DenmarkLov nr. 467 af 14. maj 2025, National Competent Authorities and Article 5 Enforcement
Lov nr. 467 af 14. maj 2025 om supplerende bestemmelser til forordningen om kunstig intelligens (AI-loven) Folketingets sagsforlob 2024/1 LF 154
In force since .
An AI prohibited practices rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, Place of effect
- Obligation class
- Prohibition, Governance
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Do not deploy an AI system in Denmark that engages in a practice the EU AI Act's Article 5 prohibits, including untargeted scraping of facial images from the internet or CCTV to build a facial-recognition database, biometric categorization that infers a protected characteristic, or individual predictive-policing profiling.NIST AI RMFMAP 3.3
- Provide accurate, complete information to Digitaliseringsstyrelsen, Datatilsynet or Domstolsstyrelsen on request, and allow them to inspect your premises and technical systems, or risk a fine; the Danish text states no ceiling, and the bill's notes say the EU AI Act's Article 99 ceilings apply.NIST AI RMFGOVERN 1.1
These lines are LexLint's reading of the law's text. Also read by: Digitaliseringsstyrelsen (Danish Agency for Digital Government) (guidance, recorded ).
In the frameworks
- NIST AI RMF
- GOVERN 1.1Legal and regulatory requirements involving AI are understood, managed, and documented.
- MAP 3.3Targeted application scope is specified and documented based on the system’s capability, established context, and AI system categorization.
- NIST AI 600-1
- GAI-RISK-07Human-AI Configuration
- GAI-RISK-08Information Integrity
- GAI-RISK-11Obscene, Degrading, and/or Abusive Content
- NIST AI 200-2 Draft
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI09Human-Agent Trust Exploitation
- MIT mitigations Draft
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ETSI EN 304 223
- 5.1.2-1Business need and security risks written down and assessed before deciding to build an AI system.
- 5.1.4-1Capability for human oversight designed in and maintained.
- 5.1.4-5End-users told which uses of the system are prohibited.
- 5.2.1-1Full inventory of assets, including their dependencies and connections.
- 5.2.4-1Developers keep an audit trail of system design and post-deployment maintenance plans and offer it downstream.
- 5.4.2-1Operators log system and user actions.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 10(1): a fine, unless a higher penalty is warranted under other legislation, for violating Article 5(1)(a) to (g) of the EU AI Act, giving inaccurate, incomplete or misleading information to a competent authority, failing to comply with an information demand or inspection, or failing to comply with an order or temporary ban. No monetary ceiling is stated for this fine in the Danish text, though the bill's notes say the Article 99(3) and (5) ceilings of the EU AI Act must be respected; a bodeforelag (administrative fine notice with the same effect as a judgment if accepted) is available under section 11. Section 10(4): the limitation period is 5 years.
Who enforces it
Enforcement body
Digitaliseringsstyrelsen, Datatilsynet and Domstolsstyrelsen, Denmark's national competent authorities under the EU AI Act, with market-surveillance responsibility for the Article 5 prohibited practices divided between the first two and Domstolsstyrelsen covering the courts' own non-judicial use of AI systems.
Settledness
- As of
- Guidance link
- https://digst.dk/media/03kdcicv/hovedvejledning-om-de-forbudte-former-for-ai-praksis-efter-ai-forordningens-artikel-5.pdf
- Guidance body
- Digitaliseringsstyrelsen (Danish Agency for Digital Government)
- Open questions
- Where one AI system raises concerns under both Article 5(1)(a) to (c), (e) or (f) and Article 5(1)(d) or (g) of the EU AI Act, which of Digitaliseringsstyrelsen and Datatilsynet decides, and can both act?
- Which AI uses by a court count as acting 'i deres egenskab af domstol' (in its capacity as a court), so that the court itself and not Domstolsstyrelsen decides under section 2(5)?
What it makes you log
Who may demand the log
Regulator
Logging duty
Section 5 lets the market surveillance authorities demand all information necessary for their supervisory activity, including to determine whether a matter falls within their competence, from natural and legal persons covered by Article 2(1)(a)-(f) of the AI Regulation. The clause does not itself create a logging capability or state what must be recorded; it requires the party to produce information on demand.
- Kind
- Implicit
- As of
- Provision
- § 5
- Trigger
- all_systems
What this law does
Denmark's supplementary AI Act law designates Digitaliseringsstyrelsen, Datatilsynet and Domstolsstyrelsen as the national competent authorities under Article 70(1) of the EU AI Act.
Digitaliseringsstyrelsen is the notifying authority and central contact point and is the market-surveillance authority for Article 5(1)(a) to (c), (e) and (f) of the prohibited-practices list, which includes the untargeted scraping of facial images from the internet or CCTV footage to build a facial-recognition database.
Datatilsynet is the market-surveillance authority for Article 5(1)(d) and (g), covering individual predictive-policing profiling and biometric categorization that infers a protected characteristic. Domstolsstyrelsen covers the courts' own use of AI systems outside their judicial capacity. The authorities may demand information, enter business premises without a court order, run technical inspections of an AI system, publish their decisions, and issue compliance orders or temporary bans.
A violation of Article 5's prohibited practices, giving inaccurate, incomplete or misleading information on request, failing to answer an information demand, obstructing an inspection, or not complying with an order or temporary ban is punishable by a fine, and the limitation period is 5 years.
The law states no monetary ceiling, but the bill's notes on section 10 say the ceilings in Article 99(3) and (5) of the EU AI Act must be respected, which are EUR 35,000,000 or 7 percent of worldwide turnover for an Article 5 violation and EUR 7,500,000 or 1 percent for inaccurate information.
When LexLint raises it
When your app profile says your app crawls the web, processes biometric data or makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .