Iceland

The most relevant provisions of the Icelandic constitution that must be kept in mind in relation to the deployment and use of AI, are:

• Article 65, which recognises that everyone shall be equal before the law and enjoy human rights irrespective of sex, religion, opinion, national origin, race, colour, property, birth or other status.
• Article 70, which provides for the right to a fair trial and within a reasonable time.
• Article 71, which recognises everyone’s right to enjoy freedom from interference with privacy, home, and family life.

In terms of fundamental rights, Iceland is a signatory to several international conventions on human rights, in particular the United Nations Universal Declaration of Human Rights and the Council of Europe’s European Convention on Human Rights. The Ministry of Justice ensures legislative amendments to meet international obligations and reports to relevant committees overseeing human rights agreement implementation (see www.government.is/topics/human-rights-and-equality/).

Iceland actively participates in international discussions on AI, aligning policies with ethical norms while considering adaptation to local contexts (see www.stjornarradid.is/library/01--Frettatengt---myndir-og-skrar/FOR/Fylgiskjol-i-frett/08.04.21_Stefna%20%C3%8Dslands%20um%20gervigreind_loka.pdf). The AI Action Plan also places new emphasis on protecting democracy and public debate. It calls for an assessment of how AI may affect democratic values, information flows and election behaviour, including risks linked to misinformation, propaganda techniques and foreign interference. The plan further provides for a review of how registered political parties use AI, with a view to developing general guidance on transparency and responsible use of AI in political activity. This work is expected to result in a report and accompanying guidance in autumn 2026. (See page 12, www.stjornarradid.is/library/04-Raduneytin/Menningar---nyskopunar--og-haskolaraduneytid/A%C3%B0ger%C3%B0a%C3%A1%C3%A6tlun%20um%20gervigreind.pdf.)

Patents in Iceland are governed by Act No. 17/1991, which grants exclusive rights for industrially applicable inventions in all technical fields. However, discoveries, scientific theories, mathematical methods, artistic works, mere presentation of information, plans, rules or methods for mental activities and computer programs, are not considered patentable. As for computer programs, the Icelandic Patents Act stipulates that only those programs which are merely representations of mental activity and lack technical features are excluded from being considered patentable inventions. Computer programs that are essential to a specific production process and involve technical features may be patentable if they meet other necessary conditions. Iceland’s legislation on the patentability of computer software aligns with the Nordics and EU.

Iceland’s copyright regime is contained in the Icelandic Copyright Act No. 73/1972. According to Article 1, authors of literary or artistic works have copyright, granting them exclusive rights within specified legal limits. Literature and artistic works include spoken and written language, stage works, compositions, art, architecture, films, photography, applied art and other corresponding arts, in whatever way and in whatever form the work appears. Plans, drawings, models, and other such data, which provide information on issues or clarify them, are protected in the same way as literary works. The same applies to computer programs.

It shall be noted that the EU Directive 2019/790 on copyright and related rights in the Digital Single Market (“DSM Directive”) has not yet been incorporated into the EEA Agreement and thus not implemented into Icelandic law. The Icelandic copyright law is still adapting to challenges posed by AI, and it has in most cases yet to be amended to address such challenges. The Icelandic Copyright Act does not for instance, specifically address exceptions and limitations of copyright for text and data mining, such as the DSM Directive does. Further, the Icelandic Copyright Act does not provide for general fair use or general fair dealing exceptions. It shall be noted that the DSM Directive has been approved by the EEA Joint Committee, and it can therefore be expected that the act will be incorporated into the EEA Agreement in the near future (see www.efta.int/eea-lex/32019l0790), after which the act will ultimately be implemented into Icelandic law.

The ISIPO has not yet published any guidelines on copyright and AI.

Act No. 131/2020 on Trade Secrets implemented Directive (EU) 2016/943 and provides comprehensive protection and remedies against the unlawful acquisition, use and disclosure of trade secrets. Such protection is particularly important for technology companies, whose value often depends on confidential know-how safeguarded through confidential obligations.

