What happened

Norwegian authorities invited organisations to comment on draft EU guidelines for classifying high-risk systems. At the same time, Council and Parliament had reached a provisional agreement to postpone application of several high-risk requirements.

The timetable was politically agreed, but final legal text still required adoption. Organisations could use the draft to test classification while recording the assumptions and version of the rules on which the assessment relied.

Legal status in Norway

The Norwegian government stated that high-risk rules would apply in Norway only after Parliament adopted a KI law and the amended regulation was incorporated into the EEA Agreement.

What the sources clarify

The draft guidance was intended to help draw the line between high-risk systems and systems outside those categories. At the same time, the timetable was only politically agreed on 7 May; final EU text still required adoption. Assessments therefore needed a source version and date. The work remained useful: record intended purpose, the decision affected, relevant groups, data and human oversight. If use changes from internal assistance to ranking applicants or deciding access to an essential service, classification must be reopened. A delayed deadline creates time for better evidence; it does not justify losing the inventory.

Organisations should use the delay to gather evidence that is expensive to recreate later: decision logic, dataset versions, validation results, responsibility and supplier changes. A simple change rule can require reclassification when purpose, affected group, decision effect or human oversight changes. Control then follows actual system development rather than only the procurement date.

Practical implications

A quarterly review should show systems still missing classification evidence and use changes that reopened assessment. Management can use the delay to close data and contract gaps while avoiding reliance on a guidance draft as though it were final text.

Sources

Norwegian Government: “Innspill til retningslinjer for høyrisiko-KI,” 26 May 2026.

Council of the European Union: “Council and Parliament agreement to streamline AI rules,” 7 May 2026.

For discussion

Which scenario should we exercise first?