Can a foreign company buy a virksomhetssertifikat directly?

Not without a Norwegian anchor. Both issuing CAs — Buypass and Commfides — tie issuance to an entity registered in the Norwegian business registers: the certificate is bound to a Norwegian organisation number, and the person signing the order must hold a role that is registered and visible in the Brønnøysund registers for that entity. A company with no Norwegian registration has neither.

So how does a foreign company become eligible?

By getting the anchor first: registering a NUF (Norwegian-registered foreign business) with Brønnøysund yields a Norwegian organisation number for the existing foreign company, and a registered role holder for that NUF can then sign a certificate order. Whether a NUF is the right structure for you is professional advice; the eligibility mechanics are as stated.

We already have an eIDAS qualified seal. Is that a virksomhetssertifikat?

No. They are parallel credentials from different trust regimes. A European eSeal from an EU Trust List provider is accepted by Maskinporten's dedicated European route for scopes opened to European businesses — but it does not substitute for a virksomhetssertifikat in the standard Norwegian onboarding: ordering one, signing Digdir's terms, and Altinn registration all anchor on the Norwegian registry, not the EU Trust List.

What entity size or form does the certificate demand?

None beyond registration. The eligibility bar is registry-anchored, not size-anchored: a single-person Norwegian entity can hold one. Apier's own certificate — and the Maskinporten production access and Altinn System Register entry built on it — was obtained by a Norwegian enkeltpersonforetak, a sole proprietorship.

Foreign access

A virksomhetssertifikat is issued against a Norwegian organisation number — foreign entities get one by registering first.

Norway's enterprise certificate is the credential every deeper government integration assumes. Both issuing CAs anchor it on an entity registered in the Brønnøysund registers, so for a foreign company the eligibility question reduces to the registration question.

What the artifact is

A virksomhetssertifikat (enterprise certificate) is an X.509 certificate that identifies an organisation — not a person — to Norwegian digital infrastructure. It is issued by one of two certificate authorities, Buypass and Commfides, and it sits underneath the entire integration chain: it is how you sign into Samarbeidsportalen the first time, the credential a Maskinporten client is bound to, and the organisational identity behind Altinn onboarding. It is the first item on the dependency chain for a reason — nothing deeper starts without it.

Eligibility, precisely — from both CAs

Buypass's eligibility page states that anyone can order a virksomhetssertifikat, but the person signing the agreement must hold a visible role for the business registered in the Brønnøysund registers — and their ordering documentation requires the business itself to be registered in the Norwegian entity register, with the organisation number embedded in the certificate's serial number. Signing authority can be delegated by power of attorney, but the delegation chain still starts at a registered role.

Commfides's ordering requirements anchor the same way: the person ordering must have a role registered and visible in Brønnøysundregisteret, and the certificate is linked to a legal entity — an organisation number. Two CAs, one anchor. As of 26 July 2026, neither CA documents an issuance path for an entity that exists only in a foreign register.

The consequence for a foreign company is mechanical rather than discretionary: eligibility is not about nationality, sector, or size — it is about presence in the Norwegian registry. Establish that presence and the certificate follows; skip it and no CA order form will complete.

The route for a foreign entity

Establish the registry anchor. Brønnøysund's guidance: a foreign business that needs a Norwegian organisation number registers a NUF — a registration of the existing foreign company. The role holders registered for that NUF are who a CA can verify.
Order from either CA with a registered role holder (or their power-of-attorney delegate) signing. Ask up front for the soft certificate variant (P12/PFX) if the key will live on a server — the hardware-token default costs a re-issuance cycle to undo, one of the pitfalls the Maskinporten Developer Guide walks through.
Budget verification time. Issuance is a formal organisational-verification process — typically days to weeks, not minutes — and the certificate renews annually. Put the renewal in a calendar the day it arrives.

What a virksomhetssertifikat is not

It is not an eIDAS eSeal, and the two are not interchangeable. If your organisation already holds a qualified electronic-seal certificate from an EU Trust List provider, that credential opens exactly one documented Norwegian door: Maskinporten's European eSeals route, for scopes explicitly enabled for European businesses. It does not open Samarbeidsportalen onboarding, does not satisfy a CA order form, and does not stand in for the certificate in the standard integration chain. Conversely, a virksomhetssertifikat is a Norwegian-regime credential — useful precisely because the Norwegian chain anchors on it.

How low the entity bar actually is

A first-hand data point that puts the eligibility bar in perspective: Apier's own virksomhetssertifikat — and the Maskinporten production access and Altinn System Register entry built on top of it — was obtained by a Norwegian enkeltpersonforetak, a sole proprietorship. The certificate regime does not demand an AS with board minutes and share capital; it demands a registered entity with a verifiable role holder. For a foreign company weighing the cost of establishing a Norwegian anchor, that is the honest calibration: the bar is registration, not scale.

FAQ

Can a foreign company buy a virksomhetssertifikat directly?: Not without a Norwegian anchor. Both issuing CAs — Buypass and Commfides — tie issuance to an entity registered in the Norwegian business registers: the certificate is bound to a Norwegian organisation number, and the person signing the order must hold a role that is registered and visible in the Brønnøysund registers for that entity. A company with no Norwegian registration has neither.
So how does a foreign company become eligible?: By getting the anchor first: registering a NUF (Norwegian-registered foreign business) with Brønnøysund yields a Norwegian organisation number for the existing foreign company, and a registered role holder for that NUF can then sign a certificate order. Whether a NUF is the right structure for you is professional advice; the eligibility mechanics are as stated.
We already have an eIDAS qualified seal. Is that a virksomhetssertifikat?: No. They are parallel credentials from different trust regimes. A European eSeal from an EU Trust List provider is accepted by Maskinporten's dedicated European route for scopes opened to European businesses — but it does not substitute for a virksomhetssertifikat in the standard Norwegian onboarding: ordering one, signing Digdir's terms, and Altinn registration all anchor on the Norwegian registry, not the EU Trust List.
What entity size or form does the certificate demand?: None beyond registration. The eligibility bar is registry-anchored, not size-anchored: a single-person Norwegian entity can hold one. Apier's own certificate — and the Maskinporten production access and Altinn System Register entry built on it — was obtained by a Norwegian enkeltpersonforetak, a sole proprietorship.