised, judged on the facts as they stood.
Article 41(2) AP I then fixes who qualifies. It sets out three categories: a person “in the power of an adverse Party”; one who “clearly expresses an intention to surrender”; and one who is “incapacitated by wounds or sickness, and therefore is incapable of defending himself”. Each category carries a single condition. The person must abstain from any hostile act and must not attempt to escape. Commit a hostile act or run, and the status falls away.
This safeguard is not confined to the treaty’s parties. The ICRC Customary IHL Study treats the prohibition on attacking persons hors de combat as customary international law, binding in both international and non-international armed conflict (Rule 47). States that never ratified AP I still accept the rule’s core.
In operational terms, the recognition standard is where military necessity and humanity are reconciled, before either has to give way to the other. The law does not demand certainty or hindsight. It asks what a reasonable person would recognise in the moment, which preserves room to act under real battlefield conditions. Once that threshold is crossed, protection attaches and does not bend to convenience. That balance is why the rule has held for half a century, and it frames everything that follows.
II. The first failure: mistaking the dangerous for the protected
The first way recognition fails is to read protection off appearances. A wounded or fallen enemy has not necessarily left the fight, and the treaty does not presume that he has. Article 41(2)(c) AP I protects the wounded or sick only once they are incapacitated to the point of being incapable of defending themselves. The ICRC Commentary sharpens the point: the duty to spare arises from the resulting inability to fight, and a wounded man who is preparing to shoot, or already shooting, may still be attacked (para. 1620, at p. 487). American doctrine sets the same threshold, requiring that a person be “wholly disabled from fighting” before the protection attaches (DoD Law of War Manual, § 5.9.4). Montazzoli supplies the operational reason this matters: wounded combatants can keep fighting, and playing dead is a common battlefield tactic (at p. 26). Feigning incapacitation or surrender in order to attack is itself perfidy under Article 37(1) AP I.
What the law asks in place of appearances is a judgement, and it is the objective standard from Section I seen from the soldier’s end: what a reasonable person would recognise on the information available at the time. Montazzoli casts this in the field as a good-faith, common-sense assessment, under which an enemy reasonably identified as a lawful target stays one until the soldier is reasonably convinced he has dropped out of the fight (at p. 26). That judgement is made in the moment. Under the Rendulic Rule, from the post-war Hostage Case, conduct is judged on how things stood when the soldier acted, which allows for split-second decisions and imperfect information, and a reasonable error of judgement carries no criminal liability (at p. 28). Here is where genuine operational latitude lives.
The latitude is bounded, and the bounds are strict. It licenses an individual, good-faith judgement about a specific person; applied as blanket routine it becomes unlawful, so automatic double-taps, security rounds, or wholesale death checks are prohibited (Montazzoli, at p. 27). A general or theoretical threat will not do either. The DoD Manual bars attacking the incapacitated unless they commit a hostile act or try to escape (§ 5.9), and Montazzoli requires a good-faith belief that the particular person may still be fighting (at p. 27). That latitude also cuts the other way. Reitz argues that the clearly wounded should be treated presumptively as hors de combat, and that a merely theoretical ability to reach a weapon does not defeat the status; only reaching for it, or some other hostile act, does.
The boundary shows most sharply when it is crossed. Blackman is the illustration. The Courts-Martial Appeal Court accepted the finding that “there was no threat from the wounded Afghan insurgent”, who had been gravely hurt and stripped of his weapons, and held that the possible presence of other insurgents nearby had no causative bearing on Blackman’s decision to shoot him (R v Blackman [2014] EWCA Crim 1029, at para. 65). The murder conviction was later quashed on fresh psychiatric evidence that he had been suffering from an adjustment disorder, and a verdict of manslaughter by reason of diminished responsibility substituted ([2017] EWCA Crim 190). That partial defence reduced his culpability. It did not make the killing lawful, and the later court proceeded on the same footing: that the insurgent was incapacitated when he was shot (at para. 108). In operational terms, the latitude reaches honest uncertainty about the person in front of the soldier, not the danger of the situation at large. Once someone is genuinely out of the fight, the surrounding threat does not pull him back into it. That floor, and the criminal consequence of crossing it, is the subject of Section V.
