KI Norway: Guidelines for the Responsible Development and Use of Artificial Intelligence in the Public Sector

AI Norway is the active, official main gateway for guidance on the responsible and innovative development and use of artificial intelligence. Digdir states that the content regarding artificial intelligence has been moved to ki.norge.no. AI Norway is organized under the Norwegian Digitalisation Agency and collaborates with, among others, the Norwegian Data Protection Authority and the Norwegian Communications Authority.

The former Digdir guide has been carried over into a broader and continuously updated collection of web guides. The central process guide, «How to succeed with AI,» follows the work from needs and risk assessment through procurement, development, and testing to implementation, operation, and management.

The guidance provides practical advice, but is not binding regulation and does not establish a separate legal basis for the use of AI. The organization must itself identify and comply with relevant requirements, including within privacy, information security, administrative law, archiving, procurement, and sector regulations.

When using AI for text drafting, summarization, or translation, verification of content, sources, language, and professional precision is still necessary. Generative AI should not be used alone as a basis for facts, legal assessments, or decisions with significant consequences.

The guideline does not regulate businesses and does not establish independent legal obligations. It provides recommendations on how businesses can work systematically with AI throughout its entire lifecycle – from the clarification of needs and framework conditions to procurement, testing, implementation, operation, and subsequent follow-up.

The content includes risk assessment, data quality, privacy, information security, responsibilities and roles, vendor management, human oversight, testing, and documentation, among other things. Which binding requirements apply must be assessed based on the area of use, the data being processed, and the role of the enterprise.

The guide translates overarching requirements for responsible AI use into concrete tasks and control points. It can help public sector entities identify legal, technical, and organizational risks before a solution is procured or put into operation.

This is particularly relevant when AI is used in case processing, communication, summarization, or translation. Such tools can produce convincing, yet incorrect or misleading content. The organization must therefore test the solution in its own context, ensure sufficient human oversight, and maintain necessary professional and linguistic expertise.