On October 13, 2022, the European Data Protection Supervisor (“EDPS”) released its Opinion 20/2022 on a Recommendation issued by the European Commission in August 2022 calling for a Council Decision authorising the opening of negotiations on behalf of the European Union for a Council of Europe convention on artificial intelligence, human rights, democracy and the rule of law.

The resulting convention – to be called the “AI Convention” –  would complement the EU’s proposed AI Act and the proposed AI Liability Directive, both currently under negotiation.  (See our previous blog post on the proposed AI Act here and on the proposed AI Liability Directive here).

The AI Convention would be the first legally binding international instrument on AI, and would be open to participation by non-member States.  In September 2022, the Council of Europe’s Committee on Artificial Intelligence (“CAI”) examined a first draft, which focused on developing common principles to ensure continued application of and respect for human rights, democracy and the rule of law, where AI systems assist or replace human decision-making.  The AI Convention would cover both public and private providers, and users of AI systems.

The EDPS welcomes the AI Convention as an opportunity to complement the EU’s AI Act and supports the EU Commission’s aim to ensure consistency with the EU’s proposed AI Act.  Moreover, the EDPS endorses the AI Convention’s suggested definition of “AI subject”, i.e., a person affected by the use of AI systems (such as workers affected by the use of AI in work management systems, or individuals applying for loans relying on AI-powered creditworthiness systems), and of procedural safeguards and rights for AI subjects.

The EDPS’ key recommendations on the EU’s negotiating directives include the following:

• Prioritize safeguards and fundamental human rights for individuals as general objectives;
• Include (1) an explicit reference to the AI Convention’s compliance with the EU’s data protection framework, and (2) a methodology for assessing the risks posed by AI systems to fundamental rights, in order to establish clear, concrete and objective criteria for conducting “human rights impact assessments”;
• In line with a risk-based approach, ensure that risks to societal and specific groups posed by AI systems be assessed and mitigated, and impose a prohibition on AI systems presenting “unacceptable risks”.  In the EDPS’ view, AI systems using (1) social scoring, (2) biometric identification in publicly accessible spaces, and (3) biometrics and emotional categorization, in addition to certain other systems, should generally be prohibited;
• Promote a data protection by design and by default approach in every step of an AI system’s lifecycle, to allow effective implementation of data protection principles by means of state-of-the-art technologies;
• Specify that the AI Convention should (1) include ex ante third-party conformity assessments for high-risk AI systems, and a procedure for new assessments in case of significant changes to those systems, and (2) provide minimum requirements on transparency, explainability and auditability of AI systems; and
• Ensure that competent supervisory authorities be vested with adequate investigatory and enforcement powers, and cross-border cooperation among authorities be facilitated.

Although further negotiations are scheduled to take place, a final proposal for the AI Convention is expected to be adopted by the Council of Europe’s Committee of Ministers in November 2023.

***

Covington regularly advises  companies on their most challenging regulatory and compliance issues in the EU and other major markets.  Our team is happy to assist with any inquiries relating to the new AI Convention and the EU AI Act, and other tech regulatory matters.