Norway: technology regulation at a glance

Framework: Crypto Asset Act (Lov om kryptoeiendeler / Kryptoeiendelsloven), in force since 1 July 2025, incorporating EU Regulation 2023/1114 (MiCA) into Norwegian law via the EEA Agreement; supervised by Finanstilsynet (Norwegian FSA) under the Ministry of Finance. Tax treatment is governed by the General Tax Act and administered by Skatteetaten.

Crypto is legal in Norway and now governed by a comprehensive, in-force licensing regime. The Crypto Asset Act took effect on 1 July 2025, transposing MiCA into Norwegian law (Norway is an EEA, not EU, member), so issuers of asset-referenced tokens (ARTs) and e-money tokens (EMTs) and crypto-asset service providers (CASPs) must be authorised by Finanstilsynet or passport an EEA authorisation. The previous AML-only registration regime has been replaced; a transitional window for legacy VASPs was extended to 30 June 2026 pending MiCA authorisation decisions.

Framework: Proposed Norwegian Artificial Intelligence Act incorporating the EU AI Act (Regulation (EU) 2024/1689) into Norwegian law via the EEA Agreement; underpinned by the 2020 National Strategy for Artificial Intelligence. Lead ministry: Digitalisation and Public Governance (Digitaliserings- og forvaltningsdepartementet); proposed coordinating authority: Nkom.

Norway does not yet have a comprehensive AI law in force. The government published a consultation (30 June 2025) on a national AI Act that will transpose the EU AI Act into Norwegian law through the EEA Agreement, with entry into force targeted for summer/late 2026. Until then, AI is governed by the non-binding 2020 National Strategy for Artificial Intelligence plus existing sectoral and data-protection rules (GDPR/Datatilsynet).

Framework: Personal Data Act 2018 (personopplysningsloven), which incorporates the EU GDPR into Norwegian law via the EEA Agreement; supervised by Datatilsynet (the Norwegian Data Protection Authority).

Norway has a comprehensive, GDPR-based personal-data protection regime. As an EEA member, it incorporated the EU GDPR into national law through the Personal Data Act (personopplysningsloven), which entered into force on 20 July 2018 and adds Norwegian-specific adaptations. The independent supervisory authority is Datatilsynet, with appeals heard by the Privacy Appeals Board (Personvernnemnda) and ultimately the courts.

Framework: Financial Institutions Act (Finansforetaksloven, Act of 10 April 2015 No. 17) and accompanying Payment Services regulations implementing EU PSD2, supervised by Finanstilsynet (Financial Supervisory Authority of Norway), with the private-law side governed by the Financial Contracts Act (finansavtaleloven).

Norway operates a clear, EEA-aligned licensing regime for digital payments and fintech. Payment institutions and electronic money institutions must be licensed by Finanstilsynet under the Financial Institutions Act, which transposes PSD2/EMD2; the private-law and consumer-protection aspects (including PSD2 conduct rules and consumer credit) sit in the Financial Contracts Act. Open banking is live via PSD2 APIs, while the EU's newer Instant Payments Regulation and Payment Services Regulation are not yet incorporated into Norwegian law.

Framework: Immigration Act (Utlendingsloven) and Immigration Regulations, administered by the Norwegian Directorate of Immigration (UDI). EU/EEA nationals fall under EEA free-movement rules.

Norway has no dedicated digital-nomad or remote-work visa, and UDI states explicitly that there is no residence permit for remote work and that working remotely for a foreign employer is generally not a valid basis for residence on the mainland. Existing work-immigration routes (skilled worker, self-employed) require Norwegian employment, a Norwegian client/assignment, and recognised qualifications, so they do not serve a typical location-independent remote worker. EU/EEA citizens may live and work freely, and the Svalbard archipelago is visa-free but legally separate from mainland residency.

Framework: Proposed Act on Digital Services ('lov om digitale tjenester') implementing the EU Digital Services Act into Norwegian/EEA law, plus a separate proposed social-media age-limit bill; Nkom designated as national coordinator. Existing partial rules: e-Commerce Act intermediary liability and the Media Liability Act (medieansvarsloven).

Norway, an EEA (non-EU) state, does not yet have a comprehensive online-safety/platform-regulation regime in force; the EU Digital Services Act is being transposed via a proposed national Act on Digital Services that completed public consultation on 1 October 2025 and is expected to apply from summer 2026. A separate bill imposing a social-media age limit (access from 1 January of the year a child turns 16) with platform-side age-verification duties is heading to Parliament, though it is not expected to take effect before 2027. Until these enter into force, online activity is governed by partial rules: intermediary-liability provisions of the e-Commerce Act and the 2020 Media Liability Act.

Framework: Lov om digital sikkerhet (digitalsikkerhetsloven, Act 2023-12-20-108) and its implementing regulation (digitalsikkerhetsforskriften), supervised by the National Security Authority (Nasjonal sikkerhetsmyndighet, NSM); complemented by the national Security Act (sikkerhetsloven) for national-security functions.

Norway has a comprehensive horizontal cybersecurity regime: the Digital Security Act (digitalsikkerhetsloven) and its regulation entered into force on 1 October 2025, transposing the EU NIS1 directive and imposing risk-management and incident-reporting duties on providers of essential services and digital service providers. NSM (which hosts the national CERT/NCSC) is the supervisory authority and national incident-response body. NIS2 and the CER directive have not yet been transposed; a new law expected during 2026 is set to replace the current Act and broadly expand scope.

Framework: Norwegian Private Limited Liability Companies Act (Aksjeloven); company registration via the Brønnøysund Register Centre (Register of Business Enterprises / Foretaksregisteret) and the Altinn portal; residence/work permits administered by UDI for non-EU/EEA nationals.

Norway places no restrictions on foreign ownership, a foreigner may own 100% of a Norwegian private limited company (AS), and formation is fast and largely digital with a low NOK 30,000 minimum share capital. The main frictions for non-EU/EEA founders are a residence permit to actually work in the business and a rule that at least half the board and any general manager must reside in the EEA, the UK, or Switzerland. EU/EEA nationals face an easy, near-frictionless process; non-EEA nationals face additional immigration steps, making the overall picture moderate.