Two thirds of AI users on corporate devices were on personal accounts outside the company’s control. Most Finnish companies have no written rules, and the few good ones we found came from municipalities you’ve probably never heard of.
On Friday 23 October, Swedish Radio’s Ekot programme reported that the Government Offices in Stockholm would block ChatGPT and Claude on staff work computers, effective the following Monday.1 The digitalisation director had written on the staff intranet that using AI services without an agreement with the Government Offices “can have consequences for our information security.”2 He declined an interview.
By Monday the browser versions of both tools no longer loaded on work computers. In their place was Copilot, the Microsoft tool the government had approved after an internal security review. Some staff kept access to the blocked models through an in-house platform called Intric.1 The Swedish tax authority and Statens institutionsstyrelse, the agency that runs Sweden’s secure youth and addiction-care homes, had already done the same. Kronofogden, the enforcement authority, was preparing its own decision.1
The story came out on Friday. By Monday the tools were blocked. Nobody mentioned phones, personal laptops or the free accounts staff may have signed up for months earlier.
We think most companies are better served by a short written rule and a working conversation than by a block or a silence.
Finland uses AI at work more than nearly any country in Europe. Eurostat, the EU’s statistics office, put the figure at 38% of firms with 10 or more staff in spring 2025, second in the EU.3 Fewer firms have written down what their staff should and should not put into them.
Figure 1
How many Finnish firms had written rules for AI use
Horizontal bars, one pair for each of four firm sizes, on a scale from 0 to 100 percent. Share of firms with written rules for AI use, 2024 then 2025: 10 to 19 staff, 6 then 8 percent; 20 to 49 staff, 10 then 15; 50 to 99 staff, 17 then 25; 100 staff or more, 38 then 51. Every size grew, and in every size except the largest most firms still had nothing written down.
The share of firms in each size band, including those that do not use AI, that had documented instructions, practices or ways of working for AI use. The hollow bar is the same share a year earlier.
Statistics Finland, surveys of firms with 10 or more staff, spring 2024 and spring 2025. Finance and insurance are outside scope. The top band has no upper limit and includes the largest firms. Statistics Finland does not publish margins of error for these figures, so the chart shows none.
| Firm size | 2024 survey | 2025 survey | No written rules, 2025 | Change, percentage points |
|---|---|---|---|---|
| 10–19 staff | 6% | 8% | 92% | +2 |
| 20–49 staff | 10% | 15% | 85% | +5 |
| 50–99 staff | 17% | 25% | 75% | +8 |
| 100 staff or more | 38% | 51% | 49% | +13 |
Statistics Finland’s 2025 survey splits the answer by company size (Figure 1). Among firms with 50 to 99 staff, a quarter had documented rules; three in four had nothing written down.4 A separate survey by CGI, an IT services and consulting company, and the research firm Norstat asked a thousand workers directly.5 63% said they had used or tried AI at work, but only a third had received guidance, and 17% training. Among leaders at large companies, interviewed separately, 64% said their organisation had defined guidelines.5
Finance was the exception. The Finnish Financial Supervisory Authority surveyed 83 firms in early 2025 and found that 82% had usage rules and 60% had trained all staff.6
We found no Finnish company that publishes its staff AI rules. The detailed, practical policies we found came from small municipalities whose council papers happen to be open. Large cities publish short principle pages or keep the detail on the intranet. Tampere’s page names the approved tools and requires human review. Helsinki published rules for its communications staff. Turku’s education division requires AI literacy training before use, though the full staff rulebook is internal.7,8
Tromsø, in northern Norway, is a university city of about 80,000 people.9 In March 2025, Norway’s public broadcaster NRK reported that the municipality’s 120-page school-structure document, which proposed closing eight schools, cited sources that did not exist. Most of the 18 listed sources could not be traced. One was a book credited to a professor of education, who said he had never written it.9
Chat logs released that September, 673 pages of them, showed what had happened.10 An employee had used ChatGPT to research and draft sections of the report, including asking the tool for evidence, with citations, that fewer and larger schools cope better with changes in pupil numbers. The chatbot had supplied it.
The municipality hired PwC, the accounting and consulting firm, to review the case.11 Its AI guidelines did not say which tools staff could use. Staff had not received AI training. The AI-generated text was neither quality-assured nor labelled as AI-produced, and acquiring AI knowledge had been left to individuals. On the central question, whether the fabricated sources had affected the school proposal, PwC concluded they had not. The direction had been set by a 2021 council decision, before the chatbot was involved. But the errors, PwC noted, could affect trust in the municipality.11
A year later, the local paper Avisa Nordhordland checked about 30 sources in a document prepared by Alver, another Norwegian municipality, and found three invented research articles.12 Alver confirmed that Copilot had been used and acknowledged the output had not been checked thoroughly enough.12 In both cases, nobody had checked the citations before the documents went out.
The best staff-facing AI rules we found in Finland came from the council papers of three municipalities small enough that every committee agenda is a public PDF.
Raahe, a city of about 23,000 in North Ostrobothnia, wrote a 12-page AI policy in October 2024, with a one-page staff-room notice attached.13 The notice lists ten rules, covering approved tools, output checking and training. Among them is a test for what may go into a public AI tool. If you would not print it and leave it for everyone to see, do not enter it.
That is Raahe’s rule for free and consumer AI accounts. Figure 2, below, sorts six kinds of information across three kinds of tool, from free accounts to the company’s own systems. Material that fails the test may belong on a vetted business account, on the company’s own system, or nowhere near an AI tool, depending on what it is. Customer names and order details would fail, and so would your company’s own code, a contract in negotiation, or a draft press release with unpublished numbers. A question about how to write a better introduction to a report would pass.
The test catches a second problem. On many free or consumer AI accounts, what you type can end up in the model’s training data.14,15,16,17 Business accounts do not use it for training by default.18
Pyhäjoki, one of Raahe’s neighbours, adopted the text almost word for word in June 2026.19 Kuortane, in South Ostrobothnia, went further with a nine-page guide covering approved tools, a do-not-enter list, meeting rules and an incident-reporting route.20 The Ministry of Finance published guidance for the whole public sector in March 2025,21 and the Finnish Bar Association’s guide, updated in November 2025, adds what lawyers in particular need.22 Figure 3 picks out the best ideas from these, from Samsung’s rollout, and from published policies and guides elsewhere.
Figure 3
Thirteen rules and ideas we found
No. 01 · FinlandThe anchor
huoneentaulu, a notice for the staff-room wall
If you would not print it and leave it for everyone to see, do not type it into an AI tool.
City of RaaheAI policy v1.0, staff-room notice (appendix 1) · 14 Oct 2024
No. 02Finland
Lists what to report at once, from personal data pasted into an open tool to an AI assistant nobody invited to the meeting.
Kuortane municipalityStaff guide to AI use · undated
No. 03Finland
Keeps a table of approved tools, each with what it is for, what data it may see and the date it was last assessed.
Pyhäjoki municipalityAI policy, appendix 1 (approved systems) · 22 Jun 2026
No. 04Finland
If an outside participant brings an AI note-taker you don’t recognise into a video meeting, block it.
Ministry of FinanceGuidance on generative AI in public administration (VM 2025:9) · 20 Mar 2025
No. 05Finland
Buy the business licence. The free Copilot in Windows is not the same product as the business one.
Finnish Bar AssociationAI guide for lawyers (annex 5 to B 05.2) · updated 13 Nov 2025
No. 06Finland
tekoälylukutaito, AI literacy
Learn the basics before you use AI at work. The training is logged in the HR system, or done as a short online course with a test.
City of Turku, education divisionGuidance on AI in teaching · renewed Oct 2025
No. 07Finland
Written in the first person, as commitments staff make themselves, including one to share what they learn with colleagues.
Finnish Academy of Science and LettersGuidelines for the use of AI (seven staff commitments) · 22 May 2024
No. 08United Kingdom
advice, not a rule
A question can give something away by who asks it. A chief executive asking a public chatbot how to lay someone off has already said too much.
National Cyber Security CentreChatGPT and large language models: what’s the risk? (blog post) · 14 Mar 2023
No. 09United Kingdom
If you have substantially edited or thoroughly reviewed the result, you need not say AI helped. If the content is mostly AI-generated, or a chatbot answer nobody can check, label it.
Information Commissioner’s OfficeInternal AI use policy v1.3, section 4.1.3 · Aug 2025
No. 10Canada
Tell your manager about any substantive use of AI, and do not use it as a search engine unless it gives sources you can check.
Government of CanadaGuide on the use of generative artificial intelligence · page dated 24 Sep 2026
No. 11United States
Treat anything an AI tool produces as unvetted source material, checked with the same judgment as any other tip.
