AI Sovereignty in Orbit: Threat Assessment for the On-Orbit AI Domain

Key Findings

1. The governance vacuum for AI processing in orbit scores 30.0 on the L x I x V risk matrix (Critical) — the highest-rated threat in the assessment, reflecting a gap that is not emerging but present and comprehensive.
2. 4 of 17 identified threats fall in the Critical zone; zero threats score below Medium priority, indicating the entire domain operates at elevated risk.
3. Export controls constrain hardware proliferation but fail to cover AI models and algorithms — the element that transforms a sensor platform into an autonomous decision-maker.
4. 5 of 7 mapped civilian-to-military conversion pathways for on-orbit AI require only trivial modification, making this among the most inherently dual-use technologies in the space domain.
5. All five threat categories show increasing 12-month trends, producing a uniformly worsening risk environment through the 2026-2031 planning horizon.

Executive Summary

This assessment evaluates the threat landscape created by the deployment of autonomous AI systems aboard satellites — systems that compress sensor-to-decision cycles from hours to seconds, operate beyond any single state’s jurisdiction, and cannot be physically accessed after launch. The dominant threat profile is a widening capability-governance gap: military and commercial operators are fielding on-orbit AI faster than any legal, normative, or technical framework can govern it. The highest-priority risk is the structural absence of governance for orbital AI processing (Risk Score: 30.0, Critical), which amplifies every other threat category from autonomous escalation to supply chain vulnerability. The net trajectory is strongly negative across all dimensions.

The Threat Environment

Context and Threat Environment

On-orbit AI transforms satellites from data collectors into processors that transmit analyzed conclusions rather than raw imagery — a shift from “images to answers” that rewrites the sovereignty equation. This is not a theoretical capability. China’s Three-Body constellation operates an 8-billion-parameter large language model in orbit, with nine months of orbital testing and reported 94% classification accuracy, though these metrics originate from Chinese state media and have not been independently verified.

Three structural features define this threat environment. First, orbital mechanics place satellites beyond physical jurisdiction while they transit dozens of national territories per orbit, creating irreconcilable conflicts between data sovereignty regimes. Second, post-deployment immutability means that compromised hardware or flawed AI models cannot be physically remediated — a constraint unique to space operations. Third, the sovereignty locus has shifted from data to algorithms, a domain no existing legal framework adequately covers. The assessment horizon spans 2026-2031, during which on-orbit AI will transition from experimental deployments to operational military infrastructure at constellation scale.

The Threat Landscape

The assessment identifies 17 threats across five categories, scored using a Likelihood x Impact x Vulnerability framework where each dimension is rated on structured scales and the product yields a composite risk score. Four threats reach the Critical zone.

The governance vacuum dominates. The absence of any international legal framework for AI processing in orbit (T9, Risk Score: 30.0) is not a future risk — it is a present reality that amplifies every other threat. The LAWS governance process has produced no provisions covering space-based autonomous systems (T10, 25.0), creating a false sense of regulatory progress while the most consequential domain remains ungoverned.

Autonomous escalation follows. The ISR-to-targeting chain that bypasses meaningful human oversight (T1, 25.0) is already in development. Compressed decision cycles prevent diplomatic de-escalation (T4, 16.0) as AI-augmented military command systems reduce the time between detection and engagement to seconds.

Supply chain concentration creates a third pressure point. NVIDIA Jetson has become the de facto standard for on-orbit GPU computing, appearing across multiple vendor platforms; the chokepoint risk (T5, 20.0) is structurally embedded. The impossibility of post-deployment access makes hardware backdoor risks (T7, 18.75) uniquely severe — compromised firmware in orbit cannot be patched through physical intervention. Critically, the hardware concentration that creates vulnerability also functions as a de facto non-proliferation mechanism: efforts to diversify supply chains through RISC-V or neuromorphic alternatives will simultaneously lower barriers to proliferation, creating a policy tension that technology alone cannot resolve.