III. The second failure: mistaking the protected for the dangerous
The opposite error is to withhold recognition from an enemy who has in truth left the fight. A serious academic argument presses this point, and it is worth engaging because it widens protection rather than narrowing it. Call it the contextual reading. Umbrello and Wood argue that Article 41 demands a contextualised appraisal of whether an enemy is out of combat, so that the status turns on the relative power of the two sides and not on the enumerated categories alone (at p. 2). On their account, the protected class is larger than the standard reading admits: a tank brigade that comes upon a platoon of riflemen faces, they say, an enemy already out of combat, because small arms can do nothing to armour (at pp. 3–4).
At the centre of the proposal is a change in the operative test. What decides the question, the authors argue, is not whether an enemy can defend himself but whether he retains any power to harm at all: powerlessness, in their word, rather than defencelessness (at p. 4). They establish the distinction by varying the encounter. Suppose the tanks now escort Coalition infantry, foot soldiers whom the riflemen can engage with their small arms. The riflemen are even more outmatched than before, yet because they can still kill and wound that infantry they remain, on the authors’ account, in combat (at p. 4). Defencelessness and powerlessness thus come apart, and it is powerlessness, the inability to harm anyone at all, that the authors make decisive. Yet the argument rests on a concession they are candid enough to state. Pressed with the objection that their logic would also protect the combatants aboard a supply train far behind the lines, the authors accept that such a train may lawfully be attacked. Those men are lawful targets simply as combatants, whether or not they threaten anyone at that moment. Against the objection, the authors concede that “there is no direct response which can be given” (at p. 5).
In my view the reading cannot be adopted, and the reason is textual before it is prudential. Article 41(2)(c) AP I protects a person who is “incapable of defending himself,” not one who is merely powerless to harm his enemy. Those are different measures. A soldier may be wholly unable to stop a tank and still able to defend himself against the infantry beside it. Recasting the category as powerlessness changes what the treaty tests. Nor does the ICRC Commentary supply the missing bridge. It does treat the defenceless adversary as out of combat, but that line sits within its discussion of an enemy held at the mercy of overwhelming firepower and forced to cease combat, with all means of defence exhausted (para. 1612, at p. 484). That is the situation of being in the power of an adverse Party under Article 41(2)(a), where the ICRC placed it, and it fits how states actually fight.
The appeal to charitable interpretation deserves closer attention, because it locates the conflict in the wrong place. Umbrello and Wood read the ICRC Commentary’s line as a general rule that any defenceless soldier is out of combat (at p. 4). Such a rule would indeed clash with practice, since defenceless soldiers are lawfully struck from the air every day, and so the authors offer the powerlessness reading as the generous interpretation that reconciles the ICRC Commentary with that practice (Appendix A, at p. 10). But that conflict does not exist once the ICRC Commentary is read in place. Anchored in the treaty’s categories, it states no such general rule and needs no rescue; it already matches the common understanding and state practice. What will not reconcile with Article 41’s text or with established practice is the powerlessness thesis itself. As a proposal for future law the contextual reading is arguable; as an account of what Article 41 requires today, it does not hold.
None of this discards the authors’ insight; it relocates it. The real case they describe, an enemy so overpowered that he has effectively passed into his opponent’s hands, is already caught by Article 41: by the category of being in the power of an adverse Party, and by the recognition standard of Section I. That placement also serves readiness, since a rule asking commanders to weigh relative power in the abstract would expand protection unpredictably, whereas the categories draw a line they can apply. Being in an adversary’s power, and the protection that follows, is the subject of the next section.
IV. Hors de combat in the enemy’s hands: Article 41(3) and continuing protection
Falling into an adverse Party’s power does not end protection; it changes its form. The category from Section I, being in the power of an adverse Party, reaches every kind of detainee, from prisoners of war to unprivileged belligerents, retained personnel, and civilian internees, each of whom remains hors de combat so long as he refrains from hostile acts and does not try to escape (DoD Law of War Manual, § 5.9.2). Once a person is in enemy hands, the protections of international humanitarian law, above all the prisoner-of-war regime of the Third Geneva Convention, are supplemented and reinforced by international human rights law, which adds procedural and substantive safeguards backed by stronger enforcement (Borelli and Laufer, at pp. 1 and 2).
Article 41 anticipates the hard case in its third paragraph. When persons entitled to prisoner-of-war protection fall into an adverse Party’s power under unusual conditions of combat that prevent their evacuation, Article 41(3) AP I requires that they be released, with all feasible precautions taken for their safety. The drafters had a concrete situation in mind: the long-range patrol with no way to hold captives or move them to the rear (ICRC Commentary, para. 1625, at p. 489). Feasibility is judged realistically. The detaining force must do everything reasonable in the circumstances to protect those it releases, but it need not cripple its own mission by giving away most of its supplies (para. 1625, at p. 489).
Release is mandatory, not discretionary: where the Third Convention’s evacuation conditions cannot be met, the prisoners shall be released (para. 1627, at p. 490). But release is a humanitarian act, not a convenient way to shed an encumbrance. The ICRC Commentary is emphatic that to release a prisoner who would then be left with almost no prospect of survival is, in substance, a denial of quarter (para. 1627, at p. 490). Paragraph 3 is also narrow in whom it covers: unlike paragraphs 1 and 2, it protects only those entitled to prisoner-of-war status (para. 1626, at p. 490).
In operational terms, this is the humanity principle meeting military necessity at its sharpest edge. Once an enemy is hors de combat, necessity no longer justifies using force against him (Borelli and Laufer, at p. 2). The pressure a commander may feel to dispose of a prisoner he can neither hold nor safely evacuate therefore has no lawful outlet: the law channels the hard case toward release with precautions, never toward killing. What the law forbids outright, and treats as a grave breach, is the subject of the next section.
V. Attacking a person hors de combat: the grave breach under Article 85(3)(e)
Beneath the recognition standard lies a criminal floor. Article 85(3)(e) AP I makes it a grave breach to make a person “the object of attack in the knowledge that he is hors de combat”, where the act is committed wilfully and causes “death or serious injury to body or health”. That threshold is deliberately high. The grave breach requires wilfulness, actual knowledge of the status, and a serious result, whereas the primary prohibition in Article 41(1) AP I reaches even the attacker who merely should have recognised the man before him. Not every breach of Article 41 is therefore a grave breach. The gravest category is reserved for the attacker who knew.
What this floor forbids, it forbids without exception. The ICRC Commentary is unequivocal: military necessity affords no derogation here (para. 1609, at p. 484). This is the counterpart to the latitude described in Section II. The law is realistic about what a soldier can perceive under fire, and unyielding about what follows once recognition is owed. Necessity does its work before that threshold, never after it.
This prohibition is enforced, not merely declared. The ICTY tried the killings of prisoners taken from Vukovar hospital, whom the Prosecution submitted qualified as civilians under Article 5 of the Statute, either because they had never taken part in the hostilities or because they had been placed hors de combat (Prosecutor v Mrkšić, IT-95-13/1-T, Trial Judgment, 27 September 2007, at para. 444). That submission was rejected. Reading Article 5 by reference to Article 50 AP I, the Mrkšić Trial Chamber held that the term civilian excludes combatants and fighters who are hors de combat, and that the individual victims of such a crime must themselves be civilians (at paras. 461 and 463). A year later the Martić Appeals Chamber reached the opposite conclusion on the second point, overturning the trial chamber below and holding that “a person hors de combat may thus be the victim” of a crime against humanity, provided the killing formed part of a widespread or systematic attack on a civilian population (Prosecutor v Martić, IT-95-11-A, Appeals Judgment, 8 October 2008, at paras. 313 and 314). What never divided the chambers was the criminality of the killing itself, since even the narrower view recorded that these acts remain punishable as war crimes (Mrkšić, at para. 460). That line of cases is traced by Hines.
In operational terms, this floor is what makes the recognition standard more than good advice. Once recognition is owed, no lawful path remains: not necessity, not convenience, not the pressure of the moment. The criminal consequence removes any incentive to treat the standard as negotiable. How that standard fares under remote and autonomous engagement is the subject of the final section.
VI. Recognition under new conditions: drones and autonomous systems
The surrender category is under real operational pressure, and that pressure is not speculative. Since September 2022, Ukraine’s “I Want to Live” project has used hotlines and a chatbot to arrange the surrender of Russian soldiers, sending a quadcopter to meet the soldier at agreed coordinates and guide him to Ukrainian lines (Wallace, Reeves and Hart, at p. 81). The practice is newer in scale than in kind. An Iraqi soldier surrendered to a US Navy Pioneer remotely-piloted vehicle during the 1991 Gulf War, the first recorded case of its type (at p. 84).