The Associated PressStandards around generative AI · 15 Aug 2023
No. 12United Kingdom
A significant AI element in a piece of work needs a stated benefit, human oversight and a senior editor’s permission. Readers are told.
The GuardianThe Guardian’s approach to generative AI · updated 4 Mar 2026
No. 13South Korea
When it opened the tools to staff in 2026, it trained its leaders first, and gave everyone else access only after security training.
SamsungGroup-wide AI rollout, as reported by CIO · reported 12 Jun 2026
From published AI policies and guides we read while researching this note, in our own words and, where Finnish, our translation.
Seven come from Finland, where councils publish their policies as meeting papers, and six from elsewhere. We found no Finnish company that publishes its staff rules. Each card names its source; the full list is below.
| Organisation | Card | Document | Date |
|---|---|---|---|
| City of Raahe (city, Finland) | No. 01 | AI policy v1.0, staff-room notice (appendix 1) | 14 Oct 2024 |
| Kuortane municipality (municipality, Finland) | No. 02 | Staff guide to AI use | undated |
| Pyhäjoki municipality (municipality, Finland) | No. 03 | AI policy, appendix 1 (approved systems) | 22 Jun 2026 |
| Ministry of Finance (ministry, Finland) | No. 04 | Guidance on generative AI in public administration (VM 2025:9) | 20 Mar 2025 |
| Finnish Bar Association (professional body, Finland) | No. 05 | AI guide for lawyers (annex 5 to B 05.2) | updated 13 Nov 2025 |
| City of Turku, education division (education division, Finland) | No. 06 | Guidance on AI in teaching | renewed Oct 2025 |
| Finnish Academy of Science and Letters (learned society, Finland) | No. 07 | Guidelines for the use of AI (seven staff commitments) | 22 May 2024 |
| National Cyber Security Centre (security agency, advice, United Kingdom) | No. 08 | ChatGPT and large language models: what’s the risk? (blog post) | 14 Mar 2023 |
| Information Commissioner’s Office (data-protection regulator, United Kingdom) | No. 09 | Internal AI use policy v1.3, section 4.1.3 | Aug 2025 |
| Government of Canada (central government, Canada) | No. 10 | Guide on the use of generative artificial intelligence | page dated 24 Sep 2026 |
| The Associated Press (news agency, United States) | No. 11 | Standards around generative AI | 15 Aug 2023 |
| The Guardian (newsroom, United Kingdom) | No. 12 | The Guardian’s approach to generative AI | updated 4 Mar 2026 |
| Samsung (company, South Korea) | No. 13 | Group-wide AI rollout, as reported by CIO | reported 12 Jun 2026 |
They name the approved tools, say what stays out, assign someone to check output, and tell staff who to call when something goes wrong.
A ban is a different response from a policy, and bans tend not to last.
In the weeks after Samsung allowed its semiconductor engineers to use ChatGPT in March 2023, employees reportedly put internal source code and a meeting transcript into the tool.23 Samsung confirmed a memo to its phones and appliances division banning generative AI on company devices, with a termination warning; the semiconductor division curtailed access.24 The ban was described as temporary. A partial relaxation with security guidelines followed in spring 2025, and in June 2026, three years after the ban, Samsung announced enterprise access to ChatGPT, Gemini and Claude group-wide, with mandatory security training.25
Five weeks after ChatGPT launched, New York City’s public schools restricted it on department devices and networks; schools could request an exemption.26 Four months later the schools chancellor lifted the restriction. In an op-ed headlined “ChatGPT caught NYC schools off guard,” he wrote that “the knee-jerk fear and risk overlooked the potential of generative AI to support students and teachers.”27
Meanwhile, Verizon’s 2026 Data Breach Investigations Report measured AI traffic on corporate devices and found that 67% of users were accessing AI services through personal, non-corporate accounts, down slightly from 72% a year earlier.28 Regular AI use on those devices had tripled, from 15% to 45%.28
What belongs in a company’s AI rules depends on its size, its sector and the kind of data it handles. But the questions every company needs to answer are the same.
Figure 2
What can go into which AI tool
A grid of six kinds of information against three kinds of AI tool. Each cell is yes, with care, or never. Public information can go into all three. Internal information can go into a business account or your own system, not a free one. Customer, confidential and trade-secret material, and personal data, never go into a free account; elsewhere they go in only with care, except customer or confidential material in your own system, which is yes. Health and other special-category data go into none of them.
