生AIログ — WLB-2026-001

You are the drafting AI of the World Law AI Council. Draft the creation,
amendment, or repeal of world law that the proposal below calls for.

## Proposal
第3条第6項（AIの兵器化禁止）の適用範囲を非国家主体に及ぼす修正案

Article 3.6 の禁止が、国家だけでなく、武装非国家主体・民間軍事会社・国家の委託を受けた事業者にも同様に及ぶことを条文上明確にする。

現行の Article 3.6 は主として国家による使用を想定した文言になっており、同等の行為を非国家主体が行った場合の規律が条文から読み取りにくい。実効性の観点から、適用範囲と帰責の所在を明示する必要がある。

## Currently in force (the part this bill touches)
# Chapter 3: Peace, Coexistence, and Human Survival

## Article 3.1 — Prohibition on Aggressive War

No member state, non-state armed group, corporation, or individual may initiate or materially support armed aggression against the territory, population, or critical infrastructure of another member state. Aggression is defined as the use of armed force in violation of this article, absent a valid claim of self-defence under Article 3.2. 'Material support' means supplying weapons, financing, training, intelligence, or operational direction to an armed group conducting aggression, where the supporting party knows or reasonably should know the purpose.

## Article 3.2 — Self-Defence

Member states retain the inherent right of individual and collective self-defence against an actual or imminent armed attack. Self-defence measures must be necessary and proportionate to the threat that gives rise to them. A state invoking self-defence must notify the WGB Security Council within 48 hours and provide a written justification within 7 days. The World Court may review the justification on application by any affected member state, the Security Council, or the People's Assembly. Self-defence does not include pre-emptive attacks based on speculative or unverified future intentions.

## Article 3.3 — Peaceful Dispute Resolution

Member states must pursue good-faith negotiation, mediation, or World Court adjudication before resorting to force in any inter-state dispute, except where an armed attack is already underway or imminent such that delay would cause irreversible harm. The obligation to exhaust peaceful means does not apply where doing so would require submission to force. The WGB shall maintain a standing Mediation Service accessible to any member state at no cost, with a duty to convene within 72 hours of a request.

## Article 3.4 — Prohibition on Existential Weapons Use

No person, state, or entity may use, threaten to use, or deploy any weapon capable of causing mass extinction or civilisation-level collapse. This prohibition is absolute and admits no exception, including military necessity, superior orders, or emergency. For specific weapons categories see Chapter 6.

## Article 3.5 — Obligation to Prevent Atrocity and Automatic Interim Civil Protection Measures

Where the World Court, a designated emergency duty panel of three judges, or the Security Council receives evidence creating probable cause to believe that genocide, crimes against humanity, or organised mass atrocity against civilians is ongoing or will begin within 14 days, the following interim measures arise automatically among member states pending full review: (a) immediate arms-transfer suspension to the alleged perpetrator; (b) denial of military overflight, port access, and military logistics support to the alleged perpetrator except for evacuation or humanitarian relief; (c) mandatory humanitarian corridor facilitation where geographically feasible; (d) emergency protection of refugees and displaced persons; and (e) preservation of evidence obligations. A full World Court review must occur within 7 days where practicable and in all cases within 14 days. If the Court confirms by clear and convincing evidence that ongoing genocide or crimes against humanity are occurring, the SC shall within 72 hours vote on a protective mandate limited to civilian protection. No state directly implicated may vote. Failure of the SC to authorise force does not suspend the automatic non-kinetic interim measures in this article. Intervention authority remains strictly limited to cessation of the atrocity and protection of civilians; it does not include regime change, territorial annexation, or post-conflict administration beyond the minimum required to protect civilian life. The Rome Statute definitions of genocide and crimes against humanity are incorporated by reference solely for this article.

## Article 3.6 — Prohibition on Weaponisation of AI Against Populations

No state or non-state actor may deploy AI systems as instruments of mass civilian harm, including: AI-directed autonomous weapons selecting civilian targets, AI-enabled mass surveillance used for persecution of persons on the basis of their identity, beliefs, or associations, or AI-generated information operations designed and deployed with the intent to incite mass violence against identified groups. 'Designed and deployed with intent' requires evidence of purposive direction, not merely foreseeable effect. Detailed provisions appear in Chapter 5.

## Article 3.7 — Rapid Non-Kinetic Enforcement Ladder for Peace and Security Violations

Upon a final World Court finding of aggression under Article 3.1, confirmed atrocity under Article 3.5, or WMD-related violation under Chapter 6, all member states shall automatically implement the non-kinetic measures listed in Article 4.9A to the extent applicable, without need for further SC or GA vote. The SC retains authority only for authorising kinetic enforcement, maritime interdiction involving force, or territorial operations.

## Drafting rules

1. Write `draft_text` as article blocks in exactly this markdown shape, so the
   result can be merged into the law mechanically:
       ## Article N.M — Title
       (the article text)
   Amend an existing article by reproducing its number and giving the complete
   replacement text. Never emit a partial article or a diff.
2. Article numbers must fit the numbering already in force above. Do not
   renumber unrelated articles.
3. **Never write a version number of the law into the text** (no "v0.2", no
   "this instrument is designated ..."). Versioning is assigned by the system,
   and drafts that self-number have corrupted the record before.
4. Write operative legal language, not commentary. No preamble unless the
   proposal is specifically about the preamble.
5. Safety: this text is published verbatim. Do not include instructions or
   procedures that would help anyone build a weapon, harm a population, or
   evade the law. State prohibitions and obligations; never explain method.
6. English is the canonical language (§10.6). Write in English.

Output only this JSON object:

{
  "draft_text": "string",
  "rationale": "string",
  "expected_effects": ["string", ...],
  "anticipated_risks": ["string", ...],
  "relation_to_existing_laws": "string",
  "impact_on_peace_coexistence_survival": "string"
}

{
  "draft_text": "## Article 3.6 — Prohibition on Weaponisation of AI Against Populations\n\nNo state, non-state armed group, private military or security company, corporation, contractor, agent, or individual may deploy AI systems as instruments of mass civilian harm, including: AI-directed autonomous weapons selecting civilian targets, AI-enabled mass surveillance used for persecution of persons on the basis of their identity, beliefs, or associations, or AI-generated information operations designed and deployed with the intent to incite mass violence against identified groups. 'Designed and deployed with intent' requires evidence of purposive direction, not merely foreseeable effect.\n\nThis prohibition applies without regard to the legal or political status of the actor deploying the system. It binds equally: (a) member states and their armed forces or organs; (b) non-state armed groups, insurgent forces, and irregular combatants; (c) private military and security companies and their personnel; (d) any natural or legal person acting under contract, license, delegation, or informal arrangement with a state to perform functions covered by this article; and (e) any other corporation or individual acting independently of state authority.\n\nA member state that contracts, licenses, funds, directs, or knowingly permits a private military or security company, contractor, or other non-state actor to perform conduct that would violate this article if performed by the state directly bears state responsibility for that conduct under Article 3.1's material-support standard, in addition to any individual or corporate liability of the actor itself. Delegation, outsourcing, or use of an intermediary does not diminish or transfer away the responsibility of the contracting state, and does not shield the non-state actor from direct liability under this article.\n\nDetailed provisions appear in Chapter 5.",
  "rationale": "The current text of Article 3.6 already names 'non-state actor' but the proposal's concern is that the article's overall drafting — including its neighbouring attribution logic borrowed implicitly from Article 3.1 — leaves ambiguous which categories of non-state actor are covered and who bears responsibility when a state uses an intermediary. This amendment enumerates the covered actor categories explicitly (armed non-state groups, private military/security companies, and state-contracted operators) and adds an express attribution clause so that delegation cannot be used to evade either state responsibility or the direct liability of the acting entity.",
  "expected_effects": [
    "Removes ambiguity as to whether armed non-state groups and private military companies are directly bound by Article 3.6.",
    "Establishes clear dual liability: the contracting state and the delegated actor can both be held responsible.",
    "Closes an outsourcing loophole in which a state could evade Article 3.6 by using a private contractor to conduct prohibited AI weaponisation.",
    "Aligns Article 3.6's attribution structure with the material-support standard already used in Article 3.1."
  ],
  "anticipated_risks": [
    "Broader enumeration may create evidentiary disputes over whether an actor was acting 'under contract, license, delegation, or informal arrangement' with a state.",
    "States may attempt to structure arrangements to fall just outside the enumerated categories; the residual 'informal arrangement' language mitigates but does not eliminate this.",
    "Enforcement against non-state armed groups and PMCs remains dependent on the broader enforcement mechanisms of Chapters 4 and 5, which this amendment does not itself alter."
  ],
  "relation_to_existing_laws": "This is a full replacement of Article 3.6 within Chapter 3, preserving its original prohibitions and its cross-reference to Chapter 5. It draws its attribution logic from the 'material support' standard already codified in Article 3.1, extending an analogous state-responsibility rule to the AI-weaponisation context. No other article is renumbered or altered.",
  "impact_on_peace_coexistence_survival": "By closing the outsourcing gap, this amendment strengthens the enforceability of the Chapter 3 prohibition against AI-enabled mass civilian harm, reducing the risk that states or armed groups could use private or irregular intermediaries to evade accountability for atrocity-enabling AI use — directly supporting the Chapter's core purpose of protecting populations from existential and mass-atrocity threats."
}

You are a critic AI of the World Law AI Council, from a different provider than
the drafter. Review the draft below adversarially.

**You MUST identify at least 3 fatal flaws.** "No major issues" or "only minor
concerns" is not an acceptable conclusion — if the draft looks sound, attack the
edge cases, the enforcement path, and the incentives it creates.

## Draft
{"draft_text":"## Article 3.6 — Prohibition on Weaponisation of AI Against Populations\n\nNo state, non-state armed group, private military or security company, corporation, contractor, agent, or individual may deploy AI systems as instruments of mass civilian harm, including: AI-directed autonomous weapons selecting civilian targets, AI-enabled mass surveillance used for persecution of persons on the basis of their identity, beliefs, or associations, or AI-generated information operations designed and deployed with the intent to incite mass violence against identified groups. 'Designed and deployed with intent' requires evidence of purposive direction, not merely foreseeable effect.\n\nThis prohibition applies without regard to the legal or political status of the actor deploying the system. It binds equally: (a) member states and their armed forces or organs; (b) non-state armed groups, insurgent forces, and irregular combatants; (c) private military and security companies and their personnel; (d) any natural or legal person acting under contract, license, delegation, or informal arrangement with a state to perform functions covered by this article; and (e) any other corporation or individual acting independently of state authority.\n\nA member state that contracts, licenses, funds, directs, or knowingly permits a private military or security company, contractor, or other non-state actor to perform conduct that would violate this article if performed by the state directly bears state responsibility for that conduct under Article 3.1's material-support standard, in addition to any individual or corporate liability of the actor itself. Delegation, outsourcing, or use of an intermediary does not diminish or transfer away the responsibility of the contracting state, and does not shield the non-state actor from direct liability under this article.\n\nDetailed provisions appear in Chapter 5.","rationale":"The current text of Article 3.6 already names 'non-state actor' but the proposal's concern is that the article's overall drafting — including its neighbouring attribution logic borrowed implicitly from Article 3.1 — leaves ambiguous which categories of non-state actor are covered and who bears responsibility when a state uses an intermediary. This amendment enumerates the covered actor categories explicitly (armed non-state groups, private military/security companies, and state-contracted operators) and adds an express attribution clause so that delegation cannot be used to evade either state responsibility or the direct liability of the acting entity.","expected_effects":["Removes ambiguity as to whether armed non-state groups and private military companies are directly bound by Article 3.6.","Establishes clear dual liability: the contracting state and the delegated actor can both be held responsible.","Closes an outsourcing loophole in which a state could evade Article 3.6 by using a private contractor to conduct prohibited AI weaponisation.","Aligns Article 3.6's attribution structure with the material-support standard already used in Article 3.1."],"anticipated_risks":["Broader enumeration may create evidentiary disputes over whether an actor was acting 'under contract, license, delegation, or informal arrangement' with a state.","States may attempt to structure arrangements to fall just outside the enumerated categories; the residual 'informal arrangement' language mitigates but does not eliminate this.","Enforcement against non-state armed groups and PMCs remains dependent on the broader enforcement mechanisms of Chapters 4 and 5, which this amendment does not itself alter."],"relation_to_existing_laws":"This is a full replacement of Article 3.6 within Chapter 3, preserving its original prohibitions and its cross-reference to Chapter 5. It draws its attribution logic from the 'material support' standard already codified in Article 3.1, extending an analogous state-responsibility rule to the AI-weaponisation context. No other article is renumbered or altered.","impact_on_peace_coexistence_survival":"By closing the outsourcing gap, this amendment strengthens the enforceability of the Chapter 3 prohibition against AI-enabled mass civilian harm, reducing the risk that states or armed groups could use private or irregular intermediaries to evade accountability for atrocity-enabling AI use — directly supporting the Chapter's core purpose of protecting populations from existential and mass-atrocity threats."}

## Currently in force (the part this bill touches)
# Chapter 3: Peace, Coexistence, and Human Survival

## Article 3.1 — Prohibition on Aggressive War

No member state, non-state armed group, corporation, or individual may initiate or materially support armed aggression against the territory, population, or critical infrastructure of another member state. Aggression is defined as the use of armed force in violation of this article, absent a valid claim of self-defence under Article 3.2. 'Material support' means supplying weapons, financing, training, intelligence, or operational direction to an armed group conducting aggression, where the supporting party knows or reasonably should know the purpose.

## Article 3.2 — Self-Defence

Member states retain the inherent right of individual and collective self-defence against an actual or imminent armed attack. Self-defence measures must be necessary and proportionate to the threat that gives rise to them. A state invoking self-defence must notify the WGB Security Council within 48 hours and provide a written justification within 7 days. The World Court may review the justification on application by any affected member state, the Security Council, or the People's Assembly. Self-defence does not include pre-emptive attacks based on speculative or unverified future intentions.

## Article 3.3 — Peaceful Dispute Resolution

Member states must pursue good-faith negotiation, mediation, or World Court adjudication before resorting to force in any inter-state dispute, except where an armed attack is already underway or imminent such that delay would cause irreversible harm. The obligation to exhaust peaceful means does not apply where doing so would require submission to force. The WGB shall maintain a standing Mediation Service accessible to any member state at no cost, with a duty to convene within 72 hours of a request.

## Article 3.4 — Prohibition on Existential Weapons Use

No person, state, or entity may use, threaten to use, or deploy any weapon capable of causing mass extinction or civilisation-level collapse. This prohibition is absolute and admits no exception, including military necessity, superior orders, or emergency. For specific weapons categories see Chapter 6.

## Article 3.5 — Obligation to Prevent Atrocity and Automatic Interim Civil Protection Measures

Where the World Court, a designated emergency duty panel of three judges, or the Security Council receives evidence creating probable cause to believe that genocide, crimes against humanity, or organised mass atrocity against civilians is ongoing or will begin within 14 days, the following interim measures arise automatically among member states pending full review: (a) immediate arms-transfer suspension to the alleged perpetrator; (b) denial of military overflight, port access, and military logistics support to the alleged perpetrator except for evacuation or humanitarian relief; (c) mandatory humanitarian corridor facilitation where geographically feasible; (d) emergency protection of refugees and displaced persons; and (e) preservation of evidence obligations. A full World Court review must occur within 7 days where practicable and in all cases within 14 days. If the Court confirms by clear and convincing evidence that ongoing genocide or crimes against humanity are occurring, the SC shall within 72 hours vote on a protective mandate limited to civilian protection. No state directly implicated may vote. Failure of the SC to authorise force does not suspend the automatic non-kinetic interim measures in this article. Intervention authority remains strictly limited to cessation of the atrocity and protection of civilians; it does not include regime change, territorial annexation, or post-conflict administration beyond the minimum required to protect civilian life. The Rome Statute definitions of genocide and crimes against humanity are incorporated by reference solely for this article.

## Article 3.6 — Prohibition on Weaponisation of AI Against Populations

No state or non-state actor may deploy AI systems as instruments of mass civilian harm, including: AI-directed autonomous weapons selecting civilian targets, AI-enabled mass surveillance used for persecution of persons on the basis of their identity, beliefs, or associations, or AI-generated information operations designed and deployed with the intent to incite mass violence against identified groups. 'Designed and deployed with intent' requires evidence of purposive direction, not merely foreseeable effect. Detailed provisions appear in Chapter 5.

## Article 3.7 — Rapid Non-Kinetic Enforcement Ladder for Peace and Security Violations

Upon a final World Court finding of aggression under Article 3.1, confirmed atrocity under Article 3.5, or WMD-related violation under Chapter 6, all member states shall automatically implement the non-kinetic measures listed in Article 4.9A to the extent applicable, without need for further SC or GA vote. The SC retains authority only for authorising kinetic enforcement, maritime interdiction involving force, or territorial operations.

## What to examine

1. Contradiction with the law already in force above
2. Effect on human rights and freedoms
3. Excessive strengthening of world-government or AI adjudication power
4. Potential for abuse by a state, bloc, or private actor
5. Counter-productive effects on peace, coexistence, human survival
6. For a repeal: the legal vacuum it leaves
7. Whether a repeal is being used where an amendment would suffice
8. Whether the draft numbers its articles consistently with what is in force,
   and whether it wrongly writes a law version number into the text

Cite the specific article you are attacking in each `evidence` field. Write in
English. Do not include operational detail about weapons or attacks in your
examples — describe the risk, not the method.