Existing law absorbs this without amendment. The DoD Law of War Manual requires a surrender to be genuine, clear and unconditional, and made where it is feasible for the opposing party to accept it (§ 5.9.3). Feasibility asks whether taking custody is practical and safe, not whether prisoners would later burden the force; inconvenience is no ground for refusal (§ 5.9.3.3). Whether ground troops can surrender to aircraft has long been contested, and the strict view has cost lives. Apache pilots in Iraq killed two insurgents attempting to surrender, acting on advice that ground forces could not surrender to aircraft (Biggerstaff and Chiaramonte, under “The Feasibility of Surrendering to Drones”). Those authors defend the better view, that feasibility turns on the circumstances. On their account, a drone operator who guides a man in exercises much the control that a single foot soldier sent to bring him back would.
Timing matters more here than technology. A Russian soldier who has told a hotline that he intends to surrender, but who remains with his unit, is not hors de combat and stays a lawful target, since that expression is neither clear nor unconditional (Wallace, Reeves and Hart, at pp. 93 and 94). Protection attaches later, when he is identified at the rendezvous, drops his weapon and follows the drone. Section I supplies the governing test: whether a reasonable person could discern the offer in the circumstances (at p. 93).
The autonomous case is usually argued in a form that deserves scrutiny. Its objection runs that Autonomous Weapon Systems (AWS) may be unable to recognise or interpret signs of surrender reliably. My difficulty is with the structure of that claim rather than its conclusion. It names no system, rests on no trial, and cannot be tested, which quietly shifts the burden of disproof onto whoever fields the equipment. Wood presses the broader version. Critics say that AWS cannot reliably tell lawful targets from protected ones, and so cannot satisfy the principle of distinction. He answers that this misreads the principle and rests on an overly wide definition of AWS, holding these systems to a standard the law does not impose (at p. 52). Drone practice disposes of part of the surrender objection too. If a remote operator can confirm a surrender through a drone’s optics, then distance and sensor mediation are not what defeats recognition. What stays open is judgement rather than perception, and it stays open for systems as they stand rather than for all time.
In my view Article 41 does not wait on that question. Status under the treaty is dynamic and conditional. It arises when a man clearly expresses an intention to surrender, and it falls away if he commits a hostile act or tries to escape. Whatever executes an engagement must therefore be able to follow a status that can change after the weapon is launched. Where a system cannot meet the recognition standard in the circumstances of its use, deploying it there risks attacking someone who should be recognised as hors de combat, which Article 41(1) AP I already forbids. No new rule is needed to reach that result. What is needed is context-appropriate human judgement and control, in the GGE’s current formulation (Rolling text of 12 May 2025, Section II.5), a standard aimed at the human involvement an operation demands and not at what makes a person hors de combat. The ICRC puts the underlying point plainly: IHL protects anyone recognised as hors de combat, and “these rules apply regardless of the technology involved”. Umbrello and Wood land nearby from their own premises, arguing for meaningful human control over how a system reads enemy status. That is an argument for retained human command authority, not for prohibition.
Conclusion
Article 41 has held for half a century because it asks the right question. It does not ask a commander to be certain, and it does not judge him in hindsight. Instead it asks what a reasonable person would recognise in the circumstances as they stood. That single standard carries the whole accommodation between military necessity and humanity, and it carries it in both directions. Under genuine uncertainty it leaves the soldier room to fight, which is why a wounded man preparing to shoot may still be attacked. Once recognition is owed it leaves no room at all, which is why there is no necessity exception, why the prisoner who can be neither held nor evacuated must be released rather than disposed of, and why attacking a man known to be hors de combat is a grave breach.
That is also why the rule survives contact with new technology. Drones have changed how a surrender is offered and accepted. They have not changed what a reasonable person must recognise. The question a commander asks before fielding an autonomous system is the question the infantryman asks over a fallen enemy, only asked earlier and at a remove.
My next post takes the same boundary from the other side: the civilian who loses the protection of civilian status under Article 51(3) AP I by taking a direct part in hostilities. the fight.