Norway's Digital Security Act: scope and reporting
The Digital Security Act has applied since October 2025. Check the service definitions, exceptions and reporting rules for your category of provider.
The cover image is an AI-generated editorial illustration. Screens and documents are illustrative concepts.
Norway’s Digital Security Act and its regulation entered into force on 1 October 2025. They implement NIS1, while Norwegian NIS2 implementation is a separate process. NSM explains the distinction.
The immediate task is to determine whether the services your business provides fall within the current law.
Check the service definition and exceptions
The law addresses providers of essential services and providers of specified digital services. Sector descriptions alone do not settle scope: the regulation defines categories and conditions.
Essential services include defined activities in areas such as energy, transport, health and digital infrastructure. Digital services include online marketplaces, search engines and cloud services.
Small-provider exceptions can apply to the digital-service category. Do not assume that every small cloud business is covered, or that every small essential-service provider is exempt. Use the regulation’s scope provisions and record the conclusion.
Assign the security work
Identify the systems needed to deliver the covered service, their risks and responsible owners. Maintain proportionate security measures and documentation that can support supervision.
Check registration and contact requirements for your category. NSM’s guidance hub includes guidance for providers and notification of essential services.
Use the right reporting clock
Reporting depends on the category of provider and the incident’s impact. For essential-service providers, the regulation includes a latest initial notification time of 24 hours, followed by further reporting. The duty to report without undue delay still matters.
Do not copy that timetable automatically into a digital-service provider’s procedure. NSM’s detailed guide explicitly distinguishes those rules.
Use NSM’s reporting instructions to identify the threshold, recipient and submission method. Keep a primary contact and deputy available.
One incident may also trigger GDPR, sector or contractual reporting. Put those duties alongside each other in the incident plan, with separate triggers and recipients.
For future planning, see NIS2 for Norwegian businesses. Current obligations remain the starting point.
