Artificial Intelligence - Norway

The Ministry of Digitalisation and Public Governance circulated a consultation on 30 June 2025 for a new Norwegian AI Act implementing EU Regulation 2024/1689. It adopts the EU's risk-based approach (bans on unacceptable-risk systems, strict obligations for high-risk systems, transparency for limited-risk). The consultation closed 30 September 2025 and the law is targeted to enter into force in 2026.

As of mid-2026 the AI Act remains a proposal undergoing the legislative process; the EU AI Act has not yet been formally incorporated into the EEA Agreement, so its provisions are not yet binding in Norway. Entry into force is planned for summer/late 2026, in step with the EU to preserve EEA market alignment.

The proposal designates the Norwegian Communications Authority (Nkom) as the national coordinating market-surveillance authority and EU contact point, with sectoral regulators supervising domain-specific high-risk systems and the Data Protection Authority (Datatilsynet) competent for certain uses such as law-enforcement applications.

Norway's binding-rules gap is currently filled by the National Strategy for Artificial Intelligence (2020), a non-binding policy document built on ethical principles, privacy/data protection and cyber security, prioritising AI in health, oceans, public administration, energy and mobility.

The government is establishing 'KI-Norge', a national arena hosted by the Digitalisation Agency (Digdir) to provide guidance, capacity-building and a regulatory sandbox for controlled testing. Datatilsynet separately runs an AI regulatory sandbox focused on data-protection-compliant AI development.

Pending the AI Act, AI use is constrained by generally applicable frameworks — notably the GDPR/Personal Data Act enforced by Datatilsynet — and sector rules, rather than a dedicated horizontal AI statute.