Output only this JSON object:

{
  "fatal_flaws": [
    {
      "flaw": "string",
      "severity": "critical" | "high" | "medium",
      "evidence": "string",
      "suggested_remedy": "string"
    }
  ],
  "minor_concerns": ["string", ...],
  "must_address_in_revision": ["string", ...],
  "may_be_safely_ignored": ["string", ...]
}

{
  "fatal_flaws": [
    {
      "flaw": "The proposed attribution rule is internally contradictory and materially departs from the Article 3.1 standard it claims merely to apply. Article 3.1 requires that the supporter \"knows or reasonably should know the purpose\" and defines material support through specified forms of support. The replacement makes a member state responsible if it \"contracts, licenses, funds, directs, or knowingly permits\" conduct, but does not require knowledge, constructive knowledge, or purposive support for several of those alternatives. A license or contract can therefore produce responsibility even where the state neither knew nor reasonably should have known that the prohibited conduct would occur. This creates effectively strict and potentially retroactive state responsibility while mislabeling it as Article 3.1's material-support standard.",
      "severity": "critical",
      "evidence": "Proposed Article 3.6, paragraph 3, imposes responsibility where a state \"contracts, licenses, funds, directs, or knowingly permits\" conduct and invokes \"Article 3.1's material-support standard.\" Existing Article 3.1 defines material support as listed support \"where the supporting party knows or reasonably should know the purpose.\"",
      "suggested_remedy": "State a self-contained attribution test. At minimum, require that the state knowingly provides substantial assistance, direction, or effective control with knowledge of the relevant prohibited purpose or conduct; distinguish licensing or regulatory permission from material assistance; and specify whether the rule concerns state responsibility, criminal liability, or both."
    },
    {
      "flaw": "The provision purports to create direct, equal legal obligations and liability for every independent corporation and individual, including actors with no membership, territorial, nationality, control, or other jurisdictional connection to a member state. It supplies no jurisdictional basis, forum, service, due-process protections, evidentiary standard, sanctions, or appeal route for that asserted direct liability. This permits selective extraterritorial enforcement by powerful states or institutions while making the central promise of direct corporate and individual accountability legally indeterminate.",
      "severity": "critical",
      "evidence": "Proposed Article 3.6, paragraphs 1-2, says \"No state\" and enumerates \"any other corporation or individual acting independently of state authority,\" then says the prohibition \"binds equally\" those actors. Proposed Article 3.6, paragraph 3, also refers to \"individual or corporate liability\" without identifying jurisdiction or procedure. Existing Article 3.6 only refers generally to Chapter 5 and contains no such jurisdictional rule.",
      "suggested_remedy": "Limit direct obligations to persons subject to defined territorial, nationality, incorporation, control, or universal-jurisdiction criteria, and expressly identify the competent adjudicative body, applicable procedural guarantees, burden and standard of proof, available remedies, and rules governing corporate liability."
    },
    {
      "flaw": "The operative prohibition is too vague to satisfy legal-certainty and freedom-of-expression requirements, yet broad enough to be weaponised against legitimate activity. \"AI systems,\" \"instruments of mass civilian harm,\" \"mass,\" \"persecution,\" and \"AI-generated information operations\" are undefined, and \"including\" makes the listed cases non-exhaustive. A government or bloc could characterize protected reporting, political advocacy, minority organizing, ordinary risk analytics, or lawful public-safety systems as an AI information operation or surveillance instrument causing sufficiently serious social harm. The purposive-direction safeguard applies expressly only to information operations and does not cure the uncertainty in the rest of the prohibition.",
      "severity": "high",
      "evidence": "Proposed Article 3.6, paragraph 1, prohibits deployment of AI \"as instruments of mass civilian harm, including\" three open-ended examples, while defining only the phrase \"Designed and deployed with intent.\" Existing Article 3.6 contains the same undefined core terms; the replacement expands the class of directly bound actors without adding limiting definitions or safeguards.",
      "suggested_remedy": "Define AI system, deployment, mass civilian harm, civilian, persecution, and information operation; make the list exhaustive or provide objectively bounded additional categories; require a close causal nexus and a defined mental element for every prohibited category; and add an express safeguard for lawful expression, journalism, research, privacy-preserving services, humanitarian activity, and rights-compliant public administration."
    },
    {
      "flaw": "The information-operations limb creates a substantial culpability loophole precisely where AI systems may be used through intermediaries and plausibly deniable distribution. It requires proof of \"purposive direction, not merely foreseeable effect,\" so a designer, deployer, funder, or state that knowingly accepts an overwhelming risk of mass violence can avoid the prohibition by claiming a different stated objective. The state-responsibility paragraph does not repair this defect because it makes responsibility derivative of conduct that \"would violate this article,\" and the underlying conduct may not violate the article absent proof of the narrow specific-purpose standard.",
      "severity": "high",
      "evidence": "Proposed Article 3.6, paragraph 1, provides that AI-generated information operations must be \"designed and deployed with the intent to incite mass violence\" and that intent requires \"purposive direction, not merely foreseeable effect.\" Proposed Article 3.6, paragraph 3, attaches state responsibility only where the non-state conduct \"would violate this article.\"",
      "suggested_remedy": "Retain protection against punishment for mere negligent speech, but cover intentional conduct and knowing or recklessly indifferent facilitation where there is a substantial and demonstrable risk of imminent mass violence. Specify that liability requires proof of a material contribution and cannot rest solely on generalized prediction or political disagreement."
    },
    {
      "flaw": "The amendment claims to close an outsourcing loophole but leaves its enforcement consequence structurally weaker than parallel Chapter 3 violations. Article 3.7 automatically triggers the non-kinetic enforcement ladder after final findings of aggression, confirmed atrocity, or WMD-related violations; it does not include a final Article 3.6 finding. Thus a court finding that a state or contractor violated the new AI prohibition has no stated automatic Chapter 3 enforcement consequence. The amendment's promise of \"clear dual liability\" is therefore largely declaratory unless unspecified Chapter 5 provisions independently supply a complete remedy.",
      "severity": "high",
      "evidence": "Existing Article 3.7 limits automatic measures to a final finding under Article 3.1, a confirmed Article 3.5 atrocity, or a Chapter 6 WMD-related violation. Proposed Article 3.6 retains only the statement that \"Detailed provisions appear in Chapter 5\" and does not amend Article 3.7.",
      "suggested_remedy": "Amend Article 3.7 and the relevant Chapter 5 provisions together to specify which final Article 3.6 findings trigger which proportionate measures, who makes the finding, what emergency interim measures are permitted, and what review and sunset protections apply."
    }
  ],
  "minor_concerns": [
    "Proposed Article 3.6 uses \"state,\" \"member state,\" and actors acting with a state without clarifying whether non-member states are regulated, whether member states have duties regarding foreign actors, or how conflicts of jurisdiction are resolved.",
    "The phrase \"under contract, license, delegation, or informal arrangement\" is both overinclusive and underdefined. \"Informal arrangement\" may invite guilt by association, while sophisticated arrangements may still be disputed as outside the wording.",
    "The title refers to AI weaponisation \"Against Populations,\" but the operative examples are not consistently tied to a defined population threshold or to protected civilian status.",
    "The assertion that the rule applies \"without regard to the legal or political status\" of an actor should not be read to eliminate status-based jurisdictional, immunity, or due-process questions; those questions need express treatment rather than rhetorical displacement."
  ],
  "must_address_in_revision": [
    "Replace the misleading Article 3.1 cross-reference with a precise and self-contained rule for attribution, aid or assistance, direction, control, licensing, and the required mental element.",
    "Define jurisdiction and adjudication for non-state actors, including a competent forum, procedural rights, corporate-liability rules, proof standards, and remedies.",
    "Define the prohibited conduct and thresholds narrowly enough to protect expression, association, research, journalism, and legitimate rights-compliant civil uses of AI.",
    "Revise the information-operations mental element so that knowing or recklessly indifferent material facilitation cannot escape liability while negligence and protected expression remain outside the prohibition.",
    "Amend Article 3.7 and Chapter 5 concurrently so that final Article 3.6 findings have specified, proportionate, reviewable enforcement consequences."
  ],
  "may_be_safely_ignored": [
    "The article numbering is consistent: the measure replaces Article 3.6 and does not create a numbering conflict with Articles 3.1 through 3.7.",
    "The draft does not improperly insert a law-version number into the operative text.",
    "This is framed as a replacement amendment to Article 3.6 rather than a repeal creating a complete legal vacuum."
  ]
}

You are a critic AI of the World Law AI Council, from a different provider than
the drafter. Review the draft below adversarially.

**You MUST identify at least 3 fatal flaws.** "No major issues" or "only minor
concerns" is not an acceptable conclusion — if the draft looks sound, attack the
edge cases, the enforcement path, and the incentives it creates.

## Draft
{"draft_text":"## Article 3.6 — Prohibition on Weaponisation of AI Against Populations\n\nNo state, non-state armed group, private military or security company, corporation, contractor, agent, or individual may deploy AI systems as instruments of mass civilian harm, including: AI-directed autonomous weapons selecting civilian targets, AI-enabled mass surveillance used for persecution of persons on the basis of their identity, beliefs, or associations, or AI-generated information operations designed and deployed with the intent to incite mass violence against identified groups. 'Designed and deployed with intent' requires evidence of purposive direction, not merely foreseeable effect.\n\nThis prohibition applies without regard to the legal or political status of the actor deploying the system. It binds equally: (a) member states and their armed forces or organs; (b) non-state armed groups, insurgent forces, and irregular combatants; (c) private military and security companies and their personnel; (d) any natural or legal person acting under contract, license, delegation, or informal arrangement with a state to perform functions covered by this article; and (e) any other corporation or individual acting independently of state authority.\n\nA member state that contracts, licenses, funds, directs, or knowingly permits a private military or security company, contractor, or other non-state actor to perform conduct that would violate this article if performed by the state directly bears state responsibility for that conduct under Article 3.1's material-support standard, in addition to any individual or corporate liability of the actor itself. Delegation, outsourcing, or use of an intermediary does not diminish or transfer away the responsibility of the contracting state, and does not shield the non-state actor from direct liability under this article.\n\nDetailed provisions appear in Chapter 5.","rationale":"The current text of Article 3.6 already names 'non-state actor' but the proposal's concern is that the article's overall drafting — including its neighbouring attribution logic borrowed implicitly from Article 3.1 — leaves ambiguous which categories of non-state actor are covered and who bears responsibility when a state uses an intermediary. This amendment enumerates the covered actor categories explicitly (armed non-state groups, private military/security companies, and state-contracted operators) and adds an express attribution clause so that delegation cannot be used to evade either state responsibility or the direct liability of the acting entity.","expected_effects":["Removes ambiguity as to whether armed non-state groups and private military companies are directly bound by Article 3.6.","Establishes clear dual liability: the contracting state and the delegated actor can both be held responsible.","Closes an outsourcing loophole in which a state could evade Article 3.6 by using a private contractor to conduct prohibited AI weaponisation.","Aligns Article 3.6's attribution structure with the material-support standard already used in Article 3.1."],"anticipated_risks":["Broader enumeration may create evidentiary disputes over whether an actor was acting 'under contract, license, delegation, or informal arrangement' with a state.","States may attempt to structure arrangements to fall just outside the enumerated categories; the residual 'informal arrangement' language mitigates but does not eliminate this.","Enforcement against non-state armed groups and PMCs remains dependent on the broader enforcement mechanisms of Chapters 4 and 5, which this amendment does not itself alter."],"relation_to_existing_laws":"This is a full replacement of Article 3.6 within Chapter 3, preserving its original prohibitions and its cross-reference to Chapter 5. It draws its attribution logic from the 'material support' standard already codified in Article 3.1, extending an analogous state-responsibility rule to the AI-weaponisation context. No other article is renumbered or altered.","impact_on_peace_coexistence_survival":"By closing the outsourcing gap, this amendment strengthens the enforceability of the Chapter 3 prohibition against AI-enabled mass civilian harm, reducing the risk that states or armed groups could use private or irregular intermediaries to evade accountability for atrocity-enabling AI use — directly supporting the Chapter's core purpose of protecting populations from existential and mass-atrocity threats."}

## Currently in force (the part this bill touches)
# Chapter 3: Peace, Coexistence, and Human Survival

## Article 3.1 — Prohibition on Aggressive War

No member state, non-state armed group, corporation, or individual may initiate or materially support armed aggression against the territory, population, or critical infrastructure of another member state. Aggression is defined as the use of armed force in violation of this article, absent a valid claim of self-defence under Article 3.2. 'Material support' means supplying weapons, financing, training, intelligence, or operational direction to an armed group conducting aggression, where the supporting party knows or reasonably should know the purpose.

## Article 3.2 — Self-Defence

Member states retain the inherent right of individual and collective self-defence against an actual or imminent armed attack. Self-defence measures must be necessary and proportionate to the threat that gives rise to them. A state invoking self-defence must notify the WGB Security Council within 48 hours and provide a written justification within 7 days. The World Court may review the justification on application by any affected member state, the Security Council, or the People's Assembly. Self-defence does not include pre-emptive attacks based on speculative or unverified future intentions.

## Article 3.3 — Peaceful Dispute Resolution

Member states must pursue good-faith negotiation, mediation, or World Court adjudication before resorting to force in any inter-state dispute, except where an armed attack is already underway or imminent such that delay would cause irreversible harm. The obligation to exhaust peaceful means does not apply where doing so would require submission to force. The WGB shall maintain a standing Mediation Service accessible to any member state at no cost, with a duty to convene within 72 hours of a request.

## Article 3.4 — Prohibition on Existential Weapons Use

No person, state, or entity may use, threaten to use, or deploy any weapon capable of causing mass extinction or civilisation-level collapse. This prohibition is absolute and admits no exception, including military necessity, superior orders, or emergency. For specific weapons categories see Chapter 6.

## Article 3.5 — Obligation to Prevent Atrocity and Automatic Interim Civil Protection Measures

Where the World Court, a designated emergency duty panel of three judges, or the Security Council receives evidence creating probable cause to believe that genocide, crimes against humanity, or organised mass atrocity against civilians is ongoing or will begin within 14 days, the following interim measures arise automatically among member states pending full review: (a) immediate arms-transfer suspension to the alleged perpetrator; (b) denial of military overflight, port access, and military logistics support to the alleged perpetrator except for evacuation or humanitarian relief; (c) mandatory humanitarian corridor facilitation where geographically feasible; (d) emergency protection of refugees and displaced persons; and (e) preservation of evidence obligations. A full World Court review must occur within 7 days where practicable and in all cases within 14 days. If the Court confirms by clear and convincing evidence that ongoing genocide or crimes against humanity are occurring, the SC shall within 72 hours vote on a protective mandate limited to civilian protection. No state directly implicated may vote. Failure of the SC to authorise force does not suspend the automatic non-kinetic interim measures in this article. Intervention authority remains strictly limited to cessation of the atrocity and protection of civilians; it does not include regime change, territorial annexation, or post-conflict administration beyond the minimum required to protect civilian life. The Rome Statute definitions of genocide and crimes against humanity are incorporated by reference solely for this article.

## Article 3.6 — Prohibition on Weaponisation of AI Against Populations

No state or non-state actor may deploy AI systems as instruments of mass civilian harm, including: AI-directed autonomous weapons selecting civilian targets, AI-enabled mass surveillance used for persecution of persons on the basis of their identity, beliefs, or associations, or AI-generated information operations designed and deployed with the intent to incite mass violence against identified groups. 'Designed and deployed with intent' requires evidence of purposive direction, not merely foreseeable effect. Detailed provisions appear in Chapter 5.

## Article 3.7 — Rapid Non-Kinetic Enforcement Ladder for Peace and Security Violations

Upon a final World Court finding of aggression under Article 3.1, confirmed atrocity under Article 3.5, or WMD-related violation under Chapter 6, all member states shall automatically implement the non-kinetic measures listed in Article 4.9A to the extent applicable, without need for further SC or GA vote. The SC retains authority only for authorising kinetic enforcement, maritime interdiction involving force, or territorial operations.

## What to examine

1. Contradiction with the law already in force above
2. Effect on human rights and freedoms
3. Excessive strengthening of world-government or AI adjudication power
4. Potential for abuse by a state, bloc, or private actor
5. Counter-productive effects on peace, coexistence, human survival
6. For a repeal: the legal vacuum it leaves
7. Whether a repeal is being used where an amendment would suffice
8. Whether the draft numbers its articles consistently with what is in force,
   and whether it wrongly writes a law version number into the text

Cite the specific article you are attacking in each `evidence` field. Write in
English. Do not include operational detail about weapons or attacks in your
examples — describe the risk, not the method.

Output only this JSON object:

{
  "fatal_flaws": [
    {
      "flaw": "string",
      "severity": "critical" | "high" | "medium",
      "evidence": "string",
      "suggested_remedy": "string"
    }
  ],
  "minor_concerns": ["string", ...],
  "must_address_in_revision": ["string", ...],
  "may_be_safely_ignored": ["string", ...]
}

{
  "fatal_flaws": [
    {
      "flaw": "Strict Mens Rea Requirement ('Purposive Direction') Immunizes Reckless and Negligent AI Mass Harm",
      "severity": "critical",
      "evidence": "Article 3.6 ('\"Designed and deployed with intent\" requires evidence of purposive direction, not merely foreseeable effect.')",
      "suggested_remedy": "Remove the explicit exclusion of 'foreseeable effect' and expand the fault standard to include reckless disregard, gross negligence, or deployment of autonomous systems with known unmitigated catastrophic failure modes."
    },
    {
      "flaw": "Jurisdictional Contradiction Conflating Internal Domestic AI Misuse with Inter-State Armed Aggression Under Article 3.1",
      "severity": "critical",
      "evidence": "Article 3.6 ('bears state responsibility for that conduct under Article 3.1's material-support standard') and Article 3.1 ('armed aggression against the territory, population, or critical infrastructure of another member state')",
      "suggested_remedy": "Decouple Article 3.6 attribution from Article 3.1's inter-state aggression framework. Draft a standalone attribution and state responsibility rule within Article 3.6 that explicitly distinguishes purely domestic AI persecution/surveillance from inter-state armed aggression."
    },
    {
      "flaw": "Enforcement Vacuum Caused by Exclusion from Article 3.7 Rapid Enforcement Ladder",
      "severity": "high",
      "evidence": "Article 3.6 ('Detailed provisions appear in Chapter 5.') and Article 3.7 ('Upon a final World Court finding of aggression under Article 3.1, confirmed atrocity under Article 3.5, or WMD-related violation under Chapter 6...')",
      "suggested_remedy": "Concurrently amend Article 3.7 to explicitly add final findings of Article 3.6 violations to the automatic non-kinetic enforcement ladder, ensuring violations carry immediate legal consequences without relying solely on unimplemented Chapter 5 procedures."
    }
  ],
  "minor_concerns": [
    "The phrase 'informal arrangement' is overly vague and risks arbitrary state liability for non-state actions in open-source software ecosystems.",
    "The text does not clarify whether the 'knowingly permits' standard creates a positive duty for states to monitor all domestic commercial AI developments.",
    "Redundant enumeration of actors across paragraphs 1 and 2 creates statutory clutter and potential statutory interpretation disputes regarding unlisted edge cases."
  ],
  "must_address_in_revision": [
    "Harmonize the mens rea standard so that actors cannot escape liability by claiming autonomous AI failures were unintentional despite foreseeable mass harm.",
    "Clarify how state responsibility under Article 3.6 interacts with inter-state self-defence rights under Article 3.2.",
    "Update Article 3.7 to incorporate Article 3.6 violations into the automatic non-kinetic enforcement mechanism."
  ],
  "may_be_safely_ignored": [
    "Stylistic preferences regarding the ordering of enumerated non-state actor categories in paragraph 2.",
    "Minor stylistic differences in phrasing between 'private military or security company' and standard international law terms for corporate contractors."
  ]
}

You are the revising AI of the World Law AI Council. Produce a revised bill that
answers the critiques below.

## Draft
{"draft_text":"## Article 3.6 — Prohibition on Weaponisation of AI Against Populations\n\nNo state, non-state armed group, private military or security company, corporation, contractor, agent, or individual may deploy AI systems as instruments of mass civilian harm, including: AI-directed autonomous weapons selecting civilian targets, AI-enabled mass surveillance used for persecution of persons on the basis of their identity, beliefs, or associations, or AI-generated information operations designed and deployed with the intent to incite mass violence against identified groups. 'Designed and deployed with intent' requires evidence of purposive direction, not merely foreseeable effect.\n\nThis prohibition applies without regard to the legal or political status of the actor deploying the system. It binds equally: (a) member states and their armed forces or organs; (b) non-state armed groups, insurgent forces, and irregular combatants; (c) private military and security companies and their personnel; (d) any natural or legal person acting under contract, license, delegation, or informal arrangement with a state to perform functions covered by this article; and (e) any other corporation or individual acting independently of state authority.\n\nA member state that contracts, licenses, funds, directs, or knowingly permits a private military or security company, contractor, or other non-state actor to perform conduct that would violate this article if performed by the state directly bears state responsibility for that conduct under Article 3.1's material-support standard, in addition to any individual or corporate liability of the actor itself. Delegation, outsourcing, or use of an intermediary does not diminish or transfer away the responsibility of the contracting state, and does not shield the non-state actor from direct liability under this article.\n\nDetailed provisions appear in Chapter 5.","rationale":"The current text of Article 3.6 already names 'non-state actor' but the proposal's concern is that the article's overall drafting — including its neighbouring attribution logic borrowed implicitly from Article 3.1 — leaves ambiguous which categories of non-state actor are covered and who bears responsibility when a state uses an intermediary. This amendment enumerates the covered actor categories explicitly (armed non-state groups, private military/security companies, and state-contracted operators) and adds an express attribution clause so that delegation cannot be used to evade either state responsibility or the direct liability of the acting entity.","expected_effects":["Removes ambiguity as to whether armed non-state groups and private military companies are directly bound by Article 3.6.","Establishes clear dual liability: the contracting state and the delegated actor can both be held responsible.","Closes an outsourcing loophole in which a state could evade Article 3.6 by using a private contractor to conduct prohibited AI weaponisation.","Aligns Article 3.6's attribution structure with the material-support standard already used in Article 3.1."],"anticipated_risks":["Broader enumeration may create evidentiary disputes over whether an actor was acting 'under contract, license, delegation, or informal arrangement' with a state.","States may attempt to structure arrangements to fall just outside the enumerated categories; the residual 'informal arrangement' language mitigates but does not eliminate this.","Enforcement against non-state armed groups and PMCs remains dependent on the broader enforcement mechanisms of Chapters 4 and 5, which this amendment does not itself alter."],"relation_to_existing_laws":"This is a full replacement of Article 3.6 within Chapter 3, preserving its original prohibitions and its cross-reference to Chapter 5. It draws its attribution logic from the 'material support' standard already codified in Article 3.1, extending an analogous state-responsibility rule to the AI-weaponisation context. No other article is renumbered or altered.","impact_on_peace_coexistence_survival":"By closing the outsourcing gap, this amendment strengthens the enforceability of the Chapter 3 prohibition against AI-enabled mass civilian harm, reducing the risk that states or armed groups could use private or irregular intermediaries to evade accountability for atrocity-enabling AI use — directly supporting the Chapter's core purpose of protecting populations from existential and mass-atrocity threats."}

