AI governance for Swedish agencies, municipalities and regions

The short answer

Swedish public bodies already have a clear legal frame for AI. It is spread across four instruments, and none of them is an AI law of Sweden’s own. The Administrative Procedure Act governs how decisions are made. The GDPR governs personal data and solely automated decisions. The EU AI Act governs AI systems themselves. The Digg and IMY guidelines translate all three into practice for generative AI.

The Government’s AI strategy, published on 20 February 2026, wants Sweden to be among the world’s ten leading AI nations and gives agencies AI and data assignments to get there. That raises the volume of AI in the public sector, which is why the governance has to keep pace.

What the Administrative Procedure Act allows

Section 28 of förvaltningslagen (2017:900) says a decision can be made by one official alone, by several jointly, or automatically. Since 1 July 2018 that has been the general footing for automated decisions across Swedish administration.

It is a permission, not an exemption. The rest of the Act still applies to a decision made by a system.

• Section 5 requires support in the legal order, objectivity, impartiality and proportionality.
• Section 25 requires the authority to tell the party about material of significance and let them respond before deciding.
• Section 32 requires clear reasons for a decision that affects someone in a not insignificant way.
• Sections 40 and 41 open the decision to appeal in the administrative courts.

A rules engine that applies a statute can meet these. A model whose output cannot be traced back to the law, or explained to the person affected, is much harder to defend.

Where the GDPR and IMY come in

Article 22 of the GDPR restricts decisions based solely on automated processing that have legal or similarly significant effects. For an authority, the relevant exception is a decision authorised by law that lays down suitable safeguards.

IMY’s guidance on GDPR and AI says a decision supported by an AI model but made by a person is generally not a solely automated decision. Where the rules do apply, the person must get meaningful information about the logic involved, including how the model reached its result. IMY says that does not require opening the black box.

IMY is also the market surveillance authority for most AI Act prohibitions and several high-risk areas, so the same regulator can ask about both regimes.

What the EU AI Act adds

Swedish authorities, municipalities and regions are deployers whenever they use an AI system. The duties already in force are the prohibitions and AI literacy (since 2 February 2025) and the Article 50 transparency duties (since 2 August 2026). For high-risk systems, the deployer duties apply from 2 December 2027. They include using the system as instructed, assigning competent human oversight, monitoring, keeping logs and informing affected people. Public bodies must also carry out a fundamental rights impact assessment before using most Annex III high-risk systems. The deployer obligations guide covers each duty.

Several Annex III areas are mainly public. They include eligibility for public assistance benefits and services, education, migration, law enforcement and the administration of justice. Under the Government’s decision of 4 June 2026, PTS supervises public assistance, education, employment and critical infrastructure, and IMY supervises biometrics, law enforcement, migration and justice. The Swedish AI Act authorities page sets out the full split.

What the Digg and IMY guidelines ask

The 18 guidelines published on 21 January 2025 are the practical layer. Four matter most for governance.

Adopt an AI policy. Management decides in advance how generative AI may be used, by whom, with which tools and data, and who checks the output.

Prepare for the AI Act. Know which systems you run and which risk tier each falls into.

Keep human control over decisions. Avoid letting generative AI decide matters that directly affect people on its own, document the tool’s role and be open about its use.

Buy deliberately. Make conscious decisions about acquiring generative AI and procure it under the Public Procurement Act.

The data protection guidelines add the controller and processor split, legal basis, transfers to third countries and a risk assessment for each use. That matters for any cloud AI service hosted outside Sweden.

A working approach

For an agency, municipality or region, the work comes down to five steps.

1. Find what is in use. Generative AI arrives through browsers and built-in features long before a formal project. Finding shadow AI comes first.
2. Register every system. Record its owner, purpose, whom it affects, whether it decides or supports a decision, and its AI Act risk tier. Keep it in one register, not scattered spreadsheets.
3. Assess what affects people. Run an impact assessment for each system that touches a decision about a person, covering legal support, reasons, appeal and human review. For high-risk systems, extend it into the fundamental rights impact assessment.
4. Write and enforce the policy. Set which tools and data are allowed, train staff, and apply the rules where the traffic flows rather than only in a document.
5. Keep it current. Review systems when they change, log incidents and keep what you decided and why.

Aicura supports this work. Its AI register, discovery, risk and impact assessments, policies, guardrails and oversight cover the steps above, and the EU AI Act is available from the Essentials plan. The judgements stay with your organisation.