Skip to main content

    AI by country · Northern Europe

    AI in Norway: the rules, the readiness and where to start

    Last checked: 29 October 2026

    What should a company in Norway know before starting with AI?

    Norway is in the EEA, not the EU, so EU laws apply only once they are added to the EEA Agreement and made Norwegian law. The GDPR applies through the Personal Data Act of 2018, supervised by Datatilsynet. The EU AI Act is not yet in force in Norway as of 29 October 2026; a Norwegian AI Act (KI-loven) is being prepared, with Nkom named to coordinate supervision.

    At a glance

    Norway at a glance

    Key facts about Norway
    Data protection lawGDPR, made Norwegian law by the Personal Data Act (personopplysningsloven), in force since 20 July 2018
    RegulatorDatatilsynet for data protection; Nkom named as coordinating AI market surveillance authority
    AI policyEU AI Act not yet incorporated into the EEA Agreement; Norwegian AI Act (KI-loven) still being prepared as of 29 October 2026
    Time zoneCET, UTC+1 in winter and CEST, UTC+2 in summer (India is 4.5 or 3.5 hours ahead)
    CurrencyNOK (Norwegian krone)
    Business languageNorwegian, with English widely used in business

    Why now

    Why Norway is worth watching

    Each point links to the document it comes from.

    • Eurostat reports that 28.89% of Norwegian enterprises with 10 or more staff used at least one AI technology in 2025, up from 20.77% in 2024. The EU figure was 19.95%.[9]

    • In July 2025 Nkom said it would be the coordinating supervisory authority under a planned Norwegian AI Act, with the rules then planned to apply from summer 2026.[4]

    • That timetable slipped. A Norwegian AI training provider reported in August 2026 that the government plans a new consultation in autumn 2026 and a bill to the Storting in spring 2027.[6]

    • Datatilsynet runs a regulatory sandbox for privacy-friendly innovation and AI, with new projects taken in through application rounds about twice a year.[7]

    • Norway is part of the LUMI AI Factory consortium, whose EUR 387.8 million LUMI-AI supercomputer in Finland is expected to be available in 2027.[8]

    The rules

    The rules that matter for AI

    What each law or policy means when you build or buy an AI system.

    General Data Protection Regulation (EU) 2016/679, via the EEA Agreement

    In force2018The GDPR was added to the EEA Agreement by Joint Committee Decision 154/2018, in force in the EEA from 20 July 2018. People have a right not to be subject to a decision based solely on automated processing with legal or similarly significant effects (Article 22). High-risk processing needs an impact assessment (Article 35), and breaches must be reported within 72 hours where feasible (Article 33).[1]

    Personal Data Act (personopplysningsloven), LOV-2018-06-15-38

    In force2018In force since 20 July 2018. Section 1 makes the GDPR part of Norwegian law, and the Act adds national rules, for example on children's consent for online services (section 5) and on administrative fines (section 26). Datatilsynet is the supervisory authority.[2]

    EU Artificial Intelligence Act, Regulation (EU) 2024/1689, in Norway

    Passed, not yet in force2024The EFTA Secretariat lists the AI Act as under scrutiny for incorporation into the EEA Agreement. Until it is incorporated and made Norwegian law, its duties do not bind Norwegian companies at home. Companies that sell AI systems or outputs into the EU must already follow it there.[3]

    Norwegian AI Act (KI-loven), proposed

    Draft2025A draft was put out for consultation in 2025, and Nkom was named as coordinating supervisory authority and national contact point. Nkom says the national set-up is not fully decided. No entry into force date was set as of 29 October 2026.[5]

    Where AI fits first

    Where AI fits first

    Energy and oil and gas

    Predictive maintenance, reading inspection reports and searching technical documents.

    AI used as a safety component in critical infrastructure such as electricity and gas supply is an Annex III high-risk use under the EU AI Act, which Norway is expected to adopt through KI-loven.[3]

    Public sector and welfare

    Summarising case files and drafting replies, with caseworkers making decisions.

    Datatilsynet's sandbox has published 2026 material on an AI assistant in child welfare services and on chatbots on public sector websites.[7]

    Seafood and aquaculture

    Image-based fish health checks, feed planning and sorting.

    We found no Norwegian AI rule specific to this sector. Data protection rules apply where staff or customer data is used.[2]

    Banking and insurance

    Customer service in Norwegian and English, document checks and fraud signals.

    Once the AI Act applies in Norway, credit scoring and life and health insurance pricing will be high-risk uses. Article 22 GDPR already limits fully automated decisions.[1]

    Your first steps

    Your first steps

    1. List the AI tools and systems you build or use, and note which would be high risk under the EU AI Act.
    2. If you sell AI products or services into the EU, follow the AI Act there now, as it already applies in EU countries.
    3. Run a data protection impact assessment before AI processes personal data at scale, and make sure a person reviews significant decisions.
    4. Prepare to report personal data breaches to Datatilsynet within 72 hours.
    5. Consider Datatilsynet's sandbox if your AI project raises unclear privacy questions.
    6. Follow the KI-loven consultation and Nkom's guidance so you are ready when the law is passed.
    7. Use a GDPR transfer mechanism before personal data goes to a country without an adequacy decision.

    AI services for Norway

    AI consulting and development for teams in Norway

    We work remotely with companies in Norway, in your time zone, and keep your data under the rules described above.

    AI agents and automation

    Agents that finish multi-step work across your tools, with people approving what matters.
    Learn more

    Document Q&A (RAG)

    Answers from your own documents, with the source shown for every answer.
    Learn more

    AI governance and data protection

    Policies, review steps and audit trails that fit your local data law.
    Learn more

    Software and cloud engineering

    Web apps, integrations and cloud platforms built around your AI use case.
    Learn more

    How we work with you

    How we work with you

    We work remotely with clients worldwide, in the client's time zone. India (UTC+5:30) is 4.5 hours ahead of Norway in winter (UTC+1) and 3.5 hours ahead in summer (UTC+2). Taking a 9:00 to 17:00 day in Norway and 9:30 to 18:30 in India, the overlap is about 5 hours in winter (09:00 to 14:00 Norwegian time) and 6 hours in summer (09:00 to 15:00). India has no EU adequacy decision, so any personal data we handle needs a GDPR transfer mechanism such as standard contractual clauses.

    Questions

    Common questions about AI in Norway

    Does the EU AI Act apply in Norway?

    Not yet at home. As an EEA state, Norway must first add the AI Act to the EEA Agreement and pass a Norwegian law, KI-loven. As of 29 October 2026 neither step was complete. If you sell into the EU, the Act already applies to that business.

    When will KI-loven come into force?

    No date is set. The government first planned summer 2026. A secondary report from August 2026 says a new consultation is planned for autumn 2026 and a bill for spring 2027, but we could not open the government's own announcement.

    Who supervises AI in Norway?

    Datatilsynet supervises personal data, including in AI. Nkom has been named as the coordinating market surveillance authority and national contact point for the AI Act once it applies, working with sector regulators.

    Does the GDPR apply in Norway?

    Yes. It was incorporated into the EEA Agreement in July 2018 and applies through the Personal Data Act. Transfers of personal data outside the EEA need a GDPR transfer mechanism.

    Complimentary tools

    Try these first

    Three complimentary tools from our AI Toolkit that suit a team starting out.

    AI readiness score

    Answer a few questions and see where your team stands, in about five minutes.
    Open the tool

    AI use case triage

    Test an idea against data, risk and effort before you spend on it.
    Open the tool

    AI project cost estimator

    Get a rough build and run cost range for a first AI project.
    Open the tool

    Read next

    Sources

    Sources

    Facts checked on 29 October 2026. Numbers in square brackets above match this list.
    1. [1] EFTA Secretariat (EEA-Lex), 2018-07-20. Factsheet 32016R0679, General Data Protection Regulation(efta.int)
      Full title and what we used it for

      Factsheet 32016R0679, General Data Protection Regulation. Primary. Used for JCD 154/2018 and EEA entry into force on 20 July 2018. GDPR articles were read in the Official Journal text at https://publications.europa.eu/resource/celex/32016R0679.

