The writing of insurance contracts in Norway is regulated by the Norwegian Insurance Contract Act (ICA) which sets out rights and duties for both the insurer and the insured. With the implementation of EU directive on insurance distribution (IDD) and the Amendment Act, the ICA got a new structure and especially some changes related to the customer communication and distribution.

The new ICA went into force by 1st of July 2022.

ICA consists of the following six parts:

First Part. General Provisions.

• – Area of operation – definitions – exemption access – the companies’ general duties – rules on electrical communication – provisions that the first part of the Act also applies to insurance intermediaries.

Second Part. Precontractual obligations.

• – The duty to identify the customer’s requirements and needs – the duty to investigate the customer’s knowledge, experience, financial situation and investment goals before giving a personal recommendation on insurance-based investment products – rules on refusal of insurance – ban on cross-selling – obligation to provide information, rules on how information must be provided and standardized information document (IPID) – right of withdrawal

Third Part. Contracts for non-life insurance (The non-life insurance part)

Fourth Part. Contracts for the insurance of individuals (the life insurance part)

Fifth Part. Provisions of complaints handling, supervision, and sanctions.

• – the companies’ liability for compensation for breaches of the law – duty to have appropriate and effective complaint handling – The Consumer Authority and the Markets Council’s access to supervise the companies – infringement fee

Sixth Part. Entry into force and transitional provisions.

Insurance contracts are also subject to the general principle of Norwegian contract law. The parties are free to agree on the terms in the insurance contract, but their freedom of contract is limited by the mandatory provisions in ICA.

The provisions in the Third Part of ICA cannot be contracted out of, other than in respect of an injured third party’s direct right of action against an insolvent tortfeasor’s liability insurer, whilst none of the provisions in Part Four of ICA can be contracted out of to the detriment of insured.

Note that the right to contract out of the remaining provisions of the ICA only applies to the extent that the insured entity is a commercial insured, and meets the following conditions:

• Has more than 250 employees, and has revenues for more than € 13 600 000 million based on the last available financial statements, or has assets worth more than € 6 600 000 million according to its balance sheets.

The commercial insured exemption also applies when the insured’s business is mainly based in a foreign country, if the insurance covers vessels or aircrafts, or if the insurance covers goods under international transportation.

By the implementation of IDD in Norwegian insurance law, electronic communication is the default choice of communication with the customer/ insured.

Different rules apply to non-life insurance undertakings, life insurance undertakings and credit insurance undertakings as set out in the Financial Institution Act with accompanying regulations.

There are separate licences for different types of insurance undertaking, and different capital requirements. Non-life and life insurance activities cannot be carried out by the same undertaking, as an entity may only obtain a licence to perform one type of insurance activity. Reinsurance is also a separate licence, however, there is no separate legal basis for it, and it will rely on the licence requirements applicable for the underlying insurance activities.

Life insurance contracts are regulated in the fourth part of the Norwegian Insurance Act, whilst the third part pf the act regulates and non-life insurance. ICA does not apply to reinsurers. Reinsurance contracts are generally considered to be regular commercial contracts subject to the general principles of Norwegian contract law and other legislation, depending on the issue at hand.

Yes, insurance brokers, insurance agents and ancillary agents in the Norwegian market are subject regulation set out to the Insurance Mediation Act 2021 with accompanying regulations. Insurance Mediation Act 2021 implements The Insurance Distribution Directive of 2016/97/EU (“IDD”) in Norwegian Law. Note that there some areas where the Norwegian legislators have exercised the possibility to implement stricter requirements than what is set out in IDD.

In brief, the act sets out certain educational requirements, and as a minimum requirement, insurance intermediaries must show necessary knowledge of the terms and conditions of the policies offered, the applicable law, the insurance market, financial competency, and claims and complaints handling.

It is an absolute requirement for all insurers and reinsurers to obtain a licence from the Norwegian Financial Supervisory Authority (the “NFSA“) to operate in Norway.

Norway is a member of the European Economic Area (“EEA”) and therefore takes part in the “single passport system”. This means that insurers established in other EEA countries may in general obtain their licence through their home country regulator. The system then allows the insurance undertaking to provide services by offering them from its home country to a customer in another EEA country online or by telephone. Alternatively, the insurance undertaking can establish a branch in Norway. A non-EEA undertaking may apply for a Norwegian licence to conduct insurance activities through the establishment of a Norwegian subsidiary.

