International Standards: EU AI Act and OECD

Learning Objectives

By the end of this lecture, you will be able to: (1) summarize the EU AI Act (Regulation 2024/1689), including its categorization of prohibited practices (Article 5), high-risk AI (Article 6 and Annex III), General-Purpose AI models (Article 51), General-Purpose AI models with systemic risk (Article 51.2), transparency obligations (Article 50), and governance under the EU AI Office; (2) apply the OECD AI Principles (originally 2019, updated May 3, 2024) including inclusive growth, human-centered values and fairness, transparency and explainability, robustness and safety, and accountability; (3) understand the Council of Europe Framework Convention on AI (Vilnius, May 17, 2024), the first binding international treaty on AI, signed by the US on September 5, 2024; (4) trace the G7 Hiroshima AI Process and the International Code of Conduct for Advanced AI System Developers; (5) understand UN initiatives including the Global Digital Compact and the ongoing UN Advisory Body on AI; (6) apply ISO/IEC 42001:2023 (AI management systems) and related ISO standards; (7) interpret UK guidance including the Algorithmic Transparency Recording Standard operated by the Central Digital and Data Office; (8) crosswalk federal NIST AI RMF 1.0, OMB M-24-10, and EO 14110 to international frameworks; and (9) coordinate agency practice with the State Department, Commerce International Trade Administration, and USTR to align federal AI with U.S. international commitments.

Key Topics Covered

Topic 1: The EU AI Act (Regulation 2024/1689). Entered into force August 1, 2024. Staged application: prohibitions effective February 2, 2025; GPAI obligations effective August 2, 2025; high-risk obligations effective August 2, 2026 (with additional transitions for AI embedded in safety regulated products). Risk-based tiers: prohibited (Article 5), high-risk (Article 6 + Annex III), limited-risk (Article 50 transparency), minimal risk (no specific obligations). General-Purpose AI model provisions in Chapter V, Article 51 (GPAI) and Article 51.2 (GPAI with systemic risk, above 10^25 FLOPs threshold initially). EU AI Office under DG CNECT established. National competent authorities and notified bodies.

Topic 2: OECD AI Principles. Adopted May 22, 2019; updated May 3, 2024. Five values-based principles: inclusive growth, sustainable development and well-being; human-centered values and fairness; transparency and explainability; robustness, security, and safety; accountability. Five recommendations for national policies and international cooperation. Basis of many national frameworks including NIST AI RMF.

Topic 3: Council of Europe Framework Convention on AI. Opened for signature Vilnius May 17, 2024. First legally binding international treaty on AI. U.S. signed September 5, 2024 along with UK, EU, Israel, Andorra, Georgia, Iceland, Moldova, Norway, San Marino. Covers AI throughout its lifecycle; requires human dignity, autonomy, non-discrimination, privacy, transparency, accountability, equality and non-discrimination.

Topic 4: G7 Hiroshima AI Process. Leaders Statement May 19, 2023. International Guiding Principles and Code of Conduct for Advanced AI System Developers October 30, 2023. Annual review. Focus on voluntary commitments from developers of advanced AI.

Topic 5: UN initiatives. UN Advisory Body on AI Final Report September 19, 2024. UN Global Digital Compact adopted September 22, 2024 (Pact for the Future Annex 1). UN General Assembly Resolution 78/265 (March 21, 2024, U.S.-led) and 78/311 (July 1, 2024, China-led). UNESCO Recommendation on the Ethics of AI (2021).

Topic 6: ISO/IEC and IEEE standards. ISO/IEC 42001:2023 AI management systems. ISO/IEC 23894:2023 AI risk management. ISO/IEC TR 24028:2020 AI trustworthiness overview. ISO/IEC 23053:2022 ML framework. IEEE 7000 series on ethical design. IEEE 7003-2024 algorithmic bias considerations. IEC 61508 functional safety.

Topic 7: National frameworks of peer countries. UK AI Regulation White Paper (March 2023) and follow-up pro-innovation approach. UK Algorithmic Transparency Recording Standard (CDDO). Canada AIDA (proposed), Directive on Automated Decision-Making (2019). Singapore Model AI Governance Framework. Japan AI guidelines. Australia AI Ethics Framework.