Cross-category interactions compound the picture. The most dangerous cascading path runs from supply chain compromise through AI misclassification to autonomous kinetic response without human intervention — a chain amplified by the governance vacuum at every link.

Risk Matrix

The distribution reveals a threat landscape concentrated in the high-impact quadrant with no threats in the Low zone. Critical threats cluster in two areas: the governance-structural nexus (T9, T10) and the autonomous escalation pathway (T1). The boundary between High and Critical is porous — AI misclassification (T2) and hardware backdoor (T7) could shift upward if autonomous targeting becomes more widespread or supply chain attacks are demonstrated.

The Assessment

The Threats That Matter Most

The governance void is the master amplifier. No international treaty, convention, or binding agreement addresses AI processing of data in orbit (T9). This is not a gap awaiting diplomatic closure — it is a structural absence across every relevant framework. GDPR addresses data storage and transfer, not algorithmic inference. ITAR addresses hardware export, not model behavior. The Outer Space Treaty addresses state responsibility for space objects, not for the algorithmic decisions those objects make. A satellite using a US chip, running a European model, processing data over Chinese territory creates multi-layered sovereignty challenges that no single framework resolves. The vulnerability factor is rated at maximum exposure (1.5) because the gap is comprehensive. The LAWS governance process (T10, 25.0) compounds this by creating the appearance of progress while no trajectory toward space-specific provisions is visible. The governance window is narrower than it appears: norms must be established before the most capable systems, currently at mid-range technology readiness, reach operational deployment.

Autonomous targeting is advancing rapidly. The Pentagon’s push for autonomous AI systems through the Golden Dome program, and the integration of AI-processed intelligence into military command networks, demonstrate that on-orbit AI is being embedded in kill chains (T1, 25.0). The meaningful human control framework breaks down structurally in this domain: orbital latency compresses oversight windows, jurisdictional transit fragments control authority, and autonomous classification may occur where no human has both the ability and authority to intervene. Each operational use lowers the threshold for the next. The technology risk profile adds a critical dimension: lightweight image classification is mature and operationally proven, but the larger models now being deployed — including the 8-billion-parameter system on Three-Body — introduce failure modes that are qualitatively different. Large language model hallucination in safety-critical classification is rated the highest-priority technology risk because it produces confident but incorrect outputs with very low detectability. A model that silently degrades under radiation exposure or generates plausible but wrong classifications poses greater risk than one that fails visibly, because visible failure triggers human intervention while silent failure propagates into targeting chains.

The hardware chokepoint is strategic leverage. NVIDIA Jetson appears across Aitech, Novo Space, and Kepler deployments — 40 Jetson Orin modules across 10 satellites in the most recent constellation alone (T5, 20.0). AMD/Xilinx dominates the FPGA space. All critical components originate in US-allied supply chains, and US export controls determine global access — yet the Bureau of Industry and Security operates with fewer than 600 employees and under $200M budget. States outside US-allied supply chains face widening capability gaps with each hardware generation. Alternative architectures — RISC-V HPSC at technology readiness level 5-6, European neuromorphic chips at level 3-4 — remain years from operational deployment, meaning supply chain concentration will persist through at least 2029-2030.

Hardware tampering carries disproportionate consequences. No publicly documented case of space-grade hardware tampering exists, but the impossibility of post-deployment remediation makes the payoff of successful compromise disproportionately high (T7, 18.75). A backdoor in an AI processor aboard a military ISR satellite could feed manipulated intelligence into targeting chains for the satellite’s entire operational life. The concentration of space AI hardware in fewer than five vendor families creates high-value targets. Runtime integrity monitoring can detect behavioral anomalies but cannot identify hardware-level compromise with certainty.

