What does the EU AI Act mean for Norwegian businesses? A practical guide and checklist

New parts of the EU AI Act have applied since 2 August 2026, including the requirement that AI-generated content is clearly labelled. Norway has not adopted the rules yet, and that makes it tempting to sit back. I would be careful with that. Here is what actually applies, who it affects, and a checklist you can work through this week.

In short: does the AI Act apply to you?

If you sell into the EU, have customers in the EU or bid for contracts alongside EU companies, the requirements already apply to you. If you sell only in Norway, the rules have not formally been adopted yet, but customers and partners can start asking for them before the law does.

We get a lot of questions about this at the moment, both from clients and after our video on the subject took off on TikTok. So let us do it properly.

What happened on 2 August 2026?

That is when the transparency requirements in the EU AI Act started to apply across the EU. In practice it means three things for ordinary businesses:

• Content created or manipulated with AI must be clearly labelled. That covers images, video and audio, and in some cases text as well.

• Chatbots must tell people they are talking to a machine.

• Deepfakes must always be labelled.

Note that this is not only about content that is 100 % generated by AI. Content that has been substantially produced with the help of AI is covered too. Ads, banners and images on websites are typical examples.

The stick, as usual, is fines. Breaches of the transparency requirements can reach 15 million euros or 3% of global turnover. Nobody yet knows how hard this will be enforced in practice, and the requirements are about openness, not prohibition.

Norwegian law is delayed. The market is not.

Norway is adopting the AI Act through the EEA, and that process is not finished. Many Norwegian business owners read that as permission to wait.

The practical reality is different. If you sell to Sweden, Denmark or other EU countries, the supervisory authorities there can enforce the rules against you now. And at home we already see larger companies and public tenders starting to ask their suppliers about AI use, data processing and labelling.

The biggest risk is not the fines

Most small and medium-sized businesses do not build their own AI. They use ChatGPT, Claude, Gemini, Copilot, AI chat on the website and AI in their marketing. So the question is not whether you use AI, but whether you use it in a way your customers can trust.

For a typical Norwegian SMB the real risk is losing a tender, losing a major customer, or having no answer when someone asks which AI tools you use, where the data is processed and who has access.

In other words, this is about trust, not only about law.

The checklist: four steps you can take now

The good news first: for most Norwegian SMBs this is entirely manageable. Here is how to go about it:

1. Map your AI use. Where do you actually use AI today? Text, images, chatbot, customer service, analysis. Write the list down. Most people are surprised by how long it is.

2. Classify it. Is any of what you do high-risk under the regulation? AI used in recruitment or credit scoring, for example. Most SMBs land outside the high-risk categories, but you need to know that.

3. Document human oversight. Who quality-checks what the AI produces before it goes out? A simple document describing the routine does a lot.

4. Check your suppliers. Do your tools and agencies use AI under the hood? Ask them. You are responsible for what is published in your name.

What about your marketing?

This is where most businesses meet the AI Act first. If you use AI-generated images in ads and on your website, you should establish a labelling routine now. The same goes for AI chat on the website: a simple line of text saying the user is talking to a bot is enough.

We use AI in content production every single day, both for ourselves and for our clients, and we have written more about how to use AI as a marketing manager. Our experience is that being open about it does not scare customers away. What damages trust is being caught hiding it. And if you want to know how your AI visibility is doing at the same time, the two are more closely connected than you might think.

Do not waste the waiting time

Norway will adopt the rules, but not right away: the government is aiming to put the bill before parliament in spring 2027. You can use that time in two ways: hope it blows over (it will not), or get control of how your business actually uses AI.

The bottom line: this is not only about avoiding fines. It is about being a business your customers dare to trust.

Frequently asked questions about the AI Act

Does the EU AI Act apply in Norway?

Not yet. Norway is adopting the regulation through the EEA Agreement, and the process is not finished. But if you sell to EU countries, the requirements already apply to you, and Norwegian customers and tenders can ask for the same things before the law is in place.

What has to be labelled as AI-generated content?

Images, video and audio created or substantially manipulated with AI must be clearly labelled. Deepfakes must always be labelled. In some cases it applies to text as well, particularly when it is published to inform the public.

Does the chatbot on my website have to say it is an AI?

Yes. The transparency requirements say users must be told when they are talking to a machine. A simple, visible line of text in the chat is sufficient.

What do I risk if I do not comply with the AI Act?

Fines can reach 15 million euros or 3% of global turnover. For most Norwegian SMBs the practical risk still lies elsewhere: lost tenders, lost customers and damaged trust when you cannot answer how you use AI.

Are ChatGPT and Copilot still allowed?

Yes. The AI Act does not ban ordinary AI tools. The requirements are about openness: people should know when they meet AI-generated content or talk to a machine.

What should a small business do first?

Start by mapping where you use AI today. Then check whether anything falls into the high-risk categories, document who quality-checks AI-produced content, and ask your suppliers about their AI use.