Denmark — Datatilsynet AI Guidance + EU AI Act: AI Compliance Requirements
Denmark's Datatilsynet (Data Protection Authority) has published detailed AI-specific guidance and conducted high-profile AI investigations, including fining Danish municipalities for unlawful pupil profiling AI. Denmark's National AI Strategy "AI i verdensklasse" focuses on responsible AI adoption in public services. Denmark has a strong AI research ecosystem (Pioneer Centre for AI) and is among the most AI-forward Nordic countries. All EU AI Act obligations apply.
Summary of publicly-available regulatory text as of 2026-08-22. Verify against current official sources before relying on this for compliance decisions. Not legal advice.
Key Facts
January 1, 2022
August 2, 2026
GDPR (Datatilsynet): up to €20M or 4% global turnover. EU AI Act: €35M or 7% global turnover.
What Your Business Must Do
3 compliance requirements identified. Critical requirements carry the highest risk of enforcement action.
EU AI Act Compliance (Mandatory)
CriticalDenmark is subject to the EU AI Act. Classify AI systems by risk. High-risk AI in Danish public administration, healthcare, and education requires conformity assessment and registration. Denmark's Business Authority (Erhvervsstyrelsen) serves as national market surveillance authority. NOTE: the EU AI Act high-risk (Annex III) conformity-assessment deadline was deferred EU-wide from 2026-08-02 to 2027-12-02 by the "Digital Omnibus" amendment, Regulation (EU) 2026/1744 (in force 2026-07-27) -- Article 50 transparency obligations still apply from 2026-08-02, but conformity assessment/technical documentation/registration for stand-alone high-risk systems is not due until 2027-12-02 (2028-08-02 for Annex I product-embedded high-risk systems).
Deadline: December 2, 2027
EU AI Act Art. 6, Annex III (high-risk classification); Art. 16 (provider obligations); Art. 43 (conformity assessment); Art. 26 (deployer obligations)Datatilsynet AI Guidance and GDPR Compliance
High PriorityDatatilsynet published detailed AI guidance covering: lawful basis for AI training (legitimate interest requires balancing test), consent requirements for behavioral profiling, DPIA obligations for high-risk AI processing, and disclosure requirements for automated decisions. Danish Datatilsynet has fined public and private sector organizations for AI-related GDPR violations.
Danish National AI Strategy Implementation
Medium PriorityDenmark's "AI i verdensklasse" national strategy creates public sector AI governance requirements. Organizations supplying AI to Danish government must document transparency, bias testing, and explainability. Private sector organizations should document compliance with Danish AI principles for public procurement eligibility and market credibility.
Who Does This Apply To?
Applies to: any organisation established in Denmark, and any organisation outside Denmark processing the personal data of Danish residents through AI systems — GDPR applies with extraterritorial reach (Art. 3), obligations attaching to the processing activity rather than company size, with no general small-business exemption. As an EU member state, Denmark is fully subject to the EU AI Act, with the Danish Business Authority (Erhvervsstyrelsen) serving as national market-surveillance authority: AI systems must be risk-classified, and high-risk AI in public administration, healthcare and education requires conformity assessment and registration. The Danish Datatilsynet requires a documented lawful basis for AI training (legitimate interest requires a balancing test), a DPIA for any AI making consequential decisions affecting more than a nominal number of Danish residents, explicit consent for special-category AI processing, and meaningful — not rubber-stamp — human review of automated decisions. Penalties reach €20M / 4% of global turnover under GDPR and €35M / 7% under the EU AI Act.
Recent Enforcement Actions
Against:
Recent Regulatory Guidance
Datatilsynet AI Guidance — Legal Basis and DPIA for AI Systems
Datatilsynet guidance covers: (1) legitimate interest for commercial AI requires a documented balancing test; (2) DPIA mandatory for any AI with >1,000 Danish users making consequential decisions; (3) special-category AI (health, biometrics, religion) requires explicit consent — no legitimate interest available; (4) human review must be meaningful — documented authority to reverse AI decisions.
Frequently Asked Questions
Does Denmark — Datatilsynet AI Guidance + EU AI Act apply to my business?
Denmark's Datatilsynet (Data Protection Authority) has published detailed AI-specific guidance and conducted high-profile AI investigations, including fining Danish municipalities for unlawful pupil profiling AI. Denmark's National AI Strategy "AI i… Use Aegis Firma's free scanner to get a personalized assessment in under 5 minutes.
What is the penalty for non-compliance?
The maximum penalty under Denmark — Datatilsynet AI Guidance + EU AI Act is: GDPR (Datatilsynet): up to €20M or 4% global turnover. EU AI Act: €35M or 7% global turnover.. Fines are typically scaled by company size, severity of violation, and whether violations were willful or accidental.
How do I comply with Denmark — Datatilsynet AI Guidance + EU AI Act?
The 3 requirements above cover the core obligations. The fastest path to compliance is: (1) conduct an AI risk assessment, (2) document your AI systems, (3) implement transparency disclosures where required. Aegis Firma generates all required documents automatically.
Official Source
https://www.datatilsynet.dk/english/artificial-intelligenceLast updated: 2026-08-22 — verify at source before relying on this information.
Don't leave compliance to chance
Aegis Firma scans your AI tools, tells you exactly which regulations apply, and generates all required documents — in 30 minutes.
Start your free compliance scan