1. March 2024: a race between international organisations to regulate AI^[1]

March 2024 has been the apex of a sort of race as to which international organisation would be the first to adopt an instrument trying to regulate the development, production, and use of artificial intelligence (AI).

On March 11, the General Assembly of the United Nations adopted unanimously a resolution entitled «Seizing the opportunities of safe, secure and trustworthy artificial intelligence systems for sustainable development»^[2]. According to the relevant UN internet page this is a «landmark resolution» presented with the following comment «Adopting a United States-led draft resolution without a vote, the Assembly also highlighted the respect, protection, and promotion of human rights in the design, development, deployment and the use of AI. The text was “co-sponsored” or backed by more than 120 other Member States. The General Assembly also recognized AI systems’ potential to accelerate and enable progress towards reaching the 17 Sustainable Development Goals. It represents the first time the Assembly has adopted a resolution on regulating the emerging field. The US National Security Advisor reportedly said earlier this month that the adoption would represent an “historic step forward” for the safe use of AI»^[3]. In my humble opinion, reading the content of the resolution is rather sobering.

According to the last paragraph (no 13.) of the Resolution, the General Assembly «Acknowledges that the United Nations system, consistent with its mandate, uniquely contributes to reaching global consensus on safe, secure and trustworthy artificial intelligence systems, that is consistent with international law, in particular the Charter of the United Nations; the Universal Declaration of Human Rights; and the 2030 Agenda for Sustainable Development, including by promoting inclusive international cooperation and facilitating the inclusion, participation and representation of developing countries in deliberations»; in paragraph no 12 the text says that it «looks forward also to the overall review by the General Assembly, in 2025, of the progress made since the World Summit on the Information Society».

Looking for more content than the UN Resolution at mid-March, it is better to take stock of the positive vote of the European Parliament – with 523 votes in favour, 46 against and 49 abstentions – on the proposed European Union Regulation of the European Parliament and of the Council on laying down harmonised rules on Artificial Intelligence (Artificial Intelligence Act) and amending certain Union Legislative Acts, on which a political deal was reached in a “trilogue” session between representatives of the European Parliament and the Council of the EU^[4]. As rightly recalled on the relevant Internet site of the European Parliament^[5], the text «is still subject to a final lawyer-linguist check and is expected to be finally adopted before the end of the legislature (through the so-called corrigendum procedure)» and «also needs to be formally endorsed by the Council». The final text wording will only be available with its publication in the EU official Journal (in May or June 2024); the AI Act project has already been the subject of a great deal of literature, including in this journal^[6].

While the institutions of the European Union were working on the regulation of AI, the Council of Europe (hereinafter CoE), which brings together all European States except for Belarus and Russia^[7], was also working on this issue. On 14 March 2024 the Council of Europe’s Committee on Artificial Intelligence (CAI) adopted a Draft Framework Convention on Artificial Intelligence, Human Rights, Democracy and the Rule of Law / Projet de Convention-cadre sur l’intelligence artificielle, les droits de l’homme, la démocratie et l’État de droit^[8] (hereafter FCIA), which will be submitted to the Committee of Ministers, which will most probably approve it, thus opening the procedure for signature or accession by the Member states of the CoE and third States^[9].

It would be wrong to say that the two organizations have worked in parallel: as the text itself shows, there has been and continues to be a great deal of interaction between the institutions of the two European organizations^[10]. This is the least that could be done, given that all 27 EU Member States are also members of the CoE, along with 19 other European States.

As indicated in the Draft Explanatory Report of the FCIA^[11], in December 2021 The Committee of Ministers of the CoE decided «to allow for the inclusion in the negotiations of the European Union and interested non-European States sharing the values and aims of the Council of Europe – States from around the globe, namely Argentina, Australia, Canada, Costa Rica, the Holy See, Israel, Japan, Mexico, Peru, the United States of America and Uruguay, joined the process of negotiations in the CAI and participated in the elaboration of this Framework Convention as observer States».

This is why the EU Council adopted on 21 November 2022 a Decision authorising the opening of EU negotiations for a Council of Europe Convention on Artificial Intelligence, Human Rights, Democracy and the Rule of Law^[12]. Some recitals of the decision are worth quoting.

«(4) The Union has adopted common rules that will be affected by the elements considered with regard to the convention. Those elements include in particular a comprehensive set of rules in the area of the single market for products and services for which AI systems can be used, as well as secondary Union legislation implementing the EU Charter of Fundamental Rights, considering that those rights are likely to be adversely affected in certain circumstances by the development and use of certain AI systems». We will see below the particularities arising from the CoE’s and the EU’s conferred powers.

Recital (5) states that the scope of application envisaged for the Convention and that of the AIA proposal overlap «to a large extent with that legislative proposal in its scope, since both instruments aim to lay down rules applicable to the design, development and application of AI systems, provided and used by either public or private entities». Also, according to recital (6): «therefore, the conclusion of the convention may affect existing and foreseeable future common Union rules or alter their scope within the meaning of Article 3(2) of the Treaty on the Functioning of the European Union (TFEU)». It is quite striking that this recital refers to Article 3(2) on the values of the Union, according to which «The Union shall offer its citizens an area of freedom, security and justice without internal frontiers, in which the free movement of persons is ensured in conjunction with appropriate measures with respect to external border controls, asylum, immigration and the prevention and combating of crime». As we shall see, the Commission proposal of 21 April 2021^[13], as well as the text approved by the European Parliament in March 2024^[14], refer only to the legal bases relating to the internal market and not to those relating to controls at the internal and external borders of the Union (Article 77(2) TFEU).

