Denmark Sends Revised Public-Sector AI Authorization Law for Consultation

Key Takeaways

• Revised AI Bill: Denmark has opened consultation on a revised law that would establish a general data protection legal basis for public authorities and bodies to develop and use AI systems involving personal data.
• Existing Privacy Rules Remain: Authorities would still have to comply with other data protection requirements, including processing security, data subject rights and rules governing transfers to third countries.
• Limits on Automated Decisions: The bill includes AI used for decision-making support but does not provide authority for fully automated decisions under Article 22 of the GDPR.
• Previous Concerns Under Review: The Danish Data Protection Authority will examine how the revised draft reflects comments it made during an earlier consultation.

Deep Dive

Denmark has returned to a difficult question in its plans for public-sector AI, sending a revised bill for consultation that would give public authorities a general legal basis to process personal data when developing and using AI systems.

The Ministry of Research, Education and Digitalisation circulated the new draft after an earlier version went through consultation this year. The Danish Data Protection Authority, which raised a number of issues with that proposal, said Sept. 16 that it will now review the changes and consider how its previous comments have been addressed.

Known as the AI Authorization Act, the bill is intended to establish a general basis under data protection law for public authorities and bodies to develop and use AI systems involving personal data when carrying out their tasks.

The scope of that authorization is important. It would address the legal basis for processing personal data, but it would not set aside the broader requirements of data protection law. Authorities would still have to meet their obligations on matters including processing security, data subject rights and transfers of personal data to third countries.

In other words, the proposal seeks to answer one of the legal questions surrounding public-sector AI without pretending that answering it settles the rest. The bill also stops short of authorizing fully automated decision-making under Article 22 of the General Data Protection Regulation. AI could be used to support decisions under the proposed framework, but the legislation would not itself provide authority for decisions covered by Article 22 to be made entirely through automated processing.

That boundary is likely to matter as public authorities consider where AI can be put to practical use. A system that assists an official in reaching a decision raises a different set of legal questions from one that makes the decision without human involvement. The draft permits the former within its scope while declining to provide a legal basis for the latter under Article 22.

Much now depends on what changed between the two drafts. The Danish Data Protection Authority submitted comments during the previous consultation and has not yet reached a public conclusion on the revised proposal. Its next step is to compare the new text with the earlier version and determine how far its concerns have been reflected.

“We look forward to delving into the new bill and the changes that have been made since the last one. It will be particularly interesting to see how our previous comments are reflected in the new draft,” Cristina Angela Gulisano, director of the Danish Data Protection Authority, said.

The consultation remains open until Oct. 12, 2026. For Danish public authorities, the proposal would clarify one part of the legal foundation for using AI with personal data, but deliberately leaves the rest of the data protection framework standing around it. A lawful basis for processing is necessary. It is not permission to forget what happens to the data afterward, where it travels, how it is protected or what rights remain with the people to whom it belongs.

The Data Protection Authority will now decide whether the revised draft has drawn those lines clearly enough.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey.