Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law (CETS No. 225)

What it is

The Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law, Council of Europe Treaty Series No. 225, is the first legally binding international treaty dedicated to AI. It was negotiated by the Council of Europe’s Committee on Artificial Intelligence with the 46 member states, the European Union and a group of non-member states, and adopted by the Committee of Ministers on 17 May 2024. It opened for signature in Vilnius on 5 September 2024.

It is a framework convention, meaning it sets common principles and obligations and leaves each party to decide how to implement them in its own law. It covers the whole lifecycle of AI systems.

Who it applies to

The Convention binds parties, which are the states and international organisations that ratify it. Its scope covers activities within the lifecycle of AI systems that have the potential to interfere with human rights, democracy and the rule of law.

• Public authorities. Parties must apply the Convention to activities by public authorities and by private actors acting on their behalf.
• Private actors. Parties must also address risks and impacts from other private-sector AI activity, but may choose to do so by applying the Convention’s obligations directly or by taking other appropriate measures. Each party states its approach in a declaration.
• Exclusions. Activities to protect national security are outside its obligations, provided they respect international human rights law. National defence is excluded, as are research and development activities not yet made available for use, unless testing could interfere with rights, democracy or the rule of law.

Companies are therefore affected through the national laws their governments adopt to implement it, not by the treaty itself.

What it requires

Principles

Parties must make sure that activities within the AI lifecycle are consistent with a set of principles. These are human dignity and individual autonomy, transparency and oversight, accountability and responsibility, equality and non-discrimination, privacy and personal data protection, reliability, and safe innovation. Separate articles require parties to protect human rights and to protect the integrity of democratic processes and respect for the rule of law.

Remedies and procedural safeguards

Parties must make sure that accessible and effective remedies are available for human rights violations resulting from AI. That includes documenting relevant information about AI systems that significantly affect human rights and making it available to affected people, and an effective possibility to lodge a complaint. Where an AI system significantly affects the enjoyment of rights, people should have procedural safeguards, and people should be told when they are interacting with an AI system rather than a human.

Risk and impact management

Parties must adopt or maintain measures to identify, assess, prevent and mitigate risks posed by AI systems, considering actual and potential impacts on human rights, democracy and the rule of law. Those measures should take account of context and intended use, the severity and probability of impacts, the perspectives of affected stakeholders, and should apply iteratively across the lifecycle with monitoring, documentation and testing. Parties must consider whether some uses are incompatible with human rights and need a moratorium, ban or other measures.

Follow-up

A Conference of the Parties will monitor implementation once the Convention is in force. Until then, the Council of Europe’s Steering Committee for New and Emerging Digital Technologies (CDNET), set up from 1 January 2026, acts as custodian of the Convention and carries on the HUDERIA work.

Key dates

The Convention was adopted on 17 May 2024 and opened for signature on 5 September 2024. Canada and Japan signed on 11 February 2025. The European Union ratified on 15 May 2026 after Council Decision (EU) 2026/1080 of 21 April 2026.

It enters into force on the first day of the month following three months after five signatories, including at least three Council of Europe member states, have ratified it. As of October 2026 that threshold had not been met, so the Convention was not yet in force.

How it relates to other frameworks

For the European Union, the EU AI Act is the main instrument for meeting the Convention’s obligations within the areas the Union covers. For other parties, implementing laws will differ, which is why the Convention is a framework rather than a uniform rulebook.

The Council of Europe’s HUDERIA methodology is non-binding guidance designed to support risk and impact assessment of AI from a human rights, democracy and rule of law perspective. Parties are free to use it or other methods. Organisations that already run AI impact assessments under ISO/IEC 42005, or fundamental rights impact assessments under the EU AI Act, will find the Convention’s risk and impact themes familiar.