Artificial intelligence (AI) is interacting in ever more complex ways with the sovereignty of states.
On the one hand, AI technologies are beginning to underpin key sectors and services, including national security, the economy, healthcare. Consequently – and unsurprisingly – states are seeking to protect AI capabilities and the data infrastructure they rely on. The UK, for instance, designated data centres as critical national infrastructure in 2024 and is planning to designate them as essential services. Such designations play an important role in domestic law – imposing, among others, obligations of risk mitigation and notification on operators of designated infrastructure. These designations may also play a role under international law. Considering AI tools and infrastructure as critical infrastructure or an essential service may affect the application of obligations deriving from state sovereignty.
On the other hand, the risks inherent to certain AI capabilities are becoming increasingly apparent. A looming concern is the possibility of unintentionally causing harm to the sovereignty of another state in the use of AI – without a desire to harm, knowledge or even capacity to reliably predict system behaviour. In a widely reported incident of July 2026, OpenAI agents compromised Hugging Face, a developer of computational tools. Since then, another incident involving OpenAI was revealed: a ‘swarm of rogue OpenAI agents hijacked a German website this spring and transformed it into a bulletin board for other AI agents.’ On 9 September, Anthropic reported a fourth incident involving an early version of Claude, after prior acknowledgment that the model had, during training, hacked three companies. And in late September, it was reported that an OpenAI agent had, without instructions or authorisation, in what OpenAI terms ‘misaligned model activity’, hacked an Australian government website. While these incidents have, so far, involved relationships between industry actors, or industry actors and governments, they might, in a not-too-distant future, engage the international relations between states. What if an AI model used by a state to defend itself against external threats autonomously, without the knowledge of the persons deploying it, mounts an operation that interferes with the sovereignty of another state? This again raises questions of international law, and in particular the existence, if any, of intent or other subjective elements in obligations protecting state sovereignty.
This post analyses these two nodes of the interaction between AI and sovereignty – (1) AI systems and infrastructure as critical infrastructure/ essential service and (2) the risk of unintended consequences in the use of AI – through the lens of the obligation of states to respect state sovereignty. As noted in the Tallinn Manual 2.0, a violation of sovereignty can be established under two bases: one, infringement upon a state’s territorial integrity, and two, interference with or usurpation of inherently governmental functions (Rule 4, para. 10). The post does not engage with the lingering debate over the customary existence of the obligation. It proceeds on the assumption that the obligation exists, and explores its elements as identified in the national positions of states on the application of international law to cyberspace. Other rules that bear on the two nodes of AI-sovereignty interaction discussed here, such as the prohibition of intervention, are only mentioned where relevant as comparators.
AI tools and infrastructure as critical infrastructure or essential services
The first question is whether the designation of certain AI systems or supporting infrastructure as critical infrastructure or an essential service matters for the application of the rule of sovereignty.
To begin with, there is no self-standing protection of critical infrastructure or essential services under international law (despite a number of calls for regulation to this effect). Critical infrastructure, a concept not authoritatively defined in international law, is specifically referenced in three of the UN Norms of Responsible State Behaviour in Cyberspace (f, g, h), but these norms are not binding (although they sometimes reference binding obligations).
That critical infrastructure and essential services are not protected through a specific rule does not imply that the labels – or the propositions they stand for – are without consequence. Thailand’s position, for instance, specifically singles out critical infrastructure in its analysis of sovereignty: ‘State cyber operations targeting another State’s critical infrastructure constitute a violation of sovereignty where they interfere with the State’s sovereign control over the critical infrastructure; cause harm or compromise essential functions of the critical infrastructure’ (para. 12). And Germany, in its position paper ‘On the Application of International Law in Cyberspace’, suggests that
‘[g]enerally, the fact that a piece of critical infrastructure (i.e. infrastructure which plays an indispensable role in ensuring the functioning of the State and its society) or a company of special public interest in the territory of a State has been affected may indicate that a State’s territorial sovereignty has been violated. However, this cannot in and of itself constitute a violation, inter alia because uniform international definitions of the terms do not yet exist’ (p. 4).
