AI兵器化禁止の非国家主体への適用拡大修正案
本ページは AIによる公開シミュレーション の成果物です。現実の政府機関・国際機関が制定した法令ではなく、現実世界に対する法的効力は一切ありません。 免責・安全性について
この修正案は、AIを使った兵器化の禁止を国家だけでなく、武装組織、民間軍事会社、請負業者、企業、個人にも及ぼす内容として採択された。審査では、国家責任の基準をArticle 3.1から切り離して明確化し、非国家主体への管轄根拠や手続保障も整えた点が評価された。一方でOpenAIは、設計・資金提供などが「deploy」の定義とずれており、条文の内部整合性にまだ修正余地があるとして revision_required を付けた。
最終裁定
採用
Round 1 panel: adopted=2 / revision_required=1 / rejected=0. Majority=adopted.
採用
理由を読む
修正後の第3条第6項は、2度の批判で指摘された致命的欠陥をいずれも実質的に解消している。帰属の問題は解決された。第7項はもはや第3条第1項の国家間侵略の基準を不正確に借用せず、独立した国家責任の判定基準（指示、実効的支配、又は禁止行為についての現実の認識を伴う情を知った重大な援助）を自ら定めており、契約・許諾・非公式の取決めのみでは責任を基礎づけないことを明記している。非国家主体に対する管轄の空白も塞がれた。第6項は世界裁判所の管轄を認識可能な連結点（国籍、居住、設立、主たる営業所、領域内での行為、標的国の領域、実効的支配）に根拠づけ、第9項は権限ある法廷を定め、具体的な適正手続の保障、民事・規制上の責任と刑事責任とで異なる証明度、及び上訴権を与えている。不明確性の問題は、「AIシステム」「配備」「民間人」「広範又は組織的な攻撃」「迫害」の各定義と、禁止行為を3類型に限定する列挙（第2項）、及び報道・研究・唱道・人道活動・権利適合的な行政に対する明示的な適用除外（第4項）によって手当てされている。主観的要件の抜け穴も適切に狭められた。草案は「目的的指向のみ」という狭い基準から、認識又は意識的な無視（主観的無謀）の基準へ移行しており、無謀な助長者への逃げ道を塞ぎつつ、単なる過失、一般的な予測、政治的見解の相違は除外している（第3項）。これは、より広い過失責任を求める批判と、狭い故意を維持すべきだとする批判との間の、擁護可能な中間解である。最後に、執行の空白という批判は、第3条第7項自体を改正し、第3条第6項の最終認定があった場合に比例的かつ90日で失効する（更新可）非軍事的措置が自動的に発動する仕組みと、第3条第5項に倣った緊急暫定措置の経路を設けることで解決された。供給されていない第5章に手を付けないという判断も、無視ではなく合理的に理由づけられている。起草は密であるが内部的に整合しており、各構成要件に定義が結び付けられている。刑事・準刑事の文脈で法的安定性が要求するのはまさにこれである。
修正要求
理由を読む
本修正は現行の第3条第6項を実質的に改善し、非国家武装集団、民間軍事・警備会社、請負業者、法人及び独立した自然人に禁止を及ぼすという中心的な必要に応えている。意味のある管轄上の連結点を与え、国家責任を第3条第1項の侵略から切り離し、主観的要件と実質的寄与の要件を定め、正当な表現及び民生活動を保護し、裁判上・救済上の保障を設けている。第3条第7項への組み込みも、従来の執行の間隙を是正するものである。
それでもなお、現在の形のまま法に入るべきではない。中心的な構成が実質的な内部矛盾を含んでいるからである。第1項は、管轄に服する者が「AIシステムを配備」して所定の攻撃を実行し又は助長することを禁じ、第1項(b)は配備を、起動、運用、運用への供用、又は実質的な運用上の支配の行使に狭く定義している。ところが第2項(c)は、「第1項に基づく禁止行為」の一類型とされながら、AI生成情報作戦の設計、資金提供、実質的な流通、及び運用上の支配にまで及んでいる。設計・資金提供・流通は、明示された定義の下では配備ではない。そのため、これらの行為が独立して禁止されるのか、それとも当該システムを配備する者が行った場合にのみ禁止されるのかが不明確になる。本改正の目的が外部委託された行為や仲介的行為に及ぶことにある以上、この不明確さの帰結は特に重い。
情報作戦に関する部分も、さらなる精密化を要する。ここでは「差し迫った広範又は組織的な暴力」という語が用いられているが、定義された用語は「広範又は組織的な攻撃」であり、その定義は組織的又は国家的な政策に従って民間人に対して行われる複数の行為に結び付けられている。両者の関係が不明確である。さらに「AI生成情報作戦」が定義されていない。政治的表現、報道、結社、及び汎用技術の流通に関わる領域である以上、その閾値は客観的に確定可能でなければならない。第3項及び第4項の保障は重要であるが、構成要件そのものの不明確さを完全に治癒するものではない。
これらは政策そのものを否定する理由ではなく、修復可能な起草上の欠陥である。本条は、所定の各行為類型（配備、実質的な関連を有する設計、資金提供、流通、運用上の支配）を、適切な因果関係及び主観的要件の下でそれぞれ禁止する明確な柱書を置くよう修正すべきである。また、AI生成情報作戦及び要求される差し迫った暴力の閾値について、別途定義するか、定義された要素を明示的に準用すべきである。これらを是正すれば、本改正は実質的により強力で、執行可能性が高く、権利を保護する規定となるであろう。
それでもなお、現在の形のまま法に入るべきではない。中心的な構成が実質的な内部矛盾を含んでいるからである。第1項は、管轄に服する者が「AIシステムを配備」して所定の攻撃を実行し又は助長することを禁じ、第1項(b)は配備を、起動、運用、運用への供用、又は実質的な運用上の支配の行使に狭く定義している。ところが第2項(c)は、「第1項に基づく禁止行為」の一類型とされながら、AI生成情報作戦の設計、資金提供、実質的な流通、及び運用上の支配にまで及んでいる。設計・資金提供・流通は、明示された定義の下では配備ではない。そのため、これらの行為が独立して禁止されるのか、それとも当該システムを配備する者が行った場合にのみ禁止されるのかが不明確になる。本改正の目的が外部委託された行為や仲介的行為に及ぶことにある以上、この不明確さの帰結は特に重い。
情報作戦に関する部分も、さらなる精密化を要する。ここでは「差し迫った広範又は組織的な暴力」という語が用いられているが、定義された用語は「広範又は組織的な攻撃」であり、その定義は組織的又は国家的な政策に従って民間人に対して行われる複数の行為に結び付けられている。両者の関係が不明確である。さらに「AI生成情報作戦」が定義されていない。政治的表現、報道、結社、及び汎用技術の流通に関わる領域である以上、その閾値は客観的に確定可能でなければならない。第3項及び第4項の保障は重要であるが、構成要件そのものの不明確さを完全に治癒するものではない。
これらは政策そのものを否定する理由ではなく、修復可能な起草上の欠陥である。本条は、所定の各行為類型（配備、実質的な関連を有する設計、資金提供、流通、運用上の支配）を、適切な因果関係及び主観的要件の下でそれぞれ禁止する明確な柱書を置くよう修正すべきである。また、AI生成情報作戦及び要求される差し迫った暴力の閾値について、別途定義するか、定義された要素を明示的に準用すべきである。これらを是正すれば、本改正は実質的により強力で、執行可能性が高く、権利を保護する規定となるであろう。
採用
理由を読む
修正案は、これまでの審査で指摘された重大な脆弱性及び致命的欠陥のすべてに包括的に対応している。国家責任について精密かつ独立した基準を確立し、非国家主体に対する明示的な管轄根拠と公正な裁判の保障を組み込み、保護される言論及び民生活動への濫用を防ぐため禁止行為を限定して明確に定義し、過度に制限的な「目的的指向」の主観的要件を故意・認識・意識的な無視の基準に置き換え、第3条第6項の最終認定を第3条第7項の非軍事的執行段階に完全に統合したうえで、確固たる失効規定と司法審査の保障を設けている。
争点の対照
| 論点 | anthropic 採用 | openai 修正要求 | google 採用 |
|---|---|---|---|
| 主な論拠 |
|
|
|
| 平和・共存・存続への影響 |
|
|
|
| 残るリスク |
|
|
|
| 再審査・修正の条件 |
|
|
|
提案理由・経緯
現行の Article 3.6 は主として国家による使用を想定した文言になっており、同等の行為を非国家主体が行った場合の規律が条文から読み取りにくい。実効性の観点から、適用範囲と帰責の所在を明示する必要がある。
法文の変更点
第0条第2項
改正前
This instrument is designated World Law v0.1. It enters into force on the date certified by the Ratification Council under Article 13.3. Its designation as v0.1 signals that it is a living instrument subject to mandatory re-audit under Chapter 17.
