CoE AI Convention
Council of Europe Framework Convention on AI
First legally binding international AI treaty. Signed by EU, UK, US (Sep 2024), Canada, Japan (Feb 2025) and others. Requires risk/impact assessments, transparency, accountability. National security exemptions apply.
Jurisdiction
International
Enacted
May 17, 2024
Effective
Nov 1, 2025
Enforcement
TBD
Entered into force November 1, 2025
Council of EuropeWhy It Matters
First binding global AI treaty. US signature notable given federal deregulation stance—demonstrates international divergence.
Recent Developments
Adopted May 17, 2024; opened for signature Sep 5, 2024 in Vilnius. Entered into force November 1, 2025 after UK, France, Norway ratifications. European Parliament gave consent to EU accession on March 11, 2026 (resolution TA-10-2026-0071), clearing the way for the EU itself to ratify the Convention. The EP-consent vote is the key 2026 milestone in the Convention's adoption trajectory and is referenced alongside the Digital Omnibus on AI negotiations as part of the EU's broader AI governance posture.
At a Glance
Harms addressed
Who Must Comply
- Public authorities
- Private actors acting on their behalf (or through "other measures")
Obligations fall on:
Safety Provisions
- Risk and impact assessments
- Mitigation measures
- Transparency and oversight
- Accountability principles
- Rights and remedies framework
Compliance & Enforcement
Key Dates
May 17, 2024
Convention adopted by Committee of Ministers
Sep 5, 2024
Convention opened for signature
View on map
International
Focus Areas
General regulation
Cite This
APA
International. (2024). Council of Europe Framework Convention on AI.
Related Regulations
ISO 42001
First certifiable international standard for AI management systems. Uses Plan-Do-Check-Act methodology. Third-party certification available; major AI systems have achieved certification.
ISO 23894
AI risk management guidance complementing ISO 31000. Lifecycle risk management; audit/procurement language.
OECD AI Due Diligence
Non-binding OECD guidance applying the OECD's six-step responsible business conduct (RBC) due-diligence process to enterprises across the AI value chain, providing practical recommendations for identifying, preventing, mitigating, and accounting for adverse human-rights and societal impacts of AI systems.
CA AB 2246
Repeals and replaces the California Age-Appropriate Design Code Act. Requires a business providing an online service, product or feature likely to be accessed by children to estimate the age of child users with a reasonable level of certainty or extend child protections to all users, to configure high-privacy defaults, and to take reasonable steps to prevent specified harms including severe psychological harm. Removes the exceptions to the data-collection prohibitions, lets children void contracts entered through manipulative design features, and states that it creates no private right of action.
IL HB 5511
Requires covered operators of online platforms to apply protective default settings to users they know to be minors, including limits on algorithmic feeds, a 10 p.m. to 7 a.m. notification curfew and no autoplay by default on addictive social media platforms, and establishes a device-level age-bracket signal that Internet-enabled device manufacturers must provide and operators must request. Announced by the Governor as the Children's Social Media Safety Act, the title of the bill as introduced. Enforced by the Attorney General.
NJ Kids Code
Codifies a New Jersey Age-Appropriate Design Code requiring covered online service providers to design services likely to be accessed by minors around minors' safety and wellbeing, including high-privacy defaults, limits on engagement-maximising design features, and data protection impact assessments. Enforced by the Attorney General with a private right of action for minors and their parents.
Last updated May 10, 2026. Verify against primary sources before relying on this information.