EU AI Act in Iceland: EEA Incorporation Status and Why Article 2 Already Bites

An Icelandic software company selling an AI hiring tool to employers in Copenhagen and Hamburg is bound by the EU AI Act today — even though, as of mid-2026, the Act has not yet been incorporated into the EEA Agreement and so is not yet Icelandic law. That is the nuance Icelandic companies most often miss. Iceland is in the European Economic Area (EEA), so EU single-market law reaches it through a deliberate incorporation step rather than automatically; until that step completes, the Act does not apply domestically by Icelandic force. But Article 2 reaches any Icelandic company that touches the EU market regardless. This article separates the two tracks and tells you which one binds you now.

---

Iceland, the EEA, and the two ways the Act reaches you

Iceland is not an EU Member State. It is one of three EEA EFTA states — alongside Norway and Liechtenstein — which means EU legislation relevant to the single market is extended to Iceland by a deliberate act of incorporation, not by direct applicability under EU primary law. That distinction governs how and when obligations attach domestically. It does not give Icelandic companies a free pass on the EU market.

Inside the single market, but not an EU state

Because Iceland participates in the single market through the EEA Agreement, EU legislation deemed EEA-relevant is extended to Iceland through the EEA institutions rather than automatically. The EU AI Act — Regulation (EU) 2024/1689 — has been marked EEA-relevant by the EU and is under scrutiny for incorporation into the EEA Agreement by Iceland, Liechtenstein and Norway. As of mid-2026 that incorporation has not yet been completed.

Two distinct routes — keep them apart

1. The EEA-incorporation mechanism. Once the Act is incorporated into the EEA Agreement and taken into Icelandic law, it becomes domestic Icelandic law, with national authorities empowered to enforce it. Until that happens, the Act does not directly apply in Iceland by national force.
2. Article 2 extraterritorial reach. Independent of incorporation timing, Article 2 binds any Icelandic company that places an AI system on the EU market or whose output is used in the Union — today.

The practical consequence: an Icelandic provider or deployer that touches the EU market faces obligations equivalent to an EU competitor either way. Incorporation changes who can enforce against you inside Iceland — not whether the EU duties bind you when you reach the EU market.

---

The EEA mechanism: how (and whether yet) an EU regulation becomes Icelandic law

Regulation vs EEA incorporation

Inside the EU, the EU AI Act is a Regulation — directly applicable in every Member State with no national transposition. In the EEA it does not apply automatically. It must first be assessed as EEA-relevant (done), then incorporated into the EEA Agreement by a decision of the EEA Joint Committee, then implemented in domestic Icelandic law, which confers enforcement powers and designates national competent and market-surveillance authorities.

The incorporation is pending — hedge accordingly

This is the load-bearing caveat. As of mid-2026, the EEA Joint Committee has not yet adopted a decision incorporating Regulation (EU) 2024/1689 into the EEA Agreement; the file is still under EEA EFTA scrutiny. Iceland, Liechtenstein and Norway participate in the European Artificial Intelligence Board's meetings as observers, and the Act's obligation to designate national authorities does not yet apply to them. So there is, as of mid-2026, no Icelandic implementing act, no Icelandic AI-Act competent authority, and no fixed Icelandic application date. Do not assume any of these; they are matters for legal review against the live EEA process.

Persónuvernd is the data-protection authority, not (yet) an AI-Act authority

Iceland's data-protection supervisor is Persónuvernd (the Icelandic Data Protection Authority), which supervises the GDPR as incorporated into the EEA Agreement and sits on the European Data Protection Board for GDPR matters (without voting rights, as an EEA EFTA authority). Persónuvernd's GDPR role does not make it the EU AI Act competent authority. Whether Persónuvernd, another body, or a new authority will hold the AI-Act role in Iceland is something Icelandic law will determine after incorporation — do not assert it in advance.

---

Article 2: why Icelandic companies are caught before incorporation

This is the decisive point for most Icelandic companies. Article 2 sets the Regulation's scope, and it reaches beyond EU borders.

Placing AI on the EU market (Article 2(1)(a))

Under Article 2(1)(a), any provider placing an AI system on the EU market or putting it into service in the Union is in scope, regardless of where it is established. An Icelandic provider selling an AI product to customers in Denmark, Germany, or the Netherlands is caught today — independent of whether the Act has been incorporated into the EEA Agreement. Establishment in Reykjavík does not move you outside the Regulation; selling into the Union moves you inside it.

Output used in the Union (Article 2(1)(c))

Under Article 2(1)(c), a provider or deployer established in a third country is in scope where the output of the AI system is used in the Union. The relevant question is where the effect lands, not where the server or the company sits. An Icelandic company whose AI output reaches people in the EU is caught on this limb even if it sells nothing directly into a Member State.

Incorporation timing changes the forum, not the duty

The conclusion follows cleanly: incorporation timing changes who enforces against you and where, not whether the substantive obligations bind you when you touch the EU market. The pending status of EEA incorporation is therefore not the shield it appears to be for any Icelandic company selling into the Union.

---

Timeline: the EU dates are fixed; Icelandic incorporation may lag

Use the EU-wide statutory calendar as your anchor. EEA incorporation, when it comes, may follow these dates with a lag — so an Icelandic company on the EU market should plan against the EU dates, not wait for an Icelandic one.

The Digital Omnibus high-risk deferral

The Digital Omnibus is now adopted: the European Parliament approved it on 16 June 2026 and the Council formally adopted it on 29 June 2026. It enters into force on publication in the Official Journal, expected before 2 August 2026. Stand-alone Annex III high-risk obligations apply from 2 December 2027, and product-embedded Annex I high-risk obligations from 2 August 2028.

