Sanctions, Export Controls and Sensitive Sectors in Norway (2026)

Introduction

Norway is a small, open economy that is deeply integrated into European trade and security frameworks. While not a member of the European Union, Norway participates in the European Economic Area (EEA) and incorporates most EU regulations into domestic law through EEA agreements. As a result, the Norwegian sanctions regime and export‑control system largely mirror the European Union’s measures, while also reflecting national priorities around security, energy independence, and ethical procurement. This report provides a comprehensive guide to Norway’s sanctions and export‑control landscape as of mid‑2026, with a focus on screening obligations, dual‑use goods, Russia‑related sanctions, sensitive sectors such as energy and defence‑adjacent technologies, and how these factors intersect with public procurement. Throughout the report we draw from official Norwegian sources, EU regulations, and expert legal commentary to offer actionable advice for companies operating in Norway or dealing with Norwegian partners.

Why this matters

Global geopolitical tensions, especially Russia’s invasion of Ukraine and subsequent international sanctions, have intensified scrutiny on cross‑border transactions. Businesses must navigate an evolving web of restrictions on goods, services, technology transfers and investments. Norway’s adoption of successive EU sanctions packages, its introduction of a national list of dual‑use goods, and ongoing reforms to its foreign investment screening regime have expanded compliance requirements. At the same time, public contracting authorities are being pushed to consider national security and emergency preparedness when awarding contracts, adding another layer of complexity for bidders. Understanding these intersecting regimes is essential to avoid enforcement action, protect supply chains and maintain market access.

Scope of this report

We first explain how Norway’s sanctions system works and summarise the most recent sanctions packages. Next we examine the Norwegian export‑control framework, including licensing requirements for military and dual‑use items and the new national control list (List III). We then explore how screening obligations and foreign direct investment (FDI) rules apply to sensitive sectors such as energy and defence‑adjacent technology. After that we discuss how these regimes intersect with public procurement, highlighting recent reforms that emphasise security and preparedness. Finally, we offer examples, edge cases, and actionable recommendations for companies and policymakers.

1. Norway’s sanctions regime

1.1 Legal basis and alignment with the EU

Norway implements sanctions primarily under the Act relating to control of the marketing of weapons, etc. (the Export Control Act) and the Regulation on restrictive measures adopted on 15 August 2014. Under the EEA Agreement, Norway has committed to align its restrictive measures with those of the European Union. The Norwegian government emphasises that sanctions against Russia are “implemented in Norwegian law by a regulation of 2014,” and that Norway adopts EU sanctions packages on an ongoing basis. In practice this means that when the EU introduces a new sanctions package, Norway will usually implement equivalent measures through amendments to the 2014 regulation, often on the same day or shortly thereafter. This alignment reduces compliance fragmentation for Norwegian and European businesses but requires companies to monitor EU updates closely.

1.2 Evolving sanctions packages: focus on the 19th package (2025–26)

Norway has successively adopted EU sanctions packages against Russia since 2014. The 19th sanctions package, adopted on 23 October 2025 (effective in Norway on 27 March 2026), introduces some of the most far‑reaching measures to date. According to the Norwegian Ministry of Foreign Affairs, the 19th package “tightens restrictions on energy, finance and trade sectors, lists additional persons, entities and ships for asset freezing, and is incorporated into Norwegian law”. Key elements include:

1. Energy sector restrictions – the EU bans the import or transfer of Russian liquefied natural gas (LNG) into the EU, with phased implementation: contracts longer than one year entered into before 17 June 2025 may continue until 1 January 2027, while all other contracts must stop by 25 April 2026. Norway’s implementation mirrors these dates. There are also expanded transaction bans on Russian energy companies such as Rosneft and Gazprom Neft and restrictions on transferring LNG cargoes through EU ports.

2. Financial sector restrictions – the package expands bans on transactions with Russia’s financial architecture, including the System for Transfer of Financial Messages (SPFS) and additional banks and traders. It introduces definitions of ownership and control for designated entities, clarifying asset‑freeze measures. Crypto‑assets are also targeted; the package bans EU crypto service providers from offering high‑value services to Russian residents or legal persons.

3. Technology and services – restrictions extend to high‑tech goods and chemicals that could support Russia’s military‑industrial base. The package notably prohibits “AI and high‑performance computing services” and certain space‑based services for Russian clients. A Skadden analysis notes that the EU sanctions now “target companies producing AI technology and computing services” and emphasises that compliance obligations for businesses in these sectors have increased.

4. Shipping and transport measures – the package lists “shadow fleet” vessels used to circumvent the oil price cap and bars EU firms from insuring or re‑insuring these ships. Norway’s government stresses that this aims to “prevent sanctions circumvention”.

5. Listing of individuals and entities – the EU added 64 individuals and 42 entities to its asset‑freeze list, including Russian energy companies, Chinese petrochemical firms and professional advisers accused of sanctions evasion. Norway mirrors these listings through domestic regulation.

By March 2026 the Norwegian government had fully implemented the 19th package through amendments to the 2014 regulation. Previous packages remain in force, meaning that import bans on steel, iron, gold and other goods; restrictions on aviation and shipping services; and prohibitions on technology transfers introduced in earlier packages still apply. Businesses must therefore review the entire sanctions landscape rather than focusing only on the latest package.

1.3 Enforcement and penalties

The Norwegian Agency for Export Control and Sanctions (DEKSA) is responsible for administering sanctions. Failure to comply can lead to administrative penalties, criminal fines or imprisonment. In addition, the Ministry of Foreign Affairs may place entities on national denial lists. The 19th package emphasises enforcement by clarifying definitions of ownership and control and by expanding the list of sanctionable activities—signals that authorities expect companies to perform thorough due diligence. Norwegian courts may also enforce asset freezes and transaction bans; there have been cases in which Norwegian banks have blocked payments to avoid breaching EU sanctions, and companies have had shipments seized when they failed to demonstrate compliance.

1.4 Interaction with UK and US sanctions

Norwegian measures generally align with EU sanctions, but companies should also assess exposure to UK and US regimes. The 19th package coincided with new US sanctions designating Rosneft and Lukoil and UK asset freezes. Although Norway does not directly implement US or UK measures, Norwegian banks and insurance companies often apply them to manage risk. Global supply chains must therefore be screened against multiple jurisdictions.

2. Export controls and dual‑use goods

2.1 Regulatory framework

Norway’s export‑control regime is set out in the Export Control Act and the Regulation of 18 June 2013 (last amended 2025). The regulation requires a licence for the export of “products, technology and services that are particularly designed or modified for military purposes” and for dual‑use goods listed in Appendices I and II. Licensing is also required for brokering such goods between third countries and for providing technical assistance related to them. Services may require a licence if they involve the transfer of controlled knowledge—for example, software updates or technical training.

2.1.1 Catch‑all clause

The regulation contains a catch‑all provision: if exporters know or have reason to believe that products, technology or services may be used for the development or production of nuclear, chemical or biological weapons or missiles, or for “military use in an area subject to an arms embargo or war,” they must apply for a licence even if the items are not listed. This clause also covers intangible transfers, such as emailing technical drawings or cloud‑sharing software that could be used for weapons development.

2.1.2 Exemptions

The regulation exempts certain exports from licensing, including rescue equipment, European Space Agency deliveries, and controlled goods for research in EEA or NATO countries. However, these exemptions are narrowly interpreted and may not apply if end‑use concerns arise. Companies should seek confirmation from DEKSA when uncertain.

2.2 Lists of controlled goods

Norway uses three main lists:

1. List I (Military Goods) – covers weapons, ammunition, military vehicles and any equipment specially designed or modified for military use. Exports always require an individual licence. Licences may be denied if the recipient country is involved in armed conflict or human rights abuses.

2. List II (Dual‑Use Items) – corresponds closely to the EU dual‑use list governed by Regulation (EU) 2021/821. Dual‑use goods are products, software and technology that have both civilian and military applications. The EU emphasises that export controls help prevent the proliferation of weapons of mass destruction and comply with international treaties. Regulation 2021/821 also defines common rules and types of authorisations (general, national, global and individual), which Norway has largely adopted through the EEA Agreement.