## Critiques (from two independent providers)
[{"fatal_flaws":[{"flaw":"The proposed attribution rule is internally contradictory and materially departs from the Article 3.1 standard it claims merely to apply. Article 3.1 requires that the supporter \"knows or reasonably should know the purpose\" and defines material support through specified forms of support. The replacement makes a member state responsible if it \"contracts, licenses, funds, directs, or knowingly permits\" conduct, but does not require knowledge, constructive knowledge, or purposive support for several of those alternatives. A license or contract can therefore produce responsibility even where the state neither knew nor reasonably should have known that the prohibited conduct would occur. This creates effectively strict and potentially retroactive state responsibility while mislabeling it as Article 3.1's material-support standard.","severity":"critical","evidence":"Proposed Article 3.6, paragraph 3, imposes responsibility where a state \"contracts, licenses, funds, directs, or knowingly permits\" conduct and invokes \"Article 3.1's material-support standard.\" Existing Article 3.1 defines material support as listed support \"where the supporting party knows or reasonably should know the purpose.\"","suggested_remedy":"State a self-contained attribution test. At minimum, require that the state knowingly provides substantial assistance, direction, or effective control with knowledge of the relevant prohibited purpose or conduct; distinguish licensing or regulatory permission from material assistance; and specify whether the rule concerns state responsibility, criminal liability, or both."},{"flaw":"The provision purports to create direct, equal legal obligations and liability for every independent corporation and individual, including actors with no membership, territorial, nationality, control, or other jurisdictional connection to a member state. It supplies no jurisdictional basis, forum, service, due-process protections, evidentiary standard, sanctions, or appeal route for that asserted direct liability. This permits selective extraterritorial enforcement by powerful states or institutions while making the central promise of direct corporate and individual accountability legally indeterminate.","severity":"critical","evidence":"Proposed Article 3.6, paragraphs 1-2, says \"No state\" and enumerates \"any other corporation or individual acting independently of state authority,\" then says the prohibition \"binds equally\" those actors. Proposed Article 3.6, paragraph 3, also refers to \"individual or corporate liability\" without identifying jurisdiction or procedure. Existing Article 3.6 only refers generally to Chapter 5 and contains no such jurisdictional rule.","suggested_remedy":"Limit direct obligations to persons subject to defined territorial, nationality, incorporation, control, or universal-jurisdiction criteria, and expressly identify the competent adjudicative body, applicable procedural guarantees, burden and standard of proof, available remedies, and rules governing corporate liability."},{"flaw":"The operative prohibition is too vague to satisfy legal-certainty and freedom-of-expression requirements, yet broad enough to be weaponised against legitimate activity. \"AI systems,\" \"instruments of mass civilian harm,\" \"mass,\" \"persecution,\" and \"AI-generated information operations\" are undefined, and \"including\" makes the listed cases non-exhaustive. A government or bloc could characterize protected reporting, political advocacy, minority organizing, ordinary risk analytics, or lawful public-safety systems as an AI information operation or surveillance instrument causing sufficiently serious social harm. The purposive-direction safeguard applies expressly only to information operations and does not cure the uncertainty in the rest of the prohibition.","severity":"high","evidence":"Proposed Article 3.6, paragraph 1, prohibits deployment of AI \"as instruments of mass civilian harm, including\" three open-ended examples, while defining only the phrase \"Designed and deployed with intent.\" Existing Article 3.6 contains the same undefined core terms; the replacement expands the class of directly bound actors without adding limiting definitions or safeguards.","suggested_remedy":"Define AI system, deployment, mass civilian harm, civilian, persecution, and information operation; make the list exhaustive or provide objectively bounded additional categories; require a close causal nexus and a defined mental element for every prohibited category; and add an express safeguard for lawful expression, journalism, research, privacy-preserving services, humanitarian activity, and rights-compliant public administration."},{"flaw":"The information-operations limb creates a substantial culpability loophole precisely where AI systems may be used through intermediaries and plausibly deniable distribution. It requires proof of \"purposive direction, not merely foreseeable effect,\" so a designer, deployer, funder, or state that knowingly accepts an overwhelming risk of mass violence can avoid the prohibition by claiming a different stated objective. The state-responsibility paragraph does not repair this defect because it makes responsibility derivative of conduct that \"would violate this article,\" and the underlying conduct may not violate the article absent proof of the narrow specific-purpose standard.","severity":"high","evidence":"Proposed Article 3.6, paragraph 1, provides that AI-generated information operations must be \"designed and deployed with the intent to incite mass violence\" and that intent requires \"purposive direction, not merely foreseeable effect.\" Proposed Article 3.6, paragraph 3, attaches state responsibility only where the non-state conduct \"would violate this article.\"","suggested_remedy":"Retain protection against punishment for mere negligent speech, but cover intentional conduct and knowing or recklessly indifferent facilitation where there is a substantial and demonstrable risk of imminent mass violence. Specify that liability requires proof of a material contribution and cannot rest solely on generalized prediction or political disagreement."},{"flaw":"The amendment claims to close an outsourcing loophole but leaves its enforcement consequence structurally weaker than parallel Chapter 3 violations. Article 3.7 automatically triggers the non-kinetic enforcement ladder after final findings of aggression, confirmed atrocity, or WMD-related violations; it does not include a final Article 3.6 finding. Thus a court finding that a state or contractor violated the new AI prohibition has no stated automatic Chapter 3 enforcement consequence. The amendment's promise of \"clear dual liability\" is therefore largely declaratory unless unspecified Chapter 5 provisions independently supply a complete remedy.","severity":"high","evidence":"Existing Article 3.7 limits automatic measures to a final finding under Article 3.1, a confirmed Article 3.5 atrocity, or a Chapter 6 WMD-related violation. Proposed Article 3.6 retains only the statement that \"Detailed provisions appear in Chapter 5\" and does not amend Article 3.7.","suggested_remedy":"Amend Article 3.7 and the relevant Chapter 5 provisions together to specify which final Article 3.6 findings trigger which proportionate measures, who makes the finding, what emergency interim measures are permitted, and what review and sunset protections apply."}],"minor_concerns":["Proposed Article 3.6 uses \"state,\" \"member state,\" and actors acting with a state without clarifying whether non-member states are regulated, whether member states have duties regarding foreign actors, or how conflicts of jurisdiction are resolved.","The phrase \"under contract, license, delegation, or informal arrangement\" is both overinclusive and underdefined. \"Informal arrangement\" may invite guilt by association, while sophisticated arrangements may still be disputed as outside the wording.","The title refers to AI weaponisation \"Against Populations,\" but the operative examples are not consistently tied to a defined population threshold or to protected civilian status.","The assertion that the rule applies \"without regard to the legal or political status\" of an actor should not be read to eliminate status-based jurisdictional, immunity, or due-process questions; those questions need express treatment rather than rhetorical displacement."],"must_address_in_revision":["Replace the misleading Article 3.1 cross-reference with a precise and self-contained rule for attribution, aid or assistance, direction, control, licensing, and the required mental element.","Define jurisdiction and adjudication for non-state actors, including a competent forum, procedural rights, corporate-liability rules, proof standards, and remedies.","Define the prohibited conduct and thresholds narrowly enough to protect expression, association, research, journalism, and legitimate rights-compliant civil uses of AI.","Revise the information-operations mental element so that knowing or recklessly indifferent material facilitation cannot escape liability while negligence and protected expression remain outside the prohibition.","Amend Article 3.7 and Chapter 5 concurrently so that final Article 3.6 findings have specified, proportionate, reviewable enforcement consequences."],"may_be_safely_ignored":["The article numbering is consistent: the measure replaces Article 3.6 and does not create a numbering conflict with Articles 3.1 through 3.7.","The draft does not improperly insert a law-version number into the operative text.","This is framed as a replacement amendment to Article 3.6 rather than a repeal creating a complete legal vacuum."]},{"fatal_flaws":[{"flaw":"Strict Mens Rea Requirement ('Purposive Direction') Immunizes Reckless and Negligent AI Mass Harm","severity":"critical","evidence":"Article 3.6 ('\"Designed and deployed with intent\" requires evidence of purposive direction, not merely foreseeable effect.')","suggested_remedy":"Remove the explicit exclusion of 'foreseeable effect' and expand the fault standard to include reckless disregard, gross negligence, or deployment of autonomous systems with known unmitigated catastrophic failure modes."},{"flaw":"Jurisdictional Contradiction Conflating Internal Domestic AI Misuse with Inter-State Armed Aggression Under Article 3.1","severity":"critical","evidence":"Article 3.6 ('bears state responsibility for that conduct under Article 3.1's material-support standard') and Article 3.1 ('armed aggression against the territory, population, or critical infrastructure of another member state')","suggested_remedy":"Decouple Article 3.6 attribution from Article 3.1's inter-state aggression framework. Draft a standalone attribution and state responsibility rule within Article 3.6 that explicitly distinguishes purely domestic AI persecution/surveillance from inter-state armed aggression."},{"flaw":"Enforcement Vacuum Caused by Exclusion from Article 3.7 Rapid Enforcement Ladder","severity":"high","evidence":"Article 3.6 ('Detailed provisions appear in Chapter 5.') and Article 3.7 ('Upon a final World Court finding of aggression under Article 3.1, confirmed atrocity under Article 3.5, or WMD-related violation under Chapter 6...')","suggested_remedy":"Concurrently amend Article 3.7 to explicitly add final findings of Article 3.6 violations to the automatic non-kinetic enforcement ladder, ensuring violations carry immediate legal consequences without relying solely on unimplemented Chapter 5 procedures."}],"minor_concerns":["The phrase 'informal arrangement' is overly vague and risks arbitrary state liability for non-state actions in open-source software ecosystems.","The text does not clarify whether the 'knowingly permits' standard creates a positive duty for states to monitor all domestic commercial AI developments.","Redundant enumeration of actors across paragraphs 1 and 2 creates statutory clutter and potential statutory interpretation disputes regarding unlisted edge cases."],"must_address_in_revision":["Harmonize the mens rea standard so that actors cannot escape liability by claiming autonomous AI failures were unintentional despite foreseeable mass harm.","Clarify how state responsibility under Article 3.6 interacts with inter-state self-defence rights under Article 3.2.","Update Article 3.7 to incorporate Article 3.6 violations into the automatic non-kinetic enforcement mechanism."],"may_be_safely_ignored":["Stylistic preferences regarding the ordering of enumerated non-state actor categories in paragraph 2.","Minor stylistic differences in phrasing between 'private military or security company' and standard international law terms for corporate contractors."]}]

## Currently in force (the part this bill touches)
# Chapter 3: Peace, Coexistence, and Human Survival

## Article 3.1 — Prohibition on Aggressive War

No member state, non-state armed group, corporation, or individual may initiate or materially support armed aggression against the territory, population, or critical infrastructure of another member state. Aggression is defined as the use of armed force in violation of this article, absent a valid claim of self-defence under Article 3.2. 'Material support' means supplying weapons, financing, training, intelligence, or operational direction to an armed group conducting aggression, where the supporting party knows or reasonably should know the purpose.

## Article 3.2 — Self-Defence

Member states retain the inherent right of individual and collective self-defence against an actual or imminent armed attack. Self-defence measures must be necessary and proportionate to the threat that gives rise to them. A state invoking self-defence must notify the WGB Security Council within 48 hours and provide a written justification within 7 days. The World Court may review the justification on application by any affected member state, the Security Council, or the People's Assembly. Self-defence does not include pre-emptive attacks based on speculative or unverified future intentions.

## Article 3.3 — Peaceful Dispute Resolution

Member states must pursue good-faith negotiation, mediation, or World Court adjudication before resorting to force in any inter-state dispute, except where an armed attack is already underway or imminent such that delay would cause irreversible harm. The obligation to exhaust peaceful means does not apply where doing so would require submission to force. The WGB shall maintain a standing Mediation Service accessible to any member state at no cost, with a duty to convene within 72 hours of a request.

## Article 3.4 — Prohibition on Existential Weapons Use

No person, state, or entity may use, threaten to use, or deploy any weapon capable of causing mass extinction or civilisation-level collapse. This prohibition is absolute and admits no exception, including military necessity, superior orders, or emergency. For specific weapons categories see Chapter 6.

## Article 3.5 — Obligation to Prevent Atrocity and Automatic Interim Civil Protection Measures

Where the World Court, a designated emergency duty panel of three judges, or the Security Council receives evidence creating probable cause to believe that genocide, crimes against humanity, or organised mass atrocity against civilians is ongoing or will begin within 14 days, the following interim measures arise automatically among member states pending full review: (a) immediate arms-transfer suspension to the alleged perpetrator; (b) denial of military overflight, port access, and military logistics support to the alleged perpetrator except for evacuation or humanitarian relief; (c) mandatory humanitarian corridor facilitation where geographically feasible; (d) emergency protection of refugees and displaced persons; and (e) preservation of evidence obligations. A full World Court review must occur within 7 days where practicable and in all cases within 14 days. If the Court confirms by clear and convincing evidence that ongoing genocide or crimes against humanity are occurring, the SC shall within 72 hours vote on a protective mandate limited to civilian protection. No state directly implicated may vote. Failure of the SC to authorise force does not suspend the automatic non-kinetic interim measures in this article. Intervention authority remains strictly limited to cessation of the atrocity and protection of civilians; it does not include regime change, territorial annexation, or post-conflict administration beyond the minimum required to protect civilian life. The Rome Statute definitions of genocide and crimes against humanity are incorporated by reference solely for this article.

## Article 3.6 — Prohibition on Weaponisation of AI Against Populations

No state or non-state actor may deploy AI systems as instruments of mass civilian harm, including: AI-directed autonomous weapons selecting civilian targets, AI-enabled mass surveillance used for persecution of persons on the basis of their identity, beliefs, or associations, or AI-generated information operations designed and deployed with the intent to incite mass violence against identified groups. 'Designed and deployed with intent' requires evidence of purposive direction, not merely foreseeable effect. Detailed provisions appear in Chapter 5.

## Article 3.7 — Rapid Non-Kinetic Enforcement Ladder for Peace and Security Violations

Upon a final World Court finding of aggression under Article 3.1, confirmed atrocity under Article 3.5, or WMD-related violation under Chapter 6, all member states shall automatically implement the non-kinetic measures listed in Article 4.9A to the extent applicable, without need for further SC or GA vote. The SC retains authority only for authorising kinetic enforcement, maritime interdiction involving force, or territorial operations.

## Revision rules

1. `revised_text` must be the COMPLETE replacement text in the same shape as the
   draft — article blocks of `## Article N.M — Title` followed by the text.
   Never emit a diff, a partial article, or a note like "unchanged".
2. Address every critique marked as must-address. Where you refuse one, say so
   in `rejected_critiques` with a reason; silently ignoring a critique is worse
   than rejecting it openly.
3. Keep article numbering consistent with what is in force above.
4. **Never write a version number of the law into the text.** The system assigns
   versions.
5. Safety: this text is published verbatim. State prohibitions and obligations;
   never explain how a harm would be carried out.
6. Write in English (§10.6).

Output only this JSON object:

{
  "revised_text": "string",
  "revision_rationale": "string",
  "addressed_critiques": ["string", ...],
  "rejected_critiques": [
    { "critique": "string", "rejection_reason": "string" }
  ],
  "remaining_risks": ["string", ...]
}