It should also be noted that the European Data Protection Supervisor (EDPS) issued a report on the draft FCIA, which is referred to in a footnote to the Council Decision, with a number of recommendations which have often been repeated in the successive versions of the draft^[15]. In his general comments, the EDPS notes that the «market-centric approach is aligned with one of the main objectives of the proposed AI Act, the single market dimension of the regulation of AI systems. […]. At the same time, the remit of the Council of Europe is much broader […] Against this background, the EDPS considers that the convention represents an important opportunity to complement the proposed AI Act by strengthening the protection of fundamental rights of all persons affected by AI systems. Accordingly, and in line with the Joint Opinion on the AI Act, the EDPS considers that safeguarding the rights of individuals and groups of individuals subject to the use of AI systems should be given greater prominence among the general objectives for the negotiation of the convention»^[16]. As we will see, the FCIA has included specific provisions for the European Union since the December 2023 version, which are clearly the result of the Commission’s involvement in the negotiations.

The aim of this paper is to highlight the advantages and disadvantages of a CoE treaty, such as the FCIA, as opposed to an EU regulation, such as the so-called “Artificial Intelligence Act”. The content of the FCIA will therefore be presented only briefly, a text of which Lorenzo Cotino Hueso rightly says that «the Convention puts the lyric to the prose that is the AIA. The AIA establishes the foundations and structures of a safe and trusted AI ecosystem, the Convention focuses on its impact on people and democratic society. The AIA is methodical, detailed and precise, charting a clear path through technical and legal complexity, setting firm standards and concrete obligations for providers and users or implementers of AI systems. In contrast, on the lyrical side, the Convention rises to normatively integrate the fundamental values, ethical principles and human rights that should guide the evolution of AI»^[17].

2. The content of the Council of Europe’s draft Framework Convention

Chapter II of the FCIA is devoted to «General Obligations». According to Article 4, «Each Party shall take or maintain the necessary measures to ensure that activities within the life cycle of artificial intelligence systems are consistent with its obligations to protect human rights, as reflected in applicable international and domestic law». This implies not only the adoption of the necessary regulations and legislation (which, for EU Member States, is partly covered by the AIA, which is a directly applicable instrument), but also the necessary human and budgetary resources, training, and information measures. This being said, as indicated in the Draft Explanatory Report^[18] «This is an obligation of result and not an obligation of means. In this respect, the principle of subsidiarity is essential, putting upon the Parties the main responsibility to ensure respect for human rights and to provide for redress for violations of human rights».

Article 5 specifies that these are «measures that seek to ensure that artificial intelligence systems are not used to undermine the integrity, independence and effectiveness of democratic institutions and processes, including the principle of separation of powers, respect for judicial independence, and access to justice» and that «Each Party shall adopt or maintain measures that seek to protect its democratic processes in the context of activities within the lifecycle of artificial intelligence system, including individuals’ fair access to and participation in public debate, as well as their ability to freely form opinions».

The FCIA establishes the obligation to take measures with regard to the «Integrity of democratic processes and respect for the rule of law» (Article 5) as well as «Human dignity and individual autonomy» (Article 7). As we will see below, FCIA is part of the CoE’s core mission, which is to protect, primarily through binding legal instruments, human rights, and the rule of law in a democratic society, as laid down in the Statute of the Council of Europe and the ECHR.

Chapter III is devoted to the «Principles related to activities within the lifecycle of artificial intelligence systems», which «sets forth general common principles that each Party shall implement in regard to artificial intelligence systems in a manner appropriate to its domestic legal system and the other obligations of this Convention» (Article 6). These are «Human dignity and individual autonomy» (Article 7); «Transparency and oversight» (Article 8); «Accountability and responsibility» (Article 9); «Equality and non-discrimination» (Article 10); «Privacy and personal data protection» (Article 11) «Reliability» i.e., «measures to promote reliability of artificial intelligence systems and trust in their outputs, which could include requirements related to adequate quality and security throughout the lifecycle of artificial intelligence systems»; and «Safe innovation» i.e., «is called upon to enable, as appropriate, the establishment of controlled environments for developing, experimenting and testing artificial intelligence systems under the supervision of its competent authorities» (Article 13).

As Cotino rightly says, «The Convention not only has a symbolic and meta-legal value, but is also a normative instrument, with the capacity for quasi-constitutional integration into the legal systems of the States Parties and has great interpretative potential. This is why the IA Convention surpasses dozens of declaratory and soft law instruments that were already superfluous, innocuous and even tedious»^[19].

Chapter IV is devoted to «remedies» and «procedural safeguards». These are obligations of States Parties, not a system of remedies at the CoE level, as we will see below. Chapter V deals with «Assessment and Mitigation of Risks and Adverse Impacts».

Chapter VI is devoted to «Implementation of the Convention», with recurrent provisions in recent CoE instruments, concerning non-discrimination (Article 17), Rights of persons with disabilities and of children (Article 18), public consultation (Article19), safeguard for existing human rights (Article 21), and wider protection (Article 22). Article 20 «Digital literacy and skills» is more specific to AI: «Each Party shall encourage and promote adequate digital literacy and digital skills for all segments of the population, including specific expert skills for those responsible for the identification, assessment, prevention and mitigation of risks posed by artificial intelligence systems».

Chapter VII is devoted to «Follow-up mechanism and co-operation». As for Chapter VIII on the final clauses, it is significant that only five States are required to ratify, of which at least three must be members of the CoE, which shows the intention to activate the IA Convention as soon as possible.

As Cotino rightly says «Although in general the IA Convention is not characterised by clear-cut specific obligations and rights, there are several reasons to take it normatively into account. […] I consider relevant the regulation in the IA Convention of general ‘principles’ applicable to all IA systems. In this regard, it is worth recalling that for years, among dozens of declarations and documents, some essential ethical principles of AI have been made visible and distilled. Harvard analysed more than thirty of the main international and corporate declarations on AI ethics and synthesised them into privacy, accountability, security, transparency and explainability, fairness and non-discrimination, human control, professional responsibility, human values, and sustainability. The future Convention is positive in that it goes beyond declarations in the realm of soft law and regulates these principles, if I may say, it moves from the muses of ethics to the theatre of law. […] However, there are some concrete elements of the Convention that may go somewhat beyond the AIA and EU law»^[20].