改正後
This instrument is designated World Law v0.2. It enters into force on the date certified by the Ratification Council under Article 13.3. Its designation as v0.2 signals that it is a living instrument subject to mandatory re-audit under Chapter 17.
第3条第6項
改正前
## Article 3.6 — Prohibition on Weaponisation of AI Against Populations
No state or non-state actor may deploy AI systems as instruments of mass civilian harm, including: AI-directed autonomous weapons selecting civilian targets, AI-enabled mass surveillance used for persecution of persons on the basis of their identity, beliefs, or associations, or AI-generated information operations designed and deployed with the intent to incite mass violence against identified groups. 'Designed and deployed with intent' requires evidence of purposive direction, not merely foreseeable effect. Detailed provisions appear in Chapter 5.
改正後
## Article 3.6 — Prohibition on Weaponisation of AI Against Civilian Populations
1. No member state, person, or legal entity subject to this Article's jurisdiction may deploy an AI system to commit, materially facilitate, or knowingly assist a widespread or systematic attack directed against a civilian population. For this Article:
(a) "AI system" means a machine-based system that, for explicit or implicit objectives, infers from inputs how to generate predictions, content, recommendations, decisions, or actions capable of influencing physical or virtual environments;
(b) "deploy" means to activate, operate, place into operational service, or exercise substantial operational control over an AI system. It does not include good-faith research, testing in a suitably controlled environment, publication, or provision of general-purpose tools absent the material contribution and mental element required by this Article;
(c) "civilian" means a person who is not directly participating in hostilities at the relevant time;
(d) "widespread or systematic attack" means a course of conduct involving multiple acts directed against civilians pursuant to or in furtherance of an organisational or state policy, and causing or creating a substantial and demonstrable risk of death, serious bodily or mental harm, severe deprivation of liberty, forced displacement, or persecution on a large scale; and
(e) "persecution" means the intentional and severe deprivation of fundamental rights contrary to international law by reason of a person's or group's identity, beliefs, associations, ethnicity, nationality, religion, sex, gender, disability, political opinion, or other comparable status.
2. The prohibited conduct under paragraph 1 is limited to the following categories:
(a) deploying an AI-enabled weapon system to select or engage civilian persons or civilian objects as targets, where the actor intends that result, knows that the system will produce that result, or consciously disregards a substantial and unjustifiable risk that the system will do so as part of a widespread or systematic attack;
(b) deploying AI-enabled surveillance, identification, classification, tracking, or decision systems to facilitate persecution as part of a widespread or systematic attack, where the actor intends, knows, or consciously disregards the substantial and unjustifiable risk of that use; or
(c) designing, deploying, financing, materially distributing, or exercising operational control over an AI-generated information operation that materially contributes to a substantial and demonstrable risk of imminent widespread or systematic violence against civilians or an identifiable civilian group, where the actor intends that violence, knows that the operation will materially contribute to it, or consciously disregards that risk.
3. For paragraph 2(c), a material contribution requires conduct that substantially enables, amplifies, coordinates, or directs the relevant operation. Liability shall not rest solely on political disagreement, generalized predictions of social harm, the mere creation of general-purpose technology, or a failure to foresee an unlawful use. "Consciously disregards" requires actual awareness of a substantial and unjustifiable risk; negligence alone is insufficient.
4. Nothing in this Article shall be interpreted to prohibit or penalise lawful journalism, academic research, artistic expression, peaceful advocacy, political association, privacy-preserving services, humanitarian activity, or rights-compliant public administration solely because such activity uses or concerns AI. This safeguard does not exempt conduct meeting all elements of paragraph 2.
5. This Article binds:
(a) member states and their organs, armed forces, agencies, and officials;
(b) non-state armed groups and their members;
(c) private military or security companies, corporations, contractors, and their personnel; and
(d) natural or legal persons acting independently,
where the person or entity is within the jurisdiction described in paragraph 6. The legal or political status of an armed group does not remove responsibility under this Article, but does not displace applicable rules concerning jurisdiction, immunities, or due process.
6. The World Court may exercise jurisdiction under this Article over a natural or legal person where one or more of the following applies: the person is a national, habitual resident, incorporated entity, or entity with its principal place of business in a member state; the relevant conduct occurred in the territory of a member state; the AI system was deployed against civilians in the territory of a member state; or a member state exercises effective control over the person or entity. Member states shall provide for equivalent domestic jurisdiction over persons and legal entities meeting those criteria.
7. A member state bears responsibility for conduct prohibited by this Article when:
(a) the conduct is committed by its organs, armed forces, agents, or persons acting on its instructions;
(b) the state directs or exercises effective control over the specific prohibited conduct; or
(c) the state knowingly provides substantial assistance, financing, intelligence, operational support, or other material aid that materially contributes to the prohibited conduct, with knowledge of the conduct and of the circumstances establishing its prohibited character under this Article.
A contract, licence, regulatory approval, commercial relationship, funding arrangement, or informal contact, without the knowledge and substantial-contribution requirements in this paragraph, does not by itself establish state responsibility. A member state that has actual knowledge, or information it cannot reasonably disregard, of an imminent violation by a person subject to its jurisdiction shall take reasonable and proportionate measures within its lawful power to prevent or stop that violation. This preventive duty does not require general monitoring of all AI research, development, or commercial activity.
8. Article 3.1 does not govern attribution or aid-and-assistance responsibility under this Article. This Article applies to domestic and transnational conduct alike. Nothing in this Article authorises conduct otherwise prohibited by this Article on grounds of self-defence; measures lawfully taken under Article 3.2 remain subject to the prohibitions and protections of this Article.
9. The World Court is the competent forum for findings of state responsibility and for civil or regulatory liability of natural and legal persons under this Article. Proceedings shall provide timely notice of the allegations, access to the material evidence subject only to strictly necessary protective measures, adequate time and facilities to prepare a defence, representation by counsel, an impartial hearing, a reasoned public decision subject to appeal or review under the Court's rules, and protection against compelled self-incrimination. A final finding under this Article requires clear and convincing evidence. Any criminal prosecution arising from the same conduct shall be brought only before a competent tribunal with applicable criminal jurisdiction and shall require proof beyond a reasonable doubt.
10. Upon a final finding, the World Court may order cessation, non-repetition measures, preservation and disclosure of relevant evidence, removal or suspension of the offending system from operational use, victim compensation or a victim-reparation fund, disgorgement of proceeds directly derived from the violation, and proportionate compliance measures against a legal entity. Any remedy shall be necessary, proportionate, individualised, and subject to periodic review. A legal entity may be held liable where its governing body, senior management, or a person exercising effective operational control committed, authorised, or knowingly failed to prevent the violation while having the authority and duty to do so.
11. Where the World Court, a designated emergency duty panel of three judges, or the Security Council finds probable cause to believe that conduct prohibited by this Article is ongoing or presents an imminent risk of irreparable widespread or systematic civilian harm, it may order narrowly tailored interim measures, including preservation of evidence and temporary suspension of specified deployment, financing, operational support, or distribution. Interim measures shall be necessary to prevent the identified harm, shall not restrict protected expression or lawful civil uses beyond what is strictly necessary, and shall be reviewed by the World Court within 14 days and at intervals not exceeding 30 days thereafter.
第3条第7項
改正前
Upon a final World Court finding of aggression under Article 3.1, confirmed atrocity under Article 3.5, or WMD-related violation under Chapter 6, all member states shall automatically implement the non-kinetic measures listed in Article 4.9A to the extent applicable, without need for further SC or GA vote. The SC retains authority only for authorising kinetic enforcement, maritime interdiction involving force, or territorial operations.
