Introduction
The greatest danger of AI warfare is not destruction; it is uncertainty. If NATO allies cannot agree whether an attack occurred, collective defense erodes. Article 5 of the North Atlantic Treaty Organization (NATO) was designed to respond when tanks cross borders. The next Article 5 crisis may begin when no border is crossed at all. Instead, it may start with an artificial intelligence (AI) enabled cyberattack that shuts down a member state’s power grid, a coordinated deepfake campaign that paralyzes elections, or autonomous drones sabotaging critical infrastructure. In each case, the strategic challenge is not simply the damage inflicted, but whether allies can agree quickly on who attacked, whether the attack qualifies as “armed,” and what collective defense requires. AI-enabled operations do not make Article 5 obsolete, but rather expose unresolved questions about attribution, thresholds, and deterrence that NATO must answer before a crisis occurs.
Article 5: From Cold War to Algorithmic Warfare
NATO’s Article 5 states that “an armed attack against one or more of [NATO Allies] shall be considered an attack against [all NATO Allies]” and authorizes collective action “including the use of armed force.” The modern challenge lies not only in defining “armed attack,” but determining whether a digital, synthetic, or autonomous operation produces effects severe enough to trigger collective defense. Cyber and AI-enabled threats can be as destructive as armed conflict, albeit in a different capacity.
Article 5 was never automatic, but its deterrent logic depended on a clear image of aggression: an identifiable state using force against allied territory. During the Cold War, an attack by Soviet forces would have presented few attribution problems. In those scenarios attribution would be immediate; the aggressor visible, the chain of command clear, the political decision easy to justify. Collective defense therefore relied on a degree of clarity that AI- and cyber-enabled conflict increasingly erodes. The genius of Article 5 was that it transformed national borders into alliance borders; an attack on one member became a test of the entire Euro-Atlantic order.
However, conflict is increasingly borderless. Romania’s electoral crisis (analyzed below) showed how synthetic political content can pollute a democratic process even when it falls short of military aggression. In 2007, Estonia’s ministries, parliament, banks, and media were hit by widespread Distributed Denial of Service attacks (DDoS), among the first instances of cyber aggression after which the country came to host NATO’s Cooperative Cyber Defence Center of Excellence (CCDCOE). Those attacks raised allied concern but did not trigger Article 5.
How can NATO preserve Article 5’s credibility when attacks become faster, more deniable, and less physically visible?
This ambiguity is not a flaw adversaries will accidentally encounter, it is precisely what they exploit. Russia, China, Iran, and non-state actors do not need to defeat NATO militarily in order to weaken it politically. They operate in the space between crime and war, disruption and attack, deniability and responsibility. AI makes this gray zone more dangerous by increasing the speed, scale, and plausibility of such operations. Synthetic media can manufacture political confusion before governments can verify facts, autonomous systems can create physical effects while obscuring the human chain of command. The result is a new form of deterrence problem: NATO may possess overwhelming military power, yet hesitate because it cannot agree on what happened.
Three problems follow; attribution, thresholds, and deterrence, each paired with a policy proposal.
Problem 1: Attribution
Attribution is not one problem but two, and adversaries exploit the seam between them. Technical attribution asks where the packets, model, or drones came from. Legal attribution asks whether the act can be imputed to a state such that responsibility attaches. NATO can win the first and still lose the second, and Article 5 turns entirely on the second.
International law makes this hard by design. Under the customary law of state responsibility, conduct by non-state actors is attributable to a state only where a sufficient nexus exists, and the courts have set that bar high and inconsistently. The International Court of Justice (ICJ) in Nicaragua demanded “effective control” over specific operations; the International Criminal Tribunal for the Former Yugoslavia (ICTY) in Tadić accepted looser “overall control.” An adversary that routes an operation through a criminal affiliate, a “patriotic hacker” collective, or a front company is deliberately engineering itself into the gap between those two standards.
The 2016 episode is the template. After the Democratic National Committee hack, technical attribution to Russian services was widely accepted, yet Moscow’s posture “produce proof or stop talking”, was viable because the legal nexus could be contested in public. Even when technical attribution exists, legal attribution may remain contested.
AI widens this seam in three ways. First, it strips authorial fingerprints: attribution craft long relied on idiosyncrasy, reused code, distinctive tradecraft, language artifacts, working hours, but model-generated malware and influence content have no author in the old sense, degrading a forensic signal defenders have leaned on for two decades. Second, it lowers the cost of the false flag: generative tools make it cheap to manufacture evidence pointing at the wrong actor, raising the defender’s burden not because the truth is unknowable but because plausible alternatives are now trivial to fabricate. Third, it obscures the human in the loop (HITL): autonomous systems can produce physical effects while the authorizing chain of command is buried under layers of automation and deniability, the very link legal attribution requires.
