Clear Rules, More AI Use: Why Nordic Workplaces Struggle with AI Governance?
Finnish organisations have closed the AI guidelines gap faster than their Nordic neighbours, yet governance still lags behind everyday use. Recent Nordic data suggests that clear rules do not slow AI adoption down – they speed it up. The problem is not rules as such, but rules without an owner, and without the skills or strategy to back them up.
Martti Asikainen | 23.9.2026 | Photo created with Gemini AI
AI governance rarely makes headlines. The conversation tends to focus on new models, clever use cases and theoretical productivity gains. Meanwhile, the most important questions – who sets the rules, and whether anyone follows them – remain in the background. Yet governance often determines whether AI use in an organisation grows with confidence or stalls in uncertainty. Finland offers an interesting case in point, as the country has recently made rapid progress on the first step: having rules at all.
In just one year, the share of Finnish knowledge workers who say their employer has no AI guidelines fell from 21 to 7 per cent. Over the same period, the share who always follow those guidelines rose from 58 to 68 per cent (Solita 2026a). By Nordic standards, that is rapid progress. The survey covered more than 3,000 Nordic knowledge workers and was conducted by Kantar on behalf of the Nordic technology consultancy Solita. In it, 14 per cent of Swedish and 10 per cent of Danish respondents still reported having no internal AI guidelines at all.
On paper, then, Finland has largely solved the problem. In practice, it has solved only the easier half. Having a guideline is not the same as having one that works, or one that people follow. It is in the gap between the two that most AI governance appears to fail.
Do Rules Really Slow Us Down?
Many business leaders still regard AI guidelines as a handbrake: necessary for compliance, but harmful to momentum. The Nordic data points the other way. Denmark combines the region’s highest rate of guideline compliance, at 71 per cent, with its highest AI use. There, 65 per cent of respondents use generative AI at work, and 24 per cent do so daily.
In Finland the equivalent figures are 62 and 17 per cent, and in Sweden 53 and 14 per cent (Solita 2026a). Solita’s Rebecca Hammel calls the idea that guidelines slow people down the most common misconception among leaders. She argues that what actually holds people back is a lack of clarity (Solita 2026b).
There is, of course, one caveat. This is a cross-sectional survey, so it shows an association rather than a causal link. Organisations that use AI heavily may simply write rules because they need them. Even so, the explanation is plausible, and it matches what we see in the field.
In my work as an AI trainer, the question I hear most often in workshops is not how to write a better prompt. It is whether participants are actually allowed to use these tools at all. If I were an employer, that would worry me. People who don’t know where the line is either keep well clear of it or cross it quietly, without telling anyone.
Why Is Governance So Hard?
So why is governance so difficult to get right? The problem is structural rather than a matter of individual carelessness. AI use grows from the bottom up, while governance is built from the top down, and more slowly. At Finnish AI Region (FAIR), we have identified three main reasons for this mismatch.
The first is speed. In FAIR’s own survey of Finnish companies already using AI, 85 per cent of active users had started within the past three years (FAIR 2026). Most governance structures were designed for IT procurement cycles measured in years. They were not designed for tools that employees can adopt during a lunch break.
The second is knowledge. In the same survey, almost all respondents rated their understanding of the GDPR as moderate or good, with an average of 4.15 out of 5. By contrast, only around one in four were familiar with the EU AI Act. In other words, most organisations are drafting AI rules with a regulatory map that is still largely blank.
The third is ownership. According to Deloitte’s Nordic data, strategic preparedness fell from 61 to 43 per cent and talent preparedness from 33 to just 14 per cent. This happened even as three in four Nordic organisations planned to increase their AI investment substantially. Meanwhile, only 20 per cent of Nordic organisations have made anyone responsible for measuring whether AI initiatives deliver value, compared with 32 per cent globally (Deloitte 2026; Asikainen 2026c).
Tools faster than rules
Access to AI tools is spreading fast. According to Deloitte, the share of organisations in which at least 40 per cent of staff can use approved AI tools rose from 37 to 56 per cent in a single year. Yet only 16 per cent report having extensively redesigned work around the technology (Deloitte 2026; Asikainen 2026b).
Taken together with the findings above, these figures do not describe careless employees. They describe tools arriving faster than the rules, skills and roles that should accompany them. When management provides neither suitable tools nor the skills to use them, people fill the gap themselves.
KPMG found that roughly half of employees use AI without permission, and 44 per cent knowingly bypass company guidelines. Only 26 per cent of Finns consider their AI skills sufficient (KPMG 2025; Asikainen 2026a). The real question is not why someone reached for a personal account. It is what made that the easiest option.
Nordic working culture also plays a part. Deloitte notes that Nordic countries have strong labour protections, high trade union membership and a tradition of social dialogue. As a result, Nordic companies tend to negotiate major workplace changes rather than impose them from above. This slows change, but it may also reduce resistance (Deloitte 2026; Asikainen 2026b). Consensus takes time, and AI tools do not wait for the minutes to be approved.
