The Council of Europe is developing a new Convention on AI to safeguard human rights, democracy, and the rule of law in the digital space covering governance, accountability and risk assessment.

Laws/Regulations directly regulating AI (the "AI Regulations")

The Council of Europe (CoE)'s Committee on Artificial Intelligence approved the Draft Framework Convention on Artificial Intelligence, Human Rights, Democracy, and the Rule of Law (the "AI Convention") on March 14, 2024.¹ The AI Convention is intended to function as a "global legally binding instrument".²

Status of the AI Regulations

The AI Convention is expected to be formally adopted by the Committee of Ministers of the CoE (Ministers of Foreign Affairs) on May 17, 2024.³

Other laws affecting AI

The CoE has various legally binding instruments and non-binding guidelines that may affect the development or use of AI systems. A non-exhaustive list of key examples includes:

• The European Convention on Human Rights⁴
• The Guidelines on Artificial Intelligence and Data Protection⁵
• The European Ethical Charter on the use of artificial intelligence (AI) in judicial systems and their environment⁶
• The Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data⁷

Definition of "AI"

AI system is defined in the AI Convention as "a machine-based system that for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that may influence physical or virtual environments."⁸ The AI Convention notes that different artificial intelligence systems vary in their levels of autonomy and adaptiveness after deployment.

Territorial scope

The AI Convention would apply to all of the CoE Member States that choose to sign it. This could include, for example, individual EU Member States and the UK.

However, whether or not certain CoE Members choose to sign the AI Convention (and submit to the AI Convention's territorial scope) is likely to be influenced by the outcome of the final reading. For example, it has been suggested that the UK will not sign the AI Convention if its provisions also apply to the private sector.

Sectoral scope

Based on the approved draft, the AI Convention will:⁹

(i) Apply to the activities within the lifecycle of AI systems undertaken by public authorities or entities acting on their behalf where such systems have the potential to interfere with human rights, democracy, and the rule of law

(ii) Not apply to activities within the lifecycle of AI systems relates to protection of a CoE Member's security interests, in so far as the activities are conducted in a manner consistent with applicable international law (e.g., human rights law)

(iii) Not apply to research and development activities regarding AI systems, unless those activities¹⁰ have the potential to interfere with human rights, democracy, and the rule of law

(iv) Require each signatory to take appropriate steps for the realization of the AI Convention in respect of the activities within the lifecycle of AI systems by private entities, where such systems have the potential to interfere with human rights, democracy, and the rule of law.

Compliance roles

The AI Convention effectively creates compliance roles on two tiers: the obligations in the AI Convention apply directly to signatories (being CoE Members), but compliance with those obligations will ultimately impact AI actors throughout the lifecycle of AI systems. For example, Article 8 (Transparency and oversight) requires each signatory to "adopt or maintain measures to ensure that adequate transparency and oversight requirements […] are in place in respect of activities within the lifecycle of [AI] systems."¹¹ As another example, Article 9 (Accountability and responsibility) requires each signatory to "adopt or maintain measures to ensure accountability and responsibility for adverse impacts on human rights, democracy, and the rule of law resulting from activities within the lifecycle of artificial intelligence systems."¹² The signatories' implementation of such provisions will inevitably impact developers, deployers, and managers of AI systems.

Core issues that the AI Regulations seek to address

The AI Convention aims to address ethical, legal, and societal issues arising from the use of AI systems by ensuring "that activities within the lifecycle of AI systems are fully consistent with human rights, democracy, and the rule of law."¹³

Risk categorization

The AI Convention does not categorize AI systems according to risk. However, it will require signatories to adopt a risk-based approach. For example:

• Article 1 (Object and purpose) requires signatories to adopt specific or horizontal measures that are "graduated and differentiated" as necessary to give effect to its provisions, with reference to the severity and probability of the occurrence of adverse impacts on human rights, democracy, and the rule of law throughout the lifecycle of AI systems¹⁴
• Article 16 (Risk and impact management framework) requires signatories to adopt or maintain measures for the identification, assessment, prevention, and mitigation of risks posed by AI systems by considering actual and potential impacts of human rights, democracy, and the rule of law¹⁵

