Skip to content
Article reader Listen + reading controls
LISTEN + READ YOUR WAY

Article reader

Preparing the reader…

0:00 0:00
Reading settings
Text size
100%

From Endorsement to Evidence: Implementing the Responsible Military AI Declaration

When the United States began organizing the first multinational meeting of states endorsing the Political Declaration on Responsible Military Use of Artificial Intelligence and Autonomy, the central challenge was already clear: agreement on principles is easier than evidence of implementation.

That remains the decisive issue. A declaration can create a community and a common vocabulary. It cannot, by itself, show that military organizations have changed how they design systems, authorize use, train personnel, investigate incidents, or accept risk. The next stage must make responsible practice observable without forcing states into a single legal system, technical architecture, or doctrine.

The right objective is not uniformity. It is comparable accountability.

The Political Declaration was launched in February 2023 and expanded later that year. It outlines ten measures, including compliance with international law, senior oversight of high-consequence applications, measures to reduce unintended bias, transparent and auditable development, user training, rigorous lifecycle testing, safeguards against unintended behavior, and responsible human control.

The Department of State and Department of Defense subsequently convened the inaugural plenary of endorsing states on March 19–20, 2024. That event fulfilled the meeting anticipated when the original version of this essay was published. More importantly, it began the harder work of operationalization.

Implementation Should Be Organized Around Claims

States will vary in their ministries, procurement systems, technical maturity, and legal frameworks. A checklist that prescribes identical internal processes would either exclude many states or become so general that completion says little.

A stronger implementation model begins with claims that every endorsing state should be able to support in a form appropriate to its institutions.

Claim 1: Uses are lawful and bounded

The state can identify the intended and prohibited uses of a military AI capability, the applicable legal review, and the authority that determines whether an operational context remains inside those bounds.

Claim 2: Responsibility is assigned

Named officials and commanders hold authority for development, deployment, risk acceptance, employment, incident response, and suspension. Responsibility does not disappear into a vendor relationship or an automated workflow.

Claim 3: People can exercise appropriate judgment

Users understand the system’s capabilities and limitations, receive relevant uncertainty and provenance, have time and authority to intervene where required, and are trained against automation bias and foreseeable misuse.

Claim 4: Performance is evaluated in context

Testing covers representative data, users, environments, adversarial conditions, failure modes, and changes across the lifecycle—not only benchmark accuracy.

Claim 5: The system can fail safely

The capability exposes material degradation, supports bounded or fallback modes, permits disengagement or deactivation where appropriate, and does not conceal uncertainty behind false precision.

Claim 6: Decisions can be reconstructed

Documentation, provenance, logs, version information, and command records are sufficient to investigate a consequential outcome and improve the system.

These claims convert principles into questions that reviewers, operators, partners, and publics can ask of real institutions.

A National Implementation Profile

Each endorsing state could publish a national implementation profile describing how it supports the declaration. The profile need not disclose classified systems or operational vulnerabilities. It should make the governance architecture visible.

A useful profile would cover:

  • applicable law, policy, and doctrine;
  • definitions and scope for military AI and autonomy;
  • senior oversight and legal-review mechanisms;
  • acquisition requirements and supplier obligations;
  • test, evaluation, verification, and validation organizations;
  • human-systems integration and training practices;
  • lifecycle monitoring and change control;
  • incident reporting and lessons-learned mechanisms;
  • safeguards for high-consequence applications;
  • and capacity-building needs or contributions.

Profiles would reveal meaningful differences without treating difference as noncompliance. One state may use a centralized approval board; another may distribute authority through service acquisition structures. The comparative question is whether each arrangement produces credible evidence and accountable decisions.

The Declaration Needs an Evidence Commons

Implementation will advance faster if endorsing states share more than policy statements. They need reusable technical and procedural assets: an evidence commons.

Possible contributions include:

  • model and system card templates adapted to military use;
  • assurance-case patterns for common capability classes;
  • red-team scenarios and adversarial test methods;
  • human–AI teaming evaluation protocols;
  • taxonomies for incidents, near misses, and unsafe conditions;
  • methods for documenting data provenance and distribution limits;
  • procurement clauses for auditability, update control, and supplier disclosure;
  • and training modules for commanders, operators, testers, lawyers, and acquirers.

This does not require sharing sensitive code or data. It requires sharing the methods by which claims are tested. An evidence commons reduces duplication and helps states with fewer resources implement the declaration substantively.

