Europe’s AI treaty attached its duties to the public function, not the payroll

The week

On September 5, 2024, the Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law opened for signature in Vilnius. It was presented as the first legally binding international treaty on AI. The first signatories included the United States, the United Kingdom, the European Union, Israel, Norway and several other Council of Europe members. The convention applies to AI systems used by public authorities and by private actors acting on their behalf. For other private-sector use, each party chooses whether to apply the treaty’s obligations directly or address the risks by other means. National security uses are excluded. The text sets principles on transparency, accountability, non-discrimination and privacy, and requires risk and impact management and accessible remedies. It enters into force after five ratifications, including at least three Council of Europe member states. The EU AI Act had entered into force a month earlier, on August 1.

The convention drew less attention than the EU AI Act. It binds states, it is principle-based, and it depends on ratification. Its most practical feature for public-sector leaders was a scope clause. Obligations attach to AI used by public authorities and by private actors acting on their behalf. The duty follows the public function, wherever the work is done.

That matters because so much public-sector AI is operated by someone other than the agency. Benefits eligibility platforms, call center automation, fraud analytics and records processing are often run by contractors on contractor infrastructure. Under a function-based scope, each AI use falls into one of three categories, defined by who operates it and for whom: AI the agency runs itself, AI a contractor runs on the agency’s behalf, and AI operated by others whose outputs the agency relies on. Each needs a different control.

AI the agency runs itself

This category is the familiar one, and earlier articles in this series cover its core machinery: use-case inventories, named owners and classification by impact. The treaty adds little that U.S. federal agencies were not already asked to do in 2024, but it raises the stakes on one element, remedy. People affected by an AI-assisted decision must have an effective way to challenge it.

Remedy is where in-house programs are often thinnest. Appeals processes were designed for decisions made by staff. An appeal reviewer who cannot see why a system flagged a case cannot review it meaningfully. The practical fix is to record the system’s contribution in the case file at the time of the decision: the model version, the score or flag, the key factors where available, and what the caseworker did with it. Without that record, remedy is a formality.

Proportion matters too. The convention asks for risk management scaled to context. A drafting assistant that summarizes internal memos needs light controls. A model that ranks child welfare referrals needs a documented assessment before use, testing across population groups, and periodic review. Drawing that line explicitly, in a written policy, keeps scrutiny where harm is possible.

AI a contractor runs on the agency’s behalf

This is the category the scope clause was written for, and the one most programs had not mapped. When a vendor operates an eligibility engine or triages correspondence for an agency, the agency still owes the public transparency, non-discrimination and a route to challenge. It can only deliver those through the contract.

Contract terms that make the duty enforceable include: disclosure of every AI component used in delivering the service, including features added after award; notice before material model changes; access for the agency or an independent assessor to test performance across population groups; retention of decision records in a form the agency can produce in an appeal or a court; and an obligation to cooperate with remedy, including human review within set timeframes. Without these, the agency carries a duty it cannot perform.

Exit terms belong in the same list. If the agency changes vendors, it still needs the decision records from the old system to handle appeals and litigation for years afterward. A contract that returns data but not the decision history leaves the agency unable to explain past determinations.

Change control is the weak point. Many software-as-a-service products add AI features through routine releases. A renewal clause that requires the vendor to flag new AI functionality, and lets the agency switch it off pending assessment, keeps the inventory honest between contract cycles.

AI operated by others that the agency relies on

The third category is the boundary case. An agency buys a commercial risk score, an identity verification result or a data broker’s address history. The vendor built the model for many customers, not on the agency’s behalf. Whether that is “acting on behalf” is a legal question that parties to the treaty would answer differently, and counsel should weigh in.

Operationally, the answer matters less than the exposure. If an agency denies or delays a benefit because a third-party score said so, the affected person experiences an agency decision. The agency should therefore treat purchased scores as evidence, not determinations. That means documenting how each score is used, setting thresholds for mandatory human review, and keeping a route for the person to correct the underlying data. It also means asking vendors for validation evidence, including error rates for the populations the agency serves, before purchase rather than after a complaint. Where a vendor will not provide that evidence, the agency should limit the score to triage and never let it decide alone.

These three categories cover every AI use that touches an agency’s service, and they do not overlap: either the agency operates the system, a contractor operates it for the agency, or a third party operates it for its own market. Mapping an agency’s portfolio onto them shows quickly where the gaps sit. In most portfolios, the second and third categories hold the most consequential uses and the weakest controls.

With hindsight

Ratification was slow. U.S. federal AI policy changed direction in January 2025, when Executive Order 14110 was revoked, and U.S. ratification did not follow. The European Union ratified in May 2026, but the treaty was still gathering the ratifications needed to enter into force. The function-based logic proved more durable than the treaty itself. OMB’s April 2025 memos kept inventories and minimum practices for high-impact uses, and a separate acquisition memo pushed AI governance into federal contracts, which a later article in this series examines. State laws and procurement rules increasingly reached AI used by vendors in delivering public services. Agencies that had mapped contractor-operated and third-party AI found those later requirements easier to meet. Those that had inventoried only their own projects discovered the most consequential systems during audits or appeals.