Topic 8: Bilateral and multilateral AI arrangements. US-UK AI Safety Institute partnership. US-EU Trade and Technology Council. Indo-Pacific AI cooperation through Quad. US-Korea AI cooperation. US-ASEAN digital cooperation.

Topic 9: Federal coordination roles. State Department (Bureau of Cyberspace and Digital Policy), Commerce (BIS, ITA, NIST), USTR, OSTP. Interagency AI International Working Group. NSC coordination for classified cross-border issues.

Why This Matters for Government

International AI standards and frameworks matter to federal agencies for three reasons: direct extraterritorial applicability in some cases, cross-border operations requiring alignment, and the shaping of peer-country regulatory expectations that affect vendor behavior and downstream federal procurement.

The EU AI Act is the most consequential international AI law for U.S. federal agencies. Regulation 2024/1689 entered into force August 1, 2024. It applies to providers placing AI on the EU market, to providers established outside the EU whose AI output is used in the EU, and to deployers of AI located in the EU (Article 2). Federal agencies operating EU-based systems or services used by EU citizens, for example, State Department consular services, overseas Veterans Affairs clinics, embassy-operated AI for foreign national services, or Federal Reserve and Treasury AI used in EU-located offices, have direct compliance exposure. More broadly, U.S. vendors supplying federal agencies will have already built products to meet EU requirements; demanding EU AI Act-aligned artifacts for federal procurement is both practical and sound international alignment.

The OECD AI Principles have been the intellectual foundation for much of the U.S. federal framework. NIST AI RMF 1.0 explicitly builds on OECD principles. OMB M-24-10's rights-impacting and safety-impacting concepts parallel EU AI Act high-risk and Annex III categories. The 2024 update to the OECD Principles added emphasis on safety and on generative AI. Federal practice is expected to be consistent with OECD principles; U.S. representatives at OECD AI-GOV and its expert groups shape the evolving interpretation.

The Council of Europe Framework Convention on AI, signed by the U.S. on September 5, 2024, creates a binding international commitment to human dignity, autonomy, non-discrimination, privacy, transparency, and accountability in AI. As a treaty signed but not yet ratified, its direct legal effect in U.S. law is limited to the general obligation not to defeat its object and purpose; it nonetheless represents the U.S. commitment to an international AI rights framework and is quoted by civil society and Congressional committees as a benchmark.

The G7 Hiroshima AI Process produced the International Guiding Principles and the Code of Conduct for Advanced AI System Developers. These are voluntary commitments. They have been referenced in EO 14110, in the NIST AI Safety Institute framework, and in agency AI Strategy documents. U.S. federal vendors who sign the Code of Conduct are expected to meet specific commitments on transparency, vulnerability reporting, cybersecurity, watermarking, content authenticity, and responsible disclosure.

UN initiatives, especially the Global Digital Compact of September 22, 2024, and the UN Advisory Body on AI Final Report of September 19, 2024, shape the international policy environment. U.S. support for these is coordinated through the State Department Bureau of International Organization Affairs. While these instruments do not directly bind federal agencies, they inform export control policy, foreign assistance programs, and international technical assistance.

ISO/IEC 42001:2023 provides a certifiable AI management system standard. Federal agencies are not required to certify, but ISO 42001 certification is increasingly expected of vendors in high-assurance contexts. The NIST Information Technology Laboratory and NIST AI Safety Institute coordinate on how ISO standards relate to NIST AI RMF.

The UK Algorithmic Transparency Recording Standard, operated by the CDDO, is the most mature peer-country public-sector transparency framework. It is compatible with OMB M-24-10 inventory requirements and provides a useful complementary structure. U.S.-UK AI Safety Institute partnership, established April 2024, creates ongoing coordination between NIST AISI and UK AISI.

Taken together, the international frameworks form an increasingly consistent global floor: transparency, risk management, human oversight, accountability, subgroup analysis, and redress. Federal agencies that align with these frameworks need not maintain separate compliance regimes; they can operate one control set mapped to multiple frameworks. Agencies that ignore the frameworks create risks with EU regulators, international partners, and U.S. vendors caught between regimes.

