Most countries that regulate web accessibility point the rule at the public sector, or at large companies, or at both, and leave a small foreign webshop alone. Norway does not. The obligation here sits on almost every business with a website that matters to how it reaches Norwegian customers, and there is a named regulator that checks.
What the rule requires
The instrument is the regulation on universal design of ICT solutions, forskrift om universell utforming av IKT-løsninger, made under the Equality and Anti-Discrimination Act. It adopts the Web Content Accessibility Guidelines as the technical standard, at conformance level A and level AA.
In the version that has applied to private-sector solutions, that works out to 35 of the WCAG success criteria. A handful of criteria are carved out, the best known being the ones on pre-recorded audio description and captions for live video, so the count sits below the full A and AA set. The regulator publishes the exact list.
In plain terms: every function of the site has to be operable by keyboard, every image that carries meaning needs a text alternative, colour contrast has to clear a measurable threshold, form fields need labels a screen reader can announce, and nothing essential can depend on a mouse, on colour alone, or on catching a timed interaction.
It binds private business
This is the part that catches people. The regulation covers ICT solutions that “underpin the general public’s access to information and services”, and it draws no line at company size. There is no small-business exemption, no turnover floor, no employee count below which it stops applying, and no carve-out for a company registered outside Norway.
A one-person Shopify store selling to Norwegian consumers is inside the same rule as a Norwegian bank. The obligations scale a little, newer solutions have had to comply sooner than old ones, and the public sector carries extra reporting duties private companies do not. The core requirement is the same.
The scope test
The rule does not reach every page on the internet that a Norwegian can open. The test has two parts, and both have to be true.
- Aimed at the general public in Norway
- The solution is directed at people in Norway generally, not at a closed internal group. A public webshop, a booking page, a marketing site with a contact form: all aimed at the general public. A staff intranet is not.
- A main channel for the business
- The solution is a principal way the business informs people about, or delivers, its goods or services. For an online shop the storefront is the business, so this is almost always met.
For an e-commerce business the storefront clears both without much argument. That is why the headline on this page is not a hypothetical.
Where a foreign shop stands
The regulation is written around solutions and their audience, not around where the company keeping them is registered. A shop run from Berlin or Manchester that markets to Norwegian consumers, prices in kroner and ships to Norwegian addresses is, on the wording, operating a solution aimed at the general public in Norway.
Enforcement against a purely foreign operator with no Norwegian entity is less tested in practice than enforcement against a Norwegian company, and that is worth saying plainly rather than pretending otherwise. What is not in doubt is the direction of travel: the accessibility rules across the EEA are converging, the European Accessibility Act now places similar obligations on e-commerce providers across the single market, and betting on staying below Norway’s notice is a weak long-term position.
Who enforces it
The Tilsynet for universell utforming av ikt, the Authority for Universal Design of ICT, usually shortened to uutilsynet. It sits within the Norwegian Digital Agency and it is a real supervisory body, not an advisory one. It runs monitoring sweeps, tests sites against the WCAG criteria itself, handles complaints from the public, and publishes its findings.
What enforcement looks like
The authority can require a business to bring a solution into conformance, set a deadline for it, and back the order with a coercive fine, tvangsmulkt, that accrues until the fault is fixed. For serious or repeated breaches it can also impose a one-off penalty. In practice it tends to open with guidance and a deadline, and the money comes into play when a business ignores that.
The reputational side matters too. Monitoring results and decisions are public, and a Norwegian audience that already checks a foreign shop carefully does not need much of a reason to move on.
The failures we see most
On a foreign webshop, the same handful of problems come up again and again, and none of them need a rebuild to fix.
- Checkout that needs a mouse. A custom dropdown, a date picker or a payment step that cannot be completed with the keyboard alone.
- Unlabelled form fields. Inputs styled with a placeholder instead of a real label, so a screen reader announces an empty field.
- Low contrast text. Light grey on white for prices, delivery information and error messages, below the 4.5 to 1 ratio the AA level requires.
- Images carrying meaning with no alt text. Product photos, size charts and infographics that a non-sighted customer simply does not receive.
- Errors shown only in colour. A red border on a field with no text saying what went wrong.
- A cookie or newsletter overlay that traps focus. The keyboard cannot get past it, so the site behind it is unreachable.
How to check yourself
You can get most of the way with free tools before anyone bills you. Run an automated checker such as axe or WAVE on your key pages, then do the manual passes the automated tools cannot: unplug the mouse and buy something using only the keyboard, turn on your operating system’s screen reader and try to reach checkout, and check text contrast with a colour contrast analyser.
Automated tools catch perhaps a third of the criteria. The keyboard walk and the screen reader walk are where the findings that matter come from, and they cost nothing but an afternoon.
If you would rather have it done properly, with each finding evidenced and the regulation’s own wording beside it, that is the accessibility review. If the shop clears the checks yourself, you have saved the fee, and that is a fine outcome.
Have the shop checked against the rule
Your storefront tested against the 35 success criteria, evidenced with screenshots, the regulation quoted beside each finding, ordered by what leaves you most exposed. Fixed price, quoted before we start, not legal advice.
Sources
- uutilsynet, regelverk og krav for the WCAG level A and AA requirement, the list of success criteria that apply, and the exemptions.
- Lovdata, forskrift om universell utforming av IKT-løsninger for the regulation itself, including the scope test and who it binds.
- uutilsynet for the authority’s role, its monitoring work, and how it handles breaches.