SECTOR INTELLIGENCE BRIEFING, BASED ON DOCUMENTED PUBLIC EVIDENCE, RESEARCH DOCUMENT
◈ Sector Intelligence Defence BreakPoint · AI Control Gap Assessment

AI Control Gap Intelligence:
Defence

What the documented evidence shows, and what BreakPoint would expect to find

"Human in the loop" is the stated doctrine. Whether it describes operational reality, at decision level, not policy level, is the question no published audit has yet answered.

Briefing Summary
Document typeSector Intelligence Briefing
SectorDefence · MOD / Prime Contractors
Evidence baseDocumented public sources
Central doctrine"Human in the loop", JSP 936
Core tensionDoctrine vs. operational AI decision speed
Key frameworksJSP 936 · NATO AI Principles · HCDC
BreakPoint instrumentAI Control Gap Assessment
01The Documented Picture
◈  This briefing addresses the governance and assurance dimensions of AI in defence, not operational weapons systems, classified programmes, or specific tactical deployments. It draws on publicly available policy documents, parliamentary committee findings, and published MOD strategy. The predictive findings in Section 04 concern governance and control assurance, not operational capability.
◈ The doctrine gap

The UK MOD's AI Strategy (2022) and Defence AI Code of Practice explicitly require "human in the loop" for decisions with significant consequences. JSP 936 (Defence AI Policy) formalises this. NATO's AI Principles for Defence (2021), adopted by the UK, require that humans exercise "appropriate levels of judgement" over AI-enabled systems. What none of these documents specifies, and what no published audit has yet assessed, is what evidenced exercise of human authority looks like at decision level, in an operational AI environment where decision speed is measured in seconds. Doctrine specifies the requirement. It does not evidence its fulfilment.

£900m
MOD AI and data investment commitment 2022 to 2025
UK Defence AI Strategy, 2022
2022
Year UK published Defence AI Strategy and AI Code of Practice
MOD, 2022
0
published independent audits of human authority exercise in UK defence AI deployments
Research gap: documented absence
HCDC
Defence Select Committee inquiry into AI in Defence, ongoing scrutiny of governance gaps
House of Commons Defence Committee, 2023 to 24

AI is deployed across UK defence in four principal non-classified domains where governance evidence is publicly available: intelligence, surveillance and reconnaissance (ISR) data processing and pattern analysis; procurement and supplier qualification; logistics, maintenance scheduling, and supply chain optimisation; and cyber defence and threat detection. Each is subject to the "human in the loop" doctrine. None has a published independent assessment of whether that doctrine describes operational practice.

The House of Commons Defence Committee (HCDC) has conducted ongoing scrutiny of AI governance in defence since 2023. Its findings document a persistent gap between doctrine, which is well-developed, and assurance: which is absent. The Committee has explicitly noted that the MOD lacks an independent mechanism for assessing whether its AI deployments comply with the governance standards it has published.

