An employee has twenty minutes to prepare a customer response. The company's AI policy says to protect sensitive information and use good judgement. It does not say which account to use, whether the customer's attachment is permitted, or who can answer a question quickly.
That is not an operational rule. It transfers an unresolved management decision to the person closest to the deadline. I would write a Norwegian workplace AI policy around the situations employees actually encounter, then test it with them before treating it as finished.
Put permitted work next to the boundary
A useful policy should say what people can do, as well as what they cannot. For example: drafting a general meeting agenda from non-confidential information in an approved business account may be permitted. Uploading a customer contract to an unapproved personal account is a different activity. An internal label such as “business account” is not, by itself, proof that every type of information is acceptable there.
My proposed one-page starting point contains six answers:
- Which tools and accounts are approved, and who maintains the current list?
- Which kinds of information may be used in each tool, with concrete examples?
- Which uses need a separate assessment or are outside the permitted scope?
- Who checks outputs before they affect a customer, colleague or business record?
- Where can employees ask questions or report mistakes without hiding them?
- Who changes the policy, and how will staff learn about a material change?
Link this page to the detailed supplier and security assessments. Employees need an actionable answer, while the organisation still needs the evidence behind it.
Test three ordinary Norwegian workplace situations
A tender response. A sales employee wants help improving language in a document containing customer specifications. The rule should distinguish public wording from information restricted by the customer agreement. “Remove the name” may not be enough if the remaining details identify the customer or expose confidential work.
A meeting summary. A manager wants an assistant to transcribe a discussion. The process should address the actual information captured, participants, access, storage and appropriate notice or other obligations. A generic statement that employees may use AI for productivity does not settle those questions.
An employee assessment. Someone proposes ranking staff from message activity or generated productivity scores. That is not just a more advanced writing aid. It needs separate scrutiny of purpose, necessity, fairness, data protection and employment requirements before use.
These are hypothetical situations to test the policy, not findings that a particular product or use is lawful.
Involve people before changing the conditions of work
Arbeidstilsynet's guidance on control and monitoring explains the requirements for discussing control measures with employee representatives, informing employees and evaluating the measures. Not every AI tool is a control measure, but logging or scoring staff behaviour may bring those requirements into the assessment.
I would involve employees and their representatives early when redesigning work, including when a tool is intended to help rather than monitor. They can identify invisible checking work and language problems that a purchasing team may miss. Explain what usage information is collected and who can see it. Do not quietly convert a learning programme into individual performance surveillance.
Teach verification as a job skill
Training should include a flawed answer, not only a successful demonstration. Ask participants to find a wrong reference, an unsupported claim and an instruction that conflicts with the source document. Show them how to stop, check the underlying record and escalate.
For customer-facing Norwegian, review meaning and commitments as carefully as spelling. Fluent Bokmål does not establish that a product description, delivery promise or contractual statement is correct. Staff should know which kinds of outputs require specialist review and have time to obtain it.
Keep the reporting route short. A person who pasted the wrong attachment should know whom to contact immediately; they should not have to interpret a long policy while the incident grows. The AI incident response guide describes what the organisation should do next.
Sources and scope
Sources checked on 11 October 2026. The policy format and examples are my recommendations. Employment agreements, collective agreements, sector rules and the specific processing may create additional requirements. The Norwegian integration guide covers the wider privacy and supplier assessment.