Artificial
intelligence
The AI Act, risk classification, obligations for providers and deployers, and AI in contracts. Gathered in one place and kept up to date.
When the AI Act applies
The Regulation applies in stages. The dates below apply in the EU. When the rules apply in Norway depends on incorporation into the EEA Agreement.
- 1 Aug 2024 The Regulation enters into force
- 2 Feb 2025 Prohibited practices and AI literacy requirements
- 2 Aug 2025 General-purpose AI models and governance
- 2 Aug 2026 The bulk of the rules, including high-risk systems under Annex III
- 2 Aug 2027 High-risk systems linked to product legislation, Art. 6(1)
The EU has proposed postponing certain high-risk rules. The timeline will be updated as the process develops.
Articles on this topic
AI agent liability: who pays when an AI agent causes harm?
Under Norwegian law, AI agent liability rests primarily with the business that puts the agent to work. An agent is neither a legal person nor an employee, so the harm is treated as the business's own. Towards customers, ordinary contractual liability applies. The vendor is liable only as far as the contract allows, and the new EU Product Liability Directive does not yet apply in Norway.
Anonymisation under the EDPB guidelines: is your data really anonymous?
Anonymisation under the GDPR requires the likelihood of identifying anyone to be insignificant, assessed from the perspective of whoever will use the data. The draft EDPB guidelines 02/2026 build on the SRB judgment and apply three criteria, singling out, linkability and inference. A processor inherits its customer's perspective, and the assessment must be repeated over time.
Checking AI-generated text: what can businesses learn from a ruling set aside?
Checking AI-generated text means checking it against the source, not against how plausible it sounds. In September 2026 a Norwegian court of appeal set aside a ruling that set out nine paragraphs of submissions no party had made, and the court has confirmed AI was used. The same error in contracts, board papers or replies to regulators binds the business or misleads the board.
Norway's AI agreement: what must employers discuss before introducing AI?
Norway's AI agreement of 2 October 2026 is a letter of intent between the government and the social partners. It places no new obligations on individual employers, whose duties come from the Working Environment Act and collective agreements. If AI changes how work is organised, or can be used to monitor staff, it must be discussed with employee representatives before the decision is made.
Personal data in test environments: can we test with real customer data?
Personal data in test environments may only be used where testing is compatible with the purpose for which the data was collected, under GDPR Art. 6(4), and where synthetic or pseudonymised data will not do. Private businesses have no special rule. Copies of production data used for testing need the same security, access control and deletion as production.
AI hallucinations: who is liable when your chatbot promises a customer too much?
A business is liable for AI hallucinations in its own customer service. The chatbot is not a separate legal person, and what it says counts as the business's own statements. Towards consumers, wrong answers can give rise to claims for non-conformity, and misleading answers can breach Norwegian marketing law. A disclaimer in the chat window helps little.
AI literacy is now a requirement: what Article 4 of the AI Act means for your business
AI literacy is a requirement under Article 4 of the AI Act. Businesses that use AI at work must take measures to build literacy among staff and others who use the systems on their behalf. The requirement has applied in the EU since 2 February 2025 and was softened in July 2026. It does not yet apply in Norway, but should be prepared for now.
AI policy for employees: what can an employer require and monitor?
Under Norwegian law, an employer can set an AI policy for employees under its managerial prerogative, including bans on certain tools and requirements to check the output. Monitoring how employees actually use AI is a control measure that requires objective grounds, discussion with employee representatives and prior information. Continuous monitoring of individual use is generally prohibited.
Board responsibility for AI: what should the board ask before its next meeting?
Board responsibility for AI follows from the general rules of the Norwegian Companies Act. The board must ensure the business is properly organised, subject to adequate control and that the chief executive is supervised, and this also covers the use of artificial intelligence. The board does not need technical expertise, but it must know where AI is used, what the risk is and who is responsible.
Copyright and AI: who owns the text, code and images that AI creates?
Content that AI creates entirely on its own probably has no copyright under Norwegian law, because the Copyright Act requires original and individual creative effort by a human. If a human reworks the output creatively, the human contribution may be protected. A vendor's promise that you own the output gives no more protection than the law itself provides.
DPIA for AI tools: when is it required, and what must it contain?
A DPIA for AI tools is required when their use is likely to result in a high risk to data subjects, under GDPR Art. 35. AI tools with access to email, documents, customer data or employee data often meet the threshold. If two or more of the nine criteria in the Article 29 Working Party guidelines are met, you should assume that a DPIA is required.
SaaS limitation of liability: what holds up under Norwegian law?
A SaaS limitation of liability is, as a rule, valid between businesses under Norwegian law. A liability cap and an exclusion of indirect loss normally hold, but as a starting point they do not protect the supplier against wilful misconduct or gross negligence. Unusual and onerous terms may also fall away as not accepted, be read restrictively or be adjusted under the Contracts Act § 36.
Your secrets in ChatGPT: can you lose protection for trade secrets?
Trade secrets are only protected if the business has taken reasonable steps to keep them secret. One employee pasting a confidential document into ChatGPT does not normally remove that protection. But if the business lets employees use AI tools freely, without rules and without an enterprise agreement, it becomes hard to show reasonable steps when the secret later has to be enforced.
Vibe lawyering: what is the risk when management drafts contracts with AI?
Vibe lawyering means managers and specialists producing contracts with AI without legal review. The contract binds the company in full, even when it rests on foreign concepts, hallucinated references or liability rules that do not work under Norwegian law. AI can be used for simple agreements, but not without review when a lot is at stake.
The legal framework
- Norwegian Damages Act (skadeserstatningsloven)lov
- Norwegian Contracts Act (avtaleloven)lov
- Norwegian Sale of Goods Act (kjøpsloven)lov
- Norwegian Product Liability Act (produktansvarsloven)lov
- Product Liability Directive (EU) 2024/2853EU
- Artificial Intelligence Act, Regulation (EU) 2024/1689EU
- General Data Protection Regulation (EU) 2016/679EU
- Norwegian Dispute Act (tvisteloven)lov
- Norwegian Private Limited Liability Companies Act (aksjeloven)lov
- Norwegian Code of Conduct for Lawyers (Regler for god advokatskikk), annex 1 to the Lawyers Regulationsforskrift
- Norwegian Working Environment Act (arbeidsmiljøloven)lov
- Regulation on employer access to email accounts and other electronically stored material (e-postforskriften)forskrift
- Norwegian Personal Data Act (personopplysningsloven)lov
- Norwegian Financial Supervision Act (finanstilsynsloven)lov
- Norwegian Consumer Purchases Act (forbrukerkjøpsloven)lov
- Norwegian Marketing Control Act (markedsføringsloven)lov
- Regulation (EU) 2026/1744 (Digital Omnibus on AI)EU
- Norwegian Copyright Act (åndsverkloven)lov
- Norwegian Trade Secrets Act (forretningshemmelighetsloven)lov