Norway opens automated decisions consultation to 6 October

Norway's Ministry of Finance opened a consultation on 13 August 2026 on amendments to the Financial Supervision Act governing automated decisions and the use of personal data in Finanstilsynet systems. Responses are due by 6 October 2026, and the proposal remains draft legislation rather than an operative supervisory power.

The official consultation says Finanstilsynet prepared the proposal. One limb would create a legal basis for the authority to make decisions affecting natural persons through fully automated processing. Any use of that basis would still sit within Norway's administrative-law rules, the Personal Data Act and the GDPR; publication of the consultation does not displace those safeguards.

The second limb concerns personal data used to develop and test IT systems. The proposed power is tied to cases in which obtaining fictitious or anonymised information would be impossible or disproportionately difficult. That threshold makes the draft narrower than a general permission to copy production data into a development environment whenever doing so is cheaper or faster.

The proposed condition also creates an evidence question for the authority: why substitute data cannot achieve the development or testing purpose in the particular system. A consultation response can address what documentation, access restrictions, retention limits and testing controls should accompany that conclusion without assuming that the final legislation will adopt any one safeguard.

The consultation also raises a possible regulation-making power in section 6-5. That power could support more detailed rules on case processing and the forms that automated decisions may take if Parliament later amends the Act. The Ministry has not attached an implementation date to that later stage, so it should not be entered in a compliance calendar as a fixed commencement event.

The immediate question is the legal design, not deployment. For financial institutions, the proposal matters because the affected systems would be operated by the supervisor rather than by a regulated firm. An automated supervisory or administrative decision can still affect a person, while the development-and-testing power may involve financial, identity or other sensitive data already held by Finanstilsynet. Consultation responses can therefore distinguish the statutory basis for a decision, the safeguards surrounding real-data use, documentation of why synthetic or anonymised data is inadequate and the review rights preserved by existing law.

The Ministry says consultation submissions will be public and posted on its website. It does not say that Finanstilsynet receives either proposed power on 6 October; that date closes the evidence-gathering stage. Any legislative proposal, parliamentary action and implementing regulation would be later steps and require their own official dates.

The paper therefore has two audiences. Privacy and public-law specialists can assess the statutory conditions for an automated decision affecting a person, while technology and security teams can test whether the proposed live-data exception is capable of being monitored and audited in practice. Neither workstream needs to wait for an assumed commencement date.

The next fixed milestone is 6 October 2026. Until the Ministry publishes its response or introduces legislation, the item should remain a policy consultation rather than be represented as a new rule for firms.