AI Compliance and the EU AI Act in Norway — 2026-06-25 report

Introduction

Artificial intelligence (AI) technologies have grown from experimental prototypes to general‑purpose tools that shape healthcare, transportation, finance and virtually every digital service. As generative AI models produce human‑like text and images on demand and “narrow” systems automate decisions about loans, hiring and medical diagnoses, the European Union has responded with the AI Act – the world’s first comprehensive regulatory framework for AI. The AI Act, formally adopted by the EU in 2024, uses a risk‑based approach: some systems are banned, others face stringent obligations, and most remain unregulated to encourage innovation. Norway, while not an EU member state, participates in the EU single market through the European Economic Area (EEA). Because the AI Act is deemed EEA‑relevant, Norway must implement the regulation to maintain regulatory alignment with the EU.

Norway’s National Digitalisation Strategy 2024–2030, titled The Digital Norway of the Future, explains that the Government will work to incorporate the AI Act into the EEA Agreement “as quickly as possible” and commit to adopting the regulation into domestic law. The strategy views the AI Act primarily as a product liability law that ensures AI‑enabled products and systems are safe and classifies AI systems by risk. Recognising that the Act will shape future AI development, the Government pledges to establish national supervisory and administrative structures to enforce it and to strengthen guidance for responsible AI development and use. This report examines how Norway intends to implement the EU AI Act, the emerging compliance landscape, and what businesses should do to prepare.

1. Overview of the EU AI Act

1.1 Genesis and aims

The EU AI Act (Regulation (EU) 2024/1689) is the first binding legislative framework governing AI systems in the EU. It aims to harmonise rules across Member States, fostering trust while preventing fragmentation. Norway’s Ministry of Digitalisation notes that harmonisation makes it easier for Norwegian companies to compete on equal terms and ensures innovation and accountability. The regulation covers the development, placement on the market, and use of AI systems and applies to providers and deployers inside the EU, as well as organisations outside the EU whose AI outputs are used in the EU.

1.2 Risk categories and obligations

The AI Act categorises AI systems into four tiers:

1. Prohibited AI systems – AI systems that pose an unacceptable risk are banned. The Norwegian government highlights that these systems violate fundamental values, for example by manipulating behaviour or exploiting vulnerabilities. Banned applications include social scoring by public authorities, behavioural manipulation, and certain biometric identification systems in public spaces. Prohibited systems must not be developed or used in Norway once the law takes effect.

2. High‑risk AI systems – These systems can have a significant impact on individuals’ fundamental rights, safety or access to services. Examples include AI used in critical infrastructure, medical devices, employment decisions, credit scoring, law enforcement and border control. The Act subjects providers of high‑risk AI systems to strict requirements: they must implement risk‑management systems, ensure human oversight, use high‑quality data, maintain technical documentation, undergo conformity assessments, register in an EU database, and enable post‑market monitoring. High‑risk systems may require third‑party conformity assessments by notified bodies (accredited certification organisations).

3. Limited‑risk AI systems – Systems that interact directly with users without making high‑stakes decisions (e.g., chatbots, emotion recognition) must comply with transparency obligations, notifying individuals that they are interacting with AI and disclosing AI‑generated content. AI‑generated deepfakes and synthetic media must be labelled accordingly. Users can then make informed decisions about continuing or disengaging.

4. Minimal‑risk AI systems – Most AI applications (e.g., spam filters, recommendation engines) fall into this category. The Act imposes no obligations on these systems to encourage innovation. However, providers are encouraged to adopt voluntary codes of conduct and adhere to EU values and fundamental rights.

The Act also introduces rules for general‑purpose AI models (GPAI), including foundation models and large language models. Providers of GPAI must implement transparency, risk management and information obligations. Models with systemic risks (very large models like GPT‑4 or Gemini) face stricter requirements, such as implementing state‑of‑the‑art security controls, conducting model evaluations and reporting serious incidents.

1.3 Extraterritorial effect and timeline

Similar to the GDPR, the AI Act has extraterritorial reach: it applies to providers or deployers outside the EU if their AI system’s output is used within the EU. Norway’s regulatory tracker notes that even before formal incorporation, Norwegian companies may be subject to the AI Act if they place AI systems into service in the EU or if their output is used in EU markets. Therefore, Norwegian businesses must monitor developments to ensure cross‑border compliance.

The Act entered into force in the EU on 1 August 2024, with transitional periods: banned systems must cease within six months; rules for general‑purpose AI apply after twelve months; high‑risk obligations apply after thirty months. Norway’s Government aims for the national law to take effect by late summer 2026, aligning with these timelines. During the transitional period, Norwegian companies can voluntarily comply to position themselves for the future regime.

2. Norway’s adoption plan and national structures

2.1 Incorporating the AI Act into Norwegian law

Norway is committed to incorporating the AI Act into the EEA Agreement and implementing it via a national AI Act. The digitalisation strategy emphasises that the AI Act will set the main framework for future AI development and use in Norway. It states that the Act requires Member States to have administrative and supervisory structures and notes that most current AI systems fall outside the high‑risk category but that future systems may be classified as high‑risk.

The Government will therefore work quickly to incorporate the Act and build the necessary regulatory infrastructure. A draft national AI Act is expected to be circulated for comment before the summer, with a view to entering into force in late summer 2026. By aligning Norway’s AI law with the EU, the Government seeks to provide Norwegian companies with legal certainty and access to the European market.

2.2 AI Norway and national coordination

To strengthen national AI efforts, Norway will establish AI Norway (KI‑Norge), a new and expanded expert environment within the Norwegian Digitalisation Agency (Digdir). AI Norway will serve as a central advisory hub, connecting key AI stakeholders in the public sector, industry, research and academia. It will manage an AI Sandbox – a safe environment where companies can experiment with AI systems, develop prototypes and test solutions against regulatory requirements. The sandbox aims to lower entry barriers for start‑ups and SMEs and to provide regulatory guidance.

This national hub will collaborate closely with the Norwegian Communications Authority (Nkom) and the Norwegian Data Protection Authority (Datatilsynet). The Government emphasises that cooperation between Digdir, Nkom and Datatilsynet will streamline AI governance, blending digital expertise, communications regulation and data protection oversight. AI Norway’s responsibilities will likely include developing guidelines, running training programmes, and coordinating Norway’s participation in European AI policy discussions.

2.3 Supervisory and accreditation bodies

The AI Act requires three national functions: a market surveillance authority, a notifying authority, and a single point of contact with EU bodies. Norway has moved quickly to designate these bodies:

• Norwegian Communications Authority (Nkom) – The Government has appointed Nkom as the national coordinating supervisory authority for AI, effectively acting as the market surveillance authority. Nkom will ensure uniform enforcement of the AI Act, monitor AI systems on the Norwegian market for safety, security and compliance, and serve as the single point of contact with EU bodies and other countries. The Government stresses that this role is crucial for ensuring that AI is developed in line with shared European values.

• Norsk akkreditering (NA) – Norway’s national accreditation body will act as the notifying authority responsible for designating and monitoring conformity assessment bodies. By assigning this role to an established accreditation body, Norway builds on existing systems used in public administration.

• Sectoral authorities – Although Nkom is the central market surveillance authority, sector‑specific regulators (e.g., health, finance, transport) will also participate in monitoring high‑risk AI systems. These authorities will collaborate with Nkom to ensure coherent enforcement and avoid regulatory gaps.

Together, these structures will form a national governance framework for AI regulation. Norway has also published a report on governance structures for the AI Act (June 2024), exploring various models, though details are beyond the scope of this report. This framework will underpin risk assessments, conformity assessments and enforcement actions.

2.4 Guidance and ethical principles

Norway emphasises that legal compliance alone is insufficient; AI must also be ethical and trustworthy. The digitalisation strategy notes that the Norwegian Digitalisation Agency has prepared a guide for the ethical and responsible use of AI and that guidance efforts will be further developed and strengthened. The Government will require all government agencies to adhere to principles of ethical and responsible AI when adopting AI solutions. These principles are derived from Norway’s National AI Strategy 2020, which articulated seven ethical principles: respect for human autonomy, human control, fairness, transparency, accountability, privacy and data protection, and robustness. Though not legally binding, these principles inform procurement and development practices across sectors.

