The EU AI Act Is Three Weeks Away. Here Is What Norwegian SMEs Actually Need To Do.

The EU AI Act's main compliance obligations land in August 2026. Three weeks. Most Norwegian SMEs are somewhere between confused and dismissive. Both responses make sense. There has been a lot of noise, much of it designed to sell consulting services rather than clarify anything. Here is the plain version.

You Are Probably Not High-Risk

The Act divides AI systems into four tiers. The vast majority of Norwegian small and medium businesses using standard tools (ChatGPT, Microsoft Copilot, automation platforms, AI-assisted scheduling or customer support) fall into the bottom two categories. This matters because the compliance burden for minimal-risk and limited-risk AI is low.

Prohibited AI: Systems that manipulate people through subliminal techniques, exploit vulnerabilities based on personal characteristics, enable mass social scoring, or perform real-time biometric identification in public spaces. If you are not building any of these, you are not in this category. Most businesses in Norway are not.

High-risk AI: Systems used in critical infrastructure, employment decisions (CV screening, performance scoring), credit scoring, access to public services, or safety-critical equipment. If you are using an AI tool that makes or significantly influences decisions about hiring, lending, or safety, you need to look closer. These systems require documentation, human oversight mechanisms, and in some cases conformity assessment before deployment.

Limited-risk AI: Chatbots and systems that interact with users. The main obligation here is transparency: users must know they are talking to an AI. If you run a customer-facing chatbot, you need a disclosure. That is manageable.

Minimal-risk AI: Everything else. Spam filters, AI-assisted writing tools, recommendation engines on your internal systems. No specific obligations beyond good practice.

A 30-Minute Self-Assessment

You do not need a lawyer for this. You need honest answers to three questions.

Step 1: List what AI systems your business actually uses. Not what is in the terms of service somewhere. What do employees actually use week to week? Include the obvious ones (Copilot, ChatGPT) and the less obvious (AI features built into your CRM, logistics software, hiring platform).

Step 2: For each system, ask: does this make or influence decisions about people? Employment, credit, access to services, safety systems. If yes, read the high-risk requirements. If no, you are almost certainly in minimal- or limited-risk.

Step 3: Check your chatbots and customer-facing AI. If you have any, add a disclosure. One sentence is enough: "You are chatting with an automated assistant." This is not a burden. It is something you should be doing anyway.

Most Norwegian SMEs will complete this in under 30 minutes and find they have nothing urgent to change. A small number will identify a system that needs closer examination. Either way, knowing is better than assuming.

What IPRESTANDA Helps With

If step two surfaces something that needs a closer look, or if you want to build the documentation and oversight frameworks that high-risk AI requires, that is the work IPRESTANDA does. Not compliance consulting for its own sake: operational AI systems designed from the start to be explainable, auditable, and appropriately supervised.

The August deadline is real. The panic is not necessary. Know where you are and act accordingly.

[Link to iprestanda.com/contact]

Original request: SIGNAL article brief — EU AI Act Norwegian SMEs 2026