Symposium on PMSCs: Playing Regulatory Catch-up – PM(S)Cs and the New Draft Instrument

[Dr Sarah Katharina Stein, LL.M. (Columbia) is a postdoctoral researcher at the Max Planck Institute for the Study of Crime, Security and Law in Freiburg, Germany. She holds a PhD focussing on public international law and PMSCs from Ludwigs-Maximilans-University Munich.]

Private Military and Security Companies (PMSCs) have been part of the global security architecture for some while now, however, they still outpace the development of robust legal and regulatory frameworks. Privatizing former state functions without the parallel creation of regulation leaves significant governance gaps and is part of the bigger trend of democratic backsliding where states systematically weaken checks on executive power, and allow for the selective application of legal standards. Thus, it seems that the International Regulatory Framework on the Regulation, Monitoring of and Oversight over the Activities of Private Military and Security Companies (Draft) under elaboration by the open-ended Inter Governmental Working Group (OEIGWG) is a positive first step in catching up regulatory efforts to state practice. However, even this well-intentioned draft instrument fails to adequately address the threat that the privatization of military functions poses to the state’s monopoly on the use of force.

The Draft as well as the OEIGWG address private military and security companies as a whole, capturing the broad spectrum of functions and activities that can be outsourced in peacetime and during armed conflict. Typically, companies provide a wide range of services, including, but not limited to “relief, recovery, and reconstruction efforts, commercial business operations, diplomacy and military activity”. Clear distinctions between companies which focus on civil aspects and those who are offering services related to combat can hardly been drawn, because numerous firms are full-service providers or offer “holistic security consulting”. Thus, a distinction on behalf of the services rendered must be made while determining individual status under IHL as well as ICL and the applicable national law. However, while drafting regulation which extend beyond individual status, a distinction can hardly be made and is also not attempted by the OEIGWG. This poses as a first point of friction in the Draft, as the regulatory necessities and needs of companies providing facilities support in peacetime, a typical PMSC service, and companies providing military training and combat services are starkly different. This is already mirrored by the different cited conventions in the Drafts preamble, including, inter alia, labor regulations as well the Geneva Conventions.

My analysis focuses on private military contractors (PMCs) and their use in armed conflict, a part of the ongoing trend to outsource former state functions which poses the gravest risks to human rights, the rule of law and the monopoly on the use of force.

Ahead of Legislation

To date, the status of PMCs in combat under international law remains at least ambiguous: they do not meet the strict definition of mercenaries, and are generally not considered members of state armed forces. Arguably, states utilize PMCs precisely for their flexibility, lack of accountability, and operational deniability, traits fundamentally incompatible with formal military integration. Where the deployment of military creates path dependencies as parliamentary oversight, transparency requirements and public scrutiny, PMCs can be employed in secret, without comparable control and knowledge of the people. Hence, incorporating PMCs into state armed forces would negate the very advantages driving their selection over traditional forces.

Meanwhile, self-regulation initiatives, while mostly well-intentioned, have proven largely ineffective: lacking binding authority and meaningful repercussions, they fail to compel either companies or states to act responsibly. Fundamentally, the functionality and effectiveness of self-regulation relies solely on its incentive effect and the voluntary participation that depends on it. Most importantly: self-regulation can principally just bind those who are willing to be bound. The individual voluntary certification under a self-regulatory regime renders no effect on entities who offer services to clients who either do not care about oversight, control and the rule of law or employ those providers exactly because they want to circumvent these restraints. These entities are not changing their behaviour because others, who operate on a different playing field, subjugate themselves to some kind of standard. Unlike real law, self-regulation can never reach those who are unwilling to comply. Yet these are precisely the actors whose behaviour makes regulation and adherence to rules particularly necessary.

