NAV's Sick-Leave Prediction Model — Norway's Data Protection Sandbox Finds a Legal Basis for Using AI, but Not a Clear One for Training It

Norway's labour and welfare administration (NAV) is legally required to assess, by week 17 of a sick-leave spell, whether a second dialogue meeting (dialogue meeting 2) is needed before week 26. NAV hypothesised that too many unnecessary meetings waste time for employers, doctors, sick-listed people and its own advisers, and built a machine-learning model to predict sick-leave duration to support the adviser's decision. The adviser, not the model, takes the final decision; the prototype justified each prediction with three factors pointing to longer and three to shorter duration.
In 2021-2022 NAV took the tool into the Norwegian Data Protection Authority's (Datatilsynet) regulatory sandbox for responsible AI, with the Equality and Anti-Discrimination Ombud invited in on fairness. The exit report (January 2022) covers three themes: legal basis, fairness and explainability.
Findings, as stated in the exit report: NAV has a legal basis to use AI as decision support on whether an individual needs follow-up; it is doubtful that the cited provisions (National Insurance Act s. 8-7 a with s. 21-4, Public Administration Act s. 17) allow using health data of past claimants to develop the model itself. The report is guidance, not a Datatilsynet decision. On fairness, NAV operationalised outcome fairness across groups such as sex, age and diagnosis, treating unnecessary invitations as less serious than missed ones, and the report identifies a tension between privacy and fairness because testing for discrimination needs group data. A fully automated variant could meet the GDPR Article 22 threshold, so real human review is required.
Evidence limits: the sandbox produced a legal and ethical assessment, not outcome data. A 2021 University of Oslo case study (Høgåsen, Complex 5/2021) describes the development as unfinished and shows the team spending more time clarifying usable data than building the algorithm, with legal-basis uncertainty slowing progress. No published results on meeting reductions or accuracy were found. The report concludes that further development needs a clear supplementary statutory basis, making this a cautionary and transferable case on how public bodies can authorise AI development, not only AI use.

Read the full analysis: https://jus.uio.no/ifp/forskning/om/publikasjoner/complex/2021/complex_5_21_web.pdf