AI Regulation Tracker  /  Signal, not a rule

Iceland Put Its AI Act Bill Behind a Step Nobody Has Taken Yet

A May 28, 2026 ministry release says the implementing bill goes to Althingi only once the AI Act has been taken up into the EEA Agreement. Iceland's own EEA database still records the file as under scrutiny with implementation not begun. Neither the release nor the database is itself a binding rule.

By Anthony Guerriero  ·  Reviewed by Anthony Guerriero  ·  Published August 3, 2026  ·  Updated August 3, 2026  ·  Signal, not a rule

Key facts

Regulatory briefing

Instrument

Press release of the Ministry of Culture, Innovation and Higher Education, "Ráðuneyti sameinast gegn djúpfölsun", May 28, 2026, establishing a three-ministry working group and stating the government's AI Act sequencing

Authority

Ministry of Culture, Innovation and Higher Education (lead), with the Ministry of Industries and the Ministry of Justice

Jurisdiction

Iceland, an EEA EFTA state outside the European Union

Status

Working group active. Regulation (EU) 2024/1689 recorded as under scrutiny for incorporation into the EEA Agreement, implementation not begun

Bindingness

Non-binding framework. The release announces a mandate and states an intention; it imposes no duty and amends no statute

Effective date

None. Working group conclusions are due no later than October 1, year not stated in the release

Primary source

Ministry of Culture, Innovation and Higher Education, May 28, 2026

What the release actually says, and what it is not

Start with the category, because it decides how much weight the item can carry. This is a ministry press release. It announces a working group, states what that group is asked to do, and sets out the government's thinking on a European regulation. It is not a statute, not a regulation, and not a bill. Nothing in it requires anyone to do anything, and no Icelandic obligation begins because of it.

What makes it worth reading anyway is that it puts the government's sequencing on the record, with a date attached. The ministry writes:

Í menningar-, nýsköpunar- og háskólaráðuneyti er fylgst náið með þróun á gervigreindarreglugerð Evrópusambandsins (AI Act) ... Gert er ráð fyrir að leggja fram frumvarp á Alþingi til innleiðingar á reglugerðinni þegar hún hefur verið tekin upp í EES-samninginn.Ministry of Culture, Innovation and Higher Education, "Ráðuneyti sameinast gegn djúpfölsun", May 28, 2026

In English: the ministry is closely monitoring developments on the European Union's artificial intelligence regulation, and it is envisaged that a bill will be submitted to Althingi to implement the Regulation once it has been taken up into the EEA Agreement. Note the conditional. The bill is not scheduled against a calendar date. It is scheduled against an event, and that event is outside the ministry's sole control.

The second half of the release describes the working group. Three ministries are involved: Culture, Innovation and Higher Education as lead, with the Ministry of Industries and the Ministry of Justice represented. The chair is dr. María Rún Bjarnadóttir. The group is asked to analyse which aspects relating to deepfakes are already protected by law and where existing legislation needs improvement, to map the overlap between ministries, and to put forward proposals for improvement. Its conclusions are to be available no later than October 1. The release does not say which year, and I am not going to fill that in for it, although the release itself is dated May 28, 2026.

I would treat the mandate language as the interesting part. A group asked to find where existing legislation needs improvement is a group that has been told to come back with drafting proposals, not with a literature review. That is a different posture from a study commission.

Why Iceland is not on the European Union's clock

American readers routinely assume that Iceland, Norway and Liechtenstein get EU digital rules at the same moment EU member states do. They do not, and the difference is structural rather than political.

Iceland is a party to the Agreement on the European Economic Area, not a member of the European Union. An EU regulation does not become part of Icelandic law by its own force. It has to be taken up into the EEA Agreement first, which is a distinct legal step, and only then does the national implementation stage begin. Until that happens, the Regulation's own application dates are dates for the Union, not for Iceland.

Iceland's government publishes its own tracking of exactly this process, and the entry for Regulation (EU) 2024/1689 is unambiguous about where the file sits. It records the status as an EU act under scrutiny by Iceland, Liechtenstein and Norway for incorporation into the EEA Agreement. It records the state of implementation work as implementation not begun. It records that Althingi has not completed its assessment. It records that the sectoral ministry's information-sheet work is not complete and that the Foreign Ministry has not approved transmission of a draft Joint Committee Decision. It records that no consultation has taken place. The responsible ministry named on the file is the same Ministry of Culture, Innovation and Higher Education that issued the May release.

One filing detail is worth flagging precisely so that nobody over-reads it. The database places the file in EEA Annex 11, electronic communications, audiovisual services and the information society, sub-area 11.01 telecommunication services. That is where the file was put for administrative purposes. It is not a designation of a regulator, and it should not be read as telling you which Icelandic body will supervise AI. No Joint Committee Decision has been adopted, so the annex placement is a preparatory entry rather than an agreed term.

The practical consequence is simple and easy to state without exaggeration. As of August 3, 2026, the AI Act has not been incorporated into the EEA Agreement and is not in force in Iceland. The Regulation became generally applicable in the Union on August 2, 2026, one day earlier. Those two facts sit side by side and neither one moves the other.

The deepfake track is the one that can move first

If you only track AI Act transposition, you will miss what Iceland is actually doing, because the deepfake working group does not depend on the EEA step at all.

The mandate is set out in the release itself:

Vinnuhópnum er ætlað að greina hvaða þættir í tengslum við djúpfölsun eru þegar varðir með lögum og hvar gildandi löggjöf þarfnast úrbóta. Hópurinn muni kortleggja skörun milli ráðuneyta og leggja fram tillögur að úrbótum ... Niðurstaða hópsins á að liggja fyrir eigi síðar en 1. október.Ministry of Culture, Innovation and Higher Education, May 28, 2026

Read that as three tasks and a deadline. Inventory what Icelandic law already covers. Find where it does not. Sort out which ministry owns which piece. Then propose fixes, by October 1. The third task is the one that tells you this is a real file rather than a gesture: mapping overlap between ministries is the kind of housekeeping a government does when it expects to hand someone a drafting instruction at the end.

