Autonomous cyber-weapons: Out of eleven operations attributed to States, none fall within a framework of responsibility

The DSA, the AI Act or the Online Safety Act regulate digital damage on platforms, but not autonomous cyber weapons launched by states against civilian infrastructure. A study proposes a framework for filling this gap.

Governments have begun to regulate harmful AI-generated content on commercial platforms, with the Digital Services Act, the European AI Act and the British Online Safety Act. However, the most serious category remains beyond any framework: autonomous cyberweapons deployed by states against civilian infrastructure.

Taxonomy, threshold of human control and state responsibility

The study proposes a taxonomy that crosses six modes of action of these weapons and five categories of damage, a model of "meaningful human control" that sets a threshold for compliance with international humanitarian law, and a liability architecture accompanied by a draft treaty text. This is based on the articles of the International Law Commission on the Responsibility of States for Internationally Wrongful Acts (ARSIWA), rather than on the individual criminal responsibility of the Rome Statute.

Applied to eleven documented operations attributed to states, as well as to a hypothetical defensive system, the framework places each real case in a vacuum of responsibility. The threshold depends on the target: against entirely civilian targets, none of the systems studied crosses it, not even the hypothetical. Three other incidents are ruled out due to a lack of sufficient autonomy or attribution. The authors specify that the weightings used are illustrative and not calibrated on data.