Europe’s AI treaty attached its duties to the public function, not the payroll

The week

On September 5, 2024, the Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law opened for signature in Vilnius. Treaties rarely make headlines in the technology press, and this one arrived with little noise. But for anyone who runs a public service that uses artificial intelligence, or sells one to government, it carried a simple and far-reaching idea.

The Council of Europe is a separate and older international organization than the European Union. It focuses on human rights, democracy and the rule of law and best known for the European Convention on Human Rights. A “framework convention” is a treaty that sets broad principles and obligations, leaving each country to decide the detailed rules it uses to meet them.

The text came out of roughly two years of negotiation in the Council of Europe’s Committee on Artificial Intelligence. All 46 member states took part, along with the European Union and 11 non-member states: Argentina, Australia, Canada, Costa Rica, the Holy See, Israel, Japan, Mexico, Peru, the United States and Uruguay. The Committee of Ministers adopted the convention on May 17, 2024. It entered the Council of Europe Treaty Series as No. 225.

The convention was presented as the first legally binding international treaty on AI. It opened for signature at an informal conference of Council of Europe justice ministers. Ten parties signed on the first day: Andorra, Georgia, Iceland, Norway, the Republic of Moldova, San Marino and the United Kingdom, together with Israel, the United States and the European Union. The European Commission signed for the EU.

The heart of the treaty is its scope. It applies to AI systems used by public authorities and by private actors acting on their behalf. For other private-sector use, each party chooses whether to apply the treaty’s obligations directly or address the risks by other means. National security uses are excluded.

The private-sector clause was the hardest compromise of the negotiation. Each party must declare, at signature or ratification, how it will handle private actors who are not working for the state. It can apply the treaty’s obligations to them directly, or take other measures that meet the treaty’s aims. Norway said on signing that it would apply the convention fully to private entities as well as public ones. Beyond national security, the text also leaves out national defence. It excludes research and development on systems not yet made available for use, unless testing could interfere with human rights, democracy or the rule of law.

The text sets principles on transparency, accountability, non-discrimination and privacy. It requires risk and impact management, meaning organizations must assess and manage the harm an AI system could cause before and while they use it. And it requires accessible remedies: people affected must have a realistic way to challenge outcomes.

The remedy provisions are more specific than a general promise. Information about AI systems that can significantly affect human rights, and about how they are used, must be documented. Where appropriate, it must be made available to the people affected, so that a challenge is possible in the first place. People must also be told, where appropriate, when they are interacting with an AI system rather than a human. The risk-management article asks each party to consider whether some uses call for a moratorium, a ban or other measures.

The treaty sets up a Conference of the Parties to follow implementation. Each party must also establish or designate one or more independent mechanisms to oversee compliance at home. Those bodies, and the declarations on private actors, would decide how much the text meant in each country.

Signing is not the end of the process. The convention enters into force after five ratifications, including at least three Council of Europe member states. Ratification is the formal step by which a country commits to be legally bound, usually after its own legislature or government approves.

The timing invited comparison. The EU AI Act, a detailed regulation that applies directly across the European Union’s member states, had entered into force a month earlier, on August 1, and took most of the attention. It assigns duties mainly by role, to the providers that build AI systems and the deployers that use them. It lists access to essential public services and benefits among its high-risk uses, with most high-risk obligations scheduled to apply from August 2026. The treaty’s less noticed contribution was to say that the public’s protections follow the public function, whoever is doing the work.

In the United States, the same months were busy for federal AI governance. OMB Memorandum M-24-10, issued in March 2024, had told agencies to apply minimum practices to “rights-impacting” and “safety-impacting” AI by December 1, 2024, or stop using it unless they obtained a waiver or extension. Later in September, OMB followed with a memo on the responsible acquisition of AI. The U.S. signature in Vilnius came while that domestic machinery was still being built, and it did not change any of it.

A resident applies for housing assistance and is turned down. The letter comes from the agency, on agency letterhead. She has no way of knowing that the decision was shaped by a scoring system run by a private contractor, on that contractor’s computers, using a model the agency has never examined. From her side, the government said no. From the agency’s side, it may not be able to explain why.

