Q&A: REGULATION AND REIMBURSEMENT OF DIGITAL THERAPEUTICS (DTX) / Norway

To enable a consistent comparison of the legal frameworks surrounding digital therapeutics (DTx) across different jurisdictions, we have developed this Q&A template. It serves as the basis for a blog series on the BLE website that explores how various countries regulate, clas- sify, and reimburse digital health applications. By answering the following questions, you con- tribute to an international understanding of how DTx are integrated into national healthcare systems. We appreciate your time and expertise in supporting this cross-border digital health initiative.

A. Contributor Information 

Name: Anne Marie Sejersted, Annelin Sødal 

 Law Firm / Organization:  Advokatfirmaet Wiersholm AS

 City / Country:  Oslo, Norway                                                          

 Email:  ams@wiersholm.no

B. Introduction – Status and Definition of DTx

1. Does your country have any uniform or established regulations for digital therapeutics (DTx) which provides for a legal definition of DTx? If not, are there any soft law instruments, guidance documents, or working definitions used by authorities or HTA bodies?

Norway does not have a specific, uniform legal definition of digital therapeutics (DTx). However, as a member of the EEA, Norwegian law incorporates the core EU legal framework on medical devices and may rely on the definitions and interpretations provided in the EU guidance. This includes the Medical Devices Regulation (MDR) 2017/745 (medical devices including software), In Vitro Diagnostic Regulation (IVDR) 2017/746 (in vitro diagnostic medical devices), General Data Protection Regulation (GDPR) (processing of personal health data), and the ePrivacy Directive (privacy in the electronic communications sector). None of these frameworks provide a legal definition of "Digital Therapeutics". Rather, they establish regulatory structures that can include digital health products depending on their functionality and the type of data they process. 

In the absence of a legal definition, our approach assume that Digital Therapeutics (DTx) are considered evidence-based software interventions used for therapeutical purposes, i.e to prevent, manage, or treat physical, mental, or behavioral conditions. DTx are typically delivered via smartphones, tablets, or computers, either alone or alongside other therapies, and provide therapeutic benefits such as cognitive behavioral therapy, lifestyle modification, medication adherence, or disease education.  

Note that our answers below are based on the above understanding of DTx as a concept. 

C. Legal Classification of DTx in your Country

2. Under which legal framework do DTx fall in your country (e.g., medical devices, pharmaceuticals, others)?

The classification depends on the specific components of the therapy, whether it includes a medicinal product, a medical device, or a combination of both.  

In Norway, DTx are primarily regulated under the medical devices framework, which is implemented through the Norwegian medical devices legislation which transposes Regulation (EU) 2017/745 (MDR). Depending on their intended purpose and claims made, DTx products may also be subject to other regulatory regimes if they intersect with pharmaceuticals. However, in practice,  and based on our understanding of the definition, DTx will most frequently be classified as medical devices, often specifically as software medical devices. 

According to EU law, health applications should be considered medical devices primarily based on Regulation (EU) 2017/745 on medical devices (Medical Devices Regulation), which serves as the main source of interpretation in this context. 

3. What criteria determine whether a DTx is classified as a medical device or as a well-ness/lifestyle/other product?

DTx will be classified as a medical device if the software’s intended purpose is for the diagnosis, prevention, monitoring, treatment, or alleviation of disease, or similarly defined medical functions under MDR Article 2. If a digital health device is intended solely for general wellness, well-being, or lifestyle purposes and does not claim a direct medical function, it will not be classified as a medical device. The decisive factor is the device's intended purpose, as defined by the manufacturer and described in marketing or labeling materials.

4. What are the regulatory requirements for market access (e.g., conformity assessment, CE marking, national registration)?

The fundamental regulatory pathways for market access do not differ between DTx and non-DTx products. DTx classified as medical devices must undergo conformity assessment in accordance with requirements under MDR such as the device’s risk class, obtain CE marking, and fulfill requirements for post-market surveillance. The process and the involvement of a notified body depend on the risk class of the device, in accordance with MDR and further Norwegian implementation measures. For Class I devices, the manufacturer may self-declare conformity; higher-risk devices require notified body assessment. Registration requirements with Norwegian authorities must be fulfilled prior to market access. 

5. Are there specific cybersecurity, interoperability, or data protection requirements that apply to DTx?

DTx must comply with the general cybersecurity, interoperability, and data protection provisions as specified in EU and national law. There are, however, no specific Norwegian requirements tailored exclusively to DTx. For your reference, we have included a brief description of the general requirements below. 

MDR: DTx must comply with requirements under the MDR, which is implemented nationally within the Norwegian medical device regulatory framework. This includes requirements to undergo a conformity assessment in line with the MDR, obtain a valid CE marking, fulfill post-market surveillance obligations and register the device with relevant Norwegian authorities before commercialization. These requirements may be further specified by Norwegian authorities for health IT, such as the Norwegian Directorate of Health's (Nw. Helsedirektoratet) guidance on digital health solutions.  

NIS Directives: DTx must comply with the requirements under the NIS Directives, which aim to enhance cybersecurity across the EU. The NIS 1 Directive is implemented in Norway through the Norwegian Digital Security Act (No. Digitalsikkerhetsloven), and set the main legal baseline for digital security in Norway in connection with DTx, hereby minimum cybersecurity requirements and incident notification obligations for operators of essential services and certain digital service providers, including those in the health sector such as medical device companies and digital health providers.  The NIS 2 Directive expands its coverage (compared to the original NIS 1 Directive) by including medium-sized companies in critical and highly critical sectors, including healthcare providers, pharmaceutical and medical device companies, as well as drug research firms, if size thresholds are met. Depending on the size and characteristics of a DTx, specific cybersecurity requirements under the NIS Directives may apply to DTx providers. 

GDPR: All DTx handling personal data must comply with the General Data Protection Regulation (GDPR), as implemented in Norway, which imposes strict standards for processing health data, information security, and data subject rights. The GDPR is incorporated in Norway through the Norwegian Personal Data Act (Nw. personopplysningsloven), making its data security, storage, consent, and data subject rights provisions directly applicable. This includes requirements for: 

• Conducting data protection impact assessments (DPIA) for health apps. 

• Implementing both organisational and technical security measures, such as encryption, access control, and secure data storage. 

• Providing transparency about data processing, ensuring legal grounds for processing (often explicit consent), and respecting data subject rights (e.g., access, erasure, correction). 

• Notifying breaches to the Norwegian Data Protection Authority (Nw. Datatilsynet) within set timelines. 

  
  

The Norwegian Data Protection Authority is the competent supervisory body and issues practical guidance and enforcement decisions regarding data privacy in health and digital health sectors.  

The Health Register Act: Beyond MDR and GDPR, sector specific Norwegian rules may apply to DTx, such as the Health Register Act (Nw. helseregisterloven). This law governs the processing of health data in Norway, including both patient-specific and statistical/administrative uses. It requires that health data must be processed electronically in systems designed for therapeutic use. Health data filing systems must comply with strict requirements for data processing, access control, retention, and secondary use. 

Code of Conduct for information security and data protection: The Code of Conduct outlines best practices for protecting information systems and personal data in health care and are often required for integration with the national infrastructure.  

Digital Content Directive: Additionally, consumer protection laws require strict data protection if DTx are distributed to consumers. The Digital Content Directive, implemented in Norway as the Norwegian Digital Content and Services Act (Nw. Digitalytelsesloven) applies to contracts where digital therapeutics are supplied to consumers. Requirements include suitability for purpose, update obligations, conformity with expectations, and explicit disclosure/acceptance of any deviations from quality standards. 

6. Is there a specific regulatory pathway or fast-track available for digital health products or DTx (e.g., expedited review, sandbox programs)?

Norway does not have a fast-track or sandbox regulatory pathway specifically for DTx. However, authorities encourage innovation in digital health. Guidance or dialogue with relevant agencies is available on a case-by-case basis to support the development and regulatory compliance of DTx products. E.g. the Norwegian Directorate of Health and the Norwegian Medical Products Agency (DMP).  

7. How is the legal distinction between DTx and other digital health applications handled (if any) in your jurisdiction?

Due to the lack of a legal DTx definition and other digital health applications, it is not possible to establish a clear distinction between the two categories. The primary distinction is whether the application is classified as a medical device under MDR. Digital health applications that do not meet the criteria for medical devices are considered as general wellness or lifestyle products and are not subject to the same regulatory requirements under the MDR.  

D. Reimbursement According to your Jurisdiction

8. Is there a legal basis for the reimbursement of DTx in your healthcare system?

There ist no specific category or additional criteria that apply solely because a device has DTx properties. Devices with DTx properties must meet the same general regulatory and reimbursement requirements as other medical devices, including demonstration of safety, efficacy, and cost-effectiveness.  

DTx that qualifiy as medical devices may be considered for reimbursement under general medical device funding schemes in Norway. This includes the sceme for blue perscription (Nw. Blåreseptordningen), which is a scheme covered by the Norwegian regulation of blue perscription (Nw. Blåreseptforskriften), where approved medical devices can be funded for patient use if they meet requirements for safety, efficacy, and cost-effectiveness. However, the reimbursement criteria and processes are not tailored specifically for DTx. Digital therapeutics are assessed according to the same framework as other medical devices. 

9. Under what conditions can DTx be eligible for reimbursement (e.g., prescription require- ment, evidence of efficacy, medical benefit)?

DTx devices are eligible for reimbursement to the same extent as non-DTx devices, as Norwegian law does not impose specific legal requirements for DTx devices. This means the conditions for reimbursement are the same for DTx devices and non-DTx devices.  

