Norwegian Schools and the AI Act: The Gap Nobody Talks About

Introduction

I live in Norway. I work in transport. On the side, I read EU regulations and build compliance templates that small and medium businesses actually use.

Most people think the EU AI Act is about companies. Banks. Insurance. Recruitment AI. It is. But that’s not all.

Nobody talks about schools. And in Norway, that silence is louder.

What Brussels Already Published

In 2025, the European Commission and OECD launched an AI Literacy Framework for primary and secondary education. Not a draft. Not a proposal. A real framework designed for teachers, school leaders, and policymakers.

The Commission also updated its ethical AI guidance for teachers. Why? Because AI use in classrooms is now widespread enough to need rules.

ChatGPT for homework help. AI grading tools. Proctoring software. Personalized learning platforms. It’s everywhere.

So the EU knows this is happening. They published the framework. But here’s the critical gap: the AI Act itself does not require schools to teach AI literacy to students.

The Article 4 Paradox

Article 4 of the AI Act requires AI literacy for staff — teachers, IT administrators, the people who operate AI systems. It does not require AI literacy for the students who use those systems every day.

Consider the numbers:

77% of EU teens use generative AI (European Parliament, 2025)
They are 2x more likely than adults to use AI tools
AI literacy is not in any EU school curriculum
Not in Digital Decade 2030. Not in key competences.
The European Parliament’s own briefing says only “few Member States” introduced AI competences for children

That is the gap. And it’s massive.

What Norway Adds: The Datatilsynet Factor

Norway is not in the EU. We are EEA/EFTA. The AI Act applies through incorporation into EEA law, and that process takes time.

But here is where it gets interesting: Norway’s data protection authority, Datatilsynet, already has stricter rules for child data than the EU baseline.

Under Norwegian law, if a school deploys an AI tool that processes student data, a Data Protection Impact Assessment (DPIA) is required BEFORE deployment.

Not after. Not when someone asks. Before.

How many Norwegian schools did a DPIA before letting teachers use ChatGPT for grading essays?

I have asked around. The answer so far: almost none.

Education AI Is High-Risk

And here is the bigger issue. Education AI is high-risk under Annex III of the AI Act:

AI grading and assessment
AI proctoring during exams
AI admissions and placement decisions
AI monitoring of student behavior
AI “tutoring” that tracks performance and recommends paths

All of these trigger full compliance obligations:

Human oversight procedures
Bias testing and documentation
Transparency notices
Risk management systems

The AI Act says: if you use high-risk AI, you must have a human oversight procedure.

How many Norwegian schools have a human oversight procedure for their AI grading tool?

How many have documented the bias testing of their exam proctoring software?

I am not asking rhetorically. I genuinely want to know. Because I have not found one yet.

The Reality: A Scenario

So let’s put it together:

A Norwegian teacher uses ChatGPT to grade essays tomorrow.

No AI training
No DPIA
No parent notification
No oversight procedure
No documentation

The AI Act says this is high-risk and needs oversight.
Norwegian data law says DPIA is required.

Who checks? Nobody. Yet.

What Should Schools Do Now?

If you work in a Norwegian school, kommune, or education department, here is a practical starting point:

Inventory: List every AI tool currently used by staff or students
DPIA: Conduct a Data Protection Impact Assessment for each tool processing student data
Policy: Create an Acceptable Use Policy for AI tools
Transparency: Inform parents and students which AI tools are used and for what purpose
Oversight: Document human oversight procedures for high-risk AI use cases
Training: Ensure staff have sufficient AI literacy (Article 4 compliance)

Sources

EUR-Lex — Regulation (EU) 2024/1689 (full text)
European Commission — AI Literacy Framework for Education (2025)
European Commission — Updated Ethical AI Guidance for Teachers
European Parliament — ATAG/2025/769494 (Children and Generative AI)
Datatilsynet (NO) — Guidance on AI and child data protection
European Commission AI Office — Q&A on Article 4

This article is based on official documents only. It does not constitute legal advice. It reflects what the documents say and what they do not say.

About the Author

Aleš Frelih builds practical EU AI Act and GDPR compliance tools for SMEs through Kema. He lives in Oslo and works in transport compliance. He reads EU regulations so you don’t have to.

Free resource: 2-Minute EU AI Act Compliance Check — find out if your organization is affected.