AI governance for Swedish banks, insurers and financial firms

The short answer

Swedish financial firms do not have an AI rulebook of their own. They govern AI under the rules that already apply to them for governance, risk management and operational resilience, and under the EU AI Act, which Finansinspektionen (FI) now supervises for the firms most exposed to it.

Three things changed in 2026. The Government named FI as a market surveillance authority under the AI Act. FI started a new mapping of how the sector uses AI. And it began an in-depth review of how firms protect themselves against cyber threats from advanced AI models.

FI’s role under the AI Act

On 4 June 2026 the Government decided (Fi2026/01365) that FI, PTS, IMY, Läkemedelsverket and Swedac act as Sweden’s national competent authorities under the AI Act until 31 December 2026, while supplementary legislation is prepared. FI is market surveillance authority for

• prohibited practices and high-risk systems used to evaluate creditworthiness or set credit scores of natural persons (Annex III point 5(b)), within FI’s own supervisory remit, and
• prohibited practices and high-risk systems used for risk assessment and pricing in life and health insurance (point 5(c)).

IMY supervises creditworthiness and credit scoring systems outside FI’s area, and PTS covers other areas such as employment, which reaches HR systems in financial firms too. The Swedish AI Act authorities page has the full split.

For a bank or insurer, credit and insurance pricing models are the systems to classify first. After the 2026 Digital Omnibus, the Annex III high-risk duties apply from 2 December 2027. Deployers of credit scoring and life or health insurance pricing systems must carry out a fundamental rights impact assessment, as public bodies must, before using them. The high-risk classification guide covers how to decide what is in scope.

What FI found in 2024

FI’s report AI in the Swedish financial sector, published on 6 December 2024, surveyed 278 firms and received answers from 234.

• 84 per cent said their employees use public generative AI tools such as ChatGPT, Copilot or Gemini.
• 22 per cent had AI systems in production or under development, and 46 per cent were running experiments or pilots.
• Only 41 per cent of firms with AI in production had a formally approved policy for developing and using AI. Guidelines for staff use of public generative AI were even less developed.
• 91 per cent of firms using AI had started preparing for the AI Act, or planned to within months.

FI’s message was that it sets high demands on the sector knowing which risks AI brings, having the competence to manage them, and putting policies and routines in place.

What FI is looking at in 2026

A new mapping of AI use. On 3 September 2026 FI announced an in-depth analysis of how financial firms use AI and handle its opportunities, risks and challenges. A targeted survey goes to banks, credit institutions, insurers, fund management companies, payment institutions and securities firms. It follows up the 2024 survey and asks how firms believe the AI Act affects them. FI says the results will help it direct its supervision.

Cyber threats from advanced AI models. On 29 September 2026 FI started an in-depth review, with on-site visits, of how firms protect themselves against cyber threats from advanced AI models. FI calls this a priority area in its supervision and points to DORA’s obligations on operational resilience.

AI and ESG data. On 15 October 2026 FI published guidance with 12 questions and answers on using AI to handle ESG data, the first output of its Innovationskompassen work. Its central point applies to AI generally. A firm’s responsibility for the information is the same whether it is produced manually or with AI.

A working approach

For a firm FI supervises, the work comes down to five things.

1. Know what you run. Register every AI system and model, including generative AI tools staff use and AI inside vendor products. FI’s 2024 numbers show that use runs well ahead of formal governance.
2. Classify credit and pricing models. Decide which systems fall under Annex III points 5(b) and 5(c), and which authority supervises each.
3. Approve a policy. Put a board-approved AI policy in place, with rules for public generative AI. Board reporting keeps it in front of the people accountable for it.
4. Manage third-party and model risk. Map which systems depend on which providers, and treat AI vendors under your existing outsourcing and DORA third-party arrangements. The vendor AI risk guide sets out the steps.
5. Test and monitor. Red team AI systems against the threats FI is reviewing, and monitor for drift and provider changes.

Aicura supports this work with its AI register, vendor management, risk and impact assessments, security testing and monitoring. It assesses against the EU AI Act from the Essentials plan, and ISO/IEC 42001 and the NIST AI RMF from Pro. The decisions, and the dialogue with FI and IMY, stay with you.