To be considered for reimbursement, a device must typically demonstrate efficacy, safety, and medical benefit, meeting the requirements set by relevant HTA agencies such as the Norwegian Medical Products Agency (Nw. Direktoratet for medisinske produkter) or the Norwegian Directorate of Health. The product must be CE marked as a medical device and, depending on the funding mechanism, may also require a prescription (if classified as a pharmaceutical), clinical evidence, and cost-effectiveness documentation. 

Please note that the reimbursement requirement may vary dependent on the classification of the DTx. For example, requirements may differ if the DTx includes specific components such as a medicinal (pharmaceutical) product or a software product. The Norwegian Regulation relating to Medicinal Products (Nw. Legemiddelforskriften) Chapter 14 specifically governs pricing, reimbursement, and market access for pharmaceuticals in Norway. Devices or software products that are classified as medical devices (including software as a medical device) are primarily regulated under the MDR and the Norwegian medical device regulation (Nw. Forskrift om medisinsk utstyr), rather than the Norwegian Regulation relating to Medical Products (Nw. Legemiddelforskriften) Chapter 14, unless they also include a medicinal component.  

10. How is reimbursement of DTx practically  carried out – through catalogs, individual agreements, or direct claims to insurers?

As far as we know, there is no general practical pathway for DTx reimbursement in Norway.  Depending on its specific components, as described above, DTx may be funded through existing arrangements for medical devices or pharmaceuticals in Norway  (such as hospital procurement, individual funding decisions, or potentially under public pharmacy schemes). However, there is no national catalog or dedicated reimbursement list specifically for digital therapeutics. As an alternative, individual agreements with payers or hospitals may be pursued

11. What role do health technology assessment (HTA) bodies or evidence evaluation procedures play in this process?

The Norwegian Medical Products Agency (Nw. Direktoratet for medisinske produkter) evaluates clinical evidence, cost-effectiveness, and health outcomes for DTx seeking reimbursement or endorsement in the Norwegian healthcare system. These assessments guide coverage and reimbursement decisions at both national and hospital level. 

12. What limitations or uncertainties currently exist regarding the reimbursement of DTx in your country (e.g., missing lists, lack of contracts, definitional issues)?

In Norway, the reimbursement landscape for DTx is uncertain due to the absence of a legal definition for digital therapeutics. Consequently, a fragmented legal framework and uncertainty regarding which rules apply or which reimbursement alternatives are 

suitable.  

13. Is temporary or conditional reimbursement (e.g., while real-world evidence is collected) possible in your jurisdiction?

To our understanding, this question concerns whether the Norwegian healthcare system allows DTx or digital health products to receive reimbursement on a temporary basis or under specific conditions. While Norway's system does sometimes permit temporary or conditional access to selected therapies (e.g., via managed entry agreements), there is no formalised structure specifically tailored for DTx in this contect.

E. Practical barriers

14. Have manufacturers of DTx in your country faced specific practical barriers (e.g., delays in evaluations, inconsistent insurer decisions, lack of digital infrastructure)?

There is no general information available to refer to on this question. As mentioned above, there are certain challenges such as a fragmented legal framework and bureaucratic or procedural hurdles.  Regarding the latter, it is also a general point of concern that it is often difficult and time consuming to get access to health data for research projects, even if such data is in principle available. 

F. Perspectives – Future Outlook

15. Are there any ongoing initiatives or legislative efforts in your country to further develop or reform the legal and reimbursement framework for DTx?

We are not aware of any initiatives or legislative efforts in Norway regarding the legal and reimbursement framework for DTx specifically. On a general level there is, however, a high attention in Norway towards the digitalization of the healthcare sector.  

As an illustratation, both White Papers to the Norwegian Parliament (Nw. Stortingsmeldingen) and the Norwegian Directorate of Health’s e-health strategy (Nw. Helsedirektoratets e-helsestrategi for helse- og omsorgssektoren)  lay out objectives for accelerating digitalisation in the healthcare sector, including the integration and adoption of DTx solutions. The focus on digital health measures is further illustrated by the Norwegian government’s 2025 budget, which allocates substantial funding for the develop health technology schemes. These funds support digital interaction solutions, adaption of patient record systems, and increased interoperability between health personnel and patients. 

16. Do these efforts include stakeholder consultations or pilot programs that manufacturers can engage with?

Both White Papers to the Norwegian Parliament (Nw. Stortingsmeldingen) and the Norwegian Directorate of Health's e-health strategy (Nw. Helsedirektoratets e-helsestrategi for helse- og omsorgssektoren) mentioned above encourage co-creation achieved through dialogue with municipalities, health trusts, patient organisations, professionals and industry representatives. This may open up for opportunities also for manufactureres to engange in digital health projects.