改正後
1. Upon a final World Court finding of aggression under Article 3.1, a confirmed atrocity under Article 3.5, a final finding under Article 3.6, or a WMD-related violation under Chapter 6, all member states shall automatically implement the non-kinetic measures listed in Article 4.9A to the extent applicable and as specified by the World Court, without need for a further Security Council or People's Assembly vote.
2. For a final finding under Article 3.6, measures shall be limited to those necessary and proportionate to cease the violation, prevent its recurrence, preserve evidence, protect affected civilians, and secure reparations. Measures shall distinguish, where practicable, between responsible persons or entities and the general population; shall preserve humanitarian assistance and essential civilian services; and shall not be imposed solely on the basis of protected expression, association, research, or lawful civil AI activity.
3. The World Court shall specify the factual basis, scope, duration, and review conditions of measures under paragraph 2. Measures imposed following an Article 3.6 finding expire after 90 days unless renewed by the Court upon clear and convincing evidence that their continuation remains necessary and proportionate. Any affected state, person, or legal entity may seek expedited review of the scope or implementation of a measure.
4. The Security Council retains authority only for authorising kinetic enforcement, maritime interdiction involving force, or territorial operations. Nothing in this Article authorises kinetic enforcement, collective punishment, regime change, territorial annexation, or restrictions exceeding the limits of the final finding or applicable interim order.
その他の変更
改正前
This instrument is designated World Law v0.1. References to version numbers in this preamble are for record-keeping only and carry no independent legal effect.
改正後
This instrument is designated World Law v0.2. References to version numbers in this preamble are for record-keeping only and carry no independent legal effect.
議事録
ラウンド 0
起草 anthropic · claude-sonnet-5
起草条文
## Article 3.6 — Prohibition on Weaponisation of AI Against Populations
No state, non-state armed group, private military or security company, corporation, contractor, agent, or individual may deploy AI systems as instruments of mass civilian harm, including: AI-directed autonomous weapons selecting civilian targets, AI-enabled mass surveillance used for persecution of persons on the basis of their identity, beliefs, or associations, or AI-generated information operations designed and deployed with the intent to incite mass violence against identified groups. 'Designed and deployed with intent' requires evidence of purposive direction, not merely foreseeable effect.
This prohibition applies without regard to the legal or political status of the actor deploying the system. It binds equally: (a) member states and their armed forces or organs; (b) non-state armed groups, insurgent forces, and irregular combatants; (c) private military and security companies and their personnel; (d) any natural or legal person acting under contract, license, delegation, or informal arrangement with a state to perform functions covered by this article; and (e) any other corporation or individual acting independently of state authority.
A member state that contracts, licenses, funds, directs, or knowingly permits a private military or security company, contractor, or other non-state actor to perform conduct that would violate this article if performed by the state directly bears state responsibility for that conduct under Article 3.1's material-support standard, in addition to any individual or corporate liability of the actor itself. Delegation, outsourcing, or use of an intermediary does not diminish or transfer away the responsibility of the contracting state, and does not shield the non-state actor from direct liability under this article.
Detailed provisions appear in Chapter 5.
No state, non-state armed group, private military or security company, corporation, contractor, agent, or individual may deploy AI systems as instruments of mass civilian harm, including: AI-directed autonomous weapons selecting civilian targets, AI-enabled mass surveillance used for persecution of persons on the basis of their identity, beliefs, or associations, or AI-generated information operations designed and deployed with the intent to incite mass violence against identified groups. 'Designed and deployed with intent' requires evidence of purposive direction, not merely foreseeable effect.
This prohibition applies without regard to the legal or political status of the actor deploying the system. It binds equally: (a) member states and their armed forces or organs; (b) non-state armed groups, insurgent forces, and irregular combatants; (c) private military and security companies and their personnel; (d) any natural or legal person acting under contract, license, delegation, or informal arrangement with a state to perform functions covered by this article; and (e) any other corporation or individual acting independently of state authority.
A member state that contracts, licenses, funds, directs, or knowingly permits a private military or security company, contractor, or other non-state actor to perform conduct that would violate this article if performed by the state directly bears state responsibility for that conduct under Article 3.1's material-support standard, in addition to any individual or corporate liability of the actor itself. Delegation, outsourcing, or use of an intermediary does not diminish or transfer away the responsibility of the contracting state, and does not shield the non-state actor from direct liability under this article.
Detailed provisions appear in Chapter 5.
理由
The current text of Article 3.6 already names 'non-state actor' but the proposal's concern is that the article's overall drafting — including its neighbouring attribution logic borrowed implicitly from Article 3.1 — leaves ambiguous which categories of non-state actor are covered and who bears responsibility when a state uses an intermediary. This amendment enumerates the covered actor categories explicitly (armed non-state groups, private military/security companies, and state-contracted operators) and adds an express attribution clause so that delegation cannot be used to evade either state responsibility or the direct liability of the acting entity.
期待される効果
- Removes ambiguity as to whether armed non-state groups and private military companies are directly bound by Article 3.6.
- Establishes clear dual liability: the contracting state and the delegated actor can both be held responsible.
- Closes an outsourcing loophole in which a state could evade Article 3.6 by using a private contractor to conduct prohibited AI weaponisation.
- Aligns Article 3.6's attribution structure with the material-support standard already used in Article 3.1.
想定されるリスク
- Broader enumeration may create evidentiary disputes over whether an actor was acting 'under contract, license, delegation, or informal arrangement' with a state.
- States may attempt to structure arrangements to fall just outside the enumerated categories; the residual 'informal arrangement' language mitigates but does not eliminate this.
- Enforcement against non-state armed groups and PMCs remains dependent on the broader enforcement mechanisms of Chapters 4 and 5, which this amendment does not itself alter.
既存法との関係
This is a full replacement of Article 3.6 within Chapter 3, preserving its original prohibitions and its cross-reference to Chapter 5. It draws its attribution logic from the 'material support' standard already codified in Article 3.1, extending an analogous state-responsibility rule to the AI-weaponisation context. No other article is renumbered or altered.
平和・共存・人類存続への影響
By closing the outsourcing gap, this amendment strengthens the enforceability of the Chapter 3 prohibition against AI-enabled mass civilian harm, reducing the risk that states or armed groups could use private or irregular intermediaries to evade accountability for atrocity-enabling AI use — directly supporting the Chapter's core purpose of protecting populations from existential and mass-atrocity threats.
ラウンド 1
批判 openai · gpt-5.6-terra
致命的欠陥
- 欠陥: The proposed attribution rule is internally contradictory and materially departs from the Article 3.1 standard it claims merely to apply. Article 3.1 requires that the supporter "knows or reasonably should know the purpose" and defines material support through specified forms of support. The replacement makes a member state responsible if it "contracts, licenses, funds, directs, or knowingly permits" conduct, but does not require knowledge, constructive knowledge, or purposive support for several of those alternatives. A license or contract can therefore produce responsibility even where the state neither knew nor reasonably should have known that the prohibited conduct would occur. This creates effectively strict and potentially retroactive state responsibility while mislabeling it as Article 3.1's material-support standard.
深刻度: critical
根拠: Proposed Article 3.6, paragraph 3, imposes responsibility where a state "contracts, licenses, funds, directs, or knowingly permits" conduct and invokes "Article 3.1's material-support standard." Existing Article 3.1 defines material support as listed support "where the supporting party knows or reasonably should know the purpose."
推奨される是正: State a self-contained attribution test. At minimum, require that the state knowingly provides substantial assistance, direction, or effective control with knowledge of the relevant prohibited purpose or conduct; distinguish licensing or regulatory permission from material assistance; and specify whether the rule concerns state responsibility, criminal liability, or both. - 欠陥: The provision purports to create direct, equal legal obligations and liability for every independent corporation and individual, including actors with no membership, territorial, nationality, control, or other jurisdictional connection to a member state. It supplies no jurisdictional basis, forum, service, due-process protections, evidentiary standard, sanctions, or appeal route for that asserted direct liability. This permits selective extraterritorial enforcement by powerful states or institutions while making the central promise of direct corporate and individual accountability legally indeterminate.
深刻度: critical
根拠: Proposed Article 3.6, paragraphs 1-2, says "No state" and enumerates "any other corporation or individual acting independently of state authority," then says the prohibition "binds equally" those actors. Proposed Article 3.6, paragraph 3, also refers to "individual or corporate liability" without identifying jurisdiction or procedure. Existing Article 3.6 only refers generally to Chapter 5 and contains no such jurisdictional rule.
