Norway's Datatilsynet sandbox report says an AI minutes assistant in child welfare cases is lawful if data minimisation and storage limitation are respected, as non-binding advice

Key takeaways

• The conclusions are advice. Datatilsynet says they are not official decisions, rulings or approvals.
• Datatilsynet finds use of the AI assistant lawful if data minimisation and storage limitation are respected.
• Datatilsynet recommends deleting audio once the transcript exists, and the transcript once the final minutes are done.
• Model choice and information security were not assessed and remain the controller's responsibility.

Is the Datatilsynet sandbox report binding, and what did it conclude?

No. Datatilsynet states that in the sandbox it advises participants, that "konklusjonene er ikke offisielle avgjørelser, vedtak eller godkjenninger" (the conclusions are not official decisions, rulings or approvals), and that participants choose whether to follow the advice. The headline finding is stated as "Bruk av KI-assistenten er lovlig" (use of the AI assistant is lawful). Datatilsynet says the GDPR and the Child Welfare Act give a valid legal basis for the processing, and that lawful use depends on the solution respecting data minimisation and storage limitation.

The project looked at an assistant that records a conversation, uses AI to produce a written transcript and then drafts minutes. The three municipalities, Kongsvinger, Stange and Ringsaker, are considering the tool, and the report limits itself to child welfare services. In weighing necessity and proportionality, Datatilsynet says it gave weight to the wide scope child welfare has for investigations and to the current backlog in writing minutes. Our article on the Danish Datatilsynet sandbox reports covers a separate set of sandbox outputs.

What conditions does the report attach to lawful use?

Datatilsynet lists four main conclusions. The first is the lawfulness finding above, conditional on data minimisation and storage limitation. The second is that trust in the technology is decisive: its assessment of necessity and proportionality is directly affected by whether meeting participants trust the tool, and if families stop sharing important information it becomes less clear that using the tool serves its purpose.

The third concerns deletion. Datatilsynet recommends that "lydopptaket slettes så snart transkripsjonsteksten foreligger" (the audio recording is deleted as soon as the transcript exists), and that the transcript itself is deleted as soon as the final minutes are finished. The fourth concerns openness. Data subjects should get clear information that the AI assistant is used, which personal data is processed and how, and Datatilsynet's text says the municipalities "must also have a clear routine in place" for handling objections from users (Norwegian: "må også ha på plass en klar rutine").

What did the project leave out of scope?

Datatilsynet states that the project did not assess the choice of specific AI models or information security requirements, because ensuring these is the controller's own responsibility. In our reading, a municipality or vendor therefore cannot treat the report as clearing a particular product or its security setup. The report also does not extend to other services beyond child welfare, since the project limited its assessments to that use.

The Datatilsynet page describes the sandbox as a space where participants work with the authority on privacy questions so that the service follows the law, and where the findings can help others with similar problems. It adds that the sandbox is useful where the law has few practical examples to point to.

What should municipalities, counsel and vendors do now?

For public-sector counsel and data protection officers, the report is a reference point for a child welfare minutes tool, not an approval. For vendors of meeting-transcription tools, the news page points to short audio retention, short transcript retention, plain information to the people recorded and a working objection route.

• Check how long your tool keeps audio and transcripts, and whether deletion follows the sequence in the report.
• Review the information given to families and other data subjects about the AI assistant, including what personal data is processed and how.
• Write down the routine for handling objections and who owns it.
• Record your own assessment of model choice and information security, which the report leaves to the controller.
• Read the full report PDF for the detail behind the four conclusions before relying on this summary.

What are the key dates and parties?

What we did not verify

What we opened: the Datatilsynet news page for the report, in Norwegian, on 2026-10-25.

What we did not open: the full report PDF linked from that page, the launch webinar recording, and any statement by the municipalities. We did not check how the Child Welfare Act or the GDPR provisions are applied in the full report, and we rely on the news page for the four conclusions.

What we refuse to claim: that the conclusions are binding, that Datatilsynet has approved a product or a municipality's deployment, that the report applies outside child welfare, or any legal position beyond what the page states.

Related briefings

• AI Regulation News hub
• Europe AI regulation tracker
• Attorneys and AI regulation
• Danish Datatilsynet AI sandbox final reports
• Denmark consultation on a legal basis for public-body AI under the GDPR
• Norway Datatilsynet guidance on AI smart glasses
• Ambient AI scribes, accuracy and the regulatory gap