On 4 September 2026, the Group of Governmental Experts (GGE) on Emerging Technologies in the Area of Lethal Autonomous Weapons Systems adopted the report of its sessions from 2024 to 2026 (CCW/GGE.1/2026/3). The report represents a significant diplomatic breakthrough: it formulates, by consensus, ‘a set of elements of an instrument’ to address the normative and operational aspects of lethal autonomous weapon systems.
Paragraph 25 of the report characterizes a lethal autonomous weapon system as ‘a combination of one or more weapons and technological components operating together, that is capable of identifying, selecting, and engaging a target in a way that results in loss of life, without intervention by a human being operating the system’. This post suggests that the formula is a mixed success. Despite describing autonomous weapon systems in detail, it leaves key questions unresolved. These are likely to resurface in any future negotiations.
‘A combination … operating together’
The phrase ‘a combination of one or more weapons and technological components operating together’ is new. Earlier drafts circulated by the Chair spoke of an ‘integrated combination’ and of ‘functionally integrated technological components’. The language of functional integration suggested that technological elements formed part of an autonomous weapon system only if they were necessary to the operation of its weapon component. This matters, because various assets may contribute to the functioning of a weapon without being necessary for its operation. A military weather station may supply a missile battery with meteorological data, for example, but the battery can fire a missile without this input. The requirement of functional integration thus ensured that components would fall within the characterization only if they were meaningfully linked to a weapon (CCW/GGE.1/2025/WP.9, para 15).
The Chair of the GGE suggested that ‘a combination … operating together’ does not differ substantially from the old language, since the new formula ‘ultimately conveys the same meaning while avinternational humanitarian law, AI autonomous weapons systems, autonomous weapons, IHL, Lethal Autooiding terminology that may be understood differently by different delegations’ (second meeting of 31 August, 47:01). This is open to question. Functional integration does not happen in a weapon system by accident. Components that enable a weapon to function, such as a launcher necessary for firing a missile, are normally designed for that purpose. By contrast, technological elements could operate together with a weapon in a much looser combination to identify, select and engage a target. In a networked system of sensors, deciders and effectors, data captured by one sensor may be processed by an analytical engine whose output serves as an input for a weapon. Which node captures the data that identifies a candidate target, which one validates it and which one executes the engagement may change with the circumstances. Under the GGE’s characterization, what specific combination qualifies as an autonomous weapon system is therefore not static and cannot necessarily be determined in advance.
The fact that the characterization turns on ‘capability’ broadens its scope significantly. Read literally, individual components of a network of sensors and deciders may fall within the characterization simply because they are capable of contributing to target identification, selection and engagement. This wide approach is not necessarily a flaw, but its implications may be significant. Assets that are neither weapons, nor means of warfare in themselves may have to be treated as components of a weapon system purely because they may feed into a targeting cycle that includes an autonomous weapon. If so, they could be considered subject to a mandatory review under Article 36 of Additional Protocol I. Whether this was intended is not clear.
Identifying, selecting and engaging
The GGE characterized autonomous weapon systems with reference to three critical functions: identifying, selecting and engaging a target. The wisdom of this triad is debatable. Some delegations regarded target identification as a distinct phase of the targeting cycle (WP.2, para 12), but it is more accurate to treat it as a precondition and component of target selection (WP.9, paras 10 and 11). In any case, because the GGE has decided to join the three functions with an ‘and’, so that they must be met cumulatively, the separate mention of identification merely makes explicit a function that is already implicit in the process of target selection.
