Digg and IMY guidelines for generative AI in public administration (Sweden)

What it is

The guidelines for generative AI in public administration (riktlinjer för generativ AI inom offentlig förvaltning) are Sweden’s national guidance for public bodies using generative AI. The Government assigned the work to the Agency for Digital Government (Digg) and the Swedish Authority for Privacy Protection (IMY) in July 2024, and the two agencies published the guidelines on 21 January 2025. They were developed with input from public administration, academia, suppliers, employee and employer organisations and other AI actors.

IMY published its data protection part as a separate report, GDPR vid användning av generativ AI (IMY-2024-9162), on 5 February 2025. Digg and IMY say they will update the guidelines as technology, law and experience develop, and named sustainability, transparency and human control in decision-making as areas to develop further.

The guidelines do not cover developing new foundation models or fine-tuning existing ones. They are about using generative AI.

Who it applies to

The guidelines are written for regions, government agencies and municipalities, and for the staff and managers in them. They are guidance rather than law, so they carry no penalties.

They matter beyond the public sector. Suppliers of AI to Swedish public bodies will meet them in procurement and due diligence. IMY says its GDPR part is largely applicable to private organisations too, which makes it a practical reference for any Swedish organisation adopting generative AI.

What it requires

There are 18 guidelines in seven areas.

Leadership and accountability. Introduce an AI policy, prepare the organisation for the EU AI Act, and make sure decisions supported by generative AI have human control. The AI policy guideline says management should decide in advance how generative AI may and should be used. It lists what a policy covers, from purpose and scope, ethical principles, data protection and security, permitted and prohibited tools and data, to who checks output quality, who owns the policy and what training users need.

Data protection (GDPR). Start from the data protection rules, apply the GDPR principles, clarify the roles of controller and processor, make sure there is a legal basis and other legal support, consider whether automated decision-making or transfers to third countries occur, safeguard individuals’ rights, assess the risks and ensure appropriate security, and take particular care with publicly available and integrated generative AI.

Employment law. Analyse how the workplace is affected by introducing generative AI and prepare for the change.

Procurement. Make deliberate decisions about acquiring generative AI, and buy it under the Public Procurement Act (lagen om offentlig upphandling).

Information security. Ensure confidentiality when using generative AI and identify information security risks.

Copyright. Assess copyright when using generative AI.

Ethics. Use generative AI ethically.

The decision guideline is the one with most legal weight. It says automated decisions are permitted under the Administrative Procedure Act, but that this rests on program code people have written and fully checked. Generative AI output is usually not reliable enough to use directly as fact. Public bodies should avoid letting generative AI make decisions that directly affect people on their own, document the tool’s role in the decision process, be open about when and how it is used, and keep enough internal competence to carry out meaningful human review.

Key dates

• July 2024. Government assigns Digg and IMY to produce the guidelines.
• 21 January 2025. Guidelines published.
• 5 February 2025. IMY publishes its GDPR report, IMY-2024-9162.
• 20 February 2026. The Government publishes Sweden’s AI strategy, which aims for Sweden to be among the ten leading AI nations and tasks Digg and PTS with supporting its implementation.

How it relates to other frameworks

The guidelines sit beneath binding law. The EU AI Act sets duties for deployers, which Swedish public bodies are, and Sweden’s AI Act authorities page shows who supervises them. The GDPR rules on automated decisions apply to any decision about a person made without meaningful human involvement.

The ethical themes follow the same lines as the EU’s Ethics Guidelines for Trustworthy AI, and an organisation using ISO/IEC 42001 will find the policy, roles, risk assessment and training expectations map closely to it.

A note on this page

This is Aicura’s reading of the Digg and IMY guidelines. It is not legal advice and it is not the guidelines themselves. Read the primary source published by Digg, and take advice on how the law applies to your organisation.