Kort fortalt
In short: The AI Act applies in the EU, but it has not yet been incorporated into Norwegian law. Norwegian businesses that offer AI systems in the EU or use them there may still fall within the EU rules. Existing rules on privacy, discrimination and copyright continue to apply in Norway.
Two different rulebooks for Norwegian businesses
The EU Artificial Intelligence Act (AI Act) regulates the development, placing on the market and use of AI systems. It entered into force in the EU in 2024, but its requirements are being phased in. The main body of the Act has applied since 2 August 2026, with some requirements subject to separate transition dates.
Norway is not an EU member. The AI Act has been assessed as relevant to the EEA, but it has not yet been incorporated into the EEA Agreement or implemented in Norwegian law. In August, the Norwegian government said it would reopen consultation on a revised AI Act bill and aims to submit it to Parliament in spring 2027. No date has been set for when the rules will take effect in Norway.
This does not leave Norwegian businesses without rules. Privacy, employment and anti-discrimination, consumer protection and copyright laws already apply where relevant. The AI Act's specific requirements, however, are not yet Norwegian law.
When can EU rules reach a Norwegian company?
The Act can apply to organisations outside the EU. A Norwegian company should assess its position if it offers an AI system or general-purpose AI model on the EU market, or if the system's output is used in the EU. The rules distinguish between roles such as provider and deployer, and obligations depend on the role, system and use. Simply using a commercial AI tool internally in Norway does not automatically bring every AI Act requirement into play.
The Act uses a risk-based model, but “high-risk” is a specific legal category, not a label for every AI system with potentially serious consequences. Certain uses in employment, education, critical infrastructure, essential services, law enforcement and border management can fall into the category. Requirements vary depending on whether the organisation develops the system or deploys it; registration and conformity assessment do not apply in the same way to every actor.
The deadlines have changed
In the EU, prohibitions on certain AI practices have applied since February 2025. Requirements for providers of general-purpose AI models began in August 2025. The AI Omnibus has simplified AI literacy requirements and gives the European Commission and Member States a clearer role in promoting AI literacy. Since 2 August 2026, transparency rules have applied to certain AI systems: in specific cases, people must be told they are interacting with a chatbot or seeing a deepfake, and AI-generated content must be capable of machine-readable marking. There are limits and exceptions, including for some text under human editorial control.
The AI Omnibus entered into force in the EU on 27 July 2026 and moved several deadlines for high-risk systems. Requirements for certain uses, including employment and education, are scheduled to apply from 2 December 2027. For AI embedded in regulated products such as medical devices and machinery, the date is 2 August 2028. These EU dates are not Norwegian commencement dates.
What should a business do now?
Start by listing how your organisation uses AI and who supplies each system. Record what it is used for, who it affects, where its outputs are used, and whether your organisation develops, offers or deploys it. This helps separate activity in Norway from activity that may fall under EU rules.
If your organisation offers AI to customers in the EU or uses its outputs there, clarify its role under the Act and assess the relevant obligations, especially transparency, documentation and risk management. For high-risk systems, base the assessment on the specific use, not only the supplier's product description.
Regardless of market, businesses should control personal data, access, quality assurance and human accountability. These duties already follow from other laws and sound operations; the AI Act is not the only reason to do this work.
Norwegian authorities also recommend that businesses prepare for the national AI Act, even though it has not yet been passed. Follow the EEA incorporation process and the revised bill. Those steps—not the Brussels calendar alone—will determine when Norwegian rules take effect.
Sources
Norwegian government: revised AI Act bill to be consulted on again · KI Norge: guidance for businesses · European Commission: AI Act timeline · European Commission: enforcement and deadlines