EU AI Act for Swedish Companies in 2026: What Applies and Who Supervises

What does the EU AI Act mean for Swedish companies in 2026?

The EU AI Act, Regulation (EU) 2024/1689, entered into force on 1 August 2024. As a regulation it applies directly in Sweden. Sweden only adds supplementary rules, mainly on which authorities supervise and how penalties are imposed.

The Act is risk-based. A few practices are banned. Listed high-risk uses, such as AI in recruitment, credit scoring or critical infrastructure, carry heavy documentation and oversight duties. Chatbots, deepfakes and AI-generated content carry transparency duties. General-purpose AI models have rules aimed at their providers. Most other business AI carries no specific duty beyond AI literacy.

For a typical Swedish company that means: know which AI systems you use and in which role, make sure staff have adequate AI knowledge, disclose AI where Article 50 requires it, and keep treating personal data under the GDPR.

EU AI Act timeline: which dates apply after the Digital Omnibus?

In short

Prohibitions and AI literacy from 2 February 2025, GPAI rules from 2 August 2025, general application and Article 50 from 2 August 2026. High-risk rules moved to 2 December 2027 (Annex III) and 2 August 2028 (Annex I).

The Digital Omnibus on AI, Regulation (EU) 2026/1744, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It postponed the high-risk rules and added new prohibitions. It did not postpone the prohibitions, AI literacy, the GPAI rules or most of Article 50.

The Commission's AI Act Service Desk confirms that enforcement powers of the AI Office and national authorities apply from 2 August 2026. Under Article 99, fines reach EUR 35 million or 7 percent of global turnover for prohibited practices and EUR 15 million or 3 percent for most other breaches. For SMEs the lower amount applies.

Source: Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744; AI Act Service Desk, accessed 2026-09-29

Provider or deployer: which role does your company have?

In short

A provider develops an AI system and places it on the market or puts it into service under its own name. A deployer uses an AI system professionally under its authority. Most Swedish companies are deployers, but building your own chatbot can make you a provider.

Almost every obligation attaches to a role.

• Provider. Develops an AI system or model, or has it developed, and places it on the market or puts it into service under its own name. OpenAI provides ChatGPT; Microsoft provides Microsoft 365 Copilot.
• Deployer. Uses an AI system under its authority, other than for personal use. According to the Commission, employees are not separate deployers: the company is.
• Importer and distributor. Bring or make available third-country AI systems in the EU. Relevant for resellers and integrators.

Roles can shift. Under Article 25, a deployer becomes the provider of a high-risk system if it puts its name on it, substantially modifies it or changes its intended purpose to a high-risk use. A company that builds a customer service assistant on a model API and launches it under its own brand is, in practice, the provider of that system. Digg makes the same point for the public sector: your role decides your obligations, even if you only use AI.

What must a Swedish company that uses ChatGPT, Copilot or a chatbot actually do?

In short

Internal use of ChatGPT or Copilot requires AI literacy measures, no prohibited uses and GDPR compliance. A customer-facing chatbot must tell users they are talking to AI unless it is obvious. Label deepfakes and unreviewed public-interest AI text.

Internal use of ChatGPT, Copilot or Claude

Drafting, summarising or analysing with a general-purpose assistant is not high-risk. Your duties are limited but real:

• AI literacy (Article 4). After the Omnibus, providers and deployers must take measures to support AI literacy of their staff, considering knowledge, role and context. No certificate is required, but keep records of training and guidance.
• Prohibited practices (Article 5). Inferring employees' emotions at work is banned, except for medical or safety reasons. Check before enabling emotion features on staff calls or meetings.
• Publishing AI output (Article 50(4)). Disclose deepfakes. Disclose AI-generated text published to inform the public on matters of public interest, unless it was human-reviewed under editorial responsibility.

A customer service chatbot

Article 50(1) requires that people are informed they are interacting with an AI system, unless that is obvious. If you bought the chatbot, the vendor is the provider, but check that your configuration keeps the disclosure. If you built it and launched it under your brand, the duty is yours. A first message such as "You are chatting with an AI assistant" plus a route to a human is the practical minimum.

If AI is used to decide about people, for example screening job applicants or assessing creditworthiness, it is Annex III high-risk. From 2 December 2027 deployers must follow the instructions for use, assign human oversight, monitor operation, keep logs, inform affected workers and people, and in some cases assess fundamental rights impact.

How does the AI Act relate to the GDPR in Sweden?

