Förvaltningslagen section 28 and automated decisions by Swedish authorities

What it is

The Administrative Procedure Act (förvaltningslagen, 2017:900) sets the rules for how Swedish administrative authorities handle cases. It entered into force on 1 July 2018 and replaced the previous act of 1986.

Section 28 deals with who makes a decision. It says a decision can be made by one official alone, by several jointly, or automatically (“eller automatiserat”). That short phrase is the general legal footing for automated decision-making across Swedish public administration.

Who it applies to

The Act applies to the handling of cases at administrative authorities. That covers government agencies and, under section 2, authorities in municipalities and regions, though some sections do not apply to municipal decisions that are reviewed for legality under the Local Government Act. Under section 4, a provision in another act or ordinance that deviates from the Administrative Procedure Act takes precedence, so sector legislation can set its own rules.

The Act does not apply to private companies. A supplier that builds or runs an automated decision system for an authority sits inside that authority’s obligations, and should expect them in its contract.

What it requires

Section 28 is a permission, not an exemption. An automated decision is a decision like any other, and every duty that attaches to a decision still applies.

• Legality, objectivity and proportionality (section 5). An authority may only take measures that have support in the legal order. It must be objective and impartial, and a measure must never go further than needed. An automated rule set has to reflect the law it applies, and an AI model whose output cannot be traced to that law is hard to square with this.
• Communication before a decision (section 25). Before deciding a case, the authority must generally tell the party about all material of significance to the decision and give them a chance to respond. Where a model’s output is part of that material, it has to be something the person can see and answer.
• Reasons (section 32). A decision that can be assumed to affect someone’s situation in a not insignificant way must contain a clear statement of reasons, naming the rules applied and the circumstances that decided the outcome.
• Notification and appeal (sections 33, 40 and 41). The party must be told the full content of the decision as soon as possible, and how to appeal. A decision that can affect someone’s situation in a not insignificant way can be appealed to the general administrative courts.
• Correction (sections 37 and 38). An authority may change a first-instance decision it finds incorrect, and must do so where it is obviously wrong in a material respect and can be fixed quickly and easily without harming a private party.

The GDPR applies on top. Article 22 restricts decisions based solely on automated processing that produce legal or similarly significant effects, but allows them where Union or member state law authorises them and lays down suitable safeguards. IMY’s guidance on GDPR and AI says the person must be given meaningful information about the logic involved, including an explanation of how an AI model reached a given result, which it says does not require opening the black box. See GDPR automated decisions.

For an AI system in a Swedish authority, this becomes four practical questions. Which systems decide on their own and which only support an official? Is there legal support for the decision being made that way? Can the authority give reasons and explain the result to the person affected? And is there a route to have the decision reviewed and corrected?

Generative AI and section 28

The national guidelines on generative AI from Digg and IMY, published on 21 January 2025, take a cautious line. They say automated decisions are permitted under the Act, but that this rests on program code people have created and fully checked, which makes the outcome predictable. That reasoning cannot simply be applied where generative AI supports a decision. The guidelines advise public bodies to avoid using generative AI to make decisions that directly affect people on their own, to document the tool’s role in the decision process, and to keep human control. See the guidelines page.

Key dates

• 1 July 2018. The Administrative Procedure Act (2017:900) enters into force, with section 28.
• 21 January 2025. Digg and IMY publish national guidelines on generative AI in the public sector.
• 2 December 2027. EU AI Act high-risk duties apply to Annex III systems, including AI used by public authorities to assess eligibility for public assistance benefits and services.

How it relates to other frameworks

Section 28 sits beneath the EU rules. Where an authority’s automated system is an AI system in one of the AI Act’s high-risk areas, such as public assistance benefits, the EU AI Act adds deployer duties, including a fundamental rights impact assessment for public bodies. Sweden’s AI Act authorities page shows which regulator supervises which area. Organisations that structure their AI governance on ISO/IEC 42001 will find the same themes of accountability, transparency and human review.

A note on this page

This is Aicura’s reading of the Administrative Procedure Act. It is not legal advice and it is not the Act itself. Read the primary source published by the Riksdag, and take advice on how the Act applies to your organisation.