Skip to main content

    AI by country · Northern Europe

    AI in Iceland: the rules, the readiness and where to start

    Last checked: 29 October 2026

    What should a company in Iceland know before starting with AI?

    Iceland is in the EEA, not the EU. The GDPR applies through Act No. 90/2018 on Data Protection and the Processing of Personal Data, supervised by Persónuvernd. The EU AI Act was still under scrutiny for incorporation into the EEA Agreement on 29 October 2026, so it does not yet bind Icelandic companies at home, but it does apply to anything they sell into the EU.

    At a glance

    Iceland at a glance

    Key facts about Iceland
    Data protection lawGDPR, applied through Act No. 90/2018, in force since 15 July 2018
    RegulatorPersónuvernd (Data Protection Authority)
    AI policyIceland's Strategy on AI (2021) and AI Action Plan 2025 to 2027. EU AI Act not yet incorporated into the EEA Agreement as of 29 October 2026
    Time zoneGMT, UTC+0 all year, no summer time (India is 5.5 hours ahead)
    CurrencyISK (Icelandic króna)
    Business languageIcelandic, with English widely used in business

    Why now

    Why Iceland is worth watching

    Each point links to the document it comes from.

    • The government published Iceland's AI Action Plan 2025 to 2027 on 1 July 2025. It supports a clear legal framework for AI and aims to raise productivity and develop digital health services.[5]

    • The plan builds on Iceland's Strategy on Artificial Intelligence of 2021 and on a November 2024 report by the ministry and Statistics Iceland on the economic opportunities of AI.[5]

    • The EFTA Secretariat lists the EU AI Act as under scrutiny for incorporation into the EEA Agreement by Iceland, Liechtenstein and Norway.[3]

    • Persónuvernd publishes guidance on AI covering chatbots, AI agents and AI note takers, and says personal data can be involved at every stage from model development to use.[4]

    The rules

    The rules that matter for AI

    What each law or policy means when you build or buy an AI system.

    General Data Protection Regulation (EU) 2016/679, via the EEA Agreement

    In force2018The GDPR was added to the EEA Agreement by Joint Committee Decision 154/2018, in force in the EEA from 20 July 2018. People have a right not to be subject to a decision based solely on automated processing with legal or similarly significant effects (Article 22). High-risk processing needs an impact assessment (Article 35), and breaches must be reported within 72 hours where feasible (Article 33).[1]

    Act No. 90/2018 on Data Protection and the Processing of Personal Data

    In force2018In force since 15 July 2018. A child must be at least 13 to consent to online services. Persónuvernd can set daily fines of up to ISK 200,000 when its orders are ignored (Article 45), and administrative fines of up to ISK 2.4 billion or 4% of worldwide turnover for the most serious breaches (Article 46).[2]

    EU Artificial Intelligence Act, Regulation (EU) 2024/1689, in Iceland

    Passed, not yet in force2024Adopted by the EU, but not yet incorporated into the EEA Agreement or made Icelandic law as of 29 October 2026. We found no Icelandic bill to implement it. Companies selling AI systems or outputs into the EU must already follow it there.[3]

    Where AI fits first

    Where AI fits first

    Public services

    Chatbots that answer common questions and draft replies, with staff checking answers.

    Persónuvernd's AI guidance covers chatbots and AI note takers, including what personal data they collect.[4]

    Health care

    Drafting clinical notes and summarising records, with clinicians deciding.

    The AI Action Plan aims to develop digital health services. Health data is sensitive under the GDPR and needs a specific legal basis.[5]

    Fisheries and seafood

    Catch and quality data analysis and forecasting for processing plants.

    We found no Icelandic AI rule specific to this sector. The GDPR applies where staff or customer data is used.[2]

    Tourism

    Booking support and multilingual customer service.

    Chatbots that talk to the public would need to say they are AI once the AI Act transparency rules apply in Iceland. They already apply in the EU from 2 August 2026.[6]

    Your first steps

    Your first steps

    1. List the AI tools your company uses or builds, and note which ones use personal data.
    2. Read Persónuvernd's AI guidance before using chatbots, agents or AI note takers with customer or staff data.
    3. Run a data protection impact assessment for AI that profiles people or makes significant decisions, and keep a person reviewing those decisions.
    4. If you sell into the EU, check your AI against the AI Act now, since most of it applies there from 2 August 2026.
    5. Prepare to report personal data breaches to Persónuvernd within 72 hours.
    6. Use a GDPR transfer mechanism before personal data leaves the EEA for a country without an adequacy decision.

    AI services for Iceland

    AI consulting and development for teams in Iceland

    We work remotely with companies in Iceland, in your time zone, and keep your data under the rules described above.