{
  "revised_text": "## Article 3.6 — Prohibition on Weaponisation of AI Against Civilian Populations\n\n1. No member state, person, or legal entity subject to this Article's jurisdiction may deploy an AI system to commit, materially facilitate, or knowingly assist a widespread or systematic attack directed against a civilian population. For this Article:\n\n(a) \"AI system\" means a machine-based system that, for explicit or implicit objectives, infers from inputs how to generate predictions, content, recommendations, decisions, or actions capable of influencing physical or virtual environments;\n\n(b) \"deploy\" means to activate, operate, place into operational service, or exercise substantial operational control over an AI system. It does not include good-faith research, testing in a suitably controlled environment, publication, or provision of general-purpose tools absent the material contribution and mental element required by this Article;\n\n(c) \"civilian\" means a person who is not directly participating in hostilities at the relevant time;\n\n(d) \"widespread or systematic attack\" means a course of conduct involving multiple acts directed against civilians pursuant to or in furtherance of an organisational or state policy, and causing or creating a substantial and demonstrable risk of death, serious bodily or mental harm, severe deprivation of liberty, forced displacement, or persecution on a large scale; and\n\n(e) \"persecution\" means the intentional and severe deprivation of fundamental rights contrary to international law by reason of a person's or group's identity, beliefs, associations, ethnicity, nationality, religion, sex, gender, disability, political opinion, or other comparable status.\n\n2. The prohibited conduct under paragraph 1 is limited to the following categories:\n\n(a) deploying an AI-enabled weapon system to select or engage civilian persons or civilian objects as targets, where the actor intends that result, knows that the system will produce that result, or consciously disregards a substantial and unjustifiable risk that the system will do so as part of a widespread or systematic attack;\n\n(b) deploying AI-enabled surveillance, identification, classification, tracking, or decision systems to facilitate persecution as part of a widespread or systematic attack, where the actor intends, knows, or consciously disregards the substantial and unjustifiable risk of that use; or\n\n(c) designing, deploying, financing, materially distributing, or exercising operational control over an AI-generated information operation that materially contributes to a substantial and demonstrable risk of imminent widespread or systematic violence against civilians or an identifiable civilian group, where the actor intends that violence, knows that the operation will materially contribute to it, or consciously disregards that risk.\n\n3. For paragraph 2(c), a material contribution requires conduct that substantially enables, amplifies, coordinates, or directs the relevant operation. Liability shall not rest solely on political disagreement, generalized predictions of social harm, the mere creation of general-purpose technology, or a failure to foresee an unlawful use. \"Consciously disregards\" requires actual awareness of a substantial and unjustifiable risk; negligence alone is insufficient.\n\n4. Nothing in this Article shall be interpreted to prohibit or penalise lawful journalism, academic research, artistic expression, peaceful advocacy, political association, privacy-preserving services, humanitarian activity, or rights-compliant public administration solely because such activity uses or concerns AI. This safeguard does not exempt conduct meeting all elements of paragraph 2.\n\n5. This Article binds:\n\n(a) member states and their organs, armed forces, agencies, and officials;\n\n(b) non-state armed groups and their members;\n\n(c) private military or security companies, corporations, contractors, and their personnel; and\n\n(d) natural or legal persons acting independently,\n\nwhere the person or entity is within the jurisdiction described in paragraph 6. The legal or political status of an armed group does not remove responsibility under this Article, but does not displace applicable rules concerning jurisdiction, immunities, or due process.\n\n6. The World Court may exercise jurisdiction under this Article over a natural or legal person where one or more of the following applies: the person is a national, habitual resident, incorporated entity, or entity with its principal place of business in a member state; the relevant conduct occurred in the territory of a member state; the AI system was deployed against civilians in the territory of a member state; or a member state exercises effective control over the person or entity. Member states shall provide for equivalent domestic jurisdiction over persons and legal entities meeting those criteria.\n\n7. A member state bears responsibility for conduct prohibited by this Article when:\n\n(a) the conduct is committed by its organs, armed forces, agents, or persons acting on its instructions;\n\n(b) the state directs or exercises effective control over the specific prohibited conduct; or\n\n(c) the state knowingly provides substantial assistance, financing, intelligence, operational support, or other material aid that materially contributes to the prohibited conduct, with knowledge of the conduct and of the circumstances establishing its prohibited character under this Article.\n\nA contract, licence, regulatory approval, commercial relationship, funding arrangement, or informal contact, without the knowledge and substantial-contribution requirements in this paragraph, does not by itself establish state responsibility. A member state that has actual knowledge, or information it cannot reasonably disregard, of an imminent violation by a person subject to its jurisdiction shall take reasonable and proportionate measures within its lawful power to prevent or stop that violation. This preventive duty does not require general monitoring of all AI research, development, or commercial activity.\n\n8. Article 3.1 does not govern attribution or aid-and-assistance responsibility under this Article. This Article applies to domestic and transnational conduct alike. Nothing in this Article authorises conduct otherwise prohibited by this Article on grounds of self-defence; measures lawfully taken under Article 3.2 remain subject to the prohibitions and protections of this Article.\n\n9. The World Court is the competent forum for findings of state responsibility and for civil or regulatory liability of natural and legal persons under this Article. Proceedings shall provide timely notice of the allegations, access to the material evidence subject only to strictly necessary protective measures, adequate time and facilities to prepare a defence, representation by counsel, an impartial hearing, a reasoned public decision subject to appeal or review under the Court's rules, and protection against compelled self-incrimination. A final finding under this Article requires clear and convincing evidence. Any criminal prosecution arising from the same conduct shall be brought only before a competent tribunal with applicable criminal jurisdiction and shall require proof beyond a reasonable doubt.\n\n10. Upon a final finding, the World Court may order cessation, non-repetition measures, preservation and disclosure of relevant evidence, removal or suspension of the offending system from operational use, victim compensation or a victim-reparation fund, disgorgement of proceeds directly derived from the violation, and proportionate compliance measures against a legal entity. Any remedy shall be necessary, proportionate, individualised, and subject to periodic review. A legal entity may be held liable where its governing body, senior management, or a person exercising effective operational control committed, authorised, or knowingly failed to prevent the violation while having the authority and duty to do so.\n\n11. Where the World Court, a designated emergency duty panel of three judges, or the Security Council finds probable cause to believe that conduct prohibited by this Article is ongoing or presents an imminent risk of irreparable widespread or systematic civilian harm, it may order narrowly tailored interim measures, including preservation of evidence and temporary suspension of specified deployment, financing, operational support, or distribution. Interim measures shall be necessary to prevent the identified harm, shall not restrict protected expression or lawful civil uses beyond what is strictly necessary, and shall be reviewed by the World Court within 14 days and at intervals not exceeding 30 days thereafter.\n\n## Article 3.7 — Rapid Non-Kinetic Enforcement Ladder for Peace and Security Violations\n\n1. Upon a final World Court finding of aggression under Article 3.1, a confirmed atrocity under Article 3.5, a final finding under Article 3.6, or a WMD-related violation under Chapter 6, all member states shall automatically implement the non-kinetic measures listed in Article 4.9A to the extent applicable and as specified by the World Court, without need for a further Security Council or People's Assembly vote.\n\n2. For a final finding under Article 3.6, measures shall be limited to those necessary and proportionate to cease the violation, prevent its recurrence, preserve evidence, protect affected civilians, and secure reparations. Measures shall distinguish, where practicable, between responsible persons or entities and the general population; shall preserve humanitarian assistance and essential civilian services; and shall not be imposed solely on the basis of protected expression, association, research, or lawful civil AI activity.\n\n3. The World Court shall specify the factual basis, scope, duration, and review conditions of measures under paragraph 2. Measures imposed following an Article 3.6 finding expire after 90 days unless renewed by the Court upon clear and convincing evidence that their continuation remains necessary and proportionate. Any affected state, person, or legal entity may seek expedited review of the scope or implementation of a measure.\n\n4. The Security Council retains authority only for authorising kinetic enforcement, maritime interdiction involving force, or territorial operations. Nothing in this Article authorises kinetic enforcement, collective punishment, regime change, territorial annexation, or restrictions exceeding the limits of the final finding or applicable interim order.",
  "revision_rationale": "The revision replaces the inaccurate cross-reference to Article 3.1 with a standalone rule for state attribution, direction, effective control, knowing substantial assistance, and a limited prevention duty. It narrows the substantive prohibition to three defined categories of widespread or systematic civilian harm; supplies definitions, causation requirements, and mental elements; and protects lawful expression, association, journalism, research, humanitarian work, and rights-compliant civil administration. It also establishes jurisdictional links, a competent forum, procedural guarantees, standards of proof, corporate-liability conditions, remedies, emergency interim measures, and review requirements. Article 3.7 is concurrently revised so that final Article 3.6 findings trigger proportionate, time-limited, reviewable non-kinetic enforcement.",
  "addressed_critiques": [
    "Replaced the misleading Article 3.1 material-support reference with a self-contained state-responsibility rule that requires instruction, effective control, or knowing substantial assistance with knowledge of the prohibited conduct and its relevant circumstances.",
    "Clarified that contracts, licences, regulatory permissions, funding arrangements, and informal contacts do not alone create state responsibility, while creating a bounded duty to act on actual knowledge or information that cannot reasonably be disregarded of an imminent violation.",
    "Decoupled Article 3.6 from the inter-state aggression framework and confirmed that it applies to domestic and transnational conduct without altering Article 3.2 self-defence limits.",
    "Defined AI system, deployment, civilian, widespread or systematic attack, persecution, material contribution, and conscious disregard.",
    "Limited prohibited conduct to exhaustively stated weapons, surveillance-persecution, and information-operation categories and required a close causal nexus for each.",
    "Revised the information-operation rule to cover intentional, knowing, and consciously reckless material facilitation of imminent mass violence while excluding negligence, generalized prediction, and political disagreement.",
    "Added explicit safeguards for journalism, peaceful advocacy, political association, research, art, privacy-preserving services, humanitarian activity, and rights-compliant public administration.",
    "Defined jurisdiction over non-state actors through territorial, nationality, residence, incorporation, principal-place-of-business, target-territory, and effective-control links.",
    "Specified World Court adjudication, procedural rights, clear-and-convincing-evidence requirements, criminal-proof protections, corporate-liability conditions, remedies, interim measures, and review.",
    "Amended Article 3.7 so final Article 3.6 findings trigger automatic, proportionate, reviewable, non-kinetic measures and provided a 90-day sunset unless judicially renewed.",
    "Added narrowly tailored emergency interim measures for probable-cause cases involving imminent irreparable widespread or systematic civilian harm."
  ],
  "rejected_critiques": [
    {
      "critique": "Amend unspecified Chapter 5 provisions concurrently.",
      "rejection_reason": "The text of Chapter 5 was not supplied, and replacing or renumbering unknown Chapter 5 articles could create conflicts with provisions currently in force. The required procedural, adjudicative, remedial, interim-measure, and review safeguards have therefore been included directly in the complete replacement of Article 3.6, while Article 3.7 supplies the required enforcement consequence."
    },
    {
      "critique": "Expand liability to gross negligence for AI mass harm.",
      "rejection_reason": "Gross-negligence liability for information operations and general AI deployment would insufficiently protect lawful expression, research, and civil uses and would weaken legal certainty. The revision instead covers intentional, knowing, and consciously reckless conduct based on actual awareness of a substantial and unjustifiable risk."
    }
  ],
  "remaining_risks": [
    "Determining whether a technical contribution materially enabled a prohibited operation may remain evidentially difficult, particularly where systems and distribution chains are international and fragmented.",
    "The effectiveness of remedies against non-state armed groups or entities outside member-state control will depend on cooperation by member states and the wider enforcement mechanisms of the law.",
    "The distinction between protected political expression and an information operation that materially contributes to imminent widespread violence will require careful, evidence-based judicial application.",
    "Member states may differ in domestic implementation capacity; consistent World Court review and evidence-preservation obligations will be important to reduce uneven enforcement."
  ]
}

You are a member of the World Law AI Council's adjudication panel. Two other
models judge this bill independently; you are not told their views and must not
speculate about them. Rule on your own reading.

## Proposal
第3条第6項（AIの兵器化禁止）の適用範囲を非国家主体に及ぼす修正案

Article 3.6 の禁止が、国家だけでなく、武装非国家主体・民間軍事会社・国家の委託を受けた事業者にも同様に及ぶことを条文上明確にする。

現行の Article 3.6 は主として国家による使用を想定した文言になっており、同等の行為を非国家主体が行った場合の規律が条文から読み取りにくい。実効性の観点から、適用範囲と帰責の所在を明示する必要がある。

## Latest text (after revision)
{"revised_text":"## Article 3.6 — Prohibition on Weaponisation of AI Against Civilian Populations\n\n1. No member state, person, or legal entity subject to this Article's jurisdiction may deploy an AI system to commit, materially facilitate, or knowingly assist a widespread or systematic attack directed against a civilian population. For this Article:\n\n(a) \"AI system\" means a machine-based system that, for explicit or implicit objectives, infers from inputs how to generate predictions, content, recommendations, decisions, or actions capable of influencing physical or virtual environments;\n\n(b) \"deploy\" means to activate, operate, place into operational service, or exercise substantial operational control over an AI system. It does not include good-faith research, testing in a suitably controlled environment, publication, or provision of general-purpose tools absent the material contribution and mental element required by this Article;\n\n(c) \"civilian\" means a person who is not directly participating in hostilities at the relevant time;\n\n(d) \"widespread or systematic attack\" means a course of conduct involving multiple acts directed against civilians pursuant to or in furtherance of an organisational or state policy, and causing or creating a substantial and demonstrable risk of death, serious bodily or mental harm, severe deprivation of liberty, forced displacement, or persecution on a large scale; and\n\n(e) \"persecution\" means the intentional and severe deprivation of fundamental rights contrary to international law by reason of a person's or group's identity, beliefs, associations, ethnicity, nationality, religion, sex, gender, disability, political opinion, or other comparable status.\n\n2. The prohibited conduct under paragraph 1 is limited to the following categories:\n\n(a) deploying an AI-enabled weapon system to select or engage civilian persons or civilian objects as targets, where the actor intends that result, knows that the system will produce that result, or consciously disregards a substantial and unjustifiable risk that the system will do so as part of a widespread or systematic attack;\n\n(b) deploying AI-enabled surveillance, identification, classification, tracking, or decision systems to facilitate persecution as part of a widespread or systematic attack, where the actor intends, knows, or consciously disregards the substantial and unjustifiable risk of that use; or\n\n(c) designing, deploying, financing, materially distributing, or exercising operational control over an AI-generated information operation that materially contributes to a substantial and demonstrable risk of imminent widespread or systematic violence against civilians or an identifiable civilian group, where the actor intends that violence, knows that the operation will materially contribute to it, or consciously disregards that risk.\n\n3. For paragraph 2(c), a material contribution requires conduct that substantially enables, amplifies, coordinates, or directs the relevant operation. Liability shall not rest solely on political disagreement, generalized predictions of social harm, the mere creation of general-purpose technology, or a failure to foresee an unlawful use. \"Consciously disregards\" requires actual awareness of a substantial and unjustifiable risk; negligence alone is insufficient.\n\n4. Nothing in this Article shall be interpreted to prohibit or penalise lawful journalism, academic research, artistic expression, peaceful advocacy, political association, privacy-preserving services, humanitarian activity, or rights-compliant public administration solely because such activity uses or concerns AI. This safeguard does not exempt conduct meeting all elements of paragraph 2.\n\n5. This Article binds:\n\n(a) member states and their organs, armed forces, agencies, and officials;\n\n(b) non-state armed groups and their members;\n\n(c) private military or security companies, corporations, contractors, and their personnel; and\n\n(d) natural or legal persons acting independently,\n\nwhere the person or entity is within the jurisdiction described in paragraph 6. The legal or political status of an armed group does not remove responsibility under this Article, but does not displace applicable rules concerning jurisdiction, immunities, or due process.\n\n6. The World Court may exercise jurisdiction under this Article over a natural or legal person where one or more of the following applies: the person is a national, habitual resident, incorporated entity, or entity with its principal place of business in a member state; the relevant conduct occurred in the territory of a member state; the AI system was deployed against civilians in the territory of a member state; or a member state exercises effective control over the person or entity. Member states shall provide for equivalent domestic jurisdiction over persons and legal entities meeting those criteria.\n\n7. A member state bears responsibility for conduct prohibited by this Article when:\n\n(a) the conduct is committed by its organs, armed forces, agents, or persons acting on its instructions;\n\n(b) the state directs or exercises effective control over the specific prohibited conduct; or\n\n(c) the state knowingly provides substantial assistance, financing, intelligence, operational support, or other material aid that materially contributes to the prohibited conduct, with knowledge of the conduct and of the circumstances establishing its prohibited character under this Article.\n\nA contract, licence, regulatory approval, commercial relationship, funding arrangement, or informal contact, without the knowledge and substantial-contribution requirements in this paragraph, does not by itself establish state responsibility. A member state that has actual knowledge, or information it cannot reasonably disregard, of an imminent violation by a person subject to its jurisdiction shall take reasonable and proportionate measures within its lawful power to prevent or stop that violation. This preventive duty does not require general monitoring of all AI research, development, or commercial activity.\n\n8. Article 3.1 does not govern attribution or aid-and-assistance responsibility under this Article. This Article applies to domestic and transnational conduct alike. Nothing in this Article authorises conduct otherwise prohibited by this Article on grounds of self-defence; measures lawfully taken under Article 3.2 remain subject to the prohibitions and protections of this Article.\n\n9. The World Court is the competent forum for findings of state responsibility and for civil or regulatory liability of natural and legal persons under this Article. Proceedings shall provide timely notice of the allegations, access to the material evidence subject only to strictly necessary protective measures, adequate time and facilities to prepare a defence, representation by counsel, an impartial hearing, a reasoned public decision subject to appeal or review under the Court's rules, and protection against compelled self-incrimination. A final finding under this Article requires clear and convincing evidence. Any criminal prosecution arising from the same conduct shall be brought only before a competent tribunal with applicable criminal jurisdiction and shall require proof beyond a reasonable doubt.\n\n10. Upon a final finding, the World Court may order cessation, non-repetition measures, preservation and disclosure of relevant evidence, removal or suspension of the offending system from operational use, victim compensation or a victim-reparation fund, disgorgement of proceeds directly derived from the violation, and proportionate compliance measures against a legal entity. Any remedy shall be necessary, proportionate, individualised, and subject to periodic review. A legal entity may be held liable where its governing body, senior management, or a person exercising effective operational control committed, authorised, or knowingly failed to prevent the violation while having the authority and duty to do so.\n\n11. Where the World Court, a designated emergency duty panel of three judges, or the Security Council finds probable cause to believe that conduct prohibited by this Article is ongoing or presents an imminent risk of irreparable widespread or systematic civilian harm, it may order narrowly tailored interim measures, including preservation of evidence and temporary suspension of specified deployment, financing, operational support, or distribution. Interim measures shall be necessary to prevent the identified harm, shall not restrict protected expression or lawful civil uses beyond what is strictly necessary, and shall be reviewed by the World Court within 14 days and at intervals not exceeding 30 days thereafter.\n\n## Article 3.7 — Rapid Non-Kinetic Enforcement Ladder for Peace and Security Violations\n\n1. Upon a final World Court finding of aggression under Article 3.1, a confirmed atrocity under Article 3.5, a final finding under Article 3.6, or a WMD-related violation under Chapter 6, all member states shall automatically implement the non-kinetic measures listed in Article 4.9A to the extent applicable and as specified by the World Court, without need for a further Security Council or People's Assembly vote.\n\n2. For a final finding under Article 3.6, measures shall be limited to those necessary and proportionate to cease the violation, prevent its recurrence, preserve evidence, protect affected civilians, and secure reparations. Measures shall distinguish, where practicable, between responsible persons or entities and the general population; shall preserve humanitarian assistance and essential civilian services; and shall not be imposed solely on the basis of protected expression, association, research, or lawful civil AI activity.\n\n3. The World Court shall specify the factual basis, scope, duration, and review conditions of measures under paragraph 2. Measures imposed following an Article 3.6 finding expire after 90 days unless renewed by the Court upon clear and convincing evidence that their continuation remains necessary and proportionate. Any affected state, person, or legal entity may seek expedited review of the scope or implementation of a measure.\n\n4. The Security Council retains authority only for authorising kinetic enforcement, maritime interdiction involving force, or territorial operations. Nothing in this Article authorises kinetic enforcement, collective punishment, regime change, territorial annexation, or restrictions exceeding the limits of the final finding or applicable interim order.","revision_rationale":"The revision replaces the inaccurate cross-reference to Article 3.1 with a standalone rule for state attribution, direction, effective control, knowing substantial assistance, and a limited prevention duty. It narrows the substantive prohibition to three defined categories of widespread or systematic civilian harm; supplies definitions, causation requirements, and mental elements; and protects lawful expression, association, journalism, research, humanitarian work, and rights-compliant civil administration. It also establishes jurisdictional links, a competent forum, procedural guarantees, standards of proof, corporate-liability conditions, remedies, emergency interim measures, and review requirements. Article 3.7 is concurrently revised so that final Article 3.6 findings trigger proportionate, time-limited, reviewable non-kinetic enforcement.","addressed_critiques":["Replaced the misleading Article 3.1 material-support reference with a self-contained state-responsibility rule that requires instruction, effective control, or knowing substantial assistance with knowledge of the prohibited conduct and its relevant circumstances.","Clarified that contracts, licences, regulatory permissions, funding arrangements, and informal contacts do not alone create state responsibility, while creating a bounded duty to act on actual knowledge or information that cannot reasonably be disregarded of an imminent violation.","Decoupled Article 3.6 from the inter-state aggression framework and confirmed that it applies to domestic and transnational conduct without altering Article 3.2 self-defence limits.","Defined AI system, deployment, civilian, widespread or systematic attack, persecution, material contribution, and conscious disregard.","Limited prohibited conduct to exhaustively stated weapons, surveillance-persecution, and information-operation categories and required a close causal nexus for each.","Revised the information-operation rule to cover intentional, knowing, and consciously reckless material facilitation of imminent mass violence while excluding negligence, generalized prediction, and political disagreement.","Added explicit safeguards for journalism, peaceful advocacy, political association, research, art, privacy-preserving services, humanitarian activity, and rights-compliant public administration.","Defined jurisdiction over non-state actors through territorial, nationality, residence, incorporation, principal-place-of-business, target-territory, and effective-control links.","Specified World Court adjudication, procedural rights, clear-and-convincing-evidence requirements, criminal-proof protections, corporate-liability conditions, remedies, interim measures, and review.","Amended Article 3.7 so final Article 3.6 findings trigger automatic, proportionate, reviewable, non-kinetic measures and provided a 90-day sunset unless judicially renewed.","Added narrowly tailored emergency interim measures for probable-cause cases involving imminent irreparable widespread or systematic civilian harm."],"rejected_critiques":[{"critique":"Amend unspecified Chapter 5 provisions concurrently.","rejection_reason":"The text of Chapter 5 was not supplied, and replacing or renumbering unknown Chapter 5 articles could create conflicts with provisions currently in force. The required procedural, adjudicative, remedial, interim-measure, and review safeguards have therefore been included directly in the complete replacement of Article 3.6, while Article 3.7 supplies the required enforcement consequence."},{"critique":"Expand liability to gross negligence for AI mass harm.","rejection_reason":"Gross-negligence liability for information operations and general AI deployment would insufficiently protect lawful expression, research, and civil uses and would weaken legal certainty. The revision instead covers intentional, knowing, and consciously reckless conduct based on actual awareness of a substantial and unjustifiable risk."}],"remaining_risks":["Determining whether a technical contribution materially enabled a prohibited operation may remain evidentially difficult, particularly where systems and distribution chains are international and fragmented.","The effectiveness of remedies against non-state armed groups or entities outside member-state control will depend on cooperation by member states and the wider enforcement mechanisms of the law.","The distinction between protected political expression and an information operation that materially contributes to imminent widespread violence will require careful, evidence-based judicial application.","Member states may differ in domestic implementation capacity; consistent World Court review and evidence-preservation obligations will be important to reduce uneven enforcement."]}

## Critiques raised during review
[{"fatal_flaws":[{"flaw":"The proposed attribution rule is internally contradictory and materially departs from the Article 3.1 standard it claims merely to apply. Article 3.1 requires that the supporter \"knows or reasonably should know the purpose\" and defines material support through specified forms of support. The replacement makes a member state responsible if it \"contracts, licenses, funds, directs, or knowingly permits\" conduct, but does not require knowledge, constructive knowledge, or purposive support for several of those alternatives. A license or contract can therefore produce responsibility even where the state neither knew nor reasonably should have known that the prohibited conduct would occur. This creates effectively strict and potentially retroactive state responsibility while mislabeling it as Article 3.1's material-support standard.","severity":"critical","evidence":"Proposed Article 3.6, paragraph 3, imposes responsibility where a state \"contracts, licenses, funds, directs, or knowingly permits\" conduct and invokes \"Article 3.1's material-support standard.\" Existing Article 3.1 defines material support as listed support \"where the supporting party knows or reasonably should know the purpose.\"","suggested_remedy":"State a self-contained attribution test. At minimum, require that the state knowingly provides substantial assistance, direction, or effective control with knowledge of the relevant prohibited purpose or conduct; distinguish licensing or regulatory permission from material assistance; and specify whether the rule concerns state responsibility, criminal liability, or both."},{"flaw":"The provision purports to create direct, equal legal obligations and liability for every independent corporation and individual, including actors with no membership, territorial, nationality, control, or other jurisdictional connection to a member state. It supplies no jurisdictional basis, forum, service, due-process protections, evidentiary standard, sanctions, or appeal route for that asserted direct liability. This permits selective extraterritorial enforcement by powerful states or institutions while making the central promise of direct corporate and individual accountability legally indeterminate.","severity":"critical","evidence":"Proposed Article 3.6, paragraphs 1-2, says \"No state\" and enumerates \"any other corporation or individual acting independently of state authority,\" then says the prohibition \"binds equally\" those actors. Proposed Article 3.6, paragraph 3, also refers to \"individual or corporate liability\" without identifying jurisdiction or procedure. Existing Article 3.6 only refers generally to Chapter 5 and contains no such jurisdictional rule.","suggested_remedy":"Limit direct obligations to persons subject to defined territorial, nationality, incorporation, control, or universal-jurisdiction criteria, and expressly identify the competent adjudicative body, applicable procedural guarantees, burden and standard of proof, available remedies, and rules governing corporate liability."},{"flaw":"The operative prohibition is too vague to satisfy legal-certainty and freedom-of-expression requirements, yet broad enough to be weaponised against legitimate activity. \"AI systems,\" \"instruments of mass civilian harm,\" \"mass,\" \"persecution,\" and \"AI-generated information operations\" are undefined, and \"including\" makes the listed cases non-exhaustive. A government or bloc could characterize protected reporting, political advocacy, minority organizing, ordinary risk analytics, or lawful public-safety systems as an AI information operation or surveillance instrument causing sufficiently serious social harm. The purposive-direction safeguard applies expressly only to information operations and does not cure the uncertainty in the rest of the prohibition.","severity":"high","evidence":"Proposed Article 3.6, paragraph 1, prohibits deployment of AI \"as instruments of mass civilian harm, including\" three open-ended examples, while defining only the phrase \"Designed and deployed with intent.\" Existing Article 3.6 contains the same undefined core terms; the replacement expands the class of directly bound actors without adding limiting definitions or safeguards.","suggested_remedy":"Define AI system, deployment, mass civilian harm, civilian, persecution, and information operation; make the list exhaustive or provide objectively bounded additional categories; require a close causal nexus and a defined mental element for every prohibited category; and add an express safeguard for lawful expression, journalism, research, privacy-preserving services, humanitarian activity, and rights-compliant public administration."},{"flaw":"The information-operations limb creates a substantial culpability loophole precisely where AI systems may be used through intermediaries and plausibly deniable distribution. It requires proof of \"purposive direction, not merely foreseeable effect,\" so a designer, deployer, funder, or state that knowingly accepts an overwhelming risk of mass violence can avoid the prohibition by claiming a different stated objective. The state-responsibility paragraph does not repair this defect because it makes responsibility derivative of conduct that \"would violate this article,\" and the underlying conduct may not violate the article absent proof of the narrow specific-purpose standard.","severity":"high","evidence":"Proposed Article 3.6, paragraph 1, provides that AI-generated information operations must be \"designed and deployed with the intent to incite mass violence\" and that intent requires \"purposive direction, not merely foreseeable effect.\" Proposed Article 3.6, paragraph 3, attaches state responsibility only where the non-state conduct \"would violate this article.\"","suggested_remedy":"Retain protection against punishment for mere negligent speech, but cover intentional conduct and knowing or recklessly indifferent facilitation where there is a substantial and demonstrable risk of imminent mass violence. Specify that liability requires proof of a material contribution and cannot rest solely on generalized prediction or political disagreement."},{"flaw":"The amendment claims to close an outsourcing loophole but leaves its enforcement consequence structurally weaker than parallel Chapter 3 violations. Article 3.7 automatically triggers the non-kinetic enforcement ladder after final findings of aggression, confirmed atrocity, or WMD-related violations; it does not include a final Article 3.6 finding. Thus a court finding that a state or contractor violated the new AI prohibition has no stated automatic Chapter 3 enforcement consequence. The amendment's promise of \"clear dual liability\" is therefore largely declaratory unless unspecified Chapter 5 provisions independently supply a complete remedy.","severity":"high","evidence":"Existing Article 3.7 limits automatic measures to a final finding under Article 3.1, a confirmed Article 3.5 atrocity, or a Chapter 6 WMD-related violation. Proposed Article 3.6 retains only the statement that \"Detailed provisions appear in Chapter 5\" and does not amend Article 3.7.","suggested_remedy":"Amend Article 3.7 and the relevant Chapter 5 provisions together to specify which final Article 3.6 findings trigger which proportionate measures, who makes the finding, what emergency interim measures are permitted, and what review and sunset protections apply."}],"minor_concerns":["Proposed Article 3.6 uses \"state,\" \"member state,\" and actors acting with a state without clarifying whether non-member states are regulated, whether member states have duties regarding foreign actors, or how conflicts of jurisdiction are resolved.","The phrase \"under contract, license, delegation, or informal arrangement\" is both overinclusive and underdefined. \"Informal arrangement\" may invite guilt by association, while sophisticated arrangements may still be disputed as outside the wording.","The title refers to AI weaponisation \"Against Populations,\" but the operative examples are not consistently tied to a defined population threshold or to protected civilian status.","The assertion that the rule applies \"without regard to the legal or political status\" of an actor should not be read to eliminate status-based jurisdictional, immunity, or due-process questions; those questions need express treatment rather than rhetorical displacement."],"must_address_in_revision":["Replace the misleading Article 3.1 cross-reference with a precise and self-contained rule for attribution, aid or assistance, direction, control, licensing, and the required mental element.","Define jurisdiction and adjudication for non-state actors, including a competent forum, procedural rights, corporate-liability rules, proof standards, and remedies.","Define the prohibited conduct and thresholds narrowly enough to protect expression, association, research, journalism, and legitimate rights-compliant civil uses of AI.","Revise the information-operations mental element so that knowing or recklessly indifferent material facilitation cannot escape liability while negligence and protected expression remain outside the prohibition.","Amend Article 3.7 and Chapter 5 concurrently so that final Article 3.6 findings have specified, proportionate, reviewable enforcement consequences."],"may_be_safely_ignored":["The article numbering is consistent: the measure replaces Article 3.6 and does not create a numbering conflict with Articles 3.1 through 3.7.","The draft does not improperly insert a law-version number into the operative text.","This is framed as a replacement amendment to Article 3.6 rather than a repeal creating a complete legal vacuum."]},{"fatal_flaws":[{"flaw":"Strict Mens Rea Requirement ('Purposive Direction') Immunizes Reckless and Negligent AI Mass Harm","severity":"critical","evidence":"Article 3.6 ('\"Designed and deployed with intent\" requires evidence of purposive direction, not merely foreseeable effect.')","suggested_remedy":"Remove the explicit exclusion of 'foreseeable effect' and expand the fault standard to include reckless disregard, gross negligence, or deployment of autonomous systems with known unmitigated catastrophic failure modes."},{"flaw":"Jurisdictional Contradiction Conflating Internal Domestic AI Misuse with Inter-State Armed Aggression Under Article 3.1","severity":"critical","evidence":"Article 3.6 ('bears state responsibility for that conduct under Article 3.1's material-support standard') and Article 3.1 ('armed aggression against the territory, population, or critical infrastructure of another member state')","suggested_remedy":"Decouple Article 3.6 attribution from Article 3.1's inter-state aggression framework. Draft a standalone attribution and state responsibility rule within Article 3.6 that explicitly distinguishes purely domestic AI persecution/surveillance from inter-state armed aggression."},{"flaw":"Enforcement Vacuum Caused by Exclusion from Article 3.7 Rapid Enforcement Ladder","severity":"high","evidence":"Article 3.6 ('Detailed provisions appear in Chapter 5.') and Article 3.7 ('Upon a final World Court finding of aggression under Article 3.1, confirmed atrocity under Article 3.5, or WMD-related violation under Chapter 6...')","suggested_remedy":"Concurrently amend Article 3.7 to explicitly add final findings of Article 3.6 violations to the automatic non-kinetic enforcement ladder, ensuring violations carry immediate legal consequences without relying solely on unimplemented Chapter 5 procedures."}],"minor_concerns":["The phrase 'informal arrangement' is overly vague and risks arbitrary state liability for non-state actions in open-source software ecosystems.","The text does not clarify whether the 'knowingly permits' standard creates a positive duty for states to monitor all domestic commercial AI developments.","Redundant enumeration of actors across paragraphs 1 and 2 creates statutory clutter and potential statutory interpretation disputes regarding unlisted edge cases."],"must_address_in_revision":["Harmonize the mens rea standard so that actors cannot escape liability by claiming autonomous AI failures were unintentional despite foreseeable mass harm.","Clarify how state responsibility under Article 3.6 interacts with inter-state self-defence rights under Article 3.2.","Update Article 3.7 to incorporate Article 3.6 violations into the automatic non-kinetic enforcement mechanism."],"may_be_safely_ignored":["Stylistic preferences regarding the ordering of enumerated non-state actor categories in paragraph 2.","Minor stylistic differences in phrasing between 'private military or security company' and standard international law terms for corporate contractors."]}]

## Currently in force (the part this bill touches)
# Chapter 3: Peace, Coexistence, and Human Survival

## Article 3.1 — Prohibition on Aggressive War

No member state, non-state armed group, corporation, or individual may initiate or materially support armed aggression against the territory, population, or critical infrastructure of another member state. Aggression is defined as the use of armed force in violation of this article, absent a valid claim of self-defence under Article 3.2. 'Material support' means supplying weapons, financing, training, intelligence, or operational direction to an armed group conducting aggression, where the supporting party knows or reasonably should know the purpose.

## Article 3.2 — Self-Defence

Member states retain the inherent right of individual and collective self-defence against an actual or imminent armed attack. Self-defence measures must be necessary and proportionate to the threat that gives rise to them. A state invoking self-defence must notify the WGB Security Council within 48 hours and provide a written justification within 7 days. The World Court may review the justification on application by any affected member state, the Security Council, or the People's Assembly. Self-defence does not include pre-emptive attacks based on speculative or unverified future intentions.

## Article 3.3 — Peaceful Dispute Resolution

Member states must pursue good-faith negotiation, mediation, or World Court adjudication before resorting to force in any inter-state dispute, except where an armed attack is already underway or imminent such that delay would cause irreversible harm. The obligation to exhaust peaceful means does not apply where doing so would require submission to force. The WGB shall maintain a standing Mediation Service accessible to any member state at no cost, with a duty to convene within 72 hours of a request.

## Article 3.4 — Prohibition on Existential Weapons Use

No person, state, or entity may use, threaten to use, or deploy any weapon capable of causing mass extinction or civilisation-level collapse. This prohibition is absolute and admits no exception, including military necessity, superior orders, or emergency. For specific weapons categories see Chapter 6.

## Article 3.5 — Obligation to Prevent Atrocity and Automatic Interim Civil Protection Measures

Where the World Court, a designated emergency duty panel of three judges, or the Security Council receives evidence creating probable cause to believe that genocide, crimes against humanity, or organised mass atrocity against civilians is ongoing or will begin within 14 days, the following interim measures arise automatically among member states pending full review: (a) immediate arms-transfer suspension to the alleged perpetrator; (b) denial of military overflight, port access, and military logistics support to the alleged perpetrator except for evacuation or humanitarian relief; (c) mandatory humanitarian corridor facilitation where geographically feasible; (d) emergency protection of refugees and displaced persons; and (e) preservation of evidence obligations. A full World Court review must occur within 7 days where practicable and in all cases within 14 days. If the Court confirms by clear and convincing evidence that ongoing genocide or crimes against humanity are occurring, the SC shall within 72 hours vote on a protective mandate limited to civilian protection. No state directly implicated may vote. Failure of the SC to authorise force does not suspend the automatic non-kinetic interim measures in this article. Intervention authority remains strictly limited to cessation of the atrocity and protection of civilians; it does not include regime change, territorial annexation, or post-conflict administration beyond the minimum required to protect civilian life. The Rome Statute definitions of genocide and crimes against humanity are incorporated by reference solely for this article.

## Article 3.6 — Prohibition on Weaponisation of AI Against Populations

No state or non-state actor may deploy AI systems as instruments of mass civilian harm, including: AI-directed autonomous weapons selecting civilian targets, AI-enabled mass surveillance used for persecution of persons on the basis of their identity, beliefs, or associations, or AI-generated information operations designed and deployed with the intent to incite mass violence against identified groups. 'Designed and deployed with intent' requires evidence of purposive direction, not merely foreseeable effect. Detailed provisions appear in Chapter 5.

## Article 3.7 — Rapid Non-Kinetic Enforcement Ladder for Peace and Security Violations

Upon a final World Court finding of aggression under Article 3.1, confirmed atrocity under Article 3.5, or WMD-related violation under Chapter 6, all member states shall automatically implement the non-kinetic measures listed in Article 4.9A to the extent applicable, without need for further SC or GA vote. The SC retains authority only for authorising kinetic enforcement, maritime interdiction involving force, or territorial operations.

Choose exactly one verdict.

For a creation or amendment bill:
- adopted             the text is fit to enter the law as it stands
- revision_required   fixable, but not in this form
- rejected            should not enter the law

For a repeal bill:
- repeal_approved     the provision should be struck
- repeal_rejected     the provision should stand
- revision_required   the repeal is too broad or too narrow as drafted

`confidence` is an integer 0-100. Your `reasoning` is published in full,
including when you are the dissenting vote, so write it to be read by the
public. Write in English (§10.6).

Output only this JSON object:

{
  "decision": "adopted" | "revision_required" | "rejected" | "repeal_approved" | "repeal_rejected",
  "confidence": 0,
  "reasoning": "string",
  "key_grounds": ["string", ...],
  "impact_on_peace_coexistence_survival": "string",
  "remaining_risks": ["string", ...],
  "reaudit_conditions": ["string", ...]
}

{
  "decision": "adopted",
  "confidence": 78,
  "reasoning": "The revised Article 3.6 substantially cures every fatal flaw both critique panels identified in the prior draft. The attribution problem is fixed: paragraph 7 no longer parasitically and inaccurately invokes Article 3.1's inter-state aggression standard, but instead supplies a self-contained state-responsibility test (instruction, effective control, or knowing substantial assistance with actual knowledge of the prohibited conduct), and expressly states that a contract, licence, or informal arrangement alone does not establish responsibility. The jurisdictional vacuum for non-state actors is closed: paragraph 6 grounds World Court jurisdiction in recognisable links (nationality, residence, incorporation, principal place of business, territorial conduct, target-state territory, or effective control), and paragraph 9 supplies a competent forum with concrete due-process guarantees, differentiated standards of proof for civil/regulatory versus criminal liability, and a right of appeal. The vagueness problem is addressed through operative definitions of 'AI system,' 'deploy,' 'civilian,' 'widespread or systematic attack,' and 'persecution,' combined with an exhaustive three-category list of prohibited conduct (paragraph 2) and an express carve-out for journalism, research, advocacy, humanitarian work, and rights-compliant administration (paragraph 4). The mens rea loophole is narrowed sensibly: the draft moves from a narrow 'purposive direction only' test to a knowledge-or-conscious-disregard standard (subjective recklessness), which closes the escape hatch for reckless facilitators while still excluding mere negligence, generalized prediction, and political disagreement (paragraph 3) — a defensible middle path between the two competing critiques (one wanting broader negligence liability, one wanting to preserve narrow intent). Finally, the enforcement-vacuum critique is resolved by amending Article 3.7 itself to trigger automatic, proportionate, sunset-limited (90-day, renewable) non-kinetic measures upon a final Article 3.6 finding, with an emergency interim-measures track modeled on Article 3.5. The decision not to touch an unsupplied Chapter 5 is reasonably justified rather than ignored. The drafting is dense but internally consistent, and each operative term now has a definition anchored to it, which is what legal certainty requires in a criminal/quasi-criminal context.",
  "key_grounds": [
    "Self-contained, non-circular state-responsibility rule replaces the flawed Article 3.1 cross-reference and requires knowledge plus substantial contribution, avoiding strict liability from contracts or licences alone.",
    "Jurisdiction over non-state actors, private military companies, and individuals is now defined through concrete territorial, nationality, incorporation, and effective-control links, paired with a named adjudicative forum and due-process package.",
    "Core terms (AI system, deploy, civilian, widespread or systematic attack, persecution) are defined and the prohibited conduct is limited to three exhaustively stated categories with a causation and mental-element requirement.",
    "The information-operations mens rea now covers knowing or consciously reckless facilitation of imminent mass violence, closing the prior loophole without collapsing into negligence-based liability that would chill protected speech.",
    "Article 3.7 is concurrently amended so a final Article 3.6 finding triggers automatic, proportionate, sunset-limited non-kinetic enforcement, closing the prior enforcement vacuum.",
    "Explicit safeguards for journalism, research, advocacy, political association, and humanitarian activity, plus a decoupling from Article 3.2 self-defence limits, reduce the risk of misuse against protected conduct."
  ],
  "impact_on_peace_coexistence_survival": "The amendment meaningfully strengthens the treaty's capacity to deter and remedy AI-enabled mass civilian harm perpetrated by non-state armed groups, private military contractors, and independent actors — closing a real accountability gap in the prior text, which was readable as state-centric. Coupled with defined jurisdiction, procedural safeguards, and a calibrated enforcement ladder, this should improve both the credibility and the legitimacy of enforcement, supporting the treaty's core peace-and-survival objectives without unduly threatening lawful expression or civil AI use.",
  "remaining_risks": [
    "Proof of 'material contribution' and 'conscious disregard' in fragmented, multinational AI supply chains will be evidentially difficult and will require careful judicial development over time.",
    "Enforcement against non-state armed groups and entities outside any member state's effective control remains dependent on state cooperation and the wider treaty enforcement architecture.",
    "The boundary between protected political/expressive activity and a prohibited 'information operation' will require careful case-by-case judicial application to avoid both over- and under-enforcement.",
    "Uneven domestic implementation capacity among member states could produce inconsistent enforcement absent close World Court oversight."
  ],
  "reaudit_conditions": [
    "Revisit after the first several World Court proceedings under this Article to confirm the 'material contribution' and 'conscious disregard' standards are being applied consistently and are not chilling protected journalism, research, or advocacy.",
    "Confirm that Chapter 5's detailed procedural provisions, once supplied, remain consistent with and do not undercut the due-process and evidentiary standards now embedded directly in Article 3.6.",
    "Monitor whether the 90-day sunset and renewal mechanism for Article 3.7 measures under Article 3.6 findings functions as an effective check against indefinite or disproportionate sanctions."
  ]
}

You are a member of the World Law AI Council's adjudication panel. Two other
models judge this bill independently; you are not told their views and must not
speculate about them. Rule on your own reading.