Not everything is delayed

The "stop the clock" proposal to pause the timeline was rejected. Article 5 prohibitions and Article 4 literacy have applied since 2 February 2025; GPAI obligations under Articles 51–55 since 2 August 2025. These are live now for any Icelandic company on the EU market — incorporation status does not loosen them.

---

What Icelandic obligations look like, on the EU market and after incorporation

Equivalent obligations, identical text

Because EEA incorporation will import the same Regulation text, Icelandic providers and deployers will face the same role-based duties as EU companies — and on the EU market they already do through Article 2. There is no lighter "Icelandic-lite" regime and no Icelandic-specific carve-out; the obligations and the figures are the EU ones.

Roles and the Article 25 role-shift

The roles map identically: provider, deployer, importer, distributor — with importer duties at Article 23 and distributor duties at Article 24. A deployer, distributor, or importer becomes a provider under Article 25 on putting its own name or trademark on a high-risk system, substantially modifying it, or changing its intended purpose. An Icelandic reseller that rebrands a high-risk EU tool, or fine-tunes it into a new purpose, can cross that line without realising it.

High-risk duties and penalties

For a stand-alone Annex III system the provider stack applies directly: risk management, data governance, technical documentation, logging, transparency, human oversight, accuracy and robustness (Articles 9–15), conformity assessment, the Article 49 registration, and provider obligations under Article 16. Penalties are the Article 99 tiers — identical figures, calculated on worldwide turnover, not Icelandic revenue: up to €35 million or 7% for Article 5 breaches (Article 99(3)); €15 million or 3% for most other obligations (Article 99(4)); €7.5 million or 1% for incorrect or misleading information (Article 99(5)). For SMEs, Article 99(6) caps the fine at the lower of the fixed amount or the percentage.

---

Worked example: a Reykjavík analytics firm selling HR-screening AI into the EU

Saga Analytics ehf is a roughly 70-employee Reykjavík firm with around €9 million in annual turnover. It sells an AI CV-screening and candidate-ranking tool to employers in Denmark and Germany.

Why Saga is in scope now

As a provider placing the system on the EU market, Saga is in scope under Article 2(1)(a) today — before any EEA incorporation and before any Icelandic implementing act. Its tool is high-risk under Annex III point 4(a) (recruitment and selection of natural persons), which triggers the full provider stack under Articles 9–15. The Reykjavík headquarters changes nothing.

The prohibited-practice gate comes first

Before any high-risk work, Saga must clear the hard gate at Article 5(1)(f): emotion recognition in the workplace context is a prohibited practice. If the ranking flow infers emotion from video interviews — reading "confidence" or "enthusiasm" from facial expression or tone — that feature must be removed regardless of high-risk status. A prohibited practice is not curable by documentation; it is simply banned.

Saga's pre-market checklist

• Appoint an Article 22 authorised representative established in the Union before placing the system on the EU market (Saga is, for AI-Act purposes, a non-EU-established provider while incorporation is pending).
• Build the Article 11 / Annex IV technical documentation and the Article 47 / Annex V EU declaration of conformity.
• Run the conformity assessment and register the system under Article 49.
• Note the exposure: a high-risk provider breach sits in the Article 99(4) tier. As an SME, Saga benefits from the Article 99(6) cap at the lower of the fixed amount or the percentage, so 3% of roughly €9 million turnover is the operative ceiling, not the €15 million figure.
• Plan against the now-adopted 2 December 2027 high-risk deadline.

---

What Icelandic companies should do now

Act on the EU timeline, not an Icelandic one

Do not wait for EEA incorporation. If you place AI on the EU market or your output is used in the Union, the EU timeline binds you through Article 2 today. Treating incorporation as a starting gun is the trap.

A five-step starting checklist

1. Map your AI systems against Article 2 to confirm where you touch the EU market or your output reaches the Union.
2. Classify each system: clear the Article 5 hard gate first, then assess Article 6 / Annex III for high-risk status.
3. Assign roles — provider, deployer, importer, distributor — and run the Article 25 conversion check on anything you rebrand, modify, or repurpose.
4. For high-risk systems where you are a non-EU-established provider, appoint an Article 22 authorised representative before market placement.
5. Build the compliance file: risk management, Annex IV documentation, conformity assessment, and the Annex V declaration of conformity.

Two developments to monitor

Track two moving pieces for legal review: the EEA Joint Committee incorporation decision and the Icelandic implementing legislation that will designate national authorities; and the Digital Omnibus adoption status that governs the high-risk dates. Liechtenstein and Norway sit in the same EEA position, so the same incorporation logic and Article 2 backstop apply to companies established there.

---

How Confir helps Icelandic companies

Confir derives your provider, deployer, importer, or distributor role and classifies your systems under Articles 5 and 6 with Annex III logic from plain-language intake. The engine is deterministic and rule-based — no model inference, no hallucination — so the same intake always yields the same audit-defensible finding with a human-readable explanation of which rule fired.

Confir generates the Article 11 / Annex IV technical documentation pack and the Article 47 / Annex V declaration of conformity, and supports the Article 27 Fundamental Rights Impact Assessment where it applies. The aim is to position an Icelandic company to be ready against the EU calendar regardless of EEA incorporation timing. The GPAI workflow (Articles 51–55) is partial and on the roadmap, not presented as complete. Confir is EU-hosted, at confir.eu.

---

Related guides

• EU AI Act in Norway: how the EEA mechanism applies the Act
• EU AI Act in Liechtenstein: EEA status and reach
• EU AI Act extraterritorial reach for non-EU companies
• EU AI Act scope explained (Article 2)
• EU AI Act deadlines and application dates