Skip to main content

    AI by country · Northern Europe

    AI in Sweden: the rules, the readiness and where to start

    Last checked: 29 October 2026

    What should a company in Sweden know before starting with AI?

    In Sweden, AI that uses personal data falls under the GDPR and the Swedish Data Protection Act (2018:218), supervised by IMY. The EU AI Act also applies, with most rules applying from 2 August 2026 and high-risk duties now moved to December 2027 and August 2028. A company should know which of its AI uses could count as high risk, and which Swedish authority will supervise them.

    At a glance

    Sweden at a glance

    Key facts about Sweden
    Data protection lawGDPR plus the Data Protection Act (2018:218), in force since 25 May 2018
    RegulatorIntegritetsskyddsmyndigheten (IMY) for data protection; PTS as lead AI Act authority under an interim government assignment
    AI policyEU AI Act (Regulation (EU) 2024/1689), phased. Sweden's AI Strategy, February 2026. A Swedish law to complement the AI Act was proposed in October 2025 and was not confirmed in force as of 29 October 2026
    Time zoneCET, UTC+1 in winter and CEST, UTC+2 in summer (India is 4.5 or 3.5 hours ahead)
    CurrencySEK (Swedish krona)
    Business languageSwedish, with English widely used in business

    Why now

    Why Sweden is worth watching

    Each point links to the document it comes from.

    • Eurostat reports that 35.04% of Swedish enterprises with 10 or more staff used at least one AI technology in 2025, up from 25.09% in 2024. The EU figure was 19.95%.[9]

    • Sweden's AI Strategy, published by the government on 20 February 2026, sets the aim that Sweden should be among the ten leading nations in AI.[7]

    • On 16 June 2026 PTS said the government had made it a national competent authority, a market surveillance authority and the single point of contact under the AI Act until 31 December 2026, with a task to set up a national AI sandbox.[5]

    • The EU's Digital Omnibus on AI entered into force on 27 July 2026 and moved the high-risk rules for Annex III uses, such as hiring and credit, to 2 December 2027.[4]

    • IMY updated its guidance on GDPR and AI on 26 May 2026. It covers legal basis, accuracy, discriminatory algorithms and automated decisions.[8]

    The rules

    The rules that matter for AI

    What each law or policy means when you build or buy an AI system.

    General Data Protection Regulation (EU) 2016/679

    In force2016People have a right not to be subject to a decision based solely on automated processing that has legal or similarly significant effects, with exceptions for contracts, law and explicit consent (Article 22). High-risk processing needs a data protection impact assessment (Article 35), and a breach must be reported within 72 hours where feasible (Article 33). Fines can reach EUR 20 million or 4% of worldwide turnover (Article 83).[1]

    Data Protection Act (2018:218), Lag med kompletterande bestämmelser till EU:s dataskyddsförordning

    In force2018This is the Swedish law that fills in the GDPR. It sets 13 as the age at which a child can consent to online services, adds rules on sensitive data and personal identity numbers, and caps fines on public authorities at SEK 5 million or SEK 10 million depending on the breach.[2]

    EU Artificial Intelligence Act, Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744

    Phased2024Bans and AI literacy duties apply from 2 February 2025, rules for general-purpose AI models from 2 August 2025, and most other rules, including transparency duties, from 2 August 2026. High-risk duties apply from 2 December 2027 for Annex III uses and 2 August 2028 for AI in regulated products. Fines for banned practices can reach EUR 35 million or 7% of worldwide turnover.[3]

    Proposed Swedish law complementing the AI Act (SOU 2025:101)

    Draft2025A government inquiry proposed in October 2025 that PTS lead market surveillance, that IMY take the main role for banned practices, and that PTS, IMY and Finansinspektionen share supervision of Annex III high-risk systems. It proposed a start date of 2 August 2026. We could not confirm that a law has been passed, so the interim assignment to PTS and other authorities applies as of 29 October 2026.[6]

    Where AI fits first

    Where AI fits first

    Banking and insurance

    Document checks, fraud signals and customer service in Swedish and English, with people reviewing credit decisions.

