The German Federal Ministry of Defence issued an AI concept for the Bundeswehr on 12 August 2026[1]. Page 14 of the public version says: "Human control is not the same as human interaction."[2] And one sentence later: "not every use of an effectorEFFECTORMilitary term for anything that acts on a target, from a shell to a drone. The German original uses the official term "Wirkmitteleinsatz". necessarily requires human interaction." (Both quotes are our translation of the German original.) A German ministry document thus states what manufacturers have been advertising as a capability for years. In a growing number of cases, whoever launches an attack drone today no longer selects an individual target. They approve an area, a time window and a desired effect. This article reads what data sheets, tenders, a stock market prospectus and two budget decisions say about it.
01What gets approved today
Before launch, the operator sets an area, a duration and a desired effect. Which object within it is attacked is then decided by the software. The people involved have several words for this. At Israel Aerospace Industries the area is called the "Loitering Area", as documented by Automated Decision Research[3], the research unit of the Stop Killer Robots campaign, which calls for a ban on such weapons. US procurement says "desired effects", the Ukrainian swarm software Swarmer "target zone"[4].
On 13 January 2026, the US procurement office Defense Innovation Unit and a Pentagon unit for autonomous warfare launched a competition worth up to $100 million[5]. It seeks software that people can command "through plain language that expresses desired effects, constraints, timing, and priorities". The command refers to the effect; the individual target does not appear in the sentence.
For its Bolt-M attack drone, Anduril lists "where to look" as the first of four operator decisions[6]. No source from the company that we could access says whether this becomes approval to use weapons in that area: the product pages deliver only JavaScript without readable text, and the company blog answered our requests with HTTP 403.
The German manufacturer Helsing describes the mission control of its HX-2 drone in a specialist article of 10 November 2025 as satellite-independent navigation "with terrain-based positioning and subsequent automated target confirmation" (our translation)[7]. We could not obtain a first-hand statement from Helsing: its website rejected five attempts between 5 and 9 September 2026 with HTTP 429.
02The Red Cross yardstick
The International Committee of the Red Cross (ICRCICRCInternational Committee of the Red Cross, Geneva. Guardian of international humanitarian law and the Geneva Conventions. Its interpretation carries great weight but is not law.) measures by a single question: does the human know the specific target? In its position paper of December 2025, it describes an autonomous weapon system as one that, after activation by a human, triggers an attack itself as soon as sensor data match a generalised target profile[8]. The operator then knows neither which object will be hit, nor when, nor where.
By this standard, systems that are not usually called autonomous are autonomous too. The paper lists mines, sensor-fuzed munitions, certain loitering munitionsLOITERING MUNITIONAn aircraft carrying an explosive charge that circles over an area and waits until it finds or is assigned a target. Also called a kamikaze drone., close-in defence systems on ships and active protection systems on tanks as autonomous weapon systems already in use.
Conversely, much that looks spectacular falls outside it. According to the same paper, autonomy in parts of a weapon system other than target selection does not make it autonomous: a drone that navigates by itself and flies on its own to a target selected by a human is not one. How differently the same terms are interpreted by the military and civil society is shown in our article on the Pentagon's contract with OpenAI.
03The principle is older than artificial intelligence
Israel Aerospace Industries has been selling area approval as an advantage for more than forty years. The first paragraph of the HARPY data sheet, dated October 2025, reads: "With over 40 Years of field operational experience combining capabilities of a UAV and a missile, HARPY searches, identifies, acquires, attacks and destroys enemy radar targets. As a fully autonomous and independent weapon system, HARPY is highly effective against a wide spectrum of modern air defense systems."[9]
On the product page, IAI adds that HARPY can launch without prior knowledge of the target's location and stay in the area of operation for up to nine hours[10]. This is the case the Red Cross describes, and it is older than any current AI model: HARPY has been in the field since the 1980s, and the 2025 paper lists "certain loitering munitions" among the autonomous weapon systems already in use.
The same manufacturer separates operating modes within one product line. The HAROP data sheet, also dated October 2025, lists "Man-in-the-loop attack, avoiding collateral damage" among its highlights, one line about "Autonomous platform operation", and in the body text calls the drone "supervised by remote human-in-the-loop mission control"[11]. According to the sheet, it searches for targets without prior reconnaissance "in a designated area". On the HARPY sheet, same month, same sender, a human in the loop does not appear.
What is actually new
What has grown since are the numbers, the budgets and the areas of operation. According to Breaking Defense on 21 April 2026, the budget of the responsible Pentagon unit for autonomous warfare rises from $225.9 million in fiscal year 2026 to $54.6 billion in the request for fiscal year 2027[12]. Of this, $53.6 billion is to come through a reconciliationRECONCILIATIONA procedure in the US Congress for budget laws that can pass the Senate by simple majority. Such funds sit outside the annual defence budget. package and $1 billion from the base budget. Defense One reported the same order of magnitude on 4 May 2026[13].
Palantir itself put a figure on how far the number of people involved is shifting, at its in-house conference on 12 March 2026: one of the company's architects said there, as reported by The Register, that targeting used to occupy around 2,000 intelligence officers and is now handled by around 20 operators[14]. How the company handles this role is covered in our article on Palantir.
04What Germany has put in writing
The sentence from the AI concept sits in a paragraph that opens with a commitment. Immediately before it, the document states that Germany has made a political commitment to ensure context-appropriate human judgement over the use of military force, with a footnote referring to the Paris Declaration of 11 February 2025[2].
The qualification names two settings. It goes on, in our translation: "In air combat situations or at sea, i.e. far away from civilians and infrastructure, the necessary level of human interaction may be lower than in deployments in urban areas, for example."
What control should look like instead is set out in section 3.3.5 on page 31. Germany and France list nine conditions there, explicitly not exhaustive, including defined rules of engagement, a precise mission framework with target types, duration and area of operation, and the legal weapons review under Article 36 of Additional Protocol I. None of them requires a human to approve each individual strike. All of the conditions listed take effect before deployment.
On 5 September 2025, the same two states were among the 42 signatories of a joint statement in the UN expert group saying the negotiating text was mature enough to serve as the basis for negotiations on a treaty on autonomous weapon systems[15]. The Stop Killer Robots campaign has documented its wording. Alongside this, the nine conditions set out when, for the same states, a deployment without approval of each strike still counts as being under human control.
Almost six months earlier, the Bundestag's budget committee had approved the matching procurement. On 25 February 2026 it released two framework contracts for loitering munitions; the defence blog Augen geradeaus! has published the committee's resolution in full, and none of its five conditions concerns human control or target selection[16]. The trade journal ESuT puts the volume at around €4.3 billion and the first call-off at 4,300 HX-2 systems from Helsing and 2,200 Virtus systems from Stark[17].
Eight months before the AI concept, the Bundeswehr sounded different. Its report on a swarm trial at the combat training centre of 8 December 2025 describes a chain from search to engagement and then states: "A human then decides whether and how the target is engaged." (our translation)[18] Both texts come from within the same ministry.
"The operator used to steer the drone actively as pilot-in-the-loop. Today, his role is shifting to operator-on-the-loop."— Niklas Köhler, co-founder of Helsing, in Europäische Sicherheit & Technik (10 November 2025, our translation) [7]
05The same documents say a human approves
Alongside area approval, the same body of documents also contains passages in which a human approves the strike.
The manufacturer Allen Control Systems writes on the product sheet for its autonomous gun turret that the device detects, tracks, identifies and acquires targets by itself, "only requiring an operator command to fire"[19]. Firing therefore requires a command. On the same company's general capabilities page this addition is missing; it only says the turret detects, identifies and neutralises hostile drones[20].
An Anduril Fury, type designation YFQ-44A, fired a live missile for the first time over the Mojave Desert; it appears under the same name in our article on the Pentagon's contract with OpenAI. Anduril describes the sequence in a statement quoted by The War Zone: "our Lattice software ingested a target track, an operator tasked the aircraft to engage the target"[21]. Military Times recorded the rule behind it on 15 July 2026: the decision to release a weapon remains "with a human operator who has command and control of the platform at all times"[22]. Neither account gives a test date, and we could not access the Department of Defense release the report is based on (HTTP 403).
Further evidence is found in procurement documents. In the $100 million tender that mentions the desired effects, the head of the responsible Pentagon unit calls the human the "ethical decision maker" in the same text, who must understand at all times what the system is doing and why[5]. With the Maven Smart System, human analysts remain responsible for checking the labels generated by the AI, according to an analysis by CSIS of 2 June 2026[23]. And on the German loitering munition systems, the trade coverage of the procurement says the operator steers until they trigger the engagement[17].
And the approval itself can become empty. Nilza Amaral of the British institute Chatham House warns in an overview in Arms Control Today of May 2026 about "automation bias", the tendency to follow what the machine displays[24]. Target approval then risks becoming a mere formality. How far AI systems make their own decisions and override stop commands is covered in our article on AI autonomy. The same overview gives the scale involved: according to the White House, the US military struck more than 13,000 targets in the first 38 days of the war against Iran.
06The promise depends on a rule being rewritten
With Anduril's Bolt-M attack drone, a human stays in the loop, at least until the attack order is final. The War Zone's coverage describes this as "in line with U.S. Department of Defense protocol"[6]; we could not access an Anduril text making the same link. The rule in question is Directive 3000.09, which, unlike the Red Cross, focuses on the operator: autonomous, under it, is a system that selects and engages targets "without further intervention by an operator"[26].
This directive is to be rewritten. Presidential memorandum NSPM-11 of 5 June 2026 orders in section 3(a) that the Secretary issue an update within 90 days, citing the pace of AI development[25]. The deadline expired on 3 September 2026.
On 5 September 2026, we opened the Pentagon's issuance file in an ordinary browser[26]. The cover page still shows the version of 25 January 2023, and the line "Incorporating Change", with which the department marks incorporated amendments, is missing. This documents the public status on that day. It does not prove that no new version exists: a non-public version or an unannounced extension of the deadline remain possible.
07What cannot be resolved
Whether the best-known field case falls under the Red Cross definition depends on a single phrase. The same account of the Ukrainian swarm software Swarmer says the operator sets a target zone and, two lines later, that they mark targets in the reconnaissance video, both in the same write-up of 17 September 2025[4]. Only the machine's share is undisputed there: the group decides which bomber drone drops when, staggered by distance, battery level and remaining munitions. The contradiction cannot be resolved from publicly available sources. We examined how reliable reports from the Ukrainian battlefield are in detail, using the ground robot attack of April 2026, in a German-language article.
The same contradiction appears in the stock market prospectus, there addressed to a regulator. Swarmer has been traded on Nasdaq since 17 March 2026; the prospectus is dated 16 March[27]. On page 64, the company assures the US Securities and Exchange Commission that it designed its products with a "human-in-the-loop architecture ensuring human operators maintain authority over lethal force decisions", and promises that operators can override the use of weapons. In the same document, the drones running the Trident operating system are said to operate "at varying degrees of autonomy depending on each end-user's requirements and tactics"; the degree of autonomy is therefore a customer setting. Both statements are in a document filed with the regulator. It says nothing about international humanitarian law.
08What happens in November
The UN expert group on lethal autonomous weapon systems concluded its work in Geneva on 5 September 2026, after a three-year mandate. According to Human Rights Watch, the final report was considerably weakened because Russia and the United States watered down widely supported passages[28]. It states that human control and human judgement are needed for such systems to comply with international law; a record number of states support negotiations on binding rules.
One term is in dispute. A majority of states call for "meaningful human control". The negotiating text instead speaks of "human judgment and control" and, according to former US delegation lawyer Jessica Thibodeau, explicitly states that this does not mean constant direct human control[29]. More than 70 states support the same text as a basis for negotiations. If the conference makes no progress, observers consider a move to another UN forum likely.
The decision will be made at the Seventh Review Conference of the CCWCCWThe UN Convention on Certain Conventional Weapons of 1980, which restricts weapons such as landmines and blinding lasers. Autonomous weapons have been discussed under it since 2014., the UN weapons convention. Three paths are open: a mandate to negotiate a legally binding instrument, an extension of the mere discussion mandate, or letting the process lapse. The conference meets from 16 to 20 November 2026 at the Palais des Nations in Geneva.