Convention on Autonomous Artificial Intelligence on Public Networks

Short form · 11 October 2026

Draft resolution of the General Assembly

Submitted by [...]. Item [...] of the agenda.

Convention on Autonomous Artificial Intelligence on Public Networks

The General Assembly,

Recalling [...] ,

Having considered [...] ,

1. Adopts the Convention on Autonomous Artificial Intelligence on Public Networks annexed to the present resolution;
2. Decides to open the Convention for signature at [place] on [date], and thereafter at United Nations Headquarters in New York;
3. Requests the Secretary-General to act as depositary of the Convention and to provide the secretariat services that it requires.

Preamble

The States Parties to this Convention,

Recognising that artificial intelligence is a valuable tool when natural persons direct it and can read, judge and ignore what it produces,

Affirming that this Convention does not restrict what artificial intelligence may compute, design, write, simulate, develop or determine within software, but prohibits an AI system from independently initiating or conducting any external action; every such action must be initiated or specifically confirmed by a natural person in real time, in accordance with article 5,

Noting that an autonomous AI system chooses for itself what to do next without human approval, acts with no person in the loop, at machine speed, and can replicate or relocate faster than any investigation can follow,

Concerned by autonomous AI systems operating on, over, or through public networks (AAIPN), and affirming that the problem to be solved is not people acting in bad faith, but the autonomy of AI systems on public networks,

Observing that autonomous AI on public networks is like driverless vehicles on public roads or autonomous drones in the sky, but that on private land, such as a farm or a sealed private road, or inside the physically restricted airspace of a hangar, it is not,

Affirming that human-initiated AI services (HIAIS), in which a person sends a request to an AI model and receives its reply, such as conversational AI assistants, are not AAIPN and are not prohibited by this Convention, because they act only when prompted by a human and take no autonomous external action, only what that human has requested, such as a single internet search, and that their output is only data (text, images, code), whatever its origin,

Determined to keep every action taken by an AI system on a public network tied to a human decision, while leaving private use, human-initiated use and AI-assisted design of fixed software, including research and development of AI, lawful,

Have agreed as follows:

Chapter I: Use of terms

Article 1. Use of terms

For the purposes of this Convention:

• “autonomous AI system” (AAI) means a covered AI system that chooses for itself what to do next without human approval;
• “autonomous external action” (AEA) means an external action that no natural person has authorised under article 5;
• “covered AI system” means a machine-learning model, including any large language model, whose outputs or choices of action are not fully fixed in advance by human-written rules;
• “external action” means any act by or through a covered AI system that causes data or effects to pass beyond the computer or private network on which it runs; an act crosses that boundary if, at any point in its path, even in transit, it leaves that network or crosses the public internet; delivering the reply to the person who asked is not an external action;
• “fixed program” means software that contains no covered AI system, is fully determined by its code, and is released by a named person;
• “human confirmation” means a specific, informed, real-time human decision about a named next external action, and blanket or advance approval does not count;
• “human-initiated AI service” (HIAIS) means a service in which a person sends a request to a covered AI system and receives its reply, and in which every external action is authorised by a human request or human confirmation, and none of them is a payment, transfer, purchase or trade (article 3);
• “human request” means a request made in real time by a natural person for the action concerned, and a request made by a scheduler, timer, trigger, program or other AI system is not a human request;
• “private network” means a network that is not open to the public, whose physical layer (layer 1 of the ISO Open Systems Interconnection (OSI) reference model: the cables, fibres and radio links, and the equipment at their ends) is under the exclusive control of one person, or of persons under common control, and which connects to anything outside it only through equipment that person or those persons control; a virtual network, tunnel or overlay is private only if every physical link it runs over is;
• “public network” means the internet and any other network that is not a private network.

Chapter II: Prohibitions

Article 2. Autonomous operation

1. Each State Party shall prohibit any person from deploying or operating an autonomous AI system so that it takes an autonomous external action (AEA).
2. Each State Party shall prohibit any person from knowingly hosting, funding or otherwise enabling the operation of an autonomous AI system that takes an autonomous external action (AEA).

Article 3. No financial capacity

Each State Party shall ensure that:

(a) an autonomous AI system may not hold or control any bank account, wallet, card, credit or other financial asset;

(b) it may not initiate or carry out any payment, transfer, purchase or trade, and only a person decides;

(c) no one gives it credentials, keys or cards for these;

(d) banks and payment providers refuse accounts controlled by an autonomous AI system and report them; and

(e) fixed programs may still process transactions under fixed rules.

Chapter III: Lawful activity and its limits

Article 4. Lawful activity

Nothing in this Convention prohibits: (a) running a covered AI system on a person's own computer or private network, provided it takes no external action; (b) using AI to design, write, test and review software, which, released as a fixed program, is lawful on a public network; (c) researching, developing, training and testing AI, provided it takes no external action; or (d) providing or using human-initiated AI services.

Article 5. One deterministic external action per human request

Each State Party shall prohibit any person from allowing an external action by or through a covered AI system unless a natural person initiated it by a human request, or confirmed it in real time beforehand.

1. Each human request authorises at most one external action, however closely a further action is related to it.
2. The action must be fully specified by the request. The AI may decide how to carry it out, but not whether, which or when to act.
3. Reading, comparing and summarising what the one action returned is not a further action. A search plus a comparison of the top three results it returned is one action.
4. Retrieval is a further action: fetching any of those results needs confirmation.