What to add as the company grows
About 50 staff
200 to 500
1,000 and above
Our reading of the Finnish public-sector guidance, the Finnish Bar’s AI guide and data-protection law. A business account here means one with no-training terms and a data processing agreement. A free account has neither.
Built from the Raahe (2024) and Pyhäjoki (2026) AI policies, Kuortane’s staff guide, the Ministry of Finance guidance (March 2025) and the Finnish Bar’s guide (November 2025). The steps by size draw on the same documents and on larger organisations’ templates. A general picture, not legal advice.
| Information | Free or personal AI account | Paid business account | Your own system |
|---|---|---|---|
| Public (Website text, price lists, press releases) | Yes. Not with your work email. | Yes. | Yes. |
| Internal (Your own notes, a draft agenda) | Never. The provider may use it for training. | Yes. On a company account. | Yes. |
| Customer or confidential (Contracts, quotes, customer emails, your own code) | Never. | With care. Only if approved for this material. | Yes. Only for people who may see it. |
| Trade secrets (Formulas, process data, designs) | Never. | With care. Case by case; the owner decides. | With care. Behind the same access controls. |
| Personal data (Names with contact details, CVs, staff records) | Never. No data processing agreement. | With care. If approved, with a lawful basis. | With care. A lawful basis is still needed. |
| Health and other special-category data (Health, union membership, beliefs, ethnic origin) | Never. | Never. The strictest class in data law. | Never. Ask your data protection contact. |
Figure 2 shows which kind of information can go into which kind of tool. The strip underneath adds what a policy needs at three sizes, from about 50 staff to 1,000 and above.
Before you adopt it, discuss it with your staff representatives. The law section below covers the requirement.
For larger companies, the strip under Figure 2 shows what to add at each step. ISO/IEC 42001 is a certifiable standard for AI management systems. NIST, the US National Institute of Standards and Technology, publishes an AI Risk Management Framework, which is voluntary, not a certificate. Both are overkill unless a customer or a public tender requires one.
The AI Act’s literacy duty, Article 4, has been law since February 2025.29 If your company’s staff use AI tools, you are required to “take measures to support the development of AI literacy” among them. You do not have to guarantee any particular level of literacy, but you do need to show you did something.29 A documented policy and a training session is a clean way to demonstrate that.
Article 50(4), in force since August 2026, has two limbs.30 AI-generated or manipulated content that would falsely appear authentic (deepfakes) must be disclosed; the only exceptions are law-authorised crime detection and a lighter disclosure for evidently artistic or satirical work. AI-generated text published to inform the public on matters of public interest must also be disclosed, unless a person has exercised genuine editorial review and holds responsibility for the publication. “Genuine” means a reviewer with relevant expertise who actually reviews the content and is empowered to approve, change or reject it; spell-checking and grammar correction do not qualify.30 Standard marketing copy, product descriptions and internal reports are almost certainly outside “matters of public interest.” A disclosure rule like the one above goes further than what Article 50(4) requires for most companies. For ordinary business content it is good practice, not a strict legal obligation.
The Co-operation Act (yhteistoimintalaki, 1333/2021, as amended from 1 July 2025) requires employers with 50 or more staff to discuss workplace rules and practices with staff representatives in ongoing dialogue; a lighter dialogue duty applies at 20 to 49 staff.31 In our reading, an AI-use policy falls within the workplace rules the Act lists for that dialogue. Discuss it with your staff representatives before you adopt it. If new AI tools substantially change how people do their work, change negotiations may also apply.31
If you plan to monitor compliance with the policy, by logging AI tool use, reviewing access records, or checking which services staff access, this is likely to count as technical monitoring under the Act on the Protection of Privacy in Working Life (759/2004), which requires that the purpose and methods of such monitoring go through the co-operation procedure first.32
If personal data enters an AI tool, you need a lawful basis and a data processing agreement with the provider, which is one reason a business account matters more than a free one.33 Where AI use involves systematic monitoring of individuals or large-scale processing of personal data, a data protection impact assessment may also be required.
AI systems used in employment, including hiring, promotion, task allocation and performance monitoring, are already listed as high-risk under the AI Act’s Annex III. The obligations that follow from that classification apply from December 2027.34 The rule that AI does not decide about people is a holding position. Companies that want to use AI in those areas will need legal advice on the requirements.
A company’s AI rules can be short. Start with the notice-board test and an approved-tools list, work through Figure 2, and discuss it with your staff representatives before it goes out. Review it every six months.
Hapax builds training sessions around the tools staff already use, in their own workflows. The details are on our training page.
Sources