AI Regulation in Norway: 2026 Update

AI regulation in Norway is shaped primarily by the EU AI Act, which applies to Norway as a member of the European Economic Area. Businesses developing, deploying or importing AI systems in Norway must comply with a layered framework that combines EEA obligations, existing Norwegian sectoral law, and emerging national guidance. This guide covers the legal foundations, risk classification, compliance obligations, enforcement structure, and practical steps for businesses operating in or entering the Norwegian market.

Norway is not an EU member state, but it participates in the single market through the EEA Agreement. This means that EU regulations adopted as EEA-relevant legislation are incorporated into Norwegian law after a formal EEA Joint Committee decision. The EU AI Act - Regulation (EU) 2024/1689 - is EEA-relevant and is in the process of being incorporated into the EEA Agreement, making it binding on Norway on the same substantive terms as in EU member states.

The practical consequence is significant. Norwegian companies cannot treat the EU AI Act as a foreign rule that applies only when they sell into the EU. Once incorporated, the regulation applies to AI systems placed on the Norwegian market or put into service in Norway, regardless of where the provider is established. A Norwegian software company building an AI-powered recruitment tool for domestic clients falls squarely within scope.

The timeline for formal EEA incorporation involves a Joint Committee decision, followed by the Norwegian parliament granting the necessary consent where constitutional requirements demand it. In practice, Norwegian authorities and businesses are already aligning with the EU AI Act';s structure and deadlines, treating incorporation as a near-certainty. The Norwegian government has publicly confirmed this alignment approach.

Alongside the AI Act, Norway';s existing legal framework remains fully operative. The Personal Data Act, which incorporates the GDPR into Norwegian law, applies to any AI system that processes personal data. The Norwegian Working Environment Act governs automated decision-making in employment contexts. The Financial Supervisory Authority of Norway (Finanstilsynet) applies its own expectations to AI use in financial services. These sectoral rules interact with the AI Act and in some cases impose stricter requirements.

The EU AI Act organises AI systems into four risk tiers, and understanding which tier applies to a given system is the first practical compliance task for any Norwegian business.

Unacceptable-risk AI systems are prohibited outright. These include systems that use subliminal manipulation to distort behaviour, exploit vulnerabilities of specific groups, enable social scoring by public authorities, and - with narrow exceptions - real-time remote biometric identification in public spaces. Norwegian businesses must ensure none of their AI systems fall into this category.

High-risk AI systems face the most demanding compliance obligations. The AI Act lists specific sectors and use cases in Annex III, including AI used in critical infrastructure, education, employment and worker management, access to essential private and public services, law enforcement, migration and border control, and administration of justice. Many AI applications in Norwegian financial services, healthcare, and public administration will qualify as high-risk.

Limited-risk systems - such as chatbots and deepfake generators - face transparency obligations. Providers must ensure users are informed they are interacting with an AI system. General-purpose AI models, including large language models, face their own set of obligations under Title VIII of the AI Act, including transparency requirements and, for models with systemic risk, additional evaluation and incident reporting duties.

Minimal-risk systems, such as spam filters or AI-enabled video games, face no mandatory requirements under the AI Act, though voluntary codes of conduct are encouraged.

A common mistake among Norwegian businesses is underestimating how broadly the high-risk category is drawn. An AI system used to screen job applications, assess creditworthiness, or prioritise access to public benefits is likely high-risk, even if the company considers it a simple automation tool.

For businesses operating high-risk AI systems in Norway, the EU AI Act imposes a structured set of obligations that apply across the system lifecycle.

Risk management system. Providers must establish, implement, document and maintain a risk management system throughout the AI system';s lifecycle. This is not a one-time assessment but an ongoing process that must identify and analyse known and foreseeable risks, estimate and evaluate risks that may emerge from intended use and reasonably foreseeable misuse, and adopt appropriate risk mitigation measures.

Data governance. Training, validation and testing datasets must meet quality criteria. They must be relevant, sufficiently representative, and free from errors to the extent possible. Norwegian businesses working with personal data in AI training pipelines face a dual obligation: compliance with the AI Act';s data governance requirements and compliance with the GDPR as implemented through the Norwegian Personal Data Act.