Problem 2: Thresholds
When does an AI-enabled operation become an armed attack? Since the 2014 Wales Summit, the alliance has held that a cyberattack with effects “comparable to a conventional armed attack” can trigger Article 5. The 2016 Warsaw Summit declared cyberspace an operational domain. The 2021 Brussels communique reaffirmed that significant malicious cyber activities could, in certain circumstances, amount to an armed attack- decided case-by-case. The threshold doctrine exists, the problem is that it is deliberately under-specified, and that is now being exploited rather than respected.
The ambiguity carries a genuine benefit and a genuine cost. The benefit is that an adversary cannot map the exact line and plan to its edge. The cost is calibrated slicing: a rational adversary assumes the line sits somewhere short of mass casualties and operates just beneath it indefinitely, accumulating strategic advantage that never quite triggers a response. Ambiguity deters the attack while licensing the chronic one.
Two features specific to AI sharpen the problem:
The cumulative-effects gap. No single intrusion crosses the line, but a sustained campaign (degrade the grid Monday, the banking rails Wednesday, emergency communications Friday, repeat) can produce aggregate effects rivaling a kinetic strike. The 2021 Brussels language gestures at this (“single or cumulative”), but there is no operational doctrine for summing sub-threshold events into an Article 5 finding, so each incident is adjudicated in isolation and none qualifies.
The strategic but not physical attack. Romania’s first-round presidential vote in November 2024 was annulled by its Constitutional Court over alleged Russian and TikTok-driven manipulation. In the May 2025 rerun; deepfakes (including a fabricated video implying the eventual winner’s religion) circulated freely. The episode produced a strategic effect grave enough to void a NATO member’s national election, with zero physical effect. By an “effects comparable to armed attack” standard, it does not come close to Article 5. The gravest, most repeatable AI threat to the alliance is precisely the one the threshold doctrine is built to exclude.
There is also an unresolved reversibility question, a missile-destroyed substation is done; a malware-disabled grid may be back in hours. Does duration bear on whether an armed attack occurred, or only severity at peak? The doctrine is silent, and adversaries will exploit silence.
Problem 3: Deterrence
Deterrence depends on credibility. Credibility depends on knowing who attacked, and knowing whether the attack crossed a threshold. If neither is clear, deterrence weakens. The purpose of Article 5 is not retaliation but deterrence, and deterrence only functions when adversaries believe that an attack will generate a predictable collective response.
Classical deterrence by punishment requires four things to hold simultaneously: capability, will, communication, and, implicitly, a return address. AI does not touch NATO’s capability, it attacks the other three. It breaks the return address through deniable proxies and autonomous effects; you cannot punish what you cannot impute, nor deter an actor who believes they will never be named. It muddies will by manufacturing the doubt that prevents consensus, so the adversary’s bet is not “NATO is weak” but “NATO will be unable to agree it was attacked.” It strains communication because the alliance has never specified which provocation earns which response.
This produces the most dangerous dynamic of all: self-deterrence. NATO can hold overwhelming force and still be paralyzed, because the adversary deters it not by matching its power but by engineering ambiguity about whether anything happened. The relationship inverts; the side with less force shapes the behavior of the side with more.
The binary structure of Article 5 compounds this: if the only credible collective response is the full mutual-defense, then everything short of a catastrophic strike faces no credible collective response at all, and so sub-threshold attacks proliferate where deterrence is absent. Punishment cannot be the whole answer; deterrence by denial, making attacks fail through resilience so the payoff drops, must carry weight the punishment track cannot. The response problem and the resilience problem are two halves of one strategy.
Three policy proposals directly mapped to a problem.
Proposal 1: NATO Legal Attribution Framework
NATO should establish a standing legal attribution framework identifying the evidentiary standards for assigning responsibility to states in cyber and AI-enabled operations. The objective is not to eliminate disagreement, but to give allies a common path to legally and politically credible conclusions before a crisis escalates.
First, adopt a tiered, pre-agreed confidence vocabulary. Intelligence agencies operate with varying degrees of certainty, yet political debates often treat attribution as binary: proven or not. A standardized confidence ladder, like the United Kingdom’s “highly likely” and “almost certainly” framework, would let allies communicate calibrated judgments without litigating evidentiary standards mid-crisis. Allies should agree in advance which confidence thresholds are sufficient to trigger Article 4 consultations and which may justify considering Article 5 measures.
