Written and maintained by CASRAI Editorial Board
Last updated
Verified line by line against three primary Council of Europe documents: the published book HUDERIA – Methodology and Model (Council of Europe Publishing, April 2026, ISBN 978-92-871-9692-7), the terms of reference of the Steering Committee for New and Emerging Digital Technologies (Extract from CM(2025)131-addfinal), and the report of the CDNET’s 1st plenary meeting (CDNET(2026)R1, issued 8 June 2026). This page is a snapshot as of 25 September 2026. Secondary coverage of HUDERIA stops at “the Model was approved.” It was — but what was approved is one resource set out of a register that the Council of Europe has itself scheduled out to the end of 2027, and the published book quietly records one resource that was considered and left out. This page is the register: what HUDERIA formally consists of today, what is only on a deadline, and what an organisation is actually claiming when it says it follows HUDERIA.
The Register, as of 25 September 2026
HUDERIA is not one document. It is a Methodology, a Model that is supposed to carry five numbered Components, and a set of supporting resources. Here is every piece, with its real status:
| Piece | Status as of 25 September 2026 | Evidence |
|---|---|---|
| HUDERIA Methodology | Approved. Committee of Ministers, 26 February 2025 | Stated on the title page of the published book |
| HUDERIA Model: Context-Based Risk Analysis (COBRA) Resources A, B, C, E and F | Adopted 5 November 2025; Model approved by the Committee of Ministers 25 February 2026 | Book title page; footnote 1 to the contents page |
| COBRA Resource D | Considered and not included. No future decision prejudiced | Footnote 1 to the contents page |
| Component No. 1 — Guidance on Context-based Risk Analysis and Stakeholder Engagement Process | In drafting. Draft sent back for revision, April 2026; deadline 31 December 2026 | CDNET(2026)R1 paras 22–23; ToR deliverable 1 |
| Component No. 2 — Recommendations on Roles and Responsibilities in AI Project Lifecycle | Not adopted. Discussion paper only; aimed at adoption at the next plenary; deadline 31 December 2026 | CDNET(2026)R1 paras 24–25; ToR deliverable 2 |
| Component No. 3 — Procurement Guidelines | Not adopted. Online working group established April 2026; deadline 31 December 2027 | CDNET(2026)R1 paras 26–27; ToR deliverable 7 |
| Component No. 4 — Mapping Report on Interoperability Clauses | Not adopted. Online working group established April 2026; deadline 31 December 2027 | CDNET(2026)R1 paras 28–29; ToR deliverable 8 |
| Component No. 5 — Templates and Workflow for the Implementation of HUDERIA Documentation | Deferred. Postponed in April 2026 to a later stage; deadline 31 December 2027 | CDNET(2026)R1 para 30; ToR deliverable 9 |
| SEP Resources (stakeholder salience questions, engagement methods, factors determining objectives and levels of engagement) | Do not exist. Cited in the Methodology as “to be developed and adopted by the CDNET in 2026” | Book, footnotes 16, 17, 18 and 19 |
| “Roles and responsibilities” section of the Model | Does not exist. Cited in the Methodology as “to be developed and adopted by the CDNET in 2026” | Book, footnote 3 |
| Joint online platform with the OECD AI Observatory for collecting HUDERIA application practice | Not built. Deadline 30 June 2027 | ToR deliverable 4 |
Counted by numbered Component, four of the five — Components 2, 3, 4 and 5 — have nothing adopted at all, and three of those four had no draft text in circulation as of the last public meeting report. The fifth, Component No. 1, is the only one in active drafting, and even it was sent back for revision in April 2026.
What Is Actually Adopted: a Methodology and One Resource Set
The published book has two parts, and the asymmetry between them is the whole story.
Part I is the Methodology: a technology-neutral, non-binding procedure organised around four elements — Context-Based Risk Analysis (COBRA), the Stakeholder Engagement Process (SEP), the Risk and Impact Assessment, and the Mitigation Plan — followed by an Iterative Review that runs across the system’s life cycle. That is the part the Committee of Ministers approved on 26 February 2025.
Part II is the Model. Its full heading in the book is “Resource model for context-based risk analysis (COBRA)”, and its contents run exactly as far as its name: an introduction, an overview of COBRA Resources A, B and C, then Resources A (risk factors arising in the AI system’s application context), B (design and development context), C (deployment context), E (illustrative areas of potential concern from the point of view of human rights, democracy and the rule of law) and F (illustrative list of sectors/domains and potential areas of concern).
There is no Part covering SEP resources, no Part covering the risk and impact assessment, no Part covering mitigation planning, and no Part covering documentation templates. The Model that was approved on 25 February 2026 is a resource model for the first of the Methodology’s four elements. The World Privacy Forum, which built an interactive tool on top of it, describes what it implemented in exactly those terms: the HUDERIA Model: COBRA.
The Lettering Skips D, and the Book Says Why
Read the contents page of the published book and the COBRA resources run A, B, C, E, F. The gap is not a typography error. Footnote 1 on that page records the decision:
“The Committee on Artificial Intelligence (CAI) considered the possible inclusion of a COBRA Resource D; however, without prejudice to any future decision on its inclusion, the HUDERIA Model: Context-Based Risk Analysis Resources adopted on 5 November 2025 comprises COBRA Resources A, B, C, E and F.”
Three things are worth extracting from that single sentence. First, the adoption date of the COBRA resources is 5 November 2025 — during the CAI’s final plenary, and nearly four months before the Committee of Ministers approved the Model. Second, a Resource D was drafted far enough to be considered as a candidate for inclusion and was left out. Third, the wording “without prejudice to any future decision on its inclusion” deliberately keeps the letter D reserved. The lettering gap is a placeholder, not a mistake, and anyone building a crosswalk, a compliance checklist or a software tool against COBRA should expect a D-shaped hole to be filled later rather than renumber around it.
No secondary source we could find covers this at all. Searching for the phrase returns the Council of Europe’s own PDFs and nothing else.
The Methodology Footnotes Materials That Do Not Exist
The more consequential gap is inside Part I. The Methodology’s own body text repeatedly points readers at support materials, in the ordinary way a standard points at its annexes — and then, in square brackets, admits those materials have not been written. Four footnotes carry the identical formula “[to be developed and adopted by the CDNET in 2026]”:
- Footnote 3, on the risk and impact assessment: “The ‘Roles and responsibilities’ section in the HUDERIA Model [to be developed and adopted by the CDNET in 2026] will provide guidance in connection with this aspect of the Methodology.”
- Footnote 16, on stakeholder identification: “SEP Resources (List of questions to assess relative stakeholder salience) [to be developed and adopted by the CDNET in 2026] provides detailed questions and tools to guide the identification of relevant stakeholders.”
- Footnote 17, on engagement planning: SEP Resources, same bracket, “provides indicative detailed questions and the description of options for stakeholder engagement.”
- Footnote 18: “SEP Resources (Examples of relevant engagement methods with relevant questions) [to be developed and adopted by the CDNET in 2026].”
- Footnote 19, on severity and reversibility: “SEP Resources A and B [to be developed and adopted by the CDNET in 2026] provide detailed questions (List of questions to assess relative stakeholder salience) and the description of formats of stakeholder engagement (List of factors determining the objectives and levels of stakeholder engagement).”
Footnote 19 is the most revealing: it names SEP Resources A and B, with titles, as though the lettered series already existed in parallel to the COBRA series. It does not. A practitioner who tries to run the Stakeholder Engagement Process as the Methodology describes it will find the salience questions, the engagement-method catalogue and the factors that set engagement objectives and levels all missing, with a forward reference where the content should be.
The CDNET Deliverable Schedule Through 2027
Those missing pieces are not unscheduled. The Committee of Ministers wrote them into the terms of reference of the CDNET, the steering committee that took over HUDERIA from the Committee on Artificial Intelligence. The CDNET’s mandate runs from 1 January 2026 to 31 December 2027, it meets in plenary twice a year for three days, and its instruction on HUDERIA is to “carry on the work of the Committee on Artificial Intelligence (CAI)” and to “adopt, as necessary and depending on the outcomes of the last CAI Plenary meeting in November 2025, additional supporting materials.”
Its HUDERIA-related deliverables, with the deadlines as they appear in the terms of reference:
| ToR deliverable | Title, as written | Deadline |
|---|---|---|
| 1 | HUDERIA Model: Component No. 1 on Guidance on Context-based Risk Analysis and Stakeholder Engagement Process | 31 December 2026 |
| 2 | HUDERIA Model: Component No. 2 on “Recommendations on Roles and Responsibilities in AI Project Lifecycle” | 31 December 2026 |
| 4 | In coordination with the OECD AI Observatory, set up an online platform for collecting and sharing the practice of HUDERIA application | 30 June 2027 |
| 7 | HUDERIA Model: Component No. 3 on “Procurement Guidelines” | 31 December 2027 |
| 8 | HUDERIA Model: Component No. 4 on a “Mapping Report on Interoperability Clauses” | 31 December 2027 |
| 9 | HUDERIA Model: Component No. 5 on “Templates and Workflow for the Implementation of HUDERIA Documentation” | 31 December 2027 |
| 10 | Working document analysing the needs of various HUDERIA user groups, mapping usability and capacity-building needs — expressly including “analysis of the HUDERIA impact on public procurement, localisation of the methodology, especially for public sector AI” | 31 December 2027 |
Two observations. Component No. 1’s title tells you the design intent: COBRA guidance and SEP guidance were always meant to ship together, which is why the Methodology’s SEP footnotes point at 2026. And the single hardest deadline in the register — the templates and workflow that would let an organisation actually produce HUDERIA documentation — is the last one, 31 December 2027, two years after the Model was first approved.
Where Each Component Stood at the 1st Plenary
The CDNET held its first plenary in Strasbourg from 15 to 17 April 2026, electing Mario Hernández Ramos (Spain) as Chairperson and Thomas Schneider (Switzerland) as Vice-Chairperson, and admitting thirty-four civil society organisations as observers — several of which, the report notes, “specifically referenced HUDERIA as a model they use, implement, or draw inspiration from.” The meeting report, CDNET(2026)R1, gives each Component its own agenda item, and the outcomes differ sharply:
- Component No. 1 came to the table as a draft, CDNET(2026)4, covering the Stakeholder Engagement Process, previously examined by the CAI. Members debated the balance between generic and AI-specific content and asked for more attention to indirectly affected stakeholders. The Committee instructed the Secretariat to prepare a revised version, set a deadline of 29 May 2026 for written comments, and decided to examine the revised draft by written procedure rather than waiting for a plenary.
- Component No. 2 existed only as a Secretariat discussion paper, CDNET(2026)2. Written comments were due by the same 29 May 2026 date, the Chair and Secretariat were instructed to prepare the draft, and the stated aim is “submitting a consolidated proposal for adoption at the next plenary meeting.”
- Component No. 3, Procurement Guidelines, drew what the report calls “strong interest.” It was handed to a newly established online working group to advance between plenaries.
- Component No. 4, on interoperability clauses, also went to a new online working group, after a discussion that was still settling what “interoperability” means in the HUDERIA context.
- Component No. 5 was deferred outright: the Committee “decided to consider” it “at a later stage in light of advancement of discussion on the other HUDERIA Model Components.” No working group, no drafting instruction.
The Committee also noted work on a potential interactive HUDERIA online tool and a HUDERIA Health Academy organised jointly with the Council of Europe’s biomedicine and health committee and the OECD — both signs of implementation effort running ahead of the components that would standardise it.
Why This Page Is Dated
The CDNET agreed to hold its 2nd plenary meeting in Strasbourg on 21–23 October 2026. That is after this page was published. Component No. 2 is explicitly aimed at adoption there, and Component No. 1’s revised draft was routed to a written procedure that could conclude at any time without a meeting. So this register is accurate as a snapshot on 25 September 2026 and should be expected to change.
Checking it is harder than it should be, which is part of why the gap exists. The Council of Europe’s HTML pages for HUDERIA and the CDNET return HTTP 403 to automated requests, so the meeting reports and terms of reference are effectively invisible to ordinary search. Both are reachable as raw PDFs on rm.coe.int, linked in the sources below. To re-check this page, read the most recent CDNET meeting report and compare it against the deliverable table above.
What “We Follow HUDERIA” Can Honestly Mean Today
An organisation that says it follows HUDERIA in September 2026 is, at most, saying this: it applies a non-binding, technology-neutral methodology approved in February 2025, supported by one adopted resource set covering the first of that methodology’s four elements. The stakeholder-engagement resources the methodology cites do not exist. The roles-and-responsibilities guidance it cites does not exist. Procurement guidance, interoperability mapping and documentation templates are scheduled for the end of 2027.
That is not a criticism of the claim — running COBRA well is real work, and the Methodology is a serious document. It is a caution about what the claim can bear. If a vendor questionnaire, a grant condition or a contract clause treats “HUDERIA-compliant” as a verifiable state, ask which element the assessment covered and which resource set it used. There is currently only one defensible answer to the second question. The same discipline applies to any self-assessed governance claim; our AI governance maturity model walks through the difference between a practice an organisation performs and a practice it can evidence.
Why Research Administrators Should Track This
Two items in the register land directly on university offices in Council of Europe member states.
Component No. 3, Procurement Guidelines, is the one that will eventually be handed to procurement and sponsored-programs offices. Public universities in CoE states buy AI-enabled systems under public-procurement law, and the CDNET’s terms of reference are unusually explicit about who the output is for: deliverable 10 names “analysis of the HUDERIA impact on public procurement, localisation of the methodology, especially for public sector AI.” That is a work item about whether a methodology written for AI project teams can be turned into contract language and tender criteria. Both are due 31 December 2027, which means institutions writing AI procurement standards in 2026 are writing them before the guidance arrives — and will likely have to reconcile them afterwards. If you are drafting those clauses now, the existing instruments are the practical reference point; we compare two of them in AI procurement clauses: OMB M-25-22 versus the EU model contractual clauses.
Component No. 2, Roles and Responsibilities in the AI Project Lifecycle, matters to any institution trying to work out who owns an AI risk assessment internally — the research-computing group that hosts the model, the IRB that reviews the study using it, the data-protection officer, or the principal investigator. The Methodology already assumes such an allocation exists and footnotes a section that does not. Until Component No. 2 is adopted, that allocation is entirely a local decision.
The broader driver is the treaty this work supports. HUDERIA exists to help Parties implement the Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law (CETS No. 225), and the CDNET is its custodian until the Conference of the Parties is established. The European Union ratified the Framework Convention on 15 May 2026, according to a footnote in the plenary report. As ratifications accumulate, pressure to point at a concrete assessment procedure will grow faster than the procedure is being completed.
The Short Version
- HUDERIA today is a Methodology (approved 26 February 2025) plus one resource set, COBRA (adopted 5 November 2025, approved as the Model on 25 February 2026).
- COBRA is itself short a resource: the lettering runs A, B, C, E, F, and the book records that a Resource D was considered and not included, without prejudice to a future decision.
- Five numbered Components are planned. None is adopted. Component No. 1 is in revision, Component No. 2 is aimed at the October 2026 plenary, Components 3 and 4 are with online working groups, and Component No. 5 was deferred.
- The Methodology’s own footnotes cite SEP resources and a roles-and-responsibilities section that do not exist yet.
- Deadlines: Components 1 and 2 by 31 December 2026; the OECD AI Observatory platform by 30 June 2027; Components 3, 4 and 5 by 31 December 2027.
- Snapshot date: 25 September 2026. The 2nd CDNET plenary, 21–23 October 2026, is expected to change it.
Sources
- Council of Europe, HUDERIA – Methodology and Model, Council of Europe Publishing, April 2026 (ISBN 978-92-871-9692-7; PDF 978-92-871-9693-4): rm.coe.int — title page, contents page footnote 1, and body footnotes 3, 16, 17, 18 and 19.
- Terms of reference of the Steering Committee for New and Emerging Digital Technologies (CDNET), Extract from CM(2025)131-addfinal: rm.coe.int — duration, main task (iv), and main deliverables 1, 2, 4, 7, 8, 9 and 10.
- CDNET, 1st Meeting, Strasbourg, 15–17 April 2026 — Meeting Report, CDNET(2026)R1, 8 June 2026: rm.coe.int — paragraphs 8, 10, 14, 16, 17, 22–30 and 34, and Appendix III.
- World Privacy Forum, interactive tool based on HUDERIA Context-Based Risk Analysis: worldprivacyforum.org — corroborates that the instrument approved on 25 February 2026 is the HUDERIA Model: COBRA.
