Leaders should ask six questions about AI

Sebastian Reichmann, head of Data and AI Public360° at Tieto, argues in an opinion piece that Norwegian organisations treat "AI adoption" as one decision about one technology, and that this is a dangerous oversimplification. He says leaders need to know whether they control how different types of AI are used in their own organisations.

He cites a 2026 Twoday analysis showing the gap between use and governance: 75 percent of Nordic top executives integrate AI into most initiatives, but only 26 percent of CEOs are directly involved in AI strategy, and 53 percent of organisations cannot assign clear responsibility.

Reichmann describes two categories of AI at work. Personal productivity tools handle writing, search, analysis, code and planning, and the user chooses the task and is the main quality control. The risk arises when a personal habit becomes an unofficial business process that affects customers, citizens and decisions without quality requirements, a possible new "Excel hell" at greater speed and scale. He notes that Microsoft and LinkedIn's Work Trend Index found 78 percent of AI users brought their own tools to work. The second category is AI embedded in defined work processes with fixed data, purposes, roles and control points. It is less flexible but gives measurable gains, such as shorter handling time and fewer cases redone. It is not automatically safe, since poor process choices can be built in and scaled, but the risk can be tied to a named product, a concrete process and repeatable tests.

The two need different governance. Personal tools need approved solutions, clear data limits, AI skills and user responsibility. Process AI needs named ownership, testing, access control, monitoring, control points and documentation across its lifecycle. Reichmann points to the EU AI Act, Norwegian implementation work, the Archives Act, ISO/IEC 42001 and NIST, but says a general AI policy is not enough.

He proposes six questions: What is the consequence of error? How dependent is the task on fixed data, roles and rules? How much variation can we tolerate? Must the result be explainable? How often and at what scale is the task performed? Who owns quality, updates and deviations? Low-consequence work can allow exploration, shared team practices need guidance and a named owner, and regulated or high-consequence processes need controlled, embedded solutions. Organisations should map use cases rather than licences, measure results rather than activity, and assign both process and technical lifecycle responsibility for significant AI solutions.