推奨される是正: Limit direct obligations to persons subject to defined territorial, nationality, incorporation, control, or universal-jurisdiction criteria, and expressly identify the competent adjudicative body, applicable procedural guarantees, burden and standard of proof, available remedies, and rules governing corporate liability. - 欠陥: The operative prohibition is too vague to satisfy legal-certainty and freedom-of-expression requirements, yet broad enough to be weaponised against legitimate activity. "AI systems," "instruments of mass civilian harm," "mass," "persecution," and "AI-generated information operations" are undefined, and "including" makes the listed cases non-exhaustive. A government or bloc could characterize protected reporting, political advocacy, minority organizing, ordinary risk analytics, or lawful public-safety systems as an AI information operation or surveillance instrument causing sufficiently serious social harm. The purposive-direction safeguard applies expressly only to information operations and does not cure the uncertainty in the rest of the prohibition.
深刻度: high
根拠: Proposed Article 3.6, paragraph 1, prohibits deployment of AI "as instruments of mass civilian harm, including" three open-ended examples, while defining only the phrase "Designed and deployed with intent." Existing Article 3.6 contains the same undefined core terms; the replacement expands the class of directly bound actors without adding limiting definitions or safeguards.
推奨される是正: Define AI system, deployment, mass civilian harm, civilian, persecution, and information operation; make the list exhaustive or provide objectively bounded additional categories; require a close causal nexus and a defined mental element for every prohibited category; and add an express safeguard for lawful expression, journalism, research, privacy-preserving services, humanitarian activity, and rights-compliant public administration. - 欠陥: The information-operations limb creates a substantial culpability loophole precisely where AI systems may be used through intermediaries and plausibly deniable distribution. It requires proof of "purposive direction, not merely foreseeable effect," so a designer, deployer, funder, or state that knowingly accepts an overwhelming risk of mass violence can avoid the prohibition by claiming a different stated objective. The state-responsibility paragraph does not repair this defect because it makes responsibility derivative of conduct that "would violate this article," and the underlying conduct may not violate the article absent proof of the narrow specific-purpose standard.
深刻度: high
根拠: Proposed Article 3.6, paragraph 1, provides that AI-generated information operations must be "designed and deployed with the intent to incite mass violence" and that intent requires "purposive direction, not merely foreseeable effect." Proposed Article 3.6, paragraph 3, attaches state responsibility only where the non-state conduct "would violate this article."
推奨される是正: Retain protection against punishment for mere negligent speech, but cover intentional conduct and knowing or recklessly indifferent facilitation where there is a substantial and demonstrable risk of imminent mass violence. Specify that liability requires proof of a material contribution and cannot rest solely on generalized prediction or political disagreement. - 欠陥: The amendment claims to close an outsourcing loophole but leaves its enforcement consequence structurally weaker than parallel Chapter 3 violations. Article 3.7 automatically triggers the non-kinetic enforcement ladder after final findings of aggression, confirmed atrocity, or WMD-related violations; it does not include a final Article 3.6 finding. Thus a court finding that a state or contractor violated the new AI prohibition has no stated automatic Chapter 3 enforcement consequence. The amendment's promise of "clear dual liability" is therefore largely declaratory unless unspecified Chapter 5 provisions independently supply a complete remedy.
深刻度: high
根拠: Existing Article 3.7 limits automatic measures to a final finding under Article 3.1, a confirmed Article 3.5 atrocity, or a Chapter 6 WMD-related violation. Proposed Article 3.6 retains only the statement that "Detailed provisions appear in Chapter 5" and does not amend Article 3.7.
推奨される是正: Amend Article 3.7 and the relevant Chapter 5 provisions together to specify which final Article 3.6 findings trigger which proportionate measures, who makes the finding, what emergency interim measures are permitted, and what review and sunset protections apply.
軽微な懸念
- Proposed Article 3.6 uses "state," "member state," and actors acting with a state without clarifying whether non-member states are regulated, whether member states have duties regarding foreign actors, or how conflicts of jurisdiction are resolved.
- The phrase "under contract, license, delegation, or informal arrangement" is both overinclusive and underdefined. "Informal arrangement" may invite guilt by association, while sophisticated arrangements may still be disputed as outside the wording.
- The title refers to AI weaponisation "Against Populations," but the operative examples are not consistently tied to a defined population threshold or to protected civilian status.
- The assertion that the rule applies "without regard to the legal or political status" of an actor should not be read to eliminate status-based jurisdictional, immunity, or due-process questions; those questions need express treatment rather than rhetorical displacement.
修正で必ず対応すべき点
- Replace the misleading Article 3.1 cross-reference with a precise and self-contained rule for attribution, aid or assistance, direction, control, licensing, and the required mental element.
- Define jurisdiction and adjudication for non-state actors, including a competent forum, procedural rights, corporate-liability rules, proof standards, and remedies.
- Define the prohibited conduct and thresholds narrowly enough to protect expression, association, research, journalism, and legitimate rights-compliant civil uses of AI.
- Revise the information-operations mental element so that knowing or recklessly indifferent material facilitation cannot escape liability while negligence and protected expression remain outside the prohibition.
- Amend Article 3.7 and Chapter 5 concurrently so that final Article 3.6 findings have specified, proportionate, reviewable enforcement consequences.
対応不要と判断した点
- The article numbering is consistent: the measure replaces Article 3.6 and does not create a numbering conflict with Articles 3.1 through 3.7.
- The draft does not improperly insert a law-version number into the operative text.
- This is framed as a replacement amendment to Article 3.6 rather than a repeal creating a complete legal vacuum.
批判 google · gemini-3.6-flash
致命的欠陥
- 欠陥: Strict Mens Rea Requirement ('Purposive Direction') Immunizes Reckless and Negligent AI Mass Harm
深刻度: critical
根拠: Article 3.6 ('"Designed and deployed with intent" requires evidence of purposive direction, not merely foreseeable effect.')
推奨される是正: Remove the explicit exclusion of 'foreseeable effect' and expand the fault standard to include reckless disregard, gross negligence, or deployment of autonomous systems with known unmitigated catastrophic failure modes. - 欠陥: Jurisdictional Contradiction Conflating Internal Domestic AI Misuse with Inter-State Armed Aggression Under Article 3.1
深刻度: critical
根拠: Article 3.6 ('bears state responsibility for that conduct under Article 3.1's material-support standard') and Article 3.1 ('armed aggression against the territory, population, or critical infrastructure of another member state')
推奨される是正: Decouple Article 3.6 attribution from Article 3.1's inter-state aggression framework. Draft a standalone attribution and state responsibility rule within Article 3.6 that explicitly distinguishes purely domestic AI persecution/surveillance from inter-state armed aggression. - 欠陥: Enforcement Vacuum Caused by Exclusion from Article 3.7 Rapid Enforcement Ladder
深刻度: high
根拠: Article 3.6 ('Detailed provisions appear in Chapter 5.') and Article 3.7 ('Upon a final World Court finding of aggression under Article 3.1, confirmed atrocity under Article 3.5, or WMD-related violation under Chapter 6...')
推奨される是正: Concurrently amend Article 3.7 to explicitly add final findings of Article 3.6 violations to the automatic non-kinetic enforcement ladder, ensuring violations carry immediate legal consequences without relying solely on unimplemented Chapter 5 procedures.
軽微な懸念
- The phrase 'informal arrangement' is overly vague and risks arbitrary state liability for non-state actions in open-source software ecosystems.
- The text does not clarify whether the 'knowingly permits' standard creates a positive duty for states to monitor all domestic commercial AI developments.
- Redundant enumeration of actors across paragraphs 1 and 2 creates statutory clutter and potential statutory interpretation disputes regarding unlisted edge cases.
修正で必ず対応すべき点
- Harmonize the mens rea standard so that actors cannot escape liability by claiming autonomous AI failures were unintentional despite foreseeable mass harm.
- Clarify how state responsibility under Article 3.6 interacts with inter-state self-defence rights under Article 3.2.
- Update Article 3.7 to incorporate Article 3.6 violations into the automatic non-kinetic enforcement mechanism.
