Does the EU AI Act apply in Norway?
Regulation
Short answer: No, not formally. As of 14 September 2026 the AI Act has not been incorporated into the EEA Agreement, and Norway’s AI law has not been adopted. But two things mean you cannot wait: Norwegian businesses offering AI in the EU are already covered there, and the government aims to put the law before parliament in spring 2027.
Why it does not apply in Norway yet
EU rules only apply in Norway once they are incorporated into the EEA Agreement and implemented in Norwegian law. Neither has happened for the AI Act. The Norwegian Communications Authority, Nkom, wrote on 10 August 2026 that the rules “do not generally apply in Norway”, and Norway’s parliament noted in June that the timing of incorporation remains unclear.
| When | What | Status |
|---|---|---|
| March 2025 | Nkom named coordinating authority | Decided |
| June to Sept 2025 | Consultation on a new AI law, around 150 responses | Under review |
| Autumn 2026 | New consultation covering the EU changes of July 2026 | Announced |
| Spring 2027 | Bill to parliament | Ambition |
| Not set | EEA decision and entry into force in Norway | Undecided |
August 2027 is repeated on several websites. We found no official source that confirms it.
Who it already reaches
The law may not apply in Norway, but it applies in the EU. According to Nkom, Norwegian businesses are covered when they offer AI systems in the EU, or when the output of an AI system is used in the EU. If you have customers, users or a subsidiary in the EU, this is not a future question.
Meanwhile, existing Norwegian law applies to AI as it does to anything else: privacy, marketing and criminal law.
The EU timeline, after the changes of July 2026
In July 2026 the EU adopted a simplification of the AI Act, Regulation (EU) 2026/1744, which moved several deadlines. It entered into force on 27 July 2026. Those changes are not part of the EEA Agreement either.
| From | Applies in the EU |
|---|---|
| 2 February 2025 | Prohibited practices and AI literacy |
| 2 August 2025 | General purpose AI models, governance and penalties |
| 2 August 2026 | General application, including transparency duties |
| 2 December 2026 | Marking of AI generated content for systems already on the market, and a new ban on AI that creates sexual content without consent |
| 2 December 2027 | High risk systems (Annex III), moved from August 2026 |
| 2 August 2028 | High risk in regulated products (Annex I), moved from August 2027 |
The AI literacy requirement was also changed in the same package. Read the consolidated text on EUR-Lex before building a training programme around it.
The four risk levels
The law sorts AI by how much harm it can do:
- Prohibited. For example social scoring, manipulation, emotion recognition at work and school, and scraping facial images from the internet.
- High risk. 8 areas, including hiring, education, critical infrastructure and access to public services. This is where the heaviest obligations sit.
- Transparency. Chatbots and AI generated content. People must know they are dealing with AI.
- Minimal risk. Most ordinary use. No specific obligations.
Breaches can carry fines of up to 35 million euros or 7 percent of global turnover, according to Nkom.
What to do now
- List the AI systems you use and plan to use. That is Nkom’s first piece of advice.
- Place each one in a risk level. Most land in minimal risk. The few that do not are where the work is.
- Check what touches the EU. If you sell there, or the output is used there, the rules already apply.
- Follow the consultation this autumn. That is where the Norwegian details, such as supervision and penalties, get decided.
Who enforces it
Nkom is designated as coordinating market surveillance authority and national contact point. Norwegian Accreditation becomes the accreditation body, and sector authorities keep responsibility within their fields. The legal basis for these roles only arrives with the new law. The Norwegian Digitalisation Agency has set up KI Norge, which is building a regulatory sandbox with Nkom and the Data Protection Authority for businesses that want to test solutions with guidance.
This is an overview, not legal advice. If you are unsure about a specific system, talk to a lawyer.
Sources
All sources checked on 14 September 2026. Most are in Norwegian.
- Nkom: New AI marking requirements in the EU, 10 August 2026
- Norwegian Parliament, EU/EEA news, 12 June 2026
- Government: Consultation on a new AI law, 2025
- Government: New consultation and bill, 4 August 2026
- Government: Nkom designated, 26 March 2025
- EUR-Lex: Regulation (EU) 2026/1744
- European Commission: Article 113, entry into application
- Nkom: Risk categories
- Nkom: Frequently asked questions
- Digdir: KI Norge
