EU AI Act in Denmark: Authorities, Deadlines, and Business Obligations
How the EU AI Act applies in Denmark: directly applicable, no transposition, EU-wide deadlines, the Article 70 authority designation. What Danish firms do now.
Directly. The EU AI Act — Regulation (EU) 2024/1689 — applies in Denmark by force of EU law itself, with no Danish statute needed to create the obligations. The Danish-specific question is not whether Denmark has "adopted" the Act; it is which obligations apply now, and which national authority will operationalise them. This guide answers both for providers, deployers, importers, and distributors operating in Denmark.
Denmark is consistently among the EU's most digitalised public sectors, which puts public-sector automation squarely in the high-risk frame and raises the stakes of the Article 27 Fundamental Rights Impact Assessment. This article sets out the directly-applicable obligations, the Article 70 designation mechanism, the GDPR overlap, the timeline, the penalties, and a worked example.
The EU AI Act Applies in Denmark Directly — No Danish Transposition
Regulation (EU) 2024/1689 is a Regulation, not a Directive. Under Article 288 TFEU, a Regulation applies directly in every Member State, Denmark included, without a national implementing statute to create the substantive duties. German and Swedish companies do not wait for a domestic law before the Act bites, and neither do Danish ones.
The obligations are already live regardless of any national step. Article 5 prohibited practices and Article 4 AI literacy duties have applied since 2 February 2025. General-purpose AI (GPAI) model obligations under Chapter V (Articles 51–55) have applied since 2 August 2025.
What Denmark must do under Article 70 is narrower than re-legislating the Act: designate national competent authorities — at least one notifying authority and at least one market surveillance authority — name a single point of contact for the EU AI Office, and confer domestic enforcement powers so those authorities can investigate and fine. That is procedure and machinery, not the substantive rules.
Where the Germany guide tracks a named implementing law (the KI-MIG) and the Sweden guide tracks a named proposed authority (PTS via SOU 2025:101), this guide deliberately does not invent a Danish authority name. Human-review flag: do not name a specific Danish competent authority or a specific Danish implementing act unless it has been verified against Denmark's current notification to the Commission.
The Article 70 Designation Mechanism — and What to Verify
Article 70 requires each Member State to designate at least one notifying authority and at least one market surveillance authority (MSA) as its national competent authorities, and to communicate them to the Commission. The milestone for that communication was 2 August 2025. The mechanism is uniform across the Union; what differs is the national body each state nominates.
Describe the Danish candidate landscape only in mechanism terms. Denmark has strong digital-government institutions and established market-surveillance and data-protection bodies, any of which could in principle host the AI Act mandate. But which one holds it is a matter for the official designation — confirm it, and any Danish implementing act, against the official source before treating either as settled.
Article 74 governs market surveillance. Once Danish enforcement powers are in force, the designated MSA gains authority to audit Annex IV technical documentation, review conformity assessments and Article 72 post-market monitoring, order corrective action, require withdrawals, and impose the Article 99 fines.
GPAI is carved out of national supervision. General-purpose AI model providers are supervised directly by the EU AI Office in Brussels, with Commission fines under Article 101 — not by any Danish national authority. A Danish single point of contact merely coordinates with Brussels; it does not supervise GPAI models.
Denmark's Digital-Government Context and Why It Raises the Stakes
Denmark is, by repeated measure, among the EU's most digitalised public sectors, with widespread use of digital identity and automated case-handling across public administration. That is the factual backdrop, without attributing specific AI deployments to named Danish agencies.
It matters because of where Annex III lands. Annex III point 5(a) covers AI used by public authorities to evaluate eligibility for essential public benefits and services; Annex III point 8 covers administration of justice and democratic processes. A heavily-automated public sector therefore has more systems in the high-risk frame than a less-digitalised one.
That exposure connects directly to Article 27. The Fundamental Rights Impact Assessment is mandatory for public bodies — and bodies governed by public law — deploying Annex III high-risk systems, and for private deployers in the creditworthiness (point 5(b)) and life-and-health-insurance (point 5(c)) categories. For a Danish public sector that runs eligibility scoring at scale, the FRIA is not a marginal duty; it is an early focus area.
The roles follow. A Danish municipality or agency running an eligibility-scoring tool is a deployer under Article 26. If it builds the system, or substantially modifies one, Article 25 can convert it into a provider with the full obligation stack.
How the EU AI Act Stacks With the GDPR in Denmark
The GDPR and the EU AI Act run in parallel for any AI system that processes personal data — which covers most Annex III high-risk systems. The Danish Data Protection Agency (Datatilsynet) continues to enforce the GDPR; that role is unchanged by the AI Act, and the two frameworks stack.
