Surrender is protected by law. That protection depends on a system's ability to stop in time.
The right to surrender is not new. Under Article 41 of Additional Protocol I, anyone hors de combat — including a person attempting to surrender — cannot be lawfully attacked. This is settled law, not a proposal.
But that right rests on a silent assumption: that once surrender is communicated, someone — or something — can actually stop in time. As long as a human operator makes the firing decision, this assumption usually holds. Human reaction time, however imperfect, provides the bridge between recognition and restraint.
Autonomous systems can break that bridge. When a machine's decision cycle outpaces human reaction time, surrender can be perfectly recognized and still be irrelevant — because no intervention arrives before the outcome is fixed. The failure is not one of recognition. It is one of arrestability: the system's structural capacity to be stopped within a human-relevant window of time.
This reframes the problem. Recognition is a necessary but secondary condition; arrestability is the precondition that gives recognition any legal weight at all. And this obligation is not something Human Flag is asking states to invent. Machine safety law already requires it — see ISO 13855 on minimum safety distances relative to approach speed, adopted or mirrored across most major regulatory systems: directly in the EU (EN ISO 13855) and Switzerland (SN EN ISO 13855); through equivalent operator-protection duties in the United States (OSHA, 29 CFR § 1910.212); as binding law in the Eurasian Economic Union, covering Russia and its member states (Technical Regulation TR CU 010/2011, which mandates emergency-stop means wherever they can reduce danger); through identical national adoption of the underlying ISO/IEC standards in China (GB/T 15706, GB 5226.1, GB/T 16855.1); and through the same guarding tradition, carried forward via adopted IEC/ISO standards, in Israel (Work Safety Ordinance 5730-1970). International humanitarian law already presupposes the same protective structure, in Articles 41, 57, and 36 AP I. What is missing is not a new rule in any of these systems, but the recognition that an existing one applies here.