The Council of Europe Convention on AI: National Security Implications

Timeline

Different countries will implement the Convention on different timelines, especially as some will simply need to implement or amend existing regulation, while others might need to introduce new, legally binding measures.^[12] Nevertheless, several key milestones are detailed in the Convention (Figure 2).

Figure 2: Timeline for the implementation of the Council of Europe Convention on AI 

Source: Council of Europe Convention on AI.

The Principles

The Convention sets out a series of principles to be incorporated into the participating countries’ domestic approaches to AI regulation (Figure 3).

Figure 3: The principles set out in the Council of Europe Convention on AI

Source: Council of Europe Convention on AI.

The Obligations

In addition to these principles, the Convention establishes several obligations for all participating nations. These include the need for signatories to:

• Ensure that existing domestic legal frameworks are up-to-date and continue to protect human rights in a rapidly evolving AI landscape.^[13]
• Protect democratic processes in the face of AI risks.^[14]
• Make clear there exists a right to launch a complaint and to receive an effective remedy where human rights have been violated due to AI.^[15]
• Preserve human oversight where AI-based decision-making substantially impacts human rights.^[16]
• Establish iterative risk management throughout the AI lifecycle.^[17]

These obligations are set out at a high level to allow compatibility with domestic law and policy.

Exclusions 

The Convention includes several sectoral exclusions (Figure 4). Broadly, these exclusions mirror those set out in the EU AI Act, but there are key differences.

The biggest difference is how the Convention deals with private sector AI. The Convention applies fully to private entities acting on the behalf of public authorities. However, for all other private sector AI, there is substantial leeway for signatory states. Specifically, participating countries can either enact the Convention as normal to the private sector or apply the same obligations through ‘other appropriate measures’.^[18] This more lenient approach to governing the private sector was discussed heavily during the final stages of negotiation, with the US reported to be pushing for private sector exclusions from the Convention.^[19]

Figure 4: Exemptions from the Council of Europe Convention on AI by sector

Source: Council of Europe Convention on AI.

The National Security Exclusion

How is the scope of the exclusion defined?

Any AI systems related to the protection of ‘national security interests’ are out of scope of the Convention, on the understanding that existing international human rights law still applies.^[20]

Debate surrounding the national security exclusion

The exclusion for national security has been debated extensively, both by those participating in treaty negotiations and by civil society groups.

1. During negotiations, the specific parameters of the national security exclusion evolved.^[21] Several factors motivated those negotiating the Treaty. For example, the EU Commission wanted the Convention to align closely with the EU AI Act, which excludes national security.^[22] 
2. Outside of negotiations, civil society groups have objected to the exclusion for national security^,[23] arguing that the sorts of AI applications which are prevalent in national security settings have significant human rights implications that must be addressed.^[24] 

Why Does the Convention Still Matter for National Security?

Despite these exclusions, the Council of Europe Convention on AI will have national security implications in all participating countries. It will be crucial for the national security community to consider which of the Convention’s provisions they might adopt voluntarily, while tracking the progress of this Convention for what it reveals about global trends in AI regulation. 

Principles for AI and Human Rights

Principles-based approaches to AI policy are nothing new, nor do the seven principles set out in the Convention show significant divergence from the many sets of principles for ethical AI which have emerged elsewhere (for example from the OECD, UNESCO, Global Partnership on AI and elsewhere)^.[25] Nevertheless, the seven principles in the Convention are likely to be particularly influential given they form the basis of a legally binding treaty. 

Despite national security being excluded from the Convention, these principles are still applicable to national security agencies’ work on AI. In some contexts, the value of AI ethics principles in national security is already recognised explicitly. For example, the US intelligence community has committed publicly to a set of principles for ethical AI,^[26] while the UK’s GCHQ has set out their own approach to AI ethics.^[27] Numerous defence departments have also published their own AI principles.^[28]

For those who are yet to publicly commit to a set of principles on AI and human rights, the seven principles set out in the Convention could provide a useful framework to guide AI practices in a national security context, and agencies may consider making voluntary public commitments to those principles, rather than developing new principles from scratch. 

However, setting out a set of principles for AI and human rights is only a first stage in developing a practical approach to AI governance. In many national security settings, existing laws and policies are already in place to protect human rights and individual freedoms. Commitment to high-level principles is insufficient unless it is complemented by additional internal mapping of how these principles are implemented in practice, and in a manner that is consistent with existing regulation and policy. 

New best practice for fundamental rights impact assessment  

Given the high-level nature of the Convention, one of the most practically useful resources for the national security community won’t be found in the Convention itself, but instead within accompanying efforts to develop a methodology for ‘fundamental rights, democracy and rule of law impact assessments’ for AI systems.^[29]

While conducting human rights impact assessments won’t be mandatory in national security contexts, methodologies which have been prepared in association with the Council of Europe provide detail on how to identify human rights risks associated with new AI projects.^[30] These methods could be incorporated within national security approaches to AI assurance.^[31]

Revealing fault lines for future AI regulation initiatives 

Beyond being a practical resource for the national security community, the Convention reveals how challenging it is to reach international consensus on AI regulation, especially on topics such as national security and private sector innovation.^[32] The debates around the Convention provide useful insight into the most contentious issues likely to arise in any future regulatory discussions concerning AI and national security. 

Despite bringing together just 57 nations during negotiations, with a heavy skew towards Global North countries, the degree of compromise needed to reach consensus on the final Convention resulted in significant criticism, especially around decisions made to soften the obligations of the private sector.^[33]

The Convention is the first initiative to ‘combine EU and US priorities’ on AI regulation, so the need for compromise should not come as a surprise. Nevertheless, as one of the earliest international AI regulation initiatives, it offers important lessons, pointing to the sorts of compromises that may need to be made in the future.^[34] 

Conclusion

While this Convention is unlikely to have such significant, practical implications for the national security community as the EU AI Act, its progress should still be monitored closely. The Convention’s provisions are broad, leaving significant scope for how States will enact them. As this process begins, the UK national security community should clarify its own position on the principles set out in the Convention, and how they can best be applied in their domain. National security agencies should also closely follow how different countries enact this treaty for what it reveals about convergence and divergence in international approaches to AI governance.