Under IHL, PMCs are civilians engaging in hostilities, neither protected nor privileged. Simultaneously, this means they are not part of military oversight or chains of responsibility as needed for combatants according to Art. 4(A) II GCIII. Establishing accountability is less straight forward and primarily falls to the territorial state, which is usually involved in an armed conflict and after all has limited capacity to gather evidence and conduct legal investigations. Thus, private military providers engaging in combat fall through the gap created by the distinctive regulatory efforts and real-life obstacles of actual implementation of legal standards.

The Road to Hell is Paved with Good Intentions

Trying to regulate private actors engaging in combat is not new endeavor. Already in 1987, the Special Rapporteur on the use of mercenaries was appointed, later succeeded by the Working Group on the use of mercenaries as a means of violating human rights and impeding the exercise of the rights of peoples to self-determination in 2005. As early as 2010 it was attempted to draft a regulatory instrument for PMSCs, but disagreements – especially over whether rules should be binding – led to deadlock. In the wake of these debates, the Human Rights Council decided in 2010 to create a new open-ended working group with a mandate to consider the elaboration of an international regulatory framework, including the possibility of a legally binding instrument, but consensus on the legal nature remained elusive as major powers like the US and UK continued to resist binding rules and favored voluntary or self-regulation. Despite ongoing efforts, including the establishment of the OEIGWG in 2017 and repeated mandate renewals in 2020 and 2023, regulatory progress has been slow. Frameworks like the Montreux Document are being widely endorsed and a non-binding, more industry-friendly status quo is maintained. This shows that state consensus on the issue is tricky, even with multiple and institutionally backed up ventures.

Two Predicaments

The most recent draft, negotiated during the sixth session in April 2025, marks a substantial advance in regulating PM(S)Cs, but has no conclusion to the legal nature of a potential instrument. It seems that a binding treaty is still out of reach, as explicitly expressed by key states like UK, US and Saudi Arabia. Any progress content-wise has thus to be taken with a grain of salt. I want to highlight two predicaments of the Draft.

The first predicament regards the content of the regulation. The current Draft introduces stronger and more specific requirements for national licensing and registration systems. These include mandatory adoption of internal codes of conduct (an homage to self-regulation), human rights due diligence, and transparent ownership and contract disclosure. The Draft also mandates operational transparency, and requires states to establish national contact points to facilitate cross border cooperation and enhance accountability. Furthermore, it strengthens victim access to justice by requiring states to provide accessible, transparent, and rights compatible grievance procedures. These provisions represent a marked improvement over the first Draft from 2010, and would enhance the status quo massively, though the Draft still falls short of the rigorous oversight applied to regular armed forces. Thus, the difference in oversight, control, transparency and accountability between PMCs and soldiers is still substantial enough that clients who want to engage PMCs specifically to circumvent these mechanisms are still inclined to use them. The accountability gap is still very much in existence – subsequently, human rights are still more vulnerable by employment of PMCs than deployment of the armed forces.

Here comes the dilemma: some clients employ PMSCs precisely because, unlike regular soldiers, these entities operate outside the bounds of strict political oversight, transparency obligations, and formal responsibilities. The wider the legal, political, and symbolic distinctions between military personnel and PMCs, the more attractive these companies become as a tool for states seeking flexibility and deniability. However, introducing meaningful regulation to close this gap would undermine the very incentives currently driving state endorsement for the continued use of PMCs – and, consequently, for acquiescence to any treaty that might impose such restrictions. The stronger the regulation will get, the closer the accountability gap between soldiers and PMCs narrows, the more unlikely it is that a binding treaty will find support.

The second predicament involves the monopoly on the use of force. Any effort to regulate PMSCs (whether through self-regulation or binding instruments) legitimizes the use of PMSCs for all actors, states and non-state actors as extractive industry companies, warlords or international organizations alike, by normalizing the existence of ‘private armies’, simultaneously undermining the foundational principle that the monopoly on the use of force belongs to the state. 

