Artificial intelligence procurement and deployment: ensuring alignment with the Guiding Principles on Business and Human Rights

In the present report, the Working Group on the issue of human rights and transnational corporations and other business enterprises analyses the trends in regulation and the emerging practices by States and by businesses that procure and deploy artificial intelligence (AI),¹ although do not develop AI themselves, and the implications for human rights thereof.

1. While the Working Group acknowledges that AI is an umbrella term that encompasses loosely related technologies (see Arvind Narayanan and Sayash Kapoor, AI Snake Oil: What Artificial Intelligence Can Do, What It Can’t, and How to Tell the Difference (Princeton, New Jersey, United States of America, Princeton University Press, 2024)), it applies the Organisation for Economic Co-operation and Development definition of an AI system as a machine-based system that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments (see https://www.oecd.org/en/publications/explanatory-memorandum-on-the-updated-oecd-definition-of-an-ai-system_623da898-en.html). ↩

The Working Group has recognized the vital roles of new technologies and notes the increasing deployment of AI systems across the public and private sectors. In its stocktaking exercise of the implementation of the Guiding Principles on Business and Human Rights over the first decade since their adoption in 2011,² the Working Group acknowledged that digital technologies were essential for achieving the Sustainable Development Goals by 2030. AI has the potential, for example, to enhance the efficiency of the financial sector, reduce hunger through precision farming and improve the affordability of healthcare.³ At the same time, the use of technological products and services can have an adverse impact on virtually all internationally recognized human rights. AI presents significant challenges in terms of data protection, security, privacy, discrimination, exclusion and the right to a clean, healthy and sustainable environment.⁴ Further, AI systems can be exploited to influence information and interfere with democratic processes, unduly restricting freedom of expression, stifling dissent and limiting access to diverse viewpoints.⁵

2. See https://www.ohchr.org/sites/default/files/2021-12/ungps10plusroadmap.pdf. ↩
3. See https://s41721.pcdn.co/wp-content/uploads/2021/06/eBat-2402309_AI-for-Good-Impact-Report-E-v6.pdf; and https://www.geneva-academy.ch/joomlatools-files/docman-files/GHRP%20-%20AI%20Decoded.pdf. ↩
4. See, for example, A/75/590, A/HRC/44/24, A/HRC/44/57, A/HRC/48/76, A/HRC/56/68 and A/HRC/57/70; and Alberto Coddou, Sebastián Smart and Valentina Vivallo, “Derechos humanos e inteligencia artificial: el caso chileno”, in Informe Annual sobre Derechos Humanos en Chile 2024, Judith Schönsteiner, Claudio Fuentes Maureira and Senead Barrera Trabol, eds. (Santiago, Centro de Derechos Humanos, Facultad de Derecho de la Universidad Diego Portales, 2024). ↩
5. See https://www.europarl.europa.eu/RegData/etudes/IDAN/2024/754450/EXPO_IDA(2024)754450_EN.pdf. ↩

The Guiding Principles on Business and Human Rights provide a framework for stakeholders to prevent and mitigate adverse human rights impacts and are thus a compelling starting point for States and businesses seeking to address these impacts in the context of AI procurement and deployment. Efforts are already under way to provide guidance on these aspects to businesses, policymakers and other key stakeholders in line with the Guiding Principles.⁶

6. See https://www.ohchr.org/en/business-and-human-rights/b-tech-project. ↩

The protection of human rights is increasingly emphasized in regulatory developments related to AI, such as the Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law, the AI Act of the European Union and the Continental Artificial Intelligence Strategy of the African Union. However, evidence from the Working Group’s consultations and submissions has shown that there are still significant gaps when it comes to legislative frameworks on rights-respecting procurement and deployment of AI systems by States and businesses. Further, for many businesses, understanding of the human rights implications of the deployment of AI systems 1 While the Working Group acknowledges that AI is an umbrella term that encompasses loosely related technologies (see Arvind Narayanan and Sayash Kapoor, AI Snake Oil: What Artificial Intelligence Can Do, What It Can’t, and How to Tell the Difference (Princeton, New Jersey, United States of America, Princeton University Press, 2024)), it applies the Organisation for Economic Co-operation and Development definition of an AI system as a machine-based system that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments (see https://www.oecd.org/en/publications/explanatory-memorandum-on-the-updated-oecd-definition-ofan-ai-system_623da898-en.html). 2 See https://www.ohchr.org/sites/default/files/2021-12/ungps10plusroadmap.pdf. 3 See https://s41721.pcdn.co/wp-content/uploads/2021/06/eBat-2402309_AI-for-Good-Impact-ReportE-v6.pdf; and https://www.geneva-academy.ch/joomlatools-files/docmanfiles/GHRP%20-%20AI%20Decoded.pdf. 4 See, for example, A/75/590, A/HRC/44/24, A/HRC/44/57, A/HRC/48/76, A/HRC/56/68 and A/HRC/57/70; and Alberto Coddou, Sebastián Smart and Valentina Vivallo, “Derechos humanos e inteligencia artificial: el caso chileno”, in Informe Annual sobre Derechos Humanos en Chile 2024, Judith Schönsteiner, Claudio Fuentes Maureira and Senead Barrera Trabol, eds. (Santiago, Centro de Derechos Humanos, Facultad de Derecho de la Universidad Diego Portales, 2024). 5 See https://www.europarl.europa.eu/RegData/etudes/IDAN/2024/754450/EXPO_IDA(2024)754450_ EN.pdf. 6 See https://www.ohchr.org/en/business-and-human-rights/b-tech-project. remains in its early stages. Thus, the rapid, mainly unregulated, uptake of AI systems by States and businesses is creating situations with high potential for adverse impacts across a variety of human rights, in a context where existing access-to-remedy mechanisms are struggling to keep up.

The intersection of business and human rights with AI procurement and deployment has therefore become a crucial issue. Under the Guiding Principles on Business and Human Rights, States have a duty to protect individuals and communities from human rights abuses by third parties, including businesses along their value chains. At the same time, businesses themselves bear a responsibility to respect human rights across the life cycle of AI systems, including with regard to AI systems developed by third parties that they are using. Moreover, victims of human rights abuses in the context of the deployment of AI procured by States and businesses should have access to effective remedies, in accordance with the Guiding Principles on Business and Human Rights.

The Working Group seeks to achieve four key objectives with the present report: (a) to review existing regulatory frameworks and outline how States can further enhance efforts to protect human rights when regulating, procuring and deploying AI systems; (b) to map emerging practices and clarify the responsibilities of businesses to incorporate a human rights-based approach into the procurement and deployment of AI systems in their operations, products and services; (c) to consider what remedial mechanisms exist for rights holders affected by the procurement and deployment of AI systems, and how they can be strengthened; and (d) to provide States and businesses with clear guidance regarding the implementation of the Guiding Principles on Business and Human Rights in the procurement and deployment of AI systems.

Drawing on the important work of the United Nations in this field,⁷ in particular that of the United Nations High Commissioner for Human Rights,⁸ the Office of the United Nations High Commissioner for Human Rights (OHCHR)⁹ 9 and its B-Tech project,10 the special procedures of the Human Rights Council,¹¹ the International Labour Organization (ILO),¹² the United Nations Educational, Scientific and Cultural Organization (UNESCO)¹³ and the International Telecommunication Union (ITU),¹⁴ and that of the Organisation for Economic Co-operation and Development (OECD),¹⁵ 15 the World Economic Forum,¹⁶ 16 the European Union,17 the Council of Europe¹⁸ and the African Union,19 in addition to civil 7 See A/79/296 and A/HRC/43/29; and guidance of the Secretary-General on human rights due diligence for digital technology use. 8 See A/HRC/39/29, A/HRC/44/24 and A/HRC/48/31. 9 See A/HRC/50/56, A/HRC/53/42, A/HRC/56/45 and A/HRC/59/32. See also https://www.ohchr.org/sites/default/files/documents/issues/civicspace/2025-02-state-regulation-keyai-1-en.pdf. 10 See https://www.ohchr.org/en/business-and-human-rights/b-tech-project. 11 See, for example, A/73/348, A/74/493, A/76/151, A/78/310, A/HRC/32/45, A/HRC/38/48, A/HRC/41/41, A/HRC/46/37, A/HRC/47/52, A/HRC/49/52 and A/HRC/50/32. See also https://empresasyderechoshumanos.org/wp-content/uploads/2022/04/INFORMATION-NOTE-onPP_LAC_EN.pdf. 12 See https://www.ilo.org/artificial-intelligence. 13 See https://www.unesco.org/en/articles/recommendation-ethics-artificial-intelligence; https://www.unesco.org/ethics-ai/en/eia; and https://unesdoc.unesco.org/ark:/48223/pf0000391566. 14 https://www.itu.int/en/action/ai/Pages/default.aspx. 15 See https://mneguidelines.oecd.org/RBC-and-artificial-intelligence.pdf; and forthcoming guidance on human rights due diligence and AI. 16 See https://www3.weforum.org/docs/WEF_AI_Procurement_in_a_Box_AI_Government_Procurement_G uidelines_2020.pdf. 17 See https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai. 18 See https://www.coe.int/en/web/artificial-intelligence. 19 See https://au.int/en/documents/20240809/continental-artificial-intelligence-strategy. GE.25-06864 society, academia and multi-stakeholder initiatives,²⁰ in the present report, the Working Group analyses the obligations and responsibilities of various stakeholders within the evolving AI procurement and deployment landscape.