The Council of Europe convention addressed that gap, with little fanfare. It drew less attention than the EU AI Act. It binds states, not companies directly; it is principle-based rather than detailed; and it depends on ratification. But its most practical feature for public-sector leaders was a scope clause. Obligations attach to AI used by public authorities and by private actors acting on their behalf. The duty follows the public function, wherever the work is done.

U.S. federal readers would have found the idea familiar. OMB’s AI governance memos applied to AI developed, used or acquired “by or on behalf of” covered agencies. What the treaty did was carry the same idea into an international instrument aimed at public authorities generally, including the regional and municipal bodies that federal memos never reached. The EU AI Act, by contrast, assigns duties mainly by role in the supply chain. A function-based scope asks a simpler question: whose public service is this AI helping to deliver?

That matters because so much public-sector AI is operated by someone other than the agency. Benefits eligibility platforms, call center automation, fraud analytics and records processing are often run by contractors on contractor infrastructure. Under a function-based scope, each AI use falls into one of three categories, defined by who operates it and for whom. There is AI the agency runs itself, AI a contractor runs on the agency’s behalf, and AI operated by others whose outputs the agency relies on. Each needs a different control.

Scores, flags and queue orders: how AI shows up in a public service

To a non-technical leader, “AI” can sound like a robot making decisions. In practice, most AI in public services is less dramatic and more pervasive.

At its simplest, an AI system is software that learns patterns from past data and uses them to make a prediction, a ranking, a classification or a piece of text. A model is the trained pattern-finder inside such a system. A score or flag is its output: a number that says “this application looks risky” or a marker that says “send this case for review.” A model version identifies which edition of the model produced the output, because models are retrained and updated over time, and a new version can behave differently from the old one.

In government, AI tends to show up in four places. It sorts and routes incoming work, such as correspondence or calls. It flags possible fraud or error. It helps decide eligibility or priority, for example by ranking cases. And it drafts or summarizes text for staff. Some of these are low-stakes conveniences. Others shape decisions that change people’s lives.

The output rarely arrives labeled as “AI.” It arrives as a number on a caseworker’s screen, a queue order, a recommended action, or a feature switched on without announcement in a software product the agency already uses. Governance that starts with “list our AI projects” therefore tends to miss a great deal.

How an output travels through a service

A score rarely stays where it was produced. In a typical benefits workflow, a model scores an application, the case management system turns the score into a queue position, and the queue position decides how soon a caseworker opens the file. A delay of weeks can follow from a number nobody looked at. Fraud analytics work the same way: a flag can trigger a document request, a payment hold or a referral to investigators.

The fourth pattern, drafting, grew fastest after 2023. A system that drafts a denial letter or summarizes a case history for a hearing officer shapes what the decision-maker reads. It may decide nothing, but it frames the record on which someone else decides. Governance that counts only systems that “make decisions” will miss it.

The useful unit for governance is therefore the use, not the product. One case management platform may host five AI uses with very different stakes. An inventory that lists the platform once hides the high-impact use among the routine ones, and the controls end up sized to the average.

AI the agency runs itself

This category is the familiar one, with its core machinery of use-case inventories, named owners and classification by impact. The treaty adds little that U.S. federal agencies were not already asked to do in 2024, but it raises the stakes on one element, remedy. People affected by an AI-assisted decision must have an effective way to challenge it.

Remedy is where in-house programs are often thinnest. Appeals processes were designed for decisions made by staff. An appeal reviewer who cannot see why a system flagged a case cannot review it meaningfully.

The U.S. federal baseline in 2024

For U.S. federal agencies, this category already came with a deadline. M-24-10 required minimum practices for rights-impacting and safety-impacting AI by December 1, 2024. They included impact assessments, testing in real-world conditions, ongoing monitoring, and training and oversight for the staff who use the system. Rights-impacting uses also needed notice to affected people and a route to human review and appeal. The treaty’s remedy principle mapped almost directly onto that list.

State and local governments had no equivalent federal mandate. A county human services department or a city housing authority answers to state law, its own policies and, where federal money flows, program rules. For them the treaty was a reference point, not a rule. Its value was as an outside checklist that matched what federal agencies were being told to do, at a time when few states had their own.

