Ready Without Being Active: Why Reopening Ukrainian Airspace Needs a Trigger-Based, Not an Immediate, Architecture

Anna Tsirat, Doctor of Laws | JVS Law

In July 2026 Russia fired a record 376 missiles at Ukraine — the highest monthly total since the start of the full-scale invasion, and more than double the June figure. Of those, 195 followed a ballistic trajectory, and Ukrainian air defence intercepted 29 — roughly 15 %. Against drones the picture is different: over the same month air defence destroyed or suppressed 5,142 of them. The reason for the gap is neither disputed nor concealed — a critical shortage of interceptors, particularly the PAC-3 rounds for Patriot batteries, which remain the only reliable countermeasure against a ballistic threat.

These figures matter less as a statement about the war and more because they reframe the question that reopening Ukrainian civil aviation actually turns on. In a previous article in this series, we argued that the real question is not when the skies reopen, but under what conditions war risk becomes acceptable to the international insurance market — and that acceptability depends first on whether risk can be digitally verified: audit trail, immutable logging, rapid data retrieval for insurers. That conclusion still holds. It is a necessary condition. It is not a sufficient one.

Verifiability answers whether an underwriter can be shown that the system works. It does not answer the question that follows immediately after: who carries the residual financial risk once verification is established, and under what circumstances that exposure shifts from the private market to the state. That second layer of the architecture is the subject of this article.

One temptation raised by the interception figures above is worth naming and setting aside at the outset: treating the absence of a functioning ballistic shield as a decisive argument against doing any preparatory work now, before that shield exists. The remainder of this article explains why that inference does not hold. A shortage of interceptors is an argument against immediate capitalisation and against flying now. It is not an argument against having the legal and institutional architecture ready to activate quickly once conditions permit.

On 13 March 2026 Ukraine’s Ministry for Communities and Territories Development issued Order No. 511, establishing a working group to prepare for the restoration of airport operations, published three days later. The group is chaired by a deputy minister and draws its members from the Ministry of Defence, the Air Force, the State Aviation Administration, the State Emergency Service, the Security Service, the State Agency for Restoration and the management of Ukraine’s principal airports. An order of this kind is an internal act of a ministry rather than a normative-legal act subject to state registration with the Ministry of Justice: it organises the ministry’s own work, but it does not by itself create a subject of responsibility, does not establish a binding model of risk allocation, and cannot be integrated into international insurance or financing frameworks.

The position has not since been clarified; it has become more complicated. By Cabinet of Ministers Resolution No. 963 of 17 July 2026, the ministry that created the working group was reorganised: it was renamed the Ministry of Restoration, Infrastructure and Transport, a separate Ministry for Communities, Territories and Internally Displaced Persons was created alongside it, and functions were redistributed between the two. Four months after the order was signed, the body behind it carried a different name and a different remit. The order itself survives the change — it is still published on the successor ministry’s site — but what becomes of the working group, and of the wider interagency coordination structure meant to serve as the institutional centre of the reopening effort, has not been made public.

This is not a footnote in the administrative record. It illustrates a structural vulnerability with direct consequences for how any restart mechanism should be designed. Any institution tied to a specific ministry, or created by a single agency’s order without an independent statutory basis, inherits the full political risk of that ministry — reorganisation, renaming, redistribution of functions, a change of priorities under new leadership. For an international lessor or reinsurer weighing whether to return an asset or capacity to Ukraine on a multi-year horizon, that vulnerability reads unambiguously: even once a mechanism is designed, there is no assurance that the body meant to administer it will still hold the same mandate by the time activation conditions are met.

The implication is stronger than a point about administrative convenience. An activation mechanism needs to sit with an institution that has procedural and functional continuity, not with an ad hoc interagency structure subordinate to a single ministry. Ukraine’s State Aviation Administration meets that requirement by design. It is the sector’s dedicated regulator, its authority derives from civil aviation legislation rather than from a single ministerial order, and it does not lose its mandate each time the government reorganises — unlike coordinating bodies created for a particular political moment.

The point generalises beyond aviation. A mechanism resting on a structure that can be renamed, redrawn or absorbed along with the ministry that created it cannot, by definition, be “ready but not yet active” in the sense this article argues for — it risks being unrecognisable by the time the conditions for activation finally arrive. Anchoring the mechanism to the State Aviation Administration is therefore not an administrative preference. It is part of the risk-management design itself, on the same footing as the financial architecture discussed further below.

