May 12, 2026 | Outline Drafting | Data Governance

On 12 May 2026, the Consultative Committee of the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108) of the Council of Europe released the revised draft guidelines on privacy and data protection in the context of large language models (LLM)-based systems (T-PD(2025)3rev3). The revised draft guidelines address privacy and data protection risks across the lifecycle of LLM-based systems, covering model creation, post-training adaptation, system integration, operational deployment, and end-user interaction. The revised draft guidelines operationalise the principles of Convention 108 and its Amending Protocol CETS No. 223 (Convention 108+), including lawfulness, fairness, purpose limitation, data minimisation, transparency, accountability and data security.Grounded in Article 10.2 of Convention 108+, the draft guidelines set out the Identify, Assess, Mitigate and Monitor (IAMM) methodology to support privacy risk governance across the LLM lifecycle. They are directed at states and governments, LLM providers, deployers, industry actors, civil society organisations, users and supervisory authorities, and reflect the Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law (CETS No. 225). No finalisation date has been announced.