Makes insurance decisions, in Denmark

Lov nr. 502 af 23. maj 2018 om supplerende bestemmelser til forordningen om beskyttelse af fysiske personer i forbindelse med behandling af personoplysninger og om fri udveksling af sadanne oplysninger (databeskyttelsesloven), consolidated as Act No. 289 of 8 March 2024 · Read the law's page

• Establish a GDPR Article 6 lawful basis before processing personal data of a person in Denmark, including data collected by crawling.
• Conduct a Data Protection Impact Assessment for high risk processing under GDPR Article 35.

Regulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22 · Read the law's page

• Give a person in Denmark a path to obtain human intervention, express their view, and contest a decision made solely by automated processing that produces a legal or similarly significant effect on them, under GDPR Article 22.
• Do not subject a person in Denmark to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, unless the decision is necessary for entering into or performing a contract with them, is authorised by Union or Member State law that also lays down suitable measures to safeguard their rights, or rests on their explicit consent, under GDPR Article 22(1) and (2).
• Do not base a solely automated decision with legal or similarly significant effects on a person in Denmark on the special categories of personal data in GDPR Article 9(1), unless they gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, and suitable measures to safeguard their rights are in place, under GDPR Article 22(4).
• If you make solely automated decisions about a person in Denmark of the kind GDPR Article 22(1) and (4) describe, including profiling, tell them so and give them meaningful information about the logic involved and the significance and envisaged consequences for them: when you collect their data, within the Article 14(3) period where you obtained it from someone else, and in answering their access request, under GDPR Articles 13(2)(f), 14(2)(g) and 15(1)(h).

Lov nr. 467 af 14. maj 2025 om supplerende bestemmelser til forordningen om kunstig intelligens (AI-loven), Folketingets sagsforlob 2024/1 LF 154 · Read the law's page

• Do not deploy an AI system in Denmark that engages in a practice the EU AI Act's Article 5 prohibits, including untargeted scraping of facial images from the internet or CCTV to build a facial-recognition database, biometric categorization that infers a protected characteristic, or individual predictive-policing profiling.
• Provide accurate, complete information to Digitaliseringsstyrelsen, Datatilsynet or Domstolsstyrelsen on request, and allow them to inspect your premises and technical systems, or risk a fine; the Danish text states no ceiling, and the bill's notes say the EU AI Act's Article 99 ceilings apply.

Regulation (EU) 2024/1689, Arts. 5, 50 — directly applicable in Denmark as EU Member State; enforced via Law No. 467 of 14 May 2025

• Disclose that users are interacting with an AI chatbot or voice system.
• Mark synthetic generative AI outputs in a machine-readable format.

Regulation (EU) 2024/1689, Arts. 6, Annex III — directly applicable in Denmark as EU Member State

Forslag til Lov om produktansvar, L 32 (2026/1) · Read the law's page

• If you develop or make software, or have it developed or made, you answer as its manufacturer, unless it is free open-source software that you develop or supply outside commercial activity (Secs. 1(2), 3 point 1 and 3 point 10).
• Keep supplying the software updates and upgrades needed to keep the product safe while the product is within your control: a defect caused by software, by an update or upgrade, or by a missing necessary update is not excused because it arose after you put the product into circulation (Secs. 3 point 5 and 12(2)).
• Meet the product safety requirements that apply to your product, safety-relevant cybersecurity requirements included: they count in judging whether it is defective (Sec. 6(2) point 6), and failing a mandatory requirement that protects against the damage suffered presumes it defective (Sec. 11(2) point 2).
• Account for what your product learns or acquires after it is put into circulation: the effect of that ability is weighed in judging whether it is defective (Sec. 6(2) point 3).
• Keep records you could produce if a court orders disclosure on a claimant's supported request, because failing to comply with the order presumes the product defective (Secs. 10(1), 11(2) point 1).
• If you are a manufacturer established outside the European Union, your importer and your authorized representative answer as the manufacturer would, and where there is neither, the provider of distribution services answers (Sec. 7(1) point 3).
• If you substantially modify a product outside the manufacturer's control and then make it available on the market or put it into use, you answer as its manufacturer (Sec. 7(2)).
• If you are a distributor, or an online platform that lets consumers conclude distance contracts with traders, identify the operator established in the European Union or your own supplier within a month of the injured person's request, or you answer for the product (Sec. 7(3) and (4)).
• Do not rely on a contract term to limit or exclude your liability to an injured person, because the Act cannot be departed from to the injured person's detriment (Sec. 2).
• Be ready to prove a Section 12 defense: that you did not put the product into circulation, that the defect probably did not exist then, that it results from compliance with legal requirements, or that the objective scientific and technical knowledge then did not allow the defect to be discovered (Sec. 12(1)).
• If you integrate software made by a micro or small enterprise as a component, a recourse waiver agreed with that enterprise removes your recourse against it (Sec. 13(4)).
• Claims are time-barred 3 years after the injured person knew or should have known of the damage, the defect and the liable operator, and the right expires 10 years after the product was put into circulation or into use, or 25 years for a latent personal injury (Secs. 15 and 16).