Sweden's AI Act authorities and national implementation

What it is

The EU AI Act, Regulation (EU) 2024/1689, applies directly in Sweden as it does in every member state. Each member state must still name the authorities that enforce it, set penalties and run at least one regulatory sandbox. This page covers how Sweden is doing that.

On 19 September 2024 the Government appointed an inquiry into the national adaptations the AI Act needs (dir. 2024:83). Its report, Anpassningar till AI-förordningen – Säker användning, effektiv kontroll och stöd för innovation (SOU 2025:101), was handed over on 6 October 2025. It proposed a Swedish act and ordinance with supplementary provisions to the AI Act, which would set out the authorities, their powers and the sanctions regime, including administrative fines that can be imposed on public authorities.

That legislation has not yet been adopted. To fill the space, the Government decided on 4 June 2026 (Fi2026/01365) to task five authorities with acting as national competent authorities under Article 70(1) of the AI Act. The assignment runs to 31 December 2026, and PTS describes it as pending supplementary Swedish legislation.

Who it applies to

The authorities supervise everyone the AI Act reaches in Sweden. That means providers placing AI systems on the market, deployers using them, and importers and distributors. Deployers include public authorities, municipalities and regions as well as companies. Which authority you deal with depends on what the system does.

Post- och telestyrelsen (PTS). The single point of contact for the AI Act under Article 70(2), and the authority tasked with setting up Sweden’s AI regulatory sandbox under Article 57. PTS is the market surveillance authority for

• prohibited practices under Article 5 where the system is used in the Annex III areas of critical infrastructure, education, employment, public assistance benefits and emergency calls (points 2 to 4, 5(a) and 5(d)),
• high-risk systems in those same Annex III areas,
• high-risk systems in products covered by the Radio Equipment Directive, and
• the transparency duties in Article 50(1), (2) and (4), which cover systems that interact with people, synthetic content marking and deepfakes.

Integritetsskyddsmyndigheten (IMY). The Swedish data protection authority is market surveillance authority for

• prohibited practices under Article 5, except the areas assigned to PTS and Finansinspektionen,
• high-risk systems in biometrics (Annex III point 1), creditworthiness and credit scoring outside Finansinspektionen’s area (point 5(b)), law enforcement, migration and border control, and the administration of justice and democratic processes (points 6 to 8), and
• the Article 50(3) duty to inform people exposed to emotion recognition or biometric categorisation.

Finansinspektionen (FI). The financial supervisor covers prohibited practices and high-risk systems in creditworthiness and credit scoring within its own supervisory remit (point 5(b)), and in risk assessment and pricing for life and health insurance (point 5(c)).

Läkemedelsverket. The Medical Products Agency is market surveillance authority for high-risk AI in products covered by the EU Medical Devices and In Vitro Diagnostic Medical Devices Regulations, and the notifying authority for conformity assessment bodies in that area.

Swedac. The accreditation body is the notifying authority for conformity assessment bodies under the AI Act in all other areas.

What it requires

The national decision creates no new obligations. The duties are the AI Act’s own, as described on the EU AI Act page. What the decision settles is who will ask you about them.

For an organisation in Sweden, that turns into three practical tasks. First, know which of your systems fall into which Annex III area, because that decides whether PTS, IMY or Finansinspektionen is your authority. Second, check the duties already in force. The prohibitions and AI literacy have applied since 2 February 2025, and the Article 50 transparency duties since 2 August 2026. Third, prepare for the high-risk duties, which apply to Annex III systems from 2 December 2027 after the 2026 Digital Omnibus.

IMY’s role is worth noting. Because the same authority supervises the GDPR, an organisation using AI in biometrics, law enforcement or credit scoring outside the financial sector may face questions under both regimes from one regulator. The GDPR rules on automated decisions and the AI Act’s deployer duties should be worked through together.

Key dates

• 19 September 2024. Government appoints the inquiry on the AI Act (dir. 2024:83).
• 6 October 2025. Inquiry report SOU 2025:101 handed to the Government.
• 4 June 2026. Government decision Fi2026/01365 names PTS, IMY, Finansinspektionen, Läkemedelsverket and Swedac as national competent authorities.
• 2 August 2026. General application of the AI Act, including the Article 50 transparency duties.
• 31 December 2026. The interim assignment ends, unless national legislation takes over.
• 2 August 2027. Deadline for the national AI regulatory sandbox, as amended at EU level.
• 2 December 2027. Annex III high-risk obligations apply.

How it relates to other frameworks

The national authorities enforce the EU AI Act, so the Act and its guidance remain the place to start. In the public sector, the AI Act sits alongside Sweden’s own rule that lets authorities take decisions automatically, set out in the Administrative Procedure Act, and the Digg and IMY guidelines for generative AI, which include a guideline on preparing for the AI Act.

The Government’s AI strategy of February 2026, which aims to put Sweden among the world’s ten leading AI nations, tasks Digg and PTS with supporting its implementation. It sets ambitions rather than obligations.

A note on this page

This is Aicura’s reading of the Swedish Government’s decision and the inquiry behind it. It is not legal advice and it is not the decision itself. Read the primary sources published by the Government Offices and PTS, and take advice on how the AI Act applies to your organisation.