Your customers must now document you: new Norwegian rules for tech and AI suppliers
Do you supply software, data or AI features to banks, insurers, energy companies, healthcare providers or the public sector? Then your customers' questions have changed over the last year. Answering a security questionnaire once is no longer enough. Your customers must now document every supplier they use, and the suppliers behind them, including the AI models your features are built on.
Here's what applies in Norway now, what's coming, and what your customers will therefore ask you. At the end: a practical list for becoming the supplier that's easy to approve.
Why your customers care so much
The supplier that gets breached is rarely the one the customer reviewed. In autumn 2026, Canva was hit through Canny, a small supplier of a feedback tool. Canva confirmed that attackers reached enterprise customer and contract information through Canny's connection to Canva's Salesforce, and the attackers claim they reached many other companies the same way. (Source) That's why your customers want to know who stands behind you, not just who you are.
What applies now
DORA, financial sector (since 1 July 2025) The DORA Act has applied since 1 July 2025. Banks, insurers and asset managers must keep a register of all their ICT supplier agreements, including the subcontractor chain, and report it to Finanstilsynet every year. The first deadline was 13 March 2026. (Finanstilsynet on the register) Every agreement must cover, among other things, where data is processed and the use of subcontractors. Agreements supporting critical or important functions must also give audit rights and an exit plan, and be notified to Finanstilsynet before they're signed. Finanstilsynet can order a firm to change or end an agreement that falls short. (Finanstilsynet on DORA, guidance on notifying ICT agreements)
The Digital Security Act (since 1 October 2025) Providers of essential services in energy, transport, health, water, banking and digital infrastructure, among others, must manage security risk in their systems, including the risk that comes from suppliers. (Lovdata, NSM)
GDPR Every customer that has you process personal data needs a data processing agreement with you and the right to approve or object to your sub-processors. When you add an AI feature that sends customer data to a model provider, that is in practice a new sub-processor the customer must be told about.
What's coming
NIS2 NIS2 will be implemented through amendments to the Digital Security Act, but the directive isn't part of the EEA Agreement yet. (Storting European committee, March 2026) It will cover far more organisations than today, including manufacturing, food, waste and ICT services, with stricter control of the whole supply chain. No date is set, but your customers are already preparing.
The EU AI Act In the EU, most of the regulation applies from 2 August 2026, including the duty to tell people when they're dealing with AI. The high-risk requirements were pushed to December 2027 and August 2028. (European Commission) In Norway it isn't yet part of the EEA Agreement. The government aims to put a Norwegian AI act before Parliament in spring 2027, with Nkom as the coordinating authority. (Nkom on supervision) If you sell to customers in the EU, they already apply it to you.
What your customers will ask you
Which sub-processors do you use, including for AI? A complete list: what each one does, what data it gets, and where the data is processed. If anything is outside the EEA, they'll want to know the transfer safeguard.
Does the AI provider train on our data? The answer has to be in your contract with the model provider, not just in their blog post. Customers want to see that you've checked.
What happens if one of your suppliers has an incident? Your customers have their own deadlines, such as 72 hours to notify the data protection authority of a personal data breach. They need you to tell them in time to meet theirs.
Can we audit, and how do we get out? DORA requires audit rights and an exit plan in agreements supporting critical functions. Having the answer ready shortens the negotiation.
What changes when you launch new AI features? New features often mean new suppliers. Customers want to be told beforehand, not find out from a release note.
How to be the supplier that's easy to approve
Keep a living register of your own suppliers One overview of every supplier and AI model you build on: what it does, what data it gets, where it runs, the contract and the data processing agreement. Updated when something changes, not once a year.
Document AI use per supplier Which AI is used, whether it trains on customer data, its risk level, and when the supplier last confirmed it.
Have the answers ready before the questionnaire arrives Sub-processor list, DPA, certificates and security description in one place you can share with the customer, instead of filling in a new form each time.
Plan for incidents in your supply chain Who tells whom, by when, and where decisions are recorded. Rehearse it before it happens.
Check your agreements against DORA's terms Review your own supplier contracts for audit rights, data location, subcontracting and exit before a bank customer asks.
Why Granur
The supplier register your customers ask for, ready Every supplier and AI model you build on, in one register with security review, approval and policy status. Export it as CSV when a bank customer needs input for its DORA register.
AI use documented per supplier An AI profile and risk tier for each supplier: what the AI does, whether it trains on customer data, and what the contract says. Suppliers answer an AI questionnaire through a secure link and re-attest every year.
DPAs and sub-processors under control DPA status, data categories, data location and transfer safeguard per supplier. Gaps show red, and the processor register exports straight into your record of processing activities.
Supply-chain incidents, with deadlines The incident log counts down the 72 hours from when you became aware, and you can send issues straight to Jira or ServiceNow.
Contract terms in place Granur reads contracts with AI, highlights the terms on AI use and exit, and warns before notice deadlines. Certificates such as SOC 2 and ISO 27001 are tracked with their expiry dates.
Ongoing follow-up, not a yearly exercise Scorecards and business reviews with suppliers show you follow them over time, as NIS2 expects. Everything is logged in an exportable audit trail.
One answer for your customers Trust status shows where every supplier stands, so answering customers is faster and nothing gets forgotten.
Want to see it with your own suppliers? Get in touch for a short demo.
Read more
Your vendors added AI. Did anyone tell you? Why AI arrives through updates from vendors you already approved, with a contract clause and questionnaire you can use. For you, it's also a checklist of what your customers expect. Read the article
The vendor nobody vetted Canva, Trezor and Ledger were hit through small vendors several tiers away. Read the article
NIS2 supplier security: a checklist What NIS2 expects from supplier management, and a list to work through. Read the article
The EU AI Act for companies that buy AI The questions your customers will ask before approving an AI feature. Read the article
How to review a SOC 2 report What customers look for in your report, and what to look for in your own suppliers'. Read the article
This overview reflects the situation in November 2026 and isn't legal advice. Timelines for NIS2 and the Norwegian AI act may change; check Lovdata, regjeringen.no and the authorities' own pages for the latest status.