Proliferation is accelerating through commercial and state channels. China’s planned Three-Body expansion to 32 satellites by 2028, reportedly serving Belt and Road regions, constitutes a state-sponsored proliferation pathway that replicates the BeiDou PNT infrastructure strategy — offering non-aligned states on-orbit AI capability tied to Chinese technology dependence, though the expansion timeline rests on Chinese state media announcements and has not been independently confirmed. Simultaneously, Kepler’s orbital computing-as-a-service model eliminates the need for indigenous satellite capability entirely, enabling any customer with funding to access on-orbit AI processing. The most consequential gap in non-proliferation architecture is that AI models and algorithms are not controlled as defense articles under ITAR, EAR, or Wassenaar. A state can legally assemble a complete on-orbit AI weapon-support system by combining controlled hardware (under license) with uncontrolled software. The most probable trajectory involves proliferation continuing with, at best, voluntary transparency norms rather than binding controls.

Exposure and Resilience

Structural Vulnerabilities

The most dangerous interaction is between the structural failure of meaningful human control and the opacity of on-orbit AI models — when autonomous systems make opaque decisions at timescales that preclude human oversight, neither accountability nor correction is possible. Post-deployment immutability is a physical constraint. Governance absence and jurisdictional fragmentation are political-legal constraints that will persist for years regardless of diplomatic effort.

Resilience Factors

Resilience factors exist but are insufficient to offset systemic vulnerabilities. Architecture diversification across GPU, FPGA, neuromorphic, and RISC-V platforms reduces single-point-of-failure risk at the technology level, but diversity of platform does not equal diversity of origin — fabrication remains concentrated in US-allied supply chains. The European dual-track approach, pursuing both sovereign capability and governance leadership through programs like AI-eXpress and MYRIAD alongside the Potsdam Call, is the most promising norm-setting pathway. Yet European hardware stacks depend on US-origin components at the chip level, embedding dependency beneath the surface of strategic autonomy. Distributed constellation architectures provide redundancy against individual-node compromise but could paradoxically amplify escalation risk by making constellations appear more survivable and therefore more tempting to employ in conflict. The gap between threats and protections is widest in the autonomous escalation domain, where no resilience factor directly addresses the structural failure of meaningful human control.

Where the Landscape Is Heading

Trend Assessment

The most consequential acceleration is in autonomous escalation, where each operational deployment — the Pentagon’s Golden Dome program, Three-Body’s expansion, commercial ISR-AI convergence — lowers the threshold for the next. The inflection point is the transition from experimental AI demonstrations to operational military infrastructure, a transition that is underway now and will be substantially complete within the planning horizon.

The governance trend is the most structurally concerning. While threats accelerate, governance remains at the declaratory stage with no binding instrument under development for space-based autonomous systems. The single most consequential trend shift is the maturation of large language model inference in orbit: as systems like Three-Body move from experimental to operational, the silent failure modes inherent to large models — hallucination, radiation-induced parameter drift — will introduce qualitatively new risks into military decision chains that were designed for deterministic sensors, not probabilistic AI.

The Response

What To Do First

Immediate action centers on the governance gap. A space-specific autonomous systems protocol should be tabled at the next available UNGA or multilateral forum. This will not produce binding text quickly, but it establishes the principle that orbital autonomous AI requires dedicated governance — a principle currently absent from every active diplomatic process. In parallel, national guidance requiring explicit human authorization for any kinetic action derived from on-orbit AI classification should be issued as a domestic legal baseline, establishing norms of practice even as international frameworks develop.

Within the next twelve months, an ITAR/EAR review should be initiated to bring AI model weights and inference architectures for space applications within export control scope — closing the most consequential gap in the non-proliferation architecture. Simultaneously, investment in on-orbit AI model integrity monitoring systems is critical: technologies capable of detecting radiation-induced parameter degradation and anomalous inference outputs before they enter decision chains would address the silent failure problem that the technology risk profile identifies as the highest-priority technical vulnerability.

Over the medium term, a multilateral algorithmic transparency registry for on-orbit AI systems — analogous to nuclear safeguards — would require registered satellites to declare AI model capabilities, autonomy levels, and processing domains. Even voluntary adoption creates normative expectations. European sovereign space AI fabrication investment, building on Ubotica and AGGA-4 foundations, would provide genuine supply chain diversity at the fabrication level rather than merely at the platform level.

The single most consequential threat demanding a decision now is the governance vacuum. Every month that passes without space-specific autonomous AI governance allows operational deployments to establish facts on orbit that future regulations will struggle to reverse.

Limitations

This assessment relies on secondary sources for Chinese on-orbit AI capabilities — particularly the Three-Body constellation metrics, which originate from Chinese state media and have not been independently verified — and captures only the unclassified manifestations of US and allied military programs. Risk scores involve judgment, particularly for unprecedented scenarios such as autonomous constellation swarm escalation. The assessment captures a snapshot as of April 2026; the Three-Body expansion, HPSC delivery timeline, and ongoing conflicts could shift multiple ratings within months. Space weather effects, orbital debris risks to AI-carrying satellites, and insider threats within satellite operator organizations were excluded to maintain focus on the security-governance nexus.

Glossary

Risk framework (article-specific)

• T1…T17 — Threat identifiers used in the risk matrix, organised in five categories:
  • Autonomous escalation and loss of human control
    • T1 — autonomous ISR-to-targeting chain bypasses meaningful human oversight (25.0, Critical)
    • T2 — AI misclassification triggers kinetic response against non-threat (18.75)
    • T3 — autonomous constellation swarms operate beyond single-authority control (15.0)
    • T4 — compressed decision cycles prevent diplomatic de-escalation (16.0)
  • Supply chain concentration and hardware dependency
    • T5 — NVIDIA GPU chokepoint for on-orbit computing (20.0)
    • T6 — global memory-chip shortage constrains deployment through 2028 (15.0)
    • T7 — hardware backdoor or firmware tampering in space-grade AI processors (18.75)
    • T8 — Ubotica single-vendor dependency for European space AI (15.0)
  • Governance vacuum and jurisdictional failure
    • T9 — no legal framework governs AI processing of data in orbit (30.0, Critical — highest-rated)
    • T10 — LAWS governance excludes space-based autonomous systems (25.0, Critical)
    • T11 — GDPR and data-localization laws inapplicable to orbital processing (12.0)
    • T12 — classification policies impede allied intelligence sharing (9.0)
  • Cyber and electronic warfare against on-orbit AI
    • T13 — adversarial AI model poisoning or manipulation via uplink (15.0)
    • T14 — AI model exfiltration via satellite communication intercept (9.0)
    • T15 — spoofed sensor input causes AI misclassification (15.0)
  • Sovereignty capture by private providers
    • T16 — governments dependent on commercial on-orbit AI lose sovereign control (16.0)
    • T17 — “sovereign AI” marketed by private firms replicates the oil-sovereignty trap (11.25)
• L × I × V — Risk score formula: Likelihood × Impact × Vulnerability.
  • L1–L5 — likelihood scale on one axis of the matrix (5 = highest)
  • Impact 1–5 — impact scale on the other axis (5 = highest)

Technical and hardware

• LLM — Large Language Model; the class of model whose silent-failure modes (hallucination, radiation-induced parameter drift) dominate the technology risk profile.
• ISR — Intelligence, Surveillance, and Reconnaissance; the function most directly transformed by on-orbit AI from raw-imagery collection to classified-output delivery.
• FPGA — Field-Programmable Gate Array; reconfigurable silicon, dominated in the space-grade segment by AMD/Xilinx.
• RISC-V — open-source CPU instruction-set architecture; the leading non-US alternative for sovereign processors.
• HPSC — High-Performance Spaceflight Computing; NASA’s next-generation rad-hard processor architecture (currently at TRL 5-6).
• AGGA-4 — Advanced GPS/Galileo ASIC; ESA family of space-grade navigation chips, part of the European foundation for sovereign space AI hardware.