7. See A/79/296 and A/HRC/43/29; and guidance of the Secretary-General on human rights due diligence for digital technology use. ↩
8. See A/HRC/39/29, A/HRC/44/24 and A/HRC/48/31. ↩
9. See A/HRC/50/56, A/HRC/53/42, A/HRC/56/45 and A/HRC/59/32. See also https://www.ohchr.org/sites/default/files/documents/issues/civicspace/2025-02-state-regulation-key-ai-1-en.pdf. ↩
11. See, for example, A/73/348, A/74/493, A/76/151, A/78/310, A/HRC/32/45, A/HRC/38/48, A/HRC/41/41, A/HRC/46/37, A/HRC/47/52, A/HRC/49/52 and A/HRC/50/32. See also https://empresasyderechoshumanos.org/wp-content/uploads/2022/04/INFORMATION-NOTE-on-PP_LAC_EN.pdf. ↩
12. See https://www.ilo.org/artificial-intelligence. ↩
13. See https://www.unesco.org/en/articles/recommendation-ethics-artificial-intelligence; https://www.unesco.org/ethics-ai/en/eia; and https://unesdoc.unesco.org/ark:/48223/pf0000391566. ↩
14. https://www.itu.int/en/action/ai/Pages/default.aspx. ↩
15. See https://mneguidelines.oecd.org/RBC-and-artificial-intelligence.pdf; and forthcoming guidance on human rights due diligence and AI. ↩
16. See https://www3.weforum.org/docs/WEF_AI_Procurement_in_a_Box_AI_Government_Procurement_Guidelines_2020.pdf. ↩
18. See https://www.coe.int/en/web/artificial-intelligence. ↩
20. Coddou, Smart and Vivallo, “Derechos humanos e inteligencia artificial”; and Albert Sanchez-Graells, Digital Technologies and Public Procurement (Oxford, Oxford University Press, 2024). See also https://edri.org/wp-content/uploads/2024/04/EUs-AI-Act-fails-to-set-gold-standard-for-human-rights.pdf; and https://freedomonlinecoalition.com/joint-statements/. ↩

The present report has been informed by written submissions from over 75 States, businesses, civil society organizations and academics, which were provided in response to a call for inputs.²¹ It has also been informed by expert interviews, open multi-stakeholder consultations, regional consultations and targeted consultations with States, businesses, civil society organizations and trade unions.

21. See https://www.ohchr.org/en/calls-for-input/2025/call-inputs-use-artificial-intelligence-and-un-guiding-principles-business-and. ↩

Structured around the three pillars of the Guiding Principles on Business and Human Rights, the report is focused on the procurement and deployment of AI systems by States and businesses that do not design and develop AI systems themselves. AI takes various forms, but the report is predominantly focused on the category of “narrow AI”, namely, systems engineered and trained to perform specific tasks or operate within designated domains, as opposed to demonstrating broad or general intelligence capabilities across diverse tasks. The report does not directly cover issues related to the development of AI systems.²² However, the Working Group notes that the duty to protect and responsibility to respect human rights applies to all stages of the life cycle of AI systems.

22. See the work under the B-Tech project on the responsibility of technology companies (https://www.ohchr.org/en/b-tech/thematic-focus). ↩

For the purposes of the report, AI procurement is understood as the process of acquiring or obtaining AI systems by States or businesses. AI deployment is understood as the process of making AI systems operational and available for use in a real-world environment.

The rapid procurement and deployment of AI systems defies traditional regulatory and governance regimes. Technological innovation is outpacing progress in regulation, creating gaps related to the unregulated procurement and deployment of AI systems.²³ 23 Further, the digital environment operates without borders, which presents challenges that require international cooperation to uphold human rights, as reflected in the Global Digital Compact, an intergovernmental process establishing commitments for the governance of digital technology and AI. Regional cooperation initiatives toward rights-respecting AI systems are also emerging,²⁴ aimed at fostering AI that protects human rights and resonates with the socioeconomic context of the relevant region. A universal, enforceable framework 20 Coddou, Smart and Vivallo, “Derechos humanos e inteligencia artificial”; and Albert SanchezGraells, Digital Technologies and Public Procurement (Oxford, Oxford University Press, 2024). See also https://edri.org/wp-content/uploads/2024/04/EUs-AI-Act-fails-to-set-gold-standard-for-humanrights.pdf; and https://freedomonlinecoalition.com/joint-statements/. 21 See https://www.ohchr.org/en/calls-for-input/2025/call-inputs-use-artificial-intelligence-and-unguiding-principles-business-and. 22 See the work under the B-Tech project on the responsibility of technology companies (https://www.ohchr.org/en/b-tech/thematic-focus). 23 Sanchez-Graells, Digital Technologies and Public Procurement. 24 See https://www.gub.uy/agencia-gobierno-electronico-sociedad-informacionconocimiento/sites/agencia-gobierno-electronico-sociedad-informacionconocimiento/files/documentos/noticias/EN%20-%20Montevideo%20Declaration%20approved.pdf; https://conferenciaelac.cepal.org/9/sites/elac9/files/2401157e_cmsi.9_santiago_declaration.pdf; and https://infobrics.org/post/39534. that addresses the wide-ranging implications of AI for human rights, such as through a multilateral treaty, has also been called for.²⁵

23. Sanchez-Graells, Digital Technologies and Public Procurement. ↩
24. See https://www.gub.uy/agencia-gobierno-electronico-sociedad-informacion-conocimiento/sites/agencia-gobierno-electronico-sociedad-informacion-conocimiento/files/documentos/noticias/EN%20-%20Montevideo%20Declaration%20approved.pdf; https://conferenciaelac.cepal.org/9/sites/elac9/files/2401157e_cmsi.9_santiago_declaration.pdf; and https://infobrics.org/post/39534. ↩
25. See https://www.cigionline.org/static/documents/DPH-paper-Niazi-2.pdf. ↩

Globally, there are over 1,000 AI-related standards²⁶ and over 50 AI governance initiatives based on ethics, responsibility or safety principles.²⁷ United Nations-driven initiatives²⁸ are complemented by multilateral or State-led proposals, including General Assembly and Human Rights Council resolutions.²⁹ These initiatives are largely aimed at applying the framework of international human rights law to the public and private sector deployment of AI systems. For example, in the Ibero-American Charter on Artificial Intelligence in Civil Service, the preservation of human rights in the deployment of AI systems for public administration is emphasized. At the same time, standard-setting organizations such as ITU have been increasingly recognizing the need to consider human rights in AI technical standard development.³⁰ ILO is considering a new standard for decent work in the platform economy, addressing algorithmic decision-making and workers’ rights.³¹

26. See https://oecd.ai/en/dashboards/overview. ↩
27. See https://docs.google.com/spreadsheets/d/1gOZbs7dC9VsV2h0zJn60L7cUVwu9mccqz_B265tNyQY/edit?gid=0#gid=0. ↩
28. See CEB/2024/1/Add.1, annex IV. ↩
29. For example, General Assembly resolutions 78/213 and 78/265 and Human Rights Council resolutions 53/29, 54/21 and 58/23. See also https://www.gov.uk/government/publications/ai-safety-summit-2023-the-bletchley-declaration/the-bletchley-declaration-by-countries-attending-the-ai-safety-summit-1-2-november-2023; and https://g20.utoronto.ca/2023/230909-declaration.html. ↩
30. See A/HRC/53/42. ↩
31. See https://www.ilo.org/resource/news/new-report-platform-economy-marks-first-step-towards-considering-new. ↩

Recently, the trend for voluntary guidelines for AI systems has been shifting to legally binding initiatives. The AI Act of the European Union is aimed at ensuring that AI systems in the European Union are safe and respect fundamental rights. Under the Act, certain AI systems are banned and fundamental rights impact assessments must be undertaken by some public and private sector deployers of AI. The AI Act Guidelines of the European Commission are aimed at providing further legal clarity on prohibited AI practices.³² However, the Working Group notes that there is still uncertainty regarding how to address certain loopholes in the AI Act.³³ For instance, the Act allows for the export of banned systems to States outside the European Union, reinforcing a double standard that has been previously highlighted in relation to European Union legislative processes,³⁴ and contains broad exceptions for some high-risk sectors.

32. See https://digital-strategy.ec.europa.eu/en/library/commission-publishes-guidelines-prohibited-artificial-intelligence-ai-practices-defined-ai-act. ↩
33. See https://www.amnesty.eu/news/human-rights-and-justice-must-be-at-the-heart-of-the-upcoming-commission-guidelines-on-the-ai-act-implementation/; and https://www.amnesty.eu/wp-content/uploads/2024/04/EUs-AI-Act-fails-to-set-gold-standard-for-human-rights.pdf. ↩
34. See A/HRC/51/35/Add.2; and https://www.amnesty.eu/news/toxic-double-standards-how-europe-sells-products-deemed-too-dangerous-for-europeans-to-the-rest-of-the-world-joint-briefing/. ↩

The Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law is the first international legally binding instrument in this field. It is aimed at ensuring that activities within the life cycle of AI systems are consistent with human rights, democracy and the rule of law, and it applies to public authorities and private actors acting on their behalf. It is left up to the discretion of the signatory, however, to what extent, if at all, the measures contained in the Convention will apply to private actors in other situations, creating a gap in the protection of rights.³⁵ Further, the Convention contains exemptions for national security and defence, among others, raising concerns about accountability in high-risk contexts.36 25 See https://www.cigionline.org/static/documents/DPH-paper-Niazi-2.pdf. 26 See https://oecd.ai/en/dashboards/overview. 27 See https://docs.google.com/spreadsheets/d/1gOZbs7dC9VsV2h0zJn60L7cUVwu9mccqz_B265tNyQY/ edit?gid=0#gid=0. 28 See CEB/2024/1/Add.1, annex IV. 29 For example, General Assembly resolutions 78/213 and 78/265 and Human Rights Council resolutions 53/29, 54/21 and 58/23. See also https://www.gov.uk/government/publications/ai-safetysummit-2023-the-bletchley-declaration/the-bletchley-declaration-by-countries-attending-the-aisafety-summit-1-2-november-2023; and https://g20.utoronto.ca/2023/230909-declaration.html. 30 See A/HRC/53/42. 31 See https://www.ilo.org/resource/news/new-report-platform-economy-marks-first-step-towardsconsidering-new. 32 See https://digital-strategy.ec.europa.eu/en/library/commission-publishes-guidelines-prohibitedartificial-intelligence-ai-practices-defined-ai-act. 33 See https://www.amnesty.eu/news/human-rights-and-justice-must-be-at-the-heart-of-the-upcomingcommission-guidelines-on-the-ai-act-implementation/; and https://www.amnesty.eu/wpcontent/uploads/2024/04/EUs-AI-Act-fails-to-set-gold-standard-for-human-rights.pdf. 34 See A/HRC/51/35/Add.2; and https://www.amnesty.eu/news/toxic-double-standards-how-europesells-products-deemed-too-dangerous-for-europeans-to-the-rest-of-the-world-joint-briefing/. 35 See https://opiniojuris.org/2024/11/05/understanding-the-scope-of-the-council-of-europe-frameworkconvention-on-ai/. 36 A/HRC/52/39, para. 40. GE.25-06864

35. See https://opiniojuris.org/2024/11/05/understanding-the-scope-of-the-council-of-europe-framework-convention-on-ai/. ↩

The lack of consensus on key concepts such as “AI” and “ethics” is leading to inconsistencies in the regulation of AI systems and is particularly problematic given the transnational nature of AI. Instruments such as the UNESCO Recommendation on the Ethics of Artificial Intelligence, which incorporates a human rights-based approach that can be applied to AI procurement and deployment by private and public actors, can help address this and promote policy coherence across jurisdictions.

