Norway: Norwegian Data Protection Authority submitted consultation statement on proposed Act on Artificial Intelligence implementing EU Artificial Intelligence Act (EU Regulation 2024/1684)

On 29 September 2025, the Norwegian Data Protection Authority (Datatilsynet) submitted a consultation statement to the Ministry of Digitalisation and Public Governance on the draft Act on Artificial Intelligence, which implements the European Union’s Artificial Intelligence Regulation (Regulation (EU) 2024/1684) into Norwegian law. The Authority urged full incorporation of the Regulation to ensure legal certainty and equal protection for individuals. It requested clarification of jurisdictional rules for cross-border and domestic AI use and expressed readiness to serve as the market surveillance authority for high-risk AI systems in law enforcement, contingent on receiving additional resources to fulfil these duties. Datatilsynet emphasised that its statutory independence must be preserved within cooperation structures and called for an independent, expert appeal body with the power for market authorities to seek judicial review. It also proposed a general ban on biometric remote identification, including for commercial use, citing serious privacy and human rights concerns. The Authority further sought confirmation that coercive fines may apply regardless of cross-border activity, recommended a legally mandated list of national authorities responsible for fundamental rights oversight, and requested clear rules for information sharing among supervisory bodies to ensure effective and consistent enforcement.