English 
Norsk 
Polski 
Lietuvių kalba 
Artificial intelligence is already in use in most Norwegian businesses – and the regulations that will set clearer frameworks for the use of such tools are coming soon. The AI Act will set specific requirements for employers who use AI, and the preparation time is shorter than many think.
What is the AI Act?
The EU AI Act (Regulation 2024/1689) is the world's first comprehensive legislation on artificial intelligence, based on a risk-based approach where requirements are scaled according to the system's risk to individuals and society. The AI Act is the Norwegian legislation that will implement the regulation into Norwegian law through the EEA Agreement, with Nkom as the coordinating supervisory authority.
When does the law come into force?
The AI Act was originally planned to come into force in Norway in August 2026 but is now expected to apply from August 2027. The delay is due to two factors: the EEA negotiations between Norway, Iceland, Liechtenstein and the EU have taken longer than expected, and the EU itself has proposed to postpone its own deadlines through the so-called «Digital Omnibus» package. Note that the prohibition rules in Article 5 and the AI literacy requirement (Article 4) are not affected by the postponement and already apply in the EU.
What does the law mean to you as an employer?
Any employer using AI tools in their business is considered an "operator" (user) under the regulations – with independent duties. This applies regardless of the type of AI tool used. Particularly relevant is that the use of AI for screening, ranking, or assessing job applicants will fall under the high-risk category, with requirements for documentation, explainability, and human oversight. The law also requires AI competence for all employees involved in the use of AI systems. Additionally, there are employment law dimensions: the implementation of AI tools may trigger a duty to consult under the Working Environment Act, requirements for training, and must be considered in cases of dismissal and redundancies.
Start preparations now
It may be wise to prepare your business for the AI Act now, so that the company is compliant with the law from day one. It is therefore advisable to map out which AI systems are used, clarify whether the company is an operator or a provider, risk-classify the systems, and carry out a GAP analysis. Businesses that start now are better positioned – both regulatorily and strategically.
Halvorsen Law Firm assists employers in navigating the intersection of artificial intelligence, employment law, and technology regulation. Get in touch for an initial assessment of how AI legislation affects your business.
Frequently asked questions (FAQ)
Does the AI Act already apply in Norway?
Not fully. The AI Act has not yet been formally adopted into Norwegian law and is not expected to enter into force before August 2027. However, Norwegian businesses operating in EU countries or supplying to EU customers may already be affected by the prohibition rules in Article 5, which have applied in the EU since February 2025. The requirement for AI expertise among employees (Article 4) likewise already applies in the EU and will impact Norwegian businesses as soon as the law is incorporated into the EEA agreement.
Et højrisiko KI-system er et AI-system, der kan forårsage alvorlige skader på et individs sundhed, sikkerhed, grundlæggende rettigheder eller et betydeligt miljømæssigt tab.
A high-risk AI system is an AI system that involves a high risk to individuals' health, safety, or fundamental rights. For employers, it is particularly relevant that the use of AI in recruitment – including screening, ranking, and assessing job applicants – typically falls into this category. High-risk systems are lawful to use, but they impose strict requirements regarding documentation, data quality, transparency, explainability, and human oversight. Fines for breaching these requirements can amount to up to €15 million.
Are we covered by the law even if we are «just using» an AI tool?
Yes. The AI Act does not exclusively target technology companies and developers. Any business that uses AI systems in its own operations – for example, an HR tool, a customer service chatbot, or an analysis tool – is considered an deployer and is subject to independent obligations under the regulations. The role of deployer triggers, among other things, requirements for AI competence, internal governance, and, for public sector organisations, a duty to carry out a fundamental rights impact assessment (FRIA) before high-risk systems are deployed.
What should we do now as an employer?
The most important first step is mapping: which AI systems are used within the business, and for what purposes? After that, you should clarify the business's role under the regulation, conduct a preliminary risk classification, and begin working on AI competence among relevant employees. A GAP analysis will highlight which adjustments are necessary leading up to the effective date. The law firm Halvorsen & Co assists with all these steps.
Contact person