In addition, regulatory discussions have not sufficiently incorporated the perspective and different contexts of States in the global South, which are facing risks and impacts that are different to those faced by States in the global North.³⁷ If the global South is not included in AI decision-making, it is more likely to be exposed to negative AI impacts – such as labour displacement, political destabilization and widening economic inequality – and deprived of AI benefits.³⁸ There is also a need for discussions around if and when not to develop or to deploy AI systems, given that some are fundamentally incompatible with human rights. Crucially, current legislation does not set absolute limits. For instance, even after conducting a fundamental rights impact assessment under the AI Act of the European Union, there are no clearly defined red lines.³⁹

37. See, for example, https://www.un.org/digital-emerging-technologies/sites/www.un.org.techenvoy/files/MindtheAIDivide.pdf; and https://www.un.org/sites/un2.un.org/files/governing_ai_for_humanity_final_report_en.pdf. ↩
38. See https://www.t20brasil.org/media/documentos/arquivos/TF05_ST_05_Bridging_the_AI_gov66cdcbf06f991.pdf. ↩
39. See https://dataethics.eu/wp-content/uploads/2021/11/OUR-COMMON-AI-FUTURE-_-Francesco-Lapenta.pdf; and https://www.undp.org/eurasia/publications/impact-digital-technology-human-rights-europe-and-central-asia. ↩

In many cases, civil society has not been meaningfully involved in the development of legal frameworks governing AI deployment by the private and public sectors, leading to rights holders’ scepticism regarding the ability of these frameworks to effectively protect human rights. Further, there is an opportunity for the international community to foster a more rights-respecting AI ecosystem through global collaboration for AI capacity-building.⁴⁰ For instance, the AI Skills Coalition, spearheaded by AI for Good of ITU, serves as a platform for delivering AI skills, knowledge and expertise, particularly in developing and least developed countries and for women and girls.

40. See A/HRC/53/24. ↩

Further, the Working Group notes that States have become, along with technology businesses, principal producers, consumers and facilitators of data, highlighting the increased importance of them upholding their duty to protect human rights.⁴¹ A human rights-based approach would require preventing harm from happening by embedding human rights principles, including with regard to privacy, transparency and accountability, into the collection and selection of data, design, development and deployment of the resulting AI systems. To be rights-respecting, in line with the Guiding Principles on Business and Human Rights, current legislative efforts must shift from regulating machines to protecting people who are affected and classified by AI systems.⁴² Even with legally binding initiatives for AI systems that explicitly consider human rights, implementation and enforcement will be key.

41. See https://www.hks.harvard.edu/sites/default/files/2024-08/24_Smart_Final_01.pdf. ↩
42. See https://www.alsur.lat/sites/default/files/2024-10/ALSUR%20-%20IA%20en%20Latam%20%5BENG%5D-1.pdf. ↩

The Working Group highlights the landmark Human Rights Council resolution 58/23, in which the Council called upon States to promote a safe and enabling environment for human rights defenders and to put in place safeguards to prevent the misuse of digital tools to suppress dissent or target human rights defenders.

States as regulators, procurers and deployers

States are procuring AI systems from businesses and other actors and deploying them across various sectors and functions, such as health, mobility, e-government, education, public order, safety, welfare, criminal justice, the judiciary and surveillance. The following analysis explores the elements that States need to consider to uphold their duty to protect human rights when regulating AI systems and to respect human rights when procuring AI systems from businesses and deploying them for the provision of public services. The analysis that follows is based on a non-exhaustive list of examples, recognizing the many risks of the applications of AI systems across different sectors and contexts.⁴³ The Working Group has identified as key challenges and opportunities the following cross-cutting issues: (a) adapting traditional regulatory regimes and establishing common standards; (b) ensuring transparency and explainability; (c) enforcing data protection, privacy and security; (d) preventing bias, discrimination and disinformation; and (e) developing specialized skills.

43. For a list of risks, see CEB/2024/1/Add.1. ↩

The Working Group recalls that only multidisciplinary, multi-stakeholder collaboration and social dialogue can mitigate the risk of adverse outcomes.⁴⁴ It notes, for instance, consultations in Brazil with groups potentially affected by the rapid adoption of AI systems to inform the country’s proposed AI bill⁴⁵ and the creation of the Mauritius Emerging Technologies Council, where academia, civil society, business and other institutions help shape policies and assess human rights impacts related to AI systems.⁴⁶ The Working Group recalls that State-owned enterprises have a unique responsibility to lead by example in respecting human rights.⁴⁷

44. See https://oecd.ai/en/dashboards/ai-principles/P5; https://www.oecd.org/en/publications/advancing-accountability-in-ai_2448f04b-en.html; and https://ecnl.org/sites/default/files/2023-03/Final%20Version%20FME%20with%20Copyright%20%282%29.pdf. While both publications cover AI development, they could be applied to regulation, procurement and deployment. ↩
45. See https://www.ohchr.org/sites/default/files/documents/issues/business/workinggroupbusiness/wg-business-cfis/2025/subm-use-artificial-intelligence-sta-brazil.pdf. ↩
46. See https://mauritiusemergingtech.com/. ↩
47. See A/HRC/32/45. ↩

As regulators, States will need to set out safeguards and define the intended and expected impacts for people and the planet from the procurement and deployment of AI systems by the public and private sectors. The question is not whether to regulate AI procurement and deployment, but how to do so in line with international human rights law and standards, including the Guiding Principles on Business and Human Rights.

Several States have developed legally binding standards that apply to AI procurement and deployment and include human rights aspects. The AI Framework Act of the Republic of Korea seeks to balance private sector innovation with safeguards for AI deployment that poses a high risk of causing adverse human rights impacts.⁴⁸ For example, the ChileCompra project in Chile resulted in the design and incorporation of a standardized public policy for the procurement of AI-based systems by the public sector.⁴⁹ Examples of subnational legislation include California, United States of America, where an executive order includes provisions for public procurement to address key AI-related impacts related to safety, algorithmic discrimination, data privacy and transparency.⁵⁰ Additional initiatives include Resolution No. XIV/2620 of Lithuania, on the principles of using AI technologies in the public sector, in which the protection of human rights in AI deployment is emphasized,⁵¹ and plans under the National AI Policy of Rwanda to develop procurement guidelines for AI systems for the public sector.⁵²

48. Submission from the Republic of Korea. ↩
49. See https://www.accessnow.org/wp-content/uploads/2024/02/LAC-Reporte-regional-de-politicas-de-regulacion-a-la-IA.pdf. ↩
50. See https://www.gov.ca.gov/wp-content/uploads/2023/09/AI-EO-No.12-_-GGN-Signed.pdf. ↩
51. Submission from Lithuania. ↩
52. See https://www.minict.gov.rw/index.php?eID=dumpFile&t=f&f=67550&token=6195a53203e197efa47592f40ff4aaf24579640e. ↩

Given the cross-cutting nature of AI, policy coherence will be critical to ensure rightsrespecting procurement and deployment. Many laws that are not directly focused on AI systems will nevertheless apply to the procurement and deployment of AI, such as data protection and privacy regulations, so there is a need for interoperability within public 43 For a list of risks, see CEB/2024/1/Add.1. 44 See https://oecd.ai/en/dashboards/ai-principles/P5; https://www.oecd.org/en/publications/advancingaccountability-in-ai_2448f04b-en.html; and https://ecnl.org/sites/default/files/202303/Final%20Version%20FME%20with%20Copyright%20%282%29.pdf. While both publications cover AI development, they could be applied to regulation, procurement and deployment. 45 See https://www.ohchr.org/sites/default/files/documents/issues/business/workinggroupbusiness/wgbusiness-cfis/2025/subm-use-artificial-intelligence-sta-brazil.pdf. 46 See https://mauritiusemergingtech.com/. 47 See A/HRC/32/45. 48 Submission from the Republic of Korea. 49 See https://www.accessnow.org/wp-content/uploads/2024/02/LAC-Reporte-regional-de-politicas-deregulacion-a-la-IA.pdf. 50 See https://www.gov.ca.gov/wp-content/uploads/2023/09/AI-EO-No.12-_-GGN-Signed.pdf. 51 Submission from Lithuania. 52 See https://www.minict.gov.rw/index.php?eID=dumpFile&t=f&f=67550&token=6195a53203e197efa475 92f40ff4aaf24579640e. GE.25-06864 institutions. States are addressing this in different ways. For instance, States may have a decentralized approach to AI, with cross-cutting or multi-institutional set-ups, such as the AI Strategy Team of Japan, which, jointly with the Cabinet Office, coordinates the overall AI policy across ministries and agencies. An alternative is a centralized approach with a single leading institution or national body, such as in Germany, where the Ministry of the Interior and the Advisory Centre for Artificial Intelligence will serve as the primary coordinating body for AI in public administration.⁵³

53. See https://www.oecd.org/content/dam/oecd/en/publications/reports/2024/10/g7-toolkit-for-artificial-intelligence-in-the-public-sector_f93fb9fb/421c1244-en.pdf. ↩

Further, putting in place data-governance mechanisms that include strong protections of the right to privacy, among other rights, will underpin the public sector’s readiness to adopt AI systems in a rights-respecting manner. States, in consultation with stakeholders, can determine to what extent existing laws and regulations on data and consumer protection apply to AI systems. Cybersecurity and advanced privacy-enhancing technologies such as encryption also play a key role in safeguarding rights holders’ sensitive information.⁵⁴

54. See https://www.oecd.org/en/publications/advancing-accountability-in-ai_2448f04b-en.html. ↩

Regulation is also emerging regarding the high risks of biased and discriminatory outcomes related to algorithmic decision-making and algorithmic management in the workplace, which is relevant when businesses deploy AI systems to manage people. In Portugal, amendments to the Labour Code (Act No. 13/2023) include a set of provisions on AI and workers’ protection to ensure equal treatment and non-discrimination for labour-related decisions based on algorithms, reinforcing the fact that labour law applies to AI deployment in the workplace. Further, the New York City AI Bias Audit Law requires that AI systems deployed to inform employment-related decisions are subject to independent bias audits.⁵⁵ This is a practice that can be extrapolated in general to AI deployment, as the Working Group’s consultation revealed an urgent need for the establishment of independent oversight bodies to audit AI systems and hold public and private actors accountable.