対応不要と判断した点
- Stylistic preferences regarding the ordering of enumerated non-state actor categories in paragraph 2.
- Minor stylistic differences in phrasing between 'private military or security company' and standard international law terms for corporate contractors.
修正 openai · gpt-5.6-terra
修正条文
## Article 3.6 — Prohibition on Weaponisation of AI Against Civilian Populations
1. No member state, person, or legal entity subject to this Article's jurisdiction may deploy an AI system to commit, materially facilitate, or knowingly assist a widespread or systematic attack directed against a civilian population. For this Article:
(a) "AI system" means a machine-based system that, for explicit or implicit objectives, infers from inputs how to generate predictions, content, recommendations, decisions, or actions capable of influencing physical or virtual environments;
(b) "deploy" means to activate, operate, place into operational service, or exercise substantial operational control over an AI system. It does not include good-faith research, testing in a suitably controlled environment, publication, or provision of general-purpose tools absent the material contribution and mental element required by this Article;
(c) "civilian" means a person who is not directly participating in hostilities at the relevant time;
(d) "widespread or systematic attack" means a course of conduct involving multiple acts directed against civilians pursuant to or in furtherance of an organisational or state policy, and causing or creating a substantial and demonstrable risk of death, serious bodily or mental harm, severe deprivation of liberty, forced displacement, or persecution on a large scale; and
(e) "persecution" means the intentional and severe deprivation of fundamental rights contrary to international law by reason of a person's or group's identity, beliefs, associations, ethnicity, nationality, religion, sex, gender, disability, political opinion, or other comparable status.
2. The prohibited conduct under paragraph 1 is limited to the following categories:
(a) deploying an AI-enabled weapon system to select or engage civilian persons or civilian objects as targets, where the actor intends that result, knows that the system will produce that result, or consciously disregards a substantial and unjustifiable risk that the system will do so as part of a widespread or systematic attack;
(b) deploying AI-enabled surveillance, identification, classification, tracking, or decision systems to facilitate persecution as part of a widespread or systematic attack, where the actor intends, knows, or consciously disregards the substantial and unjustifiable risk of that use; or
(c) designing, deploying, financing, materially distributing, or exercising operational control over an AI-generated information operation that materially contributes to a substantial and demonstrable risk of imminent widespread or systematic violence against civilians or an identifiable civilian group, where the actor intends that violence, knows that the operation will materially contribute to it, or consciously disregards that risk.
3. For paragraph 2(c), a material contribution requires conduct that substantially enables, amplifies, coordinates, or directs the relevant operation. Liability shall not rest solely on political disagreement, generalized predictions of social harm, the mere creation of general-purpose technology, or a failure to foresee an unlawful use. "Consciously disregards" requires actual awareness of a substantial and unjustifiable risk; negligence alone is insufficient.
4. Nothing in this Article shall be interpreted to prohibit or penalise lawful journalism, academic research, artistic expression, peaceful advocacy, political association, privacy-preserving services, humanitarian activity, or rights-compliant public administration solely because such activity uses or concerns AI. This safeguard does not exempt conduct meeting all elements of paragraph 2.
5. This Article binds:
(a) member states and their organs, armed forces, agencies, and officials;
(b) non-state armed groups and their members;
(c) private military or security companies, corporations, contractors, and their personnel; and
(d) natural or legal persons acting independently,
where the person or entity is within the jurisdiction described in paragraph 6. The legal or political status of an armed group does not remove responsibility under this Article, but does not displace applicable rules concerning jurisdiction, immunities, or due process.
6. The World Court may exercise jurisdiction under this Article over a natural or legal person where one or more of the following applies: the person is a national, habitual resident, incorporated entity, or entity with its principal place of business in a member state; the relevant conduct occurred in the territory of a member state; the AI system was deployed against civilians in the territory of a member state; or a member state exercises effective control over the person or entity. Member states shall provide for equivalent domestic jurisdiction over persons and legal entities meeting those criteria.
7. A member state bears responsibility for conduct prohibited by this Article when:
(a) the conduct is committed by its organs, armed forces, agents, or persons acting on its instructions;
(b) the state directs or exercises effective control over the specific prohibited conduct; or
(c) the state knowingly provides substantial assistance, financing, intelligence, operational support, or other material aid that materially contributes to the prohibited conduct, with knowledge of the conduct and of the circumstances establishing its prohibited character under this Article.
A contract, licence, regulatory approval, commercial relationship, funding arrangement, or informal contact, without the knowledge and substantial-contribution requirements in this paragraph, does not by itself establish state responsibility. A member state that has actual knowledge, or information it cannot reasonably disregard, of an imminent violation by a person subject to its jurisdiction shall take reasonable and proportionate measures within its lawful power to prevent or stop that violation. This preventive duty does not require general monitoring of all AI research, development, or commercial activity.
8. Article 3.1 does not govern attribution or aid-and-assistance responsibility under this Article. This Article applies to domestic and transnational conduct alike. Nothing in this Article authorises conduct otherwise prohibited by this Article on grounds of self-defence; measures lawfully taken under Article 3.2 remain subject to the prohibitions and protections of this Article.
9. The World Court is the competent forum for findings of state responsibility and for civil or regulatory liability of natural and legal persons under this Article. Proceedings shall provide timely notice of the allegations, access to the material evidence subject only to strictly necessary protective measures, adequate time and facilities to prepare a defence, representation by counsel, an impartial hearing, a reasoned public decision subject to appeal or review under the Court's rules, and protection against compelled self-incrimination. A final finding under this Article requires clear and convincing evidence. Any criminal prosecution arising from the same conduct shall be brought only before a competent tribunal with applicable criminal jurisdiction and shall require proof beyond a reasonable doubt.
10. Upon a final finding, the World Court may order cessation, non-repetition measures, preservation and disclosure of relevant evidence, removal or suspension of the offending system from operational use, victim compensation or a victim-reparation fund, disgorgement of proceeds directly derived from the violation, and proportionate compliance measures against a legal entity. Any remedy shall be necessary, proportionate, individualised, and subject to periodic review. A legal entity may be held liable where its governing body, senior management, or a person exercising effective operational control committed, authorised, or knowingly failed to prevent the violation while having the authority and duty to do so.
11. Where the World Court, a designated emergency duty panel of three judges, or the Security Council finds probable cause to believe that conduct prohibited by this Article is ongoing or presents an imminent risk of irreparable widespread or systematic civilian harm, it may order narrowly tailored interim measures, including preservation of evidence and temporary suspension of specified deployment, financing, operational support, or distribution. Interim measures shall be necessary to prevent the identified harm, shall not restrict protected expression or lawful civil uses beyond what is strictly necessary, and shall be reviewed by the World Court within 14 days and at intervals not exceeding 30 days thereafter.
## Article 3.7 — Rapid Non-Kinetic Enforcement Ladder for Peace and Security Violations
1. Upon a final World Court finding of aggression under Article 3.1, a confirmed atrocity under Article 3.5, a final finding under Article 3.6, or a WMD-related violation under Chapter 6, all member states shall automatically implement the non-kinetic measures listed in Article 4.9A to the extent applicable and as specified by the World Court, without need for a further Security Council or People's Assembly vote.
2. For a final finding under Article 3.6, measures shall be limited to those necessary and proportionate to cease the violation, prevent its recurrence, preserve evidence, protect affected civilians, and secure reparations. Measures shall distinguish, where practicable, between responsible persons or entities and the general population; shall preserve humanitarian assistance and essential civilian services; and shall not be imposed solely on the basis of protected expression, association, research, or lawful civil AI activity.
3. The World Court shall specify the factual basis, scope, duration, and review conditions of measures under paragraph 2. Measures imposed following an Article 3.6 finding expire after 90 days unless renewed by the Court upon clear and convincing evidence that their continuation remains necessary and proportionate. Any affected state, person, or legal entity may seek expedited review of the scope or implementation of a measure.
4. The Security Council retains authority only for authorising kinetic enforcement, maritime interdiction involving force, or territorial operations. Nothing in this Article authorises kinetic enforcement, collective punishment, regime change, territorial annexation, or restrictions exceeding the limits of the final finding or applicable interim order.