The difference shows in capacity as much as in law. A cabinet department has a Chief AI Officer, a privacy office and an inspector general. A mid-sized county may have one IT director who also runs the network and the help desk. A governance model that assumes specialist staff will fail there. The county version is smaller: a short inventory, a one-page assessment for high-impact uses, and contract language borrowed from a state or peer template.

The practical fix is to record the system’s contribution in the case file at the time of the decision. That record holds the model version, the score or flag, the key factors where available, and what the caseworker did with it. Without that record, remedy is a formality, resting on someone’s recollection months later instead of a record of what actually happened.

Proportion matters too. The convention asks for risk management scaled to context. A drafting assistant that summarizes internal memos needs light controls. A model that ranks child welfare referrals needs a documented assessment before use, testing across population groups, and periodic review. “Testing across population groups” means checking whether the system performs equally well, and makes errors at similar rates, for different communities, such as by age, language, disability or neighborhood. Drawing that line between light and heavy controls explicitly, in a written policy, keeps scrutiny where harm is possible and stops staff from treating every tool with either panic or indifference.

Testing across groups, and its trade-offs

Testing for unequal error rates sounds simple and is not. Many agencies do not collect race, ethnicity or disability status, and some are restricted in how they may use such data. Without it, testing relies on proxies such as language preference or neighborhood, which are imprecise. Collecting the data for testing creates privacy obligations of its own, and can alarm the people it is meant to protect.

A workable approach separates the two uses. Demographic data is held in a restricted environment used only for testing, access is logged, and the decision system cannot read it. The design costs some engineering effort, but it lets an agency answer a fairness question without feeding protected characteristics into the decision.

Testing also needs a definition of error. For a fraud flag, the costly error is usually a false positive that delays a legitimate claim. For a child welfare screening tool, both false positives and false negatives cause serious harm. The assessment should say which errors the agency is trying to limit, and who made that call.

One owner per use

Ownership is where in-house programs often stall. A model built by a data team, used by a program office and running on IT infrastructure has three plausible owners and often none in fact. Each high-impact use needs one named business owner who answers for its outcomes, with the data team and IT in supporting roles. The Chief AI Officer, or the state or local equivalent, keeps the inventory and the policy, not the operational accountability.

AI a contractor runs on the agency’s behalf

This is the category the scope clause was written for, and the one most programs had not mapped. When a vendor operates an eligibility engine or triages correspondence for an agency, the agency still owes the public transparency, non-discrimination and a route to challenge. It can deliver those only through the contract.

Building safety offers a useful comparison. A city that hires a private contractor to inspect elevators is still responsible to the public for elevator safety, and cannot shrug and say the contractor missed it. So it writes inspection standards, reporting duties and audit rights into the contract. AI delivered on an agency’s behalf works the same way.

Contract terms that make the duty enforceable

• Disclosure of every AI component used in delivering the service, including features added after award.
• Notice before material model changes.
• Access for the agency or an independent assessor to test performance across population groups.
• Retention of decision records in a form the agency can produce in an appeal or a court.
• Cooperation with remedy, including human review within set timeframes.

Without these, the agency carries a duty it cannot perform.

Who has to be in the room

Getting these clauses into a contract takes people who rarely meet early enough. The program office knows how the service works and where decisions happen. Procurement controls the solicitation and the contract vehicle. Counsel decides what the agency must be able to prove to a resident or a court. The CIO or CISO knows how records are stored, secured and retained. AI clauses tend to appear only when all four review a solicitation before it is issued, so that review has to be a fixed step in the acquisition process, not a favor.

Where vendors push back

Vendors resist some of these terms for reasons that are more than commercial. A multi-tenant software product runs the same model for every customer, so a change notice to one agency is a change notice to all. Testing access raises intellectual property concerns. Some vendors worry that error rates measured by a customer will surface in litigation. Retaining decision records for a full appeal period can mean keeping data longer than the vendor’s standard policy allows.

