Framework Convention on Artificial Intelligence, Human Rights and Democracy

· About Framework Convention on Artificial Intelligence, Human Rights and Democracy

Key Takeaways

  • The Council of Europe Framework Convention on Artificial Intelligence, Human Rights, Democracy and the Rule of Law is a legally binding treaty for states and regional integration organizations that commit to governing AI across its lifecycle.[12][15]
  • The Convention was adopted by the Council of Europe Committee of Ministers on 17 May 2024 and opened for signature on 5 September 2024; it is not yet universally in force because entry requires five ratifications, including at least three Council of Europe member states.[2][8][15]
  • The European Union ratified the Convention in May 2026, becoming the first Party; the EU’s internal conclusion process advanced in 2026, but that does not by itself make the treaty binding on private companies unless implemented through applicable EU or national law.[3][1]
  • The treaty applies to public authorities and to private actors where parties choose to extend measures to the private sector; it is designed to address AI risks affecting human rights, democracy, and the rule of law rather than impose a single product-certification regime.[12][15]
  • Parties must adopt risk-based measures across the AI lifecycle, including impact assessment, transparency, accountability, human oversight, and remedies; the Convention also establishes follow-up and cooperation through a Conference of the Parties.[2][3][14]
  • As of October 2026, there is no evidence in the cited official sources of a 2025–2026 amendment to the Convention text itself, but there has been meaningful implementation movement, including EU ratification and continued signature growth.[3][1][7]

What It Is

The Framework Convention on Artificial Intelligence, Human Rights, Democracy and the Rule of Law is the Council of Europe’s first legally binding international instrument focused specifically on AI governance.[12][15] Its scope covers the life cycle of AI systems, with the stated purpose of ensuring that AI activities are consistent with human rights, democratic institutions, and the rule of law.[12][15]

The treaty was adopted on 17 May 2024 by the Council of Europe Committee of Ministers and opened for signature on 5 September 2024.[15][3] Official materials in 2026 describe it as the “first-ever international legally binding treaty in this field,” and the Council of Europe marked its second anniversary in September 2026.[3][4]

For entry into force, the Convention requires five ratifications, including at least three ratifications by Council of Europe member states.[2][8] The sources reviewed show that the EU ratified in May 2026, but they do not show that the treaty has yet reached the five-ratification threshold by 14 October 2026.[3][8]

Who Must Comply

The Convention is addressed primarily to States Parties and, where applicable, regional integration organizations such as the European Union.[12][15] It does not operate like a direct corporate law applicable everywhere on signature; instead, parties implement treaty obligations through domestic law, sector rules, procurement, supervision, and other public measures.[15]

Its reach is broad in subject matter because it covers AI systems used in both public and private contexts, but the exact obligations that bind private-sector developers and deployers depend on how each Party implements the treaty.[12][15] The Council of Europe says the treaty is open to non-European countries as well, which is why states such as Canada, Japan, the United States, and Uruguay signed in 2026.[3]

No treaty text cited here creates a universal company-size threshold comparable to GDPR turnover thresholds or the EU AI Act’s risk categories.[15] Instead, applicability turns on whether a Party has jurisdiction over the relevant AI activity and how it chooses to regulate public authorities, private organizations, or both.[15]

Core Requirements

  1. Risk-based governance across the AI lifecycle. Parties must regulate AI according to the risks it can create for human rights, democracy, and the rule of law, rather than treating all AI use as equally sensitive.[12][15]
  1. Protection of human rights and democratic values. Parties must ensure that AI does not undermine rights, democratic processes, or lawful institutions, and they must align implementation with existing human-rights standards.[12][15]
  1. Accountability and oversight. The treaty requires measures that ensure responsible use of AI, including oversight structures and accountability mechanisms for those developing or using AI systems.[12][15]
  1. Transparency and information duties. Parties must create measures that make AI use sufficiently transparent for affected persons and public authorities to understand material AI-driven decisions or interactions.[12][15]
  1. Impact assessment and risk mitigation. Parties are expected to assess and address AI-related harms before and during deployment, especially where systems may affect fundamental rights or democratic processes.[15]
  1. Remedies and redress. Parties must provide avenues to challenge harmful AI outcomes and seek effective remedies when AI use infringes protected interests.[15]
  1. International cooperation and follow-up. The treaty establishes ongoing cooperation mechanisms, including a Conference of the Parties, to monitor implementation and support consistent interpretation.[3][14]