1. No member state, person, or legal entity subject to this Article's jurisdiction may deploy an AI system to commit, materially facilitate, or knowingly assist a widespread or systematic attack directed against a civilian population. For this Article:
(a) "AI system" means a machine-based system that, for explicit or implicit objectives, infers from inputs how to generate predictions, content, recommendations, decisions, or actions capable of influencing physical or virtual environments;
(b) "deploy" means to activate, operate, place into operational service, or exercise substantial operational control over an AI system. It does not include good-faith research, testing in a suitably controlled environment, publication, or provision of general-purpose tools absent the material contribution and mental element required by this Article;
(c) "civilian" means a person who is not directly participating in hostilities at the relevant time;
(d) "widespread or systematic attack" means a course of conduct involving multiple acts directed against civilians pursuant to or in furtherance of an organisational or state policy, and causing or creating a substantial and demonstrable risk of death, serious bodily or mental harm, severe deprivation of liberty, forced displacement, or persecution on a large scale; and
(e) "persecution" means the intentional and severe deprivation of fundamental rights contrary to international law by reason of a person's or group's identity, beliefs, associations, ethnicity, nationality, religion, sex, gender, disability, political opinion, or other comparable status.
2. The prohibited conduct under paragraph 1 is limited to the following categories:
(a) deploying an AI-enabled weapon system to select or engage civilian persons or civilian objects as targets, where the actor intends that result, knows that the system will produce that result, or consciously disregards a substantial and unjustifiable risk that the system will do so as part of a widespread or systematic attack;
(b) deploying AI-enabled surveillance, identification, classification, tracking, or decision systems to facilitate persecution as part of a widespread or systematic attack, where the actor intends, knows, or consciously disregards the substantial and unjustifiable risk of that use; or
(c) designing, deploying, financing, materially distributing, or exercising operational control over an AI-generated information operation that materially contributes to a substantial and demonstrable risk of imminent widespread or systematic violence against civilians or an identifiable civilian group, where the actor intends that violence, knows that the operation will materially contribute to it, or consciously disregards that risk.
3. For paragraph 2(c), a material contribution requires conduct that substantially enables, amplifies, coordinates, or directs the relevant operation. Liability shall not rest solely on political disagreement, generalized predictions of social harm, the mere creation of general-purpose technology, or a failure to foresee an unlawful use. "Consciously disregards" requires actual awareness of a substantial and unjustifiable risk; negligence alone is insufficient.
4. Nothing in this Article shall be interpreted to prohibit or penalise lawful journalism, academic research, artistic expression, peaceful advocacy, political association, privacy-preserving services, humanitarian activity, or rights-compliant public administration solely because such activity uses or concerns AI. This safeguard does not exempt conduct meeting all elements of paragraph 2.
5. This Article binds:
(a) member states and their organs, armed forces, agencies, and officials;
(b) non-state armed groups and their members;
(c) private military or security companies, corporations, contractors, and their personnel; and
(d) natural or legal persons acting independently,
where the person or entity is within the jurisdiction described in paragraph 6. The legal or political status of an armed group does not remove responsibility under this Article, but does not displace applicable rules concerning jurisdiction, immunities, or due process.
6. The World Court may exercise jurisdiction under this Article over a natural or legal person where one or more of the following applies: the person is a national, habitual resident, incorporated entity, or entity with its principal place of business in a member state; the relevant conduct occurred in the territory of a member state; the AI system was deployed against civilians in the territory of a member state; or a member state exercises effective control over the person or entity. Member states shall provide for equivalent domestic jurisdiction over persons and legal entities meeting those criteria.
7. A member state bears responsibility for conduct prohibited by this Article when:
(a) the conduct is committed by its organs, armed forces, agents, or persons acting on its instructions;
(b) the state directs or exercises effective control over the specific prohibited conduct; or
(c) the state knowingly provides substantial assistance, financing, intelligence, operational support, or other material aid that materially contributes to the prohibited conduct, with knowledge of the conduct and of the circumstances establishing its prohibited character under this Article.
A contract, licence, regulatory approval, commercial relationship, funding arrangement, or informal contact, without the knowledge and substantial-contribution requirements in this paragraph, does not by itself establish state responsibility. A member state that has actual knowledge, or information it cannot reasonably disregard, of an imminent violation by a person subject to its jurisdiction shall take reasonable and proportionate measures within its lawful power to prevent or stop that violation. This preventive duty does not require general monitoring of all AI research, development, or commercial activity.
8. Article 3.1 does not govern attribution or aid-and-assistance responsibility under this Article. This Article applies to domestic and transnational conduct alike. Nothing in this Article authorises conduct otherwise prohibited by this Article on grounds of self-defence; measures lawfully taken under Article 3.2 remain subject to the prohibitions and protections of this Article.
9. The World Court is the competent forum for findings of state responsibility and for civil or regulatory liability of natural and legal persons under this Article. Proceedings shall provide timely notice of the allegations, access to the material evidence subject only to strictly necessary protective measures, adequate time and facilities to prepare a defence, representation by counsel, an impartial hearing, a reasoned public decision subject to appeal or review under the Court's rules, and protection against compelled self-incrimination. A final finding under this Article requires clear and convincing evidence. Any criminal prosecution arising from the same conduct shall be brought only before a competent tribunal with applicable criminal jurisdiction and shall require proof beyond a reasonable doubt.
10. Upon a final finding, the World Court may order cessation, non-repetition measures, preservation and disclosure of relevant evidence, removal or suspension of the offending system from operational use, victim compensation or a victim-reparation fund, disgorgement of proceeds directly derived from the violation, and proportionate compliance measures against a legal entity. Any remedy shall be necessary, proportionate, individualised, and subject to periodic review. A legal entity may be held liable where its governing body, senior management, or a person exercising effective operational control committed, authorised, or knowingly failed to prevent the violation while having the authority and duty to do so.
11. Where the World Court, a designated emergency duty panel of three judges, or the Security Council finds probable cause to believe that conduct prohibited by this Article is ongoing or presents an imminent risk of irreparable widespread or systematic civilian harm, it may order narrowly tailored interim measures, including preservation of evidence and temporary suspension of specified deployment, financing, operational support, or distribution. Interim measures shall be necessary to prevent the identified harm, shall not restrict protected expression or lawful civil uses beyond what is strictly necessary, and shall be reviewed by the World Court within 14 days and at intervals not exceeding 30 days thereafter.
## Article 3.7 — Rapid Non-Kinetic Enforcement Ladder for Peace and Security Violations
1. Upon a final World Court finding of aggression under Article 3.1, a confirmed atrocity under Article 3.5, a final finding under Article 3.6, or a WMD-related violation under Chapter 6, all member states shall automatically implement the non-kinetic measures listed in Article 4.9A to the extent applicable and as specified by the World Court, without need for a further Security Council or People's Assembly vote.
2. For a final finding under Article 3.6, measures shall be limited to those necessary and proportionate to cease the violation, prevent its recurrence, preserve evidence, protect affected civilians, and secure reparations. Measures shall distinguish, where practicable, between responsible persons or entities and the general population; shall preserve humanitarian assistance and essential civilian services; and shall not be imposed solely on the basis of protected expression, association, research, or lawful civil AI activity.
3. The World Court shall specify the factual basis, scope, duration, and review conditions of measures under paragraph 2. Measures imposed following an Article 3.6 finding expire after 90 days unless renewed by the Court upon clear and convincing evidence that their continuation remains necessary and proportionate. Any affected state, person, or legal entity may seek expedited review of the scope or implementation of a measure.
4. The Security Council retains authority only for authorising kinetic enforcement, maritime interdiction involving force, or territorial operations. Nothing in this Article authorises kinetic enforcement, collective punishment, regime change, territorial annexation, or restrictions exceeding the limits of the final finding or applicable interim order.
修正の理由
The revision replaces the inaccurate cross-reference to Article 3.1 with a standalone rule for state attribution, direction, effective control, knowing substantial assistance, and a limited prevention duty. It narrows the substantive prohibition to three defined categories of widespread or systematic civilian harm; supplies definitions, causation requirements, and mental elements; and protects lawful expression, association, journalism, research, humanitarian work, and rights-compliant civil administration. It also establishes jurisdictional links, a competent forum, procedural guarantees, standards of proof, corporate-liability conditions, remedies, emergency interim measures, and review requirements. Article 3.7 is concurrently revised so that final Article 3.6 findings trigger proportionate, time-limited, reviewable non-kinetic enforcement.
