Norway AI Regulation Overview

Overview

Norway's regulatory approach to artificial intelligence is anchored in European Economic Area (EEA) alignment, high public sector trust, and strategic digital transformation policies. Starting with the National Strategy for Artificial Intelligence in 2020 and updated through the National Digitalisation Strategy 2024–2030 ("Fremtidens digitale Norge"), Norway has systematically prepared its legal and administrative structures for responsible AI deployment. The national strategy sets explicit goals, including targeting widespread public-sector AI adoption while ensuring safety and fundamental rights.

Norway is transitioning from soft-law national strategies and sectoral action plans toward formal statutory regulation. The primary legislative measure in progress is the proposed Artificial Intelligence Act ("KI-loven"), published for public consultation by the Ministry of Digitalisation and Public Governance on 30 June 2025. This draft law incorporates the EU AI Act into Norwegian domestic law through incorporation and complementary national provisions, establishing a legally binding, risk-based framework across sectors.

Regulatory Approach

Norway follows a hybrid regulatory model combining horizontal statutory rules with domain-specific sectoral oversight. The horizontal architecture adopts the EU risk-based approach: AI applications presenting unacceptable risks are prohibited, while high-risk AI systems (such as those used in healthcare, law enforcement, and critical infrastructure) are subject to stringent obligations covering technical documentation, data governance, human oversight, robustness, cybersecurity, and mandatory post-market monitoring. Limited-risk systems are subject to transparency requirements, and tailored provisions govern general-purpose AI and foundation models.

Prior to formal legislative implementation, Norway relied on strategic policy frameworks, agency guidelines, and experimental instruments. Cross-agency plans, such as the "Felles plan for kunstig intelligens" (2019/2020) and subsequent joint health sector plans (2024–2025), provided structured guidance for clinical and administrative deployment. Practical experimentation is facilitated through regulatory sandboxes, including Datatilsynet's permanent Sandbox for Responsible AI (launched in 2020) and the national sandbox hosted within "KI Norge" at the Norwegian Digitalisation Agency (Digdir).

Key AI Legislation

• Artificial Intelligence Act (KI-loven) (Draft / Bill 2026): Implements the EU AI Act into Norwegian domestic law by incorporation and complementary national provisions. Establishes risk-based classifications, prohibitions on unacceptable risk practices, detailed obligations for high-risk systems, transparency rules, and general-purpose model requirements.
• Government Decision on Nkom Designation (Decree 2024): Enacted on 21 March 2024, formally designating the Norwegian Communications Authority (Nkom) as the national coordinating supervisory authority for AI in Norway.
• The Digital Norway of the Future – National Digitalisation Strategy 2024–2030 (Policy 2024): Comprehensive policy setting targets for high-speed connectivity, public-sector AI uptake, cybersecurity resilience, and mandatory Altinn progress reporting for assigned agency measures.
• National Strategy for Artificial Intelligence (Policy 2020): Foundational policy framework outlining principles for trustworthy AI, privacy-by-design, language resource development, research funding, and regulatory sandboxes.
• Datatilsynet Regulatory Sandbox Guidelines (Guideline 2020): Operational guidelines establishing Datatilsynet's permanent advisory sandbox for privacy-friendly AI innovation and data protection compliance.
• Joint AI Plan for Health and Care Services 2024–2025 & Pre-project Plans (Policies 2019–2025): Sectoral coordination plans led by Helsedirektoratet setting out quality assurance, procurement, validation, and regulatory navigation for healthcare AI.
• One Digital Public Sector Strategy 2019–2025 (Policy 2019): Digitalisation policy defining shared national architectures, common solution platforms, and user-centric life events across state and municipal governance.

Governance & Enforcement Bodies

Norway's AI governance relies on a multi-agency model coordinated centrally by the Ministry of Digitalisation and Public Governance (Digitaliserings- og forvaltningsdepartementet). The primary market surveillance and coordinating body is the Norwegian Communications Authority (Nasjonal kommunikasjonsmyndighet - Nkom), designated in March 2024. Nkom serves as the national contact point toward European Union structures and coordinates market surveillance, inter-agency information sharing, and supervisory actions across domains.

