Accessibility law · Europe

Norway EN 301 549 V3.2.1 → WCAG 2.1 AA (public); WCAG 2.0 AA less 3 criteria (private)

In Norway, the standard to meet is EN 301 549 V3.2.1 → WCAG 2.1 AA (public); WCAG 2.0 AA less 3 criteria (private). It binds public bodies and private businesses and organizations alike, for main websites, apps and self-service machines aimed at users. This page was reviewed against primary sources on 30 September 2026.

Standard
EN 301 549 V3.2.1 → WCAG 2.1 AA (public); WCAG 2.0 AA less 3 criteria (private)
Private sector
Covered
Accessibility statement
Required
Latest
Jul 2013 (amended Feb 2023)
Reviewed
30 September 2026
The 48 criteria All jurisdictions Checklist

Scope

Who it applies to

Norway requires universal design of ICT from public and private organizations alike: main websites, apps that need the internet, and self-service machines offered to users. Private businesses must meet WCAG 2.0 A and AA except criteria 1.2.3–1.2.5 (35 criteria); public bodies must meet EN 301 549 V3.2.1 (48 WCAG 2.1 criteria) and publish a yearly accessibility statement. The supervisory authority in the Norwegian Digitalisation Agency (Digdir) can order fixes and then impose a running daily fine (tvangsmulkt).

  • Public sector

    Public bodies, defined as in the public procurement rules, for their websites, apps and self-service machines, and for intranets and extranets new or substantially revised after 1 February 2023. They must also publish accessibility statements and, for video published after 1 February 2024, provide audio description.

  • Private sector

    Covered

    All private businesses, organizations and associations, with no size threshold, for their main ICT solutions aimed at or made available to users: web solutions (including apps that need an internet connection after download, and digital learning materials) and self-service machines. Examples the regulator gives include online shops, banks, hotels, restaurants, law firms, plumbers and sports clubs. A disproportionate-burden test applies.

Coverage

What it covers

Websites are only part of it. Each tile says whether these rules reach that kind of product, with the detail.

  • Websites

    Covered

    Main web solutions of public and private organizations.

  • Mobile apps

    Covered

    Apps that need an internet connection after download count as web solutions.

  • Documents

    Covered

    Documents on web solutions; files published before 1 February 2022 are exempt.

  • Software

    Not covered

    The regulation covers only web solutions and self-service machines.

  • Kiosks and terminals

    Covered

    Self-service machines must meet ten listed CEN, EN and ISO standards.

  • Public procurement

    Unclear

    The ICT regulation sets no procurement rule; procurement law was not reviewed.

Timeline

Deadlines

Every date here is already in force.

Dates move, so check the linked source before you plan around one.

  1. 1 Jul 2013 In force

    The ICT universal design regulation takes effect.

    Source

  2. 1 Jul 2014 In force

    New ICT solutions must be universally designed.

    Source

  3. 1 Jan 2019 In force

    New ICT solutions in the education sector must be universally designed.

    Source

  4. 1 Jan 2021 In force

    All existing ICT solutions must be universally designed.

    Source

  5. 1 Feb 2022 In force

    Web Accessibility Directive rules take effect: public bodies move to EN 301 549 V3.2.1 and accessibility statements, with one year to comply.

    Source

  6. 1 Feb 2023 In force

    Public bodies must meet the 12 added WCAG 2.1 criteria and publish statements; new or substantially revised intranets and extranets are covered.

    Source

  7. 1 Feb 2024 In force

    Public bodies must provide audio description for prerecorded video published from this date.

    Source

Instruments

The law in Norway

4 laws, rules and rulings, oldest first. Each links to its primary source.

Every fact points at a primary source. Dates move, and several moved in 2025 and 2026, so check the source before you rely on one.

  1. Jul 2013 (amended Feb 2023) Latest

    Forskrift om universell utforming av IKT-løsninger

    FOR-2013-06-21-732, last amended by FOR-2023-01-17-87

    Sets the technical rules: WCAG 2.0 A and AA less 1.2.3–1.2.5 for private web solutions (§ 4), EN 301 549 V3.2.1 for public ones (§ 4b), listed standards for self-service machines (§ 4d), accessibility statements for public bodies (§ 4e), and Digdir's supervision, orders and daily fines (§§ 5–7).

    Primary source

  2. 2017

    Likestillings- og diskrimineringsloven § 18

    LOV-2017-06-16-51, in force 1 January 2018; enforcement in § 36

    Public and private organizations must universally design their main ICT solutions aimed at or made available to users, unless that is a disproportionate burden. Digdir supervises and can order corrections backed by coercive fines.

    Primary source

  3. Feb 2022

    FOR-2021-12-21-3939

    Amendment implementing the Web Accessibility Directive, Directive (EU) 2016/2102

    Added the public-sector rules: EN 301 549 V3.2.1, accessibility statements, feedback functions, yearly monitoring and the content exemptions. In force 1 February 2022, with new duties due by 1 February 2023.

    Primary source

  4. Feb 2023

    FOR-2023-01-17-87

    Amendment to the ICT regulation

    Requires public bodies to audio-describe prerecorded video published after 1 February 2024, with an exception for schools and kindergartens outside key administrative functions. In force 1 February 2023.