This is also not a first move. The same ministry issued a release on August 15, 2025 recording an earlier and narrower step, referring likeness and voice rights to the copyright committee after a petition from arts organisations in July 2025. The May 2026 working group is broader and cross-ministerial, and it reaches misuse of AI technology generally rather than a single rights question. Read together, the two releases look like a file that started with performers and widened.

The Ministry of Justice's presence in the group is the detail I would weigh most. A mandate that includes finding where legislation needs tightening, with justice at the table, points toward criminal and civil remedies rather than a product-safety style regime. That is a different instrument family from the AI Act, and it would apply to conduct regardless of whether the Regulation ever enters the EEA Agreement. I am describing a plausible direction, not a prediction, and the group's conclusions have not been delivered or published in the sources reviewed.

The release also confirms that the Digital Services Act has likewise not been taken up into the EEA Agreement, and that preparation for its implementation is under way in the Ministry of Industries. That is a useful cross-check on the pattern: Iceland is preparing for both EU digital files domestically while neither has completed the EEA step.

Who supervises AI in Iceland right now

The honest answer is that the record does not give you a name. No Icelandic market surveillance authority or notifying authority under Regulation (EU) 2024/1689 has been notified, and none was identified in the national sources reviewed for this entry. I want to be precise about what that sentence does and does not say. It reports the state of the published record on August 3, 2026. It is not a finding that no arrangement exists anywhere, and it is certainly not a finding that Iceland will never designate one. A designation could be published tomorrow and the sentence would be out of date the same day. Write it into your register that way, with the date attached, rather than as a settled conclusion.

The reason the blank is unsurprising is structural rather than a matter of Icelandic diligence. The AI Act's designation duties are duties under the Regulation. Iceland's government records the Regulation as still under scrutiny for incorporation into the EEA Agreement and its implementation work as not begun. A state that has not taken an instrument into its legal order has nothing yet to designate an authority under. The absence of a name in Iceland and the presence of one in an EU member state are answers to two different questions, and putting them in the same column of a spreadsheet is how compliance teams end up with false comparisons.

Be careful with a specific trap here. Because the EEA database files the AI Act under the telecommunications annex, secondary trackers sometimes infer that Iceland's electronic communications regulator has been handed the AI file. No source reviewed says that. The annex is a filing convention. Do not put an inferred regulator into a compliance register, because a wrong counterpart name is worse than a blank field: it produces confident correspondence sent to a body with no mandate.

What does apply in Iceland today is ordinary Icelandic law, which is precisely what the working group has been asked to inventory. Defamation, privacy, personal data, image rights, consumer protection and criminal provisions do not stop applying to synthetic media because no AI-specific statute exists. The gap the group is mapping is a gap in coverage, not an absence of law.

What a US operator should actually do

Start by separating your Icelandic exposure from your EU exposure, because people conflate them and then either over-comply or under-comply in the wrong place.

If you place AI systems on the market in EU member states, the AI Act applies to you on the Union timetable and nothing in this Icelandic file changes that. General application arrived on August 2, 2026. Transparency and watermarking duties follow on December 2, 2026. High-risk duties sit at December 2, 2027 for stand-alone Annex III systems and August 2, 2028 for Annex I embedded systems after the Digital Omnibus moved them. Iceland's status is irrelevant to that work.

If Iceland itself is a market you serve, your position today is that the Regulation is not in force there and that no AI Act supervisor appears in the record to receive a notification. What I would not do is treat that as a reason to build a separate, lighter Icelandic product configuration. The sequencing the ministry described is a delay in the start line, not a decision to sit the race out, and unwinding a divergent configuration later costs more than never building it.

The concrete Monday work is short. Record Iceland in your jurisdiction matrix as EEA EFTA, AI Act not incorporated, implementation not begun, no authority notified, and record the date you checked, because this is a status that changes by a single administrative act. Put a watch on the Ministry of Culture, Innovation and Higher Education as the responsible ministry for the file and on the government EEA database entry, which is where the government records the state of the incorporation file. Separately, put a watch on the deepfake working group, since it runs on its own schedule and does not depend on the EEA step.

If your product generates or edits synthetic images, audio or video of real people, the Icelandic file is a reason to get your own house in order rather than to wait. The working group has been asked to identify where existing Icelandic law fails to cover deepfakes and to propose remedies. I cannot tell you what it will propose, and the record does not support guessing. What I can say is that the controls a firm would need in order to answer almost any rule in that family are controls it can build now and would have to build anyway for the Union's own transparency and watermarking duties, which apply from December 2, 2026 in EU member states. Knowing which of your outputs are synthetic, being able to label them, keeping provenance metadata intact through your pipeline, and having a route by which a person can complain that their likeness or voice was used are not exotic requirements. They are the minimum a serious operator needs in order to answer a regulator, a plaintiff or a journalist, in any jurisdiction.

The last thing I would say is about how to hold this file mentally. It is tempting to file Iceland under nothing to do and move on, and for the AI Act question that is close to right today. But the reason it is right is procedural, and procedural facts flip fast. One Joint Committee step, one bill, one report from a working group with three ministries behind it, and the Icelandic row in your matrix changes character entirely. The cost of watching two named sources and dating your entry is close to zero. The cost of discovering the change from a customer is not.

Last verified: August 3, 2026 against the primary sources listed above.