The digitalisation strategy also outlines other commitments: ensuring that 80 % of government agencies adopt AI by 2025 and 100 % by 2030; developing national AI infrastructure, including high‑performance computing and foundational models in Norwegian and Sámi languages; investigating the need for high‑performance computing; and exploring how to use data from government agencies for ethical and safe training of national language models. These initiatives complement the regulatory framework by fostering domestic capacity and linguistic diversity.

3. Compliance obligations under the AI Act

3.1 Obligations for providers of high‑risk AI systems

Businesses developing or supplying high‑risk AI systems must implement a risk management system to identify, analyse and mitigate risks throughout the lifecycle. This includes designing systems with risk controls, verifying that training data meet quality and representativeness requirements, and ensuring robustness against adversarial attacks. Providers must create and maintain technical documentation detailing system architecture, training and testing procedures, data sources, performance metrics and risk mitigations.

Providers must also implement quality management systems (QMS) addressing processes, internal audits, corrective actions and oversight. For AI systems that are also regulated products (e.g., medical devices), the AI Act complements existing sectoral rules; providers must integrate AI requirements into their product compliance processes. High‑risk AI providers must undergo conformity assessments, either internally (for some Annex II‑A systems) or via third‑party notified bodies designated by the national accreditation authority (NA). After successful assessment, providers must register the AI system in the EU database, affix a CE marking, and issue an EU declaration of conformity.

3.2 Obligations for deployers and users

Deployers (organisations that use high‑risk AI systems) must verify that the system bears CE marking and is registered in the EU database. They must conduct impact assessments where mandated, particularly when AI decisions affect individuals’ rights (e.g., credit scoring or recruitment). Deployers must also implement human oversight mechanisms ensuring that humans can intervene when necessary. Employees should receive training on the system’s capabilities, limitations and proper use. Data protection impact assessments (DPIAs) under the GDPR may be required for systems processing personal data. Organisations should also develop incident response plans and post‑market monitoring processes to detect and report serious incidents or malfunctions.

3.3 Obligations for general‑purpose AI models

Providers of general‑purpose AI models (foundation models) must comply with tailored obligations. These include:

• Technical documentation – describing the model architecture, training data sources, training and testing procedures, performance metrics and limitations.
• Risk management – identifying and mitigating systemic risks such as hallucinations, bias, and misuse.
• Compliance with EU law – ensuring that training data respect copyright and that generative outputs do not infringe intellectual property rights.
• Transparency – providing users with information on the model’s capabilities, limitations and appropriate uses.
• Security – implementing state‑of‑the‑art measures to protect against adversarial attacks and data leakage.

For very large models with systemic risk, providers must conduct more stringent evaluations and cooperate with the AI Office (an EU‑level authority). As Norway’s regulatory framework matures, AI Norway and Nkom will likely oversee compliance for models developed domestically or deployed in Norway.

3.4 Conformity assessment procedures

The AI Act sets different conformity assessment procedures depending on the risk category and whether the AI system falls under existing harmonisation legislation. Procedures include:

• Internal control – For certain high‑risk systems, providers can perform an internal conformity assessment. They must implement risk management, ensure data quality, test the system, and prepare technical documentation. An attestation of conformity and CE marking follow.

• Quality management system assessment – For AI systems regulated under sectoral safety legislation (e.g., medical devices, machinery), providers must incorporate AI requirements into the QMS and undergo a conformity assessment by a notified body.

• Third‑party conformity assessment – For other high‑risk systems (e.g., biometric identification), a notified body must assess compliance. Providers submit documentation, the notified body audits the system and may require testing. After approval, the provider issues an EU declaration of conformity.

• AI regulatory sandboxes – The AI Act encourages Member States to offer regulatory sandboxes allowing providers to test systems under supervision. AI Norway’s sandbox will play this role domestically, enabling providers to experiment and receive guidance before placing products on the market.

4. Responsible AI guidance and ethical considerations in Norway

4.1 Ethical and responsible AI guidance

Norway’s digitalisation strategy highlights the need for guidance to support ethical and responsible AI. The Norwegian Digitalisation Agency (Digdir) has published guidance to help enterprises implement the ethical principles from the National AI Strategy. These principles emphasise human autonomy and control, fairness and non‑discrimination, transparency and explainability, privacy and data protection, accountability, robustness and safety, and social and environmental benefit. The strategy commits to further developing and strengthening guidance efforts.