The compromises are well established in other fields. An agency that cannot inspect a model can test it from outside, by submitting its own evaluation cases and examining the outputs. A third-party assessor can examine what the vendor will not show the agency directly, under confidentiality terms. Retention can be met by exporting decision records into the agency’s own systems, so the vendor does not have to keep them indefinitely.

What the clauses cost

These terms add work for the vendor, and some of that work shows up in price. Small vendors and local firms may find the obligations harder to carry than large incumbents, which can narrow competition. Agencies should scale the clauses to impact, as they scale internal controls. Full terms belong in contracts for systems that shape eligibility, enforcement or priority. A short disclosure-and-notice clause is enough for low-stakes tools. One template applied to every purchase either overburdens small buys or under-protects large ones.

Exit terms belong in the same list. If the agency changes vendors, it still needs the decision records from the old system to handle appeals and litigation for years afterward. A contract that returns data but not the decision history leaves the agency unable to explain past determinations.

Change control: the weak point

Many software-as-a-service products, meaning software the agency rents and uses over the internet rather than installing and running itself, add AI features through routine releases. One month the correspondence tool sorts mail by date; the next month an update adds automatic prioritization by predicted urgency. Nobody signed a new contract, and nobody updated the AI inventory.

A renewal clause that requires the vendor to flag new AI functionality, and lets the agency switch it off pending assessment, keeps the inventory honest between contract cycles.

A clause needs a reader. The cheapest control is a release-note review: someone in the program office reads each vendor release against a short list of verbs, such as rank, score, flag, predict, summarize and draft. Hits go to the AI governance lead for a quick classification. The effort is minutes per release, and it catches changes that vendors describe as product improvements rather than AI.

AI operated by others that the agency relies on

The third category is the boundary case. An agency buys a commercial risk score, an identity verification result or a data broker’s address history. The vendor built the model for many customers, not on the agency’s behalf. Whether that counts as “acting on behalf” is a legal question that parties to the treaty would answer differently, and counsel should weigh in.

Why “on behalf of” is hard to apply

The phrase does more work than it appears to. A contractor that runs an agency’s eligibility service is plainly acting on the agency’s behalf. A data broker that sells one address-history product to banks, landlords and agencies plainly is not. Between them lie many arrangements: a vendor that configures a commercial model to an agency’s rules, a platform that trains on the agency’s own case data, a statewide shared service used by counties. Each party to the treaty would draw the line through its own law. Useful questions for counsel are who controls the configuration, whose data trains the model and whose name is on the decision.

Some purchased data also carries a legal regime of its own. Consumer reports used in certain government eligibility decisions, for example, can bring duties under credit reporting law. Agencies should ask counsel which rules attach to each data source before building it into a workflow.

Operationally, the answer matters less than the exposure. If an agency denies or delays a benefit because a third-party score said so, the affected person experiences an agency decision. The resident in the opening example will not care whether the score came from a contractor working for the agency or from a vendor selling to a hundred agencies.

The agency should therefore treat purchased scores as evidence, not determinations. That means documenting how each score is used, setting thresholds for mandatory human review, and keeping a route for the person to correct the underlying data. It also means asking vendors for validation evidence, including error rates for the populations the agency serves, before purchase rather than after a complaint. Where a vendor will not provide that evidence, the agency should limit the score to triage and never let it decide alone.

Validation evidence is only useful if it fits. A vendor’s accuracy figure is usually an average across its whole customer base. An agency serving an older, rural or multilingual population needs to know how the product performs for people like its applicants. It also needs to know whether the vendor will repeat the measurement after a model change, and whether the agency will see the result.

Identity verification after the pandemic

Identity verification is the clearest real case of the third category. During the pandemic surge in unemployment insurance fraud, many state workforce agencies adopted commercial identity verification services, some of them relying on facial comparison between a selfie and an identity document. In early 2022 the IRS, facing criticism over requiring facial recognition through a third-party service for online account access, announced it would move away from that requirement. The episode showed that the public holds the agency responsible for the vendor’s method, even when the vendor’s product serves many customers.