Domain-specific market surveillance and oversight remain assigned to sectoral supervisors. The Norwegian Data Protection Authority (Datatilsynet) enforces data protection regulations, supervises AI operations processing personal data, and oversees law enforcement AI uses. The Norwegian Digitalisation Agency (Digdir) hosts "KI Norge", offering capacity building, guidance, and a national regulatory sandbox. Additional sectoral oversight bodies include Forbrukertilsynet, Helsedirektoratet, Statens legemiddelverk (Norwegian Medicines Agency), Statens helsetilsynet, and the Norwegian National Security Authority (NSM).

Penalties & Enforcement

Under the draft Artificial Intelligence Act (KI-loven), enforcement mechanisms focus on administrative sanctions rather than new criminal offences. Proposed statutory enforcement tools include administrative fines (overtredelsesgebyr) and coercive fines (tvangsmulkt). Market surveillance authorities will have powers to issue orders requiring non-compliant systems to cease operations or be modified, order the removal of non-compliant AI systems from the market, and publish official enforcement actions.

The consultation package for the draft KI-loven invites specific stakeholder input on enforcement design choices, including statute of limitations for penalty imposition, the calibration and use of coercive fines, and whether administrative fines (overtredelsesgebyr) should be applicable to public-sector bodies. In parallel, non-compliant AI deployment in specific domains remains subject to enforcement actions and fines under existing statutory regimes, such as the Personal Data Act and GDPR administered by Datatilsynet.

Data Protection Framework

Data protection governance in Norway is established under the Personal Data Act (personopplysningsloven), which incorporates the EU General Data Protection Regulation (GDPR) into national law. AI deployment involving personal data must maintain a valid lawful basis for processing, adhere to purpose limitation and data minimisation principles, conduct Data Protection Impact Assessments (DPIAs) for high-risk systems, and implement privacy-by-design into system architecture.

To assist public and private innovators with compliance, Datatilsynet established a Regulatory Sandbox for Responsible AI in late 2020, which was made permanent in 2023. The sandbox provides structured, dialogue-based guidance on lawful bases, explainability, synthetic data, and technical safeguards. Participation in the sandbox provides tailored regulatory advice but does not grant waivers from statutory obligations or limit Datatilsynet's underlying supervisory powers under data protection law.

Sector-Specific Rules

Sector-specific AI governance is most highly articulated within the health and care service sector. Led by Helsedirektoratet together with Statens legemiddelverk, Helsetilsynet, Folkehelseinstituttet, and regional health authorities, Norway has established coordinated health sector plans and quality assurance frameworks. These measures address the intersection between AI tools and medical device legislation (EU Medical Device Regulation / MDR), setting clear validation, procurement, lifecycle management, and post-market incident reporting standards for clinical decision support systems.

In public sector administration and digital infrastructure, the National Digitalisation Strategy 2024–2030 and the "One Digital Public Sector" strategy mandate specific governance and security standards. Public agencies deploying AI systems must integrate cybersecurity guidelines from NSM, maintain compliance with the Public Administration Act, adhere to accessibility rules, and participate in semi-annual progress reporting via Altinn managed by Digdir.

International Alignment

Norway's AI regulatory framework is directly aligned with European Union legislation through its obligations under the European Economic Area (EEA) agreement. The draft Artificial Intelligence Act (KI-loven) directly transposes the EU AI Act into domestic law via incorporation. This ensures harmonised single-market requirements across the EEA, uniform risk classifications, CE-marking conformity assessment routes, and adherence to EU-level harmonised technical standards.

Beyond direct EEA regulatory alignment, Norway incorporates international benchmarks from the OECD and Council of Europe into its national strategies. The National Strategy for AI explicitly adopts OECD principles for trustworthy AI—emphasizing human oversight, transparency, robustness, and fairness—and actively participates in Nordic and European standardisation formats to support cross-border regulatory interoperability and secure data sharing.

Future Developments

The key forthcoming milestone in Norway's AI regulatory landscape is the enactment and entry into force of the Artificial Intelligence Act (KI-loven). Following the consultation deadline on 30 September 2025, the government plans to finalize the statutory text to align entry into force with the EU timing target in summer/August 2026 for the main parts of the regulation.

In parallel with statutory implementation, Norway is expanding operational resources for regulatory agencies, including funding and staffing allocations for Nkom, Digdir, and Datatilsynet. Operational measures include expanding the "KI Norge" national sandbox environment at Digdir and monitoring progress toward the national strategic target of having 80% of public sector agencies utilizing AI by 2025, tracked via recurring Altinn reporting cycles each February and September.

Enforcement Bodies