All government agencies will be required to comply with the Digitalisation Circular, which sets out principles for ethical and responsible AI adoption. This requirement will cascade through procurement contracts, meaning suppliers of AI solutions to the public sector will need to demonstrate compliance. Agencies will have to integrate ethical assessments into project planning and may need to consult AI Norway for complex systems.

4.2 Privacy and data protection

AI often relies on large datasets, including personal data. Norway’s implementation of the GDPR (via the Personal Data Act 2018) already requires data protection by design and default. Datatilsynet, the data protection authority, provides guidelines on data protection by design; they emphasise privacy risk assessments, data minimisation, pseudonymisation, encryption and robust access controls. AI providers must integrate these principles into their systems, ensuring lawful bases for processing personal data and performing Data Protection Impact Assessments (DPIAs) when deploying high‑risk AI systems in sectors like health or employment.

4.3 Human rights and non‑discrimination

The Norwegian constitution and anti‑discrimination laws (Equality and Anti‑Discrimination Act) protect individuals against unfair treatment. AI systems that make decisions about employment, lending or housing must avoid bias and uphold equal treatment. The AI Act requires bias and discrimination analysis for high‑risk systems. Norway’s ethical guidelines likewise emphasise fairness, accountability and respect for fundamental rights. Businesses must ensure training data are representative and monitor algorithms for discriminatory outcomes. Audits and fairness testing should be part of the compliance programme.

4.4 Education and workforce implications

The digitalisation strategy notes that AI will reshape the labour market, requiring reskilling and continuing education. Public agencies must cooperate with social partners to manage restructuring and ensure workers can transition into new roles. AI tools in schools can personalise learning and assist students with disabilities but raise concerns about ethics, privacy, cheating and plagiarism. The Norwegian Directorate for Education will strengthen the knowledge base and create guidelines for AI use in education. Businesses developing AI for educational purposes must adhere to these guidelines.

4.5 Sector‑specific considerations

• Healthcare – AI can improve diagnostics, logistics and administrative tasks. Radiological AI can reduce radiation doses and workload. However, developers must comply with medical device regulations and ensure human oversight.
• Labour and welfare – The Labor and Welfare Administration Act has been amended to permit automated decision‑making in certain cases. Organisations must ensure transparency and fairness when automating welfare decisions.
• Education – AI tools in education must meet guidelines from the Norwegian Directorate for Education, addressing ethics, privacy and fairness.
• Transport and maritime – Norway’s maritime sector invests in autonomous vessels and predictive maintenance using AI. Developers must apply high‑risk requirements if AI affects safety.

5. Norwegian regulatory landscape: interplay with other digital laws

Norway’s AI compliance landscape does not exist in isolation. The Norway Digital Economy report from the U.S. International Trade Administration describes a complex regulatory environment shaped by EU digital economy regulations. Besides the AI Act, Norway must implement the Digital Markets Act (DMA), Digital Services Act (DSA), Data Governance Act, Data Act, European Digital Identity Framework, Cyber Resilience Act and the Network and Information Systems Directive (NIS2). Businesses must consider how these frameworks intersect. For example, the DSA imposes obligations on online platforms to manage illegal content and protect users’ rights, while the DMA targets gatekeepers with obligations to avoid unfair conduct. The Data Governance Act enables data sharing and altruistic data pools, complementing AI training needs.

The EU’s Digital Markets and Digital Services Acts complement the AI Act: platforms using AI to curate content or personalise recommendations must still comply with transparency and accountability obligations under the DSA and fairness requirements under the DMA. NIS2 introduces cybersecurity obligations for operators of critical infrastructure, which overlap with AI Act requirements for robust security. The GDPR continues to apply to AI systems processing personal data. The Transparency Act requires large companies to report on human rights impacts, including algorithmic discrimination. Thus, AI compliance in Norway will involve integrated governance across multiple laws.

6. Implementation timeline and transition in Norway

6.1 EU AI Act timeline

Key milestones for the EU AI Act are:

• August 2024 – AI Act enters into force in the EU.
• February 2025 – Prohibited AI systems banned in the EU; Norway’s government will likely ban them concurrently.
• August 2025 – Rules for general‑purpose AI models apply (transparency and copyright obligations, codes of practice).
• August 2027 – High‑risk system obligations apply (conformity assessments, QMS, registration, etc.).

