When even the companies leading the AI race are calling for stronger controls, organisations in Norway should ask themselves whether they have control over how different types of artificial intelligence (AI) are being used.
A 2026 Twoday analysis shows how wide the gap is: 75 per cent of Nordic executives are integrating AI into most initiatives, but only 26 per cent of CEOs are directly involved in AI strategy. At the same time, 53 per cent of organisations have not assigned clear responsibility. AI use is outpacing governance.
For Norwegian organisations, the question is no longer whether to use AI, but how. Yet “AI adoption” is often treated as a single decision about a single technology. That is a dangerous oversimplification.
Two types of AI
Two categories are emerging in the workplace. One is personal productivity tools for writing, searching, analysing, coding and planning. The other is AI built into defined business and professional processes, with set data, purposes, roles and control points. They may use the same language model, but they differ in value, responsibility and risk.
Personal AI tools are generalists. The user chooses the task, evaluates the response and acts as the main quality check. But individual productivity is not the same as organisational transformation. Problems arise when a personal work habit becomes an unofficial business process. It can then affect customers, citizens and decisions without clear quality requirements. We could end up with a new “Excel hell”, only faster and on a much larger scale.
Organisations also need to know which tools are actually being used. Microsoft and LinkedIn’s Work Trend Index 2024/26 found that 78 per cent of AI users brought their own AI tools to work. This shows how quickly use can spread beyond governance frameworks.
When AI becomes part of a process
Process AI built into workflows starts from a different place. It is designed for a specific purpose within a known workflow. The organisation can govern the data, actions, approvals, logging and quality checks. This allows less flexibility, but makes results easier to measure. The question is not only how good the model is, but whether processing time falls, quality improves and fewer cases need to be redone. Built-in AI is not automatically safe, either. Poorly designed processes can be embedded and scaled.
But the risk can be tied to a named product, a specific process and repeatable tests.
That is why the two categories need different forms of governance. Personal tools need approved solutions, clear data boundaries, AI skills and clear user responsibility. Process AI needs named ownership, testing, access controls, monitoring, checkpoints and documentation throughout its lifecycle.
More than a policy
The EU AI Act and Norway’s work to implement it focus attention on competence, documentation, human oversight and accountability. The Archives Act underlines the importance of reliable documentation, while ISO/IEC 42001 and NIST provide frameworks for accountability, risk assessment and follow-up.
But a general AI policy is not enough.
Leaders should ask 6 questions:
- What are the consequences of an error?
- How dependent is the task on fixed data, roles and rules?
- How much variation can we tolerate?
- Does the result need to be explainable?
- How often is the task performed, and at what scale?
- Who is responsible for quality, updates and deviations?
The answers provide a better basis for decisions than the number of licences. Low-impact work can allow room for exploration. Shared team practices need guidance and a named owner. Regulated or high-impact processes require controlled, built-in solutions.
Responsibility must be assigned
Organisations need to map use cases, not just licences. They need to measure outcomes, not activity. For significant AI solutions, responsibility for both the process and the technical lifecycle should be clearly assigned.
Organisations that distinguish between personal productivity and process AI can give employees room to learn while putting controls where they are needed. Others may discover too late that a personal habit has become a business process that no one designed or can explain.
Read the original article on Digi.no.