3. List III (National Control List of Dual‑Use Goods) – introduced on 1 November 2024 following a consultation by the Ministry of Foreign Affairs. The list expands Norway’s control beyond the EU list to include additional materials processing equipment, electronics and computing technologies. Law firm Schjødt notes that the new list “broadens the scope of the Norwegian export control regime” and reflects emerging technologies and geopolitical trends. The list is coordinated with some like‑minded countries, such as Denmark and the UK. Companies engaged in advanced electronics or computer hardware should check whether their products fall under List III, particularly categories 2 (materials processing), 3 (electronics) and 4 (computers).

2.3 Types of licences

Norway offers several licence types:

• Individual licences – specific to one exporter and one recipient for defined goods. These are required for most List I exports and high‑risk List II/III items.

• Global licences – cover multiple items to multiple destinations. These may be granted for routine deliveries to trusted recipients, but the exporter must maintain strict record‑keeping. explains that global licences cover “multiple items to multiple countries of destination.”

• General licences – Norway participates in EU General Export Authorisations (EUGEAs), which allow exports of specified dual‑use items to certain destinations (e.g., Australia, Canada, Japan, Norway and others) without individual applications. Exporters must still register and report usage. National General Licences may also exist for less sensitive items.

Licences are issued by DEKSA. The authority assesses the applicant’s internal control system, compliance record, end‑use statement and whether the export risks being diverted to illicit end‑users. The evaluation also considers Norway’s international commitments, particularly in the Wassenaar Arrangement and the Australia Group. Companies must allow for processing time (weeks to months) and should not ship goods before a licence is granted.

2.4 Dual‑use goods and technology transfers

The expanding scope of controlled goods means that seemingly innocuous products may be caught by export control rules. Semiconductor manufacturing equipment, high‑speed processors, advanced drones, quantum devices, AI chips, encryption software and machine‑learning models can have military applications. Under Norway’s catch‑all clause, providing cloud‑based AI training to a customer in an embargoed region or handing over source code that could be repurposed for missile guidance may require a licence. Companies must perform rigorous end‑use screening and sometimes restrict intangible transfers to comply with the regulation. The requirement to license technology transfers also intersects with the EU’s general prohibition on the provision of AI and high‑performance computing services to Russian entities in the 19th sanctions package.

3. Screening and foreign investment controls

3.1 Current regime under the Security Act

Norway’s current FDI screening regime is anchored in Chapter 10 of the Security Act (2018). Transactions that lead to a “qualified ownership interest” (typically one‑third of shares or voting rights) in a company designated as security‑sensitive require mandatory notification to the Norwegian government. Companies subject to the Security Act include those handling classified information, managing critical systems or infrastructure, or otherwise performing activities vital to national security. Key sectors comprise defence, telecommunications, space, finance, transport, energy and information and communications technology. The government may also intervene in the sale of strategically located real estate (e.g., port facilities or land near military sites).

Notable cases illustrate the regime’s reach. In 2021 the government blocked the proposed sale of engine manufacturer Bergen Engines to Russian‑controlled TMH International due to concerns that technology could be diverted to Russian naval vessels. The same year, the government imposed conditions on Mubadala’s investment in fibre‑optic company GlobalConnect, including restrictions on access to sensitive networks. Norwegian authorities also intervened to prevent the sale of land in Svalbard to foreign buyers due to the archipelago’s strategic significance.

3.2 Pending amendments to the Security Act

Parliament adopted amendments to the Security Act in June 2023, but as of early 2026 they have not entered into force. The amendments would broaden the scope of the regime to include targets participating in security‑graded procurement or possessing a facility security clearance, lower the notification threshold to 10 % of share capital or voting rights, introduce a standstill obligation, and expand restrictions on information exchange. The amendments also propose stricter timelines for review and require foreign investors to provide detailed beneficial ownership information. However, implementation has been delayed, and a timeline remains uncertain.