    AI agents and automation

    Agents that finish multi-step work across your tools, with people approving what matters.
    Learn more

    Document Q&A (RAG)

    Answers from your own documents, with the source shown for every answer.
    Learn more

    AI governance and data protection

    Policies, review steps and audit trails that fit your local data law.
    Learn more

    Software and cloud engineering

    Web apps, integrations and cloud platforms built around your AI use case.
    Learn more

    How we work with you

    How we work with you

    We work remotely with clients worldwide, in the client's time zone. Iceland is on UTC+0 all year and India on UTC+5:30, a 5.5 hour gap. Taking a 9:00 to 17:00 day in Iceland and 9:30 to 18:30 in India, the overlap is about 4 hours, from 09:00 to 13:00 Icelandic time, all year. India has no adequacy decision, so any personal data we handle needs a GDPR transfer mechanism such as standard contractual clauses.

    Questions

    Common questions about AI in Iceland

    Does the EU AI Act apply in Iceland?

    Not yet at home. Iceland must first add it to the EEA Agreement and pass a national law. As of 29 October 2026 the EFTA Secretariat lists it as under scrutiny, and we found no Icelandic bill. If you sell into the EU, the Act already applies to that business.

    Does the GDPR apply in Iceland?

    Yes. Act No. 90/2018 applies it in Iceland and has been in force since 15 July 2018. Persónuvernd supervises it and can impose administrative fines.

    Can we use an AI note taker in meetings?

    Persónuvernd treats AI note takers as a data protection topic. Tell participants, check what the tool stores and where, and have a legal basis for recording.

    What is Iceland's AI policy?

    The AI Action Plan 2025 to 2027, published on 1 July 2025, builds on the 2021 Strategy on Artificial Intelligence. It supports a clear legal framework, productivity in government and digital health services.

    Complimentary tools

    Try these first

    Three complimentary tools from our AI Toolkit that suit a team starting out.

    AI readiness score

    Answer a few questions and see where your team stands, in about five minutes.
    Open the tool

    AI use case triage

    Test an idea against data, risk and effort before you spend on it.
    Open the tool

    AI project cost estimator

    Get a rough build and run cost range for a first AI project.
    Open the tool

    Read next

    Sources

    Sources

    Facts checked on 29 October 2026. Numbers in square brackets above match this list.
    1. [1] EFTA Secretariat (EEA-Lex), 2018-07-20. Factsheet 32016R0679, General Data Protection Regulation(efta.int)
      Full title and what we used it for

      Factsheet 32016R0679, General Data Protection Regulation. Primary. Used for JCD 154/2018 and EEA entry into force on 20 July 2018. GDPR articles were read in the Official Journal text at https://publications.europa.eu/resource/celex/32016R0679.

    2. [2] Persónuvernd (Data Protection Authority), 2020-02-20. Act on Data Protection and the Processing of Personal Data No 90 of 27…(assets.ctfassets.net)
      Full title and what we used it for

      Act on Data Protection and the Processing of Personal Data No 90 of 27 June 2018 (English translation). Translation published by Persónuvernd for information only; the Icelandic text in the Law Gazette prevails. Used for the entry into force (Article 53), the consent age of 13 and Articles 45 and 46. Later amendments, if any, were not checked; the Alþingi site blocked our access.

    3. [3] EFTA Secretariat (EEA-Lex), 2026-10-29. Factsheet 32024R1689, Artificial Intelligence Act(efta.int)
      Full title and what we used it for

      Factsheet 32024R1689, Artificial Intelligence Act. Primary. Used for the status 'under scrutiny for incorporation into the EEA Agreement'.

    4. [4] Persónuvernd, 2026-10-29. Gervigreind (Artificial intelligence)(island.is)
      Full title and what we used it for

      Gervigreind (Artificial intelligence). Primary. Used for the topics of the AI guidance (chatbots, agents, AI note takers).

    5. [5] Ministry of Culture, Innovation and Higher Education, 2025-07-01. Iceland's AI Action Plan 2025-2027(stjornarradid.is)
      Full title and what we used it for

      Iceland's AI Action Plan 2025-2027. Primary. Used for the plan's aims, the 2021 strategy and the November 2024 report.

    6. [6] European Commission, 2026-10-19. AI Act: regulatory framework for AI(digital-strategy.ec.europa.eu)
      Full title and what we used it for

      AI Act: regulatory framework for AI. Primary. Used for the EU application timeline, including transparency rules from August 2026.

    7. [7] European Commission, 2026-10-29. Adequacy decisions(commission.europa.eu)
      Full title and what we used it for

      Adequacy decisions. Primary. Used to confirm that India has no adequacy decision.

    This is general information, not legal advice. The AI Act is not yet part of Icelandic law and we relied on an English translation of Act No. 90/2018 that may not show later changes. Check with a qualified Icelandic lawyer before you act. Facts checked on 29 October 2026.

    Other country guides

    Starting with AI in Iceland?

    Talk to an engineer. The first call is free, and we start with a readiness assessment before any budget is committed.

    Talk to our team Get your AI score