The legal-framework explorer

Eight layers, one lifecycle

Rows are bodies of law and regulation; columns are the life of a system, from design to remedy. Each filled cell answers five questions: who owes the duty, what triggers it, what evidence it needs, what consequence follows, and where the gap is. The point of the matrix is a distinction the debate keeps collapsing: state responsibility, individual criminal responsibility, corporate liability and contractual responsibility are different things, on different triggers, with different evidence — and they can all apply to the same strike.

Legal and regulatory layers against system lifecycle stages. Select a filled cell to see its duties, triggers, evidence, consequences and gaps.
Layer ↓ · Stage →	Design	Procurement	Legal review	Deployment	Material update	Incident	Remedy
International humanitarian law		·	·		·
Article 36 weapons review		·		·			·
Arms-export licensing & end-use control	·		·				·
International criminal law	·	·	·		·
UK domestic criminal & corporate law	·		·	·	·
Procurement & contract			·
Responsible business & human-rights due diligence			·		·	·
Independent, parliamentary & judicial scrutiny	·			·	·

▢ = a duty engages at this stage · dot = not typically engaged. The selection is kept in the page address, so a shared link reopens it.

Full reference, layer by layer

International humanitarian law

Current law

A statement of law presently in force, as the editors understand it.

Governs the conduct of hostilities: distinction, proportionality and precautions in attack. The duties belong to states, commanders and combatants — an algorithm cannot discharge the legal judgment owed by humans and institutions.

International humanitarian law · Design

Who owes the duty?: States must not field weapons that are indiscriminate by nature or cause superfluous injury.
What triggers it?: A weapon, means or method of warfare is developed or adopted.
What evidence is needed?: Design characteristics; foreseeable effects in intended circumstances of use.
What consequence or remedy is available?: An unlawful weapon may not be fielded at all.
Where is the gap or uncertainty?: Decision-support software is rarely analysed as a 'means or method' at design time.

International humanitarian law · Deployment

Who owes the duty?: Attackers must distinguish, assess proportionality and take feasible precautions.
What triggers it?: Every attack.
What evidence is needed?: The information available at the time, including what the system displayed and withheld.
What consequence or remedy is available?: Unlawful attacks engage state responsibility and potentially individual liability.
Where is the gap or uncertainty?: Whether 'feasible precautions' includes interrogating a machine recommendation is asserted policy, not tested practice.

International humanitarian law · Incident

Who owes the duty?: States must investigate alleged grave breaches.
What triggers it?: A credible allegation of serious violation.
What evidence is needed?: Operational records — including system logs the state may never have required.
What consequence or remedy is available?: Prosecution, discipline, systemic correction.
Where is the gap or uncertainty?: The duty to investigate does not itself create the technical evidence investigation needs.

International humanitarian law · Remedy

Who owes the duty?: States responsible for violations owe reparation.
What triggers it?: An internationally wrongful act attributable to the state.
What evidence is needed?: Attribution and causation — reconstructed from the same fragile records.
What consequence or remedy is available?: Compensation, satisfaction, guarantees of non-repetition.
Where is the gap or uncertainty?: No standing route delivers individual victims a remedy when reconstruction fails.

SOURCES [5] ICRC position on autonomous weapon systems, International Committee of the Red Cross [2] Ambitious, Safe, Responsible: our approach to the delivery of AI-enabled capability in Defence, UK Ministry of Defence

Article 36 weapons review

Current law

A statement of law presently in force, as the editors understand it.

Additional Protocol I obliges states to determine whether new weapons, means or methods of warfare could be used lawfully. The UK conducts these reviews. The unresolved question is the review object: what exactly is approved when the software changes after approval?

Article 36 weapons review · Design

Who owes the duty?: The state must review during study and development, not only at purchase.
What triggers it?: Study, development or adoption of a new weapon, means or method.
What evidence is needed?: Technical characteristics, intended circumstances of use, foreseeable effects.
What consequence or remedy is available?: Development redirected or constrained before investment hardens.
Where is the gap or uncertainty?: Decision-support tools are often not treated as reviewable 'methods' at all.

Article 36 weapons review · Legal review

Who owes the duty?: A competent review must assess lawful usability before fielding.
What triggers it?: Adoption of the weapon or method.
What evidence is needed?: Test results, reliability data, the defined operating envelope.
What consequence or remedy is available?: Approval, conditions, or rejection.
Where is the gap or uncertainty?: The review describes a version and an envelope; neither is stable for ML systems.

Article 36 weapons review · Material update

Who owes the duty?: UK policy accepts updated systems may need iterative re-review.
What triggers it?: A material change in behaviour — currently undefined in public standards.
What evidence is needed?: Change logs, regression tests, version identifiers.
What consequence or remedy is available?: Renewed review; in principle, withdrawal of approval.
Where is the gap or uncertainty?: No published threshold defines 'material'; no external body checks whether re-review happened.

Article 36 weapons review · Incident

Who owes the duty?: Review assumptions should be revisited when performance diverges.
What triggers it?: An incident inconsistent with the reviewed behaviour.
What evidence is needed?: Comparison of deployed behaviour against the reviewed baseline.
What consequence or remedy is available?: Suspension of use; revised conditions.
Where is the gap or uncertainty?: Nothing obliges the comparison; the reviewed baseline may not be retrievable.

SOURCES [1] Additional Protocol I to the Geneva Conventions, Article 36 (new weapons), ICRC treaty database [2] Ambitious, Safe, Responsible: our approach to the delivery of AI-enabled capability in Defence, UK Ministry of Defence [4] Government response to the House of Lords AI in Weapon Systems Committee report, UK Government

Arms-export licensing & end-use control

Current law

A statement of law presently in force, as the editors understand it.

The Export Control Act 2002 and the Strategic Export Licensing Criteria govern transfers of military goods and technology. Licences can be refused, suspended or revoked where risk thresholds are met — distinct measures that should not be merged. UK practice includes suspension of specific licences on IHL-risk grounds (September 2024, pending source check).

Arms-export licensing & end-use control · Procurement

Who owes the duty?: Exporters must obtain licences; government must assess against the criteria.
What triggers it?: Export or transfer of controlled goods, software or technology.
What evidence is needed?: End-user and end-use information; risk assessment against the criteria.
What consequence or remedy is available?: Refusal of a licence prevents the transfer.
Where is the gap or uncertainty?: Software and model weights travel poorly within categories built for goods.

Arms-export licensing & end-use control · Deployment

Who owes the duty?: Government monitors whether the clear-risk assessment remains sound.
What triggers it?: Changed circumstances in the destination.
What evidence is needed?: Reporting on end-use; credible allegations of violations.
What consequence or remedy is available?: Suspension or revocation of extant licences.
Where is the gap or uncertainty?: There is no systematic post-shipment verification of how software is actually used.

Arms-export licensing & end-use control · Material update

Who owes the duty?: Ongoing support and updates may themselves be licensable transfers.
What triggers it?: Provision of technology or technical assistance.
What evidence is needed?: What updates and support continue to flow after licensing.
What consequence or remedy is available?: Conditions on, or refusal of, continuing transfers.
Where is the gap or uncertainty?: Licensing rarely tracks continuous software support as a distinct, reviewable stream.

Arms-export licensing & end-use control · Incident

Who owes the duty?: Reassessment where a clear risk emerges that items might be used in serious violations.
What triggers it?: Credible evidence bearing on the risk threshold.
What evidence is needed?: Incident reporting; the state's own assessment record.
What consequence or remedy is available?: Suspension or revocation of specific licences.
Where is the gap or uncertainty?: The lever acts on future transfers; it cannot recall software already delivered.

SOURCES [9] Export Control Act 2002, UK Parliament (legislation.gov.uk)[10] Strategic Export Licensing Criteria (written ministerial statement), UK Parliament / Department for International Trade [11] UK suspension of certain arms export licences to Israel following an IHL clear-risk assessment, UK Government (Foreign, Commonwealth & Development Office)

International criminal law

Current law

A statement of law presently in force, as the editors understand it.

War crimes engage individual liability through defined modes — committing, ordering, aiding and abetting — and command responsibility. The ICC's jurisdiction is over natural persons; it does not have general jurisdiction over corporations. Corporate exposure runs through people and through national law.

International criminal law · Deployment

Who owes the duty?: Individuals must not commit, order or knowingly assist war crimes.
What triggers it?: Conduct satisfying the elements of an offence, including the mental element.
What evidence is needed?: What specific people knew, decided and contributed.
What consequence or remedy is available?: Prosecution of natural persons, internationally or nationally.
Where is the gap or uncertainty?: Distributed, machine-mediated decisions strain doctrines built for identifiable human conduct.

International criminal law · Incident

Who owes the duty?: Commanders must prevent and punish subordinates' crimes they knew or should have known of.
What triggers it?: Effective command and the requisite knowledge.
What evidence is needed?: Reporting chains; what the commander was told and could see.
What consequence or remedy is available?: Command responsibility for failures to act.
Where is the gap or uncertainty?: What a commander 'should have known' about model behaviour is untested ground.

