Part of the AI Regulation News hub.
Datatilsynet says it has opened inspections of two AI tools in the Danish public sector, one that selects Tax Ministry employees for internal control and one that flags psychiatric patients at higher risk of belt restraint
This is an announcement that two supervisory cases are open, not a finding. What it does show is what the regulator is asking for first: the impact assessment, and who is responsible for what.
Bottom line: No finding, no order, no sanction. Datatilsynet has announced that it has opened two inspections (tilsyn) of named AI tools at two public bodies, and the page reports no outcome. The announcement adds no new obligation for anyone.
Who this affects: Data protection officers and in-house counsel at Danish state agencies, regions and municipalities; counsel at vendors that supply AI tools to Danish government; and health-sector and HR-adjacent compliance teams that use AI to prioritise patients or select staff.
Issue date: The Datatilsynet page is dated 04-11-2026 (4 November 2026). The page states no deadline and no date for a decision.
What changed: Datatilsynet states that it has opened inspections of (1) an AI tool at Skatteforvaltningen used to select employees in the Ministry of Taxation group for internal checks on tax compliance, begun partly on a complaint, and (2) Region Midtjylland's tool Fokuspatienter i Psykiatrien, used as decision support to identify psychiatric patients at higher risk of belt restraint.
Analysis: Our reading, marked as inference: the page names two things it is testing in both cases, the data protection impact assessments and the allocation of roles and responsibility between the parties involved. A public body or vendor running a comparable tool can check those two documents before any letter arrives. The tax case also touches prohibited AI practices under the AI Act, so one inspection file carries both a data protection question and an AI Act question.
Primary sources: Datatilsynet, Datatilsynet undersøger offentlige myndigheders brug af AI, 04-11-2026 · Hearing letter to Skatteforvaltningen (PDF, linked from the page, not opened by us) · Hearing letter to Region Midtjylland (PDF, linked from the page, not opened by us)
- Instrument (EN)
- Datatilsynet news item announcing inspections of AI use at the Tax Administration and the Central Denmark Region. Native title: Datatilsynet undersøger offentlige myndigheders brug af AI. English rendering is ours
- Authority
- Datatilsynet, the Danish Data Protection Agency
- Jurisdiction
- Denmark
- Status
- Two inspections opened and in progress. The page reports no finding
- Bindingness
- Not a decision. A news announcement of supervisory work; it creates no new obligation for anyone
- Issue date / next deadline
- 4 November 2026 (page date 04-11-2026). No deadline stated on the page
- AI tools named
- An AI tool selecting employees of the Ministry of Taxation group for internal compliance control; Fokuspatienter i Psykiatrien, a decision-support tool in psychiatry
- Editorial Note
- Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.
- Primary source
- https://www.datatilsynet.dk/presse-og-nyheder/nyhedsarkiv/2026/nov/datatilsynet-undersoeger-offentlige-myndigheders-brug-af-ai
Two inspections announced on one page
On 4 November 2026 Datatilsynet published a short news item saying it is examining AI use at Skatteforvaltningen and Region Midtjylland. The inspections, in the page's words, are to examine whether the authorities' processing of personal data lives up to the data protection rules.
That is the whole procedural event. The page says the inspections have been opened (indledt). It does not say when they began, how long they will run, or what Datatilsynet could decide at the end of them.
The tax tool points at staff, not taxpayers
The first inspection concerns an AI solution at Skatteforvaltningen that is used to select employees in the Ministry of Taxation group for internal control of whether they themselves comply with tax and duty legislation. The page says the inspection was opened partly on the basis of a complaint Datatilsynet received.
The people whose data the tool processes, on that description, are the authority's own employees. That is an inference from the page, not a statement in it. It matters because the usual mental picture of tax-authority AI is risk-scoring of taxpayers, and this is a different population with a different relationship to the controller.
The page adds one more element for this case only. In the Skatteforvaltningen inspection Datatilsynet is also looking at matters concerning prohibited AI practices under the AI Act. It does not say which practice, and we have not guessed.