Technical documentation. Providers must draw up technical documentation before a high-risk AI system is placed on the market. This documentation must demonstrate compliance with the AI Act';s requirements and provide national authorities with the information needed to assess that compliance. The documentation requirements are detailed and include descriptions of the system';s purpose, design logic, training methodology, performance metrics, and known limitations.

Transparency and instructions for use. High-risk AI systems must be accompanied by instructions for use that enable deployers to understand the system';s capabilities, limitations, and the human oversight measures required. This is particularly relevant for Norwegian businesses that purchase AI systems from third-party providers and deploy them in their own operations.

Human oversight. High-risk AI systems must be designed and developed in a way that allows effective human oversight during the period of use. Deployers - the businesses that use high-risk AI systems in their operations - bear specific obligations to implement human oversight measures and to assign responsibility to competent natural persons.

Accuracy, robustness and cybersecurity. High-risk AI systems must achieve appropriate levels of accuracy and must be resilient against errors, faults and inconsistencies. Cybersecurity requirements are integrated into the AI Act';s obligations, which is particularly relevant given Norway';s existing cybersecurity framework under the Network and Information Security Act.

Conformity assessment. Before placing a high-risk AI system on the market, providers must carry out a conformity assessment. For most high-risk systems, this is a self-assessment against the requirements of the AI Act. For certain categories - including AI systems used in biometric identification - third-party conformity assessment by a notified body is required.

Registration. High-risk AI systems must be registered in the EU database for high-risk AI systems before being placed on the market. Norwegian providers will register in this EU-wide database once the AI Act is formally incorporated into the EEA Agreement.

In practice, founders and compliance officers should consider building AI governance documentation in parallel with product development rather than retrospectively. Retrofitting documentation to an already-deployed system is significantly more resource-intensive and often reveals gaps that require product changes.

General-purpose AI (GPAI) models - large-scale models trained on broad data that can perform a wide range of tasks - are subject to a distinct set of obligations under Title VIII of the EU AI Act. This is directly relevant to Norwegian technology companies building or fine-tuning foundation models, as well as to businesses integrating GPAI models into their products.

All GPAI model providers must draw up and maintain technical documentation, make available information and documentation to downstream providers who integrate the model into their AI systems, establish a policy to comply with EU copyright law, and publish a sufficiently detailed summary of the content used for training.

Providers of GPAI models that are deemed to pose systemic risk - defined by reference to the computational power used in training, currently set at a threshold of ten to the power of twenty-five floating point operations - face additional obligations. These include performing model evaluations, assessing and mitigating systemic risks, reporting serious incidents to the European AI Office, and ensuring adequate cybersecurity protection.

Norwegian companies that use GPAI models provided by third parties - for example, integrating a commercial large language model into a customer service application - are downstream providers or deployers under the AI Act. They must ensure they have received the necessary documentation from the GPAI model provider and that their own system-level obligations are met.

A non-obvious requirement is that downstream providers cannot simply rely on the GPAI provider';s compliance. If a Norwegian company builds a high-risk AI system on top of a GPAI model, the company bears its own high-risk obligations in addition to whatever the GPAI provider has supplied.

If you are building or deploying AI systems in Norway and need clarity on how these obligations apply to your specific product or use case, contact info@vlolawfirm.com. We can help structure the compliance approach correctly from the outset.

The EU AI Act requires each member state - and by extension each EEA state - to designate one or more national competent authorities responsible for supervising and enforcing the regulation. Norway has been preparing its national enforcement architecture in anticipation of formal EEA incorporation.

The Norwegian Communications Authority (Nkom) has been identified as a likely candidate for a central supervisory role, given its existing mandate over digital infrastructure and services. However, the AI Act';s sectoral structure means that multiple Norwegian authorities will have enforcement roles in their respective domains. Finanstilsynet will supervise AI use in financial services. The Norwegian Data Protection Authority (Datatilsynet) will continue to enforce GDPR compliance in AI contexts and is expected to play a significant role in AI oversight more broadly, given the deep intersection between AI systems and personal data processing.

