AI regulation in Iceland (2026)

The Icelandic government published an AI Action Plan covering 2025–2027 with 20 funded measures spanning society, competitiveness, education, public administration, and healthcare. It is a policy strategy, not binding legislation, and is subject to six-monthly reviews.

Iceland has not enacted dedicated AI legislation. Regulation of AI systems is addressed through existing horizontal laws—principally data protection law (Act No. 90/2018, implementing the GDPR) and sector-specific rules—rather than a bespoke AI statute.

The EU AI Act (Regulation 2024/1689, in force 1 August 2024) is listed in the EFTA EEA-Lex tracker but has not been formally incorporated into the EEA Agreement by Joint Committee decision as of May 2026. Iceland participates as an observer in EU AI Board meetings. Full application requires an EEA Joint Committee decision, which may also entail Icelandic parliamentary steps.

Iceland's Data Protection Authority (Persónuvernd) is the principal enforcement body touching AI, supervising compliance with Act No. 90/2018 / GDPR on automated decision-making, data minimisation, and transparency. Its 2025 annual priorities included an explicit focus on AI governance and cybersecurity.

The Government of Iceland's broader information technology and digital policy portfolio, managed by the Ministry of Culture, Innovation and Higher Education, provides the umbrella under which the AI Action Plan sits alongside other digital-transformation and data strategies.

Iceland has aligned its AI strategy with the OECD AI Principles, emphasising trustworthy, human-centric AI. Iceland's initiatives are catalogued on the OECD.AI national dashboards, reflecting its commitment to international voluntary norms absent domestic binding rules.