The psychiatric tool is decision support aimed at restraint
The second inspection concerns Region Midtjylland's solution Fokuspatienter i Psykiatrien. The page describes it as decision support in psychiatry that is meant to help identify patients at elevated risk of belt restraint (bæltefiksering), so that treatment measures can be put in place to avoid restraint as far as possible.
Datatilsynet says it learned of the tool during its 2023 mapping of AI use in the public sector. So the regulator has known of this system since 2023, a gap we note without drawing a conclusion from it.
The page does not say what data the tool uses, whether patients were told, or whether anything about its design is in doubt. The stated purpose is protective. The inspection tests the data protection side of a tool whose goal is not itself in question on the page.
What Datatilsynet says it is checking
For both inspections the page lists the same two things as examples of what is being looked at: whether the authorities have prepared the required data protection impact assessments (konsekvensanalyser), and how roles and responsibility are divided among the actors involved. The word the page uses is bl.a., meaning among others, so the list is not exhaustive.
Datatilsynet also says it has focused in recent years on how public authorities in particular process citizens' personal data when developing and using AI, and that these inspections are part of that work. Two hearing letters (høringsbreve), one per authority, are linked as PDFs from the page. We did not open them, so we cannot say what questions they put or by when answers are due.
Datatilsynet's second hat under the AI Act
The page closes with a reminder that in August 2025 Datatilsynet was designated market surveillance authority for two provisions of the AI Act that deal with prohibited forms of AI practice, and that it supervises compliance with those provisions as a result. This is why the Skatteforvaltningen file can include a prohibited-practices question alongside the data protection questions.
We did not open the August 2025 notice the page links to, and we do not name the two provisions. The page says only that they concern prohibited practices.
What we did not verify
We opened the Datatilsynet news page of 4 November 2026 in full, in Danish, and checked each quotation and fact against the Danish text. The page names no outcome, no deadline and no penalty.
We did not open either hearing-letter PDF, the August 2025 designation notice, or Datatilsynet's guidance on public authorities' use of AI that the page links. We cannot report what the letters ask, which data protection or AI Act provisions they cite, or by when the bodies must reply.
We do not claim that either body has breached anything, that either tool is unlawful, or that the inspections signal a wider campaign. We also do not claim that the tool at Skatteforvaltningen falls under any named prohibited practice; the page says only that this is being examined. The gloss on the tax tool's data subjects is our inference from the page's description.
Two documents come up first in this announcement: the impact assessment and the map of who is controller, processor or something in between. If you run or supply an AI tool that profiles staff or prioritises patients, check that both exist and agree with each other. That is our reading of what the regulator chose to name, not a statement of what it has decided.
Source File
Open the Datatilsynet page, confirm the date 04-11-2026, the two named bodies, the two named tools, the line about konsekvensanalyser and rolle- og ansvarsfordelingen, and the final section on the August 2025 AI Act designation. Then open the two linked hearing-letter PDFs, which we did not.
Datatilsynet har indledt tilsyn med behandlingen af personoplysninger i forbindelse med konkrete AI-løsninger hos henholdsvis Skatteforvaltningen og Region Midtjylland. · Datatilsynet, 4 November 2026
FAQ
Has Datatilsynet found that the Danish Tax Administration or Region Midtjylland broke the law?
No. The page announces that inspections have been opened and reports no finding. Nothing on it says either body has breached the data protection rules or the AI Act.
Which AI tools are being inspected?
At Skatteforvaltningen, an AI solution used to select employees in the Ministry of Taxation group for internal control of tax compliance. At Region Midtjylland, the decision-support solution Fokuspatienter i Psykiatrien, used to help identify psychiatric patients at higher risk of belt restraint.
What is Datatilsynet examining in both inspections?
Among other things, whether the authorities have prepared the necessary data protection impact assessments and how roles and responsibility are divided among the actors involved. In the Skatteforvaltningen inspection it is also examining matters concerning prohibited AI practices under the AI Act.
Does this announcement apply to private companies?
The page concerns two public bodies and says Datatilsynet has in recent years focused especially on public authorities' use of AI. It makes no statement about private-sector controllers, and we do not extend it to them.
Related briefings
Sponsored Training
Practical AI training for regulated professionals, built around verification, documentation and a defensible process. See the courses.