Norwegian Transparency Act
Contents
Norwegian Transparency Act at a glance
In June 2021, Norway adopted the Norwegian Transparency Act (åpenhetsloven), in force since July 2022. This law requires large Norwegian companies, as well as some larger foreign companies that sell goods or services in Norway, to carry out human rights' due diligence along all their value chain.
Under this law, anyone can request information from companies on how they meet this obligation and inform the Norwegian Consumer Authority if they believe a company is not complying. The Authority can issue prohibitions and orders against companies, as well as penalties. Enforcement has been limited so far.
Which companies fall under the Norwegian Transparency Act?
The law applies to companies that meet the following two conditions:
1. They have a sufficient connection to Norway
The company must be either:
- a Norwegian company, meaning that its head office is in Norway (the head office is the administrative centre of a company’s operations, where the management is) that offers goods or services, either in Norway or abroad;
- a foreign company that:
- offers goods or services in Norway; and
- is liable to tax in Norway.
2. They are “larger” enterprises
The company must fall in one of the following two categories:
a. Public-interest companies: listed companies, banks, credit institutions and insurance companies
b. Companies that meet two of the three following thresholds:
- sales revenue of more than NOK 70 million (aprox. EUR 6.3 million)
- total assets of more than NOK 35 million (aprox. EUR 3.2 million)
- an average of more than 50 full-time-equivalent employees during the financial year.
When a Norwegian company is the parent company of a group, the revenue, assets and employees of the parent and all its subsidiaries must be considered together. This includes subsidiaries located outside Norway.
However, when a Norwegian company is the subsidiary of a foreign parent company, only the activity of the Norwegian subsidiary will be taken into account. For a foreign company, only the activities of that company in Norway are taken into account.
The law is not limited to commercial companies, it can apply to non-profit organisations, foundations or other types of enterprises if the above conditions are met.
How to check if a company is covered
There is no official list of covered companies by this law. Also, we are not aware of any comprehensive unofficial list compiled by civil-society organisations or other actors.
If you believe that a company connected to a harm or risk is Norwegian or otherwise has a connection to Norway, you can take the following steps to try to determine whether the Act applies to it.
1. Look for the company’s due diligence account
Companies covered by the Act must publish an annual account of their human rights due diligence. See section on companies’ obligations below. If a company publishes this report, it is very likely that it is covered by the Act. You can look for the account:
- On the company’s website or through an internet search. You should also look for the parent’s company due diligence account, since groups may publish due diligence accounts covering the whole group. If the English terms do not return results, you can try to look for the terms in Norwegian (“åpenhetsloven” and “redegjørelse”)
- On the company’s annual report. When filing their annual accounts, companies that are not classified as “small enterprises” under Norwegian accounting law must also file an annual report (an “årsberetning” in Norwegian). In the annual report, the company must indicate where its due diligence account is publicly available. You can search for the company’s accounts, including the annual report if applicable, in Norway’s Register of Company Accounts. If you cannot find an annual report, this does not necessarily mean that the company is outside the scope of the Transparency Act, as some covered companies are not required to prepare one.
If you cannot find a due diligence account, that does not necessarily mean that the company is not covered. The company may have failed to comply, published the account under another group company’s name, or made it difficult to locate.
2. Check whether the company meets the size thresholds
If you cannot find a due diligence account, you can examine the company’s annual accounts or look for any company profiles online to determine whether it appears to meet at least two of the thresholds above. A company will have to meet these during two consecutive years. You can look for a company’s annual accounts in the Register of Company Accounts. For a Norwegian parent company, use the combined figures for the parent and all its subsidiaries, including subsidiaries outside Norway.
3. Ask the company or seek assistance:
If you are still unsure, the Norwegian Consumer Authority recommends you to contact the company and ask it to confirm whether it is covered by the law.
If you do not wish to contact the company, for instance because of security and confidentiality concerns, you may be able to seek assistance from a trade union, civil-society organisation or lawyer. See our legal assistance directory, for instance.
If the company is not covered
If a company does not meet the criteria above the law does not apply to it. You can explore alternative remedy options or answer a few questions to receive suggestions what pathways may be appropriate for your specific situation.
If you are concerned that a company possibly covered by the Act is connected to (local) risks and harms but you need to find out more, you can refer to basic guidance here.
