A binding AI treaty opened for signature beyond the EU's borders

The design

On 5 September 2024, the Council of Europe, a treaty body with 46 member states plus outside signatories, opened the Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law for signature. The treaty text, designated CETS 225, requires each Party to "adopt or maintain appropriate legislative, administrative or other measures" so that AI activities across their lifecycle respect human rights, democracy, and the rule of law. The Council's own programme page describes it as the first legally binding international treaty in this field, distinct from the EU's AI Act because its membership reaches beyond the European Union.

What the evidence says

The treaty's own text draws a boundary the Council's promotional framing does not always foreground. Article 3 limits mandatory coverage to AI activities by public authorities; a Party's obligations toward private companies apply only "to the extent" the Party declares how it will meet them, and national-security and defence uses fall outside the treaty entirely. A Council of Europe press release issued the same day records the opening-ceremony signatories as Andorra, Georgia, Iceland, Norway, the Republic of Moldova, San Marino, the United Kingdom, Israel, the United States, and the European Union; the programme page's tracker later listed additional signatories including Canada, Japan, and Switzerland. Signing is not ratifying, and neither document available here confirms how many states have since ratified.

What it asks of people

The Convention binds states, not companies or individuals directly, and it asks nothing of a person using a companion app until a Party turns its obligations into domestic law. Article 30 sets the ratification threshold: entry into force requires five signatories, including at least three Council of Europe member states, to ratify, with force beginning three months later. Until then, and even after, whatever protection a companion-app user in a given country gets depends on that state's own implementing measures, not on the treaty's text directly.

Privacy and safeguards

The treaty does not itself specify data-retention rules, age-assurance measures, or crisis-response duties for conversational systems; it is a framework instrument meant to complement, not replace, existing instruments such as the Council's own data-protection convention. It creates a follow-up mechanism and international cooperation duties among Parties, but no individual complaint procedure comparable to the European Court of Human Rights. A reader should treat it as binding only on the states that ratify it, and only to the extent each state's own declaration and implementing law say so.

• Has the country where a companion-app maker operates signed, ratified, or declared how it will cover private companies under this treaty?
• What domestic law, if any, has a ratifying state passed to give the treaty's obligations concrete effect?
• Does a company's own claim of compliance with "international AI human-rights standards" specify this treaty or a different, non-binding framework?

The Framework Convention's significance lies in its reach past the EU's borders and its binding form, not in any immediate rule for a specific companion product; its actual effect on any one user still runs through whichever state ratifies it and how that state chooses to legislate.