Summary

• The CDNET committee adopted two HUDERIA components at its Strasbourg meeting on 21–23 October.
• The guidance covers engagement with affected people and responsibility throughout an AI system’s lifecycle.
• Procurement guidance and interoperability clauses remain under development; the adopted components do not establish new binding legal obligations.

The Council of Europe has adopted two further components of its artificial intelligence risk assessment framework, setting out how organisations should involve people affected by AI systems and identify responsibility for their development, deployment and operation.

The decision was taken by the Steering Committee for New and Emerging Digital Technologies, known as CDNET, during its second plenary meeting in Strasbourg from 21 to 23 October. Approximately 170 participants attended in person or remotely, representing governments, international institutions, civil society and invited organisations.

The Council of Europe confirmed the adoption of the Stakeholder Engagement Process and Recommendations on Roles and Responsibilities in the AI Project Lifecycle, both forming part of its HUDERIA model for assessing risks to human rights, democracy and the rule of law.

The committee also examined work on AI procurement guidelines, interoperability clauses and a study mapping technological developments with potential consequences for fundamental rights. Those additional projects remain in development and were not adopted as completed guidance at the meeting.

HUDERIA is intended for authorities and private organisations seeking a structured approach to evaluating AI. The framework is non-binding, allowing organisations to adapt the methodology to their circumstances and applicable legal obligations rather than requiring identical assessments for every application.

People affected by AI need a place in its assessment

Organisations evaluating AI frequently concentrate on technical characteristics, including model accuracy, reliability, data quality and security. Those measurements can identify important weaknesses, but they may not reveal how an application affects people operating under particular social, professional or institutional circumstances.

A system used to assess applications for public services, for example, might achieve satisfactory performance across a test dataset while producing different consequences for people who have difficulty obtaining supporting documents or correcting administrative records.

The Stakeholder Engagement Process addresses this limitation by providing a framework for gathering information from groups potentially affected by an AI system. The assessment should account for the context of its use, the risks already identified and the circumstances in which meaningful participation can occur.

HUDERIA’s existing Context-Based Risk Analysis process, known as COBRA, helps organisations examine an application’s purpose, development arrangements and operating environment. Its findings can inform which groups should participate in further assessment and which potential harms deserve closer examination.

Stakeholder engagement may involve employees, service users, affected communities, professional representatives and other organisations with relevant expertise. The most appropriate participants and methods depend on the system rather than a predetermined list applied to every AI project.

Where an application could affect vulnerable people, consultation may require particular care over accessibility, representation and the information participants receive. Someone cannot provide useful feedback about an automated process without enough information to understand how it could influence their circumstances.

Consultation also has practical limits. Participation can demand time and resources, particularly from groups that have little capacity to influence a technology purchaser. Organisations must consider how findings will inform decisions rather than treating the collection of feedback as evidence that risks have already been resolved.

The newly adopted component develops the existing methodology rather than creating an obligation for all developers to conduct a particular type of public consultation. Its use remains dependent on the organisation’s circumstances and the regulatory requirements that otherwise apply.

Responsibility extends beyond the model developer

The second adopted component addresses responsibility across the lifecycle of an AI project, where several organisations may contribute to the design, operation and subsequent modification of a system.

An enterprise application may rely on a model supplied by one business, integration work undertaken by another and data controlled by the organisation purchasing the finished service. The company deploying the technology may then determine how its recommendations affect employees or customers.

Those participants have access to different information and exercise control over different decisions. A model supplier may understand training and evaluation methods but lack detailed knowledge of a customer’s operating environment, while the deploying organisation may know the intended business process without possessing the supplier’s underlying technical records.

Effective risk assessment requires responsibilities that correspond to those differences. Someone must be accountable for maintaining appropriate documentation, responding to incidents, evaluating changes and ensuring that decisions about deployment are supported by relevant evidence.

The arrangements can become more complicated when an existing software product gains new AI capabilities through an update. Customers may not have commissioned a new system, but the technology could begin processing different information or generating recommendations used in more consequential decisions.

Clear responsibilities help determine when an assessment needs revisiting and which party should provide information about a changed model, integration or operating environment. Contracts and procurement procedures can support that allocation, although written responsibilities must correspond to what participants can actually control.

The guidance also has relevance for public bodies purchasing technology from commercial suppliers. Authorities remain responsible for exercising their lawful functions even when software assists with administrative analysis or recommendations. Understanding the supplier’s obligations is necessary, but outsourcing technical development cannot establish that every public decision has been made appropriately.

Guidance and legislation serve different purposes

HUDERIA supports the Council of Europe’s Framework Convention on Artificial Intelligence, which addresses the protection of human rights, democracy and the rule of law in the context of AI systems.

The convention is a treaty framework, whereas HUDERIA provides practical material that organisations can use when examining risks and possible mitigations. The guidance is also distinct from the European Union’s AI Act, which imposes obligations on specified actors and activities under a separate legislative system.

The Council of Europe’s Committee of Ministers approved the initial HUDERIA methodology in February 2025 and its COBRA resource model in February 2026. The October decision extends that work through more detailed components addressing consultation and responsibility.

These resources can complement statutory compliance, but using HUDERIA does not establish that an organisation has satisfied every obligation under applicable AI, data protection or sectoral law. Nor does the methodology provide a guarantee that a system is free of harmful consequences.

CDNET’s continuing work on procurement and interoperability is relevant because technology purchasers may need common language for requesting evidence from suppliers. Differences in model documentation and service contracts can otherwise make it difficult to compare risks across competing products.

The committee has not yet completed those components. Its current decision provides further material on stakeholder engagement and accountability while leaving important implementation questions to organisations using the guidance.

The adopted recommendations can assist an organisation in asking who should be consulted, what information is missing and which party must act when a problem emerges. Their influence will depend on whether those questions shape actual purchasing, development and operational decisions rather than remaining confined to assessment documents.