The EU AI Act in Norway: what applies, and when?

The EU AI Act is the EU's law on artificial intelligence, and Norway will implement it through its own national AI law (KI-loven). As of October 2026 it hasn't been incorporated into the EEA Agreement, so none of it is binding in Norwegian law yet. The government is sending a new consultation out in autumn 2026 and aims to put the bill before the Storting, the Norwegian parliament, in spring 2027.

Where Norway stands right now

The AI Act (Regulation (EU) 2024/1689) entered into force in the EU on 1 August 2024. Its rules apply in stages, and some of them already apply in the EU.

Norway is further behind. The Ministry of Digitalisation and Public Governance sent a draft AI law out for consultation on 30 June 2025 with a deadline of 30 September 2025. The plan was for the law to take effect in late summer 2026, but the regulation first has to be incorporated into the EEA Agreement, and that hasn't happened yet.

Then came the EU's simplification package, the Digital Omnibus (Regulation (EU) 2026/1744), which entered into force on 27 July 2026. It postpones the high-risk requirements, softens the AI literacy requirement and adds two new prohibitions. On 4 August 2026 Minister of Digitalisation Karianne Tung announced that the Norwegian AI law will go out for a new consultation with these changes in autumn 2026, and that the bill will be presented to the Storting in spring 2027.

Supervision is already divided up in the proposal. Nkom, the Norwegian Communications Authority, becomes the coordinating market surveillance authority and single point of contact. The Norwegian Data Protection Authority (Datatilsynet) takes responsibility for areas such as AI in law enforcement and democratic processes, and sector regulators such as the Financial Supervisory Authority keep their own areas. Nkom collects its guidance at nkom.no/ki.

If you have customers or users in the EU, you shouldn't wait for Norwegian law. The regulation also covers providers and deployers outside the EU when the output of the AI system is used in the EU.

Timeline: what applies when?

The dates below apply in the EU after the Digital Omnibus changes. None of them apply in Norway until the AI law is adopted and the regulation is incorporated into the EEA Agreement.

The high-risk requirements were originally due to apply from 2 August 2026 and 2 August 2027. Those dates are no longer correct, so check how old a source is if you see them elsewhere.

Who does the AI Act apply to?

The regulation distinguishes between roles (Article 3), and the obligations follow the role:

• Provider: develops an AI system, or has one developed, and puts it into service or sells it under its own name. Most of the requirements sit here.
• Deployer: uses an AI system at work. Most Norwegian businesses are here.
• Importer and distributor: brings other companies' systems onto the EU market or resells them.

If you have a chatbot or an AI agent built and put it into service under your own name, you're the provider, even if someone else wrote the code. If you change the purpose, for example by using a general assistant to sort job applicants, you can go from deployer to provider of a high-risk system (Article 25).

We only use ChatGPT and Copilot. Does this apply to us?

Yes, but less than many think. The obligations for general-purpose AI models sit with OpenAI, Microsoft and Google. As a deployer, this applies to you:

• The Article 5 prohibitions
• The requirement to build AI literacy among your staff
• Disclosure when you publish deepfakes or AI-generated text on matters of public interest, unless a person has edited the text and is responsible for it
• The deployer obligations for high-risk systems, but only if you use the tool for a high-risk purpose, such as assessing applicants or employees

The four risk levels

The regulation sorts AI by risk. The higher the risk, the more requirements apply.

Prohibited

Article 5 prohibits, among other things, manipulative techniques that cause harm, exploiting vulnerable groups, social scoring, crime prediction based solely on profiling, untargeted scraping of facial images for facial recognition, emotion recognition in the workplace and in education, and biometric categorisation by ethnicity, religion, sexual orientation and similar traits. From 2 December 2026 it also prohibits AI that creates sexualised images of identifiable people without consent, and child sexual abuse material.

High risk

Systems in the areas listed in Annex III are high-risk: biometrics, critical infrastructure, education, employment and worker management, access to essential private and public services (such as public benefits, credit scoring and pricing of life and health insurance), law enforcement, migration and the administration of justice.

A tool that ranks CVs, a system that decides who gets a loan, or a model that prioritises cases in welfare administration are typical examples. The requirements apply from 2 December 2027.

Transparency requirements

Chatbots, AI-generated content and deepfakes have their own transparency requirements in Article 50, which apply in the EU from 2 August 2026:

• People must know they're talking to a machine, unless it's obvious.
• The provider must mark synthetic audio, images, video and text in a machine-readable way.
• Whoever publishes deepfakes or AI text on matters of public interest must disclose it.
• The information must be given clearly, at the latest at the first interaction.

Minimal risk

Spam filters, recommendation engines in an online shop and most internal tools end up here. The AI Act sets no specific requirements for them, but the GDPR and other rules still apply.

AI literacy requirement

Article 4 has applied in the EU since 2 February 2025. Originally, providers and deployers had to make sure their staff had a "sufficient level" of AI literacy. After the Digital Omnibus they must instead take measures that support the development of AI literacy, and they no longer have to guarantee a specific level.

It's still an obligation. In practice it means training that fits how each person uses AI: what the tool can and can't do, which data must not go in, and when a person has to check the output. The Norwegian government's practical guide to AI assistants at work from June 2025 is a good starting point.

What does it mean for chatbots and AI agents?

For those who build AI systems, this is where the regulation gets concrete. We think it pays to build the requirements in from the first version, because adding them afterwards costs more.

A chatbot on your website must say that it's a machine. That takes one line in the interface and is a requirement in the EU from 2 August 2026.

For high-risk systems, the deployer must keep automatically generated logs for at least six months (Article 26). Log inputs, tool calls and decisions even if your agent isn't high-risk. Without logs you can neither debug nor document what the system has done.

High-risk systems require human oversight by people with the skills and authority to intervene. In an AI agent, that means an approval step before the agent sends email, changes data or makes decisions about people.

Also write down what the system is meant for, and what it isn't meant for. That description is the basis for the risk classification, and it makes it visible if a low-risk tool starts being used for something high-risk.

We've written more about what an agent is, what it costs and how to keep it under control in AI agents: what they are, what they do and what they cost. We build AI agents and automation with logging, approval steps and documentation as standard. We work the same way with the requirements for accessibility.

The public sector has stricter requirements

Public bodies that deploy high-risk systems must carry out a fundamental rights impact assessment before use (Article 27) and register the use in the EU database. The same applies to private companies providing public services. High-risk systems that public authorities already use must comply by 2 August 2030 at the latest.

The Norwegian Digitalisation Agency (Digdir) has set up KI-Norge with guidance for the public sector, and a regulatory AI sandbox is run jointly by Digdir, Nkom and Datatilsynet.

What do violations cost?

The fines in Article 99 are high:

The higher amount applies to large companies. For small and medium-sized enterprises the lower amount applies, and after the Digital Omnibus the same goes for small mid-cap companies in the two lower categories.

Checklist: how to prepare your organisation

You can take these eight steps now, regardless of when the AI law takes effect in Norway.

1. Map all AI use. List tools, agents, integrations and purchased services with AI, including what employees use on their own.
2. Clarify your role for each system. Are you a provider, deployer, importer or distributor? Remember that your own chatbots under your own name make you a provider.
3. Classify the risk. Check each system against the Article 5 prohibitions and the high-risk areas in Annex III.
4. Label chatbots and AI-generated content. The transparency requirements apply in the EU from 2 August 2026 and are easy to implement.
5. Start AI literacy training. Adapt it to how each group uses AI, and document what you've done.
6. Build in logging and human oversight. Log inputs, tool calls and decisions, and add approval steps before actions that affect people.
7. Connect the work with data protection. Use the provider's information in your data protection impact assessment (DPIA), and check your data processing agreements.
8. Follow the Norwegian consultation. The new consultation is due in autumn 2026. Keep an eye on Nkom and regjeringen.no.

Sources and further reading

• Regulation (EU) 2024/1689 (the AI Act) and Regulation (EU) 2026/1744 (Digital Omnibus) on EUR-Lex
• The European Commission's AI Act Service Desk with the timeline and article text
• Consultation paper with the draft AI law and the news about the new consultation on regjeringen.no (in Norwegian)
• Nkom on the AI law (in Norwegian)
• Datatilsynet's regulatory sandbox for AI (in Norwegian)
• KI-Norge at the Norwegian Digitalisation Agency (in Norwegian)

This article isn't legal advice. We'll update it when the Norwegian consultation and the bill are published.