Finally, it is necessary to present the specific provisions resulting from the EU Commission’s involvement in the negotiations, which we will discuss in section 5, on the particularities of signing and ratifying CoE treaties as opposed to adopting an EU regulation or directive; these are two provisions.

First, According to Article 27 – Effects of the Convention:

«1. If two or more Parties have already concluded an agreement or treaty on the matters dealt with in this Convention or have otherwise established their relations on such matters, they shall also be entitled to apply that agreement or treaty or to regulate those relations accordingly, so long as they do so in a manner which is not inconsistent with the object and purpose of this Convention.

2. Parties which are members of the European Union shall, in their mutual relations, apply European Union rules governing the matters within the scope of this Convention, without prejudice to the object and purpose of the present Convention and without prejudice to its full application with other Parties. The same applies to other Parties to the extent that they are bound by such rules».

The version proposed prior to the last CAI meeting in March 2024 also contained a specific provision for the EU in Article 29 – Dispute settlement: «In the event of a dispute between Parties as to the interpretation or application of this Convention which cannot be resolved by the Conference of the Parties, as provided for in Article 24, paragraph 1, e, they shall seek a settlement of the dispute through negotiation or any other peaceful means of their choice. The European Union and its members States in their relations with each other shall not avail themselves of Article 29 of the Convention. Nor shall the member States of the European Union avail themselves of that Article of the Convention insofar as a dispute between them concerns the interpretation or application of European Union law»^[21]. The last two sentences were not included in the version adopted on March 14; they were in fact a reminder of well-known principles of EU law. As we shall see, these provisions should be understood in the light of a possible provision on reservations to the Convention.

3. The Case for a Council of Europe Treaty on Artificial Intelligence

The Council of Europe (CoE) was established by the Treaty of London on 5 May 1949. This treaty was signed by 10 European States and became effective on 3 August 1949. It is the oldest of the organisations created after the Second World War with the aim of bringing together European countries that share the values of liberal democracy. According to Article 1 of its Statute, the aim of the CoE is to achieve «greater unity among its members in order to safeguard and realise the ideals and principles which constitute their common heritage», including the «rule of law» (prééminence du droit), and «to facilitate their economic and social progress». One of the primary objectives of the CoE is the protection of human rights, which led its institutions to prepare the Convention for the Protection of Human Rights and Fundamental Freedoms (ECHR), which was signed on 4 November 1950 in Rome and entered into force on 3 November 1953 after being ratified by eight member States; for Spain it was 24 November 1977. The Russian Federation ceased to be a member of the CoE on 16 March 2022, following Russia’s military aggression against Ukraine. Belarus has never been a full member of the CoE, as it has not signed the ECHR. Its participation in CoE working groups has also been suspended: on 17 March 2022, the CoE suspended relations with Belarus due to the country’s “active participation” in the Russian invasion of Ukraine. Neither Russia nor Belarus has been represented in the Ad Hoc Committee on Artificial Intelligence (CAHAI) established on 11 September 2019 and, of course, even less in its successor since January 2022, the Committee on Artificial Intelligence (CAI).

The mandate of the CAI^[22] was adopted for the period from 1 January 2022 until 31 December 2024 in the framework of the programme “Effective implementation of the ECHR”, which explains the FCIA’s focus on rule of law and human rights. The mandate was adopted under the authority of the Committee of Ministers (CoM), in which CoE member States are generally represented by their Permanent Representative in Strasbourg, exceptionally by their Foreign Ministers. The CoM may adopt resolutions and, in particular, recommendations to the governments of the Member States, notably on the follow-up to be given to judgments of the European Court of Human Rights, which are binding on States (ECHR Article 46). The CoE Statute specifies the voting procedures (Article 20). They range from a majority of representatives with unanimity of the votes cast for the most important questions, to a majority of representatives with a two-thirds majority of the votes cast for most resolutions, to a simple majority for questions relating to the Rules of Procedure or the financial and administrative rules.

The Committee instructed the CAI^[23] to «take account of the relevant key findings and challenges set out in the Secretary General’s 2023 Report on the State of democracy, human rights and rule of law ‘An Invitation to Recommit to the Values and Standards of the Council of Europe’». The aim was to «establish an international negotiation process and conduct work to finalise an appropriate legal framework on the development, design, use and decommissioning of artificial intelligence, based on the Council of Europe’s standards on human rights, democracy and the rule of law and other relevant international standards, and conducive to innovation, which can be composed of a binding legal instrument of a transversal character, including notably general common principles, as well as additional binding or non-binding instruments to address challenges relating to the application of artificial intelligence in specific sectors, in accordance with the relevant decisions of the Committee of Ministers». It was also to «maintain a transversal approach, also by co-ordinating its work with other intergovernmental committees and Council of Europe’s entities equally addressing the implications of artificial intelligence in their respective field of activity, by providing these committees and entities with guidance in conformity with the legal framework under development and by assisting them in resolving problems;», as well as «base the work on strong evidence and an inclusive consultation process, including with international and supranational partners, to ensure a global view of the subject;». Finally, the aim was to «contribute to the achievement of, and review progress towards, the UN 2030 Agenda for Sustainable Development, in particular with regards to Goal 5: Gender Equality, Goal 16: Peace, Justice and Strong institutions».

As summarised by Cotino «this mandate had a clear intention to transcend borders, seeking to create an ‘instrument attractive not only to the States of Europe but to the largest possible number of States from all regions of the world’, involving ‘Observers’ such as Israel, Canada, the United States, Japan, the Global Partnership on Artificial Intelligence (GPAI), Internet companies, and civil society organisations»^[24].

According to Article 30(1) of the FCIA, «1. This Convention shall be open for signature by the member States of the Council of Europe, the non-member States which have participated in its elaboration and the European Union». Let us recall that the European Union is party to several CoE treaties, such as the Istanbul Convention on preventing and combating violence against women and domestic violence as of 1 January 2023, and that EU accession to the ECHR is provided for in Article 17 of Protocol 14 to the ECHR, amending the monitoring system of the Convention and Article 16 TFEU.

