When Autonomous Systems Recover, The World Has Moved On – Analysis

Key Takeaways:

• The author starts from Reuters: Finnish investigators blamed spring Ukrainian-military-drone incursions on GNSS jamming plus wind—not a collapse of autonomy. The lesson is that when navigation is bad, the path away from danger matters as much as the path to a target. IMO’s first MASS Code (adopted May, in force 1 July) and EASA’s July 2026 GNSS-interference update make the same point for ships and aircraft: restrict the machine, then say what “safe enough to widen authority again” means.
• Recovery is not the inverse of shutdown. The world keeps moving (fuel, drift, traffic, a link that returns late). A restored radar or GPS fix does not restore the old sea or sky. DoD 3000.09 is cited for human judgment over force; the engineering question here is after abort. NASA-style runtime assurance: switch to a trusted fallback only under stated conditions.
• Proposed “recovery contract”: what failed, what changed while restricted, which fallback assumptions still hold, what evidence is needed before automation expands. Test false recoveries (brief good signal, split pictures of who is in control), not only hard failures. ICRC-style limits on duration and place are invoked for civilian risk near weapons; a stop of the original task is not the whole safety story.

A drone that loses navigation and an autonomous vessel that regains sensors after a fault expose the same overlooked problem: recovery is not a reset.

Earlier this month, Reuters reported that Finnish investigators attributed four Ukrainian military drones entering Finnish airspace during the spring to a combination of GNSS jamming and wind. The incident was not presented as a failure of autonomous control, and it should not be turned into one. Its narrower lesson is more useful: when navigation becomes unreliable, the route away from danger can become as consequential as the route toward an objective.

That problem is becoming harder to ignore as autonomy expands across air and sea. In May, the International Maritime Organization adopted its first MASS Code for remotely controlled and autonomous commercial ships. The non-mandatory code took effect on July 1 and requires defined modes of operation, risk management, remote-operations arrangements and continuing human responsibility. It is a major regulatory milestone. It also highlights a practical engineering question that applies well beyond commercial shipping: what exactly has to be true before an autonomous system is allowed to resume a broader role after something went wrong?

The world does not pause while autonomy is restricted. A drone may drift, consume fuel and cross into different airspace. A vessel may keep moving under a protective controller while other ships alter course around it. A communications link can return after the tactical picture has changed. A sensor can come back online after the assumptions built around its last trustworthy reading have expired.

Stopping is only the first transition

The air case makes the problem intuitive. EASA’s July 2026 update on GNSS interference reflects continued concern about jamming and spoofing and adds new operational and training measures. For any aircraft that depends heavily on satellite navigation, a command to return home is not automatically conservative if the same position estimate that triggered concern is also being used to define home, route, altitude or separation.

The relevant choice may instead be among several imperfect modes: continue a bounded trajectory, hold where safe, accept remote guidance, use an alternate navigation source, divert to a qualified recovery area, or descend under a preplanned procedure. Which option is least risky depends on remaining energy, confidence in position, nearby people, airspace, weather and the evidence still available. The important point is not that one fallback is always best. It is that fallback behavior has assumptions of its own.

For autonomous and semi-autonomous weapon systems, DoD Directive 3000.09 already treats realistic verification, validation and testing as part of assuring appropriate human judgment over the use of force. The engineering question considered here begins after a restriction or abort condition is triggered. Suspending a mission objective and safely managing the platform afterward are related decisions, but they are not the same decision.

At sea, recovery inherits a new traffic picture

Maritime autonomy exposes the same structure more clearly because a ship cannot stop the surrounding world. The IMO’s current autonomous-shipping framework requires operators to describe modes of operation and preserves the master’s overall responsibility. That makes the handover question visible: when automation has been restricted after inconsistent sensors or a communications interruption, what evidence justifies returning it to a wider operating mode?

A restored radar feed or communications link does not restore the sea that existed before the fault. Nearby ships have moved. Visibility may have changed. The vessel may have drifted. A route that was acceptable ten minutes earlier may now create a collision problem. The system therefore has to re-establish the current situation rather than simply resume from the last valid waypoint.

This is consistent with the logic behind runtime assurance research. NASA’s formal work on runtime assurance models switching between an advanced controller and a trusted fallback according to explicit conditions. The maritime lesson is not that an aerospace framework transfers unchanged to ships. It is that transitions deserve specification and evidence in their own right.

Recovery needs its own evidence contract

Air and sea therefore point toward the same testable concept: a recovery contract. It is not a universal rule for what an autonomous system must do. It is a record of the conditions under which authority was reduced, which protective modes remain qualified, what evidence would support a wider role, and who is responsible for the transition.

Four questions make that contract concrete. First, what failed or became uncertain? Second, what changed in the environment while the system was restricted? Third, which assumptions behind the preferred recovery mode are still valid? Fourth, what evidence is required before automation expands again?

Those questions also prevent a common design error: treating recovery as the inverse of shutdown. It is not. A restriction can happen because one condition crossed a threshold. Restoration may require several conditions to be re-established, including information the system did not need when it first entered the mission. The state reached after a fault is not necessarily the state that existed before it.

Test the false recovery, not only the failure

A useful evaluation therefore includes more than complete failure. It includes deceptive recovery: a navigation signal that returns briefly, a sensor that produces plausible data before drifting again, a communications path that reconnects while the remote team and onboard system hold different pictures of who is in control.

The test should make the transition observable. Can operators tell which functions remain restricted? Does the system re-check the current environment before expanding its role? Does a temporary improvement trigger repeated mode changes? Can the event record reconstruct who or what held authority at each point and why? A final arrival at the destination is not enough if the route there included an unexplained or unsafe handover.

Civilian protection is part of this problem, especially for weapon systems operating near populated areas. The ICRC’s position on autonomous weapons emphasizes limits on duration, geographic scope, situations of use and human-machine interaction. Those recommendations are not a description of binding law for every state. They do illustrate why an exit from a mission cannot be assessed only by whether the original action stopped. The platform’s next behavior can create a different risk.

The overlooked capability is coming back safely

Autonomy discussions often focus on the moment a machine receives permission to act. That is only half of the authority lifecycle. Real systems will lose confidence, enter degraded modes, hand control to people or simpler controllers, and later seek to regain capability. The quality of those transitions determines whether a local fault remains local.

The most credible systems will not be the ones that promise uninterrupted autonomy. They will be the ones that make degraded authority understandable, preserve safe options while the evidence is weak, and demonstrate what has to be true before more freedom returns.

The world keeps moving while the machine is uncertain. Recovery has to catch up with the world before authority catches up with the machine.