55. See https://www.nycbiasaudit.com/#:~:text=What%20is%20the%20NYC%20Bias,employment%20decision%20tools%20(AEDTs). ↩

The Working Group highlights that, without human oversight, the potential for adverse human rights impacts resulting from automated decision-making and deployment of AI systems may be exacerbated and that, even with human oversight, some cases of automated decision-making are not desirable. Examples of States regulating this matter include proposed House bill No. 7913 in the Philippines, which provides individuals with the option to choose human alternatives over AI systems when suitable, and ensures access to prompt human intervention, and potential remedies, in the event of AI malfunction or error.⁵⁶ While this does not necessarily equate to ensuring accountability, it is a key step towards mitigating adverse impacts.

56. See https://digitalpolicyalert.org/event/23303-introduced-artificial-intelligence-ai-regulation-act-hb-7913-including-usersubject-rights. ↩

Correctly procuring AI systems is vital to ensuring that AI is rights-respecting. Only a few large businesses are designing and developing AI, which limits the choices available to procurement teams and often creates market capture or vendor lock-in, leading to adverse impacts related to the privatization of public services.⁵⁷ Recently, however, there has been a degree of democratization, with open-source efforts providing emerging opportunities for more inclusive participation. For States, public procurement is a key junction to identify, prevent and mitigate any adverse human rights impacts of their own deployment of AI before harm occurs.⁵⁸ In the commentary to guiding principle 6, it is highlighted that States conduct a variety of commercial transactions with businesses, not least through their procurement activities. This also provides States – individually and collectively – with unique opportunities to promote awareness of and respect for human rights by those businesses, and exercise their leverage. The Working Group has previously articulated how the human rights due diligence process applies to States’ procurement activities to identify, prevent, mitigate and account for how they address their human rights impacts.⁵⁹ AI procurement is no exception, but human rights impacts and challenges related to it, such as exploitation of workers in AI value chains,⁶⁰ remain largely underexplored, and the focus is often narrowly placed on the benefits that AI systems can offer.⁶¹

57. See https://www.adalovelaceinstitute.org/report/spending-wisely-procurement/#executive-summary-2. ↩
58. See https://www.humanrights.dk/publications/public-procurement-tool-address-human-rights-risks-use-digital-technology-deliver; and Sanchez-Graells, Digital Technologies and Public Procurement. ↩
59. See A/HRC/38/48; and https://empresasyderechoshumanos.org/wp-content/uploads/2022/04/INFORMATION-NOTE-on-PP_LAC_EN.pdf. ↩
60. Submission from Fairwork. ↩
61. See https://www.humanrights.dk/publications/public-procurement-tool-address-human-rights-risks-use-digital-technology-deliver. Some guidance is emerging (e.g. https://www3.weforum.org/docs/WEF_AI_Procurement_in_a_Box_Workbook_2020.pdf) that refers to individual rights, rather than human rights. For an overview of AI procurement challenges, see, for example, https://files.thegovlab.org/a-snapshot-of-ai-procurement-challenges-june2023.pdf. ↩

The Working Group observes that AI procurement and deployment practices often lack transparency and traceability,⁶² highlighting an urgent need for public disclosure as a requirement during the procurement process. Currently, public disclosure often coincides with AI deployment in low-risk sectors. However, as highlighted during the Working Group’s consultations, AI systems are being deployed for defence and intelligence, among other high-risk sectors, with minimal, if any, transparency. A case in point are transparency exemptions added to the AI Act of the European Union during negotiations to exempt law enforcement and migration authorities from the obligation to publish information about their deployment of high-risk AI systems in a publicly accessible database.⁶³

62. For definitions, see https://www.oecd.org/en/publications/advancing-accountability-in-ai_2448f04b-en.html. ↩
63. See https://www.accessnow.org/whats-not-in-the-eu-ai-act-deal/. ↩

Some States are seeking to overcome the lack of common standards and definitions by issuing standard formats for tendering so that AI procurement processes are based on the same principles and key terms. For instance, the European Union developed a proposal in 2023 for standard model contractual AI clauses to support responsible AI deployment by public authorities, which includes language on a risk-based approach to the protection of human rights.⁶⁴ Chile has issued standard language for procurement that requests that AI suppliers provide models with statistical equity metrics, propose additional data protection measures and conduct bias analyses.⁶⁵

64. See https://public-buyers-community.ec.europa.eu/communities/procurement-ai/news/updated-eu-ai-model-contractual-clauses-now-available. ↩
65. See https://goblab.uai.cl/chilecompra-presenta-inedita-bases-bases-tipo-para-la-licitacion-de-algoritmos-e-inteligencia-artificial-con-requisitos-eticos/. ↩

Lastly, a key challenge is that public procurers are increasingly reliant on the private sector to meet their technology needs, but AI procurement and deployment require specialized technical skills and adequate AI literacy. Currently, there is an imbalance in knowledge and expertise between States and the private sector around what AI is, how it works and what outcomes it produces. There is also little space and time for procurers to engage critically with the claims made by AI vendors or suppliers, including as they relate to potential and actual human rights impacts.⁶⁶ This can be addressed by investing in capacitybuilding of public officials in this area. For instance, the National AI Policy of Rwanda provides for the organization of training for public procurement departments. The Working Group notes that there is also insufficient knowledge and expertise on human rights law, requiring capacity-building. Further, lack of diversity in the teams procuring and deploying AI systems can lead to a lack of critical assessment with regard to checking procured AI systems against potential inadvertent bias or discrimination. This has a cumulative effect when considering that most AI systems are trained using parameters in English and are 59 See A/HRC/38/48; and https://empresasyderechoshumanos.org/wpcontent/uploads/2022/04/INFORMATION-NOTE-on-PP_LAC_EN.pdf. 60 Submission from Fairwork. 61 See https://www.humanrights.dk/publications/public-procurement-tool-address-human-rights-risksuse-digital-technology-deliver. Some guidance is emerging (e.g. https://www3.weforum.org/docs/WEF_AI_Procurement_in_a_Box_Workbook_2020.pdf) that refers to individual rights, rather than human rights. For an overview of AI procurement challenges, see, for example, https://files.thegovlab.org/a-snapshot-of-ai-procurement-challenges-june2023.pdf. 62 For definitions, see https://www.oecd.org/en/publications/advancing-accountability-in-ai_2448f04ben.html. 63 See https://www.accessnow.org/whats-not-in-the-eu-ai-act-deal/. 64 See https://public-buyers-community.ec.europa.eu/communities/procurement-ai/news/updated-eu-aimodel-contractual-clauses-now-available. 65 See https://goblab.uai.cl/chilecompra-presenta-inedita-bases-bases-tipo-para-la-licitacion-dealgoritmos-e-inteligencia-artificial-con-requisitos-eticos/. 66 See https://www.adalovelaceinstitute.org/report/spending-wisely-procurement/#executive-summary2. GE.25-06864 therefore less accurate in other languages. To address this, some States are making efforts to train AI systems in non-English languages and incorporate diverse perspectives.⁶⁷ States as deployers

66. See https://www.adalovelaceinstitute.org/report/spending-wisely-procurement/#executive-summary-2. ↩
67. See, for example, https://alia.gob.es/; and https://aiforgood.itu.int/event/accelerating-the-revitalisation-of-te-reo-maori-with-ai/. ↩

When it comes to State deployment of AI, analysis of adverse impacts has largely been undertaken after harm has already been caused.⁶⁸ For example, the deployment of the System Risk Indication digital benefit fraud detection tool in the Kingdom of the Netherlands raised important questions about how equipped the public sector is to deploy AI systems in a rights-respecting manner.⁶⁹ Lessons learned after that experience included the establishment of an Algorithm Register in 2022 for government organizations in the Kingdom of the Netherlands, and the Fundamental Rights and Algorithm Impact Assessment, which is mandatory for any algorithm designed to support decision-making in the public and private sectors.⁷⁰ Several other States, including Estonia, Germany and the United Kingdom of Great Britain and Northern Ireland, as well as the cities of Amsterdam and Helsinki, have also established or are in the process of establishing mandatory algorithm registries for the deployment of AI systems in the public sector.⁷¹ While these are important steps for public disclosure, the Working Group notes that they must be accompanied by efforts requiring private sector disclosure and by initiatives to ensure that the deployment of AI systems is not only transparent, but also explainable and understandable. For instance, Peru, through its guidance for the implementation of Act No. 31814, has included the need to ensure the transparency and explainability of AI systems, such as providing information on AI deployment to facilitate its understanding and easy comprehension by potentially affected people and by the competent authorities.⁷² Guidance for States deploying AI systems is emerging,⁷³ including the OECD AI Incidents and Hazards Monitor, which keeps track of AI incidents with the goal of assisting policymakers and practitioners.