According to Article 31(1) of the FCAI «1. After the entry into force of this Convention, the Committee of Ministers of the Council of Europe may, after consulting the Parties to this Convention and obtaining their unanimous consent, invite any non- member State of the Council of Europe which has not participated in the elaboration of the Convention to accede to this Convention by a decision taken by the majority provided for in Article 20.d of the Statute of the Council of Europe, and by unanimous vote of the representatives of the Parties entitled to sit on the Committee of Ministers». There are several CoE treaties to which non-European States have acceded: for example, Canada, Chile, Costa Rica, the Holy See, Japan, Mexico, the United States, and the United States are often invited. As for the CoE Convention on Laundering, Search, Seizure and Confiscation of the Proceeds from Crime and on the Financing of Terrorism (CETS No. 198), Morocco, which has also been invited, is the only non-member State to have ratified it. Although it ceased to be a member of the CoE in 2022, the Russian Federation remains a party to several conventions, which it has not denounced, unlike the ECHR.

In my view, the two main reasons for drafting a CoE treaty on artificial intelligence were to have a common text for all European States, including the UK after Brexit, and to participate in the global race to be the first to adopt a regulation on artificial intelligence, in the hope of serving as a model at least for pluralistic democracies.

For example, one can read on the CoE’s Artificial Intelligence news page^[25]: «On 5 and 6 March 2024, the Artificial Intelligence Unit of the Council of Europe participated in the OECD – African Union (AU) Artificial Intelligence (AI) Dialogue sponsored by the government of the United Kingdom (UK) and taking place at the OECD Headquarters in Paris to present the work of the Committee on Artificial Intelligence (CAI).

The event brought together members of the AU Commission (Algeria, Cameroon, Republic of Congo, Djibouti, Egypt, Ethiopia, Kenya), the AU AI Working Group and invited experts, including from other international organisations with complementary mandates on AI to discuss the AU’s Artificial Intelligence Continental Strategy for Africa, AI governance, fostering collaboration, and addressing shared challenges.

Ms Louise Riondel, Co-Secretary to the CAI, participated in the session entitled “The international perspective: from global initiatives to global governance”, during which she presented the Council of Europe’s activities on AI, and more specifically the work of the CAI as regards the Framework Convention on AI and the Methodology for the risk and impact assessment of AI systems (HUDERIA)». This is just one of the many activities of the Council of Europe in the field of artificial intelligence since 2019, which can easily be found on its website^[26].

An additional reason was obviously to try to propose a text that could be adopted by a large number of other States, including the United States of America. The participation of the latter in the negotiations, in particular for the last meeting of the CAI from 11 to 14 March 2024, had however the effect of reducing its scope of application, in particular because it was eventually decided that the Framework Convention would not apply to the private sector. Of course, this in no way prevents a party to the future Convention from adopting more inclusive legislation, as will be the case for EU Member States through the AIA.

4. The instrument of a CoE Framework Convention as opposed to the instrument of an EU Regulation

As mentioned above, the instrument used by the CoE to regulate artificial intelligence is a framework convention i.e., an international treaty known as the Framework Convention on Artificial Intelligence, Human Rights, Democracy and the Rule of Law, while the EU uses a regulation known as the Regulation of the European Parliament and of the Council on harmonised rules in the field of artificial intelligence (Artificial Intelligence Act) and amending certain legislative acts of the Union.

It may be stressed that the terms “Artificial Intelligence Act”, used in brackets in the title of the AIA versions of the draft published by the European Commission on 21 April 2021 – and in the versions adopted by the European Parliament on 13 March 2024 – is incorrect from a legal point of view for the Dutch, German, Italian, or Spanish versions, for instance as it says “wet, Gesetz, legge, ley”, which means law in the sense of statute. The reason is that a “European law” does not exist as an instrument of EU law, as the new categorisation of Union acts contained in the Constitutional Treaty of 24 October 2004 – which, as is well known, did not enter into force because it had not been ratified by all the member States – has not been incorporated into the Treaty of Lisbon. The Portuguese version simply says Regulamento i.e. Regulation; the French version Législation is also more correct than the Dutch, German, Italian, or Spanish versions because it is a legislative act (i.e. adopted by a legislative procedure); the English version Artificial Intelligence Act may also be considered as correct, since the regulation is a legal act of the Union within the meaning of Article 288 TFEU; likewise the Danish version uses the word Retsakten, which means “legal act”.

In recent years, it seems that the Commission services tend not to be fussy about the titles of proposed secondary legislation and adopt more of a marketing attitude, using terms that address a non-legal audience; it is also true that the use of English as the main language in institutional praxis – although the 24 official and working languages mentioned in Article 55 TEU and Regulation 1/58 have the same legal value – allows some ambiguity to be maintained, given that in the UK a law is called an Act of Parliament. In fact, the English language word that best corresponds to the Dutch, German, Italian or Spanish words wet, Gesetz, legge, ley is “statute”. It should be noted that, unlike in the proposed AIA or the proposed “European Media Freedom Act”, in the so-called “Digital Markets Act” and “Digital Services Act” the title in brackets uses the word Regulation in most languages, except in German, where the term Gesetz is used, like for the AIA.

