Denmark - AI Regulation Supplement (Law No. 467/2025)

Overview

The Act on Supplementary Provisions to the Regulation on Artificial Intelligence (Lov om supplerende bestemmelser til forordningen om kunstig intelligens), adopted by the Folketing and published as Law No. 467 of 14 May 2025, is a targeted national law implementing the organisational, procedural and enforcement elements that the EU AI Regulation (EU 2024/1689) requires Member States to provide. It does not recreate the EU rules on substantive AI governance (those rules are directly applicable) but establishes how Denmark will operate the market surveillance, designation of national competent authorities and enforcement mechanisms required by the Regulation. Key outcomes of the Act include the designation of the Digitaliseringsstyrelsen as the authorising authority and central contact point and the appointment of Digitaliseringsstyrelsen, Datatilsynet and Domstolsstyrelsen as national market surveillance authorities with specified remits and powers to inspect, demand information, issue remedial orders and impose temporary bans on AI systems. For the official parliamentary file see Folketinget — L 154 and the official law text at Retsinformation.

Definitions

Terms used in the Act generally mirror definitions in the EU AI Regulation. 'Market surveillance authorities' refers to the national agencies charged with monitoring compliance and enforcing the Regulation; 'authorising authority' refers to the national body with specific procedural tasks under the Regulation; 'AI-system' and categories such as 'prohibited practices' and 'high‑risk systems' have the meanings provided in Regulation (EU) 2024/1689. The Act also refers to the persons and entities listed in Article 2(1) of the EU Regulation (providers, deployers, importers, distributors and authorised representatives), and clarifies that national powers may be exercised against those subject to Article 2(1) within Denmark.

Governance and Institutional Framework

The Act designates Digitaliseringsstyrelsen (the Danish Agency for Digital Government) as the authorising authority and central contact point for Denmark under the EU AI Regulation; it also assigns to Digitaliseringsstyrelsen, Datatilsynet and Domstolsstyrelsen distinct market surveillance responsibilities. Digitaliseringsstyrelsen’s role as central contact point includes acting as Denmark’s official interlocutor with the European Commission and other Member States on AI Regulation matters and coordinating national enforcement where multiple authorities are involved. The law provides for functional independence of the market surveillance authorities in the exercise of their statutory duties and allows cooperation with other sectoral regulators (e.g., financial supervisory authorities) where the EU Regulation anticipates sectoral allocation. For announcements and role descriptions see Digitaliseringsstyrelsen news and Datatilsynet designation">Datatilsynet press release.

Key Focus Areas

The Act focuses on several practical areas to operationalise the EU rules: (1) market surveillance powers — including the ability to request information, access business premises without prior judicial authorization in specified cases, and perform on‑site technical examinations; (2) enforcement tools — authority to issue corrective orders, require recalls or withdrawals, impose temporary prohibitions and publish enforcement decisions; (3) cooperation — mechanisms for national cooperation among the designated authorities and for cross‑border coordination with the European Commission and other Member States; (4) procedural safeguards — specified appeal routes and timelines for contesting enforcement decisions, and provisions covering assistance to authorities (including the police) where necessary to execute inspections; (5) reporting and public transparency — powers to publish rulings and to require notifications where a risk is identified. The Act also establishes the administrative basis for imposing bødeforelæg (administrative fines settled without court proceedings) in certain cases and foresees coordination with the Ministry of Justice on criminal enforcement where the EU Regulation contemplates national criminal sanctions. The law is designed to cover prohibited AI practices listed in Article 5 of the EU Regulation and to be ready to support national enforcement when other parts of the EU Regulation (such as high‑risk system oversight and conformity requirements) enter into force.

Implementation Framework

Implementation is staged to align with the EU Regulation’s phased entry into force. The law requires Denmark to notify the Commission of the designated market surveillance authorities by the deadline set in the EU Regulation. The Act confers powers on the authorities to adopt secondary rules and guidance, to designate independent experts for technical examinations, and to request cooperation from other Danish agencies. The Act also contains territorial provisions — explicitly excluding the Faroe Islands and Greenland from application. Practical measures anticipated under the Act include national guidance for businesses on cooperation with market surveillance, templates for information requests, and internal protocols to ensure that inspections and technical reviews comply with due process and data protection constraints. The official law text is available at Retsinformation.

Monitoring and Evaluation

The Act foresees monitoring of enforcement activity by the designated authorities and requires Denmark to maintain channels for reporting and coordination with the Commission and other Member States. Market surveillance authorities must document inspections and enforcement actions; they are permitted to publish decisions and outcomes in the public interest. The Act also contemplates periodic review of the national rules and allows for the Digitaliseringsministeren to propose revisions, including to reporting and sanction provisions. Early operational reports from Datatilsynet and Digitaliseringsstyrelsen — including designation notices and implementation updates — have been published following the law’s entry into force on 2 August 2025. See Datatilsynet’s announcement at Datatilsynet press release.

Penalties, Liability, and Appeals

The Act provides the national legal basis for administrative enforcement measures including injunctions, temporary bans, product recalls, and bødeforelæg (administrative fine settlements). It also contemplates that in serious or repeated cases criminal sanctions under national law may be applicable where the EU Regulation permits such measures. The Act sets out procedural rules for appeal of administrative decisions relating to courts’ use of AI and provides for judicial remedies consistent with Danish administrative and procedural law. Bødeforelæg provisions allow cases to be resolved without full court proceedings when the accused admits liability and accepts the fine; national rules on the content of indictment and the right to silence apply mutatis mutandis to such procedures. The law enshrines rights to appeal and judicial review within the Danish court system for parties affected by market surveillance decisions.

Relationship to Other Instruments

The Act explicitly supplements Regulation (EU) 2024/1689 (the EU AI Regulation) and operates alongside existing Danish and EU instruments such as the General Data Protection Regulation (GDPR), national data protection law, consumer protection legislation and sectoral regulations (e.g., banking, health, transport). It does not replace sectoral supervision where existing regulators have designated competences; rather, the Act permits coordination and delegation consistent with the EU Regulation’s sectoral approach. The law also references existing rules on whistleblower protections and cooperation with criminal law enforcement authorities when necessary for investigations. The primary legislative file and related materials are on the Folketinget website: Folketinget — L 154.

International Alignment

The Act is explicitly designed to align Denmark’s national enforcement framework with the EU AI Regulation and to facilitate cross‑border cooperation with other Member States and the Commission. Designation of a central contact point mirrors the Commission’s requirements for Member States, enabling Denmark to participate in the AI Board and other EU coordination mechanisms. The Act also takes account of international obligations under data protection treaties and EU acquis. Its structure and the powers conferred on market surveillance authorities are consistent with the enforcement architecture that the EU Regulation establishes for coordinated, cross‑border oversight of AI systems.

Implementation Timeline

Sources and References

Primary sources for this entry include the official Folketinget bill pages (L 154), the official law text published in Retsinformation (LOV nr. 467 af 14. maj 2025), and public announcements by Datatilsynet and Digitaliseringsstyrelsen regarding the designation of supervisory authorities and the scope of their responsibilities under the Act.