The key criteria for authorisation are the fulfilment of the minimum requirement for start-up capital and that the legal requirements as set out in the Financial Institution Act, such as having sufficiently experienced and capable board members and management.

The decision on an application is to be decided by the NFSA and communicated to the applicant within six months from when the application was received. If the application does not contain all necessary information to decide whether a licence shall be granted, the NFSA may ask for further information which can delay the application process. However, the application shall in all cases be decided within twelve months of its receipt.

In our experience the application process takes around six months if the application contains all the necessary information.

Norwegian insurance intermediary undertakings also require a licence from the NFSA to operate in Norway. The application will be processed within 3 months from with it is received by the NFSA – if it contains all the relevant and necessary information. Insurance intermediaries who are registered in another EEA state may commence activities in Norway through a branch or as cross-border services one month after NFSA has received notification of the planned activities from the supervisory authority in the undertaking’s home country. Insurance intermediary undertakings registered outside the EEA can only conduct business in Norway through a branch if they obtain a specific approval from the NFSA.

Yes. Insurers are subject to provisions on ownership control, which apply to all ‘financial enterprises’ as defined by the Financial Enterprises Act. Any person intending to carry out an acquisition where he or she will become the owner of a qualifying holding in an insurance company must notify, and get an approval from, NFSA or alternatively the Ministry of Finance, in advance. A qualifying holding is deemed to be a holding that represents 10 per cent or more of the capital or voting rights of a financial institution, or which otherwise makes it possible to exercise significant influence over the management of an institution and its business. The provisions apply to the acquisition of holdings in insurers by both foreign and Norwegian entities and persons. Approval may be granted only if the acquirer is considered appropriate according to specific non-discriminatory criteria as further described in the Financial Enterprises Act (the so-called ‘fit and proper’ test). In general, an acquire must be reassuring and financially equipped to hold the position.

Further, requirements of new approvals are triggered when a holding reaches or exceeds certain thresholds (20%, 30% and 50%).

Three-quarters of the share capital of the insurance undertaking shall be subscribed by increase of capital with no preferential right for shareholders or others.

There are no restrictions on foreign ownership of an insurance company in Norwegian law.

It is possible for foreign non-licensed insurers to cover risks in Norway, but they cannot lawfully market their products and operate in the Norwegian marked without a licence.

An insurer domiciled in another EEA member state can market their products on a freedom of services basis and utilize its licence through their home state regulator by way of reciprocity into Norway.

Yes, the Financial Institution Act 2015 and the Insurance Mediation Act 2021 (and related regulations, including the Regulation on Financial Enterprises and Financial Groups and the Regulation on Insurance Mediation), govern insurance businesses conducted in Norway by insurers, reinsurers and insurance intermediators incorporated in Norway.

Insurers, reinsurers and insurance intermediators incorporated in a member state of the EEA (European Economic Area) that conduct their business through branches established in Norway are governed by both the regulatory requirements in their home states and the regulatory requirements of the Financial Enterprises Act, the Insurance Activity Act , and the Insurance mediation Act, with certain exceptions.

Insurers and insurance intermediators that only conduct activities in Norway on a cross-border basis are governed by the licence and other regulatory requirements of their home states. Only a few specific requirements in the Financial Enterprises Act, Insurance Activity Act and Insurance Meditation Act apply to their practice, mostly related to information duties on sales.

The Financial Undertakings and Financial Group Act (Finansforetaksloven 10.04.2015 nr. 17) chapters 2, 3, 4, 5, 14, and 17 are especially relevant in these matters. As well as the Insurance Business Act 10.06.2005 No. 44.

Overseas insurers with head offices outside the EEA can, with special permission from the Norwegian Financial Supervisory Authority (NFSA), establish a branch in Norway. However, the permit can only cover activities that correspond with the permitted business operating in the home state, and only if this business is subject to a satisfactory supervision in that home state.

The NFSA has set out specific requirements for granting authorisation to foreign insurance companies seeking to establish branches in the country.