Privatization without adequate regulation does not merely outsource the exercise of state power, it surrenders control over it. This dynamic catalyses the emergence of a parallel private authority, distancing critical security functions from democratic oversight and accountability. As PMCs expand their influence, they absorb domains traditionally reserved for the state, effectively wielding public authority while operating under market principles: efficiency, competition, and profit. This commercial framing fundamentally misunderstands the nature of the monopoly on the use of force: military power cannot serve private interests without corrupting itself. By privatizing force, states relinquish sovereign control, placing PMCs on a normative continuum with non-state armed groups. In practice, this erodes the distinction between state-sanctioned force and non-state violence, revealing a troubling proximity between PMCs and other non-state actors. Ultimately, privatization dismantles the state’s monopoly on the use of force, voiding its foundational contract: the provision of security as the basis of its legitimacy.

One way to ease the challenge to the monopoly on the use of force would be to prohibit the privatisation of functions that are inherently the responsibility of the state. Earlier drafts even used the language of inherent state functions, which is now replaced by a definition of “prohibited activities”. According to § 2 (e), the object of the instrument is to “[urge to] prohibit PMSCs […] in view of the State monopoly on the use of force, from engaging in [prohibited activities].” Prohibited activities are defined in § 1 (f), whose content was source of a lot of debates. According to the current text, which is still not agreed upon,

‘Prohibited Activities’ are activities that a State cannot outsource to PMSCs under any circumstance, including but not limited to, conducting and engaging in combat operations, taking prisoners and the interrogation of detainees or otherwise involving the treatment of persons deprived of liberty, law making, the use of, and other activities relating to, weapons of mass destruction and any activity that IHL explicitly assigns to a State agent or authority or that would result in their participation in acts of aggression or other activities prohibited under the United Nations Charter.

If this paragraph should stand and be included into a binding treaty, which subsequently would be ratified and adhered to by most states, this would alter the current state of armed conflict, where presently PMCs have already and continue to fulfil exactly these so called inherent state functions like combat participation or detention.

However, all the “ifs” must come together and a consensus on the highly debated question of what constitutes participating in hostilities is necessary to ease the pressure on the monopoly on the use of force and, subsequently, sovereignty. This is, unfortunately, highly unlikely as previously discussed and stated by key host states of PMCs.

Sisyphean Task

All in all, PMSCs and their patrons have the distinct advantage of being already established. At present, PMSCs seem to be a permanent fixture, making regaining sole state authority on all outsourced services unrealistic. Regulators have to fight against the status quo of quasi-unlimited freedom in the use of PMCs in and around the battlefield, a steep uphill, and ultimately Sisyphean fight.

The dilemma of regulating private armed forces predates current regulatory efforts by decades. In 1977, the narrow definition of mercenaries was incorporated into Art. 47 API and subsequent international treaties, enabling the rise of unregulated private military actors. The attempt to define and stigmatize guns-for-hire ultimately failed, since the restrictive criteria allowed everyone, including private military companies, to structure their operations precisely to circumvent the definition. In practice, although PMCs are functionally equivalent to mercenaries, no concerted effort is made to hold them to the mercenary standard – even as the term is casually invoked. Thus, PMCs shared the stigma of mercenaries, but not their legal treatment. The entire problem awareness surrounding the danger to the monopoly on the use of force through private actors is concentrated behind the mercenary polemic. There is no spillover of the integral questions of legality and legitimacy at large into the PMSCs debate.

Now, the regulatory efforts of the OEIGWG find themselves trapped between conflicting aims: on the one hand, to regulate and thereby tacitly recognize the legitimacy of private actors in roles of state authority to gain wide participation, and on the other, to refuse such recognition but also to avoid the possibility of a binding nature for other meaningful regulation. An optimistic avenue for the future might to untangle P(M)SC and PMC regulation, drafting two instruments which can specifically focus on their regulatory aims and problems. Thus, at least a consensus to regulate private security providers outside of armed conflict might be achieved, whereas the regulation – or even prohibition – of combat functions appears unattainable to date.