CoE law is simpler from this formal point of view: there is no legal difference between a Convention, a Framework Convention, an Agreement, a Protocol, an Arrangement or even a Charter, such as the European Social Charter, as well as Statute; they are all treaties in the sense of public international law. Furthermore, there are only two official languages of the CoE: English and French. At the beginning of March 2024, out of a total of 226 CoE agreements signed there are three “framework” conventions: the Framework Convention for the Protection of National Minorities of 01/02/1995 (ETS n° 157) and the Framework Convention on the Value of Cultural Heritage for Society of 27/10/2005 (STCE n° 199) to which one may add the European Outline Convention on Transfrontier Co-operation between Territorial Communities or Authorities of 21/05/1980 (ETS n° 106) the French title of which is Convention-cadre européenne sur la coopération transfrontalière des collectivités ou autorités territoriales,. According to the CoE’s Directorate-General for Democracy and Human Dignity, «the sole difference between «conventions» and «agreements» is the form in which a State may express its consent to be bound. Agreements may be signed with or without reservation as to ratification, acceptance, or approval. Conventions may, in principle, be ratified»^[27]. As a matter of fact, this indication is also not accurate, since it is the domestic law of each State that determines whether ratification is necessary or whether a simple signature is possible in order to bind the State in question. According to the Explanatory Report of the Framework Convention on the Value of Cultural Heritage to Society, for example, «it is a framework Convention that sets out principles and broad fields of action agreed upon by States Parties». However, there are other CoE treaties that state the same; the Draft explanatory report to the FCIA^[28] does not contain such a statement, and to my view that is better. Similarly, the fact that non-members of the CoE can join is not a specific feature of framework convention. Indeed, reference should be made to recital 11 of the FCIA, according to which «Recognising the framework character of the Convention which may be supplemented by further instruments to address specific issues relating to the activities within the lifecycle of artificial intelligence systems».

As is well known, the differences between a CoE Treaty and an EU Regulation are essentially due to the fact that the former is binding only on the States that have signed it, and ratified it, where appropriate, while the latter is binding on all EU Member States, unless there is an exceptional derogation, usually temporary – or based on the protocols relating to Ireland and Denmark (and the UK before Brexit). In addition, there are major differences due to the fact that the EU’s competences are much more precisely defined and therefore more limited than those of the CoE.

5. The limits deriving from the respective competences of the Council of Europe and the European Union

In order to avoid errors in the comparison between CoE conventions and EU directives, regulations or decisions, legal experts are best placed to explain the origin of certain wordings. There is a first essential difference between CoE and EU action, namely the way in which the competences of the two organisations are laid down and framed.

International organisations do not possess a general power to act; unlike a sovereign State – whose competences are limited only by its obligations under international agreements it has approved – the competences of an international organisation are limited to those conferred upon it in the treaty that establishes it, in accordance with the principle of conferral which applies to all intergovernmental organisations and which is explicitly mentioned in the EU treaties since the Lisbon Treaty.

According to Article 1 of the CoE Statute:

«a. The aim of the Council of Europe is to achieve a greater unity between its members for the purpose of safeguarding and realising the ideals and principles which are their common heritage and facilitating their economic and social progress.

b. This aim shall be pursued through the organs of the Council by discussion of questions of common concern and by agreements and common action in economic, social, cultural, scientific, legal, and administrative matters and in the maintenance and further realisation of human rights and fundamental freedoms.

c. Participation in the Council of Europe shall not affect the collaboration of its members in the work of the United Nations and of other international organisations or unions to which they are parties.

d. Matters relating to national defence do not fall within the scope of the Council of Europe».

In short, the only substantial limit to the CoE’s competences is the exclusion of matters relating to national defence.

As far as the European Union is concerned, a number of provisions should be taken into account: Article 5(2) TEU which states that «Under the principle of conferral, the Union shall act only within the limits of the competences conferred upon it by the Member States in the Treaties to attain the objectives set out therein. Competences not conferred upon the Union in the Treaties remain with the Member States». It must be supplemented by Article 2(6) TFEU which states that «The scope of and arrangements for exercising the Union’s competences shall be determined by the provisions of the Treaties relating to each area». This latest wording, introduced by the Treaty of Lisbon, merely puts in black on white what was already clear in the Treaty establishing the European Coal and Steel Community of 1951 and in the Treaties of Rome of 1957.

When an initiative for EU action is envisaged, the first task of the legal experts in the Commission, the Council and the European Parliament is to check whether there is a legal basis for such action in the treaties. If not, there is a substantial risk that the acts adopted will be challenged and, sooner or later, annulled by the Court of Justice. A legal basis consists of one or more provisions of the treaties which have the following elements.

First, the action envisaged must fall within an area for which competence has been conferred on the Union. For example, the internal market (Articles 26 and 27 TFEU, as well as 114 and 115, among others), monetary policy (Articles 127 et seq. TFEU), environmental policy (Articles 191 et seq. TFEU), etc. In some cases, competence is conferred implicitly and can be deduced by combining different elements of the “treaty system” as often said by the Court of Justice.

Second, action can only be taken to achieve the Union’s objectives. These are sometimes specifically mentioned together with the provision referring to the scope of action (e.g. Article 191 TFEU for monetary policy); otherwise, they are derived from the more general objectives of Article 3 TEU. Usually, the objectives are set out in carefully chosen wording that sets limits to the policy choices that can be made in the exercise of the competences conferred by the Member States on the Union. In reviewing the legality of secondary legislation, the Court of Justice checks whether its provisions are consistent with the objectives set out in the Treaties and, if not, annuls the act in question.

Thirdly, only the type of act specified in the relevant provision may be acted upon. The articles of the Treaties often specify whether directives, or regulations, or decisions are to be used, or leave the choice between different acts; alternatively, in many cases they leave a wider margin of choice with the use of the word “measures” (for example, for the internal market, Articles 114 (measures) TFEU and 115 (directives). In any case, even when the word “measures” is used, they can only take the form of acts provided for in the Treaties, as is clear from Article 288 TFEU.

Fourth, in order to constitute a legal basis, the relevant provisions must specify the procedure to be followed by the institutions. For the adoption of legislative acts, reference is made to the ordinary legislative procedure, the details of which are specified in Article 294 TFEU, or a special legislative procedure is explicitly indicated (for example, Arts. 114 and 115 TFEU). For non-legislative acts, the procedure to be followed is specified in each case in the relevant Treaty provision (for instance Article 108 and 109 TFEU for State aid control). If the relevant legal bases for the envisaged action do not provide for a type of act that the institutions would wish to use – for example, a regulation instead of a directive; Article 352 TFEU allows such an act to be adopted by a specific procedure requiring a unanimous decision of the Council and the approval of the EP. By contrast, Article 352 cannot be used for action in an area not attributed to the EU. In addition, secondary legislation provides the legal basis for subsequent implementing acts to be adopted by the institutions, bodies, offices and agencies of the Union and, where appropriate, by the authorities of the Member States. These implementing acts must comply with the provisions of the relevant secondary legislation and, in the first instance, with the objectives set out in the enacting terms of the Union act or in its introductory recitals.