International criminal law · Remedy

Who owes the duty?: Convictions can ground reparations orders in some fora.
What triggers it?: A completed prosecution.
What evidence is needed?: The full evidential chain, years later.
What consequence or remedy is available?: Punishment; limited victim reparation.
Where is the gap or uncertainty?: Rare, slow, person-by-person — a backstop, not an architecture.

SOURCES [6] Rome Statute of the International Criminal Court, Articles 25 and 28, International Criminal Court [7] International Criminal Court Act 2001, UK Parliament (legislation.gov.uk)

UK domestic criminal & corporate law

Current law

A statement of law presently in force, as the editors understand it.

The International Criminal Court Act 2001 brings ICC offences into UK law for individuals. Corporate criminal liability depends on attribution rules and offence design; there is no verified general UK corporate war-crimes offence. Failure-to-prevent models (Bribery Act s 7) show a workable corporate structure — for bribery, not yet for this field.

UK domestic criminal & corporate law · Procurement

Who owes the duty?: Ordinary offences — fraud, misrepresentation — apply to claims made to secure contracts.
What triggers it?: False or misleading representations about a system's capabilities.
What evidence is needed?: What was claimed, to whom, against what the supplier knew.
What consequence or remedy is available?: Corporate and individual prosecution; contract consequences.
Where is the gap or uncertainty?: Capability claims about probabilistic systems are hard to prove false to the criminal standard.

UK domestic criminal & corporate law · Incident

Who owes the duty?: Individuals in the UK's jurisdiction can be prosecuted for ICC Act offences.
What triggers it?: Elements of the offence, including mental element and contribution.
What evidence is needed?: Personal knowledge and conduct — emails, decisions, warnings received.
What consequence or remedy is available?: Individual conviction.
Where is the gap or uncertainty?: Corporate knowledge is distributed by design; attribution rules struggle with it.

UK domestic criminal & corporate law · Remedy

Who owes the duty?: Civil claims in negligence or under contract may lie against suppliers.
What triggers it?: Duty, breach, causation, loss — each contested.
What evidence is needed?: The same technical records that may not exist.
What consequence or remedy is available?: Damages; settlements.
Where is the gap or uncertainty?: Combat immunity, jurisdiction and evidence make civilian claims exceptional.

SOURCES [7] International Criminal Court Act 2001, UK Parliament (legislation.gov.uk)[8] Bribery Act 2010, section 7 — failure of commercial organisations to prevent bribery, UK Parliament (legislation.gov.uk)

Procurement & contract

Current law

A statement of law presently in force, as the editors understand it.

The most immediate lever: contracts can require documentation, testing, logging, audit access, version control, incident reporting and remedies — earlier and faster than any court. What contracts do not require does not exist when it is needed.

Procurement & contract · Design

Who owes the duty?: Whatever the contract requires: design records, provenance, disclosed limitations.
What triggers it?: Contract formation — the moment of maximum leverage.
What evidence is needed?: Deliverables defined in the contract.
What consequence or remedy is available?: Rejection, withheld payment, breach remedies.
Where is the gap or uncertainty?: Standard defence terms predate decision-shaping software; the leverage is rarely used.

Procurement & contract · Procurement

Who owes the duty?: Warranties of accuracy, audit rights, acceptance testing.
What triggers it?: Award and acceptance.
What evidence is needed?: Test results against contracted claims.
What consequence or remedy is available?: Non-acceptance; damages for misdescription.
Where is the gap or uncertainty?: Acceptance tests rarely probe behaviour at operational tempo.

Procurement & contract · Deployment

Who owes the duty?: Operating-envelope definitions and support obligations.
What triggers it?: Entry into service.
What evidence is needed?: Envelope documents; support and update records.
What consequence or remedy is available?: Contractual consequences for out-of-envelope support.
Where is the gap or uncertainty?: Envelopes are often not defined, so nothing is out of them.

Procurement & contract · Material update

Who owes the duty?: Change-control clauses: notification, re-testing, re-acceptance.
What triggers it?: Material modification — if the contract defines it.
What evidence is needed?: Version identifiers, change logs, regression results.
What consequence or remedy is available?: Suspension of the update; breach remedies.
Where is the gap or uncertainty?: Continuous-delivery practice outruns contractual change control almost everywhere.

Procurement & contract · Incident

Who owes the duty?: Notification deadlines, evidence preservation, cooperation with investigations.
What triggers it?: A defined incident — again, only if defined.
What evidence is needed?: Preserved logs, versions, communications.
What consequence or remedy is available?: Suspension, termination, damages.
Where is the gap or uncertainty?: Preservation duties are rare, so spoliation is cost-free.