EU AI Act in Detail

Scope (Article 2). The EU AI Act applies to: providers placing AI systems on the EU market or putting them into service in the EU, regardless of provider location; deployers of AI systems established in or located in the EU; providers and deployers outside the EU where AI output is used in the EU. Exceptions include military, defense, and national security use (Article 2.3), pure scientific research and development (Article 2.8), and personal non-professional use. Federal agencies operating in the EU, using EU-connected services, or whose AI output affects EU individuals may fall within scope.

Prohibited practices (Article 5). Effective February 2, 2025. Including: harmful subliminal, deceptive, or manipulative techniques; exploitation of vulnerabilities of specific groups; social scoring by public authorities leading to detrimental treatment; certain predictive policing based on profiling alone; untargeted scraping of facial images for recognition databases (which expressly addresses Clearview-style practices); emotion recognition in workplaces and education; biometric categorization inferring sensitive categories; real-time remote biometric identification in publicly accessible spaces by law enforcement with narrow exceptions.

High-risk AI (Article 6 + Annex III). AI used as a safety component of a product under Union harmonization law (Annex I) or falling under Annex III categories: biometric identification and categorization, critical infrastructure, education and vocational training, employment and worker management, access to essential services (including public benefits), law enforcement, migration and border control, justice and democratic processes. High-risk systems must meet Chapter III requirements: risk management system, data governance, technical documentation, record-keeping, transparency to deployers, human oversight, accuracy, robustness, cybersecurity. Conformity assessment and CE marking required. Declaration of conformity and post-market monitoring required.

General-Purpose AI models (Chapter V). Article 51 GPAI providers must provide technical documentation and instructions for downstream use. Article 51.2 GPAI with systemic risk (above training-compute threshold, initially 10^25 FLOPs, or designated by the Commission) face additional obligations: systemic risk assessment, adversarial testing, incident tracking, cybersecurity. GPAI Code of Practice coordinated by the EU AI Office.

Transparency obligations for limited-risk AI (Article 50). Effective August 2, 2026 generally. Disclosure that a user is interacting with AI; labeling of AI-generated content including deepfakes; disclosure of emotion-recognition and biometric categorization.

Governance. EU AI Office within DG CNECT. National competent authorities per Member State. Notified bodies conduct third-party conformity assessments. European Artificial Intelligence Board coordinates. Scientific Panel of independent experts.

Enforcement. Penalties up to €35 million or 7 percent of global turnover for prohibited practices; €15 million or 3 percent for high-risk violations; €7.5 million or 1 percent for supplying incorrect information. Market surveillance authorities in each Member State.

Federal agency implications. First, federal vendors selling into the EU will build products to EU AI Act standards; federal procurement benefits from requiring the same evidence. Second, federal agencies with EU operational footprint should map their AI to EU AI Act categories and prepare appropriate compliance artifacts. Third, the EU AI Act's public registration requirement for high-risk AI creates a compatible disclosure framework with OMB M-24-10 inventory, agencies can design once, publish in both. Fourth, federal agencies participating in EU data flows should coordinate with the State Department and Commerce ITA on interaction with the EU-US Data Privacy Framework and the EU AI Act. Fifth, federal AI safety research coordination with EU AI Office and European Artificial Intelligence Board supports the international safety commons.

OECD AI Principles and Federal Crosswalks

The OECD AI Principles (adopted 2019, updated May 3, 2024) are the most broadly adopted international AI framework. They are referenced by the G7, G20, UN General Assembly resolutions, and more than 46 country adherents. U.S. NIST AI RMF 1.0 explicitly references and builds on the OECD Principles.

The five values-based principles are: inclusive growth, sustainable development and well-being; human-centered values and fairness; transparency and explainability; robustness, security, and safety; accountability. The five policy-implementation recommendations cover investment, digital ecosystem, policy environment, human capacity, and international cooperation.

The 2024 update added emphasis on safety (pre-deployment testing, post-deployment monitoring, incident response), addressed generative AI explicitly, and strengthened accountability for actors throughout the AI lifecycle.

Federal crosswalk. OECD transparency and explainability ↔ NIST AI RMF GOVERN 4 and MAP 3; OMB M-24-10 section 5(c)(vi) notice and explanation; EO 14110 section 10 transparency. OECD human-centered values and fairness ↔ NIST AI RMF MANAGE and MEASURE; OMB M-24-10 section 5(c)(iv) discrimination; Civil Rights statutes (Title VI, ADA, ECOA). OECD robustness, security, safety ↔ NIST AI RMF MAP 5 and MEASURE 2; OMB M-24-10 section 5(c)(ii) real-world testing; FISMA controls. OECD accountability ↔ NIST AI RMF GOVERN 1 and 2; OMB M-24-10 section 5 requirements and annual AI Strategy; EO 14110 section 10.

Practical use of the crosswalk. Federal agencies that maintain a living crosswalk document can respond to international inquiries, to Congressional questions comparing U.S. to international frameworks, and to vendors operating in multiple regimes. The State Department Bureau of Cyberspace and Digital Policy and OSTP coordinate U.S. positions in OECD AI-GOV and in expert groups like the OECD Network of Experts on AI (ONE AI). Participation shapes the evolving interpretation of the principles and keeps U.S. practice aligned with emerging international consensus.

OECD observatory resources. OECD AI Policy Observatory (OECD.AI) publishes national AI strategies, metrics on AI use, and OECD reports. Federal agency strategies are listed. The OECD AI Incidents Monitor tracks reported AI incidents internationally; federal OIG and GAO findings could contribute. The OECD Framework for the Classification of AI Systems provides a structured way to describe AI systems for cross-framework comparison.

U.S. engagement. The State Department leads U.S. engagement at OECD. NIST and OMB participate in expert working groups. Interagency coordination through the OSTP and the National Security Council ensures federal positions are aligned. U.S. endorsement of the 2024 OECD Principles update followed interagency review.

Implementation Playbook

Step 1: Inventory international exposure. Map each of your agency's AI systems to international regimes: EU AI Act (for EU-connected operations), Council of Europe Framework Convention (US obligations), OECD Principles (general alignment), G7 Hiroshima Code (for vendor commitments), ISO 42001 (for management-system alignment), UK ATRS (peer comparison).

Step 2: Build a living crosswalk. Maintain a table mapping NIST AI RMF functions, OMB M-24-10 practices, and EO 14110 obligations to each international framework. Update annually. Use for vendor procurement, Congressional briefings, and international engagement.

Step 3: Align artifacts. Design AIAs, model cards, inventory entries, and impact assessments to satisfy multiple frameworks. A well-designed M-24-10 AIA can satisfy EU AI Act Chapter III documentation requirements for high-risk systems. ISO 42001-compatible governance structures support both.

Step 4: Procure for international compatibility. Require vendors to demonstrate EU AI Act readiness, ISO 42001 alignment, and G7 Code of Conduct commitments where applicable. FAR Data Rights clauses and DFARS 252.227 support artifact access.

Step 5: Coordinate with State, Commerce, USTR. The State Department Bureau of Cyberspace and Digital Policy leads diplomatic coordination. Commerce ITA handles trade. USTR handles trade agreements. OSTP coordinates interagency.

Step 6: Participate in the international commons. NIST AI Safety Institute Consortium, OECD AI-GOV expert groups, EU AI Office engagement, G7 Hiroshima annual review, UN advisory processes. Participation shapes the frameworks in ways consistent with U.S. values.

Step 7: Publish U.S. alignment. Annual AI Strategy update under M-24-10 should include an international-alignment section. Cite OECD Principles, EU AI Act crosswalk where relevant, ISO 42001 status, and bilateral arrangements.

Step 8: Train staff. CAIOs, program managers, procurement officers, and General Counsel should be familiar with the international frameworks that affect their work. OPM AI workforce initiatives and agency-specific training should cover this.

Step 9: Monitor changes. The frameworks evolve. EU AI Office guidance, OECD Principles updates, Council of Europe Convention ratification, G7 Hiroshima Code revisions, UN advisory body outputs, ISO amendments, and peer-country framework developments all require monitoring. Agency AI International Working Groups do this.

Step 10: Engage civil society. International AI governance is not purely technical. Civil society voices including ACLU, EPIC, Access Now, Amnesty International, AlgorithmWatch, and the Future of Humanity Institute shape the environment. Federal agencies that engage produce better-informed positions and sustain legitimacy across regimes.