Norway's AI agreement: what must employers discuss before introducing AI?

A Norwegian company with 120 employees has bought an AI assistant that will be connected to email, calendars and the document archive. IT has set it up, the management team has approved it, and roll-out is planned for Monday. The employee representatives hear about it at a staff meeting on Friday. That is too late.

On 1 October The Economist ran a piece on employees’ email becoming training data for their employer’s AI. The following day the Norwegian government and the social partners signed an AI agreement.

What is Norway’s AI agreement?

The AI agreement (KI-avtalen) is a letter of intent on the responsible introduction and use of artificial intelligence in working life. It was signed on 2 October 2026 by the government and by NHO, KS, Virke and Spekter (employers) and LO, Unio, Akademikerne and YS (employees). It runs until 31 December 2029.

Its stated purpose is that the Norwegian working life model should apply when AI is introduced. The social partners undertake to help ensure that the Working Environment Act and the co-determination arrangements in collective agreements are actively used, by involving employee representatives and staff in each business. The parties will also focus on the rules on monitoring and control systems.

The Ministry of Digitalisation and Public Governance manages the agreement and runs the secretariat for a coordination group. Permanent members include AI Norway (KI Norge), the Data Protection Authority (Datatilsynet), the Labour Inspection Authority (Arbeidstilsynet) and the research centres TRUST and AI Learn. More on AI regulation is on the topic page on artificial intelligence.

Is the AI agreement binding on individual employers?

No. The agreement is between the state and the main organisations, and the individual employer is not a party. It contains no deadlines, requirements or sanctions aimed at businesses. The text does not expressly address legal effect, but the label and the content suggest it creates no enforceable rights.

Even so, the agreement shows where the parties intend to apply pressure over the next three years, and that is participation, discussion and monitoring. The obligations already existed.

The AI agreement creates no new duties, but it makes it harder to pretend the old ones do not apply to AI.

Which duties to discuss apply when AI is introduced?

Three sets of rules are relevant, and they apply side by side.

Under § 8-2 of the Working Environment Act (arbeidsmiljøloven), the discussion must take place as early as possible, and discussions about substantial changes in work organisation must aim at reaching an agreement. Working Environment Act § 4-2(1) also requires employees and their representatives to be kept informed about the systems, to receive the necessary training and to participate in designing them.

Employers bound by the LO–NHO Basic Agreement have further duties. § 9-4 requires discussion of important changes in production arrangements and methods. Supplementary Agreement IV on technological development states that the purpose of a computer system must be clearly defined when it is introduced, and that other uses may only follow discussions with the employee representatives. Other basic agreements must be read separately.

When does an AI tool become a control measure?

Many workplace AI tools log prompts, measure activity or summarise an individual’s meetings and email. If a function can be used to keep track of individuals, it is a control measure under Working Environment Act § 9-1. That requires an objective reason and a burden on employees that is not disproportionate. The need, design and implementation must be discussed with the employee representatives under Working Environment Act § 9-2, whatever the size of the business.

Email Regulation § 2(2) of the email regulation (e-postforskriften) also prohibits monitoring employees’ use of electronic equipment, except for network administration and security breaches. How rules on AI use relate to monitoring of individual use is covered in the article on an AI policy for employees.

Can employees’ email and chats be used to train AI?

Only after a separate assessment. Email collected to run the business cannot automatically be put to a new purpose. GDPR Art. 5(1)(b) on purpose limitation and GDPR Art. 6(4) require the employer to assess whether training or use as context is compatible with the original purpose. The factors include the employment relationship, the consequences for staff and safeguards such as pseudonymisation. The general rules are on the topic page on data protection.

Whether an AI assistant reading an employee’s mailbox amounts to “access” under Email Regulation § 2 has not been settled by the Data Protection Authority or the Privacy Appeals Board (Personvernnemnda). Even so, a tool that systematically works through every mailbox is unlikely to fit the regulation’s condition of necessity for day-to-day operations. Employers should keep personal areas out of scope and limit what the tool can reach. The procedure for accessing an individual’s email is set out in the article on when an employer can read an employee’s email.

Where the tool processes employee data on a large scale, a DPIA for the AI tool should be carried out before go-live. The AI Act will also require employers to inform workers’ representatives and affected workers before a high-risk system is used at the workplace (AI Act Art. 26(7)). The regulation has not yet been implemented in Norway.

What should employers do before introducing AI?

1. Raise the matter with the employee representatives while the choice of tool and set-up is still open, not after the contract is signed.
2. Describe the purpose in writing, including which data the tool can access and what it must not be used for.
3. Review the settings for logging, activity measurement and summaries, and treat them as control measures where they can be linked to individuals.
4. Complete the purpose assessment and the DPIA before data from email or chats is used for training or context.
5. Keep minutes of the discussion meetings. Supplementary Agreement IV recommends minutes signed by both sides, and the minutes are what show that the discussion took place in time.

Questions and answers

Next legal review: 1 March 2027