Second, establish a permanent attribution-and-analysis cell dedicated solely to determining what happened, not responding. Building on the CCDCOE, it would separate factual determinations from political decision-making. The separation matters because debate over consequences distorts assessments of responsibility: allies reluctant to support a response become reluctant to accept the attribution behind it. Decoupling the finding from the response reduces the risk that political disagreement corrodes factual consensus.
Third, adopt a pre-committed standard for state responsibility in cases involving proxies, state-supported hacker groups, and autonomous systems. Adversaries exploit the legal ambiguity around indirect actors to preserve deniability. NATO should publicly articulate the evidentiary standards it will apply when assessing responsibility, including how it evaluates proxy organizations, state-sponsored cyber groups, and AI-enabled autonomous operations. The deterrent value lies not only in the standard itself, but adversaries knowing that legal ambiguity will not shield them from accountability.
Fourth, formalize intelligence-sharing between allies and trusted private-sector cybersecurity firms, which increasingly hold the most significant attribution evidence. Standing arrangements should permit sharing at the level of conclusions without disclosing sensitive sources and methods, bridging capability gaps between allies and accelerating collective decision-making.
This framework would not eliminate uncertainty. Rigid standards can be gamed by adversaries who design operations around known criteria, and over-formalization can reduce flexibility against novel threats. The framework should therefore bind the process and vocabulary, not predetermine the verdict; reducing procedural uncertainty while preserving case-by-case judgment.
Proposal 2: Effect-Based Article 5 Thresholds
Even when responsibility can be established, allies may disagree on whether an operation is an armed attack severe enough to justify collective defense. The solution is not to redefine Article 5, but to clarify how its existing principles apply. NATO has already signaled that cyber operations may trigger collective defense when their consequences are comparable to a conventional attack; the task is to translate that principle into doctrine.
First, establish a means-agnostic taxonomy of effects. What should matter is not whether harm came through malware, autonomous systems, or missiles, but the consequences produced. Four categories should receive particular attention: mass casualties, significant physical destruction, prolonged paralysis of critical infrastructure, and severe degradation of military capabilities- assessed by scale, duration, and the strategic importance of the affected asset. A grid disabled by code and a grid destroyed by missiles are the same strategic outcome; and doctrine should say so.
Second, codify a cumulative-effects principle. Adversaries rely on campaigns of individually limited actions that remain below response thresholds while collectively imposing substantial strategic costs. NATO should formally recognize that a sustained campaign of coordinated sub-threshold operations can be assessed collectively rather than as isolated events, closing the salami-slicing gap and building on existing alliance language on cumulative threats.
Third, any threshold framework should guide political decision-making, not automate it. Article 5 has always been a political commitment as much as a legal one. An automatic trigger would create its own vulnerabilities: an adversary could engineer a false-flag operation calibrated to provoke collective action against the wrong actor. The framework’s purpose is to reduce procedural ambiguity, not replace deliberation. Consensus must remain the final safeguard against both miscalculation and manipulation.
This proposal faces real tension. Strategic ambiguity strengthens deterrence by keeping adversaries uncertain, whereas codified thresholds risk revealing where NATO's red lines sit. Taken to its conclusion, a strict effects-based standard would also exclude some of the most prominent AI threats (election interference, deepfakes, cognitive manipulation) because they rarely produce physical effects. The answer is calculated ambiguity: NATO should publicly communicate the categories of effects that may justify collective defense while keeping precise quantitative thresholds classified, providing clarity for deterrence without a blueprint for operating just below the line. The alliance should also concede that not every AI threat belongs under Article 5. Election manipulation and synthetic-media campaigns are serious challenges to democratic resilience, but they are better met through Article 4 consultations, election-security cooperation, and information-integrity measures. Forcing every AI-enabled threat into Article 5 risks weakening the credibility of collective defense rather than strengthening it.
Proposal 3: Create a Graduated AI Deterrence Doctrine
Article 5 remains NATO's most powerful security commitment, but it was never meant to be the Alliance's only response. In an environment of cyber operations, autonomous systems, proxies, and cognitive warfare, a binary choice between inaction and collective defense undermines deterrence: if adversaries believe that most attacks will fall below the Article 5 threshold, they conclude they can operate with impunity. NATO needs a graduated doctrine offering a predictable range of responses, each rung pre-coordinated and communicated publicly, because deterrence by punishment works only when consequences are understood in advance.
The first rung is coordinated public attribution, issues rapidly and supported by the standards of Proposal 1. Speed is itself a deterrent: attribution within days rather than months denies an adversary the window to build counter-narratives and fracture allied consensus.
