What does the EU AI Act mean for a mid-sized Swedish company?
For most mid-sized companies, the AI Act means three