The most practical overlap is between the GDPR Article 35 Data Protection Impact Assessment (DPIA) and the EU AI Act Article 27 FRIA. Both are mandatory pre-deployment assessments of risks to fundamental rights. Article 27(4) expressly allows the FRIA to build on an existing DPIA where the scope overlaps, so the two are designed to interlock rather than duplicate.
Record-keeping interacts as well. Article 12 automatic logging duties for high-risk systems sit alongside GDPR Article 22 transparency and human-review duties on automated decision-making. A Danish deployer running a high-risk scoring tool carries obligations under both instruments at once.
The sequencing point for Danish deployers is simple: build the factual base once — system description, data sources, categories of affected persons — and reuse it across DPIA and FRIA. Where a high-risk system processes personal data at scale, expect both Datatilsynet and the designated AI Act authority to take an interest.
The EU AI Act Timeline as It Applies in Denmark
The dates below are EU-wide and identical in every Member State. There are no Denmark-specific deadlines:
| Date | What applies |
|---|---|
| 2 February 2025 | Article 5 prohibited practices and Article 4 AI literacy — in force, enforceable now |
| 2 August 2025 | GPAI obligations (Chapter V, Articles 51–55), governance bodies, the AI Office, and Article 99 penalty provisions; also the Article 70 authority-communication milestone |
| 2 August 2026 | General application (e.g. Article 50 transparency) |
| 2 December 2027 | Stand-alone high-risk Annex III systems statutory date under Article 6(2), deferred under the adopted Digital Omnibus |
| 2 December 2026 | Article 50 content-marking duties for synthetic and AI-generated content (Digital Omnibus, adopted) |
| 2 August 2027 | High-risk AI as a safety component of Annex I regulated products — Article 6(1) statutory date |
Two caveats matter. First, the Digital Omnibus reached provisional agreement on 6–7 May 2026 (COREPER around 13 May 2026) to defer Annex III high-risk systems to 2 December 2027 and Annex I product-embedded systems (Article 6(1)) to 2 August 2028. It also adds a content-marking duty and a CSAM/nudifier prohibition. The package has now been approved by the European Parliament (16 June 2026) and adopted by the Council (29 June 2026). It enters into force on Official Journal publication, expected before 2 August 2026, and you should plan against 2 December 2027.
Second, not everything is delayed. The Article 5 prohibitions, Article 4 literacy duties, GPAI obligations, and Article 50 transparency duties are unaffected. Treating the Omnibus as a blanket reprieve is a trap.
Penalties Danish Companies Face Under Article 99
Article 99 sets three tiers, each expressed as the higher of a fixed sum or a percentage of total worldwide annual turnover.
- €35 million or 7% of total worldwide annual turnover, whichever is higher — Article 99(3), for breaches of the Article 5 prohibited practices.
- €15 million or 3% — Article 99(4), for non-compliance with most other obligations: high-risk requirements (Articles 9–15), provider duties (Article 16), deployer duties (Article 26), and Article 50 transparency.
- €7.5 million or 1% — Article 99(5), for supplying incorrect, incomplete, or misleading information to notified bodies or competent authorities. The third tier is 1%, not 1.5%; there is no 1.5% tier in the Regulation.
For SMEs and start-ups, Article 99(6) provides proportionality: the fine is capped at the lower of the fixed amount or the percentage. Take a mid-sized Danish company with roughly €40 million turnover that breaches a high-risk obligation. The headline figure is €15 million, but 3% of €40 million is €1.2 million — and because the lower figure governs, €1.2 million is the applicable cap.
National enforcement depends on the designated Danish authority having domestic powers in force; the Article 5 prohibition, however, applies regardless. GPAI fines are separate: up to €15 million or 3%, imposed by the Commission under Article 101.
Worked Example: A 250-Person Danish Health-Tech Company
Consider Nordhelse, an illustrative (fictional) Copenhagen-based digital-health scale-up — around 250 employees and roughly €40 million in annual turnover.
Product line one: a clinical decision-support tool. This qualifies as a medical device under the Medical Devices Regulation (MDR) 2017/745, which sits in Annex I Section A. Under Article 43(3), conformity for an Annex I Section A product is routed through the sectoral MDR/IVDR acts rather than the stand-alone Article 43 path. The Articles 8–15 requirements still apply; the conformity route is the sectoral one.
Product line two: a stand-alone AI recruitment-screening tool used for its own hiring. This is Annex III point 4(a) employment, and it takes the full high-risk stack directly — Articles 9–15, provider duties under Article 16 or deployer duties under Article 26, and conformity assessment under Article 43 — unless the Article 6(3) procedural-task filter removes it from high-risk.
