Accessibility laws · Norway

Norway: Universal Design of ICT

Norway does something no other country on this site does. Every time its regulator audits a website, it publishes the report, naming the organisation, the pages tested, the rules broken, and each individual finding. It runs a second public register where public bodies file their accessibility statements. So Norwegian enforcement is a record you can read rather than a rumour you hear, and the fines behind it accrue for every day a site stays broken.

Private-sector baseline: 2.0 AA
Public sector since 2023: 2.1 AA
Coercive fines accrue: Daily
Duty began (new sites): 2014

What the law is

The Regulations on Universal Design of ICT were approved on 21 June 2013 and took effect on 1 July 2013, under the Equality and Anti-Discrimination Act. New solutions had to be universally designed from 1 July 2014. The education and training sector ran on its own date of 1 January 2019. Every existing solution was captured from 1 January 2021. No grandfathering is left. What makes Norway unusual is that all of this reaches private business exactly as it reaches government, whatever your employee count, your turnover, or how you are incorporated. The test is whether the solution supports your general functions, is aimed at residents or customers in Norway, and works as an important channel for information or services.

Two tiers run side by side here, and mixing them up is the standard mistake. Private-sector websites sit at WCAG 2.0 Level A and AA, with three success criteria excepted by name and number. Those are 1.2.3 Audio Description or Media Alternative (Prerecorded), 1.2.4 Captions (Live), and 1.2.5 Audio Description (Prerecorded). Public broadcasters sit on that same private-sector standard, which catches out anyone who assumes the state broadcaster gets the stricter rule. Public bodies sit higher, on EN 301 549 V3.2.1 from March 2021. The regulation never uses the words WCAG 2.1. It names the European standard, and that standard carries WCAG 2.1 Level AA, which is why every guide reports the public-sector duty in WCAG terms.

One fact catches European readers out every time. The European Accessibility Act became applicable across the EU on 28 June 2025, and it is not in Norwegian law. Norway is in the EEA rather than the EU, and bringing the Act into the EEA agreement has been delayed, so as of 2026 it has not happened. The practical result is that one product can face WCAG 2.0 AA under the Norwegian regulation and WCAG 2.1 AA through EN 301 549 in the EU next door. Norway's private-sector bar was ahead of Europe's for a decade and now sits behind it. The regulator and the ministry have consulted on raising it. Until they do, the private sector stays on WCAG 2.0 Level AA, and anyone telling you otherwise is ahead of the law.

This applies to you if…

Your website, app, or self-service machine is aimed at the public in Norway. Company size never enters into it, and neither does turnover or legal form. If your business is established outside Norway, the scope test still points at who the solution is directed at. But we should say this plainly. We found no primary text on extraterritorial reach, and no enforcement action against a foreign-established company. Treat it as probable rather than settled.
You are a Norwegian public body, which puts you in the higher tier with a published accessibility statement to maintain and a feedback route to keep open.
You run a self-service machine or you publish digital learning materials, both of which Norway names on purpose. Ticket machines and kiosks are in scope, and so is edtech, which the regulation defines as web-based pedagogical tools developed to support learning activities. Norway is the only jurisdiction on this site that regulates learning materials by name.
You want to know what falls outside. Social media used for non-commercial purposes is excluded. Workplace ICT systems are largely outside the regulation, with exceptions. And so are Svalbard, continental shelf installations, and Norwegian vessels and aircraft when they are outside Norwegian territory.

