At the beginning of February 2023, the Council of Europe Committee on Artificial Intelligence published the “zero” draft Convention on Artificial Intelligence, Human Rights, Democracy and the Rule of Law. The document is dated 6 January, 2023, and is the Council of Europe’s preliminary proposal for the AI future regulatory framework.

How work on the Convention began

The Council of Europe began work on the draft in September 2019, and was tasked with examining the feasibility of creating a legal framework to ensure that the design, development and application of AI systems would adhere to standards on human rights, the functioning of democracy and the observance of rule of law . At the beginning of 2022, the Council of Europe set up the Committee on Artificial Intelligence (CAI), which published the revised “zero” draft [Framework] Convention on Artificial Intelligence, Human Rights, Democracy and the Rule of Law, dated 6 January 2023, in February 2023[1].

The nature of the Convention 

The Convention is being drafted to establish only a general framework on application of AI systems. Upon examination, even though it is a preliminary and working document, the proposal reveals that the envisaged Convention will not provide for requirements or bans directly applicable to private and legal persons. Requirements under the Convention will only be binding on the signatory countries. These countries will be required to establish in national law the instruments needed to comply with the principles laid down in the Convention. EU member states could also be affected, as the draft Convention does not cover in every way the same scope as the EU proposal for a Regulation of the European Parliament and of the Council laying down harmonised rules on artificial intelligence (Artificial Intelligence Act – AI Act).

The Convention also establishes mechanisms to help to implement it effectively and that require the Convention Signatories to set up national supervisory authorities to ensure compliance.

Definition of an AI system

The draft Convention defines an AI system as any algorithmic system or a combination of such systems that, as defined herein and in the domestic law of each Party, uses computational methods derived from statistics or other mathematical techniques to carry out functions that are commonly associated with, or would otherwise require, human intelligence and that either assists or replaces the judgment of human decision-makers in carrying out those functions. Such functions include, but are not limited to, prediction, planning, classification, pattern recognition, organisation, perception, speech/sound/image recognition, text/sound/image generation, language translation, communication, learning, representation, and problem-solving. This definition is therefore very broad and vague, and differs from the definition in the proposal for the AI Act and a number of other legal definitions of an AI system. It does not mention, for instance, that operation of an AI system must be at least in part autonomous, or that there has to be a machine learning capability, while it does include a highly vague and unusual term, which is human intelligence, and the phrase computation methods derived from statistics or other mathematical techniques.

Rights and obligations under the Convention

The Convention introduces a legal framework that applies in the course of design, development and application of AI systems throughout their lifecycle, regardless of whether these activities are undertaken by public or private actors. Meanwhile, the Convention will not apply to AI systems used for purposes related to national defense.

The draft Convention specifies a number of unrelated obligation categories, relating for instance to:

  • fundamental principles of design, development, and application of AI systems,
  • safety measures and rules on liability with respect to application of AI systems,
  • risk assessment with respect to AI systems,
  • application of AI systems by public authorities, and
  • application of AI systems in provision of goods, facilities and services,

The Convention lists the following fundamental principles of design, development, and application of AI systems:

  • observance by an AI system of the principle of equality and anti-discrimination;
  • proper protection of data used by AI systems (including personal data);
  • the principle of accountability, responsibility and legal liability for any unlawful harm or damage to human rights caused by an AI system;
  • creating oversight mechanisms as well as transparency and auditability requirements with respect to AI systems;
  • ensuring that adequate safety requirements, such as data quality, data integrity, and data security, and cybersecurity and robustness requirements, are in place with respect to an AI system;
  • establishing a controlled regulatory environment for testing AI systems under the supervision of competent authorities.

Moreover, the signatories are required to encourage and promote digital literacy and strive to ensure that fundamental questions raised by the design, development and application of AI systems are the subject of appropriate public discussion and multi-stakeholder consultation.

The Convention requires the following measures and safeguards ensuring accountability and redress for damage caused by an AI system:

  • setting up a mechanism whereby usage of AI systems is recorded and the collected information can be communicated to the AI system subjects concerned;
  • guaranteeing that such communication includes sufficient information for an effective possibility of contesting the application of the AI system or challenging a decision;
  • making available effective redress mechanisms;
  • ensuring that where an AI system substantially informs or takes decisions affecting human rights, there is a right to human review of the decisions;
  • ensuring that any person has the right to know that they are interacting with an AI system;
  • ensuring, where appropriate, that any person has the option of interacting with a human in addition to or instead of an AI system.

Meanwhile, it will be possible to place restrictions on the exercise of these rights where necessary and proportionate in the pursuit of a legitimate public interest.

The Convention also provides for a range of specific requirements relating to AI systems applied by public authorities or used to provide goods, facilities and services.

Comparison between the Convention and AI Act

Clearly, the rules laid down in the Convention are intended as a framework, and are considerably less specific than the provisions in the AI Act, while on the other hand these two legislative acts will have much in common. They have been drafted to ensure proper adherence to standards on human rights in an age of rapid development of AI systems, stress numerous similar dangers, and propose numerous similar solutions. Both also adopt a risk assessment approach.

There are also major differences between the draft Convention and the AI Act. The Convention places obligations on countries, while the AI Act places specific obligations on private and legal entities. Potentially, an AI system will be defined more broadly in the Convention than under the AI Act. Furthermore, many points of the Convention provide for much more extensive obligations than in the case of the drafted AI Act. This applies above all to the requirement under the Convention to guarantee the right to human review of decisions made by an AI system and ensure that any person has the option of interacting with a human in addition to or instead of an AI system.

Thus even once the AI Act is enacted and takes effect, full compliance with the EU regulation will not necessarily guarantee that all legal requirements with respect to design, development, and application of AI systems will be observed.

The future of the Convention

The wording of the Convention is expected to be finalised in September 2023 and the final version to be submitted to the Council of Europe Committee of Ministers in November 2023. At the moment it is not clear whether this will take place on schedule and when the final wording of the Convention will be adopted.

When this does in fact happen, the Convention will enter into force on the first day of the month following a three-month period from the day on which six countries (a minimum of four of which are Council of Europe members) agree to be bound by the Convention, i.e. through ratification, acceptance, or approval. At the moment it is not clear which countries will ratify the Convention, or at what pace they will harmonize their legal systems with the Convention, as the Convention does not state a timeline for when it is to be implemented in full.

[1] https://rm.coe.int/cai-2023-01-revised-zero-draft-framework-convention-public/1680aa193f