There are requirements regarding location of head office/ business office in Norway, employed staff locally, ownership, minimum initial capital, and management of the enterprise. Furthermore, there are requirements set by law or pursuant to law, amongst this, responsible business activities. The company must also have sufficient financial resources/ solvency margins. The insurance distribution must comply with the Norwegian insurance product classes as well as the Solvency-II Directive.

The EIOPA Guidelines on the supervision of branches of third-country insurance undertakings require that third-country insurers must comply with the Solvency-II Directive, which includes a number of requirements related to financial resources and reporting (ORSA), risk management, governance, and an internal control system of insurers. Third-country insurers must also comply with the specific requirements set out in the Norwegian insurance laws and regulations.

It is not open to cross-border activities beyond the cases that regards activities from other EEA member states.

It is a criminal offence to operate without appropriate permission. Such actions can be punished with fines and imprisonment for up to one year as set out in the Financial Institution Act section 22-1.

If an insurance or reinsurance undertaking fails to comply with the legal requirements, the NFSA may issue warnings and order the insurer to take corrective actions and/or order the undertaking to cease its activities. NFSA can also revoke the entity’s licences.

In our opinion the supervisory and enforcement environment is not rigorous. Withdrawal of licences is very unusual in Norway and has only been seen effectuated in few cases for insurance intermediaries.

Through its supervision of enterprises and markets, NFSA strives to promote financial stability and orderly market conditions and to instill confidence that financial contracts will be honored, and services performed as intended. The key area of its supervision is solvency, governance and risk management, capital situation and requirements, products and behavior towards customers. The supervision is based both on the information that companies are obliged to report to the NFSA, as well as NFSA carrying out their own investigations by reviewing random sample groups and following up tips about irregularities.

Norwegian insurers and reinsurers are obliged to perform their own supervision and self-reporting of their solvency and financial position at least once per year and report their findings to the NFSA. This process must be an integrated part of the undertakings system for risk control. If the undertakings financial situation changes, and The NFSA can demand a more frequent reporting.

NFSA also supervises insurers’ and reinsurers’ solvency through risk assessments based on the state of the financial markets and the financial system, as well as conducting continuous risk assessments of individual insurance undertakings.

The minimum capital requirements for Norwegian insurance companies are based on the EU Solvency II Directive and is regulated in the Financial Institutions Act 2015.

The minimum capital requirement shall be calculated to ensure an 85 per cent probability that overall losses over a period of 12 months will not exceed the calculated capital requirement. The minimum capital requirement shall not be lower than 25 per cent or higher than 45 per cent of the company’s solvency capital requirement including any capital requirement add-on Regardless of this, the minimum capital requirement shall not be less than the start-up capital requirement for the undertaking, which in NOK is equivalent to:

1. for life insurance undertakings EUR 3.7 million.
2. for other insurance undertakings EUR 2.5 million, but EUR 3.7 million if the undertaking writes liability insurance connected to motor vehicles, aircraft or vessels or other liability insurances, or credit or guarantee insurance
3. for reinsurance undertakings EUR 3.6 million, but EUR 1.2 million for reinsurance undertakings which according to their articles of association may only write reinsurance for a particular range of insurance policy holders

In addition to the minimum requirements, other capital requirements are found in the Norwegian Financial Institutions Act.

Norway has a policyholder protection scheme called The Norwegian Non-life Insurance Guarantee Scheme (“the Guarantee Scheme”). The purpose of the Guarantee Scheme is to ensure coverage of insurance claims filed under agreements on direct non-life insurance, to the secured and injured party. The task of the Guarantee Scheme is to cover claims from policyholders in insurance undertakings which are placed under public administration and member of the Guarantee Scheme, provided that the claim falls within the scope of coverage of the scheme.

The Guarantee Scheme is a legal entity and none of the members has a proprietary right to any part of the funds of the guarantee scheme.

Under the EU Solvency II Directive, groups are subject to supplementary supervision in addition to the solo supervision of individual insurance companies. The EU Solvency II Directive is implemented in Norwegian law through the Norwegian Act on Financial Institutions 2015 and the Norwegian Solvency II-regulation of 2016.

Insurance groups are subject to specific requirements with regards to consolidation of solvency, reporting of risk on a group level to the NFSA, risk assessment and internal audit, market reporting and disclosure of group structure.

