Human control of AI in Norway

In one minute

Norway’s Parliamentary Ombud calls for real control over administrative AI. Checking a case afterwards does not justify how someone was selected for investigation. [1]
The European Data Protection Board will scrutinise automated recruitment in 2027. Authorities can join a coordinated enforcement action. [3]
Brussels proposes easier access to a human customer service representative. The Digital Fairness Act addresses barriers in digital services. [4]
United restricts access by unauthorised personal AI agents. The traveller’s permission is not the platform’s permission. [5]
Latham & Watkins sets aside $1 million to reward associates’ AI contributions in 2027. That is the programme’s total award pool. [6][7]
Spain’s statistics office puts reported generative AI use at 54.8%. The annual increase is 16.9 percentage points. [9]
Google DeepMind introduces AlphaGenome 2 to research DNA effects across cell types. It has not been validated for diagnosis. [10]
CloudSEK attributes AI-agent use to an espionage operator. It says agents collected information and cleaned up logs. [11]

Lead story

NORWAY · PUBLIC ADMINISTRATION AND SAFEGUARDS · REPORT PUBLISHED 11 NOVEMBER

NAV tested AI that took the doctor’s age into account

A system was supposed to estimate how long a patient would be on sick leave. One factor it gave weight to was the age of the doctor who certified the leave. This happened during testing of a planned system at NAV, Norway’s labour and welfare administration. The estimate was intended to help assess the patient’s follow-up needs. The system was being tested; NAV told the inquiry that it does not currently use AI for digital decision support. [1]

The example raises an uncomfortable question. A correlation is a statistical relationship: two things vary together. It can help predict something without explaining its cause, and without making that information a lawful, relevant reason for a decision about a person. Improving a prediction with the doctor’s age does not show that age should influence the patient’s follow-up.

The warning comes from Sivilombudet, Norway’s Parliamentary Ombud, an independent parliamentary body overseeing public administration. Its report is dated 31 October, was published on 11 November and carries case number 2026/145. It calls for sufficient information and real means of checking that recommendations rest on lawful, relevant criteria. [1][2]

Four agencies, different ways of checking

Arbeidstilsynet, the Norwegian Labour Inspection Authority, uses Prediksjonsindeksen, a system that calculates risk scores from previous inspections to help prioritise new visits. Understanding the model in general can help. The report says inspectors may also need to know what supports an individual score so that they can disregard it. [1]

Skatteetaten, the Norwegian Tax Administration, uses models to identify potentially incorrect deductions or secondary homes being rented out. It uses Shapley values, a technique that estimates which variables contribute to predictions. This can expose unexpected factors. Explaining a prediction, however, does not itself establish its reliability or the lawfulness of its criteria. [1]

Tolletaten, Norwegian Customs, looks for patterns and anomalies in goods and consignments. Its models do not issue risk scores or inspection recommendations. Analysts check findings against other sources and manually develop control rules. The report identifies this as a possible route to independent checking, provided the relevance of each criterion is examined too. [1]

Later checks do not repair an unlawful selection

The problem arises before the final decision. An official can verify information about a person selected for inspection and still not know why that person was selected. Finding an irregularity later does not make an initially discriminatory or irrelevant selection criterion lawful. [1]

There is also automation bias: the tendency to trust a recommendation too much because a machine produced it. Having checks available is not enough; work must be organised so that people use them. Article 22 of the General Data Protection Regulation (GDPR) protects people, subject to exceptions, against solely automated decisions with legal or similarly significant effects, and purely formal human involvement can still fall within that category. [1]

For a law firm, the practical lesson is straightforward: reviewing AI output provides a safeguard only if the reviewer has the sources, time, knowledge and authority to verify and reject it. A box marked “reviewed” does not provide those things.

The report does not establish specific breaches or create a new rule. It clarifies the requirements for oversight and suggests making them more explicit in legislation. [1][2]

Spain and Norway

Spain: generative AI use rises from 37.9% to 54.8%. The household survey published on 11 November by the Instituto Nacional de Estadística (INE), Spain’s national statistics office, covers people aged 16–74 who used the technology in the previous three months. 27.6% used it for work. By age, use ranges from 83.3% among 16–24-year-olds to 19.5% among 65–74-year-olds. These figures measure respondents’ self-reported use. They are new INE findings from a different survey to the CNMC panel already covered; the populations and questions should not be treated as identical. [9]

In brief

- Google DeepMind introduces AlphaGenome 2. It predicts how DNA variants affect different cell types and states, with access through a programming interface for non-commercial research and a private preview for commercial research. Research only: it has not been validated or approved for clinical or diagnostic use. [10] - CloudSEK attributes AI-agent use to a Silent Lynx operator, covering reconnaissance, collection and log cleanup. The attribution comes from the security provider, which published its analysis of an exposed server on 11 November. [11]

The signal in the noise

A human signing without being able to check is decoration. Oversight requires sources, resources and a real ability to say no. It has to be designed into the work: in public administration, recruitment, customer service and the law firm.