NORWAY Law and Practice Contributed by: Hedvig Moe, Pål Lieungh, Espen Randen and Elin Ibsen Gustavsen, Advokatfirmaet Thommessen AS
4.6 Sanctions Compliance Programmes There are no compliance programme requirements specific to defence sector operators. The general duty of care applies and must be assessed concretely in each case (see 4.3 Screening and Due Diligence Requirements ). A programme should generally include risk assess - ment, management commitment, training, counter - party due diligence, internal reviews, and record-keep - ing. For defence operators, continuous monitoring of embargoes, sectoral sanctions and designations will typically be central. Both DEKSA and the EU publish guidance on spe - cific sanctions regimes and categories of restriction, though most guidance does not directly address com - pliance programme structure. 4.7 Enforcement, Penalties and Voluntary Disclosure Sanctions regulations typically refer back to the Sanc - tions Act for enforcement and penalties. Contraven - tions are punishable by fines and/or imprisonment for up to three years; negligent contraventions are punishable by fines and/or imprisonment for up to six months. Aiding and abetting is also within scope. Where a person has acted on behalf of an undertak - ing, the penalty is usually corporate criminal liability in the form of a fine, in accordance with the corporate liability provisions of the Penal Code. Norway has no formal voluntary disclosure mecha - nism under sanctions legislation. Self-reporting does not nullify criminal liability, but may serve as a mitigat - ing circumstance. Other mitigating and aggravating circumstances follow from the Penal Code’s corporate liability provisions. 4.8 Recent Enforcement Actions and Developments No significant sanctions enforcement actions involv - ing defence sector participants have been made pub - lic in the past 12 months. Most cases are resolved by penalty notices, which are not made public unless the case proceeds to trial.
Notable recent changes relevant to the defence sec - tor include: • the establishment of DEKSA on 1 January 2025 as the new national authority for export control and sanctions; • Norway’s continued alignment, with few excep - tions, with the EU’s sanctions policy, including, in particular, the successive packages targeting Rus - sia; and • the absorption of the national List III into List II in January 2026 (see 3.2 Scope of Controls: Military and Dual-Use Lists ), together with the Ministry of Foreign Affairs’ announced comprehensive review of the export control legislation during 2026. 5. National Security Regulation 5.1 National Security Legislation Applicable to the Defence Sector The principal legislation governing national security is the Security Act ( sikkerhetsloven ). The Security Act applies to all state, county and municipal bodies, including the defence sector, by default. The Act provides a comprehensive framework for pre - ventive security work across government and critical private-sector entities. Each sectoral ministry must identify entities of critical importance to fundamental national functions and may order by administrative decision that the Act apply – in whole or in part – to private-sector enterprises that process classified information, control assets of critical importance to national security, or carry out activities essential to fundamental national functions. The Act also applies to suppliers under classified procurements. The Act is structured around the following principal subject areas. • Information Security (Chapter 5), including classi - fied information and the access to such. • Information Systems Security (Chapter 6), including the handling and storage of classified information. • Object and Infrastructure Security (Chapter 7), including designation, classification and protection of such.
147 D EFENCE CON TRACTS 2 026
CHAMBERS.COM
Powered by FlippingBook