Board members, the general manager and other persons that manage the insurance business are subject to a fit and proper assessment conducted as part of the licence application. Any subsequent changes to the senior managers must be reported to the NFSA. The fit and proper assessment will be based on completed suitability forms and certificate of good conduct, as well as other publicly available information.

There are also fit and proper requirements applicable to the management of the insurance intermediaries.

In principle it is the undertaking that will be held liable for regulatory breaches, but anyone who willfully or through negligence contravenes the provisions in the Financial Institution Act may be punished by fines or imprisonment up to one year. This also comprises senior managers. NFSA can also impose a change of senior management if they find that the senior manager does not meet the fit and proper requirements as a result of having conducted a regulatory breach.

It should also be noted that senior managers can be held liable for the entity’s or a third party’s loss in accordance with the regulations set out in the Norwegian Company Act, where it is stated that the general manager, a member of the board of directors, member of the corporate assembly, independent expert, investigator or shareholder can be held liable for any damage which they, in the capacity mentioned, have caused intentionally or negligently.

The physical presence requirements to undertake insurance activities and maintain relevant licenses and authorisations in Norway will depend on the company’s structure for market entry.

If the activities are conducted through a separate Norwegian company in Norway, the company must be registered and established in accordance with Norwegian company law, and must then have a Norwegian business address (i.e. a Norwegian physical address which is stated in the format: street/road, house number, postcode and postal town. Post-box addresses will not be accepted).

Should a company choose to establish a branch of a foreign company in Norway (NUF), the minimum presence requirement is that the branch must have a designated contact person. There is no requirement for this contact person to have a residence in Norway, but they must have a Norwegian national ID or d-number. If the contact person does not have a Norwegian personal identification number or a d-number, an application for a d-number must be submitted together with the Coordinated register notification registration form.

There are in general no presence requirements for companies that conduct insurance activities in Norway on a cross-border basis. Note that companies providing motor insurance in the Norwegian market must have a designated contact person that is domiciled or established in Norway.

EU Solvency II Directive implemented in Norwegian law through the Financial institution Act provides specific rules and restrictions that apply to outsourcing parts of the business.

Outsourcing is regulated in section 13-4 of the Financial Institution Act. The insurer may outsource certain parts of the business, but core tasks cannot be delegated. Nor can outsourcing be done in a scale or in a manner that cannot be deemed prudent or makes the supervision of the outsourced business or of the institution’s overall business difficult. There is an obligation to notify the NFSA in advance of the outsourcing unless an exemption applies. The duty to notify follows from the Norwegian Act on Financial Supervision section 4c.

An insurance undertaking cannot not engage in business other than the insurance activity it is licensed for. Previously the Financial Institution Act set out a provision stating that the undertakings subject to Norwegian law could only invest in owner shares up to 15% in entities with little or no connection to insurance. The 15% rule is now lifted, and the regulation no longer sets a quantified limit in connection to assets insurers or reinsurers can invest in before they are considered to be engaging in business other than insurance activity. Whether or not an undertaking is considered to be engaging in non-insurance activity as a result of its investments will be subject to a qualitative and discretional assessment conducted by the NFSA.

No, but note that there are special requirements for insurance companies’ information on insurance products, premium calculation and reinsurance to be provided by insurance companies, cf. insurance directive 2009/138/EC (Solvency II) art. 23 No. 1.

Insurers are expected to take into account the nature, scale and complexity of their business when developing their reinsurance strategy and reinsurance arrangements. The NFSA, may ask for the company’s assessment of how risk calculations as well as reinsurance risk or reinsurance premiums is linked to, for example, global events or global climate events, set to a short or long-time horizon in the internal model.

Especially, pension funds must always have reinsurance that is satisfactory in relation to the pension fund’s risk exposure and its financial position.

The requirements for insurance companies shall be in accordance with the Solvency II directive. The board must ensure that there are updated guidelines for the nature and extent of the pension fund’s reinsurance and that these are followed up.

Life insurance companies can, as a limited part of their business, take over reinsurance within the classes covered by the permit.

