Do we need an AI policy?

The question usually comes up the same way. Somebody on the leadership team discovers that a colleague has pasted a client document into ChatGPT to get help with a summary, and suddenly the question is no longer theoretical. The short answer is: probably yes. Not because one particular law requires it from one particular date, but because several sets of rules already point the same way: some settled, some still moving.

The long answer is about why. And this is where most organisations get lost, because they are looking for a single deadline to work to, in a body of regulation that is not built that way.

Two kinds of rules, changing at different speeds

The most common misunderstanding is to think the question is about one law that either applies or does not apply yet. That is not right. It is more useful to separate two categories.

What is already Norwegian law, and is not waiting for anything:

The Norwegian Working Environment Act imposes requirements entirely independently of whether a dedicated AI act arrives. Introducing tools that monitor or direct how staff work can trigger the rules on monitoring measures in chapter 9, which must be discussed with employee representatives before introduction, whatever the size of the business. The Act also requires the employer to provide necessary training in new systems, under section 4-2, and to watch for discrimination under chapter 13 if an AI tool has been trained on skewed data.

The Norwegian Personal Data Act and the GDPR apply the moment an AI tool processes personal data, whether that is a language model given access to documents containing client data, or a system that logs staff use. At that point the organisation needs a clear legal basis, and often has to document a data protection impact assessment.

These two apply in full, today, and will continue to apply whatever happens to the AI act next.

What is still moving:

The EU AI Act is not Norwegian law yet, and the regulation itself has been under active amendment from the EU side through 2026. The details in this section move more often than the rest of the article, so we keep them in a separate, dated box rather than weaving them into the text:

The point of putting this information in a box is not just tidiness. It is so the rest of this article does not have to be rewritten every time the deadline moves again — something it has already done several times.

Why it is sensible however the deadlines land

Regardless of when and how the AI act lands, three structural patterns point the same way, and none of them depends on a particular date.

Use grows faster than governance. This is not unique to 2026. It is the pattern every time a new technology becomes cheap and available enough for individual staff to adopt it without asking anyone. AI is simply the newest example, and the most widespread. Exactly what share of Norwegian businesses use AI today will shift month by month — but the direction has been unambiguous since 2023, and there is no reason to think it reverses.

Shadow AI is the norm, not the exception. Staff paste customer lists into a chatbot for help with segmentation, or emails into a free version of a tool to improve the phrasing, without anyone in management having taken a view on it. This happens in the vast majority of organisations that have not actively decided what is permitted, whatever the sector or size. The Samsung case from 2023 has become the classic example: engineers uploaded source code and internal meeting notes to a public chatbot shortly after the tool was approved internally, and the information became part of the supplier's training data.

Regulators respond to data protection breaches with real sums, whether or not AI is involved. The Norwegian Data Protection Authority has shown across several large cases that its sanctioning powers do get used when control fails. None of the best-known cases concerned generative AI specifically, but they show how seriously the authority treats cases where organisations have had no overview of their own data processing. And an AI tool without guidelines is exactly that: data processing without an overview.

An AI policy does not solve any of these three patterns on its own. But it is the first and cheapest measure that actually shifts something, because it forces a conversation about what is approved, what is not, and who is responsible, before it happens in practice without anyone having taken a view.

What an AI policy actually has to cover

An AI policy is not one document that solves everything. It is a collection of concrete answers to questions staff are already asking themselves, whether they say so out loud or not. These are structural questions that do not change even when the law does:

Which tools are approved, and for what. Not a general "yes to AI", but a list: one tool is fine for first drafts of internal notes, not for client data. Another is integrated and approved for email and meeting notes. Anything not on the list has not been considered yet, and must be cleared before use, not afterwards.

What must never be pasted into an AI service. Personal data, source code, trade secrets, unpublished board papers. This point alone catches most of the risk from shadow AI, and it is at the same time the easiest thing to communicate to staff who have neither the time nor the interest for the full body of regulation.

Who approves new tools. Without a defined point of responsibility the decision lands with the individual employee, who has neither the grounding nor the mandate to assess it.

What you do when the AI gets it wrong. Hallucinations and factual errors are not an exceptional state, they are a known property of language models. A policy that says nothing about human oversight and verification is missing the most important point.

How you involve employee representatives. For organisations over 50 staff this is not optional under the Working Environment Act, and Supplementary Agreement IV to the Norwegian Basic Agreement governs the introduction of new technology specifically. Several organisations report good results from bringing employee representatives in during the pilot phase, rather than once the tool has been rolled out.

How you show, if anyone asks, that you have actually thought through the training need. This point is no longer about satisfying one particular section number with one particular form. Neither Norwegian nor European regulation currently requires a specific form of documentation. It is about being able to show, briefly and simply, that management has considered what staff need to know in order to use the tools responsibly, and that something has been done about it. Three sentences and a date is often enough.

None of these points requires a consultancy or a six-month project. They require somebody in management to sit down, work through them concretely for the tools you actually use, and write down the answers.

Where to start, in practice

Step one is not writing the policy. It is mapping what is already happening. Most organisations are surprised by how many AI tools are already in use once they ask. Not because staff have done anything wrong, but because nobody has asked before.

Make a simple overview: which tools, who uses them, for which tasks, and what data can end up there. Then assess each concrete use against risk. An AI tool that drafts internal notes is something entirely different from one involved in hiring or credit assessment, which falls under what the AI Act defines as high risk. Then assign responsibility: who approves new tools, and who owns the policy once it is written.

This is not a one-off project. Tools change faster than most internal routines can follow, and a policy that is not updated quickly becomes a document nobody trusts any more. The same goes, incidentally, for the regulatory status at the top of this article. Treat it as a snapshot, not as a permanent answer.

Frequently asked questions