Key compliance requirements

Chapter II (General obligations) of the AI Convention establishes the general obligations that each signatory must comply with, which include the implementation of measures:

• To ensure that the activities within the lifecycle of AI systems are compatible with obligations to protect human rights, as enshrined in applicable international law, and in the signatories' domestic law
• That seek to ensure that AI systems are not used to undermine the integrity, independence and effectiveness of democratic institutions and processes, including the principle of separation of powers, respect for judicial independence and access to justice¹⁶

Chapter III (Principles related to activities within the lifecycle of artificial intelligence systems) establishes the general principles that each signatory must reflect in the measures they implement to ensure compliance with the AI Convention. A non-exhaustive list of the applicable principles includes:

• Respecting human dignity and individual autonomy related to activities within the lifecycle of AI systems¹⁷
• Ensuring that adequate transparency and oversight requirements tailored to specific contexts and risks are in place¹⁸
• Ensuring accountability and responsibility for adverse impacts¹⁹ resulting from activities within the lifecycle of AI systems
• Ensuring that activities related to the lifecycle of AI systems respect equality, including gender equality, and prohibition of discrimination²⁰
• Protect privacy rights of individuals and personal data in the context of activities within the lifecycle of AI systems²¹
• Promoting reliability, safety, validity, and trust in artificial intelligence systems²²

Regulators

Each signatory will be required to establish or designate effective regulatory oversight mechanisms to oversee compliance with the obligations in the AI Convention.²³ The exercise of regulatory duties must be independent and impartial, and any such regulator must have the necessary powers, expertise, and resources to effectively fulfil their task of overseeing compliance with the AI Convention.

Enforcement powers and penalties

The approved draft of the AI Convention requires that each CoE signatory must: (i) take measures to ensure the availability of accessible and effective remedies for violations of human rights resulting from the activities within the lifecycle of artificial intelligence systems; and (ii) ensure that effective procedural guarantees, safeguards, and rights, in accordance with applicable domestic and international law, are available to persons affected thereby.

1 The approved Draft AI Convention (15 March 2024) is available here.
2 See the Overview of the Council of Europe activities on Artificial Intelligence, page 10.
3 See the CoE Committee's announcement of the AI Convention's approval here.
4 The European Convention on Human Rights is available here.
5 Guidelines on Artificial Intelligence and Data Protection is available here.
6 European Ethical Charter on the use of artificial intelligence (AI) in judicial systems and their environment is available here.
7 The Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (ETS No. 108) is available here.
8 See the AI Convention (15 March 2024), page 4, Article 2 (Artificial intelligence systems).
9 See the AI Convention (15 March 2024), pages 5-6, Article 3 (Scope).
10 See the AI Convention (15 March 2024), page 5, Article 3 (Scope).
11 See the AI Convention (15 March 2024), page 6, Article 8 (Transparency and oversight).
12 See the AI Convention (15 March 2024), page 6, Article 9 (Accountability and responsibility).
13 See the AI Convention (15 March 2024), page 4, Article 1 (Object and purpose).
14 See the AI Convention (15 March 2024), page 4, Article 1 (Object and purpose).
15 See the AI Convention (15 March 2024), page 7, Article 16 (Risk and impact management framework).
16 See the AI Convention (15 March 2024), page 4, Articles 4 (Protection of human rights) and 5 (Integrity of democratic processes and respect for rule of law).
17 See the AI Convention (15 March 2024), page 5, Article 7 (Human dignity and individual autonomy).
18 See the AI Convention (15 March 2024), page 6, Article 8 (Transparency and oversight).
19 See the AI Convention (15 March 2024), page 6, Article 9 (Accountability and responsibility).
20 See the AI Convention (15 March 2024), page 6, Article 10 (Equality and non-discrimination).
21 See the AI Convention (15 March 2024), page 6, Article 11 (Privacy and personal data protection).
22 See the AI Convention (15 March 2024), page 6, Article 12 (Reliability).
23 The AI Convention (15 March 2024) is available here, page 10, Article 26 (Effective oversight mechanisms).

Daniel Mair (Trainee Solicitor, White & Case, Paris) contributed to this publication.

[View source.]