The more consequential point is that neither identification, nor selection constitutes a single decision-point in the targeting cycle. Both form part of a multistage process whereby a pool of candidate targets is gradually narrowed down through the repeated application of operational, legal and policy criteria. Many armed forces seek to automate different elements of this process, but it is unlikely that they will automate the entire cycle any time soon. The technology is not ripe for this, nor would complete automation be desirable. It is difficult to see senior commanders delegating the formulation of targeting guidance to a computer, for instance. For the foreseeable future, the automation of target identification and selection will be partial: humans will continue to perform some steps, while others are delegated to machines. A characterization of autonomous weapon systems therefore cannot simply declare identification and selection to be critical functions, but must also explain at what degree of autonomy a machine must perform them to qualify. Paragraph 25 attempts to answer this question in two ways. First, paragraph 25(a) identifies two specific forms of human involvement that affect a system’s characterization. Second, paragraph 25 imposes a general requirement that an autonomous weapon system must perform the triad of functions ‘without intervention by a human being operating the system’.
Specific forms of human involvement
The first sentence of paragraph 25(a) declares that the ‘fact that a human being programs or otherwise determines a set of potential targets or characteristics thereof’ does not remove a system from the characterization. Even with highly autonomous systems, human operators may be expected to decide what class of targets should be attacked and to define the parameters that identify members of such a class. No system would qualify if this kind of human input excluded it from the characterization. The first sentence of paragraph 25(a) is meant to avoid such an overly narrow approach.
The second sentence of paragraph 25(a) approaches the question from the other end. A system is not included in the characterization ‘when the personnel planning, deciding upon, or carrying out the attack determine the specific target or specific group of targets and the timing of the attack’. Where human operators direct a weapon against a specific object or person, they have preselected the target and leave no target selection task to the system. ‘Specific target or specific group of targets’ in this context does not refer to a category or class of targets, but to a unique object, person or group selected for engagement. The second sentence makes clear that preselection excludes a system, unless human operators allow the system to decide the timing of the attack.
The Chair noted that the concern over timing arose in relation to ‘systems that remain dormant for an extended period of time while targets have been set previously’ (second meeting of 31 August, 47:01). An earlier version of the text referred to ‘the moment of engagement’, but several delegations objected that the precise moment of an attack often cannot be determined in advance (second meeting of 31 August, 1:42:28, 1:48:02 and 2:37:19). The United States proposed the ‘timing of the attack’ formula to reflect that ‘it may not be possible to identify with precision the exact moment of the attack’ (second meeting of 31 August, 2:30:16). This suggests that the time element refers to a timeframe determined in advance, rather than to a specific point in time. The Chair’s reference to dormant systems further suggests that this timeframe may include periods in which a system actively searches for the predetermined target it has been tasked to prosecute. However, where exactly the boundary lies between actively seeking the target and lying dormant is not clear.
‘Without intervention’
Paragraph 25 also requires, in general terms, that a system perform the three critical functions ‘without intervention by a human being operating the system’. Since the first sentence of paragraph 25(a) provides that determining a set of potential targets or their characteristics does not exclude a system, the requirement of no human intervention must apply to other target identification, selection or engagement activities. It is not obvious what those are.
On one approach, any activities beyond programming the category of targets to be attacked, including target development, validation and prioritization, would amount to human involvement that precludes a system from qualifying. On another reading, a target remains a ‘potential target’ within the meaning of the first sentence of paragraph 25(a) until it has been formally approved for engagement, meaning that human input into target development and validation would not prevent a system from qualifying, though the prioritization of approved targets by human operators would exclude it. Which of these readings was intended remains unclear.
Loss of life
The characterization requires autonomous weapon systems to be capable of identifying, selecting and engaging a target ‘in a way that results in loss of life’. As the Chair pointed out, the characterization ‘does not turn on the purpose for which a system was designed or on its primary function’ (ninth meeting of 4 September, 2:56:54), but on whether a system is capable of performing the triad in a way that results in loss of life. Paragraph 25(b) makes this point expressly by declaring that the fact that a lethal autonomous weapon system ‘can be used in a way that does not result in loss of life, such as to damage or destroy objects or to cause injury, does not exclude it from this characterization’.
