On August 7, 2026, Iceland's Ministry of Health (Heilbrigðisráðuneytið) published Regulation No. 879/2026 on internal control of healthcare providers (reglugerð um innra eftirlit veitenda heilbrigðisþjónustu) in Stjórnartíðindi B-deild. The regulation enters into force on August 8, 2026. Documented internal-control procedures and the eleven minimum control themes must be in place and in use no later than January 1, 2027.
This is a binding ministerial regulation under Article 24a(3) of the Health Services Act No. 40/2007 and Article 9(4) of the Act on the Director of Health and Public Health No. 41/2007. Every Icelandic healthcare institution and other healthcare operator must run a documented, risk-based internal-control system covering quality, patient safety, staffing, medicines, access to systems and health records, and incident handling, with the provider's senior manager personally accountable.
What does Regulation 879/2026 actually require?
Providers must design, document and implement an internal-control procedure that keeps services aligned with applicable law, administrative rules, quality standards, contracts and guidance, with patient safety as the guiding principle. The procedure must be available to staff and to service users.
At minimum, the documented procedure must assign who is responsible for each control activity, set a plan for how often routine checks run, explain how an incident triggers extra internal control, provide for regular review (and ad hoc review when operations change), and require that internal-control findings be summarised periodically and presented to management for decisions and remedial action. Results must also be notified to the Directorate of Health (embætti landlæknis) when they may justify an investigation or other supervisory action.
Article 6 lists eleven control themes that must be covered unless a theme is genuinely irrelevant to the provider's activity: mapping of binding rules and professional guidance; defined staff responsibilities; risk identification and mitigations; staffing, competence and training needs; waiting-time assessment against minimum requirements where applicable; premises, medical devices and equipment licences and certifications; access controls to systems plus security of health records and personal data; safe handling and storage of medicines; procedures for unexpected and serious incidents; handling of complaints, feedback and service surveys; and follow-up remediation after internal-control findings.
Who is in scope, and who is personally accountable?
The regulation applies to healthcare institutions and other operators that provide healthcare services in Iceland. "Healthcare providers" covers both institutions and other healthcare business operators. The ábyrgðarmaður (the most senior manager of the institution or practice) is personally responsible for compliance with this regulation.
That manager must know the laws and administrative rules that apply to the activity, know professional directions and guidance issued by the Director of Health under Article 5 of the Director of Health Act where relevant, ensure that managers and staff know and participate in internal control as appropriate, and ensure that the Article 5 procedure and Article 6 control plan exist. Providers that deliver care under a contract concluded under Chapter IV of the Health Insurance Act No. 112/2008 must also meet the contractual terms on service delivery alongside this regulation.
What is the compliance calendar from August 8, 2026 to January 1, 2027?
The regulation is already in force. The transitional provision gives providers until January 1, 2027 to have the internal-control procedure and control themes finalised and taken into use. Between those dates, providers should treat build-out as an active compliance programme, not a paper exercise deferred to year-end.
| Milestone | Date | What must be true |
|---|---|---|
| Publication (Stjórnartíðindi B) | August 7, 2026 | Official text available; PDF prevails if the HTML rendering differs |
| Entry into force | August 8, 2026 | Regulation 879/2026 is binding law |
| Transitional compliance deadline | January 1, 2027 | Documented procedure and Article 6 themes in place and in operational use |
The full Icelandic text is also available on the official journal page for Regulation No. 879/2026.
What should quality and compliance leads do before January 1, 2027?
Map which Article 6 themes apply to your service lines and which can be documented as out of scope with a short rationale. Assign the ábyrgðarmaður-owned procedure owner, write the responsibility matrix, and set the review cadence. Align existing quality, pharmacovigilance-style medicine storage controls, incident reporting, complaints handling, EHR access reviews and data-protection controls into a single internal-control file that management can evidence.
Build the notification trigger to the Directorate of Health into the findings workflow so that material results are not stuck in a local quality loop. Contracted providers under Health Insurance Act Chapter IV should cross-check the regulation against their Sjúkratryggingar Íslands contract clauses in the same pass. Continuous, per-jurisdiction real-time monitoring surfaces this kind of ministerial regulation the moment Stjórnartíðindi publishes it, so the January 2027 deadline is not discovered late.
Take advantage of this real-time watch
Next steps: confirm the regulation applies to every site you operate in Iceland, close gaps against the eleven Article 6 themes, calendar the January 1, 2027 go-live of the documented procedure, and brief clinical, quality, pharmacy, IT and data-protection leads. Obsidian keeps Icelandic health-sector instruments of this type in view as they hit the official journal.