The second is targeted sanctions against the responsible individuals, entities, and infrastructure, synchronized with existing European cyber-sanctions mechanisms so costs are imposed collectively.
The third is a coordinated cyber response: members already possess sovereign offensive capabilities that can be contributed through alliance frameworks to impose proportional response when necessary. At the same time, NATO must recognize the risks associated with cyber retaliation, such as unintended effects, impact civilian infrastructure, and invite reciprocal escalation. Any use of cyber capabilities should therefore remain proportionate, deliberate, and politically authorized.
The fourth is visible posture change: increased readiness levels, forward deployments, joint exercises, and enhanced force presence can communicate resolve without immediately crossing into armed conflict. Such measures are particularly valuable because they are observable, reversible, and clearly legible to adversaries.
The fifth and final remains Article 5 itself, and reserved for the gravest attacks. Far from weakening it, a graduated response structure strengthens it. The existence of intermediate options ensures that Article 5 is not invoked for incidents that do not warrant it, preserving the credibility of the commitment for situations that do.
Punishment alone, however, is insufficient. NATO should complement this ladder with a deterrence-by-denial strategy focused on resilience; protecting critical infrastructure, securing elections, building public resistance to disinformation, and fielding AI-enabled defenses. Such measures are particularly important when confronting proxy actors or deniable operations, where identifying a responsible state may prove difficult. By reducing the payoff of aggression, deterrence by denial reaches actors that deterrence by punishment cannot always influence.
The doctrine must also avoid the wrong kind of predictability. A published response ladder may encourage adversaries to dwell at the lowest rung, treating NATO's responses as a manageable cost of doing business. To prevent this, the cumulative-effects principle proposed earlier should apply equally to deterrence. A sustained campaign of low-level operations should be capable of justifying a significantly stronger response than any individual incident would warrant in isolation. The ladder must therefore be understood as a floor for response, not a ceiling.
Finally, NATO must reckon with machine-speed escalation. Autonomous systems and automated defenses may compress decision-making until crises outrun political leaders, where the greatest danger is not deliberate but accidental escalation. NATO should require explicit human oversight for every response above the lowest levels and reject any model of automated escalation. AI may accelerate conflict, but collective-defense decisions must remain human. The ladder exists to provide clarity and predictability, not to let machines determine the course of international security.
Conclusion
NATO’s challenge in the age of AI is not that collective defense has become obsolete, but that the legal and political assumptions underpinning collective defense are being tested by new forms of coercion. The Alliance does not need a new Article 5, it needs a clearer understanding of how Article 5 applies when aggression is digital, autonomous, and deliberately ambiguous.
Works Cited
Atlantic Council. “How NATO Can Integrate AI to Prevail in Future Algorithmic Warfare.” Atlantic Council. https://www.atlanticcouncil.org/in-depth-research-reports/report/how-nato-can-integrate-ai-to-prevail-in-future-algorithmic-warfare/
AustLII. “Melbourne Journal of International Law, 2014.” Australasian Legal Information Institute. https://classic.austlii.edu.au/au/journals/MelbJIL/2014/12.html
Belfer Center. “NATO’s Article 5 Explained: How Collective Defense Works and When It’s Triggered.” Harvard Kennedy School, Belfer Center. https://www.belfercenter.org/research-analysis/natos-article-5-explained-how-collective-defense-works-and-when-its-triggered
CCDCOE. “Cyber Attacks and Article 5: A Note on a Blurry but Consistent Position of NATO.” NATO Cooperative Cyber Defence Centre of Excellence. https://ccdcoe.org/library/publications/cyber-attacks-and-article-5-a-note-on-a-blurry-but-consistent-position-of-nato/
CCDCOE. “INCYDER 2014 Q2.” NATO Cooperative Cyber Defence Centre of Excellence. https://ccdcoe.org/uploads/2014/08/INCYDER-2014Q2.pdf
CCDCOE. “NATO Summit Updates Cyber Defence Policy.” NATO Cooperative Cyber Defence Centre of Excellence. https://ccdcoe.org/incyder-articles/nato-summit-updates-cyber-defence-policy/
