EU AI Act vs Council of Europe AI Convention: Regulation vs Human Rights Treaty

Europe now has two binding legal instruments on artificial intelligence, built on very different foundations. The EU AI Act is a product regulation: detailed, directly applicable rules on how AI systems are placed on the EU market and used, enforced with fines of up to 7% of global turnover. The Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law is a human rights treaty: a short set of principles that states promise to give effect to in their own laws, open to countries far beyond Europe.

The two meet in 2026. The European Union became the first Party to the Convention on 15 May 2026, and it implements the treaty mainly through the AI Act. But as of late October 2026, the Convention had 21 signatories and was not yet in force, because it needs five ratifications, including at least three Council of Europe member states.

This guide explains what each instrument does, how they differ in scope, enforcement and ambition, and what the Convention means in practice for governments and companies.

The short answer

The AI Act tells companies and public bodies exactly what they must do with AI in the EU market. The Convention tells states what outcomes their laws must guarantee: that AI is used consistently with human rights, democracy and the rule of law, with transparency, oversight, accountability and effective remedies.

For organisations in the EU, the AI Act is the operative law, and the Convention mainly adds an international human-rights frame around it. For organisations in other signatory countries, such as the UK, Canada, Japan or Switzerland, the Convention may become the basis for new national AI laws once those countries ratify.

What the Council of Europe AI Convention requires

The Convention was negotiated by the Council of Europe's Committee on Artificial Intelligence, with the 46 Council of Europe member states, the EU and 11 non-member states, including the United States, Canada, Japan, Israel, Australia and Argentina. Its core obligations apply across the whole AI life cycle.

Scope: public sector fully, private sector by choice

The Convention's most debated feature is how it treats the private sector. Parties must apply it to AI activities by public authorities and private actors acting on their behalf. For other private actors, each Party must address AI risks either by applying the Convention's obligations directly or by taking "other appropriate measures", and declare which approach it chooses. National security activities are excluded, as are research and development not yet available for use, and national defence is outside its scope entirely.

What the EU AI Act adds that the Convention doesn't

The AI Act turns the same values into enforceable, technical requirements. It sets out:

• Specific prohibitions, such as social scoring, manipulative AI, untargeted facial image scraping and emotion recognition in workplaces and schools, applying since 2 February 2025
• Detailed high-risk requirements: risk management, data governance, documentation, logging, human oversight, accuracy, robustness and cybersecurity, applying from 2 December 2027 (Annex III) and 2 August 2028 (Annex I)
• A fundamental rights impact assessment for certain deployers of high-risk AI, the closest AI Act counterpart to the Convention's impact-management chapter
• Transparency duties for chatbots, deepfakes and AI-generated content, applying since 2 August 2026
• General-purpose AI model obligations, applying since 2 August 2025
• Conformity assessment, CE marking, market surveillance and fines of up to EUR 35 million or 7% of global turnover

In short, the AI Act regulates products and the companies that make and use them. The Convention regulates states and their duty to protect people.

If you are tracking how international AI law affects your organisation, I post practical breakdowns of the AI Act, the Council of Europe Convention and ISO 42001 regularly on LinkedIn. Feel free to connect with me there and tell me which jurisdictions you are mapping.

EU AI Act vs Council of Europe AI Convention: side by side

Where the Convention stands in late 2026

The EU's route to becoming a Party was quick. The European Parliament gave its consent on 11 March 2026 by 455 votes to 101, with 74 abstentions. The Council adopted Decision (EU) 2026/1080 on 21 April 2026, published in the Official Journal on 13 May, and the EU deposited its instrument two days later.

Because the EU isn't a Council of Europe member state, its approval counts towards the five ratifications but not towards the three required from member states. Entry into force therefore depends on national ratifications, for example by the UK, Norway, Switzerland or EU Member States.

How the two instruments fit together

The AI Act is the EU's main implementation tool

The Council Decision concluding the Convention refers explicitly to the AI Act's harmonised rules for AI systems in the EU. In practice, the EU meets its Convention obligations largely through the AI Act, complemented by the GDPR, non-discrimination law, consumer law and the Charter of Fundamental Rights. For most EU companies, complying with the AI Act and existing EU law is how the Convention reaches them.

The Convention locks in a human-rights floor

As a treaty obligation, the Convention sets a minimum standard the EU and its Parties must keep. That matters as the AI Act is amended, for example through the Digital Omnibus on AI. Changes that cut protections below the Convention's principles, such as transparency, oversight and effective remedies, would raise questions under international law.

It reaches where the AI Act can't

The Convention matters most outside the EU. The UK, Canada, Japan, Switzerland, Norway, Ukraine and others have signed it. Once they ratify, they must give effect to its principles in domestic law. That makes it the most likely common baseline for AI rules among democracies that don't adopt an EU-style regulation.