General-purpose AI tools used by staff

A newer variant of the third category arrived with general-purpose generative AI. A caseworker who pastes case notes into a public chatbot to draft a letter is relying on a model built for millions of users, under terms the agency never negotiated. No contract with the agency exists, so no clause can carry the duty. The controls have to live inside the agency instead. They include a list of approved tools and enterprise agreements that keep agency data out of model training. They also include a rule that drafts touching a decision are reviewed and filed like any other part of the record. An outright ban carries its own risk: it can push use onto personal devices, where it is harder to see and govern than sanctioned use.

An identity check that stops deciding alone

Say a county social services department buys an identity verification result to screen online benefit applications. Under a weak setup, any application that fails the check is automatically rejected. Under a stronger one, a failed check sends the application to a caseworker, who records the result and the reason in the case file, contacts the applicant and offers another way to verify. The vendor has supplied error rates for applicants similar to the county’s population, and the county reviews them annually. The score still saves time. It no longer decides on its own.

Remedy in practice: following one appeal

Remedy is the treaty principle most likely to test an agency in front of the public, so it repays tracing what it looks like when it works and when it does not. Take the housing applicant from the opening, and two versions of the same agency.

In the first version, her appeal reaches a reviewer who opens the case file and finds a single line: “Application declined.” The reviewer asks the caseworker. The caseworker remembers that the screen showed a low priority score, but not what drove it. The reviewer emails the contractor, which replies that the model has since been retrained and the old outputs were not kept. The reviewer is left to re-decide the case from scratch. There is no way to tell whether the original decision was sound or whether the same problem affected other applicants. Nor can anyone tell whether she was treated differently because of where she lives or the language she wrote in. The appeal technically exists. In substance, it is empty.

In the second version, the case file records that a scoring model helped make the decision and names its version. It shows the score and the main factors behind it, and notes that the caseworker accepted the recommendation. The contract requires the contractor to keep decision records for the same period as the agency’s own case files. It must also provide a human review within a set number of days when an appeal is filed. The reviewer can see that the score relied heavily on a gap in the applicant’s rental history, can ask her about it and can correct the record. Because the agency tests the model across population groups each year, it can also check whether that factor tends to disadvantage particular communities.

The difference between the two versions is not the sophistication of the model. It is the paperwork and the contract terms built around it. Those decisions sit with agency leaders, procurement officers and counsel, not with data scientists. They are far cheaper to put in place at the start than to reconstruct after a complaint, an audit finding or a court order.

For contractor-run and third-party systems, this is where the three categories meet the real world. An agency can deliver an effective appeal only if every party in the chain has kept the records and agreed to cooperate before the appeal arrives.

The three layers of an appeal record

An appeal record has three layers. The first is the decision itself: who decided, when and on what grounds. The second is the system’s contribution: the model version, the inputs it used, its output and the factors behind it where the system can produce them. The third is the human step: whether the caseworker accepted, changed or overrode the output, and why. Most case management systems capture the first layer well. Few capture the second and third without deliberate configuration.

Retention follows the appeal path. A benefits denial may be appealed administratively, then reviewed in court, then raised again in a class action years later. Records schedules written for paper case files rarely anticipated model outputs. Records managers should classify AI decision records explicitly, with the same retention as the case file they support.

Public records law adds another reader. Journalists and advocates have long used public records requests to obtain documentation about government algorithms. An agency with clear records will find those requests easier to answer. One without them may discover, under a deadline, whether its contractor’s records fall within reach of the law at all.

Why timing matters as much as access

A remedy that arrives late is little use to someone who needs housing or benefits now. U.S. due process law has long required a hearing before certain welfare benefits are cut off, a principle the Supreme Court set out in Goldberg v. Kelly in 1970. An AI-assisted process inherits those obligations. A contract that gives a vendor a month to answer an appeal query can break a timeline the agency is legally bound to meet.

The cost of getting this wrong is on the record. Michigan’s automated unemployment fraud system, MiDAS, wrongly accused many claimants of fraud in the mid-2010s, and the state settled a class action over it in 2022. In the Netherlands, the childcare benefits scandal, in which the tax authority wrongly treated thousands of families as fraudsters, led the government to resign in January 2021. In Australia, a Royal Commission reported in 2023 that the automated Robodebt scheme had been neither fair nor legal. In each case, the lack of a meaningful and timely route to challenge turned system errors into years of harm.