Guidelines exist, guidance doesn’t
Finland’s figure of seven per cent represents a genuine improvement. A closer look at the rest of the breakdown, however, paints a different picture. According to the survey, 13 per cent of Finnish respondents follow their employer’s guidelines only sometimes. Another 11 per cent do not know whether any guidelines exist at all (Solita 2026a).
For more than one in ten employees, then, the rules might as well not exist. In my work with organisations, I have noticed that many guidelines list prohibited tools, add a clause on sensitive data, and stop there. Employees learn what they may not do, but are left unsure about everything else. That uncertainty can make people hesitant and undermine their sense of ownership over their own work. In turn, it can hold back development, innovation and productivity.
Meanwhile, regulation has also changed in a way that may tempt organisations to relax. The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026. It rewrote Article 4 of the AI Act. Providers and deployers must still take measures to support the development of AI literacy among their staff. However, they no longer have to guarantee any specific level of literacy for each individual. In addition, obligations for stand-alone high-risk systems have been postponed until 2 December 2027.
Reading this as permission to wait would be a mistake. An obligation of effort can only be demonstrated through the measures actually taken, which makes documentation more important, not less. In Finland, the Act on the Supervision of Certain AI Systems (1377/2025) took effect at the start of 2026. It distributes oversight across 15 authorities, with the Finnish Transport and Communications Agency (Traficom) acting as national coordinator (Traficom 2026). In any case, the business case for clear guidance never depended on the regulator.
Making the rules worth following
In my experience, what people want above all is clarity. Organisations should therefore write permissions, not just prohibitions. A simple traffic-light model of green, amber and red works best with concrete, role-specific examples. For instance: ‘summarising public tender documents: green; pasting customer contracts into a personal account: red’. A model like this answers the question employees are actually asking: am I allowed to use AI for this?
It is equally important to appoint an owner and to equip line managers. Someone must be accountable for keeping the guidelines up to date and for asking whether AI is delivering value. A document without an owner goes out of date within months. Solita’s report makes a related point: managers should be trained to explain the rules, not merely pass them on (Solita 2026a).
As with any organisational change, it pays to listen to those already using AI. Employees working through unofficial channels have already discovered where AI helps and where it falls short. They are not a problem to be managed. They are the most direct route to a realistic policy that works (Asikainen 2026c). The approved route must also be the easy one. If the approved tool is slower or clumsier than a personal account, no guideline will compete with it. In a hectic working day, we all take the path of least resistance.
I would put my money on the Nordic tradition. The same culture of workplace negotiation that slows change can also lend AI rules greater legitimacy. Involving shop stewards and staff representatives takes longer on paper. In my experience, though, people are more likely to follow rules they have helped to shape, because they feel a sense of ownership over them.
Finally, document what you do. Record who received what guidance and training, and when. Under the amended Article 4, the effort itself is the evidence.
Found, understood and followed
Finland’s progress shows that this is not a problem that takes years to solve. Solita’s data suggests that the situation can change quickly once it is made a priority (Solita 2026a). Having a guideline, however, is the easy part. What matters is whether an employee under deadline pressure can find it and understand it. It also matters whether they trust the tools it points to more than the AI app waiting in their personal browser.
The argument that AI guidelines slow organisations down misses a more important question: what is the lack of clear guidance already costing them? Organisations unsure where to start can turn to free services such as Finnish AI Region (FAIR), an EU co-funded European Digital Innovation Hub. FAIR can help map current AI use and build guidelines that people will actually follow.
Author
Martti Asikainen
Communications Lead, AI Coach
Finnish AI Region
martti.asikainen@haaga-helia.fi
This article was written as part of the ReiluAI – AI and Equity in Working Life project, funded by Haaga-Helia University of Applied Sciences and the Finnish Work Environment Fund.
References
Asikainen, M. (2026a, February 13). Good Intentions, Bad Consequences: Your Employees Are Probably Using AI in Secret. Finnish AI Region.
Asikainen, M. (2026b, March 25). Nordic workers gain rapid access to AI tools, but fear of mass job losses remains low, survey finds. Finnish AI Region.
Asikainen, M. (2026c, April 15). The Problem Is the AI Strategy — Or Rather, the Lack of One. Finnish AI Region.
Deloitte. (2026). State of AI in the Nordics 2026. Deloitte AI Institute.
European Union. (2024). Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). Official Journal of the European Union.
European Union. (2026). Regulation (EU) 2026/1744 (Digital Omnibus on AI). Official Journal of the European Union, 24 July 2026.
FAIR. (2026). AI Implementation in Finnish Businesses 2026. Finnish AI Region & Haaga-Helia University of Applied Sciences. Survey conducted by Taloustutkimus, 3 December 2025–3 February 2026.
KPMG. (2025). Trust, attitudes and use of artificial intelligence: A global study 2025. KPMG International & The University of Melbourne.
Solita. (2026a). How AI is transforming Nordic work life 2026. Survey conducted by Kantar Media, 30 October–11 November 2025.
Solita. (2026b, June 18). Nordic workplaces struggle with AI guidelines and governance. Solita.
Traficom. (2026). Uudet säännöt vahvistavat luottamusta tekoälyyn Euroopassa. Finnish Transport and Communications Agency.