Role analysis. As the builder of both tools, Nordhelse is a provider under Article 16. Had it instead licensed a third-party screening tool and only operated it, it would be a deployer under Article 26 — and fine-tuning or rebranding that tool could trigger Article 25 provider status.
Timeline. Prohibitions and literacy duties already apply. GPAI is not relevant unless it trains a general-purpose model. High-risk obligations now target the adopted 2 December 2027 deadline. Action set: an AI inventory, the Article 6(3) filter, a FRIA where it is a deployer in a covered category, DPIA/FRIA coordination against Datatilsynet exposure, and an Annex IV documentation pack.
Denmark-Specific Compliance Considerations
Public-sector FRIA weight. Given Denmark's automated public administration, the Article 27 FRIA for Annex III point 5(a) eligibility tools and point 8 justice-and-democracy systems is a likely early focus. Public-sector compliance is high-visibility and sets the standard others follow.
Prohibited practices to screen now. Article 5(1)(f) bans emotion recognition in the workplace and education; Article 5(1)(g) bans biometric categorisation inferring sensitive attributes; Article 5(1)(a) covers subliminal and manipulative techniques. All relevant to Danish edtech and HR-tech, and enforceable since 2 February 2025.
Cross-border reach. Denmark is an EU Member State, so the Act applies directly with no EEA-incorporation step. Separately, Article 2 extraterritorial reach catches any provider or deployer placing AI on the EU market regardless of establishment — so a non-EU vendor selling into Denmark is caught.
Article 25 role-shift risk for Danish customisers. A deployer that substantially modifies a high-risk system, changes its intended purpose to a high-risk use, or places it under its own name becomes a provider with the full Article 16 stack — including re-running conformity assessment. Firms that heavily customise vendor AI should run this analysis before assuming the lighter deployer role.
Regulatory sandbox. Articles 57–59 require at least one AI regulatory sandbox per Member State by 2 August 2026, with priority and fee-free access for SMEs and start-ups under Article 58. Danish firms with hard-to-classify systems should track it once stood up.
Importer and distributor duties. Article 23 (importer) and Article 24 (distributor) apply to Danish firms importing or reselling third-party high-risk AI.
How Confir Helps Danish Companies
Danish compliance teams face a documentation-heavy obligation set: Article 9 risk management, Annex IV technical documentation, Article 27 FRIAs, Article 43 conformity preparation, and Article 72 post-market monitoring.
Confir is an EU-hosted compliance tool built for that work. Its classification engine is rule-based and deterministic — no model inference, no hallucination. It encodes Articles 5 and 6 with Annex III logic in explicit rules, so the same intake always produces the same finding with a human-readable explanation of which rule fired, which makes the output audit-defensible. It generates the Annex IV technical documentation pack, the Article 47 / Annex V Declaration of Conformity, and the Article 27 FRIA. The assessment spans four structured areas: risk classification (AIRC), data and technical robustness (AITR), transparency and human oversight (AITO), and governance and post-market monitoring (AIGM). GPAI workflow support is partial and on the roadmap.
What Danish Companies Should Do Now
Immediately. Audit for Article 5 prohibited practices — emotion recognition in work or education, sensitive-attribute biometric categorisation, manipulative techniques, untargeted facial-image scraping, social scoring. In force since 2 February 2025. Restructure or stop any non-compliant system.
Before 2 August 2026. Meet Article 50 transparency for any AI that interacts with people: chatbots disclose they are AI; deepfakes and synthetic media are disclosed as artificially generated; generative outputs are marked machine-readably. Content-marking duties land 2 December 2026 under the Omnibus (now adopted).
2026–2027 high-risk preparation. Build the AI inventory, apply the Article 6(3) filter, assign provider, deployer, importer, and distributor roles, and start Annex IV documentation and FRIAs — planning against the now-adopted 2 December 2027 deferral.
Ongoing. Monitor Denmark's official Article 70 authority designation and any Danish implementing act; watch for the Digital Omnibus's Official Journal publication; and follow EU AI Office GPAI guidance if you build or integrate foundation models. Verify the named authority against official sources before relying on this guide for enforcement contact.
Related guides
- EU AI Act in Germany: enforcement and authority roles
- EU AI Act in Sweden: proposed authority and obligations
- EU AI Act deadlines and application dates
- market surveillance authority — glossary
- EU AI Act compliance: where to start
Manage your EU AI Act compliance in one place
Confir automates risk classification, technical documentation, and audit trails for any company. No consultants. No 6-month projects. 14-day free trial.
Start free trial →