Legal frameworks for defence AI AI in the defence industry: what companies need to consider legally

The rapid development and integration of artificial intelligence (AI) into security-related technologies pose new challenges for the defence industry. For companies developing, distributing, or using AI systems in a military context, the key question is under which circumstances the specific requirements of the European AI Act apply – and when they do not.

With the adoption of the Artificial Intelligence Act (AI Act), the European Union has created a comprehensive legal framework to regulate the use of AI systems – especially in (high-)risk or sensitive areas of application. For companies involved in defence-related business, this means that the AI Act applies only if the AI system is not used exclusively for military or security purposes. However, as soon as an AI system is (also) used for civilian or mixed purposes – for example, in the context of dual-use concepts or internal applications (e.g. in HR) – the AI Act applies and entails extensive obligations.

Exclusive military use

The AI Act does not apply to AI systems that are used exclusively for military, defence or national security purposes. This is explicitly stated in Article 2 (3) sentence 2 of the AI Act, which formulates a clear exception, regardless of whether the AI system is operated by public or private entities.

The exception is derived from Article 4 (2) of the Treaty on European Union (TEU), which defines national security as the exclusive responsibility of Member States. In addition, the regulation refers to the EU’s common defence policy, as regulated in Article 42 TEU, which grants Member States extensive autonomy in organising their military capabilities.

The purpose of the exception is to safeguard the defence capabilities and security interests of EU Member States. In situations of military conflict, defence against hybrid threats or in the context of intelligence activities, the requirements of the AI Act – such as transparency obligations or documentation requirements – are often impractical and could undermine security-related needs.

Mixed or civilian purposes (“dual use”)

However, the preceding exception only applies if the AI system is designed solely for military purposes. As soon as an AI system is used for civilian, humanitarian, or law enforcement purposes, it is subject to the AI Act. This is particularly true for so-called dual-use systems, which serve both military and civilian purposes.

Legal assessment depends on the objective purpose of the AI system. A merely potential military use is not sufficient. The key question is whether the system is demonstrably and exclusively designed, adapted and used for military purposes. Section 104 of the German Act against Restraint of Competition (“GWB”), which defines military purposes in the context of defence procurement, provides guidance in this regard.

Recital 24 of the AI Act is also particularly relevant: If an AI system originally designed for military use is temporarily or permanently used for other purposes, such as law enforcement or civil applications, the AI Act's obligations must be met (in this regard). At the same time, however, the AI Act makes clear that military users must not be restricted by the provisions of the law. Even if an AI system is in principle covered by the AI Act, military authorities must not be restricted in their activities - for example, by official supervision or disclosure requirements. The implementation of regulatory obligations in this case is therefore not entirely straightforward, which is why each case must be examined on its own merits.

AI systems for internal use

In addition to operational use in security-related areas, many companies in the defence industry also implement AI systems for internal purposes, such as in human resources (HR). In such cases, the provisions of the AI Act apply without restriction, as the purpose is not exclusively military but relates to standard internal corporate applications. As long as AI systems are used internally in this way, there are no special legal considerations from the perspective of the AI Act.

Clear legal assessment required

The AI Act has far-reaching implications for the defence industry. While purely military applications are exempt from the regulation, mixed or internal AI systems are subject to the extensive requirements of the law. A thorough legal review is therefore required, especially in dual-use constellations or (temporary) changes of purpose.

Dr Oliver Hornung and Franziska Ladiges are partners with SKW Schwarz in Frankfurt, focused on IT & digital business, including IT- and AI-related advice in the defence industry.