68. See, for example, https://www.science.org/doi/full/10.1126/science.aax2342; and https://dl.acm.org/doi/pdf/10.1145/3359301. ↩
69. See https://www.ohchr.org/en/press-releases/2020/02/landmark-ruling-dutch-court-stops-government-attempts-spy-poor-un-expert. ↩
70. See https://algoritmes.overheid.nl/en; and https://www.government.nl/documents/reports/2022/03/31/impact-assessment-fundamental-rights-and-algorithms. ↩
71. Submissions from Estonia and Germany. See also https://www.ohchr.org/sites/default/files/documents/issues/business/workinggroupbusiness/wg-business-cfis/2025/subm-use-artificial-intelligence-ind-emma-o-connell.pdf; and https://www.ohchr.org/sites/default/files/documents/issues/business/workinggroupbusiness/wg-business-cfis/2025/subm-use-artificial-intelligence-trad-unio-public-services-international.pdf. ↩
72. See https://img.lpderecho.pe/wp-content/uploads/2024/05/Proyecto-reglamento-Inteligencia-artificial-LPDerecho.pdf. ↩
73. See, for example, https://www.turing.ac.uk/sites/default/files/2019-06/understanding_artificial_intelligence_ethics_and_safety.pdf; and https://www.oecd.org/content/dam/oecd/en/publications/reports/2024/10/g7-toolkit-for-artificial-intelligence-in-the-public-sector_f93fb9fb/421c1244-en.pdf. ↩

Some human rights impacts can be particularly severe in public sector deployment of AI, especially as people do not typically have the choice of disengaging with public services as they might do with a business deploying AI systems. States deploying AI systems without appropriate safeguards against discrimination can exacerbate existing inequalities and create new forms of marginalization and vulnerability. For example, the National Council for Human Rights of Morocco highlighted the risk of gender bias in algorithmic solutions.⁷⁴ This is illustrated in the transportation sector, where AI systems process large amounts of unrepresentative and aggregated data, which can lead to biased solutions that exclude women, who have different mobility needs than men, from the benefits of the mobility grid.⁷⁵ In the public security sector, the Working Group has received reports that China is deploying facial recognition technology, including to identify dissenters and ethnic minorities. In March 2025, the cyberspace regulator in China issued a regulation stating that individuals should not be forced to verify their identity using such technology.⁷⁶ The Working Group has also received reports of AI being used to identify human rights defenders, including Indigenous Peoples, in India and the Philippines. In the welfare sector in Nigeria, the Rapid Response Register for coronavirus disease (COVID-19) cash transfers potentially excluded participants from the programme due to the deployment of automated benchmarks (e.g. owning a mobile phone and having a bank account).⁷⁷ Lessons learned include an opportunity for improvements to be made across the board, to rethink good governance and to mitigate the problems inherent in deploying AI systems such as discrimination, transparency, accountability and stakeholder engagement.⁷⁸ Emerging examples to address this include the AI bill of Costa Rica, under which decisions made by AI that discriminate against protected categories of persons are prohibited,⁷⁹ and the 2022 Human Rights Guidelines for AI Development and Use of the National Human Rights Commission of Korea (Republic of Korea), in which a strong emphasis is placed on human rights and non-discrimination.⁸⁰

74. https://girai-report-2024-corrected-edition.tiiny.site/. ↩
75. Caroline Criado Perez, Invisible Women: Data Bias in a World Designed for Men (New York, Abrams Press, 2019). See also https://time.com/collection/davos-2020/5764698/gender-data-gap/. ↩
76. See https://www.cac.gov.cn/2025-03/21/c_1744174262156096.htm; and https://www.china-briefing.com/news/china-facial-recognition-regulations-2025/. ↩
77. See https://gpai.ai/projects/data-governance/DG08%20-%20The%20Role%20of%20Government%20as%20a%20Provider%20of%20Data%20for%20Artificial%20Intelligence%20-%20Interim%20Report.pdf. ↩
78. Fola Adeleke and Gabriella Razzano, “Algorithms and administrative justice in Africa: a case study from Nigeria”, Development, vol. 67, No. 1 (June 2024). ↩
79. See https://d1qqtien6gys07.cloudfront.net/wp-content/uploads/2023/05/23771.pdf. ↩
80. Submission from the National Human Rights Commission of Korea (Republic of Korea). ↩

AI systems are also being deployed in civil and criminal justice systems. They are used to streamline administrative processes, such as proceedings in low-value civil proceedings, and to facilitate judgments and other court decisions in simple procedural matters. While AI systems can improve access to justice, they can also have a negative impact on human rights in the justice field, including the rights to equality and non-discrimination, a fair trial, liberty and security, and the independence of the judiciary. The latter may be affected when the deployment and oversight of AI systems in the justice system is in the hands of the executive rather than a body within the judiciary itself. The potential violation of these rights highlights the need for the regulation of the procurement and deployment of AI in the administration of justice with a human rights framework. Given this rapidly evolving context, some States, civil society actors and United Nations entities are publishing guidance in this respect.⁸¹

81. See A/79/296; https://unesdoc.unesco.org/ark:/48223/pf0000390781; and https://unesdoc.unesco.org/ark:/48223/pf0000387331. ↩

In terms of data protection and the right to privacy, following adverse impacts to the right to privacy after a partnership in 2016 between the Royal Free London National Health Service Foundation Trust in the United Kingdom and a business to deploy machine learning to assist in the management of acute kidney injury,⁸² the Information Commissioner’s Office of the United Kingdom issued guidance for businesses on the application of data protection regulations to the use of information in AI systems,⁸³ and on big data, AI, machine learning and data protection, citing the need for fair, accurate and non-discriminatory use of personal data.⁸⁴ The United Kingdom also proposed significant changes to a data protection law in⁸⁵ 2024, 85 which includes explicit reference to respect for human rights, and rules on the deployment of automated decision-making systems. In 2022, the Danish Data Protection Authority suspended the use of Chromebooks and Google Workspace software in the Helsingør municipality, which it had procured for all primary schools in the region, because of an unmitigated risk of transfer of personal data to Google.⁸⁶ Subsequently, the Authority 76 See https://www.cac.gov.cn/2025-03/21/c_1744174262156096.htm; and https://www.chinabriefing.com/news/china-facial-recognition-regulations-2025/. 77 See https://gpai.ai/projects/datagovernance/DG08%20-%20The%20Role%20of%20Government%20as%20a%20Provider%20of%20 Data%20for%20Artificial%20Intelligence%20-%20Interim%20Report.pdf. 78 Fola Adeleke and Gabriella Razzano, “Algorithms and administrative justice in Africa: a case study from Nigeria”, Development, vol. 67, No. 1 (June 2024). 79 See https://d1qqtien6gys07.cloudfront.net/wp-content/uploads/2023/05/23771.pdf. 80 Submission from the National Human Rights Commission of Korea (Republic of Korea). 81 See A/79/296; https://unesdoc.unesco.org/ark:/48223/pf0000390781; and https://unesdoc.unesco.org/ark:/48223/pf0000387331. 82 See https://bmcmedethics.biomedcentral.com/articles/10.1186/s12910-021-00687-3#ref-CR22. 83 See https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificialintelligence/guidance-on-ai-and-data-protection/. 84 See https://ico.org.uk/media2/migrated/2013559/big-data-ai-ml-and-data-protection.pdf. 85 See https://bills.parliament.uk/publications/56527/documents/5212. 86 See https://www.datatilsynet.dk/afgoerelser/afgoerelser/2022/aug/datatilsynet-fastholder-forbud-ichromebook-sag. GE.25-06864 developed guidance for public authorities on AI deployment.⁸⁷ With these examples, the Working Group highlights the recurring issue of lack of prior consent of affected people for the deployment of AI systems, including the use of personal data.

82. See https://bmcmedethics.biomedcentral.com/articles/10.1186/s12910-021-00687-3#ref-CR22. ↩
83. See https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/. ↩
84. See https://ico.org.uk/media2/migrated/2013559/big-data-ai-ml-and-data-protection.pdf. ↩
85. See https://bills.parliament.uk/publications/56527/documents/5212. ↩
86. See https://www.datatilsynet.dk/afgoerelser/afgoerelser/2022/aug/datatilsynet-fastholder-forbud-i-chromebook-sag. ↩
87. See https://www.datatilsynet.dk/Media/638321084132236143/Offentlige%20myndigheders%20brug%20af%20kunstig%20intelligens%20-%20Inden%20I%20g%C3%A5r%20i%20gang.pdf. ↩

AI is considerably affecting business models and operations, with businesses embedding it in their day-to-day operations, products and services, from customer support, inventory management and value chain optimization to robotic process automation, targeted advertising and research and development, as well as for predictive analysis and data-driven decisions.⁸⁸ AI systems are also deployed for human resources – for recruitment and management of employees – and across sectors for energy optimization, credit scoring, security and, more recently, analysis of risks and regulatory compliance and to conduct human rights due diligence processes.

88. See https://shiftproject.org/resource/redflag-21/; and https://www.bsr.org/reports/BSR-AI-HuRi-Extractives-Report.pdf; https://www.bsr.org/reports/BSR-AI-Human-Rights-Healthcare.pdf. ↩

However, the increasingly rapid race for new technologies has led many businesses to procure and deploy AI systems without putting in place adequate mechanisms to identify, prevent, mitigate and account for how they address adverse human rights impacts. For instance, AI systems deployed for consumer engagement can exploit pre-existing behavioural data to manipulate purchasing decisions, raising concerns about the rights to freedom of thought and opinion, privacy and autonomy.⁸⁹ Workers operating in environments with AI-driven monitoring systems may experience constant pressure to meet performance targets, struggle to challenge rigid and opaque labour processes imposed by algorithms and suffer a considerable loss of autonomy.⁹⁰

89. Submission from the Global Digital Justice Forum. ↩
90. Submission from Fairwork. See also https://publications.jrc.ec.europa.eu/repository/handle/JRC136063. ↩

Further, the water- and energy-intensive character of certain AI systems, in addition to the related increasing use of critical minerals, is causing environmental impacts and increasing businesses’ carbon footprint without any measurement or addressing of the impacts on the right to a clean, healthy and sustainable environment.