    Creditworthiness assessment is an Annex III high-risk use under the AI Act, from 2 December 2027. The inquiry proposed that Finansinspektionen share supervision of such systems.[6]

    Recruitment and HR

    Sorting applications and drafting job adverts, with a person making the hiring decision.

    Employment uses are listed in Annex III, so high-risk duties apply from 2 December 2027. Article 22 GDPR already limits fully automated decisions about people.[4]

    Public sector

    Drafting replies, summarising case files and searching internal documents.

    IMY's guidance on GDPR and AI covers the legal basis and the right to information when an authority uses AI. The Data Protection Act caps fines on public authorities.[8]

    Manufacturing

    Visual quality inspection and predictive maintenance on production lines.

    AI used as a safety component in products covered by EU product law (Annex I) has until 2 August 2028 for high-risk duties.[3]

    Your first steps

    Your first steps

    1. List every AI use in your company and mark any that touch hiring, credit, education or biometrics, since these can be high risk under the AI Act.
    2. Train the staff who use AI tools; the AI literacy duty has applied since 2 February 2025.
    3. Run a data protection impact assessment before AI processes personal data at scale, and keep a person in the loop for decisions with legal effects.
    4. Label chatbots and AI-generated content where the AI Act transparency rules require it, as these apply from 2 August 2026.
    5. Check where your AI vendor stores and processes data, and put a GDPR transfer mechanism in place for any country without an adequacy decision.
    6. Read IMY's guidance on GDPR and AI, and watch PTS for news on the national AI sandbox.
    7. Plan your high-risk work for December 2027, rather than waiting for the final Swedish law.

    AI services for Sweden

    AI consulting and development for teams in Sweden

    We work remotely with companies in Sweden, in your time zone, and keep your data under the rules described above.

    AI agents and automation

    Agents that finish multi-step work across your tools, with people approving what matters.
    Learn more

    Document Q&A (RAG)

    Answers from your own documents, with the source shown for every answer.
    Learn more

    AI governance and data protection

    Policies, review steps and audit trails that fit your local data law.
    Learn more

    Software and cloud engineering

    Web apps, integrations and cloud platforms built around your AI use case.
    Learn more

    How we work with you

    How we work with you

    We work remotely with clients worldwide, in the client's time zone. India (UTC+5:30) is 4.5 hours ahead of Sweden in winter (UTC+1) and 3.5 hours ahead in summer (UTC+2). Taking a 9:00 to 17:00 day in Sweden and 9:30 to 18:30 in India, the overlap is about 5 hours in winter (09:00 to 14:00 Swedish time) and 6 hours in summer (09:00 to 15:00). India has no EU adequacy decision, so any personal data we handle needs a GDPR transfer mechanism such as standard contractual clauses.

    Questions

    Common questions about AI in Sweden

    Does the EU AI Act apply to my Swedish company?

    Yes, as an EU regulation it applies directly in Sweden. Most rules apply from 2 August 2026. High-risk duties were moved by the Digital Omnibus on AI to 2 December 2027 and 2 August 2028.

    Who supervises AI in Sweden?

    PTS is the single point of contact and a market surveillance authority under an interim government assignment that runs to 31 December 2026. IMY supervises data protection. A Swedish law setting the final split of roles was proposed in SOU 2025:101, and we could not confirm it was passed as of 29 October 2026.

    Can we use AI to screen job applicants?

    You can, with care. The GDPR limits decisions based solely on automated processing, so a person should make the decision. From 2 December 2027, AI used in hiring is high risk under the AI Act, with duties on documentation, human oversight and data quality.

    What does a GDPR breach cost?

    Fines can reach EUR 20 million or 4% of worldwide annual turnover, whichever is higher. For Swedish public authorities, the Data Protection Act caps fines at SEK 5 million or SEK 10 million depending on the breach.

    Complimentary tools

    Try these first

    Three complimentary tools from our AI Toolkit that suit a team starting out.

