Denmark - Independent AI Supervisory Authority (B 90)

Overview

Decision proposal B 90 (fremsat 1 December 2023) seeks to require the Danish government to table legislation establishing an independent supervisory body for artificial intelligence housed within the national Data Protection Authority (Datatilsynet) and to transfer Datatilsynet's institutional accountability from the Ministry of Justice to the Folketing (Parliament). The measure was motivated by a view that the rapid adoption of generative and other AI systems creates oversight needs that exceed existing capacities and that placing Datatilsynet under Parliament will increase its political and operational independence. The Folketinget dossier for B 90 (including the original proposal text and background materials) is available on the Folketing website; see Folketinget: B 90 (som fremsat). The proposal was debated in the chamber on 22 May 2024 and is recorded as having concluded with a second-reading status of 'Forkastet' (rejected), but it has informed subsequent policy discussion and administrative preparedness regarding national AI oversight.

Definitions

Key terms used or implied by the proposal include: "AI supervisory authority" (a dedicated organisational unit with investigative, enforcement and guidance powers over AI systems); "Datatilsynet" (the Danish Data Protection Authority, currently the lead national regulator for personal data protection); "placement under Folketinget" (institutional transfer from the Ministry to the national parliament to secure independence); "high-risk AI" (systems with significant effects on fundamental rights, safety or lawful processing, as defined by EU-level instruments such as the proposed AI Act); "FRIA" (Fundamental Rights Impact Assessment, a concept referenced in AI regulation debate that parallels GDPR's DPIA); and "public sector AI" (AI systems developed, procured or used by state entities). The proposal references existing documents and concepts such as Datatilsynet's national guidance (Datatilsynet, Oct 5, 2023).

Governance and Institutional Framework

The B 90 proposal describes a twofold institutional change: creation of an "uafhængigt tilsyn med kunstig intelligens" (independent AI supervisory authority) embedded within Datatilsynet and relocation of Datatilsynet's formal supervisory relationship from the Minister of Justice to the Folketing to enhance its independence. Embedding the AI supervisory function within Datatilsynet was justified on grounds of continuity (Datatilsynet's expertise in data protection and prior mapping and guidance activity), operational synergy (harmonising oversight where GDPR and AI rules intersect) and efficiency in resource use. The proposal also envisages specific powers for the new supervisory unit: rule-making or guidance issuance, risk-based inspections, handling of complaints and incident reports, cooperation with EU bodies and capacity to issue corrective measures. The Folketing background material that accompanies B 90 references both domestic administrative reports and the EU-level AI-forordningen deliberations, emphasising the need for a regulator that can address cross-cutting data protection and rights-related risks; see Folketinget: B 90 background.

Key Focus Areas

The proposal identifies the following priorities for the proposed supervisory authority: (1) ensuring compliance with data protection rules in AI deployments, particularly by public authorities; (2) providing proactive guidance and templates for impact assessments and governance (e.g., FRIA/DPIA templates); (3) performing market surveillance and investigations into AI suppliers and deployments that affect fundamental rights; (4) coordinating national implementation with the EU AI Act and related European supervisory networks; (5) offering outreach, capacity building and public reporting to increase transparency and trust; (6) maintaining rapid-response capabilities for incidents or breaches involving AI; and (7) evaluating systemic risks such as algorithmic discrimination, mass surveillance potential and threats to democratic processes. The proposal emphasises a rights-centred approach, combining technical oversight (model testing, auditing support) with legal review (lawful basis, data minimisation) to ensure AI systems operate lawfully and responsibly.

Implementation Framework

B 90 sets out a high-level implementation view rather than prescriptive legislative text. Implementation elements envisaged include: legislative authorisation to create an AI supervisory structure within Datatilsynet; transfer and reclassification of Datatilsynet's reporting line to Folketinget; appropriation of initial and recurrent funding (proposal estimates ~DKK 15 million/year); recruitment of technical, legal and investigatory capacity; development of technical testing capabilities or partnerships for independent model assessment; regulatory guidance and templates for FRIA/DPIA; formal cooperation mechanisms with other national regulators (e.g., Digitaliseringsstyrelsen) and EU bodies; and staged roll-out of powers (guidance and monitoring first, then formal enforcement authorities contingent on statutory grant). The proposal stresses that appropriate resources must accompany expanded mandates to ensure effective oversight.

Monitoring and Evaluation

The proposed supervisory authority would be expected to establish monitoring and evaluation practices, including regular public reporting, transparency dashboards on enforcement actions, a schedule for supervisory priorities, and metrics for case resolution, complaint volumes and systemic risk indicators. The authority should publish annual activity reports and undertake periodic independent evaluations of its effectiveness and independence. Coordination with EU-level monitoring (once the EU AI Act is in force) and participation in supervisory fora are also proposed to ensure harmonised enforcement and learning across jurisdictions.

Penalties, Liability, and Appeals

While B 90 is a decision proposal rather than a fully worked legislative text, it contemplates that the AI supervisory authority would be endowed with enforcement tools consistent with existing administrative law and harmonised with GDPR enforcement where relevant. Tools would include administrative orders, corrective measures, public admonitions, and referral powers for criminal prosecution where applicable. The proposal also presumes the authority will work within Denmark's administrative appeals framework, allowing regulated parties to seek judicial review or administrative appeals of decisions. Funding for robust enforcement capacity is emphasised as critical.

Relationship to Other Instruments

The proposal explicitly locates the new supervisory function within the broader legal ecosystem: it aims to operate in tandem with GDPR enforcement (Datatilsynet's current remit) and to align with the EU AI Act (AI-forordningen) when adopted. The Folketing background package cites both the AI-forordningen and the GDPR (Regulation (EU) 2016/679) as relevant instruments and notes that having Datatilsynet as the national hub can reduce fragmentation where data protection and AI-specific requirements overlap. The proposal references prior parliamentary debates and related decision proposals (e.g., B 42, B 136, B 149) that address algorithmic transparency and data ethics.

International Alignment

B 90 positions Denmark's proposed approach to AI oversight as compatible with EU-level harmonisation and cooperation. The proposal notes the importance of coordinating with the EU's supervisory architecture created by the AI Act (where national competent authorities will have defined roles) and with other member-state regulators to ensure consistent enforcement, cross-border investigations, and shared technical methodologies for model testing and risk assessment. The proposal also stresses that an independent, parliamentary-anchored regulator would enhance Denmark's ability to participate credibly in transnational supervisory networks and ensure domestic policy coherence with EU obligations.

Implementation Timeline

Sources and References