What are companies expected to do?
Jump to...
Carry out due diligence
Companies must carry out human rights due diligence in accordance with the OECD Guidelines for Multinational Enterprises.
This means that under the Act, companies must:
- embed responsible business conduct in their policies.
- investigate whether there are any actual or potential adverse impacts on fundamental human rights and decent working condition that the enterprise has caused or contributed toward (including in value chains), or that are directly linked with the enterprise’s operations, products or services via the supply chain or business partners. The enterprise must then address these adverse impacts and track the results of implemented measures
- communicate with stakeholders and rightsholders regarding how adverse impacts are addressed.
- establish or cooperate in remediation and compensation when appropriate.
What rights does the Act apply to and what sectors does it cover?
The Act applies to “fundamental human rights”, defined as the internationally recognised human rights included, among other places, in the International Covenant on Economic, Social and Cultural Rights, the International Covenant on Civil and Political Rights and the ILO's core conventions on fundamental principles and rights at work. It also applies to “decent” working conditions, defined as work that safeguards fundamental human rights and health, safety and environment in the workplace, and that provides a living wage.
The Act covers all business sectors.
It does not directly cover environmental impacts, although an environmental impact falls within the scope if it results in an impact on fundamental rights.
Due diligence has to be carried out regularly, meaning on an ongoing basis, in proportion to the company’s size and nature and context of its operations and be risk-based, meaning prioritisation of issues to tackle should be informed by the severity and likelihood of adverse impacts.
Publish an annual due diligence account
Companies must publish an account of their due diligence every year. This report must include, at least:
- a general description of the company’s structure, operations and procedures to handle actual and potential impacts.
- information about actual impacts and significant risks of adverse impacts.
- information on measures or plans to cease actual impacts or mitigate significant risks of impacts and the results or expected results of these measures.
The account must be made easily accessible on the company’s website. Where the company is required to prepare an annual report, that report must indicate where the due diligence account can be found. The account has to be published by 30 June each year and when there are significant changes to the company’s risk assessments.
Respond to information requests
Anyone (individuals, NGOs, public bodies, other companies, etc.) may ask a covered company for information about how it addresses actual or potential adverse impacts on fundamental human rights and decent working conditions.
A request:
- may ask for general information about the company’s due-diligence processes or information relating to a particular product or service, for example, how the company addresses working conditions connected to the production of a particular product;
- may be submitted anonymously;
- does not need to explain why the information is being requested; and
- must be made in writing, but may be sent through any written channel, including email, an online form or a physical letter.
- A company may create a specific channel for Transparency Act requests, but it must also recognise written requests sent through other channels.
If an information request alerts a company to a previously unknown adverse impact, the company may need to investigate that impact and incorporate it into its ongoing due diligence process.
How and when must the company respond?
The company must provide a written, adequate and comprehensible response within a reasonable time and no later than three weeks after receiving the request.
If the request is particularly complex, it may take up to two months but, within the original three-week period, it must inform the requester that deadline is being extended, the reason and when an answer can be expected.
- What constitutes an adequate response will depend on the question, the circumstances of the company and the principle of proportionality. The Act does not create a general right to obtain the company’s full supplier list or its production sites. The requester can ask follow-up questions.
- A company can refuse a request when its incomprehensible, is clearly unreasonable, or concerns an individual’s personal affairs or competitively sensitive enterprise data. Information concerning an actual adverse impact on fundamental human rights of which the company is aware cannot be withheld on these grounds. If the company refuses the request, it must respond explaining the basis for the refusal.
What can I do if a company does not meet the obligations?
The actions you can take under the Act do not require you to act through a lawyer and do not entail complicated procedures. Nonetheless, it can be very helpful to seek support if you are consider taking action, especially if you or someone you are representing has experienced human rights harms. You may consider contacting NGOs for guidance or seeking legal advice from lawyers experienced in corporate accountability. They can help you understand your options, support the collection of evidence, assist in submitting complaints, and connect with others. Click here for our legal assistance directory.
Submitting a tip
If a company does not comply with its obligations, for example, because its due diligence does not address a relevant human rights impact or risk, it does not publish a due diligence account or it has not adequately answered an information request, you can send a “tip” to the Norwegian Consumer Authority. For example, in August 2026, the Mapuche Williche communities from southern Chile submitted a tip concerning Statkraft over a hydropower project’s impacts.