    AI readiness score

    Answer a few questions and see where your team stands, in about five minutes.
    Open the tool

    AI use case triage

    Test an idea against data, risk and effort before you spend on it.
    Open the tool

    AI project cost estimator

    Get a rough build and run cost range for a first AI project.
    Open the tool

    Read next

    Sources

    Sources

    Facts checked on 29 October 2026. Numbers in square brackets above match this list.
    1. [1] Publications Office of the European Union, 2016-04-27. Regulation (EU) 2016/679 (General Data Protection Regulation), Official…(publications.europa.eu)
      Full title and what we used it for

      Regulation (EU) 2016/679 (General Data Protection Regulation), Official Journal L 119, 4.5.2016. Primary. Official Journal text. Used for Articles 22, 33, 35 and 83.

    2. [2] Sveriges riksdag, 2018-04-19. Lag (2018:218) med kompletterande bestämmelser till EU:s dataskyddsföro…(riksdagen.se)
      Full title and what we used it for

      Lag (2018:218) med kompletterande bestämmelser till EU:s dataskyddsförordning. Primary. Used for the entry into force on 25 May 2018, the age of 13 for children's consent and the fine caps for public authorities.

    3. [3] European Commission, AI Act Service Desk, 2026-10-29. AI Act, Article 113 (Entry into force and application) and Article 99 (…(ai-act-service-desk.ec.europa.eu)
      Full title and what we used it for

      AI Act, Article 113 (Entry into force and application) and Article 99 (Penalties). Primary text as consolidated after the Digital Omnibus on AI. Used for the application dates. Article 99 at https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-99 was used for the fine levels, and Annex III at https://ai-act-service-desk.ec.europa.eu/en/ai-act/annex-3 for the high-risk areas (hiring, credit, education).

    4. [4] European Commission, 2026-10-19. AI Act: regulatory framework for AI(digital-strategy.ec.europa.eu)
      Full title and what we used it for

      AI Act: regulatory framework for AI. Primary. Used for the timeline and for the Digital Omnibus on AI entering into force on 27 July 2026. The regulation is Regulation (EU) 2026/1744 of 8 July 2026, OJ L of 24 July 2026, checked on the Publications Office copy.

    5. [5] Post- och telestyrelsen (PTS), 2026-06-16. Uppdrag ger PTS centralt ansvar enligt AI-förordningen(pts.se)
      Full title and what we used it for

      Uppdrag ger PTS centralt ansvar enligt AI-förordningen. Primary. Used for PTS's interim roles to 31 December 2026 and the AI sandbox task.

    6. [6] Sveriges riksdag (Statens offentliga utredningar), 2025-10-01. Anpassningar till AI-förordningen, SOU 2025:101(riksdagen.se)
      Full title and what we used it for

      Anpassningar till AI-förordningen, SOU 2025:101. Primary inquiry report, dated October 2025. Used for the proposed split of supervision and the proposed start date. A proposal only; we found no bill or adopted law.

    7. [7] Regeringskansliet (Finansdepartementet), 2026-02-20. Sveriges AI-strategi(regeringen.se)
      Full title and what we used it for

      Sveriges AI-strategi. Primary. Used for the publication date and the aim of being among the ten leading AI nations.

    8. [8] Integritetsskyddsmyndigheten (IMY), 2026-05-26. Vägledning om GDPR och AI(imy.se)
      Full title and what we used it for

      Vägledning om GDPR och AI. Primary. Used for the topics covered and the last update date.

    9. [9] Eurostat, 2026-06-15. Artificial intelligence by size class of enterprise (isoc_eb_ai)(ec.europa.eu)
      Full title and what we used it for

      Artificial intelligence by size class of enterprise (isoc_eb_ai). Primary statistics. Enterprises with 10 or more staff, excluding the financial sector, using at least one AI technology.

    10. [10] European Commission, 2026-10-29. Adequacy decisions(commission.europa.eu)
      Full title and what we used it for

      Adequacy decisions. Primary. Used to confirm that India has no EU adequacy decision.

    This is general information, not legal advice. The AI Act dates were changed in 2026 and the Swedish law that will complete it is still pending, so roles may change. Check with a qualified Swedish lawyer before you act. Facts checked on 29 October 2026.

    Other country guides

    Starting with AI in Sweden?

    Talk to an engineer. The first call is free, and we start with a readiness assessment before any budget is committed.

    Talk to our team Get your AI score