Review of the Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law

Author: Dmitry Kuteinikovlawyer and researcher in the field of AI Governance, PhD in Law, author of the Telegam channel howtocomply_AI: law and AI.

Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law was accepted May 17, 2024 The Committee of Ministers of the Council of Europe at its 133rd session held in Strasbourg September 5, 2024 In 2015, it was opened for signature at the Conference of Ministers of Justice in Vilnius. The Convention was immediately signed by Andorra, Georgia, Iceland, Norway, the Republic of Moldova, San Marino, Great Britain, as well as Israel, the USA and the EU. Then the countries (and the EU) must ratify it in accordance with national legislation. After which the Convention will officially enter into force.

TLDR:

1. The Convention sets out principles aimed at reducing risks to human rights, democracy and the rule of law that potentially arise at all stages of the life cycle of AI systems.

2. The Convention applies to both the public and private sectors.

3. The state can choose to what extent it will commit itself to the private sector.

4. The Convention does not apply to scientific research, national security and defense.

5. The parties determine the list of prohibited AI systems independently.

6. The Convention does not apply to Russia, since the latter withdrew from the Council of Europe.

7. Russia could potentially be invited to sign the document, but given the current political situation, this is unlikely at the moment.

Brief background

Work on the development of a concept for regulation in the field of AI within the Council of Europe began in 2019 as part of the work Special Committee on Artificial Intelligence (CAHAI)In those distant times by modern standards, Russia was also a member of the Council of Europe. Accordingly, domestic experts also took part in the working groups.

Next, in 2022, together with CAHAI, Committee on Artificial Intelligence (CAI)which has already begun to prepare the text of the future convention. The committee included representatives of the member states of the Council of Europe, the EU, and 11 other countries (Australia, Argentina, Israel, Canada, Costa Rica, Mexico, Peru, the USA, Uruguay, the Holy See (Vatican), Japan). Representatives of the private sector, civil society and academia participated as observers.

The development of the convention largely coincided with EU legislators discussing the options for the text of the EU AI Regulation (a comprehensive law that entered into force at the European Union level on 1 August. Read more — here), so these documents were initially developed in close connection. Moreover, this convention perfectly complements the Regulation at the EU level: the convention is aimed at protecting fundamental human rights, and the regulation, although it protects fundamental rights, is to a greater extent part of the legislation on product safety.

In many ways, these acts shared a common fate in the adoption process: their final texts became significantly more lenient in relation to regulation in the area of ​​development and application of AI systems and models by the private sector.

Terminology

The Convention uses an updated version of the definition of AI systems from OECD principles:

“An AI system is a machine system that, based on input data, determines how to generate output data such as predictions, content, recommendations, or decisions that can influence a physical or virtual environment in order to achieve explicit or implicit goals. AI systems vary in their level of autonomy and ability to adapt after deployment.”

Scope of application

The Convention covers the use of AI systems at all stages of the life cycle:

1. in the public sector, including private companies acting on behalf of government bodies;

2. in the private sector.

Next comes a very important point. In relation to the private sector, two methods of applying the requirements of the convention are envisaged:

1. a state may directly assume the obligations to implement the requirements set out in the convention (in chapters II-VI);

2. the state may take other adequate measures to reduce risks in the area of ​​development and application of AI by private entities.

This voluntary nature of commitments to the private sector has been criticized by human rights activists and the academic community. Notably, this provision appears in the latest version of the draft document. More early projects provided for equal responsibilities for both the public and private sectors.

The scope of application does not include:

1. activities related to the protection of national security interests;

2. research activities concerning artificial intelligence systems, unless the testing is carried out in such a way that human rights, democracy and the rule of law may be harmed (without excluding Article 12 (safe innovation) and paragraph 2 of Article 25 (international cooperation).

3. issues related to national defense.

General Obligations (Chapter II)

Briefly, they can be described as the protection of human rights and democratic institutions.

Basic principles (Chapter III)

The Convention defines a number of basic principles:

1. Human dignity and individual autonomy;

2. Transparency and oversight (including in the context of labeling synthetic content and human interaction with the AI ​​system);

3. Accountability and responsibility (for adverse consequences);

4. Equality and non-discrimination;

5. Privacy and personal data protection.

6. Reliability (ensuring safety and proper quality);

7. Safe innovation (testing and experimenting with AI systems under the supervision of competent authorities).

Means of Ensuring the Protection of Rights (Chapter IV)

States are free to establish these at their discretion. They may include:

1. disclosure of information and documentation in cases where AI systems pose a risk to human rights (information should be provided to both authorities and other interested parties);

2. the information must be sufficient to challenge both the decision made by the AI ​​system and the very need to use the AI ​​system in this case;

3. There must be an opportunity to lodge a complaint with the competent authorities.

The means of protection must be provided with procedural guarantees.

Assessment and mitigation of risks and adverse effects (Chapter V)

To ensure the principles, States must apply measures to assess and mitigate risks and adverse effects. These measures must be proportionate and differentiated, and take into account:

1. context and intended use cases for AI systems;

2. the likelihood of potential negative consequences;

3. stakeholder opinions;

4. the need for their iterative nature throughout the entire life cycle of AI systems;

5. monitoring risks and potential negative consequences;

6. documentation of negative consequences;

7. the need to test AI systems before they are put into use and when significant modifications are required.

A very important aspect is that the convention does not define scenarios for the use of AI systems that may be banned or temporarily moratoriumed. Each party determines this if it considers such use to be incompatible with respect for human rights, the functioning of democracy or the rule of law. The absence of a list of banned AI systems has also become the basis for criticism of the document.

Application of the Convention (Chapter VI)

This chapter states that the application of the Convention must not violate human rights and their equality.

In addition, there are two interesting requirements for the parties:

1. States should seek to ensure that decisions on important AI-related issues are made with broad public participation;

2. Parties must develop digital literacy among all segments of the population to reduce potential risks from the use of AI systems.

Further cooperation and entry into force (Chapters VII and VIII)

The Parties shall exchange information and cooperate with each other. For this purpose, a Conference of the Parties shall be established, at which current issues shall be discussed and reports shall be submitted.

The parties must determine (or create) one or more bodies that will monitor the fulfillment of the obligations assumed.

The Convention shall enter into force three months after it has been duly ratified by five Parties (at least three of which must be members of the Council of Europe).

These chapters also contain other provisions that are typical of international treaties, but they are of interest mostly to lawyers, so we will not examine them in detail.

Does the convention apply to Russia?

The Convention does not apply to Russia, since it withdrew from the Council of Europe.

The document provides a mechanism that allows the parties to invite a new state, including Russia, to sign the convention. However, given the current political situation, this is unlikely at the moment.

Criticism

The convention has largely been criticized for being toothless for a number of reasons:

1. overly declarative nature and lack of specific requirements;

2. States are given the opportunity to avoid the private sector having to fully comply with their obligations;

3. voluntary nature in determining the list of prohibited AI systems;

4. unjustified exclusion from the scope of national security and defense.

You can read criticism of the European Data Protection Supervisor (EDPS) convention here.

Here is an open letter from human rights activists and civil society.

More news about AI regulation in my telegram channel howtocomply_AI: law and AI.