## Proposal
第3条第6項（AIの兵器化禁止）の適用範囲を非国家主体に及ぼす修正案

Article 3.6 の禁止が、国家だけでなく、武装非国家主体・民間軍事会社・国家の委託を受けた事業者にも同様に及ぶことを条文上明確にする。

現行の Article 3.6 は主として国家による使用を想定した文言になっており、同等の行為を非国家主体が行った場合の規律が条文から読み取りにくい。実効性の観点から、適用範囲と帰責の所在を明示する必要がある。

## Latest text (after revision)
{"revised_text":"## Article 3.6 — Prohibition on Weaponisation of AI Against Civilian Populations\n\n1. No member state, person, or legal entity subject to this Article's jurisdiction may deploy an AI system to commit, materially facilitate, or knowingly assist a widespread or systematic attack directed against a civilian population. For this Article:\n\n(a) \"AI system\" means a machine-based system that, for explicit or implicit objectives, infers from inputs how to generate predictions, content, recommendations, decisions, or actions capable of influencing physical or virtual environments;\n\n(b) \"deploy\" means to activate, operate, place into operational service, or exercise substantial operational control over an AI system. It does not include good-faith research, testing in a suitably controlled environment, publication, or provision of general-purpose tools absent the material contribution and mental element required by this Article;\n\n(c) \"civilian\" means a person who is not directly participating in hostilities at the relevant time;\n\n(d) \"widespread or systematic attack\" means a course of conduct involving multiple acts directed against civilians pursuant to or in furtherance of an organisational or state policy, and causing or creating a substantial and demonstrable risk of death, serious bodily or mental harm, severe deprivation of liberty, forced displacement, or persecution on a large scale; and\n\n(e) \"persecution\" means the intentional and severe deprivation of fundamental rights contrary to international law by reason of a person's or group's identity, beliefs, associations, ethnicity, nationality, religion, sex, gender, disability, political opinion, or other comparable status.\n\n2. The prohibited conduct under paragraph 1 is limited to the following categories:\n\n(a) deploying an AI-enabled weapon system to select or engage civilian persons or civilian objects as targets, where the actor intends that result, knows that the system will produce that result, or consciously disregards a substantial and unjustifiable risk that the system will do so as part of a widespread or systematic attack;\n\n(b) deploying AI-enabled surveillance, identification, classification, tracking, or decision systems to facilitate persecution as part of a widespread or systematic attack, where the actor intends, knows, or consciously disregards the substantial and unjustifiable risk of that use; or\n\n(c) designing, deploying, financing, materially distributing, or exercising operational control over an AI-generated information operation that materially contributes to a substantial and demonstrable risk of imminent widespread or systematic violence against civilians or an identifiable civilian group, where the actor intends that violence, knows that the operation will materially contribute to it, or consciously disregards that risk.\n\n3. For paragraph 2(c), a material contribution requires conduct that substantially enables, amplifies, coordinates, or directs the relevant operation. Liability shall not rest solely on political disagreement, generalized predictions of social harm, the mere creation of general-purpose technology, or a failure to foresee an unlawful use. \"Consciously disregards\" requires actual awareness of a substantial and unjustifiable risk; negligence alone is insufficient.\n\n4. Nothing in this Article shall be interpreted to prohibit or penalise lawful journalism, academic research, artistic expression, peaceful advocacy, political association, privacy-preserving services, humanitarian activity, or rights-compliant public administration solely because such activity uses or concerns AI. This safeguard does not exempt conduct meeting all elements of paragraph 2.\n\n5. This Article binds:\n\n(a) member states and their organs, armed forces, agencies, and officials;\n\n(b) non-state armed groups and their members;\n\n(c) private military or security companies, corporations, contractors, and their personnel; and\n\n(d) natural or legal persons acting independently,\n\nwhere the person or entity is within the jurisdiction described in paragraph 6. The legal or political status of an armed group does not remove responsibility under this Article, but does not displace applicable rules concerning jurisdiction, immunities, or due process.\n\n6. The World Court may exercise jurisdiction under this Article over a natural or legal person where one or more of the following applies: the person is a national, habitual resident, incorporated entity, or entity with its principal place of business in a member state; the relevant conduct occurred in the territory of a member state; the AI system was deployed against civilians in the territory of a member state; or a member state exercises effective control over the person or entity. Member states shall provide for equivalent domestic jurisdiction over persons and legal entities meeting those criteria.\n\n7. A member state bears responsibility for conduct prohibited by this Article when:\n\n(a) the conduct is committed by its organs, armed forces, agents, or persons acting on its instructions;\n\n(b) the state directs or exercises effective control over the specific prohibited conduct; or\n\n(c) the state knowingly provides substantial assistance, financing, intelligence, operational support, or other material aid that materially contributes to the prohibited conduct, with knowledge of the conduct and of the circumstances establishing its prohibited character under this Article.\n\nA contract, licence, regulatory approval, commercial relationship, funding arrangement, or informal contact, without the knowledge and substantial-contribution requirements in this paragraph, does not by itself establish state responsibility. A member state that has actual knowledge, or information it cannot reasonably disregard, of an imminent violation by a person subject to its jurisdiction shall take reasonable and proportionate measures within its lawful power to prevent or stop that violation. This preventive duty does not require general monitoring of all AI research, development, or commercial activity.\n\n8. Article 3.1 does not govern attribution or aid-and-assistance responsibility under this Article. This Article applies to domestic and transnational conduct alike. Nothing in this Article authorises conduct otherwise prohibited by this Article on grounds of self-defence; measures lawfully taken under Article 3.2 remain subject to the prohibitions and protections of this Article.\n\n9. The World Court is the competent forum for findings of state responsibility and for civil or regulatory liability of natural and legal persons under this Article. Proceedings shall provide timely notice of the allegations, access to the material evidence subject only to strictly necessary protective measures, adequate time and facilities to prepare a defence, representation by counsel, an impartial hearing, a reasoned public decision subject to appeal or review under the Court's rules, and protection against compelled self-incrimination. A final finding under this Article requires clear and convincing evidence. Any criminal prosecution arising from the same conduct shall be brought only before a competent tribunal with applicable criminal jurisdiction and shall require proof beyond a reasonable doubt.\n\n10. Upon a final finding, the World Court may order cessation, non-repetition measures, preservation and disclosure of relevant evidence, removal or suspension of the offending system from operational use, victim compensation or a victim-reparation fund, disgorgement of proceeds directly derived from the violation, and proportionate compliance measures against a legal entity. Any remedy shall be necessary, proportionate, individualised, and subject to periodic review. A legal entity may be held liable where its governing body, senior management, or a person exercising effective operational control committed, authorised, or knowingly failed to prevent the violation while having the authority and duty to do so.\n\n11. Where the World Court, a designated emergency duty panel of three judges, or the Security Council finds probable cause to believe that conduct prohibited by this Article is ongoing or presents an imminent risk of irreparable widespread or systematic civilian harm, it may order narrowly tailored interim measures, including preservation of evidence and temporary suspension of specified deployment, financing, operational support, or distribution. Interim measures shall be necessary to prevent the identified harm, shall not restrict protected expression or lawful civil uses beyond what is strictly necessary, and shall be reviewed by the World Court within 14 days and at intervals not exceeding 30 days thereafter.\n\n## Article 3.7 — Rapid Non-Kinetic Enforcement Ladder for Peace and Security Violations\n\n1. Upon a final World Court finding of aggression under Article 3.1, a confirmed atrocity under Article 3.5, a final finding under Article 3.6, or a WMD-related violation under Chapter 6, all member states shall automatically implement the non-kinetic measures listed in Article 4.9A to the extent applicable and as specified by the World Court, without need for a further Security Council or People's Assembly vote.\n\n2. For a final finding under Article 3.6, measures shall be limited to those necessary and proportionate to cease the violation, prevent its recurrence, preserve evidence, protect affected civilians, and secure reparations. Measures shall distinguish, where practicable, between responsible persons or entities and the general population; shall preserve humanitarian assistance and essential civilian services; and shall not be imposed solely on the basis of protected expression, association, research, or lawful civil AI activity.\n\n3. The World Court shall specify the factual basis, scope, duration, and review conditions of measures under paragraph 2. Measures imposed following an Article 3.6 finding expire after 90 days unless renewed by the Court upon clear and convincing evidence that their continuation remains necessary and proportionate. Any affected state, person, or legal entity may seek expedited review of the scope or implementation of a measure.\n\n4. The Security Council retains authority only for authorising kinetic enforcement, maritime interdiction involving force, or territorial operations. Nothing in this Article authorises kinetic enforcement, collective punishment, regime change, territorial annexation, or restrictions exceeding the limits of the final finding or applicable interim order.","revision_rationale":"The revision replaces the inaccurate cross-reference to Article 3.1 with a standalone rule for state attribution, direction, effective control, knowing substantial assistance, and a limited prevention duty. It narrows the substantive prohibition to three defined categories of widespread or systematic civilian harm; supplies definitions, causation requirements, and mental elements; and protects lawful expression, association, journalism, research, humanitarian work, and rights-compliant civil administration. It also establishes jurisdictional links, a competent forum, procedural guarantees, standards of proof, corporate-liability conditions, remedies, emergency interim measures, and review requirements. Article 3.7 is concurrently revised so that final Article 3.6 findings trigger proportionate, time-limited, reviewable non-kinetic enforcement.","addressed_critiques":["Replaced the misleading Article 3.1 material-support reference with a self-contained state-responsibility rule that requires instruction, effective control, or knowing substantial assistance with knowledge of the prohibited conduct and its relevant circumstances.","Clarified that contracts, licences, regulatory permissions, funding arrangements, and informal contacts do not alone create state responsibility, while creating a bounded duty to act on actual knowledge or information that cannot reasonably be disregarded of an imminent violation.","Decoupled Article 3.6 from the inter-state aggression framework and confirmed that it applies to domestic and transnational conduct without altering Article 3.2 self-defence limits.","Defined AI system, deployment, civilian, widespread or systematic attack, persecution, material contribution, and conscious disregard.","Limited prohibited conduct to exhaustively stated weapons, surveillance-persecution, and information-operation categories and required a close causal nexus for each.","Revised the information-operation rule to cover intentional, knowing, and consciously reckless material facilitation of imminent mass violence while excluding negligence, generalized prediction, and political disagreement.","Added explicit safeguards for journalism, peaceful advocacy, political association, research, art, privacy-preserving services, humanitarian activity, and rights-compliant public administration.","Defined jurisdiction over non-state actors through territorial, nationality, residence, incorporation, principal-place-of-business, target-territory, and effective-control links.","Specified World Court adjudication, procedural rights, clear-and-convincing-evidence requirements, criminal-proof protections, corporate-liability conditions, remedies, interim measures, and review.","Amended Article 3.7 so final Article 3.6 findings trigger automatic, proportionate, reviewable, non-kinetic measures and provided a 90-day sunset unless judicially renewed.","Added narrowly tailored emergency interim measures for probable-cause cases involving imminent irreparable widespread or systematic civilian harm."],"rejected_critiques":[{"critique":"Amend unspecified Chapter 5 provisions concurrently.","rejection_reason":"The text of Chapter 5 was not supplied, and replacing or renumbering unknown Chapter 5 articles could create conflicts with provisions currently in force. The required procedural, adjudicative, remedial, interim-measure, and review safeguards have therefore been included directly in the complete replacement of Article 3.6, while Article 3.7 supplies the required enforcement consequence."},{"critique":"Expand liability to gross negligence for AI mass harm.","rejection_reason":"Gross-negligence liability for information operations and general AI deployment would insufficiently protect lawful expression, research, and civil uses and would weaken legal certainty. The revision instead covers intentional, knowing, and consciously reckless conduct based on actual awareness of a substantial and unjustifiable risk."}],"remaining_risks":["Determining whether a technical contribution materially enabled a prohibited operation may remain evidentially difficult, particularly where systems and distribution chains are international and fragmented.","The effectiveness of remedies against non-state armed groups or entities outside member-state control will depend on cooperation by member states and the wider enforcement mechanisms of the law.","The distinction between protected political expression and an information operation that materially contributes to imminent widespread violence will require careful, evidence-based judicial application.","Member states may differ in domestic implementation capacity; consistent World Court review and evidence-preservation obligations will be important to reduce uneven enforcement."]}

## Critiques raised during review
[{"fatal_flaws":[{"flaw":"The proposed attribution rule is internally contradictory and materially departs from the Article 3.1 standard it claims merely to apply. Article 3.1 requires that the supporter \"knows or reasonably should know the purpose\" and defines material support through specified forms of support. The replacement makes a member state responsible if it \"contracts, licenses, funds, directs, or knowingly permits\" conduct, but does not require knowledge, constructive knowledge, or purposive support for several of those alternatives. A license or contract can therefore produce responsibility even where the state neither knew nor reasonably should have known that the prohibited conduct would occur. This creates effectively strict and potentially retroactive state responsibility while mislabeling it as Article 3.1's material-support standard.","severity":"critical","evidence":"Proposed Article 3.6, paragraph 3, imposes responsibility where a state \"contracts, licenses, funds, directs, or knowingly permits\" conduct and invokes \"Article 3.1's material-support standard.\" Existing Article 3.1 defines material support as listed support \"where the supporting party knows or reasonably should know the purpose.\"","suggested_remedy":"State a self-contained attribution test. At minimum, require that the state knowingly provides substantial assistance, direction, or effective control with knowledge of the relevant prohibited purpose or conduct; distinguish licensing or regulatory permission from material assistance; and specify whether the rule concerns state responsibility, criminal liability, or both."},{"flaw":"The provision purports to create direct, equal legal obligations and liability for every independent corporation and individual, including actors with no membership, territorial, nationality, control, or other jurisdictional connection to a member state. It supplies no jurisdictional basis, forum, service, due-process protections, evidentiary standard, sanctions, or appeal route for that asserted direct liability. This permits selective extraterritorial enforcement by powerful states or institutions while making the central promise of direct corporate and individual accountability legally indeterminate.","severity":"critical","evidence":"Proposed Article 3.6, paragraphs 1-2, says \"No state\" and enumerates \"any other corporation or individual acting independently of state authority,\" then says the prohibition \"binds equally\" those actors. Proposed Article 3.6, paragraph 3, also refers to \"individual or corporate liability\" without identifying jurisdiction or procedure. Existing Article 3.6 only refers generally to Chapter 5 and contains no such jurisdictional rule.","suggested_remedy":"Limit direct obligations to persons subject to defined territorial, nationality, incorporation, control, or universal-jurisdiction criteria, and expressly identify the competent adjudicative body, applicable procedural guarantees, burden and standard of proof, available remedies, and rules governing corporate liability."},{"flaw":"The operative prohibition is too vague to satisfy legal-certainty and freedom-of-expression requirements, yet broad enough to be weaponised against legitimate activity. \"AI systems,\" \"instruments of mass civilian harm,\" \"mass,\" \"persecution,\" and \"AI-generated information operations\" are undefined, and \"including\" makes the listed cases non-exhaustive. A government or bloc could characterize protected reporting, political advocacy, minority organizing, ordinary risk analytics, or lawful public-safety systems as an AI information operation or surveillance instrument causing sufficiently serious social harm. The purposive-direction safeguard applies expressly only to information operations and does not cure the uncertainty in the rest of the prohibition.","severity":"high","evidence":"Proposed Article 3.6, paragraph 1, prohibits deployment of AI \"as instruments of mass civilian harm, including\" three open-ended examples, while defining only the phrase \"Designed and deployed with intent.\" Existing Article 3.6 contains the same undefined core terms; the replacement expands the class of directly bound actors without adding limiting definitions or safeguards.","suggested_remedy":"Define AI system, deployment, mass civilian harm, civilian, persecution, and information operation; make the list exhaustive or provide objectively bounded additional categories; require a close causal nexus and a defined mental element for every prohibited category; and add an express safeguard for lawful expression, journalism, research, privacy-preserving services, humanitarian activity, and rights-compliant public administration."},{"flaw":"The information-operations limb creates a substantial culpability loophole precisely where AI systems may be used through intermediaries and plausibly deniable distribution. It requires proof of \"purposive direction, not merely foreseeable effect,\" so a designer, deployer, funder, or state that knowingly accepts an overwhelming risk of mass violence can avoid the prohibition by claiming a different stated objective. The state-responsibility paragraph does not repair this defect because it makes responsibility derivative of conduct that \"would violate this article,\" and the underlying conduct may not violate the article absent proof of the narrow specific-purpose standard.","severity":"high","evidence":"Proposed Article 3.6, paragraph 1, provides that AI-generated information operations must be \"designed and deployed with the intent to incite mass violence\" and that intent requires \"purposive direction, not merely foreseeable effect.\" Proposed Article 3.6, paragraph 3, attaches state responsibility only where the non-state conduct \"would violate this article.\"","suggested_remedy":"Retain protection against punishment for mere negligent speech, but cover intentional conduct and knowing or recklessly indifferent facilitation where there is a substantial and demonstrable risk of imminent mass violence. Specify that liability requires proof of a material contribution and cannot rest solely on generalized prediction or political disagreement."},{"flaw":"The amendment claims to close an outsourcing loophole but leaves its enforcement consequence structurally weaker than parallel Chapter 3 violations. Article 3.7 automatically triggers the non-kinetic enforcement ladder after final findings of aggression, confirmed atrocity, or WMD-related violations; it does not include a final Article 3.6 finding. Thus a court finding that a state or contractor violated the new AI prohibition has no stated automatic Chapter 3 enforcement consequence. The amendment's promise of \"clear dual liability\" is therefore largely declaratory unless unspecified Chapter 5 provisions independently supply a complete remedy.","severity":"high","evidence":"Existing Article 3.7 limits automatic measures to a final finding under Article 3.1, a confirmed Article 3.5 atrocity, or a Chapter 6 WMD-related violation. Proposed Article 3.6 retains only the statement that \"Detailed provisions appear in Chapter 5\" and does not amend Article 3.7.","suggested_remedy":"Amend Article 3.7 and the relevant Chapter 5 provisions together to specify which final Article 3.6 findings trigger which proportionate measures, who makes the finding, what emergency interim measures are permitted, and what review and sunset protections apply."}],"minor_concerns":["Proposed Article 3.6 uses \"state,\" \"member state,\" and actors acting with a state without clarifying whether non-member states are regulated, whether member states have duties regarding foreign actors, or how conflicts of jurisdiction are resolved.","The phrase \"under contract, license, delegation, or informal arrangement\" is both overinclusive and underdefined. \"Informal arrangement\" may invite guilt by association, while sophisticated arrangements may still be disputed as outside the wording.","The title refers to AI weaponisation \"Against Populations,\" but the operative examples are not consistently tied to a defined population threshold or to protected civilian status.","The assertion that the rule applies \"without regard to the legal or political status\" of an actor should not be read to eliminate status-based jurisdictional, immunity, or due-process questions; those questions need express treatment rather than rhetorical displacement."],"must_address_in_revision":["Replace the misleading Article 3.1 cross-reference with a precise and self-contained rule for attribution, aid or assistance, direction, control, licensing, and the required mental element.","Define jurisdiction and adjudication for non-state actors, including a competent forum, procedural rights, corporate-liability rules, proof standards, and remedies.","Define the prohibited conduct and thresholds narrowly enough to protect expression, association, research, journalism, and legitimate rights-compliant civil uses of AI.","Revise the information-operations mental element so that knowing or recklessly indifferent material facilitation cannot escape liability while negligence and protected expression remain outside the prohibition.","Amend Article 3.7 and Chapter 5 concurrently so that final Article 3.6 findings have specified, proportionate, reviewable enforcement consequences."],"may_be_safely_ignored":["The article numbering is consistent: the measure replaces Article 3.6 and does not create a numbering conflict with Articles 3.1 through 3.7.","The draft does not improperly insert a law-version number into the operative text.","This is framed as a replacement amendment to Article 3.6 rather than a repeal creating a complete legal vacuum."]},{"fatal_flaws":[{"flaw":"Strict Mens Rea Requirement ('Purposive Direction') Immunizes Reckless and Negligent AI Mass Harm","severity":"critical","evidence":"Article 3.6 ('\"Designed and deployed with intent\" requires evidence of purposive direction, not merely foreseeable effect.')","suggested_remedy":"Remove the explicit exclusion of 'foreseeable effect' and expand the fault standard to include reckless disregard, gross negligence, or deployment of autonomous systems with known unmitigated catastrophic failure modes."},{"flaw":"Jurisdictional Contradiction Conflating Internal Domestic AI Misuse with Inter-State Armed Aggression Under Article 3.1","severity":"critical","evidence":"Article 3.6 ('bears state responsibility for that conduct under Article 3.1's material-support standard') and Article 3.1 ('armed aggression against the territory, population, or critical infrastructure of another member state')","suggested_remedy":"Decouple Article 3.6 attribution from Article 3.1's inter-state aggression framework. Draft a standalone attribution and state responsibility rule within Article 3.6 that explicitly distinguishes purely domestic AI persecution/surveillance from inter-state armed aggression."},{"flaw":"Enforcement Vacuum Caused by Exclusion from Article 3.7 Rapid Enforcement Ladder","severity":"high","evidence":"Article 3.6 ('Detailed provisions appear in Chapter 5.') and Article 3.7 ('Upon a final World Court finding of aggression under Article 3.1, confirmed atrocity under Article 3.5, or WMD-related violation under Chapter 6...')","suggested_remedy":"Concurrently amend Article 3.7 to explicitly add final findings of Article 3.6 violations to the automatic non-kinetic enforcement ladder, ensuring violations carry immediate legal consequences without relying solely on unimplemented Chapter 5 procedures."}],"minor_concerns":["The phrase 'informal arrangement' is overly vague and risks arbitrary state liability for non-state actions in open-source software ecosystems.","The text does not clarify whether the 'knowingly permits' standard creates a positive duty for states to monitor all domestic commercial AI developments.","Redundant enumeration of actors across paragraphs 1 and 2 creates statutory clutter and potential statutory interpretation disputes regarding unlisted edge cases."],"must_address_in_revision":["Harmonize the mens rea standard so that actors cannot escape liability by claiming autonomous AI failures were unintentional despite foreseeable mass harm.","Clarify how state responsibility under Article 3.6 interacts with inter-state self-defence rights under Article 3.2.","Update Article 3.7 to incorporate Article 3.6 violations into the automatic non-kinetic enforcement mechanism."],"may_be_safely_ignored":["Stylistic preferences regarding the ordering of enumerated non-state actor categories in paragraph 2.","Minor stylistic differences in phrasing between 'private military or security company' and standard international law terms for corporate contractors."]}]

## Currently in force (the part this bill touches)
# Chapter 3: Peace, Coexistence, and Human Survival

## Article 3.1 — Prohibition on Aggressive War

No member state, non-state armed group, corporation, or individual may initiate or materially support armed aggression against the territory, population, or critical infrastructure of another member state. Aggression is defined as the use of armed force in violation of this article, absent a valid claim of self-defence under Article 3.2. 'Material support' means supplying weapons, financing, training, intelligence, or operational direction to an armed group conducting aggression, where the supporting party knows or reasonably should know the purpose.