Marketing and sale of insurance are subject to several Norwegian regulations. Certain general requirements for sales are set out in the Financial Institutions Act chapter 16, which includes provisions regarding information obligations to the purchaser, pricing, product packaging and terms and conditions. Part 1 and 2 of The Norwegian Insurance Contract Act set out rules in relation to what information the consumer must receive prior to entering into an insurance contract, and how this information is to be presented. The rules apply to both insurers and insurance intermediaries. In addition to this The Insurance Mediation Act 2021 also sets out specific provisions for sales that are done through an insurance broker or insurance agent.

Marketing and sales activities are subject to various general legal requirements under the Norwegian Marketing Act which is supervised controlled by the Norwegian Market Council and Consumer Supervision Authority.

Consumer protection is also carried out through the Norwegian Consumer Advisory Council and Consumer Supervision Authority. Furthermore, it can be noted that consumers have the possibility to file complaints concerning insurance undertakings and insurance contracts to the Norwegian Financial Services Complaints Board (FinKN).

NFSA supervises the sale of insurance through their supervision of products, market behavior, and complaint reporting. They can also take measures in specific cases if they are notified of breached or become aware of this through the media etc.

Sale of insurance can be actively marked into Norway on a cross boarder basis, but all marketing targeting Norwegian consumers and companies will be subject to the Norwegian marketing and consumer regulation.

When a consumer enters into an insurance contract online or by other means of distance sale, the Act relating to the duty of disclosure regarding and right to cancel distance contracts and off-premises sales (the Cancellation Act) applies. The Cancellation Act is an implementation of Directive 2011/83/EU relating to consumer rights. In accordance with the Cancellation Act the insurer or the intermediary shall, in reasonable time before a distance contract is concluded, give the consumer information as set out in section 28 of the Cancellation Act. The information is to be given in writing on a durable medium that the consumer has control over, and incudes i.e. information about the seller, approval schemes and information on the relevant supervisory authority, the product’s most important properties, special risks, cancellation rights, etc.The consumer may at any time during the contractual relationship ask to be given a printed copy of the contractual conditions. As a result of section 20-3 in ICA the insured must give the insurance undertaking an explicit consent to enable the use of electronical communication. The Cancellation Act also entitles the consumer to withdraw from the contract by giving notice to the insurer before the expiry of the cancellation period. For life insurance and individual pension contracts, the cancellation period is 30 days. For other contracts, the cancellation period is 14 days. Should the right to cancel be exercised, the parties’ duty to fulfil the contract lapses. If any of the parties have fulfilled all or parts of the contract, restitution shall take place.

It is also worth noting that Norway has a prohibition on direct marketing by telephone and addressed mail when the recipient has opted out. More than 2 million Norwegians have opted-out from such marketing, and the access to these marketing channels are therefore limited.

Consumer policies are subject to several restrictions under Norwegian law. The Insurance Contact Act provides detailed mandatory regulations that benefits and protects the insured. The regulation includes sections imposing strict information requirements on the insurance undertaking, provisions relating to the right of cancellation and restrictions on the undertaking’s right to change the terms of the insurance contract in the period of cover.

It can also be noted that the Norwegian courts, when interpreting an insurance contract, are likely to interpret an unclear clause in favor of the insured. The Norwegian courts can also amend the terms of the insurance contract in a specific case if the contract is found to be unreasonable or unfair, although the threshold for this is very high.

When it comes to the pricing of premiums, the parties are free to agree which price will apply to the product in question. However, there are regulations in the Insurance Contract Act, as well as case law, about renewal. The company may, in connection with renewal, have access to regulate the premiums. If the premiums are significantly increased (more than 25%), the company must notify the consumer and explicitly explain the reason for the premium increase. If the company has breached its obligation to provide information, the premium increase may be considered invalid.

In Norway, disputes between insurance companies have been effectively reduced through binding industry standards, recourse agreements, pool arrangements, and agreements on case / customer management. If the parties cannot reach an agreement, the matter is resolved through ordinary court proceedings or arbitration.

Concerning disputes between insurers and policy holders, The Norwegian Financial Services Complaints Board (Finansklagenemnda/FinKN) is a complaints board that serves as an independent dispute resolution body for customers who have complaints against financial institutions such as banks, insurance companies, investment firms, and other financial services providers. Its activities are in accordance with the provisions of the ADR Entities Act and the Insurance Contracts Act.

