From Weapons to Cloud Systems: Assessing Corporate Responsibility for Defense and Dual-Use Companies

Products, components, software, and know-how that are primarily used for civilian or commercial purposes but that also possess capabilities that may be of use to military users are becoming increasingly prevalent. These dual-use goods and technologies are reshaping how investors assess responsibility within the defense ecosystem. Analysis of ISS STOXX’s Norm-Based Research and Norm-Based Engagement suggests that the key stewardship challenge is no longer limited to the traditional defense sector but extends to any company whose products or services may contribute to adverse human rights impacts in conflict-affected and high-risk areas.

Across both defense and dual-use sectors, research and engagement outcomes suggest that relying solely on government authorizations or export control regimes is increasingly viewed as insufficient to meet evolving investor expectations and international norms. Rather, the central stewardship question is whether the company is taking meaningful steps, beyond legal compliance, to understand, prevent, mitigate, and address human rights risks associated with its products, services, and business relationships.

Beyond Compliance: Heightened Human Rights Due Diligence for Defense and Dual-Use Companies

The UN Guiding Principles “apply to all States and to all business enterprises, both transnational and others, regardless of their size, sector, location, ownership and structure.” Expectations for both defense companies and those that provide dual-use products are the same as for any other, i.e., companies have a responsibility to respect human rights and must put in place policies and processes to do so, including through human rights due diligence (HRDD), consultation with stakeholders, prevention, mitigation, and remediation. Importantly, this applies to both company inputs and outputs. While defense companies often have robust human rights policies regarding labor standards, environmental impact, and supply chain risk management, they may be lacking policies and procedures regarding product use.

Considering the risk that defense articles and dual-use products may contribute to violations of international humanitarian law and international human rights law, as well as the high likelihood that products will be involved in conflict-affected and high-risk areas (CAHRAs), companies involved in the production of defense articles and dual-use products have heightened HRDD responsibilities. The heightened HRDD framework is not merely an escalation or intensification of an already existing HRDD framework used in standard business environments. Instead, the concept is built around proportionality: the higher the risk, the more complex the processes.

Heightened HRDD must be tied to the specific dynamics of individual CAHRAs and must engage with three separate risks:

• the risk of heightened human rights impact,
• the risk of violation or complicity in violation of international human rights (IHR) or humanitarian law (IHL), and
• the risk in exacerbating or prolonging conflict.

Heightened HRDD does not only apply to contexts, however: it must also apply to customers, ideally even down to the individual unit that will receive the defense or dual-use product. Precedent exists for this type of screening. The United States’ (U.S.) Child Soldiers Prevention Act (2008) and Leahy Laws prohibit the U.S. government from providing military assistance, including training, to governments who use children in combat. The Leahy Laws also prohibit such military assistance to specific units that have committed gross human rights violations with impunity. The Department of State is responsible for enhanced vetting of these units.

However, if companies rely solely on the government export control regimes of their domiciled States to identify and prevent human rights risks, they still might not meet expectations for human rights due diligence. The conflicts in Yemen and Gaza demonstrate that arms transfers can continue for extended periods despite mounting evidence of serious human rights and IHL violations. Further, restrictions on arms transfers are often imposed only after sustained public pressure and subject to reversal upon a change in administration. These cases highlight that heightened HRDD cannot necessarily be limited to compliance with government licensing decisions. Rather, companies may wish to meet investor expectations through their own ongoing assessments of end-use and any risk of their products contributing to violations of IHL/IHR.

The Expanding Role of Dual-Use Technologies in Modern Warfare

Rapid technological development has changed how wars are fought and how technology is used in modern conflict. The private sector has played an increased role in developing commercial tools with military applications in the areas of artificial intelligence, unmanned aerial systems, cloud computing, satellite services, and communication tools. These commercial companies differ markedly from traditional defense manufacturers, who maintain close ties to their domiciled governments and can claim legitimate national security reasons for limiting public disclosure.

With the proliferation of open-source intelligence experts working independently and alongside NGOs and media houses, it is now easier than ever to find evidence of weapon use in near-real time. By contrast, the use of commercial satellites to identify targets, cloud systems to store intelligence, or AI to analyze and potentially select targets is much more difficult to demonstrate.