3.3 Proposed Investment Control Act

In parallel, the government is preparing a new Investment Control Act. As reported by law firm BAHR in February 2026, the Minister of Trade confirmed that a consultation paper would be published in spring 2026. The Act would introduce a sector‑based FDI regime covering critical technologies, raw materials and infrastructure (including AI, quantum computing, semiconductors, energy, transport and digital networks). The proposal is expected to align with the EU’s revised FDI Regulation but will not be incorporated into the EEA Agreement, meaning that Norway will remain outside EU cooperation mechanisms. Norwegian investors may face screening obligations in EU member states, while EU investors might need to file in Norway. Public consultations and legislative drafting will extend through 2026–2027; companies planning transactions should watch this process closely.

3.4 Practical considerations for investors

Foreign investors should conduct early due diligence to determine whether the target company is subject to the Security Act or will be covered by the new Investment Control Act. Considerations include whether the business operates critical infrastructure, uses classified information, supplies defence equipment or participates in security‑graded procurements. Transactions may trigger notification thresholds even when acquiring minority stakes, particularly if the amendments lower the threshold to 10 %. Investors should budget for at least 60 business days for Phase 1 review (current timeline) and expect Phase 2 reviews with no statutory deadline. To mitigate delays, parties should prepare comprehensive documentation showing how the investment will safeguard Norwegian security interests—e.g., by appointing Norwegian board members, localising sensitive data, or agreeing to ring‑fenced operations.

4. Sensitive sectors: energy and defence‑adjacent technology

4.1 Energy sector restrictions

The energy sector occupies a unique place in Norway’s sanctions and export‑control regime due to Norway’s role as a major exporter of oil and gas and its strategic interest in maintaining energy security. The 19th EU sanctions package prohibits import or transfer of Russian LNG into the EU starting from 25 April 2026 (or 1 January 2027 for certain long‑term contracts). Norway has implemented these measures, even though it does not import significant volumes of Russian gas; the ban prevents Russian LNG from being trans‑shipped via Norwegian terminals or ports. The package also bans EU firms from providing transshipment, ship‑to‑ship transfer, storage or insurance services for the banned LNG. Companies involved in the energy supply chain must therefore verify the origin of cargoes and ensure that vessels are not on the “shadow fleet” list.

In addition to sanctions, Norway uses export controls to manage the export of energy‑related equipment (e.g., drilling tools, subsea systems, advanced sensors). Many of these goods appear on the dual‑use list or the national control list because they can be adapted for military or nuclear applications. For instance, high‑pressure pumps and subsea robotics may be subject to licensing if they could support the development of undersea weapon systems. Energy companies also face FDI screening when foreign investors seek to acquire stakes in critical infrastructure such as pipelines or power grids, particularly under the Security Act amendments and the proposed Investment Control Act.

4.2 Defence and security procurement

Norway’s defence procurement rules are governed by the Regulation on Defence and Security Procurement (FOSA) and the National Security Act. FOSA implements the EU Defence Procurement Directive and applies to defence materiel and services, whereas ordinary procurement rules cover civil goods. In highly sensitive cases, procurement may be exempted from ordinary rules under Article 123 of the EEA Agreement; this can occur when the goods are vital to national security. Defence procurement follows a formal process: a market study, needs assessment, and competitive bidding. The state may use negotiated procedures or competitive dialogue where appropriate, and there is a standstill period for complaints before contract award. Offset agreements may be required to ensure that foreign suppliers contribute to the Norwegian industrial base.

4.3 Defence‑adjacent technologies and emerging security concerns

The concept of “defence‑adjacent technology” has expanded beyond traditional arms to encompass AI, cyber‑security, quantum computing, space technology, robotics and advanced materials. Many of these technologies fall under dual‑use controls or the new List III. For example:

• Artificial intelligence and high‑performance computing – As the 19th sanctions package shows, AI services and computing can be restricted when supplied to Russian entities. AI models used for predictive maintenance, image recognition or logistics could be repurposed for battlefield intelligence. Exporters must assess whether providing software or cloud compute to a foreign customer requires a licence. In addition, EU guidelines on trusted AI emphasise transparency, risk assessment and human oversight, and Norway is likely to adopt similar principles.

• Semiconductors and quantum devices – Norway does not have a large semiconductor manufacturing base, but Norwegian research institutions collaborate on quantum technology and microelectronics. High‑value components and cryogenic systems may fall under List III or EU Annex IV. Exports to certain countries, including Russia and China, may require authorisation even for research equipment.

• Space‑based services – Norway has a growing satellite and ground‑station industry in the Arctic. The 19th sanctions package restricts the provision of commercial space‑based services to Russian entities, and export controls apply to satellite components and encryption technology.

• Cyber‑security and encryption – Strong encryption software and secure communications equipment can be subject to dual‑use controls. Companies developing penetration‑testing tools or encryption libraries need to check if their products appear on List II or III and ensure they do not provide services to sanctioned entities.

4.4 Sensitive raw materials and critical minerals

Critical raw materials such as rare earth elements, cobalt, and lithium are essential for defence and green‑energy technologies. Norway is exploring deep‑sea mining on its continental shelf; however, export of extracted minerals may be restricted if they could support military applications in sanctioned countries. The EU’s revised FDI regulation, which Norway intends to align with, lists critical raw materials as a focus area. Companies investing in Norwegian mining projects should therefore anticipate screening and potential export restrictions.

5. Public procurement sensitivity and security considerations

5.1 Procurement principles and sensitivity to security

Norway’s general public procurement law emphasises competition, equal treatment, transparency and proportionality. However, recent policy developments recognise that these principles must be balanced with national security and emergency preparedness. A government white paper (Meld. St. 9 (2024–2025)) notes that the Procurement Committee has proposed a legal provision allowing contracting authorities to set security or emergency preparedness requirements and obliging them to do so where relevant. The government plans to examine amendments to procurement regulations and to provide guidance identifying categories of procurements most vulnerable to security concerns. The committee suggests that procurement requirements can ensure local presence and supply preparedness—for example by splitting contracts into smaller lots, using local suppliers, or requiring shorter supply chains.

5.2 Defence and security procurement law

The Regulation on Defence and Security Procurement (FOSA) already allows exemptions from ordinary procurement rules for highly sensitive goods and services. Contracting authorities may bypass open tendering when disclosure would jeopardise national security or when the goods are covered by Article 123 of the EEA Agreement. However, authorities must still respect proportionality and equal treatment as far as possible and justify the use of negotiated or single‑source procedures.

5.3 Security and preparedness requirements in civilian procurement

The white paper emphasises that even civilian procurement should integrate security considerations. Authorities are encouraged to consider supply‑chain vulnerability, foreign ownership risks, cybersecurity and resilience. For instance, procuring IT systems, medical devices or energy infrastructure from suppliers linked to foreign adversaries could pose risks. Contracting authorities may require suppliers to have Norwegian facility security clearances or to commit to on‑shore data storage. They may also include sanctions compliance clauses mandating that suppliers screen sub‑contractors and supply chains for listed entities. The government is preparing guidelines to help authorities identify sensitive procurements and apply appropriate measures.

5.4 Intersection with the new Investment Control Act

If the proposed Investment Control Act introduces a sector‑based FDI regime covering critical technologies and infrastructure, it is likely to interact with procurement. For example, a foreign bidder for a public contract to supply AI‑enabled surveillance cameras might need an FDI approval if the contract involves sensitive infrastructure. Contracting authorities would need to coordinate with the investment screening authority to ensure that awarding the contract does not undermine national security. This could lengthen procurement timelines and require bidders to provide detailed ownership and supply‑chain information.

6. Screening and due diligence for companies

6.1 Constructing an effective screening programme

Businesses operating in Norway or trading with Norwegian partners should implement a screening programme that addresses the full spectrum of sanctions and export‑control risks. Key elements include:

1. Entity and individual screening – Check customers, suppliers, and owners against the EU, UN, US, UK and Norwegian sanctions lists. Because the 19th package significantly expanded the list of individuals and entities and introduced new definitions of ownership and control, screening tools should capture majority and minority ownership structures. Automated sanctions‑list monitoring helps detect updates.

2. Goods and technology classification – Identify whether products, software or technical data fall under List I, II or III. Many technologies (e.g., AI models, encryption software, advanced sensors) may be captured by the expanded List III. Companies should maintain a database of controlled items and regularly review updates to the lists.

