Denmark's Act on supplementary provisions to the EU AI Act

What it is

Lov nr. 467 af 14. maj 2025 om supplerende bestemmelser til forordningen om kunstig intelligens is the Danish law that supplements the EU AI Act, Regulation (EU) 2024/1689. The AI Act applies directly in every member state, but each state has to name the authorities that supervise it and set penalties for breaches. Act No. 467 does that for Denmark. The Agency for Digital Government coordinates how it is applied.

The Act was written to meet the first stage of the AI Act, when the prohibited practices in Article 5 began to apply. Its supervisory powers and penalties therefore centre on those prohibitions. It does not apply to the Faroe Islands or Greenland.

Who it applies to

The Act reaches the same people as the AI Act itself, the providers, deployers, importers, distributors and others listed in Article 2(1)(a) to (f). In practice that is any organisation that builds, sells or uses an AI system in Denmark. The duties sit in the AI Act. What the Danish Act adds is who checks them, with what powers, and what happens on a breach.

What it requires

Authorities. Section 2 names three national competent authorities.

• The Agency for Digital Government (Digitaliseringsstyrelsen) is the notifying authority, the central point of contact and the market surveillance authority for the prohibitions in Article 5(1)(a) to (c), (e) and (f). Those cover manipulative and exploitative techniques, social scoring, untargeted scraping of facial images and emotion recognition in workplaces and education.
• The Danish Data Protection Agency (Datatilsynet) is the market surveillance authority for Article 5(1)(d) and (g), predicting criminal offences from profiling and biometric categorisation that infers sensitive traits.
• The Danish Court Administration (Domstolsstyrelsen) supervises the prohibitions where courts use AI systems other than in their judicial capacity. Where courts act as courts, decisions are taken by the court concerned and can be appealed to a higher court.

Decisions of the authorities cannot be appealed to another administrative authority.

Powers. The market surveillance authorities can demand any information they need from organisations within the AI Act’s scope (section 5). They can enter business premises without a court order, carry out technical examinations of an AI system on site and bring in independent experts (section 6). They can publish decisions in cases about prohibited practices (section 7), issue orders to comply and impose a temporary ban on supplying or marketing an AI system that may pose a risk (section 8).

Penalties. Section 10 makes the following punishable by a fine, unless a heavier penalty applies under other law.

• Breaching the prohibited practices in Article 5(1)(a) to (g).
• Giving incorrect, incomplete or misleading information to notified bodies or authorities in reply to a request.
• Refusing an information demand or blocking access to premises.
• Obstructing a technical examination of an AI system.
• Failing to comply with an order or a temporary ban.

Companies can be held criminally liable under Chapter 5 of the Danish Criminal Code. The limitation period is five years. Section 11 lets the minister allow some cases to be settled out of court with a fixed penalty notice.

What is still to come

The Act covers the prohibitions, not the rest of the AI Act. On 18 February 2026 the government introduced bill L 111, the AI Act bill, which would have repealed Act No. 467 and carried its rules forward, with new provisions tied to high-risk systems and transparency duties. It was scheduled for first reading on 17 March 2026 and lapsed with the general election of 24 March 2026. As of October 2026, Act No. 467 is the law in force.

The Agency for Digital Government’s own guidance says it has not yet been settled who will supervise the different high-risk areas, and that it will update its pages when the Danish supervisory model is final. Under the AI Act as amended by the Digital Omnibus, obligations for Annex III high-risk systems apply from 2 December 2027, and for high-risk AI in products covered by Annex I from 2 August 2028. Article 50 transparency duties have applied since 2 August 2026.

The Agency for Digital Government and the Danish Data Protection Agency also run a regulatory sandbox for AI, which gives companies and public authorities free guidance on the GDPR and on risk classification under the AI Act.

Key dates

• 14 May 2025. Act No. 467 given.
• 2 August 2025. The Act enters into force, the same day the AI Act’s penalty and governance provisions began to apply.
• 18 February 2026. Bill L 111 introduced to replace the Act.
• 24 March 2026. L 111 lapses with the general election.
• 2 December 2027. AI Act obligations for Annex III high-risk systems apply.

How it relates to other frameworks

The Danish Act is procedural. The substance sits in the EU AI Act, and any AI system that processes personal data must also meet the GDPR, including the rules on solely automated decisions in Article 22. For Danish public authorities, the Danish Data Protection Agency’s guidance on public authorities’ use of AI sets out how those data protection rules apply in practice. For banks, insurers and other financial firms, the Danish FSA’s recommendations on AI add supervisory expectations on governance, model management and explainability.

Organisations preparing for the high-risk obligations often structure the work around ISO/IEC 42001, which gives a management system that maps onto the AI Act’s requirements for risk management, documentation and human oversight.

A note on this page

This is Aicura’s reading of Act No. 467 and the Agency for Digital Government’s published guidance. It is not legal advice and it is not the Act itself. Read the primary source on Retsinformation, and take advice on how the AI Act applies to your organisation.