AI and the dangerous fiction of “all legal use”

A lot has happened since Anthropic and the U.S. Department of Defense went public in February with a dispute over whether the U.S. government can require AI companies to authorize “all lawful uses” of their technology. While the “all lawful uses” framework appears reasonable, adopting it as a universal principle for government use of AI risks widespread violations of international human rights law (IHRL) and international humanitarian law (IHL).

Anthrop and the Department of Defense were unable to reach agreement on two specific issues: mass surveillance of the American public and the development of autonomous lethal weapons that operate without human control. The government has designated Anthropic as a “supply chain risk,” which the company is challenging in court.

In recent weeks, as the international community and human rights activists react to the U.S. and Israeli attacks on Iran and Lebanon, more serious concerns have been raised about AI-assisted human decision-making and its impact on the failure to protect civilians as defined by the laws of war.

But last month, the scope of AI expanded to include its use within the United States. As first reported by the Financial Times, the U.S. General Services Administration has drafted rules for private AI contracts that also apply an “all lawful use” standard. These draft rules state that suppliers of AI systems must grant governments “irrevocable, royalty-free, non-exclusive licenses to use AI systems for lawful government purposes.”

This question of whether AI companies should allow the government “all lawful uses” of their technology has implications far beyond the debate started by the current U.S. government. This addresses a core dilemma in selling AI technology to governments in the United States and around the world.

At first glance, it may seem reasonable to conclude that “all lawful uses” is the appropriate standard for private companies selling to governments, whether for military or civilian purposes. Governments have a legal obligation to protect the rights of their citizens and exist to serve the public good, a goal nobler and nobler than returning profits to shareholders. Indeed, it should be legal standards set by governments that determine how products are used in the public interest, not shareholder interests or the preferences of investors or billionaire tech founders.

But the idea that AI companies need to allow “all lawful uses” of their technology is insufficient for at least three reasons.

First, domestic laws may not be consistent with international human rights standards. The United States’ lack of federal privacy laws and flaws in Section 702 of the Foreign Intelligence Surveillance Act, which allows the collection of large amounts of U.S. citizen data through warrantless surveillance of non-U.S. persons outside the United States, illustrate how U.S. law can and will conflict with IHRL.

Second, governments can take actions that send a clear signal that they do not intend to abide by their own laws, making it much less likely that they will actually do so. A number of recent statements by the President of the United States and the Secretary of Defense demonstrate a clear disregard for both domestic and international law, even as the dismantling of Civilian Protection Centers and similar teams significantly increases the risk of civilian casualties during armed conflicts. Or consider the case of the Russian government, which repeatedly violated the laws of war in Ukraine.

Third, the “all lawful uses” standard does not apply on a global scale. Requiring companies to permit “all lawful uses” in the United States would weaken their ability to resist government requests in other countries, where the potential for violations of human rights and humanitarian law could be further increased. While much of the global attention to the dangers and human rights risks of AI technologies in conflict is currently focused on the United States and Israel, given current events in Iran and Lebanon, the issue is broader, and there are many situations where domestic laws conflict with human rights standards or where governments proudly ignore international norms in pursuit of nationalist and authoritarian policies.

AI technology is playing a more important role than ever in both military operations (as we have witnessed in Gaza, Ukraine, and Iran) and federal law enforcement. During a recent immigration crackdown in Minnesota, federal agents used AI and other digital technologies to track both illegal immigrants and protesters. There is an increasing need to adopt clearly defined international human rights standards as a consistent and universal reference point of integrity.

Human rights serve as universal standards for all peoples and states, and IHRL and IHL outline the obligation of governments to act in a manner that promotes human rights and to refrain from acts that fail to protect human rights. This provides a more durable, consistent, scalable, robust and internationally recognized standard for guiding corporate decision-making than important but ultimately flexible and controversial concepts such as ethics, democratic values, safety and responsibility.

The question of how companies should incorporate respect for human rights into their decision-making has evolved significantly over the past two decades. The United Nations Guiding Principles on Business and Human Rights (UNGP) apply to businesses in all industries and state that they should “seek ways to respect internationally recognized human rights principles when faced with conflicting requirements.” Where local circumstances make it impossible to fully fulfill this responsibility, companies are expected to respect internationally recognized human rights principles to the extent possible under the circumstances and demonstrate their efforts in this regard.

The UNGP establishes normative standards that can guide our thinking during times like these. These provide a more principled approach for businesses, and a more desirable one for society as a whole, than the “all lawful uses” standard. They recognize the reality we all know so well: that government, and therefore its laws and enforcement, do not always serve the public interest.

While it is right for governments to enact policies, laws and regulations that restrict the actions of businesses in order to protect and respect human rights, the reverse is also true. When governments fail to protect the rights of their citizens, businesses have a responsibility to protect the rights of those affected, including conducting due diligence to assess whether the use of their products may adversely impact human rights, based on international human rights standards. Human rights due diligence will need to adapt to the pace of AI development, which will require a shift to methods that are directly integrated into the design, development, and deployment of products. Where risks of harm are reasonably foreseeable, businesses must take steps to avoid, prevent or reduce these effects.

However, it is also important to recognize that the role and responsibilities of AI companies extend beyond deciding whether to sell to governments and beyond the contractual commitments for responsible use expressed in AUPs and Terms of Use. This includes training, setting limits on what governments (and other users) can and cannot do with products, and limiting a product’s ability to enable certain harms.

If governments and the United Nations are to ensure that AI systems do not harm civilians, their design, development and deployment must comply with human rights norms, and human rights due diligence must be built into every step of the process. “All lawful uses” is a term that is too imprecise, too weak, and too easily abused to justify harmful or rights-infringing uses of AI in both military and civilian contexts.