The First Binding International AI Treaty, and Why Almost Nobody Is Watching It

Treaties bind states, not companies. That makes this tier easy to ignore and expensive to have ignored.

What it is

The Convention was drafted by the 46 Council of Europe member states, with participation from observers including Canada, Japan, Mexico, the Holy See and the United States, the European Union, and non-member participants including Australia, Argentina, Israel and Uruguay. That participation list matters: this is not a European instrument with European signatories.

It covers the full AI lifecycle. It applies to public-sector activities directly, and to private-sector activities through a choice-of-approach mechanism in Article 3 that lets each party decide how to give effect to the obligations. Article 3(2) excludes national security activities, subject to a reference to international law and democratic institutions — a boundary many commentators regard as interpretively wide open.

What it requires

Parties must give effect to principles covering human dignity and individual autonomy, equality and non-discrimination, privacy and data protection, transparency and oversight, accountability and responsibility, reliability, and safe innovation including regulatory sandboxes.

They must also provide remedies for violations, and procedural safeguards including notification that a person is interacting with an AI system rather than a human.

None of this will surprise anyone who has read the OECD Principles or the EU AI Act. The significance is not novelty. It is that these obligations become binding on states in international law.

Where ratification stands

Signatories include Andorra, Armenia, Canada, the European Union, Georgia, Iceland, Israel, Japan, Liechtenstein, Moldova, Montenegro, North Macedonia, Norway, San Marino, Switzerland, Ukraine, the United Kingdom, the United States, Uruguay and Albania.

The European Parliament consented to EU accession in March 2026 by 455 votes to 101. The EU deposited its instrument of ratification on 15 May 2026, becoming the first party to ratify.

Entry into force requires five ratifications including at least three Council of Europe member states, taking effect on the first day of the month following three months after the fifth deposit. Signature is the easy part; ratification typically requires domestic legislative action, which is why the gap between the two lists is so wide.

Why it matters commercially

Here is the argument for tracking a treaty that does not bind you.

In several jurisdictions, treaty ratification has direct domestic legal effect or triggers implementing legislation as a matter of constitutional requirement. Ratification is therefore a forward indicator of binding national AI law, often with two to three years of lead time.

For the EU, the implementation vehicle already exists — the AI Act is how Europe discharges the Convention. For the United Kingdom, Canada, Japan and others, ratification would require an assessment of whether existing law suffices, and that assessment is where new statutory duties tend to emerge.

If you sell internationally, the ratification table is a cheap way to see where the next Tier 1 or Tier 3 obligation is likely to originate.

The honest caveat

Framework conventions are, by design, permissive. The choice-of-approach mechanism means two parties can implement the same obligation very differently. The national security exclusion is broad. And there is no supranational enforcement body with the powers the EU's AI Office has.

Questions people ask