The EU AI Act for Nordic and Icelandic companies

The EU AI Act already applies to Nordic companies in Denmark, Finland and Sweden, and parts of it have been in force since February 2025. For companies in Iceland and Norway the picture is different, because the Act reaches them through the EEA Agreement, and that step is not yet complete. This post sets out what is confirmed as of 2 November 2026, what changed with the EU's AI Omnibus, and three steps any company can take now.

Which dates are already in force?

The European Commission's AI Act page gives this timeline:

1. 1 August 2024: the Act entered into force.
2. 2 February 2025: the bans on prohibited practices and the AI literacy duty apply. We covered the bans in an earlier post.
3. 2 August 2025: rules for general-purpose AI models and the governance set-up apply.
4. 2 August 2026: the Act became generally applicable, with some exceptions. National authorities and the AI Office now supervise and enforce it. Transparency rules, such as telling people they are talking to a chatbot, also took effect in August 2026.

What did the AI Omnibus change?

In November 2025 the Commission proposed a set of changes, known as the Digital Omnibus on AI. The European Parliament's legislative train page lists it as adopted: Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026. The Commission says it entered into force on 27 July 2026.

The main changes to dates are:

• High-risk systems listed in Annex III, such as AI used in biometrics, education or employment, now apply from 2 December 2027 instead of August 2026.
• High-risk AI inside regulated products (Annex I), such as machinery, now applies from 2 August 2028.
• Marking AI-generated content: providers whose systems were on the market before 2 August 2026 have until 2 December 2026.
• A ninth ban, on apps that create non-consensual sexual images or child sexual abuse material, applies from December 2026.

The Omnibus also extends the lighter rules for SMEs to small mid-cap companies, and widens access to regulatory sandboxes.

Does the AI Act apply in Iceland and Norway?

Not yet directly, on what we could confirm. Iceland, Norway and Liechtenstein are in the EEA but not the EU. EFTA explains that an EU act must be incorporated into the EEA Agreement by a decision of the EEA Joint Committee before it applies there. Some decisions also need approval by national parliaments before they take effect.

EFTA's EEA-Lex entry for the AI Act describes it as "under scrutiny for incorporation into the EEA Agreement by Iceland, Liechtenstein and Norway". We found no adopted Joint Committee decision. These points remain unconfirmed:

• When the Act will be incorporated, and from what date it will apply in Iceland and Norway.
• Whether the Omnibus changes will be incorporated at the same time.
• Which Icelandic authority will supervise it.

That doesn't mean Icelandic and Norwegian companies can ignore it. Article 2 covers providers that place AI systems on the EU market, wherever they are based. It also covers providers and deployers outside the EU when the system's output is used in the EU. If you sell an AI product to customers in Sweden or Germany, the Act already reaches you.

Which risk level is your AI in?

The Act sorts AI into four levels:

1. Unacceptable risk: banned, such as social scoring.
2. High risk: allowed with strict duties on risk management, data, logging, documentation and human oversight. CV screening and credit scoring are examples.
3. Transparency risk: allowed if people are told, such as chatbots and deepfakes.
4. Minimal risk: no specific rules. The Commission says most AI in use today falls here.

Most business tools, such as forecasting stock or drafting internal text, land in the bottom two levels.

What should a company do this quarter?

Three steps work under any timeline:

1. List every AI tool in use. Include bought software with AI features, not just what you built. Note who uses it and for what.
2. Sort each one by risk. Most will be minimal. Flag anything that touches hiring, credit, education or access to services, and anything customers talk to directly.
3. Train the people using them. The AI literacy duty has applied in the EU since February 2025. Short, role-specific training is a sensible baseline everywhere.

For anything that looks high-risk, get proper legal advice. The 2027 date gives time, but documentation and data work take months.

Where do we fit?

We signed up to the EU AI Pact, and in 2024 we formed an AI Act compliance partnership with AI&Partners. We can help you build the inventory, check the data behind each system and set up monitoring. If you want a second pair of eyes on your list, get in touch.

This post is general information, not legal advice.