Norway - AI in Health Services

Overview

The report "Status og forslag til videre arbeid med kunstig intelligens (KI) i helse- og omsorgstjenesten" (published 26 October 2023) describes the current landscape for AI use in Norway's health and care sector and sets out recommended priorities for national coordination. Led by the Norwegian Directorate of Health in collaboration with Direktoratet for e-helse, Statens legemiddelverk, regional health authorities, KS, Helsetilsynet and the Norwegian Institute of Public Health, the coordination project catalogues active AI projects (radiology, pathology, language models, decision support, administrative automation), regional pilots and identified capability gaps. The report functions as a strategic framework: it does not itself change primary law, but it proposes concrete regulatory and governance actions, quality-assurance work and capacity building to enable safe, compliant scaling of AI. The official report is available from the Directorate of Health: Status og forslag til videre arbeid med kunstig intelligens (KI) i helse- og omsorgstjenesten.

Definitions

For the purposes of the report, "artificial intelligence" (KI) covers software systems using machine learning, statistical or rule-based methods to analyse data, provide predictions, classifications, recommendations or automate tasks. The report distinguishes between: (1) CE-marked medical device AI (subject to Medical Device Regulation requirements where applicable); (2) administrative or operational AI (e.g., scheduling, logistics); (3) research and development models (used in controlled studies); and (4) large language models and general-purpose AI systems. Emphasis is placed on the distinction between AI as a medical device (clinical impact, high regulatory risk) and AI used for non-clinical/administrative functions (lower regulatory risk but still subject to data protection and governance obligations).

Governance and Institutional Framework

The report documents an inter-agency governance approach. The Directorate of Health acted as project lead, with close cooperation from Direktoratet for e-helse, Statens legemiddelverk, Helsetilsynet, regional health trusts (RHFene) and KS. It recommends clearer role allocation: national regulatory guidance on how existing laws apply to AI (e.g., medical device rules, the Personal Data Act/GDPR, health personnel responsibilities), sector-level coordination bodies (e.g., a KI-council or KI-råd), and a portfolio approach for national services such as national data infrastructure and validation services. The report also recommends cross-sector information hubs and procurement support to reduce fragmentation, and to create a single access point for guidance (to be carried forward in the subsequent "Felles KI-plan"). It highlights the need for escalation paths where patient safety concerns arise and clarifies that enforcement and statutory sanctions remain with the relevant statutory agencies (Helsetilsynet, Statens legemiddelverk, Datatilsynet).

Key Focus Areas

The report sets out priority thematic areas: (1) regulatory clarity and alignment – guidance on how to apply existing medical device and data protection law to AI, (2) quality assurance and clinical validation – standardized approaches for procurement, local testing and clinical validation before production use, (3) procurement and market access – supporting buyers with common requirements and evaluation criteria to improve comparability and safety, (4) data governance and secure infrastructure – enabling lawful, privacy-preserving data access for model development and validation, including federated approaches and synthetic data where appropriate, (5) model lifecycle management and monitoring – processes for versioning, re‑validation and change control, (6) competence and training – for clinicians, procurement teams and IT staff, (7) transparency and documentation – mandatory documentation templates, risk assessments and user information, and (8) incident reporting and post-market surveillance – building mechanisms for detection and response to safety incidents. Across these areas the report emphasises a proportionate approach calibrated to the risk posed by the AI application, and the need to protect fundamental rights while enabling useful innovation.

Implementation Framework

The report recommends a pragmatic, stepped implementation framework. Immediate actions include publishing guidance on current regulatory requirements and preparing procurement templates and a common QA framework. Medium-term actions (2024–2025) focus on building shared services (guidance portal, common evaluation criteria, regional KI-infrastructure pilots), developing training offers and piloting certification/assessment workflows for CE-marked and high-impact tools. Longer-term work includes strengthening national post-market monitoring, exploring standardized clinical evaluation methodologies and aligning Norwegian practice with evolving EU-level rules (including anticipated EU AI Act considerations). The report recommends that responsibility for concrete deliverables be assigned through ordinary agency prioritisation processes; subsequent planning was captured in the "Felles KI-plan for 2024–2025" where timelines and responsible actors were made explicit (Felles KI-plan 2024–2025).

Monitoring and Evaluation

Monitoring is twofold: (a) sectoral monitoring of implementation (progress on recommended measures, uptake of guidance, development of common services) led by the Directorate of Health and Direktoratet for e‑helse; and (b) technical and clinical monitoring of deployed systems (performance, bias, safety incidents). The report recommends establishment of KPIs for adoption and risk-handling, periodic reporting to a central coordination forum and a mechanism to capture lessons from pilot projects. It also highlights the need for post‑market surveillance aligned with medical device reporting obligations and recommends that national registries and health data resources be used to support long-term evaluation where lawful and appropriate.

Penalties, Liability, and Appeals

The status report itself does not create new penalties but anchors enforcement in existing statutory regimes. It emphasises that liability and sanctions for unsafe AI deployments fall under the applicable laws: medical device rules (CE marking and market surveillance enforced via Statens legemiddelverk and its delegated bodies), patient safety and health personnel duties enforced via Helsetilsynet, and data protection obligations enforced by the Norwegian Data Protection Authority (Datatilsynet). The report recommends clear guidance on responsibilities for vendors, procurers and providers, standard incident reporting and appeals procedures consistent with existing administrative law and regulatory processes.

Relationship to Other Instruments

The report situates Norway's sectoral approach in existing legal instruments: the EU Medical Device Regulation (MDR) and In Vitro Diagnostic Regulation (IVDR) as applied to CE-marked AI medical devices; GDPR / Norway's Personal Data Act for processing of personal health data; patient safety legislation and the Health Personnel Act for clinical responsibility; and procurement law for purchases. It also references international guidance and good practice (e.g., NHS buyer's guides, EU documents). The report recommends that national guidance clarify how these instruments interact in practice for different AI use cases and that national agencies coordinate to prevent regulatory gaps or overlaps.

International Alignment

The report underlines the importance of aligning with European and Nordic practice and EU regulatory developments, including the emerging EU AI Act and ongoing clarifications of medical-device requirements for software. It recommends active participation in EU and Nordic fora, sharing of best practices and interoperability approaches, and harmonising documentation and evaluation approaches to facilitate cross-border procurement and vendor compliance. The Directorate flagged that many Norwegian deployments rely on vendor products from international suppliers, making international alignment essential for legal certainty and market access.

Implementation Timeline

Sources and References