Rheinmetall and NATO 2026 — Kubilius’ Article 5 Warning Makes Europe’s Red Lines Visible

On October 1, EU Defense Commissioner Andrius Kubilius stated that a Russian attack on a European arms factory could trigger a military response from NATO. Two days later, NATO Secretary General Mark Rutte warned that Russia is already testing Europe everywhere, without currently conducting a direct military attack on the alliance. Together, these statements present an uncomfortable diagnosis: Europe is beginning to treat its production facilities as part of the defense front, but still lacks commonly understood rules for when an attack on this front reaches the threshold for invoking the alliance.

The Factory is Now a Strategic Target

The political background is clear. Germany, Poland, France, and other NATO states want to expand their ammunition and vehicle production to support Ukraine and replenish their own stocks. Rheinmetall exemplifies this new European arms economy. Production halls, powder plants, testing centers, and logistics hubs are no longer ordinary industrial facilities. They form the material basis of deterrence.

That is precisely why they are vulnerable. The Ukrainian military intelligence service HUR warned on October 2 of planned Russian sabotage operations in EU and NATO states. According to the published warnings, potential targets include not only military facilities but also critical infrastructure, arms logistics, and companies that support Ukraine. This is initially an intelligence warning, not proof of an impending attack. Nevertheless, it is strategically relevant: Moscow may be able to disrupt Europe’s support at a lower cost and below the threshold of open war.

Article 5 is Not an Automatic Switch

Kubilius’ statement carries political weight, but legally it is less clear-cut than its headline suggests. Article 5 obligates allies to support an attacked member, but it does not prescribe a specific military response or an automatic declaration of war. Each case remains a political decision of the alliance states. In the event of a missile attack on a factory, the attribution of the perpetrator might be relatively clear. However, in the case of a fire, a cyberattack, a manipulated supply chain, or a sabotage act carried out by proxies, it would not be.

This is the institutional gap. NATO has plans for a large armed attack, but most Russian operations in Europe are currently not in this realm. Rutte aptly described the situation as ongoing testing. The question is not only whether Russia will attack, but how much uncertainty it can create before the alliance acts collectively. Deterrence fails in the gray area not primarily due to a lack of tanks, but due to unclear decision thresholds.

Europe’s Arms Boom Intensifies the Dilemma

Increased production is militarily necessary, but it also makes Europe more visible and vulnerable in the short term. An ammunition plant cannot be duplicated at will. Specialty chemicals, propellant powders, testing facilities, and qualified labor are concentrated in a few locations. If a single bottleneck fails, not only does national supply capability decline. Multiple armed forces, joint NATO missions, and the supply to Ukraine are affected.

This creates a contradiction that European politics has so far primarily addressed financially. EU loans, national special programs, and long-term orders increase demand. However, they do not create redundancy, uniform protection standards, or shared responsibility for securing the facilities. Money can build a factory; it does not decide who protects it in a crisis, who publicly attributes a sabotage act, and who releases the political response.

Germany is particularly revealing in this regard. Berlin wants to strengthen the industrial base of the Bundeswehr and expand European cooperation. However, the responsibility for factory security, cyber defense, and crisis communication largely remains national. An attack on a German site would militarily be an attack on the entire European aid to Ukraine, but institutionally it would initially be a German security event. This discrepancy between strategic importance and national responsibility invites political delay.

What NATO and the EU Need to Clarify Now

1. Joint Attribution: NATO and the EU need a coordinated procedure that quickly switches between police, intelligence, and alliance levels after sabotage, cyberattacks, and proxy attacks.
2. Protection of Critical Arms Locations: Factory security must not be limited to private security services and national individual plans. Air defense, drone defense, cyber resilience, and backup capacities must be included in defense planning.
3. Political Thresholds: Allies must define before a crisis what combination of evidence, damage, and repetition justifies a joint military response. Otherwise, each government will wait for the reaction of the others.

Kubilius’ warning is therefore less a finished NATO doctrine than a political wake-up call. It aims to deter Moscow from viewing European arms production as a risk-free target below the threshold of alliance invocation. Its weakness lies in the fact that a red line only deters if adversaries and allies know who draws it.

Europe’s New Front is Industrial, but Not Institutional

Europe has learned that defense capability depends on production capacity. It must now learn that production capacity itself must be defended. Rutte describes Russian activities as tests; Kubilius responds with the threat of a NATO reaction. However, between these two statements, there is still a lack of a robust institutional bridge.

The paradoxical situation is therefore: The faster Europe expands its arms industry, the more strategic targets it creates. Without common protection and response rules, the European rearmament plan will not serve as deterrence but as an invitation for calculated gray zone operations. Those who declare the factory as the front must also clarify who gives the order at the moment of the first attack.

Sources

• Politico Europe, October 1, 2026, report on Kubilius’ warning regarding a possible NATO military deployment.
• Ukrinform, October 2, 2026, report on Mark Rutte’s assessment of Russian tests in Europe.
• Kyiv Independent, October 2, 2026, report on the HUR warning of increased Russian hybrid operations.
• Reuters, September 23, 2026, analysis of the increasing Russian sabotage threat.