Discussion of the dangers of reopening Ukrainian airspace tends to begin with MH17, and understandably so — the 2014 tragedy shaped the modern international framework for assessing conflict-zone risk. But using MH17 as a general shorthand for danger obscures a distinction that matters for how a restart mechanism should be designed: the risk to an aircraft in flight over a conflict zone and the risk to ground infrastructure at an airport are not one risk in two forms. They are structurally different risks, with different mitigation tools, different data sources for assessment, and different answers to the question of when each becomes acceptable.

En-route risk — the type that materialised in both MH17 and PS752 — concerns an aircraft in flight over territory where air-defence or anti-aircraft systems pose a threat. It is addressed by tools already in active use: route closure through NOTAM, an EASA Conflict Zone Information Bulletin — the mechanism set out in detail in our previous article on the status of Ukrainian airspace — and, for the carrier, a documented threat-assessment procedure ahead of each departure, discussed below by reference to the case against Ukraine International Airlines.

Terminal risk — the risk actually at stake in any Ukrainian reopening scenario — is different in kind. It is the threat to airport ground infrastructure from a ballistic strike while an aircraft is parked, taking off or landing. It cannot be resolved by closing a route, because the aircraft is not in flight over a conflict zone; it is physically present at a specific location on the ground that is, or is not, exposed to ballistic threat. This is a risk of geographic location rather than flight trajectory, which is why the choice of airport is not a logistical detail but the central variable in the entire architecture.

This bears on the choice of Lviv as the pilot location. The case for it was never purely symbolic — proximity to the Polish border supports evacuation routing and logistical integration with the European network — but the geographic argument is corroborated independently by the market itself. Insurers active in Ukrainian war-risk cover consistently identify Kyiv and Odesa as the highest-concentration regions, where accumulated insured exposure is largest and where cover is already being declined on locational limits. Lviv does not appear on that list. This is not a guarantee — no location in Ukraine has acquired formal immunity from ballistic strikes, and none is claimed here — but it is a convergence of two independent assessments reached from different starting points: the strategic-legal one (border proximity, logistical role) and the purely actuarial one (where the market already sees realised loss accumulating).

The practical consequence for the mechanism’s design is that activation thresholds cannot be uniform across the country. A condition sufficient for Lviv will remain premature for Kyiv or Odesa, and requiring nationwide risk reduction to the level tolerable for the highest-risk regions would delay reopening unjustifiably where risk is already structurally lower. The mechanism needs to be calibrated by location, not by country.

One of the most common objections to any state role in aviation war-risk insurance runs as follows: the state already faces enormous outlays to rebuild energy infrastructure, and nothing will be left for aviation. The objection is intuitively persuasive, but it conflates two distinct budgetary categories, and the distinction carries legal, not merely accounting, consequences for how the mechanism should be designed.

Direct funding — capital expenditure — is money the state spends now, regardless of whether an insured event ever occurs. That describes spending on restoring generation capacity or hardening substations: funds are allocated and spent today, against a defined physical outcome. A state guarantee is a different instrument in kind. It is not a budgetary outlay at the moment it is given; it becomes an outlay only when an insured event occurs, and only to the extent of the loss actually realised. Until then, it exists as a contingent obligation — legally real, financially dormant.

This is not an abstract distinction, and it is worth being precise about the instrument rather than collapsing it into “a state guarantee” as such. In a previous article in this series, we examined the Unity Facility — rolled out in November 2023 and presented publicly in January 2024 by Marsh McLennan together with the Ukrainian government, the Export Credit Agency of Ukraine, Ukreximbank, Ukrgasbank and DZ Bank, with cover underwritten at Lloyd’s, to insure war risk for vessels carrying Ukrainian grain through the Black Sea; in March 2024 it was extended to all non-military cargo. What the reinsurance market actually engaged with was not a direct sovereign guarantee but standby letters of credit issued by the two Ukrainian state banks and confirmed by DZ Bank, together forming a first-loss compensation fund, with the facility itself backed by Ukraine’s Ministry of Economy. A state guarantee sits behind the mechanism, but not on its face: it is the legal basis on which the state banks are able to issue the instrument at all, while the reinsurance market transacts directly against the confirmed banking instrument rather than against a sovereign obligation as such.

The distinction has practical, not merely terminological, consequences, and this is where a reinsurer’s or lessor’s counsel will focus attention. A direct sovereign guarantee, from the perspective of an international reinsurer, is an obligation of a state at war, whose performance depends on political will, fiscal capacity and, ultimately, on questions of sovereign immunity in the event of a dispute — enforcement against a sovereign, even under a governing-law and jurisdiction clause, remains materially harder to predict than enforcement against a confirming bank. A standby letter of credit confirmed by a recognised European bank is a banking instrument with a standardised, well-understood drawdown procedure that the market already knows how to price and, if necessary, litigate; it rests on the state guarantee at its foundation without presenting that guarantee to the market directly. This does not bear on the capex-versus-contingent-liability point made above — both instruments remain contingent — but it bears on which legal form that contingent obligation should take to be acceptable to the London market. The result is measurable, not declarative: war-risk premiums for vessels operating within the facility fell from roughly 3 % of cargo value to below 1 %.

This answers the structure of the objection, but only in part. A contingent obligation of this kind does not compete with energy-sector funding for the same budget line — it is not an outlay but an obligation conditional on an event — and its mere existence, on the Unity precedent, can materially lower the cost of cover the private market would otherwise decline to offer. But that does not mean the state is politically prepared to assume even a contingent obligation for aviation war risk at the current level of air-defence coverage. The more accurate formulation is this: the reason for reluctance is not a lack of fiscal space but a lack of risk appetite at the current frequency-severity profile of potential losses. That is a different claim, and a more useful legal one, because it points to a concrete, measurable question — at what interception rate for ballistic targets, or what frequency of strikes on critical infrastructure, that risk appetite would change. That question is the subject of the activation thresholds addressed below.

It is also worth stating plainly where the Unity analogy stops holding, rather than eliding it. Maritime and aviation risk differ in frequency and severity: Unity addresses a high-frequency, comparatively lower-severity risk at the lower layer of cover through a combination of confirmed letters of credit and private capital, whereas the aviation proposal positions the state at the catastrophic, upper layer, because losses from an aircraft being struck are low-frequency but severe. As our earlier article on digital trust and insurability sets out, the Unity model itself only functions where risk is identified, structured and verifiable — in the maritime sector this is achieved through route and zone control, which is not sufficient for aviation absent a digital evidentiary base. A direct transplant of the maritime model into aviation is not possible; what can be transplanted is its financial logic — contingent rather than capital state participation — adapted to a different risk profile.

The question of whether passengers will fly, after years of closed skies and against a backdrop of active strikes, is usually framed as a matter of trust or psychological readiness. That is a fair concern, but it obscures a sharper legal question that bears directly on how a restart mechanism should be designed: whether a carrier has a formalised, auditable procedure for the go/no-go decision, and what happens to the carrier if it does not — an exposure question that falls within the scope of our Legal Opinions & Expert Witness practice.

That question has already been answered in litigation, albeit in a Canadian court. As set out in our analysis of the PS752 case, the Ontario Superior Court in S. v. Ukraine International Airlines (June 2024) found that UIA had failed to prove the absence of negligence: the airline had not conducted an adequate threat assessment amid escalating US–Iran tensions, had not decided to suspend or reroute the flight, and its relevant departments had not received timely updates on the threat from partners or aviation regulators. The consequence was that UIA lost the benefit of the Montreal Convention’s limitation of liability — the current first-tier cap stands at 151,880 SDR — and became liable without limit for the consequences of the crash. UIA entered bankruptcy proceedings in November 2023, before the judgment was even handed down, and its most valuable assets had already been sold by the time the ruling was issued.

This is not a finding about moral fault — the court assessed specific procedural gaps, not intent — but about a structure of risk that any restart model needs to account for. Unlimited liability does not attach because a disaster occurs; it attaches because the carrier cannot show that the decision to fly was taken on the basis of a documented, good-faith assessment of the threat information available. Put differently, the carrier’s exposure is not the risk that something happens — it is the risk that something happens and the decision procedure behind it cannot be proven.

This connects directly to the thesis of our earlier article on IT contracts and evidentiary infrastructure: a digital audit trail, immutable logging and a documented decision procedure are not only what an insurer needs to recognise a claim. They are what allow a carrier to invoke the Montreal Convention’s liability cap in the first place, rather than repeat UIA’s fate. Any restart architecture confined to airport and aircraft insurance leaves untouched the exact channel of risk that destroyed Ukraine’s previous flag carrier — the decision procedure at the level of the airline itself.

On passenger demand specifically, the evidence cuts against both undue pessimism and undue optimism. Israel’s experience during the direct ballistic exchange with Iran in June 2025 showed that willingness to fly under threat is not a constant: the national carrier continued operating, and demand proved robust enough that the regulator subsequently examined wartime price-gouging. But that is a case of continuity, not restart — Israel never fully suspended flights, and the psychological threshold for resuming flights after a multi-year closure differs materially from that for continuing them through a new phase of escalation. No forecast for Ukrainian demand follows from this in either direction; what follows is that passenger willingness is contingent on the specific circumstances of resumption, and should not carry the argument alone, in either direction, for the mechanism this article proposes.

Each of the preceding sections answers a distinct objection on its own terms: institutional instability is addressed by anchoring the mechanism to the State Aviation Administration rather than an ad hoc body; the financial character of state participation is clarified by distinguishing a contingent obligation from capital expenditure; the geography of risk is addressed by calibrating thresholds by location rather than by country; carrier liability is addressed by a digital evidentiary basis for the flight decision. These answers combine into a single design principle: the mechanism is built and legally anchored now, but its actual activation and capitalisation are tied to predefined, measurable thresholds rather than to a political decision or a subjective reading of the moment.

The legal and institutional work that can and should be done now, without waiting for the air-defence picture to change — the kind of structuring work that falls within our Aviation & Asset Finance practice — has three components. First, extending the statutory mandate of Ukraine’s Export Credit Agency to aviation hull war risk. The agency already holds an NBU insurance licence, already operates in war-risk classes, and participated in launching the Unity Facility — making it a functional analogue of Israel’s Inbal, lacking only a formal extension of mandate rather than institutional capacity built from scratch. Second, capitalisation through a structure analogous to the confirmed standby letters of credit discussed above, with a state guarantee as the legal basis for that instrument rather than the form presented directly to the reinsurance market. This is the same configuration already proven acceptable to the London market in the maritime sector, and there is no obvious reason it could not be replicated for an aviation mechanism at the upper, catastrophic layer of cover, provided the Export Credit Agency or authorised state banks secure an equivalent confirmation from a European partner bank. Third, a formalised rapid-activation procedure — an algorithm for moving the mechanism from standby to active status that is drafted in advance rather than improvised in a crisis.

Activation thresholds should be external, measurable and publicly verifiable — the output of applying a pre-agreed criterion to available data, not the product of a closed political decision. Candidates include: the interception rate for ballistic targets over a defined observation window; the absence of direct strikes on airport infrastructure at a given location over a defined period; a formal risk reassessment by ICAO, or an updated EASA Conflict Zone Information Bulletin, for a specific route or airport. Critically, these thresholds need to be calibrated by location rather than nationally — a condition sufficient for Lviv may remain out of reach for Kyiv or Odesa long after the Lviv segment is already active.

This architecture resolves three objections that appear, at first glance, intractable. The state does not need to commit resources now, because the obligation remains contingent until the thresholds are met. Silence or institutional instability on the part of the relevant bodies stops being a sign that the project has failed and becomes confirmation that the mechanism is functioning as designed — ready, but not activated, until external conditions are satisfied. And the carrier-level risk discussed above receives a structural answer: the digital evidentiary base that is already a precondition for insurability, as our earlier article in this series argues, is also the instrument that verifies whether the activation thresholds themselves have been met — the same audit trail that protects a carrier in court can record and publicly evidence when a threshold has been crossed.

The silence of the institutions with which this conversation began, and the uncertainty surrounding their future, is not an argument against the architecture set out in this article — it is indirect confirmation of it. A mechanism built on external, measurable thresholds and anchored to an institution with procedural continuity does not need a specific ministry or coordinating body to survive untouched in order to remain valid. It needs only the legal work — extending the Export Credit Agency’s mandate, structuring confirmed letters of credit, formalising the activation procedure, building the digital evidentiary base for carriers and airports — to be done in advance, regardless of the pace or direction of the institutional change surrounding it.

None of this understates the difficulty of the present moment. The interceptor shortage described at the outset is real, and probably the single most significant constraint determining when the activation thresholds can actually be met for any given airport. But the question of when and the question of whether the architecture is ready are different questions, and conflating them produces the mistaken conclusion that the absence of ballistic defence makes any preparatory work premature. The opposite is closer to the truth: precisely because the moment of activation is unpredictable and likely to arrive unevenly across locations, legal readiness needs to precede it rather than follow it.

A detailed architecture for the Lviv pilot scenario — distinguishing the high-frequency, comparatively lower-severity risk to ground infrastructure from drones and debris from the low-frequency, catastrophic risk to an aircraft in flight — will be the subject of the next article in this series.