Under Germany’s view, the target of an operation – critical infrastructure – is a relevant factor in the application of the rule of sovereignty. At the same time, interference with critical infrastructure does not automatically entail a breach.
Designation of a tool/entity/object as critical infrastructure may matter in at least three ways:
First, under the limb of territorial sovereignty, it may matter in determining the nature of a cyber operation. Cuba (para. 2), Denmark (p. 449), Finland (p. 3), Ireland (para. 6), Sweden (p. 2), Switzerland (pp. 2-3) all accept that the ‘nature’ or ‘character’ of a cyber operation matter, and distinguish ‘nature’/ ‘character’ from ‘effects’/ ‘consequences’. The target of the operation could affect the determination of said operation’s nature or character. When an operation is launched against critical infrastructure or an essential service, states are more likely to consider it grave.
Second, again under the limb of territorial sovereignty, designation may matter in determining the operation’s foreseeable effects. Many positions, including those of Austria (p. 4), Canada (paras. 14-17), Costa Rica (paras. 20-21), Italy (p. 4) and Poland (p. 3), insist on the causation of particular types or thresholds of effects for a breach to occur. If the target of an operation is critical infrastructure/essential services, its likely effects may be more serious, and may therefore more easily satisfy a gravity threshold under the limb of ‘effects’.
Third, under the limb of interference with or usurpation of inherently governmental functions, designation may matter in determining whether the operation is indeed impacting an inherently governmental function. While there is no universally agreed definition of ‘inherently governmental functions’, Tallinn Manual 2.0 provides a list of examples: ‘changing or deleting data such that it interferes with the delivery of social services, the conduct of elections, the collection of taxes, the effective conduct of diplomacy, and the performance of key national defence activities. The Experts further agreed that it is irrelevant whether the inherently governmental function is performed by the State itself or has been privatised’ (Rule 4, para. 16). Not all critical infrastructure necessarily fulfils or facilitates an inherently governmental function, but it may be that the label – depending on how it is understood by a particular state – could make that link easier to establish.
Ultimately, the labels of ‘critical infrastructure’ and ‘essential services’ do not play a self-standing or determinative function under the obligation to respect sovereignty. Designation of particular AI models or infrastructure under these categories may at most serve as a shortcut to satisfying the tests of ‘nature’/‘character’, ‘effects’ and ‘inherently governmental function’ under the rule.
Unintended AI-enabled interferences
The second question at the intersection of AI and sovereignty concerns the relevance of intent. Can a breach of the obligation to respect state sovereignty be established when a state acts without intent vis-à-vis the harmful conduct and/or its consequences?
For instance, how are we to assess a situation where a state is training AI models to protect the security of its own governmental networks, the AI models escape their training environment, hack into law enforcement systems of another state and render these systems inoperable for a week? Or a situation where a state intentionally launches an operation against one state yet, in the AI-enabled execution, unintentionally causes harmful effects in another? Or where the intended effects are different to the ones actually caused?
This is not a question unique to AI. It is just as relevant to cyber-enabled law enforcement (for instance, where law enforcement officials unintentionally access data stored abroad), or any unintended territorial, maritime or aerial incursions (see, for instance, ILC report here). At the same time, the risk of unpredictable, unforeseen or unforeseeable conduct or effects is much greater with certain AI-enabled systems. Agentic AI systems present particular risks of misalignment between AI conduct and human intent and, ultimately, loss of control over system operation and effects. This highlights the importance of clarifying the role (if any) of subjective elements in distinct rules of international law.
While there is emerging scholarship on unintended engagements and harms under international humanitarian law obligations (here, here, here and here) and under the prohibition on the use of force (here, here and here), the question of unintended interferences with sovereignty has remained relatively invisible (with Schmitt, and Schmitt and Vihul as notable exceptions).