FinKN is composed of independent experts in finance, law, and consumer affairs, who are appointed by the Norwegian Ministry of Finance. The board operates under strict rules of confidentiality and impartiality. It is committed to providing fair and efficient dispute resolution services to consumers and financial institutions alike.

Norwegian judges are generalists and there are no specialist commercial courts. However, in complex cases, the court may be set with specialist judges in addition to the ordinary judge. In particular, the ordinary judges are used to handle quite complex insurance law matters. Overall, we are of the opinion that the courts are adept at handling complex commercial claims. Sometimes, arbitration is used as an alternative to litigation in such cases.

The use of alternative dispute resolution is well established in Norway as an alternative to litigation. Mediation, both out of court and court-linked mediation are often used to avoid ordinary litigation. The use of arbitration is also well established in Norway due to a frequent use of arbitration clauses in commercial insurance policies.

It should also be noted that the Conciliation Board in Norway is the court of first instance (instead of the City Court) if the claim is valued at less than NOK 200,000 or if one of the parties is not represented by a Norwegian lawyer.

Insurance disputes can also be decided by the Norwegian Financial Services Complaints Board (Finansklagenemnda / FinKN) which is a quasi-judicial body that decides disputes arising between finance companies and their customers in service areas such as insurance, banking, financing, securities funds and debt collection. The board consists of specialized members and offers a low-cost alternative to proceedings in the courts. Decisions of the Financial Complaints Board are not binding but are usually accepted by the disputing parties.

No, Norway has no statutory law or specific transfer mechanism that regulates sales and transfers of books of insurance or reinsurance. As a main rule such sales or transfers agreement are only limited by the Agreement Act, which does not limit the parties in such a case. However as pointed out under question 4 it is an absolute requirement for all insurers and reinsurers to obtain a license from the Norwegian Financial Supervisory Authority (the NFSA) to operate in Norway. Under question 2 we pointed out that different rules apply to non-life insurance undertakings, life insurance undertakings and credit insurance undertakings as set out in the Financial Institution Act with accompanying regulations. This implies that a buyer of books of insurance will need to satisfy the same obligations and requirements, and to be approved by the NFSA who need to be notified about sale and transfer. Reinsurance also needs a separate license, however there is no separate legal basis for it, and it will rely on the license requirements applicable for the underlaying insurance activity. Reinsurance contracts are generally considered to be regular commercial contracts subject to general principles of Norwegian contract law and other legislation.

There is tough competition in the Norwegian insurance market. Four large domestic actors hold more than 70 per cent of the market shares. However, the smaller actors have increased from a market share of 6 per cent in 2000 and up to approximately 23 percent in 2023. This is mainly a result of insurance brokers placing business abroad, combined with an increasing number of insurance agents with their own brand that makes it possible for them to change insurers. The Norwegian insurance market is highly regulated, and thus compliance could be a challenge to new market entrants.

The insurers are focused on digitalization. Norway has been in the forefront of digitalization and almost all Norwegians have access to secure digital identification online through BankID, which provides the basis for digital service offering. Some insurers have started to digitalize and automate the claims handling of some simple insurance products, but we do not see a lot of genuine innovation in the insurance sector in Norway. There are a few examples of new concepts and players, but overall it is still early days when it comes to insurtech in Norway.

Most sale of insurance in Norway is conducted online or by telephone. To comply with the anti-money laundering and data protection regulations insurance providers must have adequate and secure systems for data handling and identification control during both the sale of insurance and claims handling. The regulators in support are The Norwegian Data Protection Authority (Datatilsynet) and The Financial Supervisory Authority of Norway (Finanstilsynet).

Note that Datatilsynet does in general not consider email as secure means of communication unless the content is encrypted. Most insurance providers in Norway therefore use secure encrypted platforms for communication and identification through the use of BankID (a common online verification system used in Norway).

Several provisions in the Norwegian Insurance Contract Act (ICA) require “written notification” for the insurance company to execute certain rights (deny coverage, terminate the insurance agreement etc). After changes made in the ICA that came in to force on 1 July 2022, electronical communication meets the requirement of  “written communication” as long as the insured has not opted out of this, and the insurance company has taken steps to make sure that such communication is done in reassuring and satisfactory manner. If the electronical communication contains information that is of great importance for the receiver, the insurance undertaking must also take steps to make sure that the communication has been received by the insured. Please note that the opportunity to do opt out of electronical communication must be given on formation of the contract or at the first electronic approach from the insurer.

