AI ACt

The AI Act, also known as the AI Regulation or the AI Law, is the EU’s regulation on artificial intelligence (Read more here). Its purpose is to ensure that AI systems are developed, marketed, and used responsibly, safely, and in accordance with fundamental rights.

The AI Regulation is based on a risk-based approach. This means that the requirements depend on how the AI system is used and the risks it may pose to individuals, organizations, and society. Certain AI practices are prohibited, while high-risk AI is subject to more comprehensive requirements regarding, among other things, risk management, documentation, data quality, transparency, human oversight, and security.

For businesses and public organizations, the AI Act means that the use of AI must be managed and documented more systematically. This applies not only to organizations that develop AI systems, but also to those that use AI tools in processes, decision support, customer service, HR, case management, or other business-critical areas.

Nesp.ONE helps organizations gain a clear understanding of the requirements of the AI Regulation, assess risks, and establish specific processes, guidelines, and documentation for the safe, responsible, and compliant use of AI.

The AI Act, also known as the AI Regulation, entered into force in the EU on August 1, 2024, and is directly applicable in Denmark. However, the rules will be phased in over several years.

The most important dates are:

• 2. February 2025: General provisions, AI literacy, and prohibited AI practices take effect

• 2. August 2025: Regulations governing general-purpose AI models, including generative AI models, will take effect

• 2. August 2026: Most provisions of the AI Act take effect, including requirements for many high-risk AI systems

• 2. August 2027: Requirements for high-risk AI systems incorporated into certain regulated products take effect (Read more here)

Danish organizations should therefore begin now to gain an overview of where AI is used, which systems may be affected, and what requirements apply. Nesp.ONE helps structure efforts related to AI governance, risk assessment, documentation, and the responsible use of AI.

The AI Regulation may apply to all Danish companies and organizations that develop, market, distribute, or use AI systems as part of their activities.

This applies, among other things, to companies that:

• Develops AI systems or AI-based products (providers)

• Use AI systems in their operations or business processes (users/deployers)

• Imports AI systems from countries outside the EU

• Distributing AI systems on the European market

• Integrates AI functionality into its own products or services

For many organizations, it is particularly important to note that the AI Regulation does not apply only to companies that develop AI. Companies that use AI solutions—such as Microsoft Copilot, ChatGPT, Gemini, or other AI-based tools—may also have obligations regarding governance, risk assessment, competencies, transparency, and responsible use.

This means that the AI Regulation applies to both small and large businesses across all industries, including private companies, public organizations, and organizations subject to regulatory requirements.

Nesp.ONE helps clarify how the AI Regulation affects your organization, which requirements are relevant, and how these requirements can be translated into specific processes, guidelines, and documentation.

Yes, Danish companies may have obligations under the AI Regulation when they use AI tools such as ChatGPT, Microsoft Copilot, or Gemini in a business context. The requirements depend on how the tools are used, what data is processed, and whether AI output is used as the basis for decisions or processes that affect individuals, customers, or the business.

For most companies, it will be particularly important to establish clear guidelines for the use of AI, assess risks, ensure that employees have the necessary AI skills, and document its use where necessary. This is especially important if AI is used for customer service, HR, case management, document management, consulting, or decision support.

If a company develops its own AI solutions on top of these platforms or integrates AI into its own products and services, additional obligations may arise. Nesp.ONE helps clarify roles, risks, and requirements so that AI can be used safely, responsibly, and in compliance with the AI Regulation.

In Denmark, the AI Regulation is enforced through a coordinated effort by government agencies, with the Agency for Digitization playing a central role. The Danish Data Protection Agency and the Danish Court Administration also have responsibilities in selected areas, depending on how AI is used and which rules apply.

The Danish Agency for Digitization
The Danish Agency for Digitization is the national coordinating supervisory authority for the AI Regulation in Denmark. The Agency is responsible for coordination and overall supervision and serves as the point of contact with other EU countries and the European Commission. The Danish Agency for Digitization has also been designated as the notifying authority and central market surveillance authority under Danish law.

The Danish Data Protection Agency
The Danish Data Protection Agency has been designated as the market surveillance authority for selected parts of the AI Regulation, particularly where the rules overlap with data protection, personal data, and fundamental rights.

The Danish Court Administration
The Danish Court Administration plays a more limited role with regard to the use of AI within the judicial system.

For businesses, this means that appropriate oversight may depend on the AI system’s use, data processing, risk level, and organizational context.