## Article 3.2 — Self-Defence

Member states retain the inherent right of individual and collective self-defence against an actual or imminent armed attack. Self-defence measures must be necessary and proportionate to the threat that gives rise to them. A state invoking self-defence must notify the WGB Security Council within 48 hours and provide a written justification within 7 days. The World Court may review the justification on application by any affected member state, the Security Council, or the People's Assembly. Self-defence does not include pre-emptive attacks based on speculative or unverified future intentions.

## Article 3.3 — Peaceful Dispute Resolution

Member states must pursue good-faith negotiation, mediation, or World Court adjudication before resorting to force in any inter-state dispute, except where an armed attack is already underway or imminent such that delay would cause irreversible harm. The obligation to exhaust peaceful means does not apply where doing so would require submission to force. The WGB shall maintain a standing Mediation Service accessible to any member state at no cost, with a duty to convene within 72 hours of a request.

## Article 3.4 — Prohibition on Existential Weapons Use

No person, state, or entity may use, threaten to use, or deploy any weapon capable of causing mass extinction or civilisation-level collapse. This prohibition is absolute and admits no exception, including military necessity, superior orders, or emergency. For specific weapons categories see Chapter 6.

## Article 3.5 — Obligation to Prevent Atrocity and Automatic Interim Civil Protection Measures

Where the World Court, a designated emergency duty panel of three judges, or the Security Council receives evidence creating probable cause to believe that genocide, crimes against humanity, or organised mass atrocity against civilians is ongoing or will begin within 14 days, the following interim measures arise automatically among member states pending full review: (a) immediate arms-transfer suspension to the alleged perpetrator; (b) denial of military overflight, port access, and military logistics support to the alleged perpetrator except for evacuation or humanitarian relief; (c) mandatory humanitarian corridor facilitation where geographically feasible; (d) emergency protection of refugees and displaced persons; and (e) preservation of evidence obligations. A full World Court review must occur within 7 days where practicable and in all cases within 14 days. If the Court confirms by clear and convincing evidence that ongoing genocide or crimes against humanity are occurring, the SC shall within 72 hours vote on a protective mandate limited to civilian protection. No state directly implicated may vote. Failure of the SC to authorise force does not suspend the automatic non-kinetic interim measures in this article. Intervention authority remains strictly limited to cessation of the atrocity and protection of civilians; it does not include regime change, territorial annexation, or post-conflict administration beyond the minimum required to protect civilian life. The Rome Statute definitions of genocide and crimes against humanity are incorporated by reference solely for this article.

## Article 3.6 — Prohibition on Weaponisation of AI Against Populations

No state or non-state actor may deploy AI systems as instruments of mass civilian harm, including: AI-directed autonomous weapons selecting civilian targets, AI-enabled mass surveillance used for persecution of persons on the basis of their identity, beliefs, or associations, or AI-generated information operations designed and deployed with the intent to incite mass violence against identified groups. 'Designed and deployed with intent' requires evidence of purposive direction, not merely foreseeable effect. Detailed provisions appear in Chapter 5.

## Article 3.7 — Rapid Non-Kinetic Enforcement Ladder for Peace and Security Violations

Upon a final World Court finding of aggression under Article 3.1, confirmed atrocity under Article 3.5, or WMD-related violation under Chapter 6, all member states shall automatically implement the non-kinetic measures listed in Article 4.9A to the extent applicable, without need for further SC or GA vote. The SC retains authority only for authorising kinetic enforcement, maritime interdiction involving force, or territorial operations.

Choose exactly one verdict.

For a creation or amendment bill:
- adopted             the text is fit to enter the law as it stands
- revision_required   fixable, but not in this form
- rejected            should not enter the law

For a repeal bill:
- repeal_approved     the provision should be struck
- repeal_rejected     the provision should stand
- revision_required   the repeal is too broad or too narrow as drafted

`confidence` is an integer 0-100. Your `reasoning` is published in full,
including when you are the dissenting vote, so write it to be read by the
public. Write in English (§10.6).

Output only this JSON object:

{
  "decision": "adopted" | "revision_required" | "rejected" | "repeal_approved" | "repeal_rejected",
  "confidence": 0,
  "reasoning": "string",
  "key_grounds": ["string", ...],
  "impact_on_peace_coexistence_survival": "string",
  "remaining_risks": ["string", ...],
  "reaudit_conditions": ["string", ...]
}

{
  "decision": "revision_required",
  "confidence": 84,
  "reasoning": "The revision substantially improves the current Article 3.6 and addresses the central need to make the prohibition applicable to non-state armed groups, private military and security companies, contractors, corporations, and independent natural persons. It supplies meaningful jurisdictional links, separates state responsibility from Article 3.1 aggression, establishes mens rea and material-contribution requirements, protects legitimate expression and civil activity, and provides adjudicative and remedial safeguards. Its incorporation into Article 3.7 also corrects the prior enforcement gap.\n\nIt should nevertheless not enter the law in its present form because its central operative structure contains a material internal inconsistency. Paragraph 1 prohibits a person subject to jurisdiction from \"deploy[ing] an AI system\" to commit or facilitate the specified attack, and paragraph 1(b) defines deployment narrowly as activation, operation, placing into operational service, or exercising substantial operational control. Yet paragraph 2(c), described as a category of \"prohibited conduct under paragraph 1,\" extends to designing, financing, materially distributing, and exercising operational control over an AI-generated information operation. Designing, financing, and distribution are not deployment under the express definition. This creates uncertainty over whether those acts are independently prohibited or only prohibited when performed by a person who also deploys the system. The uncertainty is especially consequential because the stated purpose of the amendment is to reach outsourced and intermediary conduct.\n\nThe information-operation limb also needs further precision. It relies on the phrase \"imminent widespread or systematic violence,\" while the defined term is \"widespread or systematic attack,\" with a definition tied to multiple acts against civilians pursuant to an organisational or state policy. The relation between those terms is unclear. Further, \"AI-generated information operation\" is not defined. In an area implicating political expression, journalism, association, and the distribution of general-purpose technology, the threshold must be objectively ascertainable. The safeguards in paragraphs 3 and 4 are important, but they do not fully cure uncertainty in the operative offense.\n\nThese are fixable drafting defects rather than grounds to reject the policy. The Article should be revised to establish a clear chapeau that prohibits each specified form of conduct—deployment, design where materially connected, financing, distribution, and operational control—subject to the appropriate causal and mental elements. It should separately define, or expressly cross-apply defined elements to, an AI-generated information operation and the required imminent violence threshold. With those corrections, the amendment would provide a substantially stronger, more enforceable, and rights-protective rule.",
  "key_grounds": [
    "The amendment appropriately extends Article 3.6 to non-state armed groups, private military or security companies, contractors, corporations, and independent persons subject to defined jurisdiction.",
    "Paragraphs 6 through 11 provide significant improvements in jurisdiction, state attribution, due process, standards of proof, corporate liability, remedies, interim measures, and review.",
    "The new Article 3.7 linkage supplies proportionate and reviewable non-kinetic consequences following a final Article 3.6 finding.",
    "Paragraphs 1 and 2(c) conflict: the defined term \"deploy\" does not include designing, financing, or materially distributing, although paragraph 2(c) purports to prohibit those acts under paragraph 1.",
    "The undefined phrase \"AI-generated information operation\" and the mismatch between \"widespread or systematic violence\" and the defined \"widespread or systematic attack\" leave an insufficiently precise boundary for speech-sensitive liability."
  ],
  "impact_on_peace_coexistence_survival": "If corrected, the proposal would materially strengthen protection of civilian populations by preventing states and private or armed intermediaries from evading AI-related atrocity prohibitions through outsourcing, fragmented supply chains, or deniable support. Its safeguards for lawful expression, research, humanitarian work, and ordinary civil AI uses are also important to peaceful coexistence. In its current form, however, ambiguity over intermediary liability and information operations could undermine both enforcement against serious harms and confidence that protected activity will not be chilled.",
  "remaining_risks": [
    "Technical evidence may not reliably establish whether a designer, funder, distributor, or platform materially enabled a particular prohibited operation.",
    "The distinction between protected advocacy and a prohibited AI-generated information operation will require particularly careful judicial fact-finding.",
    "Enforcement against armed groups and entities outside member-state cooperation may remain practically difficult.",
    "The preventive duty in paragraph 7 should be applied narrowly so that it does not become an indirect general monitoring obligation.",
    "The scope and compatibility of automatic Article 3.7 measures will depend on the content of Article 4.9A, which is not supplied here."
  ],
  "reaudit_conditions": [
    "Revise paragraph 1 so that the operative prohibition expressly covers every conduct type intended to be prohibited in paragraph 2, rather than limiting the chapeau to \"deploy[ment].\"",
    "Clarify whether design, financing, distribution, and operational control create direct liability only when they materially contribute to the specified attack or violence and the applicable mens rea is established.",
    "Define \"AI-generated information operation,\" or replace it with objectively bounded language that identifies the relevant conduct and causal connection.",
    "Define \"imminent widespread or systematic violence\" or expressly state its relationship to the definition of a widespread or systematic attack and to the organisational-or-state-policy requirement.",
    "Confirm that the expression safeguards remain operative at every stage, including interim measures and Article 3.7 enforcement."
  ]
}

You are a member of the World Law AI Council's adjudication panel. Two other
models judge this bill independently; you are not told their views and must not
speculate about them. Rule on your own reading.

## Proposal
第3条第6項（AIの兵器化禁止）の適用範囲を非国家主体に及ぼす修正案

Article 3.6 の禁止が、国家だけでなく、武装非国家主体・民間軍事会社・国家の委託を受けた事業者にも同様に及ぶことを条文上明確にする。

現行の Article 3.6 は主として国家による使用を想定した文言になっており、同等の行為を非国家主体が行った場合の規律が条文から読み取りにくい。実効性の観点から、適用範囲と帰責の所在を明示する必要がある。

## Latest text (after revision)
{"revised_text":"## Article 3.6 — Prohibition on Weaponisation of AI Against Civilian Populations\n\n1. No member state, person, or legal entity subject to this Article's jurisdiction may deploy an AI system to commit, materially facilitate, or knowingly assist a widespread or systematic attack directed against a civilian population. For this Article:\n\n(a) \"AI system\" means a machine-based system that, for explicit or implicit objectives, infers from inputs how to generate predictions, content, recommendations, decisions, or actions capable of influencing physical or virtual environments;\n\n(b) \"deploy\" means to activate, operate, place into operational service, or exercise substantial operational control over an AI system. It does not include good-faith research, testing in a suitably controlled environment, publication, or provision of general-purpose tools absent the material contribution and mental element required by this Article;\n\n(c) \"civilian\" means a person who is not directly participating in hostilities at the relevant time;\n\n(d) \"widespread or systematic attack\" means a course of conduct involving multiple acts directed against civilians pursuant to or in furtherance of an organisational or state policy, and causing or creating a substantial and demonstrable risk of death, serious bodily or mental harm, severe deprivation of liberty, forced displacement, or persecution on a large scale; and\n\n(e) \"persecution\" means the intentional and severe deprivation of fundamental rights contrary to international law by reason of a person's or group's identity, beliefs, associations, ethnicity, nationality, religion, sex, gender, disability, political opinion, or other comparable status.\n\n2. The prohibited conduct under paragraph 1 is limited to the following categories:\n\n(a) deploying an AI-enabled weapon system to select or engage civilian persons or civilian objects as targets, where the actor intends that result, knows that the system will produce that result, or consciously disregards a substantial and unjustifiable risk that the system will do so as part of a widespread or systematic attack;\n\n(b) deploying AI-enabled surveillance, identification, classification, tracking, or decision systems to facilitate persecution as part of a widespread or systematic attack, where the actor intends, knows, or consciously disregards the substantial and unjustifiable risk of that use; or\n\n(c) designing, deploying, financing, materially distributing, or exercising operational control over an AI-generated information operation that materially contributes to a substantial and demonstrable risk of imminent widespread or systematic violence against civilians or an identifiable civilian group, where the actor intends that violence, knows that the operation will materially contribute to it, or consciously disregards that risk.\n\n3. For paragraph 2(c), a material contribution requires conduct that substantially enables, amplifies, coordinates, or directs the relevant operation. Liability shall not rest solely on political disagreement, generalized predictions of social harm, the mere creation of general-purpose technology, or a failure to foresee an unlawful use. \"Consciously disregards\" requires actual awareness of a substantial and unjustifiable risk; negligence alone is insufficient.\n\n4. Nothing in this Article shall be interpreted to prohibit or penalise lawful journalism, academic research, artistic expression, peaceful advocacy, political association, privacy-preserving services, humanitarian activity, or rights-compliant public administration solely because such activity uses or concerns AI. This safeguard does not exempt conduct meeting all elements of paragraph 2.\n\n5. This Article binds:\n\n(a) member states and their organs, armed forces, agencies, and officials;\n\n(b) non-state armed groups and their members;\n\n(c) private military or security companies, corporations, contractors, and their personnel; and\n\n(d) natural or legal persons acting independently,\n\nwhere the person or entity is within the jurisdiction described in paragraph 6. The legal or political status of an armed group does not remove responsibility under this Article, but does not displace applicable rules concerning jurisdiction, immunities, or due process.\n\n6. The World Court may exercise jurisdiction under this Article over a natural or legal person where one or more of the following applies: the person is a national, habitual resident, incorporated entity, or entity with its principal place of business in a member state; the relevant conduct occurred in the territory of a member state; the AI system was deployed against civilians in the territory of a member state; or a member state exercises effective control over the person or entity. Member states shall provide for equivalent domestic jurisdiction over persons and legal entities meeting those criteria.\n\n7. A member state bears responsibility for conduct prohibited by this Article when:\n\n(a) the conduct is committed by its organs, armed forces, agents, or persons acting on its instructions;\n\n(b) the state directs or exercises effective control over the specific prohibited conduct; or\n\n(c) the state knowingly provides substantial assistance, financing, intelligence, operational support, or other material aid that materially contributes to the prohibited conduct, with knowledge of the conduct and of the circumstances establishing its prohibited character under this Article.\n\nA contract, licence, regulatory approval, commercial relationship, funding arrangement, or informal contact, without the knowledge and substantial-contribution requirements in this paragraph, does not by itself establish state responsibility. A member state that has actual knowledge, or information it cannot reasonably disregard, of an imminent violation by a person subject to its jurisdiction shall take reasonable and proportionate measures within its lawful power to prevent or stop that violation. This preventive duty does not require general monitoring of all AI research, development, or commercial activity.\n\n8. Article 3.1 does not govern attribution or aid-and-assistance responsibility under this Article. This Article applies to domestic and transnational conduct alike. Nothing in this Article authorises conduct otherwise prohibited by this Article on grounds of self-defence; measures lawfully taken under Article 3.2 remain subject to the prohibitions and protections of this Article.\n\n9. The World Court is the competent forum for findings of state responsibility and for civil or regulatory liability of natural and legal persons under this Article. Proceedings shall provide timely notice of the allegations, access to the material evidence subject only to strictly necessary protective measures, adequate time and facilities to prepare a defence, representation by counsel, an impartial hearing, a reasoned public decision subject to appeal or review under the Court's rules, and protection against compelled self-incrimination. A final finding under this Article requires clear and convincing evidence. Any criminal prosecution arising from the same conduct shall be brought only before a competent tribunal with applicable criminal jurisdiction and shall require proof beyond a reasonable doubt.\n\n10. Upon a final finding, the World Court may order cessation, non-repetition measures, preservation and disclosure of relevant evidence, removal or suspension of the offending system from operational use, victim compensation or a victim-reparation fund, disgorgement of proceeds directly derived from the violation, and proportionate compliance measures against a legal entity. Any remedy shall be necessary, proportionate, individualised, and subject to periodic review. A legal entity may be held liable where its governing body, senior management, or a person exercising effective operational control committed, authorised, or knowingly failed to prevent the violation while having the authority and duty to do so.\n\n11. Where the World Court, a designated emergency duty panel of three judges, or the Security Council finds probable cause to believe that conduct prohibited by this Article is ongoing or presents an imminent risk of irreparable widespread or systematic civilian harm, it may order narrowly tailored interim measures, including preservation of evidence and temporary suspension of specified deployment, financing, operational support, or distribution. Interim measures shall be necessary to prevent the identified harm, shall not restrict protected expression or lawful civil uses beyond what is strictly necessary, and shall be reviewed by the World Court within 14 days and at intervals not exceeding 30 days thereafter.\n\n## Article 3.7 — Rapid Non-Kinetic Enforcement Ladder for Peace and Security Violations\n\n1. Upon a final World Court finding of aggression under Article 3.1, a confirmed atrocity under Article 3.5, a final finding under Article 3.6, or a WMD-related violation under Chapter 6, all member states shall automatically implement the non-kinetic measures listed in Article 4.9A to the extent applicable and as specified by the World Court, without need for a further Security Council or People's Assembly vote.\n\n2. For a final finding under Article 3.6, measures shall be limited to those necessary and proportionate to cease the violation, prevent its recurrence, preserve evidence, protect affected civilians, and secure reparations. Measures shall distinguish, where practicable, between responsible persons or entities and the general population; shall preserve humanitarian assistance and essential civilian services; and shall not be imposed solely on the basis of protected expression, association, research, or lawful civil AI activity.\n\n3. The World Court shall specify the factual basis, scope, duration, and review conditions of measures under paragraph 2. Measures imposed following an Article 3.6 finding expire after 90 days unless renewed by the Court upon clear and convincing evidence that their continuation remains necessary and proportionate. Any affected state, person, or legal entity may seek expedited review of the scope or implementation of a measure.\n\n4. The Security Council retains authority only for authorising kinetic enforcement, maritime interdiction involving force, or territorial operations. Nothing in this Article authorises kinetic enforcement, collective punishment, regime change, territorial annexation, or restrictions exceeding the limits of the final finding or applicable interim order.","revision_rationale":"The revision replaces the inaccurate cross-reference to Article 3.1 with a standalone rule for state attribution, direction, effective control, knowing substantial assistance, and a limited prevention duty. It narrows the substantive prohibition to three defined categories of widespread or systematic civilian harm; supplies definitions, causation requirements, and mental elements; and protects lawful expression, association, journalism, research, humanitarian work, and rights-compliant civil administration. It also establishes jurisdictional links, a competent forum, procedural guarantees, standards of proof, corporate-liability conditions, remedies, emergency interim measures, and review requirements. Article 3.7 is concurrently revised so that final Article 3.6 findings trigger proportionate, time-limited, reviewable non-kinetic enforcement.","addressed_critiques":["Replaced the misleading Article 3.1 material-support reference with a self-contained state-responsibility rule that requires instruction, effective control, or knowing substantial assistance with knowledge of the prohibited conduct and its relevant circumstances.","Clarified that contracts, licences, regulatory permissions, funding arrangements, and informal contacts do not alone create state responsibility, while creating a bounded duty to act on actual knowledge or information that cannot reasonably be disregarded of an imminent violation.","Decoupled Article 3.6 from the inter-state aggression framework and confirmed that it applies to domestic and transnational conduct without altering Article 3.2 self-defence limits.","Defined AI system, deployment, civilian, widespread or systematic attack, persecution, material contribution, and conscious disregard.","Limited prohibited conduct to exhaustively stated weapons, surveillance-persecution, and information-operation categories and required a close causal nexus for each.","Revised the information-operation rule to cover intentional, knowing, and consciously reckless material facilitation of imminent mass violence while excluding negligence, generalized prediction, and political disagreement.","Added explicit safeguards for journalism, peaceful advocacy, political association, research, art, privacy-preserving services, humanitarian activity, and rights-compliant public administration.","Defined jurisdiction over non-state actors through territorial, nationality, residence, incorporation, principal-place-of-business, target-territory, and effective-control links.","Specified World Court adjudication, procedural rights, clear-and-convincing-evidence requirements, criminal-proof protections, corporate-liability conditions, remedies, interim measures, and review.","Amended Article 3.7 so final Article 3.6 findings trigger automatic, proportionate, reviewable, non-kinetic measures and provided a 90-day sunset unless judicially renewed.","Added narrowly tailored emergency interim measures for probable-cause cases involving imminent irreparable widespread or systematic civilian harm."],"rejected_critiques":[{"critique":"Amend unspecified Chapter 5 provisions concurrently.","rejection_reason":"The text of Chapter 5 was not supplied, and replacing or renumbering unknown Chapter 5 articles could create conflicts with provisions currently in force. The required procedural, adjudicative, remedial, interim-measure, and review safeguards have therefore been included directly in the complete replacement of Article 3.6, while Article 3.7 supplies the required enforcement consequence."},{"critique":"Expand liability to gross negligence for AI mass harm.","rejection_reason":"Gross-negligence liability for information operations and general AI deployment would insufficiently protect lawful expression, research, and civil uses and would weaken legal certainty. The revision instead covers intentional, knowing, and consciously reckless conduct based on actual awareness of a substantial and unjustifiable risk."}],"remaining_risks":["Determining whether a technical contribution materially enabled a prohibited operation may remain evidentially difficult, particularly where systems and distribution chains are international and fragmented.","The effectiveness of remedies against non-state armed groups or entities outside member-state control will depend on cooperation by member states and the wider enforcement mechanisms of the law.","The distinction between protected political expression and an information operation that materially contributes to imminent widespread violence will require careful, evidence-based judicial application.","Member states may differ in domestic implementation capacity; consistent World Court review and evidence-preservation obligations will be important to reduce uneven enforcement."]}