Mapping the portfolio, and what rides on it

These three categories cover every AI use that touches an agency’s service, and they do not overlap. Either the agency operates the system, a contractor operates it for the agency, or a third party operates it for its own market. Mapping an agency’s portfolio onto them shows quickly where the gaps sit. In most portfolios, the second and third categories hold the most consequential uses and the weakest controls.

For agency heads and the boards, councils and legislators who oversee them, several things are at stake.

Public trust. When people cannot understand or challenge a decision, trust in the institution erodes, whatever the technical merits of the system.

Legal exposure. Appeals, complaints and lawsuits will be directed at the agency, not the vendor. An agency that cannot produce the decision record is in a weak position.

Fairness. Systems that work well on average can still fail particular groups. Without testing across population groups, an agency may not know until harm has been done.

Procurement timing. The cheapest moment to secure disclosure, testing access and record retention is before a contract is signed. Afterward, every request becomes a negotiation.

Direction of travel. Whatever happens to any single treaty, the function-based idea, that duties follow the public service into its supply chain, is a natural way for regulators and courts to think. Agencies that organize around it are better prepared for whatever specific rules arrive.

The strongest objections

There are serious arguments against organizing governance around this treaty. The first is legal weakness. A framework convention binds states rather than agencies, depends on ratification, and leaves most of the detail to national law. An agency may reasonably ask why it should build controls around an instrument that may never bind it.

The answer is that the function-based idea does not depend on the treaty. Administrative law already holds agencies responsible for decisions made in their name. A court reviewing a benefits denial does not accept “the vendor did it” as an explanation. The treaty states a principle that existing law already enforces, unevenly and after the fact.

The second objection is cost and speed. Disclosure, testing and retention clauses lengthen procurements and raise prices, and the burden falls hardest on small agencies with thin procurement teams. The trade-off is real. It argues for scaling the clauses to impact, and for shared templates across agencies, rather than for dropping them.

The third is that human review solves the problem. If a caseworker approves every AI-assisted decision, the argument runs, the AI is only advice and the treaty adds nothing. The well-documented tendency toward automation bias cuts against this: reviewers under time pressure tend to accept system recommendations. Human review protects people only when reviewers have the time, information and authority to disagree.

A simple measure tests that: the override rate. If caseworkers accept a model’s recommendation in nearly every case, the agency should ask whether review is real. If they override it often, it should ask whether the model is fit for use. Neither answer is available unless the case record captures the human step.

Where agency AI governance usually breaks

An agency that has this under control usually keeps a single inventory covering all three categories, including systems it does not run itself. Each entry names an owner, the operator, the impact level and the controls in place. High-impact uses have documented assessments, testing across population groups and periodic review. Case files record the system’s contribution at the time of decision. Service contracts include disclosure, change notice, testing access, record retention, remedy cooperation and exit terms. Renewals require vendors to flag new AI features. Purchased scores are treated as evidence, with human-review thresholds and a way for people to correct the data.

The breaks tend to come in the same places:

• Inventorying only in-house projects. This misses the contractor-run and third-party systems that often matter most.
• Relying on the vendor’s word. Without access to test, the agency cannot know how a system performs for its own population.
• Letting software updates slip AI in unnoticed. Routine releases are the most common way AI enters an agency without review.
• Keeping data but not decision records. Appeals and litigation can surface years later, often after a vendor has changed.
• Letting a score decide alone. Automatic rejection based on a purchased score leaves no human judgment and no easy route to challenge.
• Treating every tool the same. Heavy controls on a memo summarizer waste effort; light controls on a child welfare ranking model invite harm.

The evidence an auditor will ask for

An inspector general, state auditor or legislative committee reviewing this area will ask for evidence rather than policy. Expect requests for the inventory with the operator and impact level of each use, a sample of high-impact contracts with their AI clauses, and impact assessments with dates and sign-offs. Testing results by population group and a sample of appeal files showing the system’s contribution usually follow. Reviewers may also ask how many vendor releases were checked for new AI features, and what happened when one was found. An agency that can produce this in days is in good shape. One that needs months has found its gaps.