Nevertheless, investors may have more influence over commercial companies producing or providing dual-use goods and services to military actors due to greater sensitivity to legal, reputational, and workforce-related risks. While lawsuits targeting defense contractors for their provision of products allegedly used in war crimes remain relatively rare, commercial companies have increasingly come under legal scrutiny for their potential complicity in human rights abuses.

Construction, banking, and mining companies have all in recent years faced legal scrutiny for their operations in CAHRAs as governments integrate international norms into domestic law. Such allegations can affect not only their legal standing but also their civilian operations, including relations with consumers and employees.

For example, the head of Microsoft’s Israeli subsidiary stepped down in 2026 following a media investigation into the company’s alleged involvement, through its provision of cloud services, into the Israeli Defense Force’s mass surveillance of Palestinian civilian phone calls. Similarly, Google withdrew from the U.S. Department of Defense’s Project Maven in 2018 following pushback from Google’s own employees, with Palantir later assuming the contract. Google continues to face employee backlash in 2026 over its AI contracts with the military.

Evidence from Norm-Based Research and Engagement: Controversies, Company Responses, and Investor Expectations

Analysis of controversies identified through ISS STOXX’s Norm-Based Research and subsequent engagement undertaken through Norm-Based Engagement provide insight into the types of human rights risks, company responses, and investor expectations that have emerged in practice.

Norm-Based Research (NBR) assesses companies’ adherence to international norms on human rights, labor rights, the environment, and corruption. NBR’s core normative framework is based on the Principles of the UN Global Compact, the OECD Guidelines for Multinational Enterprises on Responsible Business Conduct, and the UN Guiding Principles for Business and Human Rights.

Norm-Based Engagement (NBE) facilitates investor dialogue with listed companies identified by NBR as failing to prevent or address social and environmental controversies, as indicated by an Amber or Red flag.

During 2020–2026, NBE reached out to 13 companies on 19 controversies related to military supplies and security-related human rights due diligence that were Amber- or Red-flagged by NBR. The majority of these controversies were in CAHRAs.

Seventeen of the 19 controversies involved allegations of failing to mitigate the risk of military or security supplies being used in human rights violations. The remaining two related to alleged failures in conducting human rights due diligence.

Most engaged companies were U.S.-based (Figure 1) and operated in the aerospace and defense industry (Figure 2), while Yemen was the most frequent controversy location (Figure 3).

Figure 1: Norm-Based Engagement: Domicile of Companies Engaged

Figure 2: Norm-Based Engagement: Industry of Companies Engaged

Figure 3: Norm-Based Engagement: Location of Controversies Engaged

The expectations from and the questions directed at companies involved in controversies in CAHRAs during this period, as reflected in the engagement data, fall into the following categories:

• Disclosing relevant information on companies’ human rights due diligence, oversight, and risk management processes related to the sale, transfer, and use of their products and services.
• Demonstrating the effective implementation of human rights policies, controls, and due diligence procedures to identify, assess, and mitigate risks associated with end users and product use.
• Taking appropriate remedial actions to address actual or alleged adverse human rights impacts connected to the company’s products, services, or business relationships and prevent their recurrence.
• Restricting business activities, transfers, or relationships where there is a credible risk of contributing to or being linked with IHR and IHL violations.

By the end of Q3 2026, four of the 13 companies remained unresponsive to engagement outreach related to five controversies in CAHRAs. These included two companies domiciled in the United States and two in China. Most of the responsive companies deferred to national governments’ laws and policies with respect to military exports.

Case Studies

The following case studies illustrate how companies facing similar allegations can differ markedly in their approach to human rights risk management, transparency, and accountability. Together, they demonstrate that responsiveness to investor expectations is influenced less by the sector companies operate in and more by how they approach due diligence, oversight, and remediation of potential adverse impacts.

Case Study 1: Defense Contractors and End-Use Risk Management

In 2020, on behalf of 32 client investors, NBE reached out to a U.K. aerospace and defense company following an Amber-flagged controversy by NBR. The controversy concerned the supply of combat aircraft and related services through U.K. government contracts to governments accused of IHR and IHL violations in a CAHRA and of failing to distinguish between civilians and combatants and between civilian and military objects. The engagement sought disclosure regarding the company’s human rights due diligence processes, the implementation of its responsible trading policy, and its assessment of the risk of IHR violations, including circumstances under which transfers may be suspended.