3. End‑use and end‑user due diligence – Investigate how the buyer will use the product and whether there is a risk of diversion to a sanctioned or military end‑use. This is crucial under the catch‑all clause. End‑use statements should be mandatory for high‑risk sales.

4. Service provision controls – Evaluate whether the provision of services such as software updates, cloud hosting, AI training or technical assistance could be considered “technical assistance” subject to licensing. Under the 19th package, certain AI and high‑performance computing services are banned.

5. FDI screening – For investors, assess whether the target is designated or participates in security‑graded procurement. Even minority stakes may require notification under future amendments. Prepare documentation early and engage with Norwegian authorities to avoid delays.

6. Procurement compliance – When bidding for Norwegian public contracts, ensure that compliance with sanctions and export controls is integrated into proposals. This may include declarations of origin, proof of facility security clearance, supply‑chain transparency, and contingency plans for disruptions due to sanctions. Understanding Norway’s emerging guidance on security‑sensitive procurement will be essential.

6.2 Edge cases and grey areas

Several situations illustrate the challenges of compliance:

• Intangible technology exports – An AI researcher in Norway may collaborate with colleagues in an embargoed country via a cloud platform. Even if no physical goods are shipped, the sharing of code or training data could constitute a controlled technology transfer requiring a licence. Companies must embed export‑control checks into research agreements and digital platforms.

• Open‑source software contributions – Contributing to open‑source projects hosted on public repositories may inadvertently provide controlled encryption or AI technology to users in sanctioned jurisdictions. Developers should maintain a register of contributors and ensure that project access is consistent with export controls.

• Joint ventures and cross‑border R&D – When Norwegian firms establish joint ventures with foreign partners to develop energy technologies, quantum computing or robotics, they must assess whether the venture triggers FDI screening or export‑control licensing, especially if intangible know‑how flows from Norway to abroad. An equity stake below one‑third may still be caught under the future 10 % threshold.

• Mergers and acquisitions – Acquiring a European company with a Norwegian subsidiary operating in the energy sector could require parallel notifications: an EU FDI filing, a Norwegian Security Act filing, and possibly a licence for exporting dual‑use technology to the parent company’s home jurisdiction. Legal counsel should plan multi‑jurisdictional filings and coordinate timelines.

7. Implications for specific stakeholders

7.1 For Norwegian companies and subsidiaries of foreign groups

Norwegian companies should integrate export‑control compliance into their enterprise risk management frameworks. Subsidiaries of multinational firms must align group policies with Norwegian law and consider EEA‑specific requirements, such as List III. Training programmes for engineering, sales and procurement staff should emphasise the catch‑all clause and the latest sanctions measures. When exporting to high‑risk jurisdictions, companies should adopt “stop and check” procedures at key points in the sales cycle.

7.2 For foreign suppliers and technology firms

Foreign firms supplying technology, energy equipment or services to Norwegian customers must ensure they are not inadvertently triggering export‑control obligations in their home countries or in Norway. For example, a US company delivering high‑performance computing services to a Norwegian energy firm must consider US export controls, EU restrictions on providing HPC services to Russia, and Norway’s catch‑all licensing requirements. Clear contractual clauses about sanctions compliance, termination rights and force majeure events should be included.

7.3 For investors and private equity funds

Investment funds seeking to acquire or expand holdings in Norwegian companies should engage specialist counsel early to map regulatory touchpoints. Funds may face FDI screening for both initial acquisitions and follow‑on investments. They should structure transactions to avoid triggering thresholds where possible, but also plan for potential standstill obligations. In sensitive sectors, funds may need to accept conditions such as ring‑fencing data or appointing Norwegian security‑cleared directors.

7.4 For public authorities

Contracting authorities must balance efficiency, competition and security. The proposed legal provision requiring them to include security and emergency preparedness criteria means procurement teams will need training in risk assessment and supplier due diligence. Authorities should consult DEKSA on whether procurement of goods or services may be subject to export‑control restrictions and coordinate with investment‑screening bodies when awarding contracts involving foreign bidders. In defence and security procurements, authorities must justify any exemption from ordinary rules and maintain documentation to defend against complaints.