Still, the system must be capable of causing death, not mere injury. Systems that affect objects without normally harming humans, such as weapons that disrupt electronics or dazzle sensors, seem to fall outside the characterization. Whether systems expected to cause injury, but not necessarily death, are also excluded depends on how paragraph 25 is read: they are excluded if loss of life must at least reasonably be expected, but included if the mere possibility of death is considered sufficient.
Broad and narrow readings
Because key aspects of paragraph 25 are unsettled, the text admits two competing readings.
On a narrow reading, the characterization reaches only lethal weapon systems that find and engage targets no human operator has singled out in advance. A combination caught by the characterization consists of a weapon and any components designed to work with it, meaning that sensors or analytical components that merely feed a targeting network do not become part of the system. A combination is classified by the way it is used in an attack: a system directed against a predetermined target chosen by human operators falls outside the characterization even if it is otherwise capable of selecting targets autonomously. The personnel determine the timing of the attack when they set the period within which a system may strike a predetermined target, so a system waiting within that period for its target to appear is excluded. Any human input beyond setting the category of targets under the first sentence of paragraph 25(a), including input into developing, validating or prioritizing targets, removes a system from the characterization. A system qualifies only if its use must reasonably be expected to result in loss of life.
On a broad reading, the characterization reaches any system capable of engaging a target autonomously, unless the personnel have fixed both the specific target and the moment of attack or have themselves prioritized the targets approved for engagement. Any sensors, processors and effectors capable of performing the three functions together form a combination, whether or not they were designed or intended to function together. A system is classified by its autonomous capabilities, so a weapon capable of selecting its own target is included even when it is deployed at lesser levels of autonomy against a predetermined target. The personnel determine the timing of the attack only when they fix a period short enough to leave the system no real choice. Human input into developing and validating targets leaves a system in, because a target remains a ‘potential’ target until it is approved for engagement. Human operators who nominate several individually identified targets for attack determine a set of potential targets under the first sentence of paragraph 25(a), rather than the specific target or specific group of targets under the second, since the system will have to prioritize, and thus select, among them. The mere possibility of causing death is enough.
Certain systems are characterized differently depending on which reading is adopted. A SPICE-250 guided munition released against the target assigned by an operator is excluded on the narrow reading, but included on the broad reading if it can engage a secondary target autonomously when it cannot find the one assigned. Loitering munitions raise the same question for timing. A Harpy launched against a single radar whose position is known, and left to strike when that radar emits, is excluded on the narrow reading, because the personnel have determined the target and the period of the attack, but included on the broad reading, since it decides when to strike. Human involvement in target selection divides in the same way. Norway gave the example of a system tasked against ‘enemy combatants A, B, and C, who are located in different parts of the battlefield’, which in its view falls under the first sentence of paragraph 25(a) (third meeting of 1 September, 9:29). A system left to decide in which order to attack such individually identified targets is included on the broad reading, but excluded on the narrow one, because the personnel have determined each target and the system merely prioritizes among them.
Conclusion
Paragraph 25 settles several important questions. It describes lethal autonomous weapon systems by the functions they can perform and treats them as combinations of weapons and technological components, rather than as single platforms. It makes clear that human operators who set the category of targets to be attacked do not thereby take a system out of the characterization. It also ties the class to the capability to cause loss of life, rather than to the purpose for which a system was designed. For a text adopted by consensus among States whose positions remain far apart, this is a considerable result.
What paragraph 25 leaves open is the exact division of labour between humans and machines. Target identification and selection form part of a multistage process and the text does not say clearly how much of that process must be left to a system before it qualifies. Most of the questions left unsettled, among them the timing of the attack and the forms of human involvement that take a system out, bear on this point.
The Chair’s interpretive statements do not close the gap. His understandings of 31 August and 4 September on the meaning of ‘operating together’, ‘is capable of’ and ‘specific group of targets’ are not part of the report. They survive in the webcast of the meetings and their weight as a guide to the meaning of paragraph 25 is uncertain. The differences the text accommodates are therefore likely to resurface once States negotiate an instrument, since the scope of the characterization will then determine which of their systems any commitments reach.