Datatilsynet has already been active in this space. The authority has issued guidance on the use of AI in employment decisions, conducted investigations into automated decision-making by Norwegian companies, and published its expectations for data protection impact assessments in AI contexts. Its work provides a practical preview of the enforcement approach Norwegian businesses can expect.

The European AI Office, established within the European Commission, has a supervisory role over GPAI models and a coordination role across national authorities. Norwegian authorities will cooperate with the European AI Office through EEA mechanisms, though the precise modalities are still being finalised as part of the incorporation process.

Penalties under the EU AI Act are substantial. Violations involving prohibited AI practices can attract fines of up to thirty-five million euros or seven percent of global annual turnover, whichever is higher. Non-compliance with other obligations for high-risk systems can result in fines of up to fifteen million euros or three percent of global annual turnover. Providing incorrect or misleading information to authorities can attract fines of up to seven and a half million euros or one percent of global annual turnover. These figures apply to the EU framework and will apply in Norway upon incorporation.

The EU AI Act is a horizontal regulation, meaning it applies across sectors. However, it explicitly preserves the application of existing sectoral law and in some cases defers to sectoral regulators. For Norwegian businesses, understanding how the AI Act interacts with sector-specific rules is essential.

Financial services. Finanstilsynet has issued supervisory expectations for the use of AI and machine learning in financial institutions. These expectations address model risk management, explainability, and governance. Norwegian banks, insurers and investment firms must comply with both the AI Act';s requirements and Finanstilsynet';s supervisory expectations. Where a financial services AI system qualifies as high-risk under the AI Act - for example, an AI system used to assess creditworthiness - the AI Act';s conformity assessment and documentation requirements apply alongside the financial regulator';s model risk expectations.

Healthcare. AI systems used as medical devices or as components of medical devices are regulated under the Medical Devices Regulation (MDR) and the In Vitro Diagnostic Regulation (IVDR), both of which apply in Norway through the EEA Agreement. The AI Act designates AI systems intended to be used as safety components of medical devices, or which are themselves medical devices, as high-risk. Norwegian medtech companies must navigate both regulatory frameworks simultaneously.

Employment. The Norwegian Working Environment Act contains provisions on the use of automated decision-making in employment relationships. Employees have rights to explanation and human review of automated decisions that significantly affect them. These rights interact with the AI Act';s transparency and human oversight requirements for high-risk AI systems used in employment contexts.

Public sector. Norwegian public authorities using AI systems in administrative decision-making must comply with the Public Administration Act, which imposes requirements of legality, proportionality and the right to explanation. AI-assisted administrative decisions must be traceable and subject to appeal. The AI Act';s requirements for high-risk AI systems used in public administration layer on top of these existing obligations.

A practical scenario: a Norwegian municipality deploys an AI system to assist in processing applications for social benefits. The system is high-risk under the AI Act';s Annex III. The municipality must comply with the AI Act';s deployer obligations - including human oversight, monitoring and logging - while also ensuring compliance with the Public Administration Act';s requirements for individual rights and the Personal Data Act';s requirements for lawful processing of sensitive personal data.

A second scenario: a Norwegian fintech company develops an AI-powered credit scoring model and sells it to banks across the EEA. The company is a provider of a high-risk AI system. It must complete a conformity assessment, prepare technical documentation, register the system in the EU database, and affix the CE marking. It must also ensure its model complies with Finanstilsynet';s model risk expectations if it is used by Norwegian-regulated entities.

For businesses already operating in Norway or planning to enter the Norwegian market with AI products or services, the following practical steps reflect the current state of the regulatory framework.

Map your AI systems. Conduct an inventory of all AI systems your business develops, deploys or procures. For each system, assess which risk tier it falls into under the EU AI Act. This mapping exercise is the foundation of any compliance programme and should be updated as systems evolve and as regulatory guidance develops.

Assess your role in the supply chain. The AI Act distinguishes between providers (those who develop and place AI systems on the market), deployers (those who use AI systems in their operations), importers, distributors and authorised representatives. Each role carries different obligations. Many Norwegian businesses will be deployers of AI systems developed by third parties, which means their primary obligations relate to use-phase compliance rather than development-phase compliance.