02The Governance Gap, What the Evidence Shows
House of Commons Defence Committee · 2023 to 24MOD AI governance: doctrine is strong; independent assurance mechanism is absent
The HCDC's inquiries into AI in defence have consistently found that the MOD's published AI governance framework, including the Defence AI Strategy, the AI Code of Practice, and JSP 936, is substantively well-developed. What is absent is an independent assurance function with the authority and access to verify that AI deployments comply with those governance standards in practice. The Committee has noted that the MOD relies on internal governance processes, the same structures that develop and deploy AI systems, to assess whether those systems meet the governance requirements. This is the identical independence gap that PRA SS1/23 identifies in financial services: the team using the model is not positioned to provide independent assurance that it meets the governance standard.
UK Defence AI Strategy · 2022£900m investment commitment and "responsible AI" framework, with no independent verification mechanism
The UK Defence AI Strategy (2022) committed £900m to AI and data development over the Integrated Review period and established a "responsible AI" framework centred on the principle that lethal force decisions would always involve human judgement. The Strategy acknowledges the speed challenge directly, AI-enabled systems operating faster than human decision cycles, and commits to ensuring governance frameworks keep pace. The commitment is documented. The verification mechanism, who independently assesses whether the framework is being implemented as described, is not. This is not a criticism of the Strategy; it is the assurance gap the Strategy itself identifies and defers.
NATO AI Principles for Defence · 2021Adopted by UK: AI must be governable, traceable, and subject to "appropriate human judgement", what "appropriate" means operationally is undefined
NATO's Principles of Responsible Use of Artificial Intelligence in Defence (2021), adopted by the UK and all NATO allies, include requirements that AI systems be governable (subject to human control), traceable (explainable), and subject to appropriate levels of human judgement. The critical word is "appropriate", and NATO deliberately left its operational definition to member states, recognising that what constitutes appropriate human oversight will vary by use case, decision speed, and consequence. The UK has committed to applying this principle. The operational specification of what "appropriate" means at decision level in specific AI deployments has not been publicly resolved.
DSIT AI Safety Institute · 2023, presentGovernment's own AI safety function has no defence mandate, the sector with highest-consequence AI has no independent safety assessor
The UK government established the AI Safety Institute (now AISI) in 2023 to assess frontier AI safety risks. Its mandate explicitly excludes classified or national security AI systems. This means that the sector with the highest-consequence AI deployments, defence: is outside the scope of the government's own AI safety function. The MOD conducts internal AI safety and ethics review. There is no external, independent body with the mandate to assess whether defence AI deployments meet the governance standards that published doctrine requires.
MOD Procurement AI · Documented publiclyAI used in supplier qualification and contract award, consequential commercial decisions without published governance
The MOD and its prime contractors use AI tools in supplier qualification, risk assessment, and, increasingly, contract award evaluation processes. These are consequential commercial decisions: exclusion from MOD supplier frameworks can be terminal for defence SMEs. The governance framework for AI in defence procurement is not publicly documented to the same standard as, for example, AI in operational contexts. There is no published equivalent of JSP 936 for procurement AI. The consequence is that AI-shaped exclusion or inclusion decisions in the defence supply chain operate without a published human authority standard.
03The Governance Framework
Framework
Core Requirement
Where AI Exposure Sits
JSP 936, Defence AI Policy
Human in the loop for decisions with significant consequences. AI must be governable and traceable. Senior Responsible Owner accountable for compliance. No independent external audit mechanism.
ISR data analysis. Targeting support AI. Logistics and maintenance AI. Any AI system where outputs inform decisions with physical or strategic consequence.
Defence AI Code of Practice
Responsible AI development and deployment. Ethics by design. Explainability requirement. Applies to MOD and prime contractors. No published compliance verification process.
Prime contractor AI tools in equipment manufacture and maintenance. AI in MOD-funded research and development. AI in platform integration and systems engineering.
NATO AI Principles (2021)
Governable, traceable, reliable, explainable, bias-mitigated, and subject to appropriate human judgement. UK committed. Operational definition of "appropriate" left to member state implementation.
All AI systems used in NATO-context operations and planning. Multinational AI integration. AI used in combined arms operations with alliance partners.
Procurement Regulations (PCR / DefCon)
Fair and transparent procurement process. AI-assisted supplier evaluation and contract award subject to public contract law. No specific AI governance standard published for procurement AI.
Supplier qualification AI. Contract award evaluation tools. Risk assessment AI for supply chain. Financial and performance scoring AI for SME assessment.
04What BreakPoint Would Predict
Epistemic note: The following are indicative and predictive inferences from the documented evidence base above - not assertions of findings BreakPoint has made in this sector. Each prediction identifies a specific gap type that the evidence strongly suggests is present. BreakPoint's role is to determine, for a specific organisation, whether the gap exists and its severity. Note that BreakPoint is not limited to these factors however, and will often surface unexpected risks or risks that may not have been fully articulated.
✕ Predicted ABSENTIndependent assurance mechanism for "human in the loop" compliance, doctrine exists; verification does not