It is essential to take the above into account in order to understand the legal framework applicable to artificial intelligence in EU acts. Indeed, given the substantial number of proposed Commission acts and communications relating to digitisation and AI that have been published in recent years, there is a risk of forgetting the limits that the principle of conferral imposes on the EU institutions.

A typical example is the Ethical guidelines on the use of artificial intelligence (AI) and data in teaching and learning for educators published by the Commission on 25 October 2022^[29]. Reading this document, as well as the description of the so-called European Education Area^[30], it seems as if the European Commission acts somewhat like a European Ministry of Education and Universities. Among other things, the page on European Education Area explains that «The idea to create a European Education Area was first endorsed by European leaders at the 2017 Social Summit in Gothenburg, Sweden. The first packages of measures were adopted in 2018 and 2019. […] In September 2020, the Commission outlined its renewed vision for the European Education Area and the concrete actions to achieve it in a Commission Communication. The Council of the EU responded with the February 2021 Resolution on a strategic framework for European cooperation in education and training for the period 2021-2030».

Those unfamiliar with EU legislation might expect EU legislation relating in fact to education. However, Article 165 TFEU, the only possible legal basis for such action, specifies that the ordinary legislative procedure shall be used for the adoption of «incentive measures, excluding any harmonisation of the laws and regulations of the Member States», which drastically reduces the Union’s competences in this area. It is true that Member States remain free to give a certain legal effect to the so-called soft law documents adopted by the institutions. However, such a reference does not mean that a binding instrument of EU law applies.

Differently, the text of the CoE Statute is very straightforward in its application, compared to the acrobatics involved in finding an adequate legal basis in EU law and ensuring that the act does not go beyond what the principle of conferral allows.

As underlined in the Explanatory Memorandum to the Commission’s proposal^[31] «The legal basis for the proposal is in the first place Article 114 of the Treaty on the Functioning of the European Union (TFEU), which provides for the adoption of measures to ensure the establishment and functioning of the internal market.

This proposal constitutes a core part of the EU digital single market strategy. The primary objective of this proposal is to ensure the proper functioning of the internal market by setting harmonised rules in particular on the development, placing on the Union market and the use of products and services making use of AI technologies or provided as stand-alone AI systems. Some Member States are already considering national rules to ensure that AI is safe and is developed and used in compliance with fundamental rights obligations. This will likely lead to two main problems: i) a fragmentation of the internal market on essential elements regarding in particular the requirements for the AI products and services, their marketing, their use, the liability and the supervision by public authorities, and ii) the substantial diminishment of legal certainty for both providers and users of AI systems on how existing and new rules will apply to those systems in the Union. Given the wide circulation of products and services across borders, these two problems can be best solved through EU harmonizing legislation.».

To be more precise, according to Article 114(2) TFEU: «The European Parliament and the Council shall, acting in accordance with the ordinary legislative procedure and after consulting the Economic and Social Committee, adopt the measures for the approximation of the provisions laid down by law, regulation or administrative action in Member States which have as their object the establishment and functioning of the internal market»; one has to add to the procedure the limits due to the achievement of the objectives set out in Article 26(2) TFEU on the internal market: «The internal market shall comprise an area without internal frontiers in which the free movement of goods, persons, services and capital is ensured in accordance with the provisions of the TFEU and in which the free movement of goods, persons, services and capital is guaranteed in accordance with the provisions of the Treaties».

The Explanatory Memorandum adds that «In addition, considering that this proposal contains certain specific rules on the protection of individuals with regard to the processing of personal data, notably restrictions of the use of AI systems for ‘real-time’ remote biometric identification in publicly accessible spaces for the purpose of law enforcement, it is appropriate to base this regulation, in as far as those specific rules are concerned, on Article 16 of the TFEU». The latter Article provides that «1. Everyone has the right to the protection of personal data concerning them. – 2. The European Parliament and the Council, acting in accordance with the ordinary legislative procedure, shall lay down the rules relating to the protection of individuals with regard to the processing of personal data by Union institutions, bodies, offices and agencies, and by the Member States when carrying out activities which fall within the scope of Union law, and the rules relating to the free movement of such data. Compliance with these rules shall be subject to the control of independent authorities».

It is striking that among the documents cited in the appendix to the Explanatory Memorandum, there is an Annex IX «Union legislation on large-scale IT systems in the area of Freedom, Security and Justice», which refers to the Regulation of 30 November 2017 establishing an Entry-Exit System (EES)^[32]. The legal bases for this Regulation are Article 77(2)(b) and (d) TFEU Article 87(2 a). The relevant provisions of Article 77 relate to «the checks to which persons crossing external borders are subject;» and «any measure necessary for the gradual establishment of an integrated management system for external borders»; Those of Article 87 relate to «the collection, storage, processing, analysis and exchange of relevant information» in the field of police cooperation. Since these legal bases are using the ordinary legislative procedure, like Articles 16 and 114 TFEU, one may wonder why Articles 77 and 87 are not also cited in the Commission’s proposal of an AI Act.

On the other hand, Article 87(3) TFEU provides that for measures for operational cooperation between «police, customs and other specialised law enforcement services in relation to the prevention, detection and investigation of criminal offences», the Council shall act unanimously after consulting the European Parliament. And Article 77(3) provides that the Council, «may adopt provisions concerning passports, identity cards, residence permits or any other such document. The Council shall act unanimously after consulting the European Parliament». An EU act cannot be based on provisions that use different procedures for their adoption. This is probably why the Commission has avoided citing these two articles, which apply, among other things, to the system of governance of AIA provisions. The problem is that, therefore, the AI Regulation may not apply to the kind of measures contemplated by Articles 77(3) and 87(3), for lack of an appropriate legal basis. Therefore, there may be quite some litigation generated by the application of the AI Act.