Review contracts with AI vendors. Deployers of high-risk AI systems must receive specific information and documentation from providers. Norwegian businesses procuring AI systems should review their vendor contracts to ensure they include appropriate representations, documentation obligations, and audit rights. Many standard vendor contracts do not yet reflect AI Act requirements.

Build governance structures. High-risk AI system deployers must designate human oversight responsibilities, implement monitoring procedures, and maintain logs of system operation. Building these governance structures requires cross-functional involvement from legal, compliance, technology and business teams.

Engage with Datatilsynet guidance. Datatilsynet has published practical guidance on AI and data protection that is directly applicable to Norwegian businesses. Engaging with this guidance - and conducting data protection impact assessments where required - is both a legal obligation and a practical risk management tool.

Prepare for registration and conformity assessment. Providers of high-risk AI systems must register their systems in the EU database and complete conformity assessments before placing systems on the market. Norwegian providers should begin preparing the required documentation now, rather than waiting for formal EEA incorporation to be completed.

Many underestimate the time required to prepare adequate technical documentation for high-risk AI systems. The documentation must be sufficiently detailed to allow a competent authority to assess compliance, which in practice means it must go well beyond a standard product specification.

For assistance with AI compliance documentation, vendor contract review, or regulatory strategy in Norway, contact info@vlolawfirm.com. We can assist with documents, filings, and regulatory engagement.

Does the EU AI Act currently apply to Norwegian businesses, and what happens if they do not comply now?

The EU AI Act is in the process of being incorporated into the EEA Agreement, which is the formal mechanism by which EU regulations become binding in Norway. Until the Joint Committee decision is adopted and Norway completes any necessary constitutional steps, the AI Act is not yet formally binding Norwegian law. However, Norwegian authorities - including Datatilsynet and the government - have made clear that alignment with the AI Act is expected, and existing Norwegian law already imposes overlapping obligations in areas such as data protection, employment and financial services. Businesses that delay compliance preparation risk being caught unprepared when incorporation is completed, and they may already face enforcement action under existing Norwegian law for AI-related practices that violate GDPR or sectoral rules. The prudent approach is to treat the AI Act as operationally applicable now.

How long does it typically take to prepare a high-risk AI system for compliance, and what does it cost?

The timeline and cost vary significantly depending on the complexity of the AI system, the maturity of existing documentation, and whether the system was designed with compliance in mind from the outset. For a moderately complex AI system with some existing technical documentation, preparing the full suite of AI Act-compliant documentation - risk management system, technical documentation, instructions for use, conformity assessment - typically takes several months of focused work. Professional fees for legal and technical advisory support usually start from the low thousands of euros for straightforward systems and can reach significantly higher for complex or novel applications. Businesses that integrate compliance requirements into the development process from the beginning generally face lower costs than those retrofitting compliance to an existing system.

Can a Norwegian company use a US-based AI model provider and still comply with Norwegian and EEA AI rules?

Yes, but with important caveats. Using a US-based GPAI model provider does not exempt a Norwegian company from its own obligations under the AI Act or under Norwegian law. If the Norwegian company builds a high-risk AI system using the US provider';s model, the Norwegian company is the provider of that high-risk system and bears the full set of provider obligations, including conformity assessment, technical documentation and registration. The Norwegian company must also ensure that its use of the US provider';s model complies with the GDPR - in particular, that there is a lawful basis for any personal data transfers to the US and that appropriate safeguards are in place. The Norwegian company should obtain from the US provider the documentation required under the AI Act for GPAI models, and should verify that the provider';s terms of service permit the intended use case.

AI regulation in Norway is converging rapidly with the EU AI Act framework, and businesses operating in the Norwegian market cannot afford to treat compliance as a future concern. The risk classification system, the obligations for high-risk and general-purpose AI, and the enforcement architecture are all taking shape now. Norwegian sectoral law adds further layers that interact with the AI Act in ways that require careful navigation.

VLO Law Firms advises international clients on AI regulation in Norway. We can assist with risk classification assessments, compliance documentation, vendor contract review, regulatory engagement with Norwegian authorities, and cross-border AI governance strategy. To request a consultation, contact: info@vlolawfirm.com