HUDERIA: Risk and impact assessment of AI systems for human rights, democracy and the rule of law

What it is

HUDERIA stands for Human Rights, Democracy and Rule of Law Impact Assessment. It is a methodology from the Council of Europe for assessing the risks and impacts of AI systems through the lens of human rights, democracy and the rule of law. The Council of Europe’s Committee on Artificial Intelligence (CAI) adopted the HUDERIA Methodology on 28 November 2024, and the HUDERIA Model, a set of resources for carrying out the first element, on 5 November 2025. The Committee of Ministers approved the Model on 25 February 2026, and the Council of Europe now publishes the Methodology and Model together.

HUDERIA is technology-neutral and designed to work across sectors and legal systems. It is non-legally binding. It was developed to support the risk and impact obligations in the Council of Europe Framework Convention on AI, but it is not the only way to meet them and it does not interpret the Convention.

Who it applies to

Nobody is required to use HUDERIA. It is written for public and private actors who design, develop, procure, deploy or oversee AI systems, and for governments that want a common method across their agencies. It is especially relevant to public bodies, to suppliers of AI to government, and to any organisation whose AI could affect access to services, rights or participation in public life.

What it requires

HUDERIA has four elements, each producing outputs that feed the next. The cycle is repeated through the lifecycle as the system and its context change.

1. Context-Based Risk Analysis (COBRA)

COBRA maps the AI system’s context to identify risk factors that raise the likelihood of adverse impacts on human rights, democracy and the rule of law. Risk factors are grouped into three categories, which are the application context, the design and development context, and the deployment context. The output is a preliminary picture of potential harms and a decision on how far the rest of the process needs to go. A low-risk system may need only a light-touch assessment, while a system that raises significant risk factors goes through the full process. The HUDERIA Model provides the COBRA resources, including structured questions and guidance for this step.

2. Stakeholder Engagement Process (SEP)

The SEP brings in the perspectives of people who could be affected by the system, especially groups that are vulnerable or at risk of marginalisation. Its depth is proportionate to the risks COBRA identifies. Engagement informs the assessment of impacts and the design of mitigations, and the methodology asks that it be meaningful rather than a formality.

3. Risk and Impact Assessment (RIA)

The RIA assesses each identified potential harm in more detail. The methodology treats severity as a combination of scale (how grave the harm is), scope (how many people it could affect, their vulnerability and how long it lasts) and reversibility (whether people can be restored to their prior situation), and assesses probability separately. Combining these factors lets the organisation prioritise which harms need the strongest response.

4. Mitigation Plan (MP)

The mitigation plan sets out measures to prevent or mitigate each harm, following a mitigation hierarchy of avoid, mitigate, restore and compensate, so prevention comes before remediation. It assigns responsibility, sets timelines and includes access to remedy for people who are affected.

Iterative review

HUDERIA treats assessment as continuous. It asks the organisation to revisit COBRA, the RIA and the mitigation plan when production, implementation or deployment factors change, or when the real-world environment shifts, and at regular intervals during operation.

Key dates

The CAI adopted the HUDERIA Methodology on 28 November 2024 and the HUDERIA Model on 5 November 2025, at the plenary that concluded its mandate. From 1 January 2026, the Steering Committee for New and Emerging Digital Technologies (CDNET) carries on the HUDERIA work, including further supporting materials. The Committee of Ministers approved the Model on 25 February 2026.

How it relates to other frameworks

HUDERIA is the methodology most closely tied to the Council of Europe Framework Convention on AI, which requires parties to identify, assess, prevent and mitigate risks to human rights, democracy and the rule of law. It overlaps with the fundamental rights impact assessment that the EU AI Act requires of some deployers (organisations using high-risk AI systems in their work), and with the AI system impact assessment in ISO/IEC 42001 and ISO/IEC 42005. Compared with those, it puts more weight on democratic processes and the rule of law, and it makes stakeholder engagement a formal element rather than a recommendation.

For organisations already running impact assessments, HUDERIA is most useful as a structure for deciding how deep each assessment should go and for scoring harms consistently. UNESCO’s Ethical Impact Assessment and national public-sector impact assessment tools take a similar approach from different starting points.