AI in Norway: when workplace trust leads employees to overshare

In Norway, people trust their colleagues, their employer and, often, the tools they use. This culture of trust is a strength: decisions move fast, hierarchies are flat and everyone is encouraged to take initiative. It also has a downside when generative AI arrives at the office.

An employee who trusts their AI assistant will readily hand it a contract, a patient file or a customer list. Not out of carelessness, but because the tool feels helpful and harmless. The challenge for Norwegian organisations is therefore not to ban AI but to shape behaviour.

The framework: GDPR through the EEA and Datatilsynet

Norway is not an EU member, but it belongs to the European Economic Area (EEA). The GDPR was brought into Norwegian law through the Personal Data Act, personopplysningsloven, which took effect in July 2018. The obligations are the same as in the EU: lawful basis, minimisation, security and impact assessments.

The supervisory authority is Datatilsynet. On AI, Norway is also preparing to bring the EU AI Act into national law, and the Norwegian Communications Authority (Nkom) has been designated to supervise it. The GDPR, however, is what applies as soon as a prompt contains personal data.

Datatilsynet's AI sandbox

In 2020 Datatilsynet launched a regulatory sandbox dedicated to artificial intelligence. Public and private organisations test their projects there with the authority, which then publishes reports that everyone can learn from.

One project drew wide interest from IT leaders: NTNU, the university in Trondheim, tested Microsoft 365 Copilot in spring 2024 with support from the sandbox. The goal was to see whether a large public body could adopt the tool responsibly. NTNU published its findings and draft impact assessments, and the sandbox published its own report in autumn 2024. For us, the lesson is simple: before switching on an AI assistant, you need to know what data it can see and what employees are going to tell it.

Why employees overshare with AI

AI leaks rarely look like malicious acts. They grow out of ordinary habits:

• Trust: the assistant answers politely, like a helpful colleague. People forget it is an external service.

• Time pressure: pasting the whole document is faster than removing the names.

• Autonomy: in a flat organisation, people pick their tools without asking permission.

• Invisible risk: nothing happens at the moment of sending, no alert and no visible consequence.

These mechanisms exist everywhere, but they weigh more where trust is the norm. A medical secretary in Bergen or a bank adviser in Oslo does not think data leak when asking an AI to rephrase a letter.

Why banning does not work

Banning generative AI runs against a work culture built on autonomy and personal responsibility. Above all, it does not stop the usage: employees switch to their phone or personal account, out of sight. That is shadow AI, and we break down its real cost elsewhere.

Training alone is not enough either. An annual session is quickly forgotten, as we explain in why AI security training doesn't work. The right moment to guide someone is the instant they are about to hit send.

Guiding at the right moment

AI DLP such as ZeusLock follows this logic. It runs on the device or in the browser and acts at the moment of sending, with a graduated response:

1. Warn: a short message explains why the detected data is sensitive and lets the employee fix it.

2. Anonymise: format-preserving anonymisation replaces names or numbers with realistic placeholders, and the work carries on.

3. Block: kept for the most serious cases, such as health data or trade secrets.

Every incident is logged. Security teams see where the real risks are and adjust the rules instead of guessing. This approach respects the trust placed in employees: you treat them as adults, you explain, and you only step in firmly when it is needed. To plan a gradual rollout, for example starting in warning mode only, see our 90-day AI DLP rollout playbook.

Where to start

There is no need to launch everything at once. Three steps are enough to get going:

• observe first: turn on detection without blocking for a few weeks, to measure which data actually leaves and to which tools;

• talk about it openly: share the results with teams without looking for culprits, and explain the rules with examples from their own work;

• tighten next: switch on anonymisation for everyday data and blocking for the most sensitive, involving the data protection officer and the employee representatives, the tillitsvalgte.

This sequence fits the Norwegian way of working: measure, discuss, then decide together.

Summary

Norway applies the GDPR through the EEA, supervised by Datatilsynet, and is preparing for the EU AI Act. Its culture of trust encourages AI adoption, but also oversharing. Rather than banning, organisations do better by guiding employees at the exact moment they send data, with clear warnings, anonymisation and targeted blocking.

Rolling out generative AI in Norway? Book a ZeusLock demo and see how to guide your teams without slowing them down.