Regulation and export control

• LAWS — Lethal Autonomous Weapons Systems; the UN CCW Group of Governmental Experts process addressing autonomous weapons governance (no space-specific provisions to date).
• ITAR — International Traffic in Arms Regulations; US defense-articles export regime.
• EAR — Export Administration Regulations; US dual-use export regime administered by BIS.
• Wassenaar — Wassenaar Arrangement; 42-state multilateral export-control regime for conventional arms and dual-use goods.
• BIS — Bureau of Industry and Security; US Department of Commerce agency that enforces the EAR (operating with under 600 staff and ~$200M budget).

Programs and systems

• Golden Dome — Pentagon missile-defence program integrating autonomous AI decision-making components.
• Three-Body — Chinese on-orbit AI computing constellation; reportedly running an 8-billion-parameter LLM in orbit (Chinese state-media source, not independently verified).
• Jetson / Jetson Orin — NVIDIA embedded AI GPU module; de facto standard for on-orbit compute, present across Aitech, Novo Space, and Kepler deployments.

Primary Sources & Research

Kepler Communications (2026). Kepler Deploys First Space-Based, Scalable Cloud Infrastructure Powered by NVIDIA. Kepler Communications. https://kepler.space/kepler-deploys-first-space-based-scalable-cloud-infrastructure-powered-by-nvidia/

Kepler Communications (2025). Kepler Announces On-Orbit Compute Capacity on Optical Data Relay Network. Kepler Communications. https://kepler.space/kepler-announces-on-orbit-compute-capacity-on-optical-data-relay-network/

NASA (2025). CogniSAT-6 Dynamic Targeting Demonstration. NASA. https://www.nasa.gov

NASA (2025). Starling: Distributed Autonomous Spacecraft Operations. NASA Ames Research Center. https://www.nasa.gov

NASA (2025). ISAAC: Integrated System for Autonomous and Adaptive Caretaking. NASA. https://www.nasa.gov

ESA (2025). Enabling Navigation Onboard MetOp-SG-A1 (AGGA-4 ASIC). European Space Agency. https://www.esa.int/Enabling_Support/Space_Engineering_Technology/Shaping_the_Future/Enabling_navigation_onboard_MetOp-SG-A1

US Space Command (2025). Assessment of COSMOS 2576 as Counterspace Weapon. NPR. https://www.npr.org

CSIS / Gregory C. Allen (2022). Choking Off China’s Access to the Future of AI. Center for Strategic and International Studies. https://www.csis.org/analysis/choking-chinas-access-future-ai

SatNews (2026). China Completes In-Orbit Testing of “Three-Body” AI Computing Constellation. SatNews. https://satnews.com/2026/02/16/china-completes-in-orbit-testing-of-three-body-ai-computing-constellation/

Chatham House (2026). Middle Powers and the AI Sovereignty Dilemma. Chatham House. https://www.chathamhouse.org

ORF / Nisha Holla (2026). India’s Sovereign AI Stack: Institutional Programs Across Five Layers. Observer Research Foundation. https://www.orfonline.org

Deloitte (2026). Technology Sovereignty Acceleration and Market Fragmentation. Deloitte Insights. https://www.deloitte.com/insights

East Asia Forum (2025). US-China AI Standards Competition and the Starlink Dual-Use Precedent. East Asia Forum. https://www.eastasiaforum.org

Cruzes, D.S. (2026). AI Sovereignty: Infrastructure, Latency, and Jurisdictional Control. arXiv. https://arxiv.org/abs/2602.10900

Siebert, L.C. et al. (2021). Meaningful Human Control: Actionable Properties for AI System Design. arXiv. https://arxiv.org/abs/2112.01298

Yew, S.K. et al. (2026). The Commodification of Sovereign AI. arXiv. https://arxiv.org/abs/2601.11763

Srivastava, D. & Bullock, J. (2024). AI and Global Governance: Instrumental, Structural, and Discursive Power. arXiv. https://arxiv.org/abs/2410.17481