During the transition, providers and deployers should gradually adapt to the requirements. The Norwegian Government intends to circulate a draft law before summer and implement it by late summer 2026. Companies may elect to follow EU requirements early to gain market trust.

6.2 National implementation steps

To prepare for implementation, Norway will need to:

1. Incorporate the AI Act into EEA law – The Government works with EFTA bodies to incorporate the AI Act into the EEA Agreement.
2. Draft and adopt a Norwegian AI Act – A national act aligning with the EU regulation will be drafted and opened for consultation in 2025.
3. Establish AI governance structures – AI Norway, Nkom and NA must formalise roles, set up procedures, and coordinate with sector regulators.
4. Issue guidance and training – Digdir and AI Norway will update and expand ethical AI guidance for agencies and businesses.
5. Build capacity – Invest in high‑performance computing, data sets, and language models to support AI development.
6. Amend sectoral laws – Identify and adapt sector legislation that might conflict with AI Act requirements, ensuring coherence.
7. Prepare accreditation bodies – NA must develop competence to assess conformity assessment bodies and coordinate with Nkom and the EU’s AI Office.

7. Impact on Norwegian businesses and foreign suppliers

7.1 Compliance burden for SMEs

Small and medium‑sized enterprises (SMEs) may find the regulatory environment burdensome. The U.S. Commerce Department’s digital economy report notes that Norway’s regulatory environment is complex and can be opaque for startups. Norwegian SMEs must invest in legal expertise, quality management systems and documentation to meet high‑risk obligations. However, Norway plans to support SMEs through the AI sandbox and guidance from AI Norway. SMEs supplying AI to the public sector must be prepared to demonstrate compliance with ethical principles and risk‑management frameworks.

7.2 Opportunities for compliance services and innovation

The AI Act creates opportunities for conformity assessment bodies, accredited laboratories, consultancies and compliance software providers. Norway’s designation of NA as the notifying authority opens a market for domestic bodies to become accredited for AI conformity assessments. The regulation will drive demand for AI auditing tools, fairness testing, data governance solutions and documentation management.

The Act also encourages innovation by reducing barriers for low‑risk AI systems. Most AI systems remain unregulated, allowing businesses to innovate freely. For high‑risk domains like healthcare and maritime, Norway’s strong research and industrial clusters may develop cutting‑edge AI solutions that comply with EU rules. AI Norway’s sandbox will help start‑ups test technologies without fear of immediate penalties.

7.3 Cross‑border considerations for international suppliers

Foreign suppliers offering AI systems in Norway should understand that the AI Act will apply extraterritorially if their systems are used in Norway or the EU. They must classify their systems by risk, implement required risk management and transparency measures, and ensure that high‑risk systems undergo conformity assessment. They should also monitor sector‑specific Norwegian laws and standards, as Norwegian authorities may impose additional requirements (e.g., language support for Norwegian and Sámi). Companies outside the EEA must appoint an authorised representative in the EU or EEA for high‑risk systems, which may involve partnering with Norwegian entities.

8. Actionable steps for organisations

To prepare for Norway’s implementation of the AI Act, organisations should undertake the following steps:

1. Inventory AI systems and classify risks: Conduct an enterprise‑wide inventory of AI applications. Determine whether each system is prohibited, high‑risk, limited‑risk or minimal‑risk under the AI Act. Review training data, deployment context and impact on individuals.

2. Establish AI governance: Create or update AI governance frameworks that include policies, procedures, roles and responsibilities. Appoint accountable executives for AI compliance. Integrate AI governance into broader compliance programmes (e.g., privacy, cybersecurity, product safety).

3. Implement risk management and QMS: For high‑risk systems, implement a risk management system, quality management system and technical documentation. Develop human oversight procedures and training programmes for staff using AI. Maintain logs and monitoring tools to identify performance drift or bias.

4. Prepare for conformity assessments: Identify whether your AI systems will require third‑party assessments. Engage early with potential notified bodies (once designated by NA). For cross‑border systems, plan for EU certification. For GPAI models, prepare to produce comprehensive documentation and risk assessments.

5. Engage with AI Norway and the AI sandbox: Participate in the national AI sandbox to test systems under regulatory supervision and receive feedback. Attend workshops and training offered by AI Norway and Nkom. Join industry forums to share best practices.

