Kristian Foss has over 25 years of experience in privacy, IT, and technology law. He leads Bull Digital, Bull's cybersecurity respons service, personvernfabrikken.no, and is a member of the Committee for ICT Law for "Juristenes utdanningssenter".
Kristian works with and lectures on legal issues related to artificial intelligence (AI Act etc.), cybersecurity (Digital Security Act, NIS 2, Cyber Resilience Act, DORA etc.), data rights (Data Act, Data Governance Act etc.) and privacy, including related contract work and board responsibilities.
Previously, he was the president of the IT IP Law Group Europe, Europe's oldest network for technology lawyers, and is a member of Itechlaw as part of Kristian's international work.
Kristian has also worked at Advokatfirmaet Haavind, where he was responsible for technology and media law, and as in-house counsel at EVRY (now TietoEvry).
Awards and rankings
The rating agencies Chambers and Partners, The Legal 500, and Who's Who Legal recommend Kristian as one of Norway's best lawyers in technology, media, and telecom (TMT) and IT/technology. He is also recognized by the ranking agencies as a "thought leader."
Education
| 2003 | Subjects in history, University of Oslo |
| 1997 | Master of Laws (LL.M.), University of Oslo |
| 1988–1989 | Sergeant course (USK), The Norwegian Army |
Work experience
| 2015– | Partner, Bull |
| 2007–2015 | Managing partner, Gille advokater DA |
| 2001–2007 | Attorney/Associate, responsible for technology, IT and telecom, Advokatfirmaet Haavind Vislie AS |
| 1999–2001 | Associate/Attorney, Legal department, EVRY |
| 1999 | Co-founder, Idium AS |
| 1997–1999 | Project manager, attorney and business developer, Grape Interactive AS (Internet consulting firm) |

Norway implements NIS1 from 2016 in extended version – in effect from 1 October 2025
The Digital Security Act, along with its accompanying regulations, comes into force on October 1, 2025. This marks a ...
Read more
The CER Directive: New physical security requirements for critical entities
The EU is now introducing the CER Directive, which imposes extensive requirements for physical security and operation...
Read more
NIS2: Personal liability for management and employees
The NIS2 directive is a new EU regulation that tightens cybersecurity requirements and introduces personal liability ...
Read more
NIS2: Which businesses are covered?
The NIS2 Directive, which came into effect in the EU in 2024, introduces stricter cybersecurity requirements for busi...
Read more
What specific security measures does NIS2 require businesses to implement?
When the NIS2 directive applies to your business, the question arises: what measures are required? Here are a brief summary and practical advice to get started.
Read more
A new era of cybersecurity in Europe
The EU has adopted the NIS 2 Directive, which will come into force for member states from 18 October 2024. The purpos...
Read more