Denmark - AI Guidelines and Risk Assessments (B 42)

Overview

Proposal B 42 (fremsat 8 November 2023) sought to require the Danish Government to immediately begin work to develop national guidelines, conduct risk assessments, and prepare a fairness-principles declaration for the development and use of artificial intelligence (AI) in Denmark. The proposal was presented by members of the Socialistisk Folkeparti and directed to the Ministery for Digitalisering (Ministeriet for Digitalisering og Ligestilling). It framed the request as an urgent, national-level measure to ensure responsible AI development and use while the EU AI Act was still being implemented, and it recommended sector-specific risk assessments with emphasis on public-sector case processing and impacts on citizens' rights. The proposal was referred to the Digitalisation & IT Committee and was ultimately rejected at 2nd reading on 2 May 2024. For the official parliamentary entry see B 42 - proposal (som fremsat) and the session overview at Folketingstidende overview (B 42). (ft.dk)

Definitions

For the purposes of the proposal: "Artificial Intelligence (AI)" refers to software systems and models that perform tasks that normally require human intelligence, including but not limited to machine learning models, statistical models and generative AI (e.g., large language models such as ChatGPT and Bard, referenced in the proposal). "Guidelines" are non-statutory or semi-statutory documents directing authorities and businesses in best practices; "risk assessments" denote formal analyses of likelihood and impact of AI uses, including privacy/data-protection impacts, algorithmic bias, discrimination, and effects on legal rights. "Fairness-principles declaration" refers to a codified statement of principles to steer design, procurement and deployment decisions. The proposal explicitly contemplated alignment with EU-level instruments (the EU AI Act) and with Danish data-protection and administrative law frameworks.

Governance and Institutional Framework

The proposal envisaged a cross-ministerial governance approach anchored in the Ministry responsible for digital affairs (referenced as Ministeriet for Digitalisering og Ligestilling) with operational roles for specialist authorities. Relevant bodies named in the parliamentary debate and surrounding materials included the Danish Data Protection Authority (Datatilsynet), the Danish Agency for Digitisation / Digitaliseringsstyrelsen (Digitaliseringsstyrelsen), and national cybersecurity authorities such as the Center for Cybersikkerhed (part of the Defence Intelligence Service). The proposal suggested that these agencies should contribute to or lead specific elements: Datatilsynet on data-protection risk templates and consequences analyses; Digitaliseringsstyrelsen on public-sector guidance for development and procurement; and the cybersecurity center on security risk assessments of model deployment. The proposal also recommended consultation with advisory and representative bodies (e.g., the Data Ethics Council—Datarådet—and children’s welfare advisory bodies such as Børnerådet where uses might affect minors). The parliamentary record reflects these institutional references and the expectation that national guidelines would be coordinated with EU-level obligations. (ft.dk)

Key Focus Areas

The resolution identified multiple risk vectors and priority areas for guidance and assessment. These included: (1) Public administration uses of AI that affect individual rights (decisions on benefits, permits, case prioritisation); (2) Generative AI applications (large language models) and their propensity to hallucinate, leak training data or reproduce bias; (3) Data protection and lawful basis for processing personal data in model development and operation; (4) Fairness, anti-discrimination and the introduction of a fairness-principles declaration to guide procurement and design; (5) Product liability considerations for AI systems sold or deployed in Denmark—proposers asked for analysis of whether the Product Liability Act should be updated to reflect AI-specific risk profiles; (6) Transparency expectations, documentation standards and the need for consistent risk assessment templates and consequence analyses; and (7) Security and resilience considerations for models and pipelines (model security, supply-chain resilience, and cybersecurity safeguards). Across these domains the proposal emphasised a precautionary approach pending EU harmonisation while seeking to avoid unnecessary duplication and to maximise alignment with forthcoming EU obligations. The resolution notes existing Danish guidance (e.g., Datatilsynet’s public-authority AI guidance and Digitaliseringsstyrelsen’s materials) and proposed national action primarily to accelerate adoption of good practices and to protect rights. (datatilsynet.dk)

Implementation Framework

The proposers sought a pragmatic implementation pathway: immediate production of high-level guidelines for authorities and companies; publication of standardised templates for risk assessments/consequence analyses; targeted sectoral risk studies for known or prevalent AI uses in the public sector; and a legal review examining whether product liability and administrative law should be amended to codify fairness and accountability duties. The parliamentary materials anticipate that Datatilsynet would provide a template for data-protection consequence analyses and that Digitaliseringsstyrelsen would coordinate guidance for procurement and design in the public sector. The proposal did not itself create binding statutory obligations but requested that the Government prepare concrete steps and legislative proposals where required. The committee record shows debate about the appropriate balance between national measures and reliance on the EU AI Act, reflecting differing political views on timing and regulatory burden for Danish actors. (ft.dk)

Monitoring and Evaluation

The resolution called for publication of the results of risk assessments and for periodic review of guidelines to reflect technological evolution and EU developments. Suggested monitoring measures included publicly available registries of high-risk public-sector AI uses, regular reporting by ministries on AI deployments affecting citizens’ rights, and coordination mechanisms for sharing lessons across agencies. The parliamentary debates and committee materials indicate that proponents expected regulatory agencies (notably Datatilsynet) to play a key evaluative role and to update templates and guidance as experience accumulated, while opponents urged caution to prevent unduly burdensome obligations for smaller actors. The resolution set no specific statutory monitoring mechanism but rather requested immediate Government action to set out processes and accountability lines. (ft.dk)

Penalties, Liability, and Appeals

The proposal requested a legal review of product liability and administrative law to determine whether statutory reforms were required to hold AI providers and deploying authorities accountable for harms—particularly where AI-driven decisions affect legal rights. It asked that the Government consider incorporating fairness principles into product liability and forvaltningsloven (the Public Administration Act) to enable redress and judicial review in AI-affected decisions. The proposal did not itself specify penalty regimes; rather it asked the Government to propose legislative options, including liability frameworks and appeal routes for affected individuals. Parliamentary debate highlighted trade-offs between enforceable liability rules and innovation incentives. (ft.dk)

Relationship to Other Instruments

Proposal B 42 explicitly linked to existing national guidance (Datatilsynet’s guidance for public authorities and Digitaliseringsstyrelsen’s materials) and to the developing EU AI Act (referred to in debates as the primary future harmonising instrument). The resolution asked the Government to act now to fill gaps pending full AI Act application and to ensure national guidelines would be compatible with the EU framework once implemented. It also called for alignment with GDPR/data-protection obligations and existing administrative-law safeguards. The parliamentary record shows attention to avoiding fragmentation and the desire among some speakers for national action that complements EU requirements rather than contradicts them. (datatilsynet.dk)

International Alignment

The proposers recognised that the EU AI Act would set binding standards across member states and that national guidelines should seek close alignment. The motion emphasised coordination with EU-level instruments to avoid divergence and to provide clarity for Danish exporters and operators. Parliamentary interventions referenced international workstreams (EDPB guidance on AI and national contributions) and the need for Denmark to coordinate technical templates and risk categorizations with EU-level guidance to ensure interoperability and legal certainty for cross-border services. The proposal therefore called for active liaison with EU bodies and for national guidance to reference the AI Act classification and obligations. (datatilsynet.dk)

Implementation Timeline

Sources and References