CSOAI - defence + national security

AI in defence and the EU AI Act - what is excluded, what still applies

Defence AI is the exception, not the rule, under the EU AI Act. The honest answer most sources get wrong: exclusively-military AI is carved out - but a lot of what defence organisations run is not exclusively military, and stays firmly in scope.

Key carve-out — The EU AI Act does NOT apply to AI systems placed on the market, put into service, or used exclusively for military, defence, or national-security purposes (Article 2(3)). The exclusion turns on exclusive purpose - not on who operates the system.

What is still in scope

  • !Dual-use AI also offered in civilian markets
  • !Non-military security, border, and migration-management AI (Annex III)
  • !Ordinary back-office AI - HR, procurement, finance - at a defence organisation
  • !General-purpose / foundation models used in defence contexts (GPAI duties)

What still governs it

  • +Classify each system: exclusively-military vs dual-use / civilian
  • +Apply the EU AI Act to everything not exclusively military
  • +Align military systems with national defence-AI strategy + NATO principles of responsible use
  • +Export controls, procurement governance, and classified-domain assurance

Questions, answered

Does the EU AI Act apply to military AI?

No. Article 2(3) excludes AI systems used exclusively for military, defence, or national-security purposes. The exclusion is about exclusive purpose, not about the organisation operating the system.

So are defence contractors fully exempt?

No. Dual-use AI, non-military security uses, and ordinary back-office AI at a defence organisation remain in scope. Only the exclusively-military systems are carved out.

What governs military AI instead?

National defence-AI strategies, NATO's principles of responsible use of AI, export controls, and procurement rules - plus classified-domain assurance. CSOAI's signed, offline-verifiable governance maps cleanly onto these without publishing anything sensitive.

The 2 Aug 2026 checklist ->Scan my readiness ->What a breach costs ->
Council OS — the EU AI Act for defence

Answers from published measurement, or it refuses. Your question is typed into the lobby — nothing sends until you press Ask.

Open Council OS

Deterministic pane commands · grounded /api/chat lane · consent checkpoint on consequential steps