Entur AS' innlegg — KI-løypa: Slik vurderer og innfører vi KI-verktøy i Entur
Entur AS · article · 2026-04-16 Reader 🖥️
Agent Governance (Internal)AI Regulation & Governance (External)Enterprise AI Adoption & ReadinessPublic-Sector Digitalization
Entur has developed a structured five-stage governance process ('KI-løypa') for evaluating, piloting, and managing AI tools responsibly, balancing the pursuit of efficiency gains against privacy, security, regulatory compliance, and ethical obligations inherent in their public-sector mandate.
practical · corporate LinkedIn post / process overview — A public-facing organizational communication describing Entur's internal governance process for evaluating and adopting AI tools, structured as a five-stage pipeline.
Structure
| Part | Role |
|---|---|
| Opening framing | Establishes the dual nature of AI: high potential value (decision support, efficiency, productivity) alongside fundamental governance questions (privacy, security, transparency, regulation, ethics). |
| Stage 1: Forslag og innspill (Proposals and input) | Describes the intake mechanism — ideas come from anyone in the organization, bottom-up. |
| Stage 2: Kost/nyttevurdering (Cost/benefit assessment) | Introduces the first gate: a future system owner and AI coordinator filter out low-value initiatives early to avoid wasting resources. |
| Stage 3: Risiko og informasjonsklassifisering (Risk and information classification) | Introduces the compliance gate: a cross-functional group assesses data types, risk class (including EU AI Act classification), and can reject tools deemed too risky. |
| Stage 4: Pilotering og eventuell innføring (Piloting and possible adoption) | Describes practical validation through pilot testing before broader rollout. |
| Stage 5: Forvaltning over tid (Governance over time) | Emphasizes that adoption is not the end — ongoing monitoring ensures continued safe and relevant use. |
| Closing philosophy and call to action | Frames the overall approach as 'ansvarlig digitalisering' (responsible digitalization) rather than technology maximalism, and invites community dialogue. |
Key terms
- KI-løypa Agent Governance (Internal)
Entur's structured five-stage governance pipeline for evaluating, testing, and managing AI tools — from proposal through ongoing stewardship. Literally 'the AI track/trail'. - kost/nyttevurdering Agent Governance (Internal)
A cost/benefit assessment performed by a future system owner and AI coordinator to filter out AI initiatives that lack sufficient potential value. - informasjonsklassifisering Agent Governance (Internal)
Classification of the type of information an AI tool will process, used to determine risk level and regulatory requirements. - EUs KI-forordning AI Regulation & Governance (External)
The EU AI Act — used as one of the frameworks for determining the risk class of AI tools under evaluation. - ansvarlig digitalisering Agent Governance (Internal)
Responsible digitalization — the guiding philosophy that AI should serve as a means to better services for employees, users, and society, not technology adoption for its own sake. - systemeier
The designated future owner of an AI tool within the organization, responsible for its cost/benefit assessment and ongoing governance. - KI-koordinator
An organizational role that works alongside system owners to evaluate AI tool proposals in the cost/benefit stage.
Propositions
- explicitAI can contribute to better decision support, more efficient work processes, and dramatically increased production when used correctly.conf: high
- explicitAI tools raise fundamental questions about value creation, privacy, data security, transparency, regulatory compliance, ethics, and public-sector mission alignment.conf: high
- implicitA structured governance process is necessary to balance AI's potential against its risks.conf: high
- explicitAI initiatives that do not demonstrate real value should be stopped early before consuming unnecessary resources.conf: high
- explicitAI tools whose risk is assessed as too high should be rejected outright.conf: high
- explicitAn AI tool is never 'finished' once adopted — it requires ongoing governance to ensure safe, responsible, and continued relevant use.conf: high
- explicitResponsible AI adoption is not about adopting the most technology as fast as possible, but about using AI as a means to better services.conf: high
- implicitAI governance in a public-sector organization must account for 'samfunnsoppdrag' (societal mission) in addition to standard business considerations.conf: high
Arguments
Organizations (especially public-sector ones) need a structured governance process for AI tool adoption. strength: medium
Explicit premises:
- AI offers significant potential benefits (decision support, efficiency, productivity).
- AI also raises fundamental questions about value, privacy, security, transparency, regulation, ethics, and mission.
- Without a structured process, organizations risk adopting tools that increase complexity without creating value, or that violate privacy/regulatory requirements.