Online and telephone sale of insurance is also subject to the act relating to the duty of disclosure regarding the right to cancel distance contracts and off-premises sales (the Cancellation Act). Please see section 20 above.

The insurers use of customer date is subject to EU’s General Data Protection Regulation (“GDPR”) which is implemented in Norwegian law. GDPR has brought new and stricter rules, including new requirements for data security and documentation and new penalties. In Norway, the processing of personal data requires consent and such consent must always be specific, voluntary and informed. A consumer policy may be conditioned by such consent; however, the consumer must be informed that he or she may withdraw the consent.

Customer data can be share on a cross-border basis between member states of the EU/EEA as long as the handling of the data is done on in accordance with EU’s General Data Protection Regulation (“GDPR”).

The protection offered by the GDPR travels with the data, meaning that the rules protecting personal data continue to apply regardless of where the data lands. This also applies when data is transferred to a country which is not a member of the EU (‘third country’). Therefore customer data can only be transferred to third countries if the transfer complies with the conditions set out in chapter 5 of the GDPR.

The first thing to consider when transferring personal data to a third country is if there is an “adequacy decision”. An adequacy decision means that the European Commission has decided that a third country or an international organization ensures an adequate level of data protection. Transfer can also be done through ensuring appropriate protection measures, or in special situations and single cases.

Norway has implemented several regulations that relate to the environmental, social and governance topics and we expect more to come. It is expected that further regulations will be in line with the implementation of the Green Deal in Norwegian legislation, national adopted climate policy targets and guidelines from European financial supervisory authorities on sustainability risk and risk management.

Norwegian Financial Supervisory Authority (NFSA):

Insurance companies operating in Norway are under the supervision from NFSA for insurers, as for other financial undertakings, the NFSA will first and foremost follow up through supervision of the companies risk assessments and solvency.

The Norwegian Accounting Act:

Effective in July 2021, the section 3-3c of the Norwegian Accounting Act was modified for Norwegian companies that aren’t regarded as small companies cf. the Norwegian Accounting Act section §1-6. In addition to the key ESG factors such as human rights, employee rights, social conditions, external environment and combatting of corruption, there have been added factors for gender and non-discrimination.

Proposal from the Government:

On 8 December 2021, the Norwegian Government proposed that insurance companies must identify any significant exposures to climate risk, and assess the effect of climate change scenarios. The requirement for such scenario analyses is not applied to low-risk companies. The proposal further means that by 2023, EIOPA will assess the capital requirements for assets or activities with environmental or social purposes. EIOPA shall also regularly assess the calibration of the capital requirement for natural disaster risk.

The EBA Guidelines and sustainable finance:

The EU regulations on sustainable finance will be implemented in Norwegian law via the EEA Agreement.

NFSA has confirmed to the EBA that Norway will follow the EBA Guidelines on internal governance under CRD. The guidelines came into force in 31. December 2021.

A new Norwegian Act on Sustainable Finance was passed in the Storting (Norwegian Parliament) on 17 December 2021. The Act came into force on 1 January 2023 and implements two key EU regulations on sustainable finance in Norway: the EU Taxonomy and the ESG Disclosure Regulation (SFDR). It is expected that the Norwegian authorities will adapt the guidelines soon.

NFSA has also determined an amendment to the Solvency II regulation, which means that EU Regulation 2021/1256 on the integration of sustainability risk in the management of insurance companies will apply from 3. February 2023.

The taxonomy reporting requirements initially apply to large listed insurance companies with over 500 employees. Going forward, the EU plans to expand the reporting requirement to include all large companies regardless of if they are listed or not. The taxonomy reporting includes insurance companies that are offering investment products where they must provide information about e.g. how much of the underlying investments are green in accordance with taxonomy requirements.

For taxonomy reporting, this will in practice mean 1. January 2023 and the first requirement of reporting will be in the annual reporting for 2022. However, the Norwegian authorities have recommended that the Norwegian actors who will be covered by the requirements report on the taxonomy already in the annual reporting for 2021.