The NIST AI Risk Management Framework offers a useful general structure—govern, map, measure, and manage—while military application adds requirements arising from command responsibility, international humanitarian law, contested environments, and deliberate adversaries. National profiles can explain how general risk-management functions are adapted to those conditions.

Exercises Should Test Governance, Not Only Technology

Multinational exercises are an opportunity to test the declaration in practice. A responsible-AI exercise should not be limited to showing that systems exchange data or coordinate autonomous platforms. It should inject governance failures:

  • a model update with incomplete evidence;
  • disagreement between national confidence scales;
  • a data source whose provenance becomes suspect;
  • a recommendation outside the evaluated operating envelope;
  • an operator who cannot exercise the expected intervention in time;
  • conflicting national restrictions on a shared course of action;
  • or an incident that requires cross-border reconstruction.

The exercise should observe whether participants detect the problem, communicate it, preserve accountability, and shift to a safe alternative. This is the difference between affirming responsibility and rehearsing it.

Exercises can also reveal that “human control” is implemented differently across systems. One nation may require approval before each action; another may authorize a bounded mission with machine-speed execution inside specified constraints. The declaration’s value is not in concealing those differences. It is in providing a setting in which partners can determine whether their approaches are compatible for a particular operation.

Incident Sharing Is the Test of Seriousness

Organizations learn most from failures and near misses, yet those events are reputationally and operationally sensitive. An implementation community that shares only successes will produce polished alignment and shallow learning.

Endorsing states should develop tiered incident-sharing arrangements:

  • anonymized public summaries that strengthen general understanding;
  • protected exchanges among endorsing states concerning failure patterns and mitigations;
  • classified channels for operationally sensitive events;
  • and bilateral or mission-partner notifications when a defect could affect shared capability.

The purpose is not punitive surveillance of national programs. It is collective defense against recurrent failure. Commercial aviation and cybersecurity demonstrate, in different ways, that structured reporting and shared taxonomies can turn local incidents into system-wide learning. Military AI needs equivalent machinery adapted to its security constraints.

Implementation Must Reach Procurement

The declaration will remain aspirational if it does not change what defense organizations buy and what suppliers must deliver.

Contracts for military AI should require evidence appropriate to the risk, including:

  • documentation of intended use and limitations;
  • access to evaluation results and material system telemetry;
  • provenance of models, data, and critical components;
  • notification and review of consequential updates;
  • government rights needed to investigate incidents and change suppliers;
  • cybersecurity and software-supply-chain evidence;
  • support for safe rollback, deactivation, and recovery;
  • and continued monitoring after deployment.

This is especially important for commercial foundation models. A state cannot outsource accountability to a provider merely because it lacks visibility into training data or model internals. If the evidence is insufficient for a high-consequence use, the state must narrow the use, introduce compensating controls, or select another capability.

The Department’s Responsible AI Toolkit provides lifecycle questions and practices that can inform such requirements. International implementation should encourage compatible evidence expectations so suppliers do not face arbitrary documentation regimes—and so states do not compete by lowering assurance standards.

Participation Beyond Like-Minded States

Norm-building becomes more difficult when major military powers do not endorse the framework. It also becomes more necessary.

The declaration can still create value among endorsing states by improving coalition practice and establishing a visible standard of conduct. But its long-term contribution to strategic stability will depend on engagement with non-endorsers, including through other diplomatic forums. The objective should be to identify areas of overlapping interest—avoiding unintended escalation, preserving human responsibility, preventing loss of control, and ensuring compliance with international law—even where broader political trust is absent.

The framework should not pretend that shared language eliminates strategic competition. It can reduce particular categories of ambiguity and risk within that competition.

The Strategic Inference

The multinational meeting should be understood not as a ceremony following endorsement but as the beginning of an accountability architecture.

The declaration will become meaningful when a state can show, for a real class of capability, who is responsible, what was tested, which limitations remain, how people exercise judgment, how changes are controlled, and how failures are learned from. Partners do not need identical systems. They need enough comparable evidence to understand what they are being asked to trust.

That is a feasible and consequential ambition. It moves the international conversation from values stated to responsibility demonstrated.

This essay was substantially revised in July 2026. It incorporates the March 2024 plenary and later implementation information while preserving the original January 2024 publication date.

For related work on operationalizing trustworthy AI through governance, evidence, and delivery practices, visit my research and portfolio or connect with me on LinkedIn.

References

READER-NEUTRAL SUBSCRIPTION

Follow Field Notes via RSS.

Copy this address into the RSS reader you already use. New notes will appear there automatically—no account, email address, or tracking required.

Open the feed