Where the contractor-run systems hide

• Do we have a single list of every AI system that touches our services, including those run by contractors and those we buy from third parties, with who operates each?
• When someone appeals a decision about eligibility, priority or benefits, can the reviewer see the model version, the score or flag, the key factors and what the caseworker did with it?
• Do our service contracts require disclosure of AI components, notice of model changes, testing access, decision-record retention and cooperation with remedy, and would we keep the decision history if we changed vendors?
• How do we find out when a vendor adds an AI feature through a routine update, and can we switch it off until we have assessed it?
• Where do purchased scores trigger human review rather than an automatic decision, and what validation evidence have we seen for the populations we serve?

Sequencing matters as much as coverage. Start with the inventory, because nothing else can be scoped without it. Fix the case record for high-impact uses next, because appeals arrive whatever the contract cycle. Contract terms come third, at the next solicitation or renewal, since mid-term amendments are costly. Release-note review can start at once and costs almost nothing.

With hindsight

Ratification was slow. A signature commits a state to little beyond not defeating a treaty’s purpose; being bound requires ratification, which usually needs domestic approval. Signatures kept accumulating through 2025 and 2026. By early September 2026, the Center for AI and Digital Policy’s tracker listed 47 signatories, EU member states among them. Recent additions included North Macedonia in May 2026 and Albania in June 2026. The treaty’s practical reach still depended on how each party carried it into national law.

U.S. federal AI policy changed direction in January 2025, when Executive Order 14110 was revoked, and U.S. ratification did not follow. A signing ceremony, on its own, changed none of the rules American agencies had to follow.

The idea at the treaty’s center traveled further than the treaty. On April 3, 2025, OMB, the White House Office of Management and Budget, issued two memos that replaced its 2024 guidance. M-25-21 applied to AI “developed, used, or acquired by or on behalf of” covered agencies. It folded the earlier rights-impacting and safety-impacting categories into a single “high-impact” category and gave agencies 365 days to document minimum practices for it. Among them: people affected by AI-enabled decisions must have access to timely human review and a chance to appeal. Where an agency lacks access to a vendor’s code, models or data, the memo said it must test by other means, such as querying the service or supplying evaluation data.

The companion memo, M-25-22, carried the same logic into acquisition. Contracts for high-impact AI had to require compliance with the minimum practices and give agencies the ability to monitor and evaluate performance regularly. Contracts had to bar vendors from using non-public agency data to train commercial models without the agency’s consent. The memo encouraged agencies to require notice before vendors add new AI features, and to consider requiring disclosure when contractors use AI in performing a contract. Its contract rules applied to solicitations issued 180 days after the memo. Several of the clauses described above had become federal acquisition policy.

In Europe, the EU AI Act’s fundamental rights impact assessment followed a similar functional logic. It applies to high-risk deployers that are bodies governed by public law and to private entities providing public services. The dates moved, though. In November 2025 the European Commission proposed, in a digital simplification package, to delay the application of high-risk obligations, leaving public bodies and their suppliers planning against a moving start date.

Some U.S. states arrived at the same place by a different road. Texas’s Responsible Artificial Intelligence Governance Act was signed in June 2025 and took effect in January 2026. It placed many of its specific duties on government entities, including telling people when they are interacting with an AI system. The scope clause’s idea, duties following the public function into its supply chain, was appearing through several routes at once.

The practical divide between agencies became clear. Agencies that had mapped contractor-operated and third-party AI found the later requirements easier to meet. They already knew where their systems were, who ran them and what their contracts said. Those that had inventoried only their own projects discovered the most consequential systems during audits or appeals, which is the most expensive and least comfortable way to find them.

Not everything in the argument held up as cleanly. In the United States, which did not ratify, the contract clauses spread through federal memos and state laws rather than through the convention. The treaty was rarely the instrument that changed agency practice there. What held up was the underlying claim: residents hold the agency responsible for decisions made in its name, whichever company ran the model. Building inventories, contracts and case records around that reality remained sound practice regardless of which rules came next.