Under the Icelandic Act, there are three criteria for information to be considered trade secrets. Information that:

• is a secret in the sense that it is not generally known or easily accessible among members of groups that normally deal with the type of information in question;
• has commercial value because it is a secret; or
• a person or legal entity is legally in control of and has taken reasonable measures depending on the circumstances to keep it a secret.

Under the Icelandic Act, the legal remedies for the protection of trade secrets are:

• injunction;
• measures by a national court;
• compensation for financial loss;
• compensatory damages; and
• penalties and daily fines.

As at the date of writing, there have been no cases in Iceland where the courts have assessed whether or not AI has disclosed trade secrets as part of any machine-generated outputs.

As of now, there have been no cases in Iceland involving the interaction between IP and AI.

At domestic level, personal data is covered by a comprehensive set of rules under the Icelandic Act on Data Protection and the Processing of Personal Data No. 90/2018. This Act is intended to promote handling of personal data in accordance with the basic principles and rules of personal data protection and the right to privacy. The Act is also intended to ensure the reliability and quality of such information and its free flow within the single market of the EEA.

Icelandic Act No. 90/2018 was enacted to implement the provisions of Regulation (EU) 2016/679 (General Data Protection Regulation (GDPR)). A special authority in Iceland, the Data Protection Authority, monitors the implementation of the GDPR, Act No. 90/2018, and rules laid down pursuant to it.

The idea that data collections should be accessible as public goods is widely recognised, with neighbouring countries to Iceland demonstrating that open data improves services, transparency, decision making, research, environmental protection and economic value creation. Data is considered open when it is legally unrestricted, reusable, and digitally accessible in a common format.

Compared to other European countries, Iceland is significantly lacking in supply on open data, ranking at the bottom alongside Liechtenstein. Iceland has actively sought to enhance the accessibility and reuse of open data through legislative initiatives aimed at alignment with European Union standards. A significant step in this regard was the adoption of Act No. 45/2018 on the Reuse of Public Information, which came into effect on 26 May 2018. The Act aims to promote the reuse of public information to support innovation and economic development while ensuring compliance with existing laws, including intellectual property and privacy regulations.

The Directive (EU) 2019/1024 on open data and the reuse of public sector information has been implemented in Iceland through legislation adopted by the Parliament, cf. Act No. 45/2024 (1621/154 lög í heild: endurnot opinberra upplýsinga | Þingtíðindi | Alþingi) (www.althingi.is/altext/154/s/1621.html), which amended Act No. 45/2018 on the Reuse of Public Information. The amendments aim to enhance the utilisation of data collected by public entities by establishing minimum rules for data sharing, promoting the economic, societal, and environmental benefits of open data. The updated regime promotes the availability of high-value datasets free of charge and with minimal legal and technical restrictions, including through the use of application programming interfaces (APIs), and requires the timely release of dynamic data.

The AI Action Plan emphasises data infrastructure and governance, including mapping computing capacity, assessing future needs for supercomputing and data centres, and a reviewing of electricity supply and securing telecommunications as conditions for responsible AI deployment. It also calls for a national data strategy to improve data access, sharing and quality across sectors, including a statutory framework for secure data sharing and the implementation of EU data instruments, expected to be completed by 2026 (see page 16, www.stjornarradid.is/library/04-Raduneytin/Menningar---nyskopunar--og-haskolaraduneytid/A%C3%B0ger%C3%B0a%C3%A1%C3%A6tlun%20um%20gervigreind.pdf).

Biometric data, including voice data and facial recognition data, is subject to the Icelandic Data Protection Act No. 90/2018, which aligns with the GDPR. Due to its sensitive and personal nature, biometric data is classified as a special category of personal data, “sensitive personal data”, under the Icelandic Data Protection Act.

