Web accessibility law in Norway: who it covers

Norway requires both private and public bodies to make their websites accessible. We read the law, the regulation and the regulator's guidance to set out who is covered and what they have to do.

This is general information and not legal advice. If a decision depends on it, read the texts linked here or ask a lawyer. Translations from Norwegian are our own.

Who the rules cover

Section 18 of the Equality and Anti-Discrimination Act (likestillings- og diskrimineringsloven) gives “public and private bodies” a duty of universal design for their main ICT solutions aimed at or made available to users. The regulation on universal design of ICT solutions (forskrift om universell utforming av IKT-løsninger) fills in the detail, and its § 2 limits the duty to web solutions, including digital learning materials, and self-service machines.

The regulator is Tilsynet for universell utforming av IKT (Uu-tilsynet), part of Digitaliseringsdirektoratet, and it says the rules apply “regardless of how many employees the business has, its turnover or its form of organisation”. Its examples include plumbers, architects and sports clubs. Apps count if they need an internet connection at least once after download to do their job.

The duty applies to a main solution (hovedløsning), which § 3 defines as ICT that is an integrated part of how the business informs the public and offers its services. These fall outside it:

private individuals’ own homepages and social media profiles, according to the regulator
tools staff use to do their work (§ 2), apart from the public sector intranets in the table below
solutions within the scope of the Broadcasting Act (§ 2)

Which WCAG criteria apply

Section 4 says private web solutions must at least follow WCAG 2.0 at levels A and AA, leaving out three criteria on captions and audio description for recorded and live media. Section 4b treats a public body as compliant if it conforms to EN 301 549 V3.2.1. The regulator counts that as 48 of the 78 criteria in WCAG 2.1.

Requirements for private and public bodies in Norway
Requirement	Private bodies	Public bodies
Rule	Regulation § 4	Regulation § 4b
Standard	WCAG 2.0, levels A and AA, without 1.2.3, 1.2.4 and 1.2.5, or equivalent	EN 301 549 V3.2.1 (2021-03), in practice WCAG 2.1
Criteria for websites	35	48 of 78
Criteria for apps	29	42
Audio description of recorded video	Not required	Video published after 1 February 2024, with exceptions for schools and kindergartens
Intranet and extranet	Exempt	Content published or substantially revised after 1 February 2023
Accessibility statement	Not required, as a rule	Required, § 4e
If the burden is too high	Apply for a dispensation, § 10	Assess it yourself and say so in the statement

The regulator keeps a list of every criterion that can be filtered by sector and type of solution. Text that resizes properly, criterion 1.4.4, is required in both sectors, and we measured which CSS passes in our article on accessible font sizing.

WCAG 2.2 is not in the regulation, which still names WCAG 2.0 and a 2021 edition of EN 301 549. The regulator wrote in November 2023 that WCAG 2.2 “is not part of the rules now” and that any change depends on whether the EU adds it to EN 301 549. The same page says criterion 4.1.1 Parsing, which WCAG 2.2 removed, still has to be met.

Dotted pixel art of green northern lights curving across a dark sky above a black horizon.

Exceptions and the burden test

Section 4c exempts some content: document formats published before 1 February 2022 unless needed for an active administrative process, live video and audio, online maps (navigation maps need an accessible alternative for the essential information), third-party content outside your control, some reproductions of cultural heritage objects, and archives. The regulator applies these to both sectors and says the bar for third-party content is high and that you must be able to document it.

Section 18 also lifts the duty where it would be a disproportionate burden (uforholdsmessig stor byrde). The law weighs the effect of removing the barriers, the nature of the business, the cost, and the size and resources of the business. In the regulator’s words, “the disadvantages of the requirements must be substantially greater than the benefits of following them”.

The accessibility statement

Section 4e requires public bodies to publish a statement through the central service run by Digitaliseringsdirektoratet and to update it at least once a year. It must explain which content is inaccessible and why, describe accessible alternatives where they exist, link to a feedback function anyone can use, and link to the enforcement procedure with information on the right to complain. It goes on the website, and for an app it can go with the download information instead.

Private bodies are outside this as a rule. The regulator reads “public sector” as it is read in the public procurement rules, so a company bound by those rules needs a statement. So does a private school entitled to state grants.

What a website owner has to do

Work out which column you are in. If you are bound by public procurement rules, read the public one.
Test your pages against the regulator’s list for your sector. Our guide on what to test covers browsers and devices.
Write conformance into contracts with agencies and platforms. The regulator says a supplier’s responsibility toward you stops at what the contract covers.
Keep records. Section 5 requires you to be able to document compliance, who is responsible and which standards you used.
Keep working on it. Section 19 a of the Act tells public and private bodies to work actively and purposefully on ICT accessibility.
If you are a public body, publish the statement and update it every year.

How the rules are enforced

Under § 36 of the Act, Digitaliseringsdirektoratet supervises compliance, can order a business to fix breaches, and can impose a coercive fine (tvangsmulkt) if the deadline passes. Section 7 of the regulation sets it as a running daily fine.

The regulator’s process starts with at least 14 days’ notice before testing. A preliminary report follows within three weeks, and the business has one week to respond. The final report comes with an order and eight weeks to fix the breaches. If a retest still finds them, the regulator sets a new deadline, usually ten working days, and the daily fine runs after that. The amount depends on user numbers, how serious the errors are, the cost of fixing them, and the turnover and size of the business. Orders and fines can be appealed.

The regulator’s results page counts 93 websites and apps checked, 91 with breaches, 22 that led to a fine decision and two where a fine ran. One recent case is Helseplattformen AS, which runs the HelsaMi health service. Inspectors found 119 errors in June 2025 and 64 remained after the deadline on 8 December. The regulator set the fine at NOK 50,000 a day and it ran for two days before a retest on 23 December found the rest fixed. Earlier, in March 2023, five public bodies were ordered to publish a missing statement or risk NOK 5,000 a day.

A breach of § 18 also counts as discrimination under § 12 of the Act, and § 37 puts the burden of proof on the business once the facts give grounds to believe a breach has happened. The Discrimination Tribunal enforces the Act apart from the sections excluded in § 7 of the Ombud Act, and § 18 is not one of them.

The European Accessibility Act

Norway had not implemented it when we checked on 8 November 2026.

The regulator’s page, last changed on 1 October 2025, says the Act “has not yet been taken into the EEA Agreement and is therefore not implemented in Norwegian law either”, and that the timing is unclear.
EFTA’s EEA-Lex factsheet for Directive (EU) 2019/882 describes it as under scrutiny by Iceland, Liechtenstein and Norway and shows no Joint Committee decision.
The Lovdata texts of the Act and the regulation do not mention the directive. The regulation’s only EEA reference is to the Web Accessibility Directive, (EU) 2016/2102.
The ministry’s consultation on implementing it ran from 7 June to 7 October 2021 and is marked as finished. We found no bill or regulation after it.

In February 2025 the regulator advised that businesses selling into the EU should adapt now, since EU rules apply there from 28 June 2025, and that businesses active only in Norway need not act on it yet but must still follow the regulation above. Our article on the European Accessibility Act covers what it asks of online shops.

How the rules built up

The regulation took effect on 1 July 2013. Section 11 gave new solutions 12 months and existing ones until 1 January 2021. Public bodies moved to WCAG 2.1 from 1 February 2023, according to the regulator, following the EU Web Accessibility Directive. The private sector stayed at its 35 criteria.

Common questions

Does a small business have to comply?

Yes, if the site is how it informs the public or offers its services. There is no minimum size.

Are PDFs covered?

Document formats published before 1 February 2022 are exempt unless they are needed for an active administrative process. Section 4c gives no such exemption for later documents.

Who is responsible if an agency built the site?

You are. The regulator says the business “is responsible for following the rules, even if it uses services from a third party”.

Sources

Where this comes from: we read each source below on 8 November 2026, and the European Accessibility Act status is as of that date. Lovdata showed the regulation as last amended by FOR-2023-01-17-87, in force from 1 February 2023, and the Act as last amended by LOV-2024-06-14-33, in force from 1 July 2024. This article was prepared with help from AI.