Only one in three companies has an AI policy

Introducing AI at a company is a balancing act between encouraging employees to experiment without leaving them alone to make decisions. Deciding which applications can be used and what data can be entered into them will protect both employees and the company. It will also create a much lower threshold for experimenting with AI.

“Some companies have already gone a long way with AI, but in the bigger picture, we’re only just starting out with it. When a company decides to introduce AI, the first step is to determine which applications can be used safely in a work context. The second step is to establish rules for information security. After that, it will be safe to experiment with AI on a needs basis to see how it can make everyday life easier for the company,” says Mari Eklund, Vice President, Communication Solutions at DNA Corporate Business.

In a survey of ICT decision-makers that was commissioned by DNA last year, the majority of respondents felt that guidance on the use of AI tools is lacking at most companies operating in Finland. Only one in three companies have rules and policies for using AI. There is a threat of trade secrets falling into the wrong hands.

“One challenge is that there are so many different types of AI. There are end-user applications such as ChatGPT, and commercial enterprise solutions that utilise AI. There’s also an infrastructure layer in which, for example, we at DNA optimise the energy consumption of masts,” says Eklund.

Good and bad AI are evolving at the same pace

Criminals are increasingly exploiting advanced AI features to develop more convincing frauds, such as financial scams. Just like other scams, these can be difficult to identify. One scam is to pretend that something is an AI application – you can only spot the difference from very minor details. For example, a scam like this may change one letter of the application's address to a number that resembles it.

“An AI-generated scam can be better than one created by humans. It is capable of personification, it sounds genuine, and uses the right tone of voice. Deep-fake scams, which impersonate a company employee and accept purchases, are very commonplace internationally. A small business owner can accidentally handover their bank account and credit card details when buying goods from an AI-generated scam webstore,” says Eklund.

Critical thinking is vital when using AI, not only in identifying scams, but also with regard to what information you provide about yourself or your company. And what pathways to data will each AI open up? Before incorporating an AI application into your company's toolbox, it makes sense to explore and compare the various options. It’s worth paying attention to the proposed application’s ownership base and what material has been used to train its language model.

“Identifying a reliable artificial intelligence is difficult, because good and bad AI are evolving at the same pace. Companies should carefully assess which applications are safe to use. It’s a good idea to have an in-house AI expert to consult. If a company is going to make extensive use of AI to process critical data, it’s worth considering whether to create a dedicated internal AI application for this purpose,” says Eklund.

What does legislation say about the use of AI?

When a company introduces AI, it’s also a good idea to familiarise yourself with relevant legislation. The use and development of AI cannot ignore existing legislation – its use must consider a broad range of regulations. For example, the General Data Protection Regulation, data security regulations and fundamental rights also apply to the use of AI.

“The AI Act is an EU Regulation that directly targets artificial intelligence. It’s the most important piece of legislation in this area, and will be applied in stages. The regulation will be fully in force in August 2027. It's a good idea to familiarise yourself with it, so you know how it will affect your own activities,” says Eklund.

Keeping pace with the rapid development of AI is a challenge. Which is why regulation must stand the test of time and be focused on the essentials. This is also a good starting point for corporate AI guidelines and policies. The key thing to remember is that, ultimately, people and companies are always responsible for everything they do.

“Artificial intelligence is evolving at a dizzying pace. If you're not already using AI, you're already behind the times. However, its use must be controlled. One starting point is to find out what others have done with AI and what kind of guidelines they have established. If you’ve missed the boat, you should try to catch up before it’s too late,” says Eklund.

 

Media enquiries:

Mari Eklund, Vice President, Communication Solutions, DNA Plc, tel. +358 44 044 7779, mari.eklund@dna.fi

DNA Corporate Communications, tel. +358 44 044 8000, communications@dna.fi

DNA’s information security survey investigated how companies and public administration in Finland treat information security and cybersecurity. It was carried out as a quantitative survey in September 2024, and was commissioned by DNA and conducted by Dagmar Oy. There were nearly 160 respondents, representing a broad range of company sizes.The survey can be downloaded here (in Finnish).