Norway's AI Act is delayed to 2027 – what organisations should still do before 2 December 2026

Norway's AI Act has been delayed: as of October 2026 the Norwegian AI law has not been passed, and the government will put it out to a fresh public consultation this autumn, aiming to present it to the Storting in spring 2027. Meanwhile, existing data protection, criminal and copyright law governs AI use, and the EU's 2 December 2026 deadlines reach Norwegian organisations through their tools.

• Norway's AI Act (KI-loven) is the national law that will implement the EU AI Act, Regulation (EU) 2024/1689, in Norwegian law.
• 27 July 2026: the EU's amending regulation, the Digital Omnibus on AI, (EU) 2026/1744, entered into force.
• 2 December 2026: a new EU ban on AI that generates non-consensual intimate deepfakes or child sexual abuse material, and the deadline for machine-readable labelling in older generative AI tools.
• 2 December 2027 and 2 August 2028: the new EU dates for the high-risk rules.
• Spring 2027: the government's target for sending the bill to parliament.
• Nkom, the Norwegian Communications Authority, has been designated as the coordinating AI supervisor.

Has Norway passed its AI Act yet?

No. A draft AI law went out for consultation in autumn 2025 and drew just under 150 responses. On 4 August 2026 the then Minister of Digitalisation and Public Governance, Karianne Tung (Labour), announced a second consultation this autumn. “My ambition is to present the AI Act to the Storting in spring 2027,” Tung said, according to the ministry's press release (in Norwegian). As of October 2026 the ministry is headed by Torgeir Micaelsen (Labour).

Spring 2027 is an ambition, not a fixed schedule. As of 18 October 2026 the new consultation had not been published.

Why has it been delayed?

The government gives three reasons: the EU rewrote parts of the AI Act in July 2026, the regulation has not yet been incorporated into the EEA Agreement, and Norway is negotiating the EEA adaptations it needs.

What is the Digital Omnibus on AI?

The Digital Omnibus on AI is an EU regulation that simplifies and postpones parts of the AI Act: Regulation (EU) 2026/1744, adopted on 8 July 2026 and in force since 27 July 2026. Four changes matter most to small organisations:

• High-risk rules pushed back: obligations for high-risk AI, such as systems that screen job applications, now apply in the EU from 2 December 2027. AI built into regulated products has until 2 August 2028.
• New prohibitions: from 2 December 2026 the EU bans AI systems that create realistic intimate images, video or audio of an identifiable person without consent, or child sexual abuse material.
• Labelling deadline for older tools: providers of generative AI systems already on the market before 2 August 2026 must label their output in a machine-readable way by 2 December 2026.
• Softer AI literacy duty: organisations must now “take measures to support the development of AI literacy” among staff, without having to guarantee any specific level.

Does 2 December 2026 apply to Norwegian organisations?

Not formally. EU dates do not bind a Norwegian charity or association until the regulation has been brought into the EEA Agreement and Norway's AI Act is in force. You will still feel the changes in two ways.

First, providers such as OpenAI, Microsoft and Google must comply in the EU, and they build labelling and safeguards into the same products people use in Norway. The labelling duty for older tools sits with the provider, not with the organisation using ChatGPT or Copilot. Second, a Norwegian organisation that itself offers AI services to users in the EU may fall within scope directly.

What do the transparency rules mean for a nonprofit?

The AI Act distinguishes between providers, who build AI systems, and deployers, who use them. Under Article 50 of the AI Act, deployers must disclose deepfakes – AI-generated or manipulated images, audio and video. AI-generated text published to inform the public on matters of public interest must also be disclosed, unless a person has reviewed it and someone holds editorial responsibility for publishing it.

On 2 August we wrote about AI content labelling as a trust opportunity for nonprofits. That advice holds, even though Norwegian law does not yet require it.

Who will enforce the AI Act in Norway?

The Norwegian Communications Authority (Nkom). In March 2025 the government decided that Nkom will be the national coordinating supervisory authority for AI and the single point of contact with EU bodies, alongside sector regulators. Nkom itself noted in March 2026 that the overall national set-up has not been finalised, as explained on Nkom's page on who enforces the AI Act (in Norwegian).

Which rules already apply to AI use in Norway?

The government stresses that the lack of an AI law does not mean anything goes. Data protection law, the Penal Code and the Copyright Act already apply when AI is developed and used.

Data protection: DPIAs and access control

In its final report from a regulatory sandbox project with NTNU on Microsoft Copilot (2024, updated October 2025), the Norwegian Data Protection Authority states that “as a general rule, a data protection impact assessment (DPIA) will be required when using generative AI that processes personal data.” Copilot can see whatever the user can see, so permissions need tidying first, and using it for HR matters carries “a particularly high risk”, according to Datatilsynet's Copilot report.

Images of real people

In February 2026, 61 data protection authorities signed a joint statement on AI deepfakes. According to Datatilsynet (in Norwegian), AI-generated images of real people count as personal data – even when what they show is untrue. That already limits what you may generate of members or volunteers.

Checklist for an organisation using ChatGPT or Copilot

A board can work through this in one meeting; it rests on rules that apply today.

1. Map your tools. Write down which AI services are used, by whom and for what.
2. Keep sensitive data out. Do not paste in membership lists, health information or HR cases without a data protection assessment – as a rule, a DPIA.
3. Fix permissions before Copilot. Check who can open which folders in Microsoft 365, because Copilot sees what the user sees.
4. Be open. Tell people when they are talking to a chatbot, label AI-generated images, audio and video, and make a named person responsible for published text.
5. Never generate images of real people without consent. That is personal data today, and the worst forms become illegal in the EU from 2 December 2026.
6. Agree internal ground rules. Our four ground rules for safe AI use in small organisations and our guide to responsible AI for nonprofits without the hype are a good starting point.
7. Train everyone in the basics. The AI literacy duty applies in the EU and is expected to reach Norway with the new law. Gründerskolen's free online courses are an easy place to begin.
8. Take part in the consultation. Associations and charities can respond too – civil society's experience is needed.

Frequently asked questions

When does the EU AI Act apply in Norway?

Only once the regulation has been incorporated into the EEA Agreement and Norway's AI Act has been passed. The government aims to present the bill in spring 2027, so the rules cannot apply in Norway before then.

What AI Act obligations apply to a small Norwegian organisation from 2 December 2026?

Formally none, unless it offers AI systems in the EU market. In practice, the tools it uses will carry machine-readable labels and new safeguards, and Norwegian data protection law already applies.

Who will supervise AI in Norway?

Nkom has been designated as the coordinating supervisory authority and national contact point, alongside sector regulators. The final set-up has not been decided.

Will there be fines for breaching Norway's AI Act?

The 2025 consultation draft proposed coercive fines and administrative penalties. Final rules and amounts depend on the bill that follows the new consultation.