Navigating Global AI Governance: Key Takeaways from the Council of Europe’s Framework Convention on Artificial Intelligence

The global regulatory landscape for artificial intelligence is shifting rapidly. Following the implementation of the European Union’s landmark AI Act, the international community has reached a historic milestone with the adoption of the Council of Europe (CoE) Framework Convention on Artificial Intelligence and Human Rights, Democracy, and the Rule of Law (often referred to as the Vilnius Convention).

Opened for signature on September 5, 2024, with major global signatories including the United Kingdom, the United States, Canada, Israel, and the European Union, this treaty represents the first-ever legally binding international instrument on artificial intelligence.

For tech startups, compliance consultants, and legal professionals navigating the evolving intersections of technology and state governance, understanding this treaty is essential. Below is a comprehensive breakdown of what the Convention entails, its core requirements, and its implications for public and private sectors.

What is the Council of Europe Convention on AI?

Unlike product safety regulations or domestic tech bills, the CoE Framework Convention is anchored in the core mandate of the Council of Europe: the protection of human rights, democracy, and the rule of law.

Rather than attempting to micromanage fast-moving technologies through rigid technical specifications, the Convention is deliberately technology-neutral. It establishes a common baseline across 57 negotiating states to ensure that AI adoption does not erode fundamental freedoms, democratic processes, or institutional integrity.

Scope and Exclusions

The treaty covers the entire lifecycle of AI systems—from planning and design to operation, monitoring, and retirement. However, it outlines specific exemptions:

• National Security & Defense: AI systems related to national security interests and national defence matters are largely excluded, though signatories remain obligated to ensure these activities respect international law and democratic institutions.

• Research and Development: Pure R&D activities are excluded, except when testing phases have the potential to interfere with human rights, democracy, or the rule of law.

Core Principles of the Convention

Chapter III of the Convention establishes seven fundamental principles that must govern the lifecycle of AI systems:

1. Human Dignity and Individual Autonomy: Ensuring that AI systems do not reduce humans to mere data points or undermine individual freedom of choice.

2. Equality and Non-Discrimination: Mandating active measures to overcome structural inequalities and prevent algorithmic bias.

3. Privacy and Personal Data Protection: Aligning AI deployment with robust data frameworks like the EU GDPR and Convention 108+.

4. Transparency and Oversight: Requiring context-specific transparency—such as clearly identifying AI-generated content and providing understandable explanations for high-stakes decisions.

5. Accountability and Responsibility: Ensuring clear lines of responsibility for adverse human rights impacts.

6. Reliability: Guaranteeing adequate quality, safety, and technical robustness throughout an AI system's deployment.

7. Safe Innovation: Balancing rigorous risk controls with an environment conducive to technological progress.

Key Obligations for Participating States

While framed at a high level of abstraction to accommodate diverse domestic legal systems, the treaty places concrete procedural obligations on participating nations:

• Risk and Impact Management: States must enforce iterative risk assessments to identify, assess, prevent, and mitigate potential adverse impacts on human rights and democratic processes. Crucially, authorities retain the flexibility to introduce moratoria or outright bans ("red lines") on AI applications deemed fundamentally incompatible with human rights.

• Remedies and Procedural Safeguards: Affected individuals must be granted access to effective legal remedies, the right to lodge complaints with independent oversight bodies, and the ability to challenge decisions made or substantially informed by AI. Furthermore, users must receive notice when they are interacting directly with an AI system rather than a human.

• Private Sector Compliance: A heavily debated topic during negotiations was how the treaty applies to private entities. Ultimately, the Convention covers public authorities and private actors acting on their behalf. For all other private sector entities, signatories are given two modalities: they can either directly apply the Convention's provisions or achieve compliance via "other appropriate measures" (such as administrative frameworks, industry standards, or voluntary compliance).

Public Authorities vs. Private Sector: Understanding the Regulatory Split

A vital distinction in the treaty is how it handles public versus private actors:

• Public Sector Deployment: Public authorities are directly bound to evaluate necessity, proportionality, and fundamental rights protections when deploying AI in sensitive domains (such as law enforcement, migration, border control, public welfare, and the judiciary).

• Indirect Private Sector Governance: Because signatories can opt for "other appropriate measures" for private companies, the treaty functions similarly to a positive obligation framework. It urges states to regulate private actors indirectly through domestic legislation, consumer protection laws, and civil liability regimes.

Why the Framework Convention Matters for Global Compliance

Though the CoE Convention lacks the prescriptive, product-safety-driven fines of the EU AI Act, it holds immense strategic significance:

• Bridging Global Frameworks: It successfully aligns multi-regional priorities, bridging European human rights traditions with broader international compliance expectations from the US, UK, and beyond.

• Interpretative Guidance for Courts: As national and international courts (including the European Court of Human Rights) begin adjudicating AI-driven harms, the principles enshrined in the Convention will serve as powerful interpretative tools.

• A Global Baseline: For organizations operating internationally, compliance with the Convention's core pillars, transparency, rigorous risk documentation, and human oversight, acts as a robust shield against future regulatory friction.