How the timelines fit together

• 2019

  Council of Europe's ad hoc Committee on AI (CAHAI) begins feasibility work.

• 2022

  Committee on Artificial Intelligence (CAI) starts negotiating the treaty text.

• 17 May 2024

  Committee of Ministers adopts the Framework Convention.

• 13 Jun 2024

  EU adopts the AI Act.

• 1 Aug 2024

  AI Act enters into force.

• 5 Sep 2024

  Convention opens for signature in Vilnius; the EU, UK, US and others sign.

• Nov 2024

  CAI adopts the HUDERIA risk and impact assessment methodology.

• 2 Feb 2025

  AI Act prohibitions apply.

• 11 Mar 2026

  European Parliament consents to EU conclusion of the Convention.

• 21 Apr 2026

  Council Decision (EU) 2026/1080 concludes the Convention on behalf of the EU.

• 15 May 2026

  EU becomes the first Party.

• Sep 2026

  Convention reaches 21 signatories; still not in force.

• 2 Dec 2027

  AI Act high-risk duties apply to Annex III systems.

What organisations should do now

1. Keep the AI Act as your compliance anchor in the EU

   For EU operations, the Convention adds no separate company obligations beyond EU law. Focus on AI Act prohibitions, transparency, general-purpose AI duties and the 2027–2028 high-risk deadlines.

2. Map signatory countries in your footprint

   List the non-EU signatories where you operate, such as the UK, Canada, Japan, Switzerland or Norway, and track their ratification and implementing laws. Those laws are where new obligations will appear.

3. Prepare public-sector work first

   If you build or run AI for governments, expect Convention-based duties soonest. Transparency, notice of AI interaction, human oversight and documented impact assessments are core requirements for public authorities and their contractors.

4. Use human-rights impact assessment

   Combine the AI Act fundamental rights impact assessment with HUDERIA-style risk analysis, so one assessment serves EU requirements and the Convention-based laws coming in other countries.

5. Strengthen remedies and redress

   Make sure people affected by your AI can find out about it, challenge decisions and get a human review. This is common to the AI Act, the GDPR and the Convention.

6. Anchor everything in one management system

   Use an AI management system such as ISO/IEC 42001 to hold your AI inventory, risk assessments, impact assessments and controls, so you can map them to each jurisdiction's law as it arrives.

Common mistakes to avoid

• Assuming the Convention is already in force
• Treating the Convention as a second EU compliance layer with its own company duties
• Assuming the Convention binds private companies directly everywhere, when each Party decides how it applies
• Assuming US signature means US obligations
• Ignoring the Convention in non-EU markets, where it may shape the next national AI law

A prompt to map your exposure to both instruments

Paste in your organisation's details to get a first-draft exposure map. Your legal team should verify each country's current treaty and legislative status.

You are an international AI law specialist with deep knowledge
of the EU AI Act (Regulation (EU) 2024/1689) as amended by the
Digital Omnibus on AI, and the Council of Europe Framework
Convention on AI and Human Rights, Democracy and the Rule of Law
(CETS No. 225).

Our organisation:
[sector; countries where we develop, sell or use AI; whether we
supply AI to public authorities; AI systems and their purposes;
which affect people's rights (for example hiring, credit,
benefits, policing, education); current impact assessment and
redress processes]

Produce:
1. For each country: whether it is an EU Member State, a
   Convention signatory, a Party, or neither, and which law
   currently governs our AI there. Mark status as UNKNOWN if not
   verified.
2. Our AI Act obligations by system (prohibited, high-risk,
   transparency, general-purpose AI).
3. Convention principles most relevant to our systems, and how
   our AI Act controls already meet them.
4. Gaps for non-EU signatory markets, especially for public-
   sector clients.
5. A single impact assessment template combining the AI Act
   FRIA and HUDERIA-style analysis.
6. A watch list of ratifications and national laws to monitor.

Use only what I provide and mark uncertain points UNKNOWN.

The AI Act tells companies what they must build. The Convention tells governments what they must protect. One regulates the market; the other sets the floor beneath it. — Kumail Mehdi

Frequently asked questions

Mapping AI obligations across the EU and other jurisdictions? Let's connect on LinkedIn. I'm always glad to compare notes on international AI law.

Sources

• Council of Europe — The Framework Convention on Artificial Intelligence
• EUR-Lex — Council Decision (EU) 2026/1080 concluding the Convention
• Council of Europe — EU Parliament backs EU conclusion of the Convention
• European Parliament Legislative Observatory — 2025/0136(NLE) vote summary
• Spanglett — Council of Europe AI Convention status (October 2026)
• Regulatorik — CETS 225 status and obligations
• AI Regulations — The Council of Europe AI Convention: status
• International Legal Materials — Text and introductory note on the Convention
• EUR-Lex — Regulation (EU) 2024/1689 (AI Act)