Council of Europe AI Convention Guide: The First Binding AI Treaty

The Council of Europe Framework Convention on Artificial Intelligence is the first international treaty on AI that binds the states that ratify it, yet most security and governance teams have never read what it asks for. Its full name is the Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law, and it is numbered CETS No. 225 in the Council of Europe Treaty Series. It does not regulate companies directly: it obliges each Party to put domestic measures in place, and those measures will reach public bodies, their contractors and, depending on each Party's choice, private organisations. This guide explains the scope, the obligations, the current signature and ratification status, how it is followed up, and what it means for teams that run AI systems and AI agents. It is for security, privacy and AI governance practitioners and the executives who own compliance plans.

Key takeaways

• A treaty, not a regulation. The Convention binds states and the European Union as Parties; organisations feel it through the national laws, procurement rules and regulator guidance that Parties adopt to implement it.
• The lifecycle is the unit of control. Obligations apply to activities across the whole lifecycle of AI systems, from design and data collection to deployment, monitoring and retirement, wherever those activities could interfere with human rights, democracy or the rule of law.
• Risk and impact assessment is central. Parties must require iterative, documented assessment of actual and potential impacts, with prevention and mitigation measures, and may ban or impose moratoria on certain uses.
• Not yet in force as of October 2026. The Council of Europe reported 21 signatures and one Party, the European Union (ratified 15 May 2026), in September 2026; entry into force needs five ratifications, including at least three Council of Europe member states.
• AI agents raise the stakes on traceability. Remedies depend on being able to document what an AI system did and why, so agent identity, delegated authority and action logs become evidence for affected people, not just for security teams.

Scope: who and what is covered

The Convention was adopted by the Council of Europe Committee of Ministers in May 2024 and opened for signature on 5 September 2024 in Vilnius. The Council of Europe describes it as the first ever international legally binding treaty in this field. It is open to Council of Europe member states, to non-member states that took part in drafting (the United States, Canada, Japan, Israel and others) and to the European Union, and other states can accede later.

Covered activities

• Public sector: activities within the lifecycle of AI systems carried out by public authorities, and by private actors acting on their behalf. A contractor running an AI service for a ministry is in scope through the Party's measures.
• Private sector: Parties must also address risks from private actors' AI activities, but each Party chooses how: either by applying the Convention's principles and obligations directly to private actors, or by taking other appropriate measures that meet the treaty's object and purpose. Parties state their approach in a declaration to the Council of Europe, so the private sector reach will differ by country.
• National security: Parties are not required to apply the Convention to activities protecting national security interests, but those activities must still respect international law and democratic institutions and processes.
• Research and development: excluded, unless testing or similar activities are undertaken in a way that may interfere with human rights, democracy or the rule of law.
• National defence: matters relating to national defence are outside the Convention.

What counts as an AI system

Article 2 defines an artificial intelligence system. The Explanatory Report states that the definition was drawn from the revised OECD definition of 8 November 2023: in short, a machine-based system that infers from inputs how to generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments, with varying levels of autonomy and adaptiveness after deployment. See the AI Register and AI Inventory Template.

Key obligations

The Convention has 36 articles in eight chapters. The Explanatory Report gives the article titles, and the obligations group naturally into five blocks. It is principle based and leaves the method to each Party.

Remedies (Article 14) and procedural safeguards (Article 15)

• Information to challenge decisions: where an AI system significantly affects human rights, relevant information about the system and its use must be documented, provided to the bodies authorised to access it and, where appropriate, made available to affected persons, so that they can contest decisions made or substantially informed by the system.
• Complaints: an effective possibility to lodge a complaint with competent authorities.
• Procedural guarantees: where a system substantially informs decisions affecting human rights, the Explanatory Report says safeguards may include human oversight, including ex ante or ex post human review of the decision.
• Disclosure of AI interaction: people interacting with an AI system should be notified that they are dealing with AI and not a human, as appropriate to the context.