    2. [2] Lovdata, 2018-06-15. Lov om behandling av personopplysninger (personopplysningsloven), LOV-2…(lovdata.no)
      Full title and what we used it for

      Lov om behandling av personopplysninger (personopplysningsloven), LOV-2018-06-15-38. Primary. Used for the in-force date of 20 July 2018 and the section headings (sections 1, 5 and 26). The full section text was not openly available, so we do not quote details such as the consent age.

    3. [3] EFTA Secretariat (EEA-Lex), 2026-10-29. Factsheet 32024R1689, Artificial Intelligence Act(efta.int)
      Full title and what we used it for

      Factsheet 32024R1689, Artificial Intelligence Act. Primary. Used for the status 'under scrutiny for incorporation into the EEA Agreement'. Annex III content was checked at https://ai-act-service-desk.ec.europa.eu/en/ai-act/annex-3.

    4. [4] Nasjonal kommunikasjonsmyndighet (Nkom), 2025-07-04. Nkom får hovedansvar for nye lover om digitale tjenester og KI(nkom.no)
      Full title and what we used it for

      Nkom får hovedansvar for nye lover om digitale tjenester og KI. Primary. Used for Nkom's planned role and the original plan for the rules to apply from summer 2026.

    5. [5] Nasjonal kommunikasjonsmyndighet (Nkom), 2026-03-24. Hvem skal håndheve KI-forordningen i Norge?(nkom.no)
      Full title and what we used it for

      Hvem skal håndheve KI-forordningen i Norge?. Primary. Used for Nkom as coordinating market surveillance authority and national contact point, and that the national organisation is not fully decided.

    6. [6] KI Akademiet, 2026-08-18. KI-loven i Norge: status og tidsplan(kiakademiet.no)
      Full title and what we used it for

      KI-loven i Norge: status og tidsplan. Secondary, a training provider's summary; it does not cite sources. Used only for the reported 4 August 2026 announcement of a new consultation and the spring 2027 aim. The government's page on regjeringen.no blocked our access, so this is not confirmed on a primary source.

    7. [7] Datatilsynet, 2026-10-29. Sandkasse for kunstig intelligens(datatilsynet.no)
      Full title and what we used it for

      Sandkasse for kunstig intelligens. Primary. Used for the sandbox purpose, intake rounds and 2026 items.

    8. [8] EuroHPC Joint Undertaking, 2026-08-31. EuroHPC JU signs contract to deploy LUMI-AI supercomputer(eurohpc-ju.europa.eu)
      Full title and what we used it for

      EuroHPC JU signs contract to deploy LUMI-AI supercomputer. Primary. Used for Norway's place in the consortium, the contract value and expected availability.

    9. [9] Eurostat, 2026-06-15. Artificial intelligence by size class of enterprise (isoc_eb_ai)(ec.europa.eu)
      Full title and what we used it for

      Artificial intelligence by size class of enterprise (isoc_eb_ai). Primary statistics. Enterprises with 10 or more staff, excluding the financial sector, using at least one AI technology.

    10. [10] European Commission, 2026-10-29. Adequacy decisions(commission.europa.eu)
      Full title and what we used it for

      Adequacy decisions. Primary. Used to confirm that India has no adequacy decision.

    This is general information, not legal advice. The Norwegian AI Act is still being prepared and its timetable is reported only by secondary sources, so check for updates. Check with a qualified Norwegian lawyer before you act. Facts checked on 29 October 2026.

    Other country guides

    Starting with AI in Norway?

    Talk to an engineer. The first call is free, and we start with a readiness assessment before any budget is committed.

    Talk to our team Get your AI score