    Primary source

Enforcement

Enforcement and penalties

  • Who enforces

    Digitaliseringsdirektoratet (Digdir), through its Tilsynet for universell utforming av IKT (uutilsynet.no).

  • How

    Digdir supervises public and private organizations, can demand documentation and access to any covered solution, and audits websites and apps. It checks public bodies' websites and apps every year using the EU monitoring method and reports to the EFTA Surveillance Authority every three years.

  • Penalties

    Digdir can order corrections with a deadline (pålegg). If the deadline passes, it can impose a coercive fine (tvangsmulkt) that runs daily until the order is met, and may reduce or waive it for special reasons. Neither the Act nor the regulation sets an amount. Decisions can be appealed to the ministry and then taken to court within three months.

  • Individuals

    Anyone can use a public body's feedback function to report failures and ask for exempted content, and users can report inaccessible solutions to the supervisory authority. The Act's compensation section (§ 38) does not list the universal-design duties, so it offers no damages for inaccessible ICT.

Accessibility statement

A statement is required

Required

Public bodies only. Each website and app needs a detailed, complete and clear accessibility statement made in Digdir's central solution and updated at least once a year. It must explain inaccessible content and why, describe accessible alternatives, link to a feedback function where anyone can report failures, and link to the enforcement procedure with information on the right to complain (forskrift § 4e). Private businesses are not required to publish one.

Exemptions

What is exempt

Exemptions are narrow and usually have to be claimed and explained, not assumed.

  • Disproportionate burden, weighing the effect of removing barriers, the nature of the business, the cost, and its size and resources (Act § 18). Digdir can also grant dispensation from requirements and deadlines on application.
  • Private web solutions need not meet WCAG success criteria 1.2.3, 1.2.4 and 1.2.5.
  • ICT used by employees for their work, except public bodies' intranets and extranets.
  • Solutions covered by broadcasting law, and family and private life.
  • Documents published before 1 February 2022, unless needed for an active administrative process.
  • Live time-based media.
  • Online maps for navigation, if essential information is available accessibly.
  • Third-party content outside the organization's control.
  • Reproductions of cultural heritage items that cannot be made accessible.
  • Archives not needed for active processes and not updated since 1 February 2022.
  • Audio description applies only to public bodies' prerecorded video published after 1 February 2024; schools and kindergartens are exempt except for important online administrative functions.
  • Public intranet and extranet content published before 1 February 2023, unless substantially revised.

The standard

What the rules ask for

48 success criteria: 29 at Level A and 19 at Level AA. 4.1.1 Parsing counts in this version, but WCAG 2.2 removed it as obsolete, so it has no page here. Public bodies must meet 48 of the 50 WCAG 2.1 A and AA criteria: all except 1.2.3 and 1.2.4 (live media is exempt), with audio description (1.2.5) required only for video published from 1 February 2024. Private businesses must meet WCAG 2.0 A and AA except 1.2.3, 1.2.4 and 1.2.5, which is 35 criteria; for apps the regulator treats 6 more criteria as not applicable, leaving 42 for public-sector apps and 29 for private ones.

1. Perceivable

2. Operable

3. Understandable

4. Robust

Beyond the law

8 Level A and AA criteria in WCAG 2.2 that these rules do not require yet. Meeting them now costs little and is where the rules are heading.

Meeting it

Where to start

The standard named here is WCAG 2.1 Level AA.

  1. Audit your pages against WCAG 2.1 Level AA: 48 success criteria at Level A and AA.
  2. Check text and control contrast in the Contrast Checker.
  3. Run the URL Analyzer for the problems a machine can find, then test with a keyboard and a screen reader.
  4. Publish an accessibility statement that says what does not meet the standard yet, and how to report a problem.
  5. Work through the Accessibility Checklist and keep a record of what you tested.

This is a summary to orient you, not legal advice. For a decision that matters, read the primary sources and ask a lawyer who practices there.

Questions

Common questions

  • Does it apply to private companies?

    Yes, and unusually broadly: any private business, organization or association whose main websites, apps or self-service machines are aimed at users, with no size threshold. Private web solutions must meet 35 WCAG 2.0 criteria at levels A and AA (all except 1.2.3, 1.2.4 and 1.2.5).

  • Did the move to WCAG 2.1 reach private businesses?

    No. WCAG 2.1 came in through EN 301 549 V3.2.1 for public bodies only: 12 extra criteria from 1 February 2023, and audio description for video published from 1 February 2024, for 48 criteria in all. As of September 2026 private businesses remain on WCAG 2.0.

  • Which apps are covered?

    Apps that need an internet connection at least once after download to do their job count as web solutions and must be universally designed, whether the owner is public or private. The regulator says 29 minimum criteria apply to private-sector apps and 42 to public-sector apps.

  • Does the European Accessibility Act apply in Norway?

    Not yet. The directive has not been incorporated into the EEA Agreement; the EFTA database lists it as under scrutiny, and the regulator says Norway's implementation is delayed.

  • How large are the fines?

    No amount is fixed in law. Digdir first orders a fix with a deadline; if that passes, it sets a running daily fine sized to push compliance. In a 2020–21 case, NAV was reportedly threatened with NOK 50,000 a day and fixed the errors in time.

Sources

Sources

Every fact on this page comes from one of these; the few secondary sources are marked. Reviewed 30 September 2026.

Elsewhere

Also in Europe

Other regions