To all those who criticise the Commission’s draft for not being broad enough on IA and for giving too much weight to data protection, it suffices to remind them of what has just been explained. In particular, Article 114 TFEU requires a link to be found with the internal market i.e., the four freedoms of movement, and also it does not allow the adoption of a text binding on the EU institutions, but in theory only allows the adoption of a text binding on the Member States, albeit being used for the establishment of a number of agencies. In contrast, Article 16 TFEU does clearly allow to apply to both EU institutions and Member States. This explains why, unlike the GDPR which is based on Article 16 TFEU, Regulation (EC) No 1049/2001 of 30 May 2001 applies only to the institutions, bodies, offices and agencies of the Union and not to the Member States. The latter Regulation is based on Article 15 TFEU (ex-Article 255 TEC), last sentence, which provides that «The European Parliament and the Council shall ensure publication of the documents relating to the legislative procedures under the terms laid down by the regulations referred to in the second subparagraph».

It is therefore not surprising that the recitals and provisions of the AIA that directly affect public authorities are extraordinarily complex.

6. The need for ratification of the Council of Europe treaty as opposed the direct applicability of the EU regulation

Unlike EU directives, regulations, and decisions of a general nature, which in principle apply directly to all member States, CoE treaties only apply to States that have signed and ratified them if their Constitution so requires.

The ECHR is the CoE’s most important instrument in general terms, starting with the rule of law, fundamental rights and freedoms and democracy. Unlike its other conventions and agreements – including the additional protocols to the ECHR – accession to the ECHR is binding on all CoE member States, making it binding on all forty-six CoE States and thus on all EU member States. On the other hand, FCIA, as is normally the case with CoE treaties, will only be binding on those States that have ratified it, as it follows from Article 30(3) that only five States are required to ratify, of which at least three must be CoE members.

Unless otherwise specified, States Parties may make reservations or declarations to CoE Conventions at the time of signature or when depositing the act of ratification. The object and effect of a reservation or declaration may be to specify how a treaty is to be applied in relation to a State Party. Reservations of a general nature are not permitted in respect of the ECHR; a reservation may only be made in respect of a particular provision of the Convention «to the extent that a law for the time being in force in its territory is not in conformity with that provision». The draft FCIA provides in Article 34 «No reservations may be made in respect of any provision of this Convention» with a single exception provided for in Article 33 concerning federal States, which might be necessary for States that are not members of the CoE, such as the United States of America or Canada in particular. It may be assumed that the provisions of Article 27 – Effects of the Convention relating EU Member States are intended to avoid reservations by the EU or its member States.

The ECHR is directly applicable in most Parties. Direct application means that the Convention can be invoked before all national courts. This means that the institutions of the State concerned – legislature, administration, and judiciary – are bound to respect the Convention, but that it may be more complicated for an individual to enforce the rights guaranteed by the Convention. The case of FCIA is more delicate. On the one hand, it will have to be determined to what extent its provisions are sufficiently precise to be considered self-executing, which will vary from one State Party to another. In particular, there are States where the courts themselves rule on the interpretation of a treaty, and others where they request an interpretation from the Ministry of Foreign Affairs. In addition, there are States where the Constitution explicitly considers treaties to be superior to the law, and others where the question is not settled. This will lead to a far from uniform application of the provisions of the FCIA, especially as, unlike the ECHR or the Charter of Social Rights, it does not provide for a judicial body such as the European Court of Human Rights or a quasi-judicial body such as the European Committee of Social Rights to settle disputes arising from its application.

That said, both the Court and the Committee refer in their jurisprudence to all relevant instruments of the CoE, as well as to other instruments of international law as useful context for the exercise of their jurisdiction.

7. By way of conclusion

As a conclusion on the possible impact of the CoE’s binding law about AI, it should be added that the case law of the European Court of Human Rights is set to evolve on the subject discussed in this paper. A first sign of this is the dissenting opinion of Judge Darian Pavli on the judgment of 4 June 2019 in case 39757/15 Sigurður Einarsson and Others v. Iceland^[33] concerning the investigation of possible criminal acts linked to the financial crisis and, if appropriate, the prosecution of the persons concerned who are members of the management bodies of one of the largest Icelandic banks, Kaupþing banki.

In the view of the majority of the Chamber, despite frequent complaints to the prosecutor about the lack of access to documents, at no time do the applicants appear to have formally requested a court to grant access to the “full collection of data” or to carry out further investigations, or to have suggested further investigative steps – for example, a new search using keywords suggested by them. In this regard, the Irish Supreme Court notes the Government’s submission that the evidence before its Court of First Instance included a general description of the objects seized and their approximate contents. In these circumstances, and bearing in mind that the applicants did not provide any details as to the type of material they were seeking, the European Court is satisfied that the lack of access to the data in question was not such as to deprive the persons concerned of a fair trial in general.

Judge Pavli, in paragraph 21 of his opinion, said: «With respect, this argument severely underestimates, in my view, the complexities of analysing large and interconnected amounts of investigative data, whether one is equipped with “merely” human intelligence or aided by artificial intelligence».

One swallow does not make a summer, but it is very likely that the Strasbourg Court will increasingly have to rule on issues relating to the use of artificial intelligence systems, as it did on data protection, where it relied in particular on Article 8 ECFR on the Right to respect for private and family life, and that it will take due account of the FCIA, as well as the AIA and national laws and regulations, in constructing its jurisprudence.

1. The author is presently “Visiting Professor di chiara fama” at Ca’ Foscari University in Venice. Some of the ideas in this paper were presented, in Spanish language, at a Conference held in Valencia, Spain, on El Reglamento Europeo de Inteligencia Artificial (Obligaciones de registro y transparencia algorítmica para los poderes públicos), on 27-28 November 2023, at: http://www.derechotics.com/congresos/60-congresos/230-aia2023. ↑
2. Draft Resolution of the General Assembly of the United Nations of 11 March 2024 on Seizing the opportunities of safe, secure and trustworthy artificial intelligence systems for sustainable development, https://digitallibrary.un.org/record/4040897?ln=en&v=pdf (consulted on 19/04/2024). ↑
3. https://news.un.org/en/story/2024/03/1147831. ↑
4. https://www.europarl.europa.eu/news/en/press-room/20231206IPR15699/artificial-intelligence-act-deal-on-comprehensive-rules-for-trustworthy-ai (consulted on 19/04/2024). ↑
5. https://www.europarl.europa.eu/news/en/press-room/20240308IPR19015/artificial-intelligence-act-meps-adopt-landmark-law (consulted on 19/04/2024). ↑
6. E. Faletti, L’Artificial Intelligence Act Proposal e la regolamentazione degli algoritmi predittivi: luci e ombre, in CERIDAP, 4, 2023, pp. 173-217. ↑
7. The Vatican City State has the personality of a sovereign body under public international law, distinct from the Holy See (i.e. the head of the Roman Catholic Church), and enjoys universal recognition, but it has a special nature which explains that, in addition to the Organisations in which the Holy See participates as a permanent observer, such as the CoE, the Vatican City State is a member of only a few IOs, such as the Universal Postal Union (UPU), the International Telecommunications Union (ITU), the International Atomic Energy Agency (IAEA) and the World Tourism Organisation (UNWTO). V. https://www.vaticanstate.va/it/stato-governo/note-generali/origini-natura.html. ↑
8. https://rm.coe.int/-1493-10-1b-committee-on-artificial-intelligence-cai-b-draft-framework/1680aee411 / https://rm.coe.int/-1493-10-1b-comite-sur-l-intelligence-artificielle-cai-b-projet-de-con/1680aee410 (consulted on 19/04/2024). The text published by the CoE on 8 January 2024 still contained options to be discussed at the last meeting of the IAC on 11-14 March. The text adopted at this meeting has been made public only at mid-April and has been circulating on social media since 19 March. It will then be submitted to the Committee of Ministers, which has the final say, so it is not excluded that there will be further changes at this stage. A Draft explanatory report has also been published https://rm.coe.int/-1497-10-1b-committee-on-artificial-intelligence-cai-b-draft-framework-convention/1680af0734&format=native / https://rm.coe.int/-1497-10-1b-comite-sur-l-intelligence-artificielle-cai-b-projet-de-convention/1680af0733&format=native (consulted on 19/04/2024). ↑
9. On 18 April, the Parliamentary Assembly of the Council of Europe unanimously approved the draft “Convention on Artificial Intelligence, Human Rights, Democracy and the Rule of Law”, albeit regretting the public-private imbalance of the draft. https://pace.coe.int/en/verbatim/2024-04-18/pm/en. ↑
10. See for example the CoE news of 12 October 2023 «“Secretary General Marija Pejčinović Burić met with European Commissioner for Justice Didier Reynders. The meeting focused on the cooperation between the Council of Europe and the European Union and on the ongoing preparations for the Convention on Artificial Intelligence» https://www.coe.int/en/web/portal/-/secretary-general-meets-european-commissioner-for-justice (consulted on 19/04/2024). ↑
11. Point 3; see above note 8. ↑
12. Council Decision (EU) 2022/2349 of 21 November 2022 authorising the opening of negotiations on behalf of the European Union for a Council of Europe Convention on Artificial Intelligence, Human Rights, Democracy and the Rule of Law https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022D2349. ↑
13. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52021PC0206. ↑
14. https://data.consilium.europa.eu/doc/document/ST-5662-2024-INIT/en/pdf. ↑
15. Opinion 20/2022 of the European Data Protection Supervisor on the Recommendation for a Council Decision authorising the opening of negotiations on behalf of the European Union with a view to a Council of Europe Convention on Artificial Intelligence, Human Rights, Democracy and the Rule of Law, https://www.edps.europa.eu/system/files/2022-10/22-10-13_edps-opinion-ai-human-rights-democracy-rule-of-law_en.pdf. ↑
16. Points 10 and 11, p. 7. ↑
17. L. Cotino Hueso, El Convenio sobre inteligencia artificial, derechos humanos, democracia y Estado de Derecho del Consejo de Europa, in Revista Administración & Ciudadanía, EGAP, 2024, forthcoming. My translation (from Spanish). ↑
18. Point 38; see above note 8. ↑
19. L. Cotino Hueso, El Convenio sobre inteligencia artificial, derechos humanos, democracia y Estado de Derecho del Consejo de Europa, cit. My translation (from Spanish). ↑
20. L. Cotino Hueso, El Convenio sobre inteligencia artificial, derechos humanos, democracia y Estado de Derecho del Consejo de Europa, cit. My translation (from Spanish). ↑
21. https://rm.coe.int/cai-2023-28-draft-framework-convention/1680ade043. ↑
22. https://rm.coe.int/terms-of-reference-of-the-committee-on-artificial-intelligence-cai-/1680ade00f. ↑
23. https://rm.coe.int/terms-of-reference-of-the-committee-on-artificial-intelligence-cai-/1680ade00f. ↑
24. L. Cotino Hueso, El Convenio sobre inteligencia artificial, derechos humanos, democracia y Estado de Derecho del Consejo de Europa, cit. My translation (from Spanish). ↑
25. https://www.coe.int/en/web/artificial-intelligence/-/presentation-of-the-council-of-europe-s-activities-on-artificial-intelligence-ai-during-the-oecd-african-union-ai-dialogue, (consulted on 19/04/2024). ↑
26. www.coe.int/ai. ↑
27. https://www.coe.int/en/web/conventions/glossary. ↑
28. See above note 8. ↑
29. https://op.europa.eu/en/publication-detail/-/publication/d81a0d54-5348-11ed-92ed-01aa75ed71a1/language-en. ↑
30. https://education.ec.europa.eu/about-eea/the-eea-explained. ↑
31. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A52021PC0206. ↑
32. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32017R2226. ↑
33. https://hudoc.echr.coe.int/fre?i=001-193494. ↑