In short

IMY states that the AI Act and the GDPR apply in parallel. The GDPR applies whenever personal data is processed when AI is developed or used; the AI Act does not replace legal basis, transparency or DPIAs.

The Swedish Authority for Privacy Protection (IMY) is direct: the AI Act and the GDPR apply in parallel, and the GDPR applies whenever personal data is processed in connection with developing or using AI. Complying with one does not mean complying with the other.

IMY's guidance on GDPR and AI (Vägledning om GDPR och AI, updated May 2026) covers legal basis, the data protection principles, transparency when models are hard to explain, data accuracy and discriminatory outcomes, and limits on automated decision-making. In practice, a DPIA under the GDPR and, for certain high-risk deployers, a fundamental rights impact assessment under the AI Act can be prepared together. IMY is also an AI Act market surveillance authority, so it may look at both sides.

Who supervises the EU AI Act in Sweden?

In short

On 4 June 2026 the Government appointed PTS, IMY, Finansinspektionen, Läkemedelsverket and Swedac until 31 December 2026. PTS is single point of contact and supervises chatbot transparency; IMY covers remaining prohibitions and biometrics.

The Government decided on 4 June 2026 (Fi2026/01365) to appoint five national competent authorities under Article 70 of the AI Act. The assignment runs until 31 December 2026 while permanent legislation is prepared, based on the inquiry SOU 2025:101. General-purpose AI models are supervised at EU level by the Commission's AI Office.

Digg, the Agency for Digital Government, is not an appointed AI Act authority. With IMY it published national guidelines for generative AI in public administration in January 2025, a useful reference for private companies too.

Swedish buyers running cross-border AI procurement across the EU should pair the Swedish supervisor map above with our vendor-level European AI consulting partners 2026 shortlist, which ranks the firms most capable of handling multi-jurisdiction AI Act scoping (Deloitte EU, KPMG Lighthouse Trusted AI, Capgemini Invent, Alice Labs and others) in a single engagement.

Source: Regeringsbeslut Fi2026/01365, 2026-06-04

EU AI Act checklist for Swedish companies in 2026

In short

Inventory AI systems and roles, screen for prohibitions, document AI literacy, fix Article 50 disclosures, align with the GDPR, flag high-risk uses for December 2027 and assign an owner.

1. Inventory. List every AI system, including AI features in existing software, and your role for each.
2. Screen for prohibitions. Check against Article 5, especially emotion recognition at work, manipulative design and biometric categorisation.
3. Document AI literacy. Baseline training for everyone who uses AI, role-specific depth, and records of who was trained and when.
4. Fix Article 50 disclosures. Chatbots say they are AI, deepfakes are labelled, public-interest AI text is reviewed or labelled.
5. Align with the GDPR. Legal basis, data processing agreements with AI vendors, DPIAs where required, rules on what staff may enter.
6. Flag high-risk candidates. Recruitment, performance management, credit, insurance, education or critical infrastructure: plan for 2 December 2027 now.
7. Assign an owner. One accountable person, a short AI policy and a review at least twice a year.

Common mistakes Swedish companies make with the AI Act

In short

Believing the Omnibus postponed everything, assuming ChatGPT users are exempt, treating the AI Act as a GDPR replacement, and launching chatbots without an AI disclosure.

• "Everything was postponed." Only high-risk dates moved.
• "We only use ChatGPT." Deployers have duties too, starting with AI literacy.
• "The AI Act replaces the GDPR." IMY says both apply.
• Forgetting that building makes you a provider. An in-house chatbot under your brand carries provider duties.
• AI literacy as a one-off webinar. Measures must fit roles, with records.
• No inventory. AI features in CRM, HR or support software are where high-risk uses hide.

This is a practical overview, not legal advice.

How Alice Labs helps Swedish companies with the AI Act

In short

Alice Labs helps with AI governance (inventory, role classification, AI policy, Article 50 reviews) and with AI training that supports the Article 4 literacy duty.

• AI governance. AI inventory and role classification, screening against prohibited and high-risk categories, a short AI policy, Article 50 reviews of chatbots and agents, aligned with your GDPR work. See AI governance (Swedish: AI-governance).
• AI training. Role-based training in ChatGPT, Copilot and Claude, including risks and internal rules, with a record of who was trained. See AI-utbildning and AI literacy for enterprises.

For all dates, see the EU AI Act timeline. We work alongside your legal and data protection functions, not instead of them.