UNIDIR: Companies, Not States, Make Key Design Choices in Military AI

Where decisions are made

According to UNIDIR, long before an AI-enabled system reaches the battlefield, someone decides what data it learns from, how it is tested and how much it is allowed to decide on its own. That someone is "usually not a State but an engineer at a company", the commentary says. These design choices influence whether a system is reliable, predictable and lawful, and they are made years before any commander uses it.

The Institute says industry's role covers the whole system life cycle, from design and testing to post-deployment maintenance and decommissioning. Developers, integrators and providers decide how to source and handle data, how to simulate operational conditions and where to set the degree of autonomy through decision thresholds.

UNIDIR also points to the speed of development. Companies tend to move faster than States can regulate them. New firms are entering the market, while established defence companies form partnerships, acquire AI start-ups and expand AI use in their products. Newer entrants and established firms may differ in institutional experience and in the internal structures they have built for compliance and accountability. Industry involvement can range from direct procurement and subcontracting networks to third-party testing.

The commentary appeared in the context of Disarmament Week. It notes that in September 2026 the Group of Governmental Experts on lethal autonomous weapon systems in Geneva agreed on a set of elements for a future instrument on these weapons.

Making military AI lawful by design

UNIDIR describes the aim of making systems "lawful by design". This means integrating legal requirements as core design parameters from the earliest stages of development and sustaining compliance across the life cycle. The Institute stresses that this approach cannot displace the responsibility of States.

For companies, the commentary cites a responsibility to respect human rights that exists over and above legal compliance, as set out in the UN Guiding Principles on Business and Human Rights. Firms can integrate legal assessments into risk management frameworks and factor international humanitarian law into design and testing.

States remain bound by international humanitarian law and international human rights law. As customers, they need assurance that the capabilities they buy allow them to meet these obligations. According to UNIDIR, they can embed responsible AI principles into procurement and export control, set clear expectations for suppliers and invest in the capacity to apply them. This includes legal reviews of new weapons under Article 36 of Additional Protocol I, which may need to be repeated given the evolving nature of AI systems.

Multi-stakeholder consultations convened by UNIDIR point to a shared view among States and industry that legal and ethical requirements must be translated into technical ones, and that a clear distribution of roles and responsibilities is essential for effective public-private partnerships.

A shared baseline and why States care

UNIDIR proposes a framework that gathers multi-stakeholder views on responsibility and ethics and turns them into clear guidance on accountability and compliance. Industry must be included, it argues, for four reasons: practical experience of what is technically possible, realistic and actionable outcomes, technical expertise States may lack, and greater buy-in for proposed solutions. Experts, academia, civil society and the humanitarian sector should also be consulted to keep the effort credible. The commentary notes that UN Secretary-General António Guterres regularly emphasizes involving a range of stakeholders, including industry.

The Institute also argues that States have their own stake. Swiss Federal Councillor Albert Rösti has called for companies to set their own guidelines and standards for trustworthy AI, alongside voluntary commitments, even before international agreements or global regulation materialize.

Legal responsibility, however, falls on the State that uses a system, not on whoever developed it. UNIDIR cites the "black box" nature of many AI systems as an example: obscure system logs may complicate States' obligation to conduct effective investigations of alleged violations of international humanitarian law. Governments therefore need to be clear about the questions they expect industry partners to answer, and to define roles and compliance responsibility within and beyond contracts. This, according to UNIDIR, gives States access to the information and documentation they need and more confidence in technical reliability.

What it means

The commentary frames military AI governance as a shared task between States and companies. For suppliers, it signals growing expectations on documentation, compliance structures and human rights due diligence. For governments, it points to procurement and contract design as practical tools for meeting legal obligations. UNIDIR positions itself as a convener that can help industry, States and other stakeholders turn these expectations into guidance.