CanadaCouncil of Europe Framework Convention on Artificial Intelligence, signed by Canada
This is a Council of Europe treaty, not European Union law. The Council of Europe is a separate international organization, with wider and different membership than the EU.
Council of Europe Framework Convention on Artificial Intelligence and Human Rights Democracy and the Rule of Law, Council of Europe Treaty Series No. 225, opened for signature ; signed by Canada on , subject to ratification
Signed, with consent not yet expressed, dated , as of .
An AI governance rule binding public and private bodies.
- Obligation class
- Disclosure, DPIA, Governance
- Audit expectation
- continuous
- Who audits it
- Regulator, Self
- Where the report goes
- Kept
As of .
Where it has got to
The text described here is Convention text as published in the Official Journal of the European Union, L series 2026/1081, . That print is CETS 225, published .
The stage above is recorded at www.canada.ca.
The Government of Canada's release records the signing on , on the margins of the AI Action Summit in Paris. Under Article 30(3), entry into force depends on five consents to be bound, including at least three Council of Europe member States. The row carries the signature only; no Canadian instrument of ratification, acceptance or approval is shown.
What it requires
- Each Party must adopt or maintain measures for the identification, assessment, prevention and mitigation of risks posed by AI systems, considering their actual and potential impacts on human rights, democracy and the rule of law; an app operator is reached through the measures its Party adopts.NIST AI RMFMAP 5.1NIST AI RMFMANAGE 1.3
- Each Party must seek to ensure, as appropriate for the context, that persons interacting with an AI system are notified that they are interacting with such a system rather than with a human, and must adopt or maintain measures for accessible and effective remedies, as far as its international obligations require and its domestic legal system allows, including measures to ensure that information about an AI system is sufficient for affected persons to contest a decision made or substantially informed by its use.NIST AI RMFMEASURE 2.8NIST AI RMFMEASURE 3.3
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST AI RMF
- MAP 5.1Likelihood and magnitude of each identified impact (both potentially beneficial and harmful) based on expected use, past uses of AI systems in similar contexts, public incident reports, feedback from those external to the team that developed or deployed the AI system, or other data are identified and documented.
- MEASURE 2.8Risks associated with transparency and accountability – as identified in the MAP function – are examined and documented.
- MEASURE 3.3Feedback processes for end users and impacted communities to report problems and appeal system outcomes are established and integrated into AI system evaluation metrics.
- MANAGE 1.3Responses to the AI risks deemed high priority, as identified by the MAP function, are developed, planned, and documented. Risk response options can include mitigating, transferring, avoiding, or accepting.
- NIST AI 600-1
- GAI-RISK-04Data Privacy
- GAI-RISK-07Human-AI Configuration
- GAI-RISK-08Information Integrity
- NIST AI 200-2 Draft
- 2.4Synthesize & Interrogate
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-DET-021Agent Decision Audit and Explainability
- ETSI EN 304 223
- 5.1.2-1Business need and security risks written down and assessed before deciding to build an AI system.
- 5.1.3-1Threat modelling and risk management, reviewed regularly and covering AI-specific attacks.
- 5.1.3-2Threats developers cannot resolve are passed to operators and on to end-users.
- 5.3.1-1Users told where and how their data is used, accessed and stored, with developers informing operators.
- 5.3.1-2.1That guidance covers proper use, limits and likely failure modes.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
What this law does
Canada signed the Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law on , at a signing ceremony held on the margins of the AI Action Summit in Paris. Under Article 30 the Convention is subject to ratification, acceptance or approval.
It enters into force on the first day of the month following three months after five signatories, including at least three member States of the Council of Europe, have expressed their consent to be bound. As drafted, it would require each Party to adopt or maintain measures for the identification, assessment, prevention and mitigation of risks posed by artificial intelligence systems, by considering actual and potential impacts to human rights, democracy and the rule of law.
It would also require each Party to seek to ensure that persons interacting with artificial intelligence systems are notified that they are interacting with such systems rather than with a human, as appropriate for the context.
It would require each Party to ensure the availability of accessible and effective remedies for violations of human rights resulting from the activities within the lifecycle of artificial intelligence systems, to the extent its international obligations require and consistent with its domestic legal system. The Convention applies to activities within the lifecycle of artificial intelligence systems undertaken by public authorities, or private actors acting on their behalf.
Each Party must address risks and impacts arising from activities of other private actors in a manner conforming with the object and purpose of the Convention, and must specify in a declaration how it intends to do so.
When LexLint raises it
When your app profile says your app deploys a chatbot, makes high-risk automated decisions or generates content with AI.