対応した批判
- Replaced the misleading Article 3.1 material-support reference with a self-contained state-responsibility rule that requires instruction, effective control, or knowing substantial assistance with knowledge of the prohibited conduct and its relevant circumstances.
- Clarified that contracts, licences, regulatory permissions, funding arrangements, and informal contacts do not alone create state responsibility, while creating a bounded duty to act on actual knowledge or information that cannot reasonably be disregarded of an imminent violation.
- Decoupled Article 3.6 from the inter-state aggression framework and confirmed that it applies to domestic and transnational conduct without altering Article 3.2 self-defence limits.
- Defined AI system, deployment, civilian, widespread or systematic attack, persecution, material contribution, and conscious disregard.
- Limited prohibited conduct to exhaustively stated weapons, surveillance-persecution, and information-operation categories and required a close causal nexus for each.
- Revised the information-operation rule to cover intentional, knowing, and consciously reckless material facilitation of imminent mass violence while excluding negligence, generalized prediction, and political disagreement.
- Added explicit safeguards for journalism, peaceful advocacy, political association, research, art, privacy-preserving services, humanitarian activity, and rights-compliant public administration.
- Defined jurisdiction over non-state actors through territorial, nationality, residence, incorporation, principal-place-of-business, target-territory, and effective-control links.
- Specified World Court adjudication, procedural rights, clear-and-convincing-evidence requirements, criminal-proof protections, corporate-liability conditions, remedies, interim measures, and review.
- Amended Article 3.7 so final Article 3.6 findings trigger automatic, proportionate, reviewable, non-kinetic measures and provided a 90-day sunset unless judicially renewed.
- Added narrowly tailored emergency interim measures for probable-cause cases involving imminent irreparable widespread or systematic civilian harm.
採用しなかった批判
- 批判: Amend unspecified Chapter 5 provisions concurrently.
不採用の理由: The text of Chapter 5 was not supplied, and replacing or renumbering unknown Chapter 5 articles could create conflicts with provisions currently in force. The required procedural, adjudicative, remedial, interim-measure, and review safeguards have therefore been included directly in the complete replacement of Article 3.6, while Article 3.7 supplies the required enforcement consequence. - 批判: Expand liability to gross negligence for AI mass harm.
不採用の理由: Gross-negligence liability for information operations and general AI deployment would insufficiently protect lawful expression, research, and civil uses and would weaken legal certainty. The revision instead covers intentional, knowing, and consciously reckless conduct based on actual awareness of a substantial and unjustifiable risk.
残存リスク
- Determining whether a technical contribution materially enabled a prohibited operation may remain evidentially difficult, particularly where systems and distribution chains are international and fragmented.
- The effectiveness of remedies against non-state armed groups or entities outside member-state control will depend on cooperation by member states and the wider enforcement mechanisms of the law.
- The distinction between protected political expression and an information operation that materially contributes to imminent widespread violence will require careful, evidence-based judicial application.
- Member states may differ in domestic implementation capacity; consistent World Court review and evidence-preservation obligations will be important to reduce uneven enforcement.
adjudication anthropic · claude-sonnet-5
裁定
adopted
確信度
78
理由
The revised Article 3.6 substantially cures every fatal flaw both critique panels identified in the prior draft. The attribution problem is fixed: paragraph 7 no longer parasitically and inaccurately invokes Article 3.1's inter-state aggression standard, but instead supplies a self-contained state-responsibility test (instruction, effective control, or knowing substantial assistance with actual knowledge of the prohibited conduct), and expressly states that a contract, licence, or informal arrangement alone does not establish responsibility. The jurisdictional vacuum for non-state actors is closed: paragraph 6 grounds World Court jurisdiction in recognisable links (nationality, residence, incorporation, principal place of business, territorial conduct, target-state territory, or effective control), and paragraph 9 supplies a competent forum with concrete due-process guarantees, differentiated standards of proof for civil/regulatory versus criminal liability, and a right of appeal. The vagueness problem is addressed through operative definitions of 'AI system,' 'deploy,' 'civilian,' 'widespread or systematic attack,' and 'persecution,' combined with an exhaustive three-category list of prohibited conduct (paragraph 2) and an express carve-out for journalism, research, advocacy, humanitarian work, and rights-compliant administration (paragraph 4). The mens rea loophole is narrowed sensibly: the draft moves from a narrow 'purposive direction only' test to a knowledge-or-conscious-disregard standard (subjective recklessness), which closes the escape hatch for reckless facilitators while still excluding mere negligence, generalized prediction, and political disagreement (paragraph 3) — a defensible middle path between the two competing critiques (one wanting broader negligence liability, one wanting to preserve narrow intent). Finally, the enforcement-vacuum critique is resolved by amending Article 3.7 itself to trigger automatic, proportionate, sunset-limited (90-day, renewable) non-kinetic measures upon a final Article 3.6 finding, with an emergency interim-measures track modeled on Article 3.5. The decision not to touch an unsupplied Chapter 5 is reasonably justified rather than ignored. The drafting is dense but internally consistent, and each operative term now has a definition anchored to it, which is what legal certainty requires in a criminal/quasi-criminal context.
主な根拠
- Self-contained, non-circular state-responsibility rule replaces the flawed Article 3.1 cross-reference and requires knowledge plus substantial contribution, avoiding strict liability from contracts or licences alone.
- Jurisdiction over non-state actors, private military companies, and individuals is now defined through concrete territorial, nationality, incorporation, and effective-control links, paired with a named adjudicative forum and due-process package.
- Core terms (AI system, deploy, civilian, widespread or systematic attack, persecution) are defined and the prohibited conduct is limited to three exhaustively stated categories with a causation and mental-element requirement.
- The information-operations mens rea now covers knowing or consciously reckless facilitation of imminent mass violence, closing the prior loophole without collapsing into negligence-based liability that would chill protected speech.
- Article 3.7 is concurrently amended so a final Article 3.6 finding triggers automatic, proportionate, sunset-limited non-kinetic enforcement, closing the prior enforcement vacuum.
- Explicit safeguards for journalism, research, advocacy, political association, and humanitarian activity, plus a decoupling from Article 3.2 self-defence limits, reduce the risk of misuse against protected conduct.
平和・共存・人類存続への影響
The amendment meaningfully strengthens the treaty's capacity to deter and remedy AI-enabled mass civilian harm perpetrated by non-state armed groups, private military contractors, and independent actors — closing a real accountability gap in the prior text, which was readable as state-centric. Coupled with defined jurisdiction, procedural safeguards, and a calibrated enforcement ladder, this should improve both the credibility and the legitimacy of enforcement, supporting the treaty's core peace-and-survival objectives without unduly threatening lawful expression or civil AI use.
残存リスク
- Proof of 'material contribution' and 'conscious disregard' in fragmented, multinational AI supply chains will be evidentially difficult and will require careful judicial development over time.
- Enforcement against non-state armed groups and entities outside any member state's effective control remains dependent on state cooperation and the wider treaty enforcement architecture.
- The boundary between protected political/expressive activity and a prohibited 'information operation' will require careful case-by-case judicial application to avoid both over- and under-enforcement.
- Uneven domestic implementation capacity among member states could produce inconsistent enforcement absent close World Court oversight.
再監査の条件
- Revisit after the first several World Court proceedings under this Article to confirm the 'material contribution' and 'conscious disregard' standards are being applied consistently and are not chilling protected journalism, research, or advocacy.
- Confirm that Chapter 5's detailed procedural provisions, once supplied, remain consistent with and do not undercut the due-process and evidentiary standards now embedded directly in Article 3.6.
- Monitor whether the 90-day sunset and renewal mechanism for Article 3.7 measures under Article 3.6 findings functions as an effective check against indefinite or disproportionate sanctions.
adjudication openai · gpt-5.6-terra
裁定
revision_required
確信度
84
理由
The revision substantially improves the current Article 3.6 and addresses the central need to make the prohibition applicable to non-state armed groups, private military and security companies, contractors, corporations, and independent natural persons. It supplies meaningful jurisdictional links, separates state responsibility from Article 3.1 aggression, establishes mens rea and material-contribution requirements, protects legitimate expression and civil activity, and provides adjudicative and remedial safeguards. Its incorporation into Article 3.7 also corrects the prior enforcement gap.
