Status in the EU
The EU regulation on artificial intelligence was adopted in 2024, and the requirements are being phased in through August 2028. The rules classify AI systems by risk, with the strictest requirements for high-risk systems. In 2026, the EU also adopted some simplifications to the rules.
Status in Norway
The regulation does not apply automatically in Norway; it must first be incorporated into the EEA Agreement and implemented in Norwegian law. The Norwegian government has announced that an updated proposal for a Norwegian AI act (KI-loven) will go out for public consultation in fall 2026, with the goal of presenting the bill to the Norwegian parliament (Stortinget) in spring 2027. The Norwegian Communications Authority (Nkom) has been designated as the supervisory authority.
What already applies?
Even without an AI act, data protection law applies in full when AI processes personal data. Businesses that use AI on customer or employee data must already have their legal basis for processing, transparency, and security in order.
What we recommend
- Take inventory of the AI tools in use
- Assess whether any of that use could qualify as high-risk
- Make sure AI use involving personal data complies with GDPR
- Follow the consultation on the Norwegian AI act
How we can help
Wondering what this means for your organization? Let's talk.
Request a meeting →