What happened
The Council of Europe published a Convention 108 Bureau draft agenda on September 3, 2026, confirming that draft guidelines on privacy and large language models (document T-PD(2025)3rev4, dated August 26, 2026) will go before the Bureau of the Convention 108 Consultative Committee on September 16-17, 2026, ahead of planned formal adoption at the November 17-19 plenary. The 30+ page draft addresses the full lifecycle of 'LLM-based systems' (model creation, post-training adaptation, system integration, deployment, modification, decommissioning) and includes a dedicated Section VII on agentic AI systems covering credential scoping (separating read from write/modify/delete access), tool/orchestration-layer risk, and credential revocation at decommissioning.
Why it matters
Convention 108+ binds 55 state parties (broader reach than GDPR, including non-EU states like Argentina, Morocco, Mexico, Senegal, Tunisia, Uruguay). While framed as interpretive rather than creating new obligations, the agentic-AI section effectively establishes security-architecture expectations (credential/access scoping, tool permission boundaries, revocation on decommissioning) that overlap directly with AI agent security best practice, giving organizations operating AI agents across a much wider jurisdictional footprint a concrete compliance target ahead of November adoption.
Action needed
Track the September 16-17 Bureau review and November plenary adoption; map current AI agent credential-scoping and tool-permission architecture against the six-lifecycle-stage model; submit comments if eligible before finalization.