The MOD's published doctrine requires human authority at decision level for consequential AI-enabled decisions. The HCDC has documented, repeatedly, that no independent mechanism exists to verify compliance. Internal governance review, conducted by the same organisations that develop and deploy AI systems, cannot constitute independent assurance under any standard that would satisfy an external auditor, a parliamentary committee, or a NATO peer review. The absence of an independent assurance function is not a failure of intent; it is a structural gap that the MOD's published documentation implicitly acknowledges by committing to develop one. BreakPoint provides a deployable assurance instrument for the commercial and administrative AI that operates within that gap.
Evidence basis: HCDC inquiries 2023 to 24 (independent assurance absent); MOD AI Strategy 2022 (commitment to assurance development); DSIT AISI mandate excludes defence; JSP 936 (no independent audit mechanism specified).
▲ Predicted ASSUMEDProcurement AI: supplier qualification and contract award AI operates without a published human authority standard
AI tools used in MOD and prime contractor procurement, supplier risk scoring, financial stability assessment, performance history analysis, compliance checking, shape consequential commercial decisions for defence SMEs. The Defence AI Code of Practice applies to these deployments in principle. No equivalent of JSP 936 has been published for procurement AI. The governance of who holds named authority over AI-shaped procurement decisions, what the override process looks like, and how excluded suppliers can challenge AI-influenced determinations is not documented. BreakPoint's framework applies directly: REAL, ASSUMED, or ABSENT authority at the point where AI is shaping the decision.
Evidence basis: MOD Defence AI Code of Practice (applies to procurement); Public Contract Regulations (transparency obligation); documented absence of procurement-specific AI governance standard; HCDC scrutiny of AI across MOD functions.
▲ Predicted ASSUMEDLogistics and maintenance AI: operational decisions within AI-optimised parameters, human authority at parameter level, not at individual decision level
Predictive maintenance AI, logistics optimisation, and asset availability scheduling are well-established in UK defence. These systems make or recommend many thousands of operational decisions, maintenance priorities, parts ordering, deployment scheduling, within parameters set by governance processes. Human authority exists at the parameter level: engineers and logistics officers set the frameworks within which AI operates. At the level of individual decisions, which platform is prioritised for maintenance, which part is ordered, which unit is held back, AI decides and humans execute. This is the same pattern BreakPoint finds across financial services: authority at policy level, automation at decision level.
Evidence basis: MOD AI Strategy 2022 (logistics AI as priority investment area); UK Defence Equipment Plan (maintenance and availability AI documented); MOD AI Code of Practice (applies to logistics systems); pattern consistent with BoE/FCA Survey 2024 automated decision-making findings.
◆ Predicted ConditionIntelligence analysis AI: scope has moved from data pattern identification to attribution-adjacent outputs, governance signed off for the former, not the latter
Intelligence AI tools approved for use in pattern recognition and data aggregation have, as those tools have matured, extended their outputs toward analysis that informs attribution judgements, assessments of intent, origin, or significance that approach the threshold for consequential decision support. The governance sign-off for these tools was for narrower capabilities. The operational scope of current-generation ISR-support AI is broader than was envisaged when governance frameworks were established. This is the scope creep Condition BreakPoint identifies: not a failure of the original governance, but a gap between the scope governance covers and the scope the AI now operates in.
Evidence basis: HCDC evidence on AI in intelligence analysis (2023 to 24); NATO AI Principles (traceability and explainability requirements for consequential decisions); MOD AI Code of Practice (applies to all AI with decision-influencing outputs); documented pattern of capability expansion in commercial ISR-adjacent tools.
▲ Predicted ASSUMEDMOD AI assurance framework: certified at programme level, not evidenced at deployment decision level
AI programmes within the MOD are assessed through the AI Assurance Framework at inception and at major milestones. Between milestones: in operational deployment, the human authority structure that the assurance framework describes is certified in documentation but not independently monitored at decision level. The assurance certifies the programme. It does not verify that the authority described in the programme documentation is being exercised at each consequential decision in operational deployment. This is the framework-vs-reality gap that appears across every sector BreakPoint examines.
Evidence basis: MOD AI Assurance Framework (published); HCDC (gap between framework and operational reality documented); DSIT AISI (no defence mandate, assurance gap confirmed structurally); pattern consistent across all sectors in BoE/FCA 2024 findings.
05Source References
MOD AI Strategy 2022
UK Ministry of Defence, Defence Artificial Intelligence Strategy, June 2022. £900m investment commitment, responsible AI framework, human-in-the-loop doctrine. gov.uk →
JSP 936
MOD, Joint Service Publication 936: Defence AI Policy. Human in the loop requirement, Senior Responsible Owner accountability, governance framework for MOD AI deployments.
Defence AI Code of Practice
MOD / DSIT, AI Code of Practice for Defence. Responsible development and deployment principles. Applies to MOD and prime contractors. Published 2022. gov.uk →
NATO AI Principles
NATO, Principles of Responsible Use of Artificial Intelligence in Defence, adopted October 2021. Governable, traceable, reliable, explainable, bias-mitigated, appropriate human judgement. UK committed. nato.int →
HCDC 2023 to 24
House of Commons Defence Committee, inquiries into AI in Defence, 2023 to 2024. Independent assurance gap documented; governance vs. operational reality distinction drawn. parliament.uk →
DSIT AISI
DSIT, AI Safety Institute (now AI Security Institute), established 2023. Mandate explicitly excludes national security and classified AI systems, confirming the assurance gap in defence. gov.uk →
Luminary Diagnostics · BreakPoint: AI Control Gap Assessment

The doctrine says humans are in the loop.
No independent audit has yet verified that at decision level.

BreakPoint provides a deployable assurance instrument for the commercial, procurement, and administrative AI that operates within the governance gap between doctrine and verified operational practice.

Book a BreakPoint conversation →
Luminary Diagnostics  ·  BreakPoint Sector Intelligence · Defence
luminary-diagnostics.com · © 2026 Luminary Diagnostics Ltd