Implicit premises:
- Ad hoc AI adoption is the default mode in many organizations and leads to poor outcomes.
- The risks of AI tools are not always apparent without structured assessment.
- Public-sector organizations face higher accountability standards than private companies.
Inferences:
- The argument moves from 'AI has both potential and risk' to 'therefore we need a structured process' — the link is plausible but the post provides no evidence of what went wrong without such a process.
Entur's five-stage KI-løypa is an adequate governance framework for AI tool adoption. strength: low
Explicit premises:
- Stage 1 captures proposals from across the organization.
- Stage 2 filters for value before investing resources.
- Stage 3 assesses risk and regulatory compliance (including EU AI Act).
- Stage 4 validates through piloting.
- Stage 5 ensures ongoing governance.
Implicit premises:
- These five stages cover all the relevant governance dimensions.
- The assessment criteria at each stage are well-defined and consistently applied.
- The cross-functional vurderingsgruppe (assessment group) has the necessary competence.
Inferences:
- The stages are described at a high level — the adequacy of the framework depends entirely on implementation details not shared in the post.
Narratives
- A developer discovers a code-assistance AI tool and submits it to KI-løypa, where it progresses through cost/benefit evaluation, risk assessment, piloting, and potentially into managed use.
→ Makes the abstract five-stage process concrete and relatable by grounding it in a specific, recognizable scenario (developer finding a coding AI tool). - Entur positions itself as a thoughtful, responsible organization navigating the AI landscape deliberately rather than chasing hype.
→ Serves as employer branding and stakeholder communication — signals maturity and trustworthiness to the public, partners, and potential hires.
Questions addressed
- ✅ How does Entur evaluate whether an AI tool creates real value or just adds complexity?
Through a cost/benefit assessment in Stage 2, conducted by a future system owner and AI coordinator. - ✅ How does Entur ensure AI tool adoption complies with privacy, security, and regulatory requirements?
Through risk and information classification in Stage 3, including EU AI Act classification, with authority to reject tools deemed too risky. - ✅ How does Entur ensure AI tools remain appropriate after initial adoption?
Through ongoing governance in Stage 5, with regular follow-up on safety, responsibility, and continued relevance. - ⭕ What specific criteria are used at each stage to make accept/reject decisions?
- ⭕ How effective has the KI-løypa been in practice — how many tools have passed through it and with what outcomes?
Gaps
- incompleteNo specific evaluation criteria or decision rubrics are shared for any of the five stages. The post describes the process structure but not how decisions are actually made, leaving the most operationally important details absent.
Read next: Internal governance documentation from similar public-sector organizations; AI governance frameworks from NIST, ISO 42001, or Datatilsynet's AI guidelines. - incompleteNo evidence of outcomes: how many AI tools have entered KI-løypa, how many were rejected at each stage, and what value the adopted tools have delivered. Without this, the framework's effectiveness is unsubstantiated.
Read next: Case studies from organizations that have published AI governance outcomes and metrics. - uninformedNo mention of how the process handles the speed-versus-governance tension — whether the pipeline creates bottlenecks that cause the organization to fall behind on beneficial AI adoption, or how quickly tools typically move through the stages.
Read next: Literature on governance agility in fast-moving technology domains; lean governance approaches to AI adoption.closed byPresentation: Platform Engineering in the Age of AI — Cihak's 'autonomous SDLC' argument (p13) directly answers the unaddressed speed-vs-governance tension: embed governance as automated, evidence-producing guardrails within the deployment pipeline itself, rather than enforcing it through periodic manual gates like a weekly Change Advisory Board, so speed and governance stop being traded off against each other. - incompleteThe role of employees and end users in the governance process is limited to submitting proposals in Stage 1. There is no mention of how employee experience, feedback from piloting, or end-user impact assessments factor into decisions at later stages.
Read next: Human-centered AI governance frameworks; participatory technology assessment literature.
Related documents
- Governing AI in the Cloud: A Practical Guide for Architects
- You Outsourced the AI—but You Still Own the Risk
- Responsible AI Is Becoming a Growth Strategy
- The Agentic P&L: Beyond the Empire of Headcount
- Building AI Agents For The Enterprise
- An Evolutionary Architecture Pattern for Managing AI's Pace of Change
- Finding Comfort in the Uncertainty
- AI and IT Teams Often Clash. But They Don't Have To.
- Stop Automating Old Processes. Design New Ones Instead.
- Agentic AI in the Software Development Lifecycle (SDLC)