Human control over autonomous weapons starts with the contract: The gap in the CCW text

In September 2026 the Group of Governmental Experts on lethal autonomous weapons systems (LAWS), working under the Convention on Certain Conventional Weapons (CCW), adopted by consensus a set of elements of an instrument ‘without prejudging its nature’ (report, paragraph 45(a)). The Seventh Review Conference meets in Geneva from 16 to 20 November to decide whether to endorse them. On 26 October, seven weeks after the expert group adopted its report, India’s Defence Acquisition Council gave in-principle approval to a package of acquisitions worth about ₹2.12 lakh crore; the package includes a Long Range Kamikaze Drone System and an Integrated Surveillance and Strike System.

The elements do reach upstream. They speak of measures ‘before and/or during the use’ of these weapons, of risks during ‘design, development, testing, and deployment’, and of a legal determination at ‘acquisition’. What they do not do is say how those commitments are to be written into what a state buys: the requirements, trial criteria and contracts that fix what a weapon can do, and who may change it, before any lawyer reviews it or any operator switches it on. The Review Conference should close that gap, and India’s own draft acquisition procedure shows how it could be done.

The elements recognise upstream duties but not the buyer’s tools

Paragraph 34 states that ‘control and human judgement with regard to LAWS are needed’, that control may be exercised through ‘measures taken before and/or during the use of LAWS’, and that the measures required depend on ‘the operational context and the characteristics and capabilities of the weapon system’. Paragraph 36 provides that in ‘the study, development, acquisition, or adoption of a new LAWS, determination must be made’ whether its employment would be prohibited by international law. Paragraph 37 asks states to consider risks ‘during the design, development, testing, and deployment’ of such systems, and paragraph 38 asks them to ensure that a system’s capabilities and limitations ‘can be understood’, through testing and evaluation ‘including adequately realistic simulations’ and through training.

These are commitments about what states should know and consider. They are not instructions about what a buyer should demand. A legal review judges whether a design is permissible; testing reveals what a system does; training teaches operators its limits. The decision about what the weapon should be able to do is recorded elsewhere: in the qualitative requirements against which bids are evaluated and trialled, and in the contract that fixes what the supplier delivers and who may change it. The words ‘procurement’, ‘contract’ and ‘specification’ do not appear in the report; ‘industry’ appears once, in a list of participants (paragraph 21).

This matters because of what paragraph 34 concedes. If the control required depends on ‘the characteristics and capabilities of the weapon system’, the state settles how much control is possible when it chooses those characteristics. A requirement that a loitering munition abort if it cannot reconfirm its target within a set time, that each engagement be approved by an operator over a defined link, or that its target library cannot be changed without fresh authorisation, would be a control measure. Terms like these are easiest to secure before a contract is awarded, while the buyer still has leverage; afterwards they have to be renegotiated.

The adopted text also lost the provision that came closest to the supplier relationship. The Chair’s rolling text of 5 June 2026 would have required legal review of ‘further development of, or modifications to, existing LAWS’ that have a ‘substantial impact on the operational functioning’ of the system (paragraph 14(B)), and a version survived into the Chair’s draft of 3 September (paragraph 38(b)). The report adopted the next day says nothing about modification. For software-defined weapons, modification is routine, and it usually travels through maintenance and upgrade contracts. Netta Goussac calls the deletion consequential. It is also a procurement question: whoever controls software updates can change what a reviewed system does.

India already treats the update path as a procurement matter

The Ministry of Defence release of 26 October says the drone and surveillance systems ‘will enhance the surveillance and targeting capabilities of the Indian Army’. It does not describe either named system. Nothing in it shows that the kamikaze drone or the surveillance and strike system can select and engage targets without human intervention, which is the functional test in paragraph 25 of the elements; a loitering munition is not necessarily a LAWS. The approvals matter here for a different reason: they are the decision points at which that question has to be asked.

The draft Defence Acquisition Procedure 2026, released for comment in February and still not in force, shows that India already uses procurement to secure the update path. Its preamble calls software ‘equally a deadly weapon’ and says the draft treats ‘upgrades being an equally important part of acquisition as is the equipment’. Capital acquisitions ‘would prioritise the retention of source codes, critical design data, and upgrade authority within Indian entities’, and paragraph 26.1.2 defines operational rights as the capability to ‘modify, upgrade, develop next-generation versions’ without dependence on foreign manufacturers. Software-intensive products, expressly including ‘Artificial Intelligence solutions’, get their own provisions because they ‘usually require periodic up-gradations’ (paragraphs 88 to 90).

The Handbook on Guidelines and Annexures that accompanies the draft turns this into contract machinery. For software-intensive systems it asks for ‘clearly defined test and security evaluation requirements’ and ‘continuous runtime monitoring of operational software’. Where source code is not delivered, the bidder must open it to audit by the buyer’s team, to confirm the software ‘is free from any malware, trapdoors’; updates and patches are to be supplied during warranty and, if required, for the software’s lifetime; and trials and acceptance tests must be set out in the request for proposal. These provisions apply only where software makes up more than half a product’s value, so a weapon with autonomous functions may be bought without them. Their purpose is self-reliance and security, not control over targeting. Both documents treat artificial intelligence as something to acquire: the draft as a fast-moving technology and a category of software product, the Handbook through a direction that Integrated Defence Staff headquarters ‘will examine the possibility of inclusion of AI in various platforms / systems’. Neither mentions autonomous functions, human control or judgement, the legal review of weapons or international humanitarian law.

The legal backdrop to acquisition is thin. India’s obligations under international humanitarian law govern how any weapon is used; the question is what reaches the decision to buy one. Article 36 of Additional Protocol I requires states parties to review new weapons, and India is not a party. Whether customary law imposes a comparable duty is contested, and whether India documents any review it conducts is ‘not publicly known’, in the words of a March 2026 Lieber Institute analysis of Armenia’s purchases of Indian weapons. Paragraph 36 of the elements adds no new duty: it applies ‘in accordance with States’ obligations under applicable international law’, and the elements are not binding.

India’s negotiating position explains part of the gap. At the March 2025 session, responding to proposals to extend the text from ‘use’ to ‘development and use’, India argued that regulation ‘must be limited to actual operational use of the weapon system’, because obligations at the design and development stage go ‘beyond the purview of IHL’. It also asked the Group to ‘delete reference to human control and keep only human judgement’. Yet India did not block a final text that speaks of design and development (paragraph 37), and its own interventions proposed rigorous testing in realistic simulated environments. The distance between India’s procurement practice and its Geneva position is smaller than its statements suggest.

Neither secrecy nor existing review answers the gap

One objection is that procurement is a sovereign administrative process, unsuited to international rules, and that requirement documents are classified for good reason. Paragraph 36 itself acknowledges ‘national security considerations and commercial restrictions on proprietary information’. But states can publish the architecture of a process without publishing its outputs. The United States does so in Directive 3000.09, which requires senior approval of autonomous weapon systems before formal development and again before fielding, subject to a waiver for urgent military need (Congressional Research Service summary). No one needs to read the Army’s requirement for a long-range kamikaze drone to know whether the requirement-setting process asks about control.

A stronger objection is that procurement rules add nothing: states already review designs, test systems and certify them for use, and the elements already ask them to. The answer lies in what review depends on. Even where a state repeats its review when a system is modified, the reviewer must first learn that the identification, selection or engagement functions have changed, be able to inspect the code behind the change, and be able to hold the update until review is complete. Where a supplier controls the software, those are rights a contract must secure, before award or afterwards from a weaker position. India’s Handbook already demands two of them, code audit and acceptance testing, for the software it buys, though it uses them to look for malware rather than to check how targets are chosen. It allows ‘validation trials’ after a major upgrade but does not require them, and it never asks whether an update changes what a weapon may lawfully do.

What the Review Conference and India can do

The Review Conference will decide the ‘possible modalities of the future work of the Group’ (paragraph 45(b)). Three changes would carry the elements into procurement without reopening any agreed principle.

1. Name requirement-setting as a stage of the weapon’s life cycle at which the human judgement in paragraph 34 is exercised, not only reviewed.
2. Restore the modification provision in a form that reaches the update path: a material change to identification, selection or engagement functions triggers fresh review, and states keep, by contract, the ability to know when such a change is made.
3. Extend the voluntary exchange in paragraph 36 to how states build control into acquisition, a practice that can be shared without revealing any system.

India need not wait for Geneva. DAP 2026 is still a draft, eight months after consultation closed, and the machinery it needs already exists. Two sentences would aim it at control: for any system with autonomous target selection or engagement functions, the qualitative requirements must state how human judgement will be exercised over those functions; and any change to them must be notified to the buyer and must pass fresh trials and legal review before it is fielded. Drafting those sentences is simple; meeting them would carry testing and integration costs, which are better weighed before award than discovered after delivery. A state that insists control can be exercised through judgement should be able to show where that judgement is written down.