CCDCOE. “Tallinn Manual.” NATO Cooperative Cyber Defence Centre of Excellence. https://ccdcoe.org/research/tallinn-manual/
ComputerWeekly. “UK Foreign Office Minister Condemns Russia for NotPetya Attacks.” ComputerWeekly. https://www.computerweekly.com/news/252435114/UK-Foreign-Office-minister-condemns-Russia-for-NotPetya-attacks
Council of the European Union. “Cyber-Attacks: Council Is Now Able to Impose Sanctions.” Council of the European Union, 17 May 2019. https://www.consilium.europa.eu/en/press/press-releases/2019/05/17/cyber-attacks-council-is-now-able-to-impose-sanctions/
Council of the European Union. “Sanctions Against Cyber-Attacks.” Council of the European Union. https://www.consilium.europa.eu/en/policies/sanctions-against-cyber-attacks/
CNN. “Russia to US: Produce Proof or Stop Talking About Hacking Claims.” CNN, 16 December 2016. https://edition.cnn.com/2016/12/16/europe/russia-us-hacking-claims-peskov/index.html
Department of Foreign Affairs and Trade. “Australia Attributes NotPetya Malware to Russia.” Australian Government. https://www.dfat.gov.au/sites/default/files/australia-attributes-notpetya-malware-to-russia.pdf
DISA. “Disinformation Narratives Impacting the Romanian Presidential Election.” DISA. https://disa.org/disinformation-narratives-impacting-the-romanian-presidential-election/
European Leadership Network. “Collective Cyber Defence and Attack: NATO’s Article 5 After the Ukraine Conflict.” European Leadership Network. https://europeanleadershipnetwork.org/commentary/collective-cyber-defence-and-attack-natos-article-5-after-the-ukraine-conflict/
European Parliament. “Artificial Intelligence and Defence.” European Parliament, 2023. https://www.europarl.europa.eu/RegData/etudes/BRIE/2023/702594/EXPO_BRI(2023)702594_EN.pdf
European Parliament. “Cyber Defence: EU and NATO Responses.” European Parliamentary Research Service, 2025. https://www.europarl.europa.eu/RegData/etudes/BRIE/2025/769580/EPRS_BRI(2025)769580_EN.pdf
EUR-Lex. “EU Restrictive Measures Against Cyber-Attacks.” EUR-Lex. https://eur-lex.europa.eu/EN/legal-content/summary/eu-restrictive-measures-against-cyber-attacks.html
Foreign, Commonwealth & Development Office. “Foreign Office Minister Condemns Russia for NotPetya Attacks.” GOV.UK. https://www.gov.uk/government/news/foreign-office-minister-condemns-russia-for-notpetya-attacks
Friends of Europe. “Hybrid Warfare Through Disinformation: The Recent Case of Romania.” Friends of Europe. https://www.friendsofeurope.org/insights/critical-thinking-hybrid-warfare-through-disinformation-the-recent-case-of-romania/
Hathaway, Oona A., et al. “The Law of Cyber-Attack.” Texas Law Review. https://texaslawreview.org/wp-content/uploads/2017/03/Hathaway.pdf
Institute of International and European Affairs. “Romania’s 2024–2025 Presidential Election Crisis and Its Aftermath.” IIEA. https://www.iiea.com/blog/romanias-20242025-presidential-election-crisis-and-its-aftermath
International Court of Justice. “Military and Paramilitary Activities in and Against Nicaragua (Nicaragua v. United States of America).” International Court of Justice. https://www.icj-cij.org/case/70
Lieber Institute. “The Evolution of Cyber Jus ad Bellum Thresholds.” Lieber Institute, West Point. https://lieber.westpoint.edu/evolution-cyber-jus-ad-bellum-thresholds/
NATO. “Brussels Summit Communiqué.” North Atlantic Treaty Organization, 14 June 2021. https://www.nato.int/en/about-us/official-texts-and-resources/official-texts/2021/06/14/brussels-summit-communique
NATO. “Collective Defence and Article 5.” North Atlantic Treaty Organization. https://www.nato.int/en/what-we-do/introduction-to-nato/collective-defence-and-article-5
Oxford Academic. “Tadić and the Overall Control Test.” European Journal of International Law. https://academic.oup.com/ejil/article/18/4/649/453762
Shackelford, Scott J. “State Responsibility for Cyber Attacks: Competing Standards for a Growing Problem.” NATO Cooperative Cyber Defence Centre of Excellence. https://ccdcoe.org/uploads/2018/10/Shackelford-State-Responsibility-for-Cyber-Attacks-Competing-Standards-for-a-Growing-Problem.pdf
Taylor & Francis Online. “Cyber Attribution and State Responsibility.” Taylor & Francis Online. https://www.tandfonline.com/doi/full/10.1080/13523260.2019.1677324
United Nations International Law Commission. “Draft Articles on Responsibility of States for Internationally Wrongful Acts, with Commentaries.” United Nations, 2001. https://legal.un.org/ilc/texts/instruments/english/commentaries/9_6_2001.pdf
Frontiers. “Frontiers in Big Data, 2024.” Frontiers in Big Data. https://doi.org/10.3389/fdata.2024.1452129