Norway's AI Act (KI-loven)

What it is

KI-loven, the Norwegian law on artificial intelligence, is the bill that will give effect to the EU AI Act in Norway. Norway is a member of the European Economic Area rather than the EU. EU regulations reach Norway when the EEA Joint Committee incorporates them into the EEA Agreement and Norway implements them in national law. KI-loven is that implementing law. It would make the EU AI Act part of Norwegian law and add national provisions where the regulation leaves choices to each state.

The Ministry of Digitalisation and Public Governance sent the draft for public consultation on 30 June 2025. At that point it expected the law to take effect in late summer 2026, alongside the general application of the AI Act in the EU. The ministry received just under 150 consultation responses.

Where it stands

The timetable has moved. The EU amended the AI Act in July 2026 through the Digital Omnibus on AI, which pushed back the high-risk obligations to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems. On 4 August 2026 the Minister of Digitalisation and Public Governance, Karianne Tung, announced that the government would send an amended bill for a new consultation in autumn 2026, with the aim of presenting it to the Storting in spring 2027.

Two things have to happen before the AI Act binds Norwegian organisations at home. The regulation, as amended, has to be incorporated into the EEA Agreement, and the Storting has to pass KI-loven. As of October 2026 neither has happened.

Who it will apply to

Once in force, KI-loven will apply to the same actors as the EU AI Act. That means providers that develop AI systems or general-purpose AI models and place them on the market, deployers that use AI systems in their work, and importers and distributors. The obligations will follow the AI Act’s risk tiers, from prohibited practices through high-risk systems and transparency duties to minimal-risk uses.

Norwegian organisations are not entirely outside the AI Act in the meantime. The EU regulation applies to providers outside the EU that place AI systems on the EU market, and to providers and deployers outside the EU whose AI output is used in the EU. A Norwegian company selling AI-enabled products or services into the EU can carry obligations under the EU AI Act now.

What it will require

The draft bill set out the supervisory structure. It proposed the Norwegian Communications Authority (Nkom) as the national coordinating market surveillance authority and single point of contact, responsible for consistent application of the rules across sectors. Sector regulators would supervise AI in their own areas, with Finanstilsynet for financial services. Nkom, Datatilsynet and the Norwegian Digitalisation Agency would cooperate on an AI regulatory sandbox.

For organisations, the substance is the AI Act itself. Prohibited practices, AI literacy, transparency under Article 50, the obligations for high-risk systems and the general-purpose AI model regime will all apply once the law is in force. Datatilsynet has pointed out that many of the requirements resemble those of the Personal Data Act. The fundamental rights impact assessment for certain high-risk systems, for example, is similar to a data protection impact assessment, so organisations with good GDPR routines have a starting point.

What applies today

The GDPR has applied in Norway since 20 July 2018 through the Personal Data Act (personopplysningsloven), which makes the regulation Norwegian law. Any AI system that processes personal data must meet it, and GDPR Article 22 governs decisions based solely on automated processing with legal or similarly significant effects. Datatilsynet supervises it, and has run a regulatory sandbox for responsible AI since 2020.

Key dates

• 20 July 2018. Personal Data Act in force, making the GDPR part of Norwegian law.
• 30 June 2025. Draft AI Act sent for public consultation.
• 4 August 2026. Government announces a new consultation on an amended bill in autumn 2026.
• Spring 2027. Government’s target for presenting the bill to the Storting.

No date has been set for the law to take effect.

How it relates to other frameworks

KI-loven is a vehicle for the EU AI Act, so the AI Act’s text, guidance and harmonised standards will define what Norwegian organisations must do. The deployer obligations guide and the high-risk classification guide apply to Norwegian organisations as they will to EU ones. Many organisations use ISO/IEC 42001 in the meantime to build the inventory, risk assessment and oversight the AI Act will expect.

A note on this page

This is Aicura’s reading of the proposed Norwegian AI Act and its status. It is not legal advice. The bill may change before it is passed. Follow the consultation documents published by the Ministry of Digitalisation and Public Governance, and take advice on how the law will apply to your organisation.