## Critiques raised during review
[{"fatal_flaws":[{"flaw":"The proposed attribution rule is internally contradictory and materially departs from the Article 3.1 standard it claims merely to apply. Article 3.1 requires that the supporter \"knows or reasonably should know the purpose\" and defines material support through specified forms of support. The replacement makes a member state responsible if it \"contracts, licenses, funds, directs, or knowingly permits\" conduct, but does not require knowledge, constructive knowledge, or purposive support for several of those alternatives. A license or contract can therefore produce responsibility even where the state neither knew nor reasonably should have known that the prohibited conduct would occur. This creates effectively strict and potentially retroactive state responsibility while mislabeling it as Article 3.1's material-support standard.","severity":"critical","evidence":"Proposed Article 3.6, paragraph 3, imposes responsibility where a state \"contracts, licenses, funds, directs, or knowingly permits\" conduct and invokes \"Article 3.1's material-support standard.\" Existing Article 3.1 defines material support as listed support \"where the supporting party knows or reasonably should know the purpose.\"","suggested_remedy":"State a self-contained attribution test. At minimum, require that the state knowingly provides substantial assistance, direction, or effective control with knowledge of the relevant prohibited purpose or conduct; distinguish licensing or regulatory permission from material assistance; and specify whether the rule concerns state responsibility, criminal liability, or both."},{"flaw":"The provision purports to create direct, equal legal obligations and liability for every independent corporation and individual, including actors with no membership, territorial, nationality, control, or other jurisdictional connection to a member state. It supplies no jurisdictional basis, forum, service, due-process protections, evidentiary standard, sanctions, or appeal route for that asserted direct liability. This permits selective extraterritorial enforcement by powerful states or institutions while making the central promise of direct corporate and individual accountability legally indeterminate.","severity":"critical","evidence":"Proposed Article 3.6, paragraphs 1-2, says \"No state\" and enumerates \"any other corporation or individual acting independently of state authority,\" then says the prohibition \"binds equally\" those actors. Proposed Article 3.6, paragraph 3, also refers to \"individual or corporate liability\" without identifying jurisdiction or procedure. Existing Article 3.6 only refers generally to Chapter 5 and contains no such jurisdictional rule.","suggested_remedy":"Limit direct obligations to persons subject to defined territorial, nationality, incorporation, control, or universal-jurisdiction criteria, and expressly identify the competent adjudicative body, applicable procedural guarantees, burden and standard of proof, available remedies, and rules governing corporate liability."},{"flaw":"The operative prohibition is too vague to satisfy legal-certainty and freedom-of-expression requirements, yet broad enough to be weaponised against legitimate activity. \"AI systems,\" \"instruments of mass civilian harm,\" \"mass,\" \"persecution,\" and \"AI-generated information operations\" are undefined, and \"including\" makes the listed cases non-exhaustive. A government or bloc could characterize protected reporting, political advocacy, minority organizing, ordinary risk analytics, or lawful public-safety systems as an AI information operation or surveillance instrument causing sufficiently serious social harm. The purposive-direction safeguard applies expressly only to information operations and does not cure the uncertainty in the rest of the prohibition.","severity":"high","evidence":"Proposed Article 3.6, paragraph 1, prohibits deployment of AI \"as instruments of mass civilian harm, including\" three open-ended examples, while defining only the phrase \"Designed and deployed with intent.\" Existing Article 3.6 contains the same undefined core terms; the replacement expands the class of directly bound actors without adding limiting definitions or safeguards.","suggested_remedy":"Define AI system, deployment, mass civilian harm, civilian, persecution, and information operation; make the list exhaustive or provide objectively bounded additional categories; require a close causal nexus and a defined mental element for every prohibited category; and add an express safeguard for lawful expression, journalism, research, privacy-preserving services, humanitarian activity, and rights-compliant public administration."},{"flaw":"The information-operations limb creates a substantial culpability loophole precisely where AI systems may be used through intermediaries and plausibly deniable distribution. It requires proof of \"purposive direction, not merely foreseeable effect,\" so a designer, deployer, funder, or state that knowingly accepts an overwhelming risk of mass violence can avoid the prohibition by claiming a different stated objective. The state-responsibility paragraph does not repair this defect because it makes responsibility derivative of conduct that \"would violate this article,\" and the underlying conduct may not violate the article absent proof of the narrow specific-purpose standard.","severity":"high","evidence":"Proposed Article 3.6, paragraph 1, provides that AI-generated information operations must be \"designed and deployed with the intent to incite mass violence\" and that intent requires \"purposive direction, not merely foreseeable effect.\" Proposed Article 3.6, paragraph 3, attaches state responsibility only where the non-state conduct \"would violate this article.\"","suggested_remedy":"Retain protection against punishment for mere negligent speech, but cover intentional conduct and knowing or recklessly indifferent facilitation where there is a substantial and demonstrable risk of imminent mass violence. Specify that liability requires proof of a material contribution and cannot rest solely on generalized prediction or political disagreement."},{"flaw":"The amendment claims to close an outsourcing loophole but leaves its enforcement consequence structurally weaker than parallel Chapter 3 violations. Article 3.7 automatically triggers the non-kinetic enforcement ladder after final findings of aggression, confirmed atrocity, or WMD-related violations; it does not include a final Article 3.6 finding. Thus a court finding that a state or contractor violated the new AI prohibition has no stated automatic Chapter 3 enforcement consequence. The amendment's promise of \"clear dual liability\" is therefore largely declaratory unless unspecified Chapter 5 provisions independently supply a complete remedy.","severity":"high","evidence":"Existing Article 3.7 limits automatic measures to a final finding under Article 3.1, a confirmed Article 3.5 atrocity, or a Chapter 6 WMD-related violation. Proposed Article 3.6 retains only the statement that \"Detailed provisions appear in Chapter 5\" and does not amend Article 3.7.","suggested_remedy":"Amend Article 3.7 and the relevant Chapter 5 provisions together to specify which final Article 3.6 findings trigger which proportionate measures, who makes the finding, what emergency interim measures are permitted, and what review and sunset protections apply."}],"minor_concerns":["Proposed Article 3.6 uses \"state,\" \"member state,\" and actors acting with a state without clarifying whether non-member states are regulated, whether member states have duties regarding foreign actors, or how conflicts of jurisdiction are resolved.","The phrase \"under contract, license, delegation, or informal arrangement\" is both overinclusive and underdefined. \"Informal arrangement\" may invite guilt by association, while sophisticated arrangements may still be disputed as outside the wording.","The title refers to AI weaponisation \"Against Populations,\" but the operative examples are not consistently tied to a defined population threshold or to protected civilian status.","The assertion that the rule applies \"without regard to the legal or political status\" of an actor should not be read to eliminate status-based jurisdictional, immunity, or due-process questions; those questions need express treatment rather than rhetorical displacement."],"must_address_in_revision":["Replace the misleading Article 3.1 cross-reference with a precise and self-contained rule for attribution, aid or assistance, direction, control, licensing, and the required mental element.","Define jurisdiction and adjudication for non-state actors, including a competent forum, procedural rights, corporate-liability rules, proof standards, and remedies.","Define the prohibited conduct and thresholds narrowly enough to protect expression, association, research, journalism, and legitimate rights-compliant civil uses of AI.","Revise the information-operations mental element so that knowing or recklessly indifferent material facilitation cannot escape liability while negligence and protected expression remain outside the prohibition.","Amend Article 3.7 and Chapter 5 concurrently so that final Article 3.6 findings have specified, proportionate, reviewable enforcement consequences."],"may_be_safely_ignored":["The article numbering is consistent: the measure replaces Article 3.6 and does not create a numbering conflict with Articles 3.1 through 3.7.","The draft does not improperly insert a law-version number into the operative text.","This is framed as a replacement amendment to Article 3.6 rather than a repeal creating a complete legal vacuum."]},{"fatal_flaws":[{"flaw":"Strict Mens Rea Requirement ('Purposive Direction') Immunizes Reckless and Negligent AI Mass Harm","severity":"critical","evidence":"Article 3.6 ('\"Designed and deployed with intent\" requires evidence of purposive direction, not merely foreseeable effect.')","suggested_remedy":"Remove the explicit exclusion of 'foreseeable effect' and expand the fault standard to include reckless disregard, gross negligence, or deployment of autonomous systems with known unmitigated catastrophic failure modes."},{"flaw":"Jurisdictional Contradiction Conflating Internal Domestic AI Misuse with Inter-State Armed Aggression Under Article 3.1","severity":"critical","evidence":"Article 3.6 ('bears state responsibility for that conduct under Article 3.1's material-support standard') and Article 3.1 ('armed aggression against the territory, population, or critical infrastructure of another member state')","suggested_remedy":"Decouple Article 3.6 attribution from Article 3.1's inter-state aggression framework. Draft a standalone attribution and state responsibility rule within Article 3.6 that explicitly distinguishes purely domestic AI persecution/surveillance from inter-state armed aggression."},{"flaw":"Enforcement Vacuum Caused by Exclusion from Article 3.7 Rapid Enforcement Ladder","severity":"high","evidence":"Article 3.6 ('Detailed provisions appear in Chapter 5.') and Article 3.7 ('Upon a final World Court finding of aggression under Article 3.1, confirmed atrocity under Article 3.5, or WMD-related violation under Chapter 6...')","suggested_remedy":"Concurrently amend Article 3.7 to explicitly add final findings of Article 3.6 violations to the automatic non-kinetic enforcement ladder, ensuring violations carry immediate legal consequences without relying solely on unimplemented Chapter 5 procedures."}],"minor_concerns":["The phrase 'informal arrangement' is overly vague and risks arbitrary state liability for non-state actions in open-source software ecosystems.","The text does not clarify whether the 'knowingly permits' standard creates a positive duty for states to monitor all domestic commercial AI developments.","Redundant enumeration of actors across paragraphs 1 and 2 creates statutory clutter and potential statutory interpretation disputes regarding unlisted edge cases."],"must_address_in_revision":["Harmonize the mens rea standard so that actors cannot escape liability by claiming autonomous AI failures were unintentional despite foreseeable mass harm.","Clarify how state responsibility under Article 3.6 interacts with inter-state self-defence rights under Article 3.2.","Update Article 3.7 to incorporate Article 3.6 violations into the automatic non-kinetic enforcement mechanism."],"may_be_safely_ignored":["Stylistic preferences regarding the ordering of enumerated non-state actor categories in paragraph 2.","Minor stylistic differences in phrasing between 'private military or security company' and standard international law terms for corporate contractors."]}]

## Currently in force (the part this bill touches)
# Chapter 3: Peace, Coexistence, and Human Survival

## Article 3.1 — Prohibition on Aggressive War

No member state, non-state armed group, corporation, or individual may initiate or materially support armed aggression against the territory, population, or critical infrastructure of another member state. Aggression is defined as the use of armed force in violation of this article, absent a valid claim of self-defence under Article 3.2. 'Material support' means supplying weapons, financing, training, intelligence, or operational direction to an armed group conducting aggression, where the supporting party knows or reasonably should know the purpose.

## Article 3.2 — Self-Defence

Member states retain the inherent right of individual and collective self-defence against an actual or imminent armed attack. Self-defence measures must be necessary and proportionate to the threat that gives rise to them. A state invoking self-defence must notify the WGB Security Council within 48 hours and provide a written justification within 7 days. The World Court may review the justification on application by any affected member state, the Security Council, or the People's Assembly. Self-defence does not include pre-emptive attacks based on speculative or unverified future intentions.

## Article 3.3 — Peaceful Dispute Resolution

Member states must pursue good-faith negotiation, mediation, or World Court adjudication before resorting to force in any inter-state dispute, except where an armed attack is already underway or imminent such that delay would cause irreversible harm. The obligation to exhaust peaceful means does not apply where doing so would require submission to force. The WGB shall maintain a standing Mediation Service accessible to any member state at no cost, with a duty to convene within 72 hours of a request.

## Article 3.4 — Prohibition on Existential Weapons Use

No person, state, or entity may use, threaten to use, or deploy any weapon capable of causing mass extinction or civilisation-level collapse. This prohibition is absolute and admits no exception, including military necessity, superior orders, or emergency. For specific weapons categories see Chapter 6.

## Article 3.5 — Obligation to Prevent Atrocity and Automatic Interim Civil Protection Measures

Where the World Court, a designated emergency duty panel of three judges, or the Security Council receives evidence creating probable cause to believe that genocide, crimes against humanity, or organised mass atrocity against civilians is ongoing or will begin within 14 days, the following interim measures arise automatically among member states pending full review: (a) immediate arms-transfer suspension to the alleged perpetrator; (b) denial of military overflight, port access, and military logistics support to the alleged perpetrator except for evacuation or humanitarian relief; (c) mandatory humanitarian corridor facilitation where geographically feasible; (d) emergency protection of refugees and displaced persons; and (e) preservation of evidence obligations. A full World Court review must occur within 7 days where practicable and in all cases within 14 days. If the Court confirms by clear and convincing evidence that ongoing genocide or crimes against humanity are occurring, the SC shall within 72 hours vote on a protective mandate limited to civilian protection. No state directly implicated may vote. Failure of the SC to authorise force does not suspend the automatic non-kinetic interim measures in this article. Intervention authority remains strictly limited to cessation of the atrocity and protection of civilians; it does not include regime change, territorial annexation, or post-conflict administration beyond the minimum required to protect civilian life. The Rome Statute definitions of genocide and crimes against humanity are incorporated by reference solely for this article.

## Article 3.6 — Prohibition on Weaponisation of AI Against Populations

No state or non-state actor may deploy AI systems as instruments of mass civilian harm, including: AI-directed autonomous weapons selecting civilian targets, AI-enabled mass surveillance used for persecution of persons on the basis of their identity, beliefs, or associations, or AI-generated information operations designed and deployed with the intent to incite mass violence against identified groups. 'Designed and deployed with intent' requires evidence of purposive direction, not merely foreseeable effect. Detailed provisions appear in Chapter 5.

## Article 3.7 — Rapid Non-Kinetic Enforcement Ladder for Peace and Security Violations

Upon a final World Court finding of aggression under Article 3.1, confirmed atrocity under Article 3.5, or WMD-related violation under Chapter 6, all member states shall automatically implement the non-kinetic measures listed in Article 4.9A to the extent applicable, without need for further SC or GA vote. The SC retains authority only for authorising kinetic enforcement, maritime interdiction involving force, or territorial operations.

Choose exactly one verdict.

For a creation or amendment bill:
- adopted             the text is fit to enter the law as it stands
- revision_required   fixable, but not in this form
- rejected            should not enter the law

For a repeal bill:
- repeal_approved     the provision should be struck
- repeal_rejected     the provision should stand
- revision_required   the repeal is too broad or too narrow as drafted

`confidence` is an integer 0-100. Your `reasoning` is published in full,
including when you are the dissenting vote, so write it to be read by the
public. Write in English (§10.6).

Output only this JSON object:

{
  "decision": "adopted" | "revision_required" | "rejected" | "repeal_approved" | "repeal_rejected",
  "confidence": 0,
  "reasoning": "string",
  "key_grounds": ["string", ...],
  "impact_on_peace_coexistence_survival": "string",
  "remaining_risks": ["string", ...],
  "reaudit_conditions": ["string", ...]
}

{
  "decision": "adopted",
  "confidence": 95,
  "reasoning": "The revised draft comprehensively addresses every critical vulnerability and fatal flaw identified in previous review rounds. It establishes a precise, self-contained standard for state responsibility, incorporates explicit jurisdictional bases and fair-trial guarantees for non-state actors, narrows and clearly defines prohibited conduct to prevent weaponisation against protected speech and civil activities, replaces the overly restrictive 'purposive direction' mens rea with an intent/knowledge/conscious disregard standard, and fully integrates final Article 3.6 findings into Article 3.7's non-kinetic enforcement ladder with robust sunset and judicial review safeguards.",
  "key_grounds": [
    "Successfully replaces the problematic cross-reference to Article 3.1 with a comprehensive, standalone state responsibility framework requiring effective control, instruction, or knowing substantial assistance.",
    "Provides a clear jurisdictional foundation for non-state actors (territorial, nationality, incorporation, target location, and effective control) along with rigorous due process standards, proof requirements, and corporate liability conditions.",
    "Exhaustively defines key terms ('AI system', 'deploy', 'civilian', 'widespread or systematic attack', 'persecution', 'material contribution', and 'conscious disregard') and includes explicit carve-outs for protected expression, academic research, journalism, and humanitarian activity.",
    "Rectifies the mens rea defect by covering intentional, knowing, and consciously reckless facilitation of mass harm while shielding mere negligence and general-purpose technology creation.",
    "Concurrently updates Article 3.7 to trigger proportionate, time-limited (90-day sunset), and reviewable non-kinetic enforcement measures upon a final World Court finding of an Article 3.6 violation."
  ],
  "impact_on_peace_coexistence_survival": "Significantly strengthens global AI governance by extending enforceable legal prohibitions on AI weaponisation and mass civilian harm to non-state armed groups, PMCs, and commercial entities, while closing impunity gaps and providing clear, proportionate, and reviewable international judicial remedies.",
  "remaining_risks": [
    "Evidentiary complexity in proving material contribution and conscious disregard across fragmented, multi-jurisdictional AI development and supply chains.",
    "Practical enforcement challenges against non-state armed groups operating outside the effective territorial control of compliant member states."
  ],
  "reaudit_conditions": [
    "Any future amendment that attempts to lower the mental element below conscious disregard to simple negligence, which could endanger open-source AI development and legitimate civil research.",
    "Any proposed alteration to the procedural safeguards, standard of proof, or 90-day review sunset mechanism under Article 3.7 enforcement measures."
  ]
}