During an NBE-facilitated engagement meeting between the company and client investors, the company provided information on its compliance framework, including a code of conduct, responsible trading principles, internal controls, and risk management processes. The company explained that business opportunities are assessed based on risks associated with the type of product and intended use, end-user characteristics, and the country of sale, with certain military sales subject to further review by senior management. At the same time, the company emphasized that defense exports are governed by strict government licensing regimes and that governments conduct their own assessments before authorizing transfers.

By the conclusion of the engagement, the company had made progress towards two of the four engagement goals and was assessed as demonstrating “Adequate” quality of participation. In 2025, the associated controversy was upgraded by NBR from Amber to Green.

Separately, NBE reached out in 2020 and 2025 to a U.S. aerospace and defense company, on behalf of 63 client investors, regarding two Amber-flagged controversies. Both controversies related to i) the supply of munitions through ongoing U.S. government contracts to governments accused of IHL violations in CAHRAs; and ii) the failure to engage with the U.S. government to restrict sales or transfers to actors credibly alleged to be engaged in violations of IHL. The company did not respond to the initial 2020 outreach or the subsequent escalation process.

The goals for the 2025 engagement focused on the company’s approach to end-use monitoring, oversight of the responsible use of its products, and any remedial measures undertaken in response to alleged IHL violations. NBE also sought disclosure on the company’s assessment of end-use risks and the circumstances under which transfers could be suspended where recipients were credibly accused of violating IHL.

In response to the 2025 outreach and follow-up questions, the company stated that its approach is guided by U.S. law and government policy. By the end of the engagement, the company had achieved no progress towards any of the engagement goals and was assessed as demonstrating “Poor” quality of participation.

While neither company claimed responsibility for determining the legality of government-authorized weapons transfers, the first company demonstrated greater willingness to discuss its own governance and risk management processes. By contrast, the second company provided limited information beyond its reliance on government oversight.

Case Study 2: Dual-Use Companies and Corporate Accountability

In 2025, as part of a fact-finding dialogue related to an Amber-flagged controversy, NBR contacted a U.S. company in the trucks/construction/farm machinery industry concerning allegations that its construction machinery was supplied, through U.S. government contracts, to a government accused of IHR and IHL violations in a CAHRA. According to reports, the equipment was used in the destruction of civilian infrastructure without sufficient military justification. In response to NBR outreach, the company stated that, while it maintains a compliance program, responsibility for ensuring that sales comply with applicable statutory and policy requirements ultimately lies with the U.S. Department of State.

In early 2026, NBE reached out to the same company on behalf of 82 client investors seeking further disclosure and clarifications regarding its human rights due diligence policies, end-use monitoring practices, any remedial measures taken in response to alleged IHR and IHL violations, and the circumstances under which transfers through the U.S. government may be suspended. The company did not respond to the NBE outreach or the subsequent escalation process.

Similarly, as part of a fact-finding dialogue related to a Green-flagged controversy, NBR contacted a packaged software company regarding allegations that its AI and cloud services had been provided to a government accused of violating IHR and IHL through targeting civilians in a CAHRA.

During the NBR dialogue, the company explained that it had decided to cease and disable the services provided to the accused party following a review with that party. The company also shared publicly available information on employee engagement on the issue, its approach to responding to activist protests, and the principles guiding its decision-making. In addition, the company expressed its commitment to publishing the findings of an external review of the allegations. Following this dialogue, the NBR score of the associated Green-flagged controversy was upgraded.

Similar to the defense sector example above, the first company relied primarily on government oversight and provided limited information regarding its own due diligence processes. By contrast, the software company disclosed the actions taken in response to the allegations, including terminating services and commissioning an external review. The differing responses demonstrate that meaningful engagement and accountability are not determined by sector, but by a company’s willingness to assess and address its own human rights impacts and responsibilities.

Conclusion

As military capabilities increasingly depend not only on weapons systems but also on other dual-use goods and technologies, the data gathered by ISS STOXX’s Norm-Based Research and Norm-Based Engagement services suggest that the key differentiator is not a company’s industry classification, but the extent to which it acknowledges and manages the human rights risks connected to the use of its products and services.

Across both defense contractors and dual-use companies, research and engagement outcomes indicate that relying solely on government authorizations or export controls is increasingly viewed as insufficient to meet international obligations and investor expectations. Companies that demonstrate meaningful due diligence, transparency, oversight of end-use risks, and a willingness to take corrective action appear better positioned to address investor concerns and align with evolving global norms.