The 18th International Conference on Cyber Conflict (CyCon), hosted by NATO's Cooperative Cyber Defence Centre of Excellence (CCDCOE) in Tallinn from May 26–29, drew nearly 800 participants from 50 countries under the theme "Securing Tomorrow." Its published proceedings — 21 peer-reviewed papers selected from roughly 200 submitted abstracts across legal, strategy-and-policy, and technical tracks — put a sharp point on a question NATO members have mostly dodged: does the law of armed conflict actually constrain how militaries buy and field AI, or is it silent right when it matters most?
The legal track's answer, drawn from papers on military AI procurement and the risk that autonomous systems in armed conflict violate established legal principles, is reassuring on paper. As legal scholars at West Point's Lieber Institute have argued, international humanitarian law (IHL) is "technologically neutral": the core obligations of distinction, proportionality, and precaution in attack apply whether a human or an AI-enabled system makes the targeting call. There is no lawless gap waiting for treaty-makers to fill.
The Case for Something More Than Existing Law
That is not a reason for complacency, and it's worth stating the strongest version of the opposing view before dismissing it. Since 2013, the UN's Group of Governmental Experts on Lethal Autonomous Weapons Systems (GGE on LAWS), operating under the 1980 Convention on Certain Conventional Weapons, has pushed toward binding rules precisely because general IHL principles are abstract and self-policed. In 2019 the CCW's high contracting parties endorsed eleven guiding principles affirming that IHL applies to LAWS and that human responsibility must be retained across a weapon's life cycle — but those principles are non-binding, and machine-learning systems that behave unpredictably in unfamiliar environments, as the Lieber Institute's own analysis warns, make case-by-case IHL compliance genuinely hard to verify after the fact. The GGE's push for a binding "rolling text" instrument, still under negotiation into 2025 with a review conference expected this year, reflects a real concern: legal review at the design stage is only as good as the state conducting it, and no outside party checks the homework.
Where Estonia's Own Record Complicates the Picture
That concern lands close to home. Estonia's Ministry of Defence published its first Defence Artificial Intelligence Strategy on April 15, 2026 — five weeks before CyCon's legal scholars convened a few kilometers away to debate exactly this question. The strategy is candid about its military ambitions: AI is meant to deliver "direct military advantages" by supporting decision-making and accelerating the targeting process, with a goal of systematic AI adoption capability by 2030 and 30–50% of the annual defence R&D budget steered toward it. What the strategy does not do is address international humanitarian law considerations at all. It is a capability document, not a compliance one.
That is not unique to Estonia — most NATO members' AI procurement roadmaps read the same way — but the juxtaposition is instructive. A state that hosts the alliance's premier legal forum on military AI, and is simultaneously accelerating its own targeting pipeline, has more reason than most to show its Article 36-style legal review is real rather than pro forma. Estonia's civilian AI approach offers a template worth extending: rather than writing bespoke AI statutes, its national strategy leans on voluntary procurement guidelines built from the EU's ethics guidelines for trustworthy AI, per the European Commission's AI Watch assessment. Applying that same logic — existing frameworks, executed with disclosed rigor — to defence procurement would do more for accountability than a new UN instrument that Russia, sitting across Estonia's border and bound by no CCW consensus it doesn't like, would never observe anyway.
The Proportionate Path
This is where the pro-innovation case holds up under its own steelman. A prescriptive new treaty on autonomous weapons would bind exactly the democracies already running legal reviews, while leaving adversaries unconstrained — a asymmetry that matters acutely for a frontline state whose defensive posture increasingly depends on AI-assisted targeting and decision support to offset a numerically larger neighbor. The CCW's own consensus-based structure means Russia can stall the rolling text indefinitely, so treating a binding instrument as the near-term fix is optimistic at best.
The better near-term move, consistent with what CyCon's own legal scholars are pointing toward, is transparency about the legal review process itself: publish the methodology, not the classified specifics, by which a state certifies that an AI-enabled targeting system meets distinction and proportionality standards before deployment. Estonia, having just adopted a defence AI strategy that skips the question entirely, has an obvious next move — and having convened the conference that surfaced the gap, an obvious reason to make it.