A Draft of a Treaty, with Annotations

Article XII: Protective Actions

1. Recognizing that the development of ASI or other Dangerous AI Activities, as laid out in Articles IV through IX, would pose a threat to global security and to the life of all people, it may be necessary for Parties to this Treaty to take drastic actions to prevent such development. The Parties recognize that development of artificial superintelligence (ASI), anywhere on earth, would be a threat to all Parties. Under Article 51 of the United Nations Charter and as longstanding precedent, states have a right to self-defence. Due to the scale and speed of ASI-related threats, self-defence may require pre-emptive actions to prevent the development of ASI.

2. To prevent the development or deployment of ASI, this Article authorizes tailored Protective Actions. Where there is credible evidence that a State or other actor (whether a Party or a non‑Party) is conducting or imminently intends to conduct activities aimed at developing or deploying ASI in violation of Article I, Article IV, Article V, Article VI, Article VII, or Article VIII, a State Party may undertake Protective Actions that are necessary and proportionate to prevent activities. In recognition of the harms and escalatory nature of Protective Actions, Protective Actions should be used as a last-resort. Outside of emergencies and time-sensitive situations, Protective Actions shall be preceded by other approaches such as, but not limited to:

   1. Trade restrictions or economic sanctions
   2. Asset restrictions
   3. Visa bans
   4. Appeal to the UN Security Council for action

3. Protective Actions may include measures such as cyber operations to sabotage AI development, interdiction or seizure of covered chip clusters, military actions to disable or destroy AI hardware, and physical disablement of specific facilities or assets directly enabling AI development.

4. Parties shall minimize collateral harm, including to civilians and essential services, wherever practical, subject to mission requirements.

5. Protective Actions shall be strictly limited to preventing ASI development or deployment and shall not be used as a pretext for territorial acquisition, regime change, resource extraction, or broader military objectives. Permanent occupation or annexation of territory is prohibited. Action will cease upon verification by ISIA that the threat no longer exists.

6. Each Protective Action shall be accompanied, at initiation or as soon as security permits, by a public Protective Action Statement that:

   1. Explains the protective purpose of the action;
   2. Identifies the specific AI‑enabling activities and assets targeted;
   3. States the conditions for cessation;
   4. Commits to cease operations once those conditions are met.

7. Protective Actions shall terminate without delay upon any of the following:

   1. ISIA certification that the relevant activities have ceased.
   2. Verified surrender or destruction of covered chip clusters or ASI‑enabling assets, potentially including the establishment of sufficient safeguards to prevent Restricted Research activities.
   3. A determination by the acting Party, communicated to the ISIA, that the threat has abated.

8. Parties shall not regard measured Protective Actions taken by another Party under this Article as provocative acts, and shall not undertake reprisals or sanctions on that basis. Parties agree that Protective Actions meeting the above requirements shall not be construed as an act of aggression or justification for the use of force.

9. The Executive Council shall review each Protective Action for compliance with this Article and report to the Conference of the Parties. If the Executive Council finds that an action was not necessary, proportionate, or properly targeted, actions may be taken under Article XI, Paragraph 3.

Precedent

The idea that nation-states can take protective actions for their own security is a reality regardless of precedent, but one case of its codification into international law is Chapter VII of the United Nations Charter, which states that the Security Council may take military or non-military measures to maintain international peace and security, when necessary.

The concept of Protective Actions as they appear in the draft above is further grounded in historical precedents where states have acted, individually or collectively, to prevent the development of technologies deemed a threat to international security. These actions range from sanctions to cyber and military strikes.

The international effort to prevent Iran from developing nuclear weapons provides a clear, modern example. The UN Security Council has several times imposed sanctions on Iran due to its nuclear program, most of which were lifted after Iran agreed to limits on said program in the 2015 Joint Comprehensive Plan of Action.

The U.S. and Israel reportedly collaborated on Stuxnet, a highly sophisticated cyberweapon which destroyed many of Iran’s uranium enrichment centrifuges in 2010.

In June 2025, Israel launched airstrikes against many of Iran’s nuclear facilities, and this was followed by U.S. airstrikes nine days later which were partially aimed at disabling the Fordow Uranium Enrichment Plant.

Another historical precedent for Protective Actions is the international response to Iraq’s nuclear noncompliance in the 1990s. Following the 1991 Gulf War, the United Nations Special Commission (UNSCOM) was created to oversee the destruction of Iraq’s weapons of mass destruction. Non-compliance with the UNSCOM inspection regime eventually led to Operation Desert Fox in 1998, a bombing campaign aimed at degrading Iraq’s ability to produce WMDs.

Notes

A treaty to prevent the creation of artificial superintelligence might not need to be explicit about the need for Protective Actions against states undertaking ASI development, and instead leave these dynamics implicit, as similar agreements often do. Our draft is explicit because this deterrence regime is core to the effectiveness of the treaty, and clarity around the incentives increases the effectiveness. This explicitness also allows us to include measures that may help prevent Protective Actions being misused, including more thorough description of when these Actions are acceptable.

As discussed elsewhere, once world leaders understand the threat from ASI, they will likely be willing to take action to stop rogue AI development, including limited military interventions. Military actions, such as narrowly targeted airstrikes, should always be treated as a last resort option to prevent the development of ASI, after all other diplomacy has failed. But it is important that they are available as a last resort, in order for the deterrence and compliance regime to hold even towards actors who wrongly perceive recklessly created artificial superintelligence as a technology that would be beneficial rather than destructive.

We stress that any use of force should be targeted at preventing ASI, and should stop once it is clear that the threat has been removed. Article XII aims to make it clear that signatories would not prevent reasonable Protective Actions taken by other parties, but these actions must also be reviewed to ensure that this article is not being abused.