The processing of sensitive personal data, including biometric data, such as facial recognition and voice data, is generally prohibited unless it meets one of the conditions outlined in Articles 9 and 11 of the Act (which correspond to Articles 6 and 9 of the GDPR).

Article 65 of the Icelandic Constitution is the foundation for Icelandic law on the prohibition of discriminatory practices. There it is stated that everyone shall be equal before the law and enjoy human rights irrespective of sex, religion, opinion, national origin, race, colour, property, birth, or other status.

Iceland has implemented Act No. 150/2020 on Equal Status and Equal Rights Irrespective of Gender. It focuses on fostering gender equality, promoting equal opportunities, and ensuring that individuals — regardless of gender — can fully benefit from their initiatives and skill development.

Further, Iceland has implemented Act No. 85/2018 on Equal Treatment Outside the Labour Market and Act No. 86/2018 on Equal Treatment Within the Labour Market, both prohibiting discrimination of grounds including race, national origin, religion, disability, age, sexuality, gender identity and expression. In addition, there are various provisions in other Icelandic legislation that have the goal of promoting equal treatment in society.

It should be noted that Iceland has ratified international agreements intended to promote equal treatment in society. These include the European Convention on Human Rights, the United Nations International Covenant on Civil and Political Rights, the United Nations International Covenant on Economic, Social and Cultural Rights and the European Social Charter.

Iceland’s cybersecurity strategy focuses on strengthening cybersecurity skills through education, research, and international collaboration, and on ensuring a secure online environment by enhancing legal frameworks, protecting children, and improving the resilience of critical infrastructures.

Icelandic Act No. 78/2019 implements the EU’s Network and Information Systems (NIS) 1 Directive 2016/1148. Article 7 of the Act sets minimum risk management and preparedness requirements, including documented security policies, regular risk assessments, access control, regular testing and contingency planning to ensure resilience of network and information systems. EU’s NIS 2 Directive 2022/2555 has not been incorporated into the EEA Agreement and thus has not yet been implemented into Icelandic law. It shall be noted that Icelandic authorities have initiated preparatory steps for implementation, but the exact timeline for implementation remains uncertain.

The CERT-IS (Iceland’s Computer Emergency Response Team) operating under the Electronic Communications Office, coordinates responses to serious incidents affecting critical infrastructure. Recognising the vital role of education, the Ministry of Education is also actively involved in cybersecurity initiatives.

Antitrust issues concerning AI in Iceland largely revolve around ensuring that the development and deployment of AI technologies do not lead to unfair market practices or concentrations of market power that could stifle competition. Given the data-driven nature of AI, there’s a risk that companies with access to vast amounts of data could dominate certain markets, making it hard for smaller players to compete.

However, as of today, no decision by the national competition authorities or courts addresses AI-related issues in this regard.

6.2 Domestic (antitrust) regulation

No domestic antitrust competition rules or regulations specifically addressing AI exist in Iceland.

Currently, Iceland does not recognise AI systems as legal agents in the sense of having independent legal capacity, decision-making authority or legal personality. There is no legal framework under which AI systems can act in their own name or bear rights or obligations. While AI systems with a high degree of automation are used in certain contexts, Iceland does not currently have fully autonomous agentic AI systems operating at a national scale in critical infrastructure, financial services or public administration. Any actions performed by such systems would be legally attributed to the relevant human or organisational actors.

Iceland does not currently have any industry-specific legislation expressly governing autonomous AI agents in sectors such as financial services, healthcare, transportation or defence. Instead, existing sectoral regulatory regimes apply to automated and AI-assisted systems more generally.

Looking ahead, Iceland plans to align with the EU Artificial Intelligence Act through the EEA Agreement. Once implemented, that framework is expected to introduce risk-based obligations for high-risk AI systems across sectors, including systems with a high degree of autonomy.