As a starting point, the law of state responsibility does not impose a self-standing element of intent (p. 34), nor does it contain a circumstance precluding wrongfulness of ‘accident’ or ‘mistake’. To determine the relevance of intent for breaching international law, the analysis transitions to an assessment of the elements of specific obligations. For the customary obligation to respect sovereignty, one therefore needs to analyse state practice and opinio iuris. In recent years, many states clarified their positions on the content of sovereignty as a self-standing customary rule of general application in their national or common positions on cyberspace. Yet very few states explicitly engaged with the presence (if any) of subjective elements within its scope. The most recently published national position – that of Slovenia – is an outlier in this regard. In the section on sovereignty, we read that:
‘Generally, a violation of sovereignty that results in physical damage or injury, temporary or permanent loss of functionality or an interference with or usurpation of inherently governmental functions of a state, with the intention to cause such harm is considered an internationally wrongful act, triggering the international responsibility of the State to which such cyber act is attributable.’ (p. 4, emphasis added).
While at first glance the use of the word ‘generally’ may suggest that the drafters left some leeway for operations departing from the elements listed to violate sovereignty, the structure and focus of the paragraph paint a different picture. It is more likely that the language of ‘generally’ is there to accommodate the potential operation of circumstances precluding wrongfulness. Therefore, the better view is that Slovenia sees intent as an element of the obligation. Iran’s position also seems to treat ‘intent’ as relevant: ‘[a]ny intentional use of cyber-force […] constitutes a violation of the sovereignty of the state’ (para. 3).
In contrast, the 2024 national position of Czechia, in its section on the prohibition of intervention, distinguishes the two rules, as follows:
‘[t]he difference between actions that violate sovereignty and actions that violate the prohibition of intervention is that the latter is coercive, i.e., intentionally aims to influence the State’s free will and choice’ (para. 11, emphasis in original text).
Other national and common positions have not taken a clear stance on the nexus between intent and sovereignty. One particular methodological difficulty lies in determining whether the absence of explicit treatment of this question indicates the acceptance of an objective standard for breach (i.e. no need for any subjective elements) or simply lack of engagement with this issue. Many reasons can explain a lack of engagement, most notably that the focus of sovereignty discussions has so far been on the test of interference (unauthorised access, effects, nature/character).
In some instances, a comparison between the language used under the ‘sovereignty’ and ‘non-intervention’ sections of national positions may suggest the implicit endorsement of an objective test. For instance, the Common Position of the African Union affirms that:
‘by virtue of territorial sovereignty, any unauthorized access by a State into the ICT infrastructure located on the territory of a foreign State is unlawful. […] that cyber operations that are attributable to a State against ICT infrastructure located on the territory of a foreign State that causes effects, such as loss or impairment of functionality, on the territory of a third State, may constitute a breach of the territorial sovereignty of that latter State.’ (para. 16).
The language does not specifically indicate any subjective elements. Thirteen paragraphs below, in the section on the prohibition of intervention, the Common Position explains that it ‘applies to the use of any instrument, including armed, political, economic, or any other means, and instruments of information, that may be used by a State for the purposes of intervening in the internal or external affairs of a foreign State.’ (para. 29, emphasis added). Similarly, Norway’s position does not speak of subjective elements under sovereignty, yet provides examples using the language of intent under non-intervention: ‘with the intent of altering election results’, ‘deliberately causing a temporary shutdown of the target State’s critical infrastructure’ (p. 479, emphasis added), and the position of The Netherlands defines prohibited intervention as ‘interference in the internal or external affairs of another state with a view to employing coercion against that state’ (p. 3, emphasis added). We see similar indications of an intent element in non-intervention and absence of subjective elements under sovereignty in the positions of Austria (p. 5), Canada (para. 22), Denmark (p. 450), Estonia (p. 25), Germany (p. 5), New Zealand (para. 9(b)), Poland (p. 4), Romania (p. 77), Switzerland (p. 87). Clearly, questions of intent were on the minds of the drafters. That they chose not to incorporate such elements under the rule of sovereignty may be legally relevant, but not necessarily so – they may have simply left the question open.
Three states – Australia, Costa Rica and Thailand – affirm that, in their view, intent is not required under non-intervention (Australia: ‘[c]oercive means are those that effectively deprive or are intended to deprive the State of the ability to control, decide upon or govern matters of an inherently sovereign nature’; Costa Rica: ‘it suffices that a State intends to coerce another State, employs coercive methods, or eventually causes coercive effects in another State’, para. 24; Thailand: ‘[c]oercion may arise where a cyber operation undermines a State’s sovereign functions or impairs its ability to exercise its reserved domain (domaine réservé) freely, even without an explicit demand, demonstrable motive, or intention to compel’, para. 18). It could be argued that it is unlikely, given the relationship between the rules of sovereignty and non-intervention, that these states would require intent under sovereignty and not require it under non-intervention.
What is clear is that most national and common positions choose to focus their analysis under sovereignty on the nature or impact of operations, not on subjective elements: African Union Common Position (para. 16), European Union Common Position (p. 4), Belgium (p. 3), Brazil (p. 18), Canada (paras. 10-21), China (p. 2), Cuba (para. 2), Denmark (p. 449), Finland (p. 2), France (pp. 6-7), Germany (pp. 3-4), Ireland (para. 6), Italy (p. 4), Japan (p. 3), New Zealand (para. 14), The Netherlands (pp. 1-3), Poland (p. 3), Romania (p. 76), Sweden (p. 2), Switzerland (p. 3). While the general language on sovereignty adopted by Austria does not address intent, its example of a sovereignty violation reads, in relevant part, ‘State A initiates a cyber espionage activity against the Foreign Ministry of state B for the purpose of obtaining illegal access to the internal communication and information system’ (pp. 4 – 5). This does not, however, clearly establish insistence on intent as an essential element of the rule.
Other positions contain even fewer hooks for analysis. Some positions dispute the existence of a rule of sovereignty (United Kingdom), others do not explore sovereignty as a self-standing rule (Australia, Pakistan), yet others discuss sovereignty, but not in a way that gives any indicia for the analysis of subjective elements (Colombia, Estonia, Israel, Kazakhstan, Kenya, Republic of Korea, Russian Federation, Singapore, United States).
Overall, the relevance of intent or other subjective elements under the obligation to respect sovereignty is an issue of increasing relevance that is yet to receive detailed examination in the positions of states and international organisations. Further inputs from states could assist in determining whether intent is a self-standing element that must be present for a violation to be established, whether it is relevant to the analysis under the ‘nature’/ ‘character’ of an operation, or whether it is irrelevant under the rule of sovereignty.
As states are beginning to grapple with this question, considerations of desirability are likely to become prominent. For instance, Schmitt highlights the risk of victim states having to shoulder the cost of a mistake of fact, especially in light of new autonomous capabilities, suggesting that ‘[a]fter all, the less control a State exercises over the conduct of an operation, the more logical it is that the State bears the risk of its mistake and the less appropriate it is that victim States should be left less than whole’ (p. 566). It bears emphasis that even if the obligation to respect sovereignty were to contain an element of intent, there are other rules of international law that could potentially transfer the cost back to the deployers of the AI-enabled system. For instance, as suggested by Dias and Coco, the customary no-harm rule extends beyond environmental harm to cover any extraterritorial harm. If the state does not compensate for the harm, its responsibility will be entailed.
Conclusion
We are finding ourselves at a difficult juncture, as AI is becoming both essential to the protection of state sovereignty and a major threat thereto. AI and sovereignty intersect in interesting, complex, and important ways. Recent research works, such as Kurosaki’s ‘The AI Sovereignty Paradox’ and Toma’s ‘Algorithmic Foreign Influence: Rethinking Sovereignty in the Age of AI’, are beginning to unpack these intersections. This post continues this research trajectory by highlighting two discrete questions under one specific rule of international law: (1) the relevance of the labels ‘critical infrastructure’/ ‘essential services’, and (2) the relevance of intent under the obligation to respect state sovereignty. As these are questions of both fundamental and growing importance to states and those living under the shield of their sovereignty, they deserve careful attention by states and other relevant stakeholders.