Procurement & contract · Remedy

Who owes the duty?: Suspension, termination, debarment from future work.
What triggers it?: Serious or repeated breach.
What evidence is needed?: The contract-performance record.
What consequence or remedy is available?: Commercial consequences that change supplier incentives.
Where is the gap or uncertainty?: Dependence on strategic suppliers makes debarment threats hard to believe.

SOURCES [13] Responsible Procurement of Military Artificial Intelligence, Stockholm International Peace Research Institute (SIPRI)

Responsible business & human-rights due diligence

Current law

A statement of law presently in force, as the editors understand it.

The UN Guiding Principles set the corporate responsibility to respect human rights: assess risk, act on findings, track, communicate, enable remedy. Important normative expectations — and soft law. They are not criminal offences and should not be presented as such.

Responsible business & human-rights due diligence · Design

Who owes the duty?: Assess human-rights risks of products and foreseeable misuse.
What triggers it?: The responsibility applies to all business activity.
What evidence is needed?: Due-diligence documentation; risk registers.
What consequence or remedy is available?: Reputational, investor and customer pressure; some disclosure regimes.
Where is the gap or uncertainty?: Usually not independently testable; internal policies substitute for scrutiny.

Responsible business & human-rights due diligence · Procurement

Who owes the duty?: Assess customers and end uses; build leverage into the relationship.
What triggers it?: Entering or continuing a business relationship.
What evidence is needed?: Customer assessments; contractual leverage actually retained.
What consequence or remedy is available?: Walking away, conditioning, or documented mitigation.
Where is the gap or uncertainty?: Defence sales are precisely where leverage is claimed to be impossible.

Responsible business & human-rights due diligence · Deployment

Who owes the duty?: Monitor for red flags; use leverage when risks materialise.
What triggers it?: Credible information of adverse impact.
What evidence is needed?: What the company knew, when, and did.
What consequence or remedy is available?: Mitigation, restriction, exit — reported publicly.
Where is the gap or uncertainty?: No external check on whether monitoring exists or notice was acted on.

Responsible business & human-rights due diligence · Remedy

Who owes the duty?: Enable or cooperate with legitimate remedy processes.
What triggers it?: Involvement in adverse impact.
What evidence is needed?: Grievance-mechanism records.
What consequence or remedy is available?: Remediation the company chooses to provide.
Where is the gap or uncertainty?: Voluntary by construction; weakest exactly where harm is gravest.

SOURCES [12] UN Guiding Principles on Business and Human Rights, UN Office of the High Commissioner for Human Rights

Independent, parliamentary & judicial scrutiny

Current law

A statement of law presently in force, as the editors understand it.

Committees, auditors, courts and inquiries provide the outer ring of accountability. Their common constraint is access: classification, commercial confidentiality and technical opacity each limit what any of them can independently establish.

Independent, parliamentary & judicial scrutiny · Procurement

Who owes the duty?: Auditors and committees examine value, conduct and policy compliance.
What triggers it?: Programme scrutiny; member interest; public controversy.
What evidence is needed?: What departments disclose, plus what members can compel.
What consequence or remedy is available?: Findings, recommendations, political pressure.
Where is the gap or uncertainty?: Committees lack cleared technical staff to interrogate model claims.

Independent, parliamentary & judicial scrutiny · Legal review

Who owes the duty?: None currently — Article 36 reviews are internal.
What triggers it?: —
What evidence is needed?: Reviews are not published or externally examined.
What consequence or remedy is available?: —
Where is the gap or uncertainty?: No external body verifies that reviews of AI-enabled systems are adequate, or happen at all after updates.

Independent, parliamentary & judicial scrutiny · Incident

Who owes the duty?: Inquiries, inquests and judicial review can examine state conduct.
What triggers it?: Deaths, litigation, political demand.
What evidence is needed?: Disclosed material, often gisted or closed.
What consequence or remedy is available?: Findings; declarations; occasionally systemic change.
Where is the gap or uncertainty?: Closed material and missing logs turn scrutiny into a description of its own limits.

Independent, parliamentary & judicial scrutiny · Remedy

Who owes the duty?: Courts can order remedies against the state within justiciability limits.
What triggers it?: A viable claim surviving secrecy and immunity doctrines.
What evidence is needed?: Admissible reconstruction of what happened.
What consequence or remedy is available?: Damages, declarations, policy change.
Where is the gap or uncertainty?: The evidential threshold is exactly what fragmented records prevent reaching.

SOURCES [3] Proceed with Caution: Artificial Intelligence in Weapon Systems (HL Paper 16), House of Lords AI in Weapon Systems Committee

⚖ Legal content on this site is editorial. Reforms marked PROPOSED REFORM are recommendations, not current law. All legal content requires review by qualified UK public-law, IHL, export-control and international-criminal-law counsel before publication.