International AI Instruments Crosswalk
Purpose: Map two international AI instruments that are not tied to one country to the wiki's controls and templates: the first international treaty on AI, and the G7 code of conduct for developers of advanced AI.
Audience: Legal and compliance teams, AI governance leads, providers of advanced and general-purpose AI models, vendor evaluation teams.
Using the two together: Use these instruments for the commitments. Use this wiki for the controls, evidence and templates. National laws are in the regional sections, starting with the EU AI Regulatory Hub.
Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law (CETS No. 225)
Status: signed, not in force. Opened for signature on 5 September 2024 (Council of Europe information page; treaty text; explanatory report). Article 30(3) says it enters into force three months after five signatories, including at least three member States of the Council of Europe, have consented to be bound. The European Union ratified it on 15 May 2026 (Council of Europe news). A secondary tracker reported no other consents as of 8 September 2026. Check the current position at the Treaty Office before relying on it. The Council of Europe lists 21 signatories, including the United Kingdom, the United States, Canada, Japan, Israel, Switzerland, Norway, Ukraine and the European Union.
The Convention binds states, not organizations directly. Parties apply it to public authorities and to private actors acting for them, and choose how to apply it to the rest of the private sector. National defence is excluded. It matters to organizations because the laws that implement it will.
Checked against the source. Article numbers and titles, Article 30(3) and the EU ratification were read on the Council of Europe's own pages on 15 October 2026 with a retrieval tool. The mapping to wiki controls is this wiki's own judgment.
| Article | Title | Main wiki controls and pages |
|---|---|---|
| 7 | Human dignity and individual autonomy | AI-CTRL-045, AI-CTRL-042 |
| 8 | Transparency and oversight | AI-CTRL-039, AI-CTRL-045; EU T06 Transparency Notice |
| 9 | Accountability and responsibility | AI-CTRL-012, AI-CTRL-008, AI-CTRL-038 |
| 10 | Equality and non-discrimination | AI-CTRL-041 |
| 11 | Privacy and personal data protection | AI-CTRL-013, AI-CTRL-017 |
| 12 | Reliability | AI-CTRL-034, AI-CTRL-040, AI-CTRL-039 |
| 13 | Safe innovation | Not mapped: it concerns controlled environments that states set up, such as regulatory sandboxes |
| 14, 15 | Remedies; procedural safeguards (including notice of interacting with AI) | AI-CTRL-045; UK-T1 ADM Safeguards Record |
| 16 | Risk and impact management framework | AI-CTRL-037, AI-CTRL-042; ISO/IEC AI Standards Crosswalk (ISO/IEC 42005) |
| 19 | Public consultation | UK-T3 Public Sector Transparency Record |
| 20 | Digital literacy and skills | AI-CTRL-044 |
| 26 | Effective oversight mechanisms | AI-CTRL-043 |
Articles 1 to 6, 17, 18, 21 to 25 and 27 to 36 cover scope, general obligations, implementation, follow-up and final clauses, and are addressed to states.
G7 Hiroshima Process International Code of Conduct for Organizations Developing Advanced AI Systems
Published by the G7 on 30 October 2023 (text; European Commission page). It is voluntary and addressed to organizations that develop the most advanced AI systems, including foundation and generative models. The OECD runs a voluntary reporting framework built on the Code's 11 actions; it launched in February 2025 and is now in its second version (OECD.AI). The actions were read from the Code's text on 15 October 2026.
| # | Action (shortened) | Main wiki controls and pages |
|---|---|---|
| 1 | Take appropriate measures throughout development to identify, evaluate and mitigate risks | AI-CTRL-037, AI-CTRL-033, AI-CTRL-034 |
| 2 | Identify and mitigate vulnerabilities, incidents and patterns of misuse after deployment | AI-CTRL-034, AI-CTRL-035, AI-CTRL-036 |
| 3 | Publicly report capabilities, limitations and domains of appropriate and inappropriate use | AI-CTRL-039; EU T12 GPAI Model Checklist |
| 4 | Work towards responsible information sharing and incident reporting among organizations | AI-CTRL-035, AI-CTRL-043 |
| 5 | Develop, implement and disclose AI governance and risk management policies | AI-CTRL-012, AI-CTRL-037 |
| 6 | Invest in robust security controls, including physical security and cybersecurity | AI-CTRL-028, AI-CTRL-032, AI-CTRL-030 |
| 7 | Develop and deploy content authentication and provenance mechanisms where technically feasible | AI-CTRL-039; US-T3 GenAI Provenance and Transparency Checklist |
| 8 | Prioritize research to mitigate societal, safety and security risks | Not mapped: a research commitment |
| 9 | Prioritize development of advanced AI to address the world's greatest challenges | Not mapped: a purpose commitment |
| 10 | Advance the development and adoption of international technical standards | Not mapped; see the standards crosswalks in this section |
| 11 | Implement appropriate data input measures and protections for personal data and intellectual property | AI-CTRL-013, AI-CTRL-029, AI-CTRL-046 |
The Code overlaps strongly with the EU's GPAI Code of Practice, which providers can use to show compliance with the AI Act's GPAI obligations (EU T12). When you buy from a developer of advanced models, ask whether it has published a report under the Hiroshima reporting framework (see the Vendor Evaluation Master Framework).
Attribution
The Framework Convention is a Council of Europe treaty. The Hiroshima Process Code of Conduct is a G7 document. This page cites article and action numbers and short titles, and does not reproduce their text beyond the short quotation of Article 30(3).