The new EU sustainability reporting regulations (CSRD) will replace the EU Non-Financial Reporting Directive (NFRD) which applies in the EU and Norway today. The time for Norwegian entry into force is uncertain, but the intention has been to follow the EU’s timetable. In that case, the first companies affected by the new rules will report for the first time in 2025 for the financial year 2024. The reporting requirements must be in accordance with the ESG Disclosure Regulation (SFDR) and the taxonomy.

The Equality and Discrimination Act entered into force on 1 January 2018. The Act prohibits direct and indirect discrimination on the grounds of, among other things, ethnicity (including national origin, descent, skin colour, language), religion and outlook on life. The purpose of the Act is to promote equality, ensure equal opportunities and rights and to prevent discrimination. The law applies to all areas of society.

Through stricter requirements for transparency and accountability, the Transparency Act (from 01.07.2022) shall ensure human rights and decent working conditions in connection with the production of goods and the delivery of services. From 01.07.2022, insurers have an obligation to provide information if an inquiry is made about the working conditions the company has with its subcontractors, and how they handle any breaches and red flags. The Transparency Act shall, together with other measures, contribute to Norway’s efforts to meet the UN’s sustainability goal no. 8 on decent work and economic growth, and goal no. 12 on responsible consumption and production.

The Act currently applies to all businesses that are not defined as small businesses in § 1-5 of the Accounting Act, and that sell goods and services in or outside Norway.

The law entails an obligation to carry out due diligence assessments, to regularly report on these assessments, as well as to provide information to anyone who makes a written request about it. For insurers, this means that the company must carry out a due diligence assessment and report on the results.  The account must be published on the company’s website by 30. June each year and «in case of significant changes to the enterprise’s risk assessments». The first deadline was 30 June 2023.  Information regarding where the report can be accessed must be part of the company’s annual report.

The Financial Supervisory Authority of Norway has issued the revised EBA-guidelines that impose requirements on financial institutions regarding their organisation, responsibility and authority allocation, reporting lines and information dissemination, as well as internal control systems. The changes in the revised guidelines mean that institutions’ risk management systems should also cover areas such as anti-money laundering and countering the financing of terrorism, climate and ESG factors, conflicts of interest, and discrimination. The guidelines apply to all institutions but will be applied proportionately based on factors such as size, complexity, and risk profile. The Financial Supervisory Authority has also developed a new supervisory module for internal corporate governance that replaces the previous module for overall management and control. The guidelines came into effect on December 31, 2021 and replace the previous version from 2017.

From 1. January 2023, ESG factors must be reflected in, among other things, the reference value statement and the reference value method.

On 15 December 2022, the joint European Commission Regulations (EU) 2020/1816, (EU) 2020/1817 and (EU) 2020/1818 were incorporated into the EEA Agreement.

We believe that the Covid-19 pandemic was a wakeup call for all businesses in Norway, and that this has opened up a bigger market for new insurance products related to consequential loss insurance, interruption insurance and loss of profit insurance. Additional stresses of a constantly changing economic landscape with increased interest rates and a weakening of the NOK further exacerbate the exposures companies and individuals faces, furthering the need to hedge downside risk. This is increasing the pressure on directors’ and officers’ liability insurance and professional liability insurance in general.

Norwegians will also see an increased threat of cyber-attacks, ID-theft and money laundering, and will most likely search insurers offering cyber insurance products (including products where insurers offer services to help insured guard against attacks and losses in the first place). Insurers offering such tailored products the next few years will probably be in a position to take the market lead.

As with the rest of the world, a key focus in Norway is AI and what opportunities this technology will provide. Although there seems to be less action than words today, both insurance companies and their customers alike will be affected by this technological shift, both directly and indirectly. With this will come challenges for the statistics on which much of the risk modelling in the industry is based and premiums are based.

It should also be noted that the effects of climate change are increasingly observed, continually changing the risk profile from what it once was. Once every ‘100’ year and ‘50 year’ weather patterns and catastrophes occur more often than previously recorded, as well as the associated damage caused. Here is seemingly a strong fit use case where AI technology can be used to a large degree to simulate futures effects of climate change. Public and private sector alike will also need to harness the power of large models and databases to both prevent and manage large scale damages.