Risk and impact management (Article 16)

Article 16 is the obligation that will create the most work inside organisations. The Explanatory Report says risks must be identified, assessed, prevented and mitigated ex ante and iteratively across the lifecycle, using a methodology with concrete and objective criteria, and that measures should be graduated and differentiated according to the context and intended use of the system. In practice this means:

• Proportionality: deeper assessment where severity and probability of impact are higher.
• Stakeholder perspectives: taking into account the views of affected people where appropriate.
• Iteration: repeating the assessment through the lifecycle, not once at go-live.
• Monitoring and documentation: recording risks, actual and potential impacts and the approach taken.
• Testing: testing systems before first use and when they are significantly modified, where appropriate.
• Red lines: each Party assesses the need for bans or moratoria on uses it considers incompatible with human rights, democracy or the rule of law.

The Council of Europe has published HUDERIA, a methodology for the risk and impact assessment of AI systems from the point of view of human rights, democracy and the rule of law. The Committee of Ministers approved the HUDERIA Methodology on 26 February 2025 and the HUDERIA Model on 25 February 2026. It is standalone, non-legally binding guidance with four parts: Context-Based Risk Analysis (COBRA), a Stakeholder Engagement Process (SEP), the Risk and Impact Assessment (RIA), which weighs factors such as scale, scope, reversibility and likelihood, and a Mitigation Plan (MP). Parties may use or adapt it. For a method aligned to an international standard, see the ISO/IEC 42005 AI System Impact Assessment Guide and the AI Risk Assessment Guide.

Timeline and current status

Status below was checked on 24 October 2026 against Council of Europe pages and the Netherlands treaty database. The Council of Europe Treaty Office status table for CETS 225 could not be read for this guide, so confirm the live position there before relying on it.

• Entry into force: the Convention enters into force on the first day of the month following a three-month period after five signatories, including at least three Council of Europe member states, have expressed their consent to be bound. The European Union's ratification counts as one of the five but not towards the three member states.
• What to watch: ratifications, private sector declarations and the first Conference of the Parties.

Enforcement and penalties

The Convention sets no fines and creates no court. Enforcement works at two levels.

• International follow-up: the Conference of the Parties, made up of official representatives of the Parties, assesses implementation, makes recommendations and can hold public hearings with stakeholders. Each Party reports to it on the activities it has taken to give effect to the Convention, starting within the first two years of becoming a Party and periodically after that.
• Domestic oversight: under Article 26 each Party must establish or designate one or more effective oversight mechanisms with the independence, powers and resources to oversee compliance. These may be existing bodies such as data protection authorities, equality bodies or sector regulators.
• Where penalties come from: any sanctions that reach an organisation come from the national law used to implement the treaty. In the European Union, the EU AI Act and existing Union law are the most likely vehicles, so AI Act penalties are the practical lever to plan around; confirm against the EU's own implementing statements. See the EU AI Act Compliance Guide.

The Convention overlaps with the EU AI Act, GDPR, ISO/IEC 42001 and the NIST AI RMF, but it is the only one of these that binds states as a treaty. For a country-by-country view, see the Global AI Regulation Map. Where personal data is involved, a DPIA will often cover part of the Article 16 work; see the DPIA Guide.

What it means for AI agents and non-human identities

The Convention does not mention agents or identities, but its accountability, transparency and remedies provisions only work if an organisation can show which system did what, under whose authority. Autonomous agents make that harder, because they act through API keys, OAuth tokens and service accounts and can chain actions across systems without a human in each step.

See the Identity Governance for AI Agents Guide and the AI Agent Observability and Incident Response Guide. Incidents such as the OpenAI Agent Medicare Portal Breach 2026, where an agent reached non-public government data, show why public bodies and their suppliers need to know what their agents can access before regulators ask.

Compliance steps

Because national implementing measures are still being written, the practical goal is to be ready for whichever measures your jurisdictions adopt, using work that also serves the EU AI Act, GDPR and ISO/IEC 42001.