Serious challenges persist in enabling businesses to uphold the responsibility to respect human rights in relation to AI procurement and deployment, in alignment with the Guiding Principles on Business and Human Rights. They include a lack of mechanisms to address the human rights impacts of AI, including through human rights due diligence, as the expertise needed is often dispersed across various teams. Another serious challenge concerns accountability, as the global and complex nature of AI value chains creates ambiguity in assigning responsibility for adverse human rights impacts.⁹¹ The Working Group notes examples of businesses seeking to discharge responsibility for the deployment of AI tools, such as the case of the National Football League of Spain, which was fined over the alleged lack of a data protection impact assessment prior to implementing biometric identification systems in stadiums, but refuted the fine, claiming that it was not responsible for processing the biometric data.⁹²

91. See https://researchrepository.ilo.org/esploro/outputs/bookChapter/AI-enabled-business-model-and-human-in-the-loop-deceptive/995376587602676. ↩
92. See https://www.aepd.es/documento/ps-00484-2023.pdf. ↩

For small and medium-sized enterprises, procuring and deploying AI systems presents additional challenges, given their limited resources, capacity and in-house expertise to understand the technological functionalities. AI systems are often deployed by such enterprises for cost-saving measures and to increase efficiency, without safeguards to respect human rights, which can result in the increased likelihood of adverse human rights impacts. The Guiding Principles on Business and Human Rights establish that all businesses, regardless of their size, are required to respect human rights and avoid causing or contributing to human rights abuses through their activities, as well as seek to prevent or mitigate human rights abuses that are directly linked to their operations, products or services by their business relationships. However, the lack of clear frameworks for oversight and accountability hinders the fulfilment of this responsibility, particularly when accountability for the impacts of AI is passed down the value chain.

Some businesses are adopting responsible AI policies and data governance frameworks, or integrating specific considerations regarding AI into their human rights strategies. For instance, the AI Ethics for Good framework of Hewlett Packard Enterprise comprises five key principles, developed to guide the design and deployment of AI in an ethical manner, including respect for human rights.⁹³ However, these efforts remain limited across the private sector. During consultations with business representatives, the Working Group found that many businesses were still in the early stages of identifying human rights impacts linked to AI procurement and deployment. The Working Group notes that, in general, a positive practice includes cross-departmental collaboration to ensure that human rights impacts and the intended purpose of AI procurement and deployment are understood throughout the business.

93. See https://www.hpe.com/emea_europe/en/solutions/artificial-intelligence/ethics.html. ↩

Businesses that adapt their human rights due diligence processes to account for risks associated with AI procurement and deployment should also ensure alignment with the Guiding Principles on Business and Human Rights by assessing whether the intended objectives of AI systems align with the responsibility to respect human rights.

To identify and assess human rights impacts, businesses will initially need to have a comprehensive understanding of all AI systems within their business and in their business relationships. Key actions include mapping human rights impacts linked to AI systems, considering specific operational contexts and datasets used and continuously assessing how human rights are integrated into the system’s design and development, as well as measures taken to address impacts, particularly when new AI systems are introduced or when other changes occur that affect the entity or its operational context. Throughout this process, it is crucial to identify individuals or groups who may be at heightened risk of being adversely affected by AI systems, including women, children, Indigenous Peoples, persons of African descent, transgender or non-binary persons and persons with disabilities, through meaningful stakeholder engagement and consultation. For instance, when using AI-driven hiring tools, IBM involved stakeholders to test and refine the systems for fairness and inclusivity, which improved the AI system’s performance and sought to address potential biases and promote equality.⁹⁴

94. Submission from Optim.ai Foundation. ↩

Based on the results of their impact assessments,⁹⁵ businesses that take appropriate actions to prevent, mitigate and, when necessary, remedy adverse human rights impacts identified from AI procurement and deployment, in consultation with potentially affected stakeholders, will be acting in alignment with the Guiding Principles on Business and Human Rights. It will also be crucial for businesses to focus on the severity of the impacts, considering factors such as gravity, scope (the number of individuals affected or potentially affected) and the irremediability of the impact,⁹⁶ especially in conflict-affected areas.⁹⁷

95. For an example of a human rights impact assessment framework, see https://www.ohchr.org/sites/default/files/documents/issues/business/workinggroupbusiness/wg-business-cfis/2025/subm-use-artificial-intelligence-cso-european-center-not-profit-law-hting.pdf. ↩
96. Commentary to guiding principle 14. ↩
97. See A/75/212. ↩

Appropriate action could also entail collaboration among sectors and businesses to address the human rights impacts of AI systems. For instance, business associations and networks could work with businesses to provide sector-specific guidance.⁹⁸ Many businesses source AI systems from the same developers, so sharing information can significantly increase awareness of potential adverse sector-specific human rights impacts while allowing businesses to identify and respond to emerging risks more rapidly. By working together, businesses can pool resources and knowledge, strengthening their ability to prevent and mitigate potential human rights harms. For example, over 250 businesses are part of the Responsible Business Alliance, which facilitates the sharing of best practices, tools and guidelines on AI ethics among its members.⁹⁹

98. See https://www.bsr.org/reports/BSR-AI-HuRi-Extractives-Report.pdf; and https://www.bsr.org/reports/BSR-AI-Human-Rights-Healthcare.pdf. ↩
99. See https://www.responsiblebusiness.org/about/members. ↩

Further, collaboration among businesses helps increase leverage. While a single enterprise may lack the influence to compel AI developers to improve practices or address human rights concerns, a group of businesses working collectively can wield greater leverage towards rights-respecting AI development (and consequently procurement and deployment). For instance, the Business Council for Ethics of AI is a collaborative initiative between UNESCO and businesses developing or deploying AI to ensure that AI respects human rights. Businesses can also use their leverage within business relationships to encourage or require third-party AI providers to ensure that human rights impacts are addressed and to provide for or cooperate with remediation processes so that effective remedy is available to those who have been adversely affected by the use of AI systems. Procurement processes are a key entry point for addressing design-phase risks, for instance, by requiring a software bill of materials or documentation that supports explainability, with algorithmic transparency taking precedence over intellectual property or trade secret claims, especially in contexts that have a high risk of adverse human rights impacts.

Business will also need to establish goals, targets and quantitative and qualitative indicators to monitor the implementation and effectiveness of human rights due diligence processes and actions related to the deployment of AI systems. To achieve this, they can gather information through meaningful consultations and incorporate lessons learned from operational-level grievance mechanisms. For instance, H&M Group uses a checklist as part of its review process for all AI projects, which helps assess AI systems against the Group’s AI principles to identify, prevent and mitigate human rights risks, especially those that could affect at-risk groups, including children. Each AI product is regularly reviewed post-deployment to ensure that it continues to meet ethical standards.¹⁰⁰

100. Submission from the Centre for Advanced Studies in Cyber Law and Artificial Intelligence. ↩

To align with the Guiding Principles on Business and Human Rights, businesses will need to communicate transparently, both internally and externally, about how they address adverse human rights impacts linked to AI procurement and deployment, ensuring that stakeholders are informed about potential human rights impacts. Effective and timely communication can build trust and strengthen relationships with partners, affected individuals and communities. It also helps stakeholders understand the business’ approach to AI procurement and deployment, including any challenges during the human rights due diligence process. For example, in 2021, Just Eat signed the first collective bargaining agreement in Spain that included workers’ information rights in relation to the deployment of algorithms and AI systems. The agreement included the creation of an algorithm commission to channel information and supervise algorithmic changes.¹⁰¹ Communication can take various forms, not necessarily formal reporting, although businesses may choose this route. The key is to ensure that information is clear, accurate, timely, culturally sensitive and accessible to all stakeholders, with special attention paid to groups at heightened risk of harm.

101. See https://www.ohchr.org/sites/default/files/documents/issues/business/workinggroupbusiness/wg-business-cfis/2025/subm-use-artificial-intelligence-trad-unio-confederacion-sindical-comisiones-obr-reras.pdf; and https://www.just-eat.es/blog/notas-de-prensa/convenio-colectivo. ↩

Business function-specific examples AI in the workplace

AI-powered tools are increasingly deployed in human resources and workforce management, including in recruitment (job advertisements, screening and ranking, initial interviews, etc.), promotion decisions and contractual relationships, as well as for allocating tasks based on individual behaviour, personal traits or characteristics and for performance monitoring or evaluating, measuring productivity, tracking movements, profiling and monitoring time and attendance. During consultations, stakeholders noted some potentially positive impacts of this deployment, for example related to health and safety monitoring for high-risk jobs sectors such as mining, by monitoring air quality conditions or fatigue levels. However, this deployment also presents significant potential for adverse impacts on the rights to privacy, non-discrimination and fair working conditions. Moreover, it can affect future career prospects, livelihoods and workers’ rights, especially for groups at heightened risk of harm, such as persons with disabilities.¹⁰² Frequently, the workers most affected by AI systems are employed in precarious forms of work, such as zero-hour or short-term contracts, or through labour intermediaries, often denying them their right to freedom of association and collective bargaining. While the deployment of AI-driven decisions may further limit workers’ ability to negotiate fair terms, undermining their influence over working conditions and career development,¹⁰³ a rights-respecting integration of AI into workplace processes could, for instance, foster more equitable outcomes, such as addressing pay disparities, mitigating biased promotion patterns or optimizing workloads to enhance conditions and career growth.