8. Future outlook and recommendations

8.1 Regulatory trends

Norway is expected to continue aligning with EU sanctions and export‑control updates. The trend towards comprehensive security policies will likely accelerate as Norway finalises the Investment Control Act and implements amendments to the Security Act. The EU’s focus on critical technologies—including AI, quantum computing, semiconductors, critical minerals and space—will drive Norway to expand its national control list further. Additionally, the EU’s new restrictions on AI and HPC services signal that export controls are shifting from purely goods‑based to service‑based restrictions. Companies must therefore broaden compliance to cover intangible services.

8.2 Actionable next steps for businesses

1. Audit your products and services – Conduct a comprehensive classification of products, software and services against Lists I–III and the EU dual‑use list. Engage engineers and product managers to identify items that might be dual‑use. Use the EU’s combined nomenclature and export control codes as guidance.

2. Enhance due diligence – Implement a multi‑jurisdictional screening tool to capture Norwegian, EU, US and UK sanctions. Include beneficial‑ownership mapping to capture indirect ownership or control, as required by the 19th sanctions package. Incorporate end‑use statements and rights to audit customers.

3. Establish internal controls – Set up export‑control compliance committees; train staff; create red‑flag escalation procedures; and integrate export‑control checks into procurement, sales, HR (for technology transfers by employees) and IT (for data transfers). Document all compliance steps for audit readiness.

4. Plan for FDI filings – Map potential investments against the current Security Act regime and anticipate the new Investment Control Act. Where deals involve critical technology or infrastructure, engage with Norwegian authorities early. Draft conditional closing clauses to allow for regulatory approval.

5. Engage with public procurement authorities – If bidding for public contracts, monitor the forthcoming guidance on security‑sensitive procurement. Offer to participate in pre‑procurement dialogues to help authorities shape realistic security requirements and demonstrate your own compliance programme.

6. Monitor regulatory updates – Track EU and Norwegian government announcements, DEKSA updates and law firm alerts. Join industry associations that provide briefings on export controls and sanctions. Consider subscribing to the EU’s Sanctions Map and the Norwegian government’s newsletter for immediate updates.

8.3 Recommendations for policymakers

1. Provide clear guidance on the new national control list – DEKSA should publish explanatory notes for List III, including case studies on how categories apply to specific products. This would help SMEs and research institutions comply without over‑ or under‑classifying goods.

2. Harmonise security and procurement regulations – The forthcoming Investment Control Act and amendments to the procurement regulations must be harmonised to avoid conflicting requirements. A one‑stop portal for FDI screening and procurement notifications could streamline compliance.

3. Support SMEs and research institutions – Smaller exporters and universities may lack the resources to navigate complex export controls. Government agencies should provide training and advisory services, perhaps through innovation Norway or research councils.

4. Ensure proportionality and openness – While security is paramount, Norway should avoid using security justifications to discriminate against foreign suppliers or to favour national champions. Transparent criteria and appeal mechanisms can maintain supplier confidence and international credibility.

Conclusion

Norway’s sanctions, export‑control and investment‑screening regimes have evolved rapidly in response to geopolitical events, technological advances and an increased focus on national security. The 19th EU sanctions package—implemented in Norway in March 2026—imposes strict restrictions on energy, finance, technology and shipping, highlighting the scale of sanctions compliance needed for global businesses. Norway’s export‑control framework, including the new List III, expands the range of goods and technologies requiring licensing. Simultaneously, pending amendments to the Security Act and the planned Investment Control Act signal a shift towards sector‑based FDI screening covering critical technologies and infrastructure. Public procurement is also being reshaped, with proposals to integrate security and emergency preparedness requirements into the awarding of contracts.

For businesses, compliance now requires cross‑functional cooperation, continuous monitoring, and agility. Understanding how sanctions, export controls, FDI rules and procurement policies intersect is essential to mitigate risk and seize opportunities in a rapidly changing environment. By implementing robust screening programmes, engaging with authorities early, and staying informed about forthcoming reforms, companies can navigate Norway’s regulatory landscape and contribute to sustainable, secure economic activity.