Iceland: technology regulation at a glance

Framework: EU Markets in Crypto-Assets Regulation (MiCA, Regulation (EU) 2023/1114) incorporated into the EEA Agreement; Act No. 140/2018 on Measures against Money Laundering and Terrorist Financing; Rules No. 152/2023 on Virtual Asset Service Providers. National competent authority: Central Bank of Iceland (Seðlabanki Íslands, which absorbed the former FME).

Iceland participates in the EEA, meaning EU MiCA rules apply domestically alongside the prior VASP registration regime established under Act No. 140/2018 and Rules No. 152/2023. Crypto-asset service providers operating before 30 December 2024 under national law benefit from a transitional grandfathering period running to 1 July 2026, after which full MiCA CASP authorisation from the Central Bank of Iceland is required. Crypto is legal, actively taxed, and exchanges must be registered or authorised.

Framework: AI Action Plan 2025-2027 (Ministry of Culture, Innovation and Higher Education); Persónuvernd (DPA) oversight under Act No. 90/2018 (GDPR implementation); EU AI Act pending EEA incorporation

Iceland has no standalone AI law. Its primary AI governance instrument is the government's AI Action Plan 2025-2027, a non-binding strategic document with 20 funded actions across five pillars. As an EEA EFTA state, Iceland is tracking the EU AI Act, which has not yet been formally incorporated into the EEA Agreement via Joint Committee decision, leaving Persónuvernd and existing GDPR-based rules as the operative regulatory framework for AI systems.

Framework: Act No. 90/2018 on Data Protection and Processing of Personal Data (implementing EU GDPR via EEA Agreement); supervised by Persónuvernd (Icelandic Data Protection Authority)

Iceland is a member of the European Economic Area (EEA) and, as such, the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) applies in full. Iceland implemented the GDPR domestically through Act No. 90/2018, which entered into force on 15 July 2018 and mirrors the GDPR's principles, obligations, and data-subject rights. Persónuvernd acts as the national supervisory authority and is a non-voting member of the European Data Protection Board (EDPB).

Framework: Icelandic law transposing EU PSD2 (Payment Services) and EMD2 (Electronic Money), plus Act on Financial Undertakings No. 161/2002; supervised by the Central Bank of Iceland (CBI/Seðlabanki) following absorption of the FME in 2020

Iceland, as an EEA member state, maintains a full licensing regime for payment institutions and electronic money institutions (EMIs) under national laws transposing EU PSD2 and EMD2, with the Central Bank of Iceland (CBI) acting as the sole supervisory authority since 2020. Licenses are passportable across all 30 EEA states. MiCA for crypto-assets entered an 18-month transitional phase in December 2024, with full authorisation required by July 2026, and DORA entered force in November 2025.

Framework: Directorate of Immigration (Útlendingastofnun) under the Aliens Act (Lög um útlendinga); the dedicated instrument is the Long-Term Visa for Remote Workers administered via island.is and work.iceland.is

Iceland operates a dedicated Long-Term Visa for Remote Workers, introduced in 2020, allowing non-EEA/EFTA nationals to reside in Iceland for up to 180 days while working remotely for employers or clients based outside Iceland. EEA/EFTA nationals exercise free-movement rights and require no visa. Iceland has no golden visa or residency-by-investment programme.

Framework: Media Act (No. 38/2011, amended), Act on Data Protection and Processing of Personal Data (No. 90/2018, GDPR-equivalent), domain-closure powers (2021 amendment to Electronic Communications Act); EU Digital Services Act (Regulation 2022/2065) pending EEA Agreement incorporation

Iceland maintains a broadly open internet with no state censorship, rated the world's freest online environment by Freedom House (94/100 in 2024 and 2025). Existing online safety rules derive from the Media Act (hate speech, incitement bans), GDPR-transposing data protection law, and a 2021 law empowering courts to shut down .is domains used for illegal content. The EU Digital Services Act, which would constitute a comprehensive regime, has not yet been incorporated into the EEA Agreement, so no DSA-equivalent national implementation is in force as of 2026.

Framework: Cyber-Security Act No. 78/2019 (Öryggi net- og upplýsingakerfa mikilvægra innviða), administered by the Electronic Communications Office of Iceland (ECOI/Fjarskiptastofa) and national CSIRT CERT-IS; NIS2 transposition amendment pending

Iceland has a comprehensive cybersecurity statute, Act No. 78/2019, which transposed the original EU NIS Directive into national law via its EEA membership, imposing cross-sector risk-management and incident-reporting duties on operators of essential services and digital service providers. The Electronic Communications Office (ECOI) and its national CSIRT, CERT-IS, are the competent enforcement bodies. As of May 2026, NIS2 transposition is still pending: Iceland plans to amend Act 78/2019 rather than enact entirely new legislation, but remains the only EEA state yet to publish a formal legislative draft.

Framework: Act on Private Limited Companies No. 138/1994 (Lög um einkahlutafélög); Act on Investment by Non-residents in Business Enterprises No. 34/1991; administered by Iceland Revenue and Customs (Skatturinn) via the Register of Enterprises (Fyrirtækjaskrá)

Iceland is broadly open to foreign business formation with no general prohibition on foreign ownership, though non-EEA investors face director residency constraints and several sectors impose ownership caps. The most common vehicle, the private limited company (ehf.), requires ISK 500,000 minimum paid-in capital and can be registered electronically in 3-5 business days, but all founding documents must be in Icelandic and electronic registration requires an Icelandic Electronic ID, creating practical friction for non-residents.