6. Monitor legislative developments: Track progress on the Norwegian AI Act, sectoral amendments and EU guidance. Engage in public consultations to influence policy. Monitor guidance from the European Commission’s AI Office and the European AI Board (once established).

7. Ensure ethical and privacy compliance: Align AI development with ethical principles and privacy by design. Conduct Data Protection Impact Assessments for systems processing personal data. Address fairness, bias and discrimination proactively. Provide transparency to users and ensure individuals can opt out of AI interactions where appropriate.

8. Secure data and systems: Invest in cybersecurity to protect AI models and data. Implement state‑of‑the‑art encryption, access controls and secure coding practices. Consider the Cyber Resilience Act and NIS2 obligations, particularly if you operate critical infrastructure.

9. Plan for talent and training: Develop internal expertise in AI compliance, ethics and audit. Provide training to technical teams on AI regulation and risk management. Encourage interdisciplinary collaboration between legal, technical and business departments.

10. Communicate with stakeholders: Inform customers, partners and employees about your AI use, risk controls and ethical commitments. Provide channels for feedback and complaints. Transparent communication builds trust and can differentiate your brand.

9. Future outlook

Norway aspires to become one of the most digitalised nations by 2030, using AI as a key driver. The Government’s ambition is reflected in its aim for full adoption of AI across government agencies and the development of national infrastructure for AI models in Norwegian and Sámi languages. The AI Act will play a pivotal role in ensuring that this digital transformation is safe, ethical and aligned with European values. Norway’s proactive implementation plan – from establishing AI Norway and Nkom’s supervisory role to creating a national accreditation regime – underscores its commitment to responsible AI.

However, challenges remain. Norway must balance innovation with risk management, particularly as generative AI becomes more powerful. SMEs will need support to navigate complex compliance regimes. Sectoral laws may require revision to accommodate AI, and international cooperation will be crucial to ensure cross‑border harmonisation. Norway will also need to invest in digital infrastructure and skills to harness AI’s potential.

By preparing early, engaging with regulators and embracing ethical AI practices, organisations can turn compliance into a competitive advantage. The Norwegian market, with its high trust levels, advanced digital infrastructure and strong public sector, offers fertile ground for AI solutions that respect human rights and societal values.

References

• Paving the way for safe and innovative use of AI in Norway – Government press release describing Norway’s plan to adopt the EU AI Act, establishing AI Norway and designating Nkom as supervisory authority.
• The Digital Norway of the Future (National Digitalisation Strategy 2024–2030) – details Norway’s commitment to incorporate the AI Act into Norwegian law and establish national supervisory and administrative structures; explains ethical AI guidance and public sector requirements; emphasises national infrastructure and adoption targets.
• Norway Digital Economy (International Trade Administration) – describes Norway’s alignment with EU digital regulations, including the AI Act, and notes the complexity of the regulatory environment for businesses.
• AI Act National Implementation Plans (artificialintelligenceact.eu) – summarises Norway’s designation of Nkom as the coordinating supervisory authority and NA as the technical accreditation body.
• AI regulations and other laws (White & Case AI regulatory tracker) – lists existing Norwegian laws affecting AI, underscores technology‑neutrality, and highlights the absence of comprehensive AI legislation pending the EU AI Act.
• Guidelines on data protection by design – Datatilsynet’s cooperation with security experts to develop guidelines for privacy by design and default, emphasising privacy risk assessments and technical measures.

Export metadata: recovered source URLs

The report prose above was recovered from the complete conversation version; only leaked internal citation tokens were removed for publication.

1. Government of Norway, Paving the way for safe and innovative use of AI in Norway: https://www.regjeringen.no/en/whats-new/gjor-norge-klar-for-trygg-og-innovativ-ki-bruk/id3093081/
2. Government of Norway, The Digital Norway of the Future: https://www.regjeringen.no/en/documents/the-digital-norway-of-the-future/id3054645/
3. EU AI Act implementation plans: https://artificialintelligenceact.eu/national-implementation-plans/
4. U.S. International Trade Administration, Norway Digital Economy: https://www.trade.gov/country-commercial-guides/norway-digital-economy
5. White & Case, AI Watch Norway: https://www.whitecase.com/insight-our-thinking/ai-watch-global-regulatory-tracker-norway
6. EU AI Act portal: https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai