The EU AI Act, the world's first comprehensive AI regulation, appears to have a simple answer for the defence sector: it does not apply. Article 2(3) carves out all AI systems placed on the market or put into service "exclusively for military, defence or national security purposes, regardless of the type of entity carrying out these activities." That sentence has been widely read as a clean exemption. The reality is considerably more complicated — and increasingly so as the boundary between civilian and military AI dissolves.
Understanding the Act's relevance to defence requires engaging with what the exemption actually covers, where it stops, and what governance pressure is accumulating in the spaces it leaves behind. For defence startups, for prime contractors, for ministries of defence, and for the public that defence systems ultimately protect, the stakes of getting this wrong are not administrative.
The architecture of the exemption
The logic behind the exclusion is constitutional rather than political. National security is explicitly reserved to Member States under Article 4(2) of the Treaty on European Union, and the Act's drafters did not attempt to override that competence. Military AI, the argument goes, is better governed by public international law — specifically, International Humanitarian Law — than by a civilian digital regulation built around product safety and fundamental rights.
Yet Recital 24 of the Act introduces three scenarios that immediately complicate the clean exemption. First, an AI system developed for military purposes that is later used, even temporarily, for civilian purposes falls within the Act's scope — and whoever changes that purpose must assume the obligations of a provider. Second, a system designed for civilian use that is subsequently used for military purposes does not fall under the Act for that military use, but the civilian version remains fully regulated. Third, and most consequential in practice: AI systems built for both civilian and military purposes — i.e., genuine dual-use systems — are subject to the Act for all non-military use cases.
The critical word throughout is "exclusively." The exemption is not a sector exemption — it does not attach to companies or industries. It attaches to specific systems, and only if their intended purpose is solely military or national security. A drone manufacturer that sells the same platform to the army and to border surveillance agencies cannot invoke the defence exemption for its entire product portfolio. A network monitoring tool built for the civilian mass market and later purchased by a ministry of defence remains subject to the Act because its original intended purpose was not exclusively military.
This distinction has far-reaching consequences for most European defence companies, which operate precisely across this civilian-military boundary.
Dual-use problem
The most significant and underappreciated regulatory challenge for defence-related AI in Europe is not the Act itself — it is the difficulty of determining whether any given system actually qualifies for the exemption.
Modern defence technology is overwhelmingly civilian-derived. Unlike the last century's pattern, in which military research produced radar, the internet, and GPS as downstream civilian benefits, today's AI innovations originate predominantly in the commercial sector and migrate upward into defence applications. Computer vision developed for autonomous vehicles ends up in drone guidance systems. Large language models built for commercial search improve intelligence analysis. Communication software written for enterprise use is repurposed for tactical coordination. The EDA's May 2025 White Paper on Trustworthiness for AI in Defence acknowledges this directly, noting that the distinction between civilian and military AI applications is structurally unclear and that civilian AI innovation cycles often set the pace for defence capabilities.
European defence startups — the segment that has attracted significant investor attention since 2022, with VC investment in European defence and security startups reaching $5.2 billion in 2024, a 24% increase year-on-year — are almost invariably dual-use by design. Companies like Helsing (AI software for weapons systems) or INDRA's civilian-facing IndraMind division develop products that function in both domains. Any provider offering an AI system to both a civilian customer and to a ministry of defence must comply fully with the AI Act for the civilian use case, regardless of whether the military deployment enjoys exemption. This means risk management documentation, data governance frameworks, conformity assessments, and post-market monitoring obligations are activated even if the end deployment is a tank.
Three regulatory frameworks
The AI Act does not exist in isolation. It sits alongside the Cyber Resilience Act (CRA) and the NIS2 Directive, and the three frameworks apply different exemption tests to the same industrial reality.
The CRA, which governs cybersecurity for products with digital elements, applies the same "exclusively" test as the AI Act: a product is exempt only if the manufacturer designed it solely for national security or defence. The NIS2 Directive, by contrast, does not focus on intended use at all — instead, it focuses on the nature of the company. Private defence companies are, in principle, not exempt from NIS2 simply because their clients are militaries. Germany, for instance, has not fully implemented the optional national exemption for military suppliers, meaning private defence companies above the relevant thresholds must comply with NIS2's cybersecurity risk management and 24-hour incident reporting requirements regardless of what their products are used for. A defence company with €15 million in revenue manufacturing electronic sensor systems is subject to NIS2 — because it is a private company in a regulated sector, not because of what its products do.
The effect for a dual-use startup is three overlapping regulatory frameworks with three distinct exemption logics, none of which align cleanly with the others. Mapping compliance obligations requires analysing each product and each use case against all three frameworks simultaneously — a legal and operational burden that legal experts confirm is systematically underestimated by the companies affected.
Border control and law enforcement
While the military exemption removes the Act from the battlefield, a substantial portion of what is conventionally understood as security AI — border management, law enforcement analytics, surveillance — falls directly within the Act's scope and carries high-risk classification.
Annex III of the Act lists as high-risk, subject to full compliance obligations, AI systems used to assess risks posed by persons entering EU territory, to examine asylum and visa applications, to identify individuals in border contexts, and to operate biometric identification and categorisation systems. Recital 60 explains why: persons in migration and asylum proceedings are particularly vulnerable, often unable to contest AI-driven determinations, and the accuracy and non-discriminatory operation of these systems is essential to their fundamental rights. Any AI deployed by or on behalf of Frontex, national border agencies, or police for these purposes must comply with the Act's full high-risk framework — risk management, data governance, human oversight, conformity assessment, and registration in the EU AI database.
This is not hypothetical. Several EU-funded defence projects are already developing AI systems with explicit dual-use targeting of these domains. The EU-GUARDIAN project (€13.5 million, led by Spain's INDRA), for instance, builds AI-based automation for cyber incident management across military networks — the same company whose IndraMind system targets modernisation of civil infrastructure. The FaRADAI project (€18 million, involving HENSOLDT) develops adaptive AI for low-data military environments — and HENSOLDT produces mission computers that can integrate military sensors into civilian avionics. Whether the data practices, model architectures, and governance standards developed under classified military programmes can pass a civilian conformity assessment if the technology migrates remains an open question — and one that neither the EU Commission nor the EDF currently has a mechanism to track.
The governance gap
The most structurally significant consequence of the Act's military exemption is not legal — it is political. By declining to regulate AI used in lethal force contexts, the EU has created a zone of normative silence at precisely the moment when military AI capabilities are advancing fastest.
Lethal Autonomous Weapon Systems — systems capable of selecting and engaging targets without direct human intervention — are the sharpest version of this problem. The EU AI Act explicitly excluded them from its scope on the basis that International Humanitarian Law (IHL) is the appropriate framework. But no binding treaty on LAWS currently exists. The UN General Assembly adopted a resolution on autonomous weapons systems in December 2024, with 166 nations in favour, and the UN Secretary-General has called for a legally binding treaty by 2026 — a target that is not being met. In the interim, Europe's most consequential AI systems — those making targeting decisions in combat — operate without the transparency, traceability, or human oversight requirements that would apply to, for example, a hospital triage algorithm.
The European Parliament's Special Committee on Artificial Intelligence in a Digital Age (AIDA) has called for an outright prohibition on LAWS and for ethical guidelines covering defence AI, warning that the EU risks falling behind on military AI while also failing to govern it. This is an unusual double critique: insufficient capability investment and insufficient oversight, simultaneously.
The EDA's May 2025 Trustworthiness for AI in Defence White Paper attempts to fill part of this gap domestically. It introduces governance requirements for defence AI — including Requirement Identification, Mandatory Impact Analysis, and considerations around human-AI race conditions — that align closely with the AI Act's high-risk framework, even though the Act itself does not apply. In effect, the EDA is building a shadow compliance architecture for military AI that borrows the Act's logic without its enforcement mechanism. NATO's revised 2024 AI Strategy follows the same pattern, endorsing six Principles of Responsible Use — Lawfulness, Responsibility and Accountability, Explainability and Traceability, Reliability, Governability, and Bias Mitigation — that mirror AI Act obligations without creating binding obligations.
The coherence problem is that neither the EDA framework nor NATO's principles carry the same legal weight as the Act. A defence AI company can voluntarily adopt EDA trustworthiness requirements; it cannot be compelled to. And with no single EU institution maintaining centralised oversight of EDF-funded AI systems after project completion, there is no mechanism to verify that the governance commitments made at proposal stage are honoured through deployment.
The strategic context
The geopolitical context is making all of this more urgent. The EU's ReArm Europe / Readiness 2030 plan, announced by Commission President von der Leyen, mobilises up to €800 billion for European defence capability. The March 2025 European Defence Readiness White Paper identifies AI as one of seven priority capability areas and explicitly mentions the SAFE instrument — up to €150 billion in EU-backed loans for joint procurement — as a channel for AI investment. In January 2026, EU Commissioner for Defence Andrius Kubilius publicly acknowledged that Europe is "behind on investments" compared to the US and China in defence AI, while stressing a commitment to rapid acceleration.
The investment gap is stark in the data. EU Member States collectively allocate €14.4 billion annually to military research and development. The United States spends €130 billion — roughly ten times more. Google alone spends more on R&D than all 27 EU Member States combined in defence research. In 2023, private AI investment in the US reached €62.5 billion; in Europe (EU plus UK), the figure was €9 billion. The EU is accelerating from a deep deficit.
Against this backdrop, the AI Act's military exemption serves a specific strategic function: it is meant to ensure that the regulatory framework designed to govern commercial AI does not inadvertently constrain military AI development at the exact moment Europe is trying to close a capabilities gap. The concern is legitimate. But the consequence is that military AI — including systems that will directly affect human life on and off the battlefield — develops within a governance vacuum while the civilian sector operates under increasingly granular oversight. For a bloc that has staked its AI policy identity on human-centric, trustworthy, rights-respecting AI, this is a significant internal contradiction.
What needs to resolve
Three questions will determine how the regulatory picture develops over the next two to three years.
First, the dual-use classification question. Neither the European Commission nor national competent authorities have issued definitive guidance on how to classify AI systems that are developed for defence but used across civilian and law enforcement contexts. Until that guidance exists, companies operating in this space face legal uncertainty that is inherently expensive — not because compliance is impossible, but because its scope cannot be determined.
Second, the post-project oversight gap. EDF-funded AI systems are developed under EU programmes but deployed and operated by Member States, whose defence competences the EU cannot override. Once an EDF project concludes, there is no EU-level mechanism to track how AI systems are used, whether they are repurposed for civilian or law enforcement contexts, or whether they remain consistent with the human control requirements stipulated at funding stage. The EDA's trustworthiness framework provides a voluntary reference architecture, but voluntary frameworks without enforcement capability are, by definition, insufficient when the stakes include autonomous targeting decisions.
Third, the LAWS governance gap. The political decision to rely on International Humanitarian Law as the primary governance framework for lethal autonomous systems was made at a moment when binding IHL treaty negotiations on LAWS were still plausible. Those negotiations have stalled. Without a binding international framework, and with the AI Act having explicitly stepped back, military AI in Europe develops under guidance documents, procurement standards, and voluntary principles — architecturally identical to the pre-regulatory situation for civilian AI that the Act was designed to end.
The most direct response available to the EU would be what multiple analysts and the European Parliament's AIDA committee have proposed: a dedicated governance instrument for military AI that adopts the AI Act's core architecture — risk-based classification, transparency requirements, human oversight mandates, and accountability mechanisms — while respecting Member States' sovereignty over national security decisions. The Commission's published position as of April 2026 is that such an instrument remains under consideration. What is not under consideration is maintaining indefinitely a framework in which the EU's most consequential AI systems — those operating in contexts of lethal force — are also its least governed ones.
References
- EU AI Act, Article 2(3); Securiti: DSPM | Data Security | AI Security | PrivacyOps analysis of Article 2 scope.
- European Parliamentary Research Service. Sebastian Clapp. "Defence and Artificial Intelligence." EPRS Briefing, PE 569.580. April 2025.
- Lexify. Gambula, E., Borri, A. "AI Act in Defence: A True Exemption?" August 2025.
- Sierra Tango. "AI Act: What Impact for Defence?" March 2024.
- EU AI Act, Recital 24. Official text, July 2024.
- Verfassungsblog. "The AI Act National Security Exception." December 2024.
- Lutz Abel Rechtsanwalts. Schmidt, A., Vogt, N. "IT-related Legal Challenges for Defense Companies with Dual-Use Products." March 2026.
- Tech Policy Press. Besliu, R. "Europe's AI Act Leaves a Gap for Military AI Entering Civilian Life." March 2026.
- European Defence Agency. "Trustworthiness for AI in Defence (TAID) White Paper." May 2025.
- NATO. "Summary of NATO's Revised Artificial Intelligence Strategy." July 2024.
- Pinsent Masons. "A Guide to High-Risk AI Systems under the EU AI Act." 2024.
- Verfassungsblog. "Regulating AI at Europe's Borders." December 2024.
- AI Act Law. Recital 60: High-Risk AI Systems in Migration and Asylum.
- CMS Law. "Dual-Use Goods: Legal Guide for Defence-Ready Companies." August 2025.
- European Science Journal. "The EU AI Act, Lethal Autonomous Weapons, and the Imperative for Human-Centric AI." March/April 2026.
- ES Think Tank. "Towards Comprehensive Regulation: The EU's Stance on Autonomous Weapons and the Need for Reform." May 2025.
- ES Think Tank. "Blind Spots in AI Governance: Military AI and the EU's Regulatory Oversight Gap." October 2025.
- European Commission. Digital Strategy. "AI-enabled Dual-Use Tech and the Role of the EU's Startup Ecosystem." December 2025.
- Europeanrelations.com. "AI for Strategic Autonomy: Europe's Bid for AI Independence." February 2026.
- Dechert LLP. "EU Defense Market Entry: Challenges and Opportunities." March 2026.
- TRENDS Research. "Governing Lethal Autonomous Weapons in a New Era of Military AI." August 2025.