Deadlines and Penalties

| milestone | date | what applies | |---|---:|---| | Adoption by Committee of Ministers | 17 May 2024 | Treaty text adopted by the Council of Europe.[15] | | Opening for signature | 5 September 2024 | States and organizations could sign the Convention.[3][15] | | EU ratification | 15 May 2026 | The EU deposited its instrument of ratification.[3][7] | | EU effect date | 1 September 2026 | Reported effective date for the EU after the ratification deposit.[7] | | Entry into force threshold | pending | The treaty enters only after five ratifications, including at least three by Council of Europe member states.[2][8] |

The cited sources do not provide a treaty-specific monetary fine schedule, because this is an international convention that is implemented by parties through domestic law.[15] Sanctions therefore depend on each Party’s implementing legislation and may include administrative enforcement, civil liability, procurement consequences, injunctions, or criminal penalties under national law, depending on jurisdiction.[15]

How to Comply

  1. Map AI use cases and owners. Build an inventory of AI systems, vendors, deployment contexts, data flows, and decision ownership so legal and security teams can see where rights-sensitive uses exist.
  1. Classify by rights impact. Use a risk model aligned to ISO 27001 controls for governance and information security, plus NIST CSF 2.0 for identify-protect-detect-respond-recover structure, to separate low-risk automation from high-impact use cases.
  1. Add lifecycle impact assessments. For each material AI system, document intended use, foreseeable misuse, affected rights, testing evidence, mitigation steps, and sign-off before deployment; this maps well to ISO 42001 AI management system requirements.
  1. Design human oversight. Ensure meaningful review, override, escalation, and incident response paths for decisions that affect rights, benefits, access, or democratic processes.
  1. Strengthen transparency and notice. Publish clear notices where AI is materially involved, document model limitations, and give internal users and affected persons understandable explanations where required.
  1. Contract for downstream control. Put in procurement and vendor terms the obligations to support audits, incident reporting, model changes, logging, and rights-impact cooperation.
  1. Test, monitor, and retrain. Run pre-launch testing and ongoing monitoring for bias, drift, security failure, and harmful outputs, then keep evidence for audit and regulator review.
  1. Prepare remediation and escalation. Set complaint handling, rollback triggers, incident triage, legal hold, and regulator-notification workflows for rights-related AI incidents.

Related Regulations

The EU AI Act overlaps strongly because it also uses a risk-based model, but it is a directly applicable product-and-use regulation in the EU, while the Convention is an international treaty that must be implemented by parties.[9][15]

The GDPR overlaps wherever AI processes personal data, especially for transparency, automated decision-making, lawful basis, and data subject rights, but the GDPR does not regulate all non-personal AI risk the way the Convention does.[15]

The Digital Services Act can conflict or overlap when AI is used for recommender systems, content moderation, or systemic-risk management by platforms, but it addresses online intermediary duties rather than general AI governance.[15]

The OECD AI Principles are non-binding and therefore easier to align with, but they are not a substitute for treaty implementation by states that ratify the Convention.[12]

The UNESCO Recommendation on the Ethics of AI is broader and softer law, so it can complement the Convention’s binding obligations but cannot create enforceable treaty duties on its own.[12]

Does the Convention already bind companies directly?

Not by itself. The Convention binds states and regional organizations that ratify it, and companies are affected through the domestic laws those parties adopt or maintain.[15] A company should still prepare now if it operates in jurisdictions that have signed or ratified, because implementing laws can follow quickly.

Does it apply outside Europe?

Yes, potentially. The Council of Europe states that the Convention is open to non-European countries, and by 2026 countries including the United States, Canada, Japan, and Uruguay had signed it.[3] Legal obligations arise only if a country ratifies and implements the treaty.

What changed in 2025–2026?

The most important 2026 development in the cited sources is the EU’s ratification in May 2026 and the European Parliament’s consent process in March 2026.[3][1][5] No cited source shows a formal amendment to the treaty text itself in 2025–2026.

When will it enter into force?

The cited sources state that entry into force requires five ratifications, including at least three from Council of Europe member states.[2][8] As of the cited 2026 materials, that threshold has not been shown as met.

What are the penalties?

The Convention text itself does not set a single global fine amount in the cited sources.[15] Enforcement and sanctions depend on each Party’s implementing law, so penalties can vary widely by country and by sector.

Sources

Put it into practice

More compliance guides