1. Map your jurisdictions. List the signatory and Party states where you operate or supply public bodies, and track each one's ratification and private sector declaration.
2. Classify your role. Identify where you are a public authority, a supplier acting on behalf of one, or a private actor; public sector supply contracts are the earliest route to binding obligations.
3. Build the AI inventory. Record each AI system and agent, its purpose, owner, data, the decisions it informs and the identities and credentials it uses.
4. Pilot an impact assessment. Take two or three systems that inform decisions about people, run a human rights impact assessment using HUDERIA or ISO/IEC 42005, and record impacts, mitigations and residual risk. Review the method before scaling.
5. Close the remedies gap. Check that you can produce, for any rights-affecting decision, the information a person would need to contest it, and that a complaints route exists.
6. Add human review and disclosure. Put approval gates on high-impact agent actions and tell people when they are interacting with AI.
7. Set reassessment triggers. Reassess on significant model change, new data sources, new tool permissions for an agent or new user groups. If an assessment shows unacceptable risk, the rollback is to suspend the use and revoke the system's credentials until mitigations are in place.
8. Measure and report. Track the metrics below and report them to the AI governance board. See the AI Governance Guide.

Decision guidance

• EU-based organisations: treat the EU AI Act as the implementing vehicle and fold Convention principles into AI Act and GDPR work rather than running a separate programme.
• UK, Swiss, Norwegian and other non-EU signatory markets: watch national implementing measures, which may differ from the AI Act, and keep assessments method neutral so they can be reused.
• Suppliers to government: expect contract clauses requiring impact assessments, documentation for remedies and audit rights; prepare evidence packs now.
• Small vs large: a short triage form with full assessments only for rights-affecting systems suits small teams; large organisations should build the assessment into existing risk and change workflows.

Metrics that show it is working

• Percentage of AI systems and agents in the inventory with a named owner and a completed triage.
• Percentage of rights-affecting systems with a current impact assessment (reviewed within the last 12 months or since last significant change).
• Time to produce a decision record for a contested outcome.
• Number of agents with standing high privileges and no approval gate.

Framework mapping

Common failure patterns

• Assuming "not in force" means "not relevant": signatories are already shaping law and procurement, and the EU has ratified. Waiting for entry into force leaves no time to build assessment capability.
• Treating the treaty as public sector only: suppliers acting for public bodies are in scope, and Parties may apply obligations to private actors directly.
• One-off assessments: an assessment done at procurement and never revisited fails the iterative requirement, especially for agents whose tools and permissions grow over time.
• No evidence trail for remedies: without retained records linking decisions to the system and identity that produced them, an organisation cannot supply the information Article 14 expects.

Practitioner checklist

• Record which Convention signatories and Parties apply to your operations and check the Treaty Office status quarterly.
• Classify each AI use as public authority, on behalf of a public authority, or private.
• Maintain an AI and agent inventory with owner, purpose, data and credentials.
• Adopt one impact assessment method (HUDERIA or ISO/IEC 42005) and pilot it on rights-affecting systems.
• Define reassessment triggers, including new agent tool permissions.
• Retain decision records sufficient for an affected person to contest an outcome.
• Provide a complaints route, human review and AI interaction disclosure.
• Give every agent a unique identity, a human owner and least-privilege, revocable credentials.

Standards and references

• Council of Europe: The Framework Convention on Artificial Intelligence
• Council of Europe: Explanatory Report to the Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law
• Council of Europe: Framework Convention Marks Two Years
• Council of Europe: European Union ratifies the Framework Convention on Artificial Intelligence
• Council of Europe: HUDERIA Risk and Impact Assessment of AI Systems
• EUR-Lex: Council Decision (EU) 2026/1080 on the conclusion of the Framework Convention
• Netherlands Treaty Database: Framework Convention on Artificial Intelligence, signatures and ratifications
• eucrim: Anniversary of CoE's AI Convention

Related NHI Mgmt Group resources: EU AI Act Compliance Guide · AI Risk Assessment Guide · DPIA Guide · Explainable and Fair AI Guide · Global AI Regulation Map. This guide summarises the Council of Europe Framework Convention on Artificial Intelligence and is not legal advice.