To submit a tip:
- If you have a Norwegian electronic identification, you should use this portal.
- If you do not have a Norwegian electronic identification, you can contact the Authority directly by phone at +47 23 400 600 or email at [email protected].
There are no special requirements regarding the format of a tip submitted by email. However, you should be as specific as possible to help the Authority understand the alleged breach and decide whether to examine it.
Where possible, include:
- the company’s name and, if known, its Norwegian organisation number;
- the obligation you believe the company has breached;
- relevant dates and a description of what happened;
- copies of any information requests and responses;
- information about the relevant human rights impact or risk.
What happens when you submit a tip?
The Norwegian Consumer Authority registers and considers the tips it receives, but it is not required to investigate every case. It has discretion to prioritise matters according to factors such as the seriousness of the alleged breach and whether the case may have wider significance.
As a general rule, a decision on whether to investigate a case must be made within 3 weeks.
Even if the complaint is examined, the person who has submitted a tip is not a party to the to the proceedings. However, they should be kept informed about them.
If the Authority decides to examine a tip, it can require the company to provide the information or documents it needs. The company must comply with such a request.
If the Authority finds that a company has breached the Act, it must seek a written confirmation from the company that the unlawful conduct will cease or issue a binding decision. The Authority can negotiate with the company before taking formal action.
Possible outcomes
A binding decision can:
- prohibit or require specific action to ensure compliance with the obligations to carry out due diligence, including, in principle, remediation of harm, publish a due diligence account or respond to information requests;
- impose an enforcement penalty: a fine payable if the company fails to comply with an order; or
- impose an administrative infringement fine for repeated breaches of the duty to publish a due diligence account or the duties relating to information requests, including repeated failure to meet the applicable response deadlines. According to regulations issued by the Norwegian government, these can be up to the greater of 4% of the enterprise's annual turnover or NOK 25m (approx. EUR 2.27m).
What to expect from the Norwegian Consumer Authority
The Norwegian Consumer Authority says that its primary working method is guidance and dialogue with companies. Formal enforcement has so far been limited. It has issued two decisions imposing administrative infringement penalties under the Act relating to companies’ transparency obligations. It has not yet issued a binding decision finding a breach of the substantive due-diligence obligation.
If the Norwegian Consumer Authority decides not to prioritise your tip or concludes that the company has not breached the Act, you may be able to appeal the decision to the Market Council, an independent administrative appellate body.
Further information
Examples and decisions so far
- Lager 157: In September 2024, the Authority imposed its first administrative infringement penalty under the Act of NOK 450,000 (approx. EUR 40,000) on clothing retailer Lager 157 for failing to comply with two information requests. One case arose from a complaint by the NGO Framtiden i våre hender after the company failed to respond adequately to its request; the other arose from a tip concerning a request submitted by a school class. In February 2025, the Market Council annulled the penalty. Although it agreed that the company had breached the information duty twice, it found that the legal basis was not sufficiently clear to impose an administrative penalty on the basis of those two infringements.
- Clockwork Bemanning: In February 2026, the Authority imposed an administrative penalty of NOK 150,000 (approx. EUR13,600) on the staffing company Clockwork Bemanning for failing to publish its annual due diligence account in 2023, 2024 and 2025, despite having received guidance about the obligation. The company has appealed the decision to the Market Council.
- The Norwegian Consumer Authority has also examined complaints and tips without imposing formal sanctions, for instance:
- In July 2023, it closed complaints against IKEA and Posten concerning their responses to information requests without finding a breach.
- In October 2025, the Authority found no breach either following a tip from Greenpeace concerning Equinor. Greenpeace argued that Equinor’s business relationship with Ithaca in the Rosebank oilfield linked it to alleged adverse impacts associated with Ithaca’s parent company, Delek Group, a company that appears on the UN’s Human Rights Office’s database of business enterprises involved in activities raising serious human rights concerns linked to Israeli settlements in occupied Palestinian territories. The Authority concluded that the required direct link had not been established. Greenpeace appealed the decision, but the Market Council dismissed the appeal.
- The Norwegian Consumer Authority also carries out enforcement activity on its own initiative, for example in March 2025 it contacted more than 20 companies that had failed to publish a due diligence account or make it easily accessible.