102. See A/HRC/49/52. ↩
103. Submission from the International Trade Union Confederation, the International Transport Workers’ Federation, the UNI Global Union and the International Lawyers Assisting Workers’ Network. ↩

In relation to this, the Working Group highlights the need for the active involvement of workers and their representatives, including labour unions, in discussions regarding the deployment of AI systems, and the importance of establishing clear guidelines for the deployment of AI systems in the workplace, particularly in the outsourcing of human resources functions, to ensure rights-respecting practices. Oversight mechanisms are also crucial to monitor AI deployment and ensure that decisions made by these systems are explainable and transparent. For instance, the Adecco Group, which is a human resources provider and temporary staffing business, has developed Responsible AI Principles that include reference to the Guiding Principles on Business and Human Rights and requirements on the ethical and human-centric, transparent, safe and lawful deployment of AI. In the Principles, among other requirements, it is stated that the aim is to have a human in the decision-making loop, particularly for AI systems deployed in human resources processes such as recruitment, selection, promotion, termination of employment and task allocation and for monitoring and evaluating performance.¹⁰⁴

104. See https://www.adeccogroup.com/rai-principles. ↩

While businesses in sectors such as healthcare, insurance, finance, energy and retail continue to rely on automated business decisions, the use of AI systems introduces new levels of scale and complexity. While AI systems have the potential to support decision-making processes – such as assisting medical doctors in the identification of certain pathologies – it is essential that businesses ensure that the AI systems they embed in their organization are transparent, explainable and understandable to customers and stakeholders and that they are non-discriminatory with regard to how they operate in various contexts. For instance, Pfizer has established three principles for responsible AI, including the need to make systems explainable to users and other stakeholders as a key form of transparency and to increase trust.¹⁰⁵

105. See https://www.pfizer.com/news/articles/three_principles_of_responsibility_for_artificial_intelligence_ai_in_healthcare. ↩

The uptake of AI systems in the finance and insurance sectors to assess investee companies’ risks or to profile individuals, such as through credit risk or insurability assessments, has raised significant human rights concerns. These systems often rely on historical data, which may contain biases and discrimination or fail to represent certain groups adequately.¹⁰⁶ As a result, AI-driven decision-making can lead to discriminatory outcomes, perpetuating existing inequalities and undermining the rights to fair and non-discriminatory treatment. Measures to mitigate such risks include developing data ethics principles, establishing an ethics committee for policy oversight, ensuring that AI decision-making systems are transparent, understandable and explainable to customers and stakeholders and establishing cross-departmental working groups to enhance understanding of data policies across the organization, all based on respect for human rights. During consultations, the Working Group repeatedly heard that establishing grievance mechanisms for users to request human reviews of AI decisions could provide a valuable channel for addressing concerns and maintaining trust.¹⁰⁷

106. See submissions from Sebastian Smart, Okechukwu (Jake) Effoduh and Maral Niazi. ↩
107. See also https://www.ohchr.org/sites/default/files/documents/issues/business/b-tech/taxonomy-GenAI-Human-Rights-Harms.pdf. ↩

With the emergence of AI regulations and frameworks and the increasing need for human rights due diligence reporting, there is an increase in the number of businesses deploying AI to meet these requirements and screen partners for human rights compliance within value chains.¹⁰⁸ This includes small and medium-sized enterprises, which often lack the resources to hire dedicated personnel for compliance. While AI systems can provide a starting point, the Working Group stresses that businesses cannot outsource their responsibilities to respect human rights, including meaningful stakeholder engagement. Businesses will need to assess the nature, quality and representativeness of training datasets, including labelling methods and conditions, test AI systems for bias and externalities, gradually deploy systems as risks emerge, conduct adversarial testing to identify unexpected risks and implement human oversight measures as safeguards, among others.¹⁰⁹

108. See https://www.oecd.org/en/publications/oecd-business-and-finance-outlook-2021_ba682899-en/full-report/component-7.html#chapter-d1e5955. ↩
109. See https://www.ungpreporting.org/wp-content/uploads/UNGPRF_AssuranceGuidance.pdf. ↩

There has also been an increase in AI procurement and deployment to personalize consumer experiences across various sectors, such as retail, tourism and essential services. This carries the risk of discrimination based on race, gender, age or disability, as biases in historical data sets are embedded in the AI models.¹¹⁰ For instance, online price differentiation driven by user data may result in discriminatory outcomes for specific groups. Businesses’ growing reliance on AI systems and targeted advertising may also affect individuals’ freedom of thought, as businesses increasingly shape their business models around the collection and monetization of consumer data, influencing users’ ideas and purchasing behaviours.¹¹¹

110. Submissions from the Association for Progressive Communications, the Global Digital Justice Forum, the Centre for the Study of the Economies of Africa and the British Institute of International and Comparative Law. ↩
111. See https://www.ohchr.org/sites/default/files/documents/issues/business/b-tech/taxonomy-GenAI-Human-Rights-Harms.pdf. ↩

Consequently, transparency around AI deployment, such as chatbots, is essential to ensure that customers are aware when they are engaging with automated systems. Similarly, 105 See https://www.pfizer.com/news/articles/three_principles_of_responsibility_for_artificial_intelligence_ai _in_healthcare. 106 See submissions from Sebastian Smart, Okechukwu (Jake) Effoduh and Maral Niazi. 107 See also https://www.ohchr.org/sites/default/files/documents/issues/business/b-tech/taxonomyGenAI-Human-Rights-Harms.pdf. 108 See https://www.oecd.org/en/publications/oecd-business-and-finance-outlook-2021_ba682899en/full-report/component-7.html#chapter-d1e5955. 109 See https://www.ungpreporting.org/wp-content/uploads/UNGPRF_AssuranceGuidance.pdf. 110 Submissions from the Association for Progressive Communications, the Global Digital Justice Forum, the Centre for the Study of the Economies of Africa and the British Institute of International and Comparative Law. 111 See https://www.ohchr.org/sites/default/files/documents/issues/business/b-tech/taxonomy-GenAIHuman-Rights-Harms.pdf. data transparency emerges as a key factor to mitigate risks, with clear options for customers to easily opt in or out of data-sharing practices. The implementation of ethical pricing models to prevent the exploitation of sensitive personal data in setting prices also illustrates an approach to addressing these risks. Moreover, establishing grievance mechanisms for dynamic pricing algorithms can help address potential issues and foster trust among consumers.¹¹²

112. Submission from Optim.ai Foundation. ↩

The Working Group notes that a key challenge with remedy is a lack of transparency regarding the procurement and deployment of AI systems. In fact, remedy relies on transparency (see the commentary to guiding principle 22) and on users being notified before and after the deployment of AI systems. Without awareness of AI system deployment and its potential human rights implications, individuals and communities may struggle to understand how their human rights are affected. Likewise, consultations have shown that businesses are facing challenges in understanding how their deployment of AI systems could have an impact on human rights.¹¹³ In Canada, the Directive on Automated Decision-Making contains requirements for notifying workers that they will be subject to the deployment of AI systems.¹¹⁴

113. See A/HRC/50/45/Add.1. ↩
114. See https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592. ↩

Additional challenges include the quantification and documentation of harm. Shifting the burden of proof to businesses and public authorities as opposed to individuals can help address this and enhance access to remedy.¹¹⁵ Further, existing access to remedy mechanisms often lack adequate resources and enforcement powers. For example, the AI Act of the European Union provides for the right to lodge complaints to the European AI Office regarding upstream providers’ infringement of the Act, but it remains to be seen how effective compliance and accountability will be, particularly given the absence of provisions providing for the representation of natural persons, or the ability for public interest organizations to lodge complaints.

115. See https://fra.europa.eu/sites/default/files/fra_uploads/fra-2020-business-human-rights_en.pdf. ↩

To be effective, mechanisms will also need to be set up, creating integrated approaches that recognize the intersectional nature of AI-related harms and their disproportionate impact on at-risk groups. Effective redress for AI-related harms requires both strong institutional frameworks and deep understanding of how technology intersects with existing patterns of human rights violation and abuses, both of which are currently missing.¹¹⁶ A few States have begun establishing specialized digital rights units within existing human rights institutions, with the technical expertise and resources to handle complaints related to AI systems. For example, the Kingdom of the Netherlands has established oversight mechanisms for independent reviews to ensure compliance with human rights and accountability in algorithmic decision-making.¹¹⁷

116. Submission from the Association for Progressive Communications. ↩
117. See https://www.autoriteitpersoonsgegevens.nl/en/themes/algorithms-ai/coordination-of-algorithmic-and-ai-supervision/department-for-the-coordination-of-algorithmic-oversight-dca; https://www.digitaleoverheid.nl/nieuws/algoritmetoezichthouder-gelanceerd/; and https://www.auditdienstrijk.nl/. ↩

Further, while jurisprudence in this area is still emerging, courts are increasingly recognizing human rights-related concerns of AI deployment, including with regard to data protection, the automated processing of data or automated decision-making,¹¹⁸ the right to an 112 Submission from Optim.ai Foundation. 113 See A/HRC/50/45/Add.1. 114 See https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592. 115 See https://fra.europa.eu/sites/default/files/fra_uploads/fra-2020-business-human-rights_en.pdf. 116 Submission from the Association for Progressive Communications. 117 See https://www.autoriteitpersoonsgegevens.nl/en/themes/algorithms-ai/coordination-of-algorithmicand-ai-supervision/department-for-the-coordination-of-algorithmic-oversight-dca; https://www.digitaleoverheid.nl/nieuws/algoritmetoezichthouder-gelanceerd/; and https://www.auditdienstrijk.nl/. 118 Court of Justice of the European Union, Schufa holding, Case No. C-634/21, Decision, 7 December 2023; Federal Court of Australia, Katherine Prygodicz and Others v. The Commonwealth of Australia, File No. VID 1252 of 2021, Judgment, 23 March 2022; and Constitutional Court of the Slovak Republic, Z.z (e-kasa), Case No. 492/2021, Judgment, 2021. GE.25-06864 effective judicial remedy,¹¹⁹ the right to privacy120 and the rights of workers.¹²¹ Importantly, following a landmark ruling by the Inter-American Court of Human Rights,¹²² the right to “informational self-determination” has been recognized as an autonomous human right serving as a guarantee for other rights and could be instrumental in addressing the human rights impacts of AI systems.

118. Court of Justice of the European Union, Schufa holding, Case No. C-634/21, Decision, 7 December 2023; Federal Court of Australia, Katherine Prygodicz and Others v. The Commonwealth of Australia, File No. VID 1252 of 2021, Judgment, 23 March 2022; and Constitutional Court of the Slovak Republic, Z.z (e-kasa), Case No. 492/2021, Judgment, 2021. ↩
119. Court of Justice of the European Union, Ligue des droits humains ASBL v. Conseil des ministries, Case No. C-817/19, Judgment, 21 June 2022. ↩
121. See, for example, https://www.cnil.fr/en/employee-monitoring-cnil-fined-amazon-france-logistique-eu32-million. ↩
122. Members of the José Alvear Restrepo Lawyers’ Collective v. Colombia, Judgment, 18 October 2023. ↩

Lastly, non-State-based grievance mechanisms will be key to ensuring access to remedy. To be aligned with the Guiding Principles on Business and Human Rights, businesses must establish or participate in effective operational-level grievance mechanisms that provide affected individuals and communities with avenues for early and direct resolution of grievances related to human rights abuses. In cases where businesses have existing operational-level grievance mechanisms, these frameworks can be adapted to specifically address the context of AI systems. Several businesses have already implemented such proactive measures. For example, Accenture has established grievance procedures specifically for AI-related issues. Through its AI ethics framework, Accenture provides staff members and other stakeholders with a clear procedure to voice concerns about the deployment of AI systems, including its impacts on human rights.¹²³ It ensures that potential negative impacts are recognized early and addressed effectively, fostering accountability. The handling of grievances by independent bodies or multi-stakeholder initiatives can further enhance the perceived neutrality and independence of these mechanisms.

123. Submission from Hakakire Legal Consult. ↩

States and businesses have the duty and responsibility to shape AI procurement and deployment in a rights-respecting manner, by safeguarding against adverse human rights impacts in accordance with the Guiding Principles on Business and Human Rights. Therefore, the starting point for States and businesses when procuring and deploying AI systems is implementing the Guiding Principles, including requiring robust human rights impact assessments and human rights due diligence, to ensure that they are people-centred.

The Working Group notes the low awareness of States and businesses of their own deployment of AI systems and of these systems’ potential to have an adverse impact on human rights. This is exacerbated by the lack of common standards and definitions around AI. There is an opportunity for businesses and States to build their own capacity, including through stakeholder engagement, so that they can meaningfully implement mechanisms for the protection of and respect for human rights.

Further, there is an urgent need for transparency regarding AI procurement and deployment by States and businesses, including the understanding, documentation and quantification of AI-related harms, which are crucial for effective access to remedy. Integrated access to remedy processes with adequate enforcement mechanisms that 119 Court of Justice of the European Union, Ligue des droits humains ASBL v. Conseil des ministries, Case No. C-817/19, Judgment, 21 June 2022. 120 See, for example, European Court of Human Rights, Big Brother Watch and Others v. the United Kingdom, Application Nos. 58170/13, 62322/14 and 24960/15, Judgment, 25 May 2021; European Court of Human Rights, Roman Zakharov v. Russia, Application No. 47143/06, Judgment, 4 December 2015; European Court of Human Rights, Glukhin v. Russia, Application No. 11519/20, Judgment, 4 July 2023; Court of Justice of the European Union, Privacy International v. Secretary of State for Foreign and Commonwealth Affairs and Others, Case No. 623/17, Opinion, 15 January 2020; and Superior Court of New Jersey, State of New Jersey v. Francisco Arteaga, Decision, 7 June 2023. See also https://www.oaic.gov.au/news/media-centre/bunnings-breached-australians-privacywith-facial-recognition-tool. 121 See, for example, https://www.cnil.fr/en/employee-monitoring-cnil-fined-amazon-france-logistiqueeu32-million. 122 Members of the José Alvear Restrepo Lawyers’ Collective v. Colombia, Judgment, 18 October 2023. 123 Submission from Hakakire Legal Consult. involve considerations around, for example, data protection, the right to privacy and non-discrimination are key in effectively addressing adverse AI-related human rights impacts and ensuring access to remedy, particularly for groups at heightened risk of harm.

Lastly, certain AI systems and their deployment are fundamentally incompatible with human rights, requiring the international community to work together urgently to establish a set of red lines for prohibited uses of AI systems, including AI systems for remote real-time facial recognition, mass surveillance, predictive policing, social scoring and other practices incompatible with human rights.

The Working Group recommends that, with regard to AI procurement and deployment, States:
(a) Strengthen global cooperation to address the international impacts of AI procurement and deployment and ensure accountability in global AI governance, including by establishing common standards, interoperable frameworks, clear institutional roles and definitions of key terms;
(b) Establish robust legal, regulatory and policy frameworks that are aligned with international human rights laws and a human rights-based approach, including the Guiding Principles on Business and Human Rights, ensuring legal certainty for all;
(c) Update and implement privacy and data protection laws to align with international human rights standards and to protect against adverse human rights impacts by AI systems;
(d) Prohibit the deployment of AI systems that cannot comply with international human rights standards;
(e) Carry out and require robust human rights due diligence processes throughout the life cycle of AI systems and use procurement and deployment to drive compliance with human rights standards, with specific measures to ensure the protection of human rights defenders;
(f) Provide specific guidance to public sector procurement actors on a human-rights based approach to the procurement of AI systems;
(g) Provide capacity-building for all stakeholders to understand the technical and human rights dimensions of AI, and ensure accessible, explainable and understandable information about the procurement and deployment of AI systems;
(h) Ensure independent oversight of AI systems and require the provision of clear documentation on AI system capabilities, limitations and data provenance;
(i) Engage in public disclosure of the procurement and deployment of AI systems, including by mandating public registration of AI systems deployed by both public and private entities;
(j) Promote meaningful stakeholder consultation and participation in decision-making processes around AI procurement and deployment;
(k) Provide specific limitations, guidance and safeguards for AI systems procured and deployed in high-risk sectors and areas such as justice, law enforcement, migration, border control, social protection and financial services, and in conflict-affected areas;
(l) Create means to notify individuals before AI systems are deployed and when they affect their rights, ensure mechanisms for meaningful stakeholder feedback and provide clear protocols for redress, including judicial and non-judicial mechanisms;
(m) Ensure access to remedy mechanisms that have adequate resources and enforcement;
(n) Implement human oversight measures as safeguards when deploying AI systems;
(o) Shift the burden of proof to businesses and public authorities regarding AI-related harms to facilitate access to remedy for victims of human rights abuses or violations.

The Working Group recommends that, with regard to AI procurement and deployment, businesses:
(a) Demonstrate their commitment to respecting human rights at the highest level, including by adopting a human rights policy;
(b) Identify the AI systems being used and establish human rights policies for AI deployment, including commitments to and the implementation of the Guiding Principles on Business and Human Rights;
(c) Conduct thorough human rights due diligence to identify, prevent, mitigate and account for potential and actual human rights impacts of the AI systems that they procure and/or deploy, including through meaningful stakeholder engagement, and carry out regular assessments and updates to ensure that human rights due diligence is ongoing and responsive to emerging potential adverse impacts throughout the life cycle of the AI systems;
(d) Foster peer-learning spaces and cross-sectoral cooperation where businesses and other stakeholders can share best practices, lessons learned and strategies for integrating human rights considerations into AI procurement and deployment and, in particular, provide guidance and support to small and medium-sized enterprises in their value chains so that such enterprises can integrate human rights considerations;
(e) Ensure transparency and accountability in all AI-related processes, particularly in how data are collected, processed, used and disposed of during deployment;
(f) Implement robust data-protection mechanisms that respect privacy rights, ensure that data are collected in a transparent and non-discriminatory manner, in line with data-protection principles, and ensure that prior informed consent is obtained for all data storage and usage, with clear explanations and limitations about how the data will be utilized and protected;
(g) Promote cross-departmental, multi-disciplinary capacity-building and awareness-raising on the human rights implications of AI systems, including in consultation with experts, civil society organizations and members of academia;
(h) Integrate human rights requirements into AI procurement processes and, when issuing tenders, require adherence to international human rights standards, the conduct of thorough human rights due diligence and transparent reporting on potential adverse human rights impacts;
(i) Establish board-level oversight bodies on human rights issues related to AI, particularly in high-risk sectors such as healthcare, criminal justice and human resources, with a multi-disciplinary governance framework that includes cross-departmental collaboration;
(j) Ensure that affected individuals have accessible, explainable and understandable information about the AI systems that they interact with and request prior consent before deploying AI systems, to foster accountability and access to remedy;
(k) Establish or participate in effective operational-level grievance mechanisms, allowing for avenues for early and direct provision of remedies with regard to human rights abuses linked to the procurement and deployment of AI systems;
(l) Leverage influence within value chains and business relationships to encourage rights-respecting business conduct with regard to the life cycle of AI systems, including in cooperation with other businesses in the same sector or with an overlapping value chain.

The Working Group recommends that investors align investments in AI with international human rights standards and conduct human rights due diligence to identify and address potential and actual harms.

The Working Group recommends that civil society and academia:
(a) Continue to monitor and report on regulation on AI procurement and deployment, holding States and businesses accountable for compliance with human rights obligations and responsibilities;
(b) Advocate for transparent governance processes and provide research and policy input to shape rights-respecting AI regulations;
(c) Support affected individuals and communities in seeking remedies and challenging harmful AI practices.

The Working Group recommends that international organizations:
(a) Support States in aligning AI policy incentives and regulations and their underlying legal frameworks with human rights obligations by offering guidance, training and capacity-building programmes;
(b) Facilitate the creation of global frameworks for AI governance (e.g. international standards) that are operational and inclusive of civil society and other stakeholders beyond States, including by providing guidance and ensuring policy coherence;
(c) Implement the guidance of the Secretary-General on human rights due diligence for digital technology use.