What it technically requires

Private-sector sites reach WCAG 2.0 Level A and AA, minus those three excepted criteria. The trigger for a rebuild is worth knowing, because the regulation defines a new ICT solution as a complete technical replacement, a version upgrade, or a major change to code or appearance. That definition is broad enough that almost nothing has slipped past it in twelve years.
Public-sector sites conform to EN 301 549 V3.2.1, and two extra dates hang off that duty. Intranet and extranet content has to meet universal design where it was published or substantially revised after 1 February 2023, which means Norwegian public bodies owe accessibility to their own staff and not only to the public. And prerecorded video published after 1 February 2024 needs audio description, with schools and kindergartens excused except for their critical administrative functions.
Public bodies publish an accessibility statement, and Norway is specific about what goes in it. Name the content that is not universally designed and say why, give the accessible alternatives where they exist, link to a way for people to report a barrier, and link to the complaint procedures. Update it at least once a year, and publish it on the website or alongside the mobile app download information. Those statements go into uustatus.no, a national register, so a Norwegian public body's own declared conformance gaps are public and searchable. The statement documents performance against the 48 success criteria the Norwegian rules require of a public-sector web solution, which is the regulator's own count rather than WCAG's.
Self-service machines are covered, and WCAG is not the standard for them. The regulation points at CEN/TS 15291:2006, the NS-EN 1332 series, NS-EN ISO 9241-20:2009, and the ISO 20282 series instead. So a WCAG audit of your website says nothing about your ticket machine, and a vendor who tells you one covers the other has not read the regulation.

All roads lead to WCAG. Start with Level AA, the legal standard or the full 55-rule library. Unfamiliar term along the way? The A to Z glossary decodes it.

This law expects a published accessibility statement, and regulators check for it first. Generate yours free →

How it is enforced

Enforcement sits with the Norwegian Digitalisation Agency, working through the Authority for Universal Design of ICT, which everyone calls uutilsynet. It inspects, it issues compliance orders with deadlines attached, and when a deadline passes it imposes a coercive fine that accrues for every day the errors stay in place. Decisions can be appealed to the ministry. Norway also reports to the EFTA Surveillance Authority each year using the EU's own monitoring methodology, which is why Norwegian public-sector conformance data exists at all.

Every audit ends in a public report. uutilsynet publishes them, naming the organisation, the URLs tested, the requirements breached, and each individual finding. Norwegian accessibility enforcement is open data, and the detail is what makes it unusual. You can read what a real regulator found on a real site, error by error, before anyone ever audits yours. The uustatus.no register alongside it does a job the Dutch register also does, so that half is not unique. The named, itemised audit report is.

The HelsaMi case is the whole mechanism in one story, and every figure in it comes from the regulator's own record. Helseplattformen AS runs the HelsaMi health portal for roughly 425,000 inhabitants of central Norway. uutilsynet tested it from 29 April to 27 June 2025 and published the report on 19 August, covering the website including its logged-in pages, and expressly not covering the downloadable mobile app. Testing ran against WCAG 2.1 across 19 pages using 22 test rules. It found breaches in 12 of the 14 requirements tested. Those breaches touched 14 of the 48 success criteria, and the closing notice counts 119 individual errors.

Then the clock started, and this part is worth reading twice. The correction deadline expired on 8 December 2025 with 64 errors left, 17 of them moderate and 3 with serious consequences for users. On 9 December uutilsynet set a final deadline of noon on 19 December and a coercive fine of NOK 50,000 per day. The retest on 19 December found 6 errors still standing, so the fines began on 20 December. A retest on 23 December found them fixed, the supervision closed, and the fines had run two days for a total of NOK 100,000. That fine was built to be escaped rather than collected. And what it nearly cost was ordinary work. The findings were low contrast between text and background, missing or inadequate image descriptions, form fields without proper labels or feedback, and symbols with no text to explain them.

Key dates

Jul 1, 2014New ICT solutions must be universally designed
Jan 1, 2021All existing solutions covered
Feb 1, 2023Public sector: WCAG 2.1 AA + accessibility statement

What to do about it

Every obligation on this page is measured against WCAG, so the first step is knowing where you actually stand. Run the free 10-page scan for the machine-checkable slice. For the rest, we review the key journeys with an expert and a real blind screen-reader user, then attach a screenshot and a fix to every finding. $499, 5 business days.

Order your audit Run the free scan

Primary sources

Other laws

Related on this site

What to read next, and the terms this page uses.

Orientation only, current as of August 2026. Not legal advice, and no attorney-client relationship is created. For your specific situation, talk to your own lawyer.