Claims arising from harm caused by AI systems are handled under existing product liability framework, as Iceland has not adopted specific AI liability legislation. Product related claims in Iceland are governed primarily by Act No. 25/1991 on Product Liability, which applies to personal injury and certain types of property damage caused by defective products. The concept of a “product” is defined broadly in Article 3 as any movable property, including components incorporated into other goods, and electricity. The Act does not refer expressly to artificial intelligence, nor does it address whether AI systems should be treated as goods or services. In practice, the regime is therefore most likely to apply where AI functionality is embedded in a tangible product placed on the market. The claimant must prove that he or she sustained the damage, what the damage is, and that the damage can be attributed to defect in a product. Whether a product is defective is assessed under Article 5, which provides that a product is defective if it does not offer the level of safety that a person is entitled to expect, for example, not as safe as expected after a reasonable assessment in terms of safety regulations, normal use and how the product was offered and presented.

Iceland does not have specific AI strict-liability rules. Strict liability may nonetheless apply where AI forms part of a product covered by the existing product liability framework.

The European Union adopted a modernised Product Liability Directive (2024/2853) that clarifies and expands strict liability for software and digital components. That instrument has not yet been incorporated into the EEA and is therefore not directly applicable in Iceland at present, but it signals the direction of travel and is likely to influence future Icelandic legislation.

Iceland does not currently have specific AI legislation governing product recalls or mandatory software updates. Where safety risks or defects arise in AI systems, however, existing product liability legislation would apply, depending on the nature of the system and the harm involved.

As of now, there have been no cases in Iceland involving AI product liability specifically.

A key initiative under the Action Plan is the development of a dedicated AI framework to ensure clear, proportionate rules aligned with EEA obligations, with draft legislation implementing forthcoming EU AI Regulation expected to be introduced in spring 2026.

Additionally, Iceland has amended Act No. 45/2018 on the Reuse of Public Information in order to align its framework with EU Directive standards. The amendments focus on improving public data use by setting basic sharing rules and highlighting open data’s economic, social, and environmental perks.

Furthermore, it is also worth mentioning that the Icelandic General Penal Code No. 19/1940 was recently amended and now explicitly prohibits the falsification of content depicting another person’s nudity or sexual behaviour. This amendment is a crucial update to the general criminal law, reflecting technological advancements that have made it easier to create convincing fake content, such as deepfakes. By addressing these issues, the legislation aims to protect individuals’ sexual privacy in an era where such violations have become increasingly commonplace.

As previously mentioned, Iceland has adopted a national AI strategy and, in July 2025, published an AI Action Plan for 2025–2027, building on the 2021 AI Policy to implement concrete measures and legislation aimed at ensuring the responsible development and use of AI in Iceland, grounded in human rights, democratic values, transparency and public trust, while at the same time strengthening innovation, productivity and competitiveness in Icelandic society. The Action Plan is built on five main pillars:

• AI for the benefit of all, focusing on democracy, equality, fundamental rights, the Icelandic language and the social impacts of AI, including the risk of bias and effects on democratic processes.
• A competitive economy, aimed at strengthening Icelandic industry through applied research, improved access to computing infrastructure and data, Nordic and European cooperation, and the establishment of national and regional AI centres.
• Education fit for the future, concentrating on AI literacy, teacher training and the responsible use of AI in schools and universities.
• New approaches in public services, which include developing guidance for public bodies on AI use, improving public-sector data quality, introducing AI tools in government administration and strengthening transparency and accountability in automated decision making.
• The healthcare system of the future, which focuses on the use of AI in health services, health-data governance and ensuring that new technologies are introduced in a secure and regulated manner.

Each action in the plan is accompanied by a timetable, responsible ministries and implementing bodies, and expected deliverables. The AI Action Plan is designed to be reviewed regularly, with updates every six months and a full review by 2027. The AI Action Plan is accessible here: www.stjornarradid.is/library/04-Raduneytin/Menningar---nyskopunar--og-haskolaraduneytid/A%C3%B0ger%C3%B0a%C3%A1%C3%A6tlun%20um%20gervigreind.pdf.