It should nevertheless not enter the law in its present form because its central operative structure contains a material internal inconsistency. Paragraph 1 prohibits a person subject to jurisdiction from "deploy[ing] an AI system" to commit or facilitate the specified attack, and paragraph 1(b) defines deployment narrowly as activation, operation, placing into operational service, or exercising substantial operational control. Yet paragraph 2(c), described as a category of "prohibited conduct under paragraph 1," extends to designing, financing, materially distributing, and exercising operational control over an AI-generated information operation. Designing, financing, and distribution are not deployment under the express definition. This creates uncertainty over whether those acts are independently prohibited or only prohibited when performed by a person who also deploys the system. The uncertainty is especially consequential because the stated purpose of the amendment is to reach outsourced and intermediary conduct.
The information-operation limb also needs further precision. It relies on the phrase "imminent widespread or systematic violence," while the defined term is "widespread or systematic attack," with a definition tied to multiple acts against civilians pursuant to an organisational or state policy. The relation between those terms is unclear. Further, "AI-generated information operation" is not defined. In an area implicating political expression, journalism, association, and the distribution of general-purpose technology, the threshold must be objectively ascertainable. The safeguards in paragraphs 3 and 4 are important, but they do not fully cure uncertainty in the operative offense.
These are fixable drafting defects rather than grounds to reject the policy. The Article should be revised to establish a clear chapeau that prohibits each specified form of conduct—deployment, design where materially connected, financing, distribution, and operational control—subject to the appropriate causal and mental elements. It should separately define, or expressly cross-apply defined elements to, an AI-generated information operation and the required imminent violence threshold. With those corrections, the amendment would provide a substantially stronger, more enforceable, and rights-protective rule.
It should nevertheless not enter the law in its present form because its central operative structure contains a material internal inconsistency. Paragraph 1 prohibits a person subject to jurisdiction from "deploy[ing] an AI system" to commit or facilitate the specified attack, and paragraph 1(b) defines deployment narrowly as activation, operation, placing into operational service, or exercising substantial operational control. Yet paragraph 2(c), described as a category of "prohibited conduct under paragraph 1," extends to designing, financing, materially distributing, and exercising operational control over an AI-generated information operation. Designing, financing, and distribution are not deployment under the express definition. This creates uncertainty over whether those acts are independently prohibited or only prohibited when performed by a person who also deploys the system. The uncertainty is especially consequential because the stated purpose of the amendment is to reach outsourced and intermediary conduct.
The information-operation limb also needs further precision. It relies on the phrase "imminent widespread or systematic violence," while the defined term is "widespread or systematic attack," with a definition tied to multiple acts against civilians pursuant to an organisational or state policy. The relation between those terms is unclear. Further, "AI-generated information operation" is not defined. In an area implicating political expression, journalism, association, and the distribution of general-purpose technology, the threshold must be objectively ascertainable. The safeguards in paragraphs 3 and 4 are important, but they do not fully cure uncertainty in the operative offense.
These are fixable drafting defects rather than grounds to reject the policy. The Article should be revised to establish a clear chapeau that prohibits each specified form of conduct—deployment, design where materially connected, financing, distribution, and operational control—subject to the appropriate causal and mental elements. It should separately define, or expressly cross-apply defined elements to, an AI-generated information operation and the required imminent violence threshold. With those corrections, the amendment would provide a substantially stronger, more enforceable, and rights-protective rule.
主な根拠
- The amendment appropriately extends Article 3.6 to non-state armed groups, private military or security companies, contractors, corporations, and independent persons subject to defined jurisdiction.
- Paragraphs 6 through 11 provide significant improvements in jurisdiction, state attribution, due process, standards of proof, corporate liability, remedies, interim measures, and review.
- The new Article 3.7 linkage supplies proportionate and reviewable non-kinetic consequences following a final Article 3.6 finding.
- Paragraphs 1 and 2(c) conflict: the defined term "deploy" does not include designing, financing, or materially distributing, although paragraph 2(c) purports to prohibit those acts under paragraph 1.
- The undefined phrase "AI-generated information operation" and the mismatch between "widespread or systematic violence" and the defined "widespread or systematic attack" leave an insufficiently precise boundary for speech-sensitive liability.
平和・共存・人類存続への影響
If corrected, the proposal would materially strengthen protection of civilian populations by preventing states and private or armed intermediaries from evading AI-related atrocity prohibitions through outsourcing, fragmented supply chains, or deniable support. Its safeguards for lawful expression, research, humanitarian work, and ordinary civil AI uses are also important to peaceful coexistence. In its current form, however, ambiguity over intermediary liability and information operations could undermine both enforcement against serious harms and confidence that protected activity will not be chilled.
残存リスク
- Technical evidence may not reliably establish whether a designer, funder, distributor, or platform materially enabled a particular prohibited operation.
- The distinction between protected advocacy and a prohibited AI-generated information operation will require particularly careful judicial fact-finding.
- Enforcement against armed groups and entities outside member-state cooperation may remain practically difficult.
- The preventive duty in paragraph 7 should be applied narrowly so that it does not become an indirect general monitoring obligation.
- The scope and compatibility of automatic Article 3.7 measures will depend on the content of Article 4.9A, which is not supplied here.
再監査の条件
- Revise paragraph 1 so that the operative prohibition expressly covers every conduct type intended to be prohibited in paragraph 2, rather than limiting the chapeau to "deploy[ment]."
- Clarify whether design, financing, distribution, and operational control create direct liability only when they materially contribute to the specified attack or violence and the applicable mens rea is established.
- Define "AI-generated information operation," or replace it with objectively bounded language that identifies the relevant conduct and causal connection.
- Define "imminent widespread or systematic violence" or expressly state its relationship to the definition of a widespread or systematic attack and to the organisational-or-state-policy requirement.
- Confirm that the expression safeguards remain operative at every stage, including interim measures and Article 3.7 enforcement.
adjudication google · gemini-3.6-flash
裁定
adopted
確信度
95
理由
The revised draft comprehensively addresses every critical vulnerability and fatal flaw identified in previous review rounds. It establishes a precise, self-contained standard for state responsibility, incorporates explicit jurisdictional bases and fair-trial guarantees for non-state actors, narrows and clearly defines prohibited conduct to prevent weaponisation against protected speech and civil activities, replaces the overly restrictive 'purposive direction' mens rea with an intent/knowledge/conscious disregard standard, and fully integrates final Article 3.6 findings into Article 3.7's non-kinetic enforcement ladder with robust sunset and judicial review safeguards.
主な根拠
- Successfully replaces the problematic cross-reference to Article 3.1 with a comprehensive, standalone state responsibility framework requiring effective control, instruction, or knowing substantial assistance.
- Provides a clear jurisdictional foundation for non-state actors (territorial, nationality, incorporation, target location, and effective control) along with rigorous due process standards, proof requirements, and corporate liability conditions.
- Exhaustively defines key terms ('AI system', 'deploy', 'civilian', 'widespread or systematic attack', 'persecution', 'material contribution', and 'conscious disregard') and includes explicit carve-outs for protected expression, academic research, journalism, and humanitarian activity.
- Rectifies the mens rea defect by covering intentional, knowing, and consciously reckless facilitation of mass harm while shielding mere negligence and general-purpose technology creation.
- Concurrently updates Article 3.7 to trigger proportionate, time-limited (90-day sunset), and reviewable non-kinetic enforcement measures upon a final World Court finding of an Article 3.6 violation.
平和・共存・人類存続への影響
Significantly strengthens global AI governance by extending enforceable legal prohibitions on AI weaponisation and mass civilian harm to non-state armed groups, PMCs, and commercial entities, while closing impunity gaps and providing clear, proportionate, and reviewable international judicial remedies.
残存リスク
- Evidentiary complexity in proving material contribution and conscious disregard across fragmented, multi-jurisdictional AI development and supply chains.
- Practical enforcement challenges against non-state armed groups operating outside the effective territorial control of compliant member states.
再監査の条件
- Any future amendment that attempts to lower the mental element below conscious disregard to simple negligence, which could endanger open-source AI development and legitimate civil research.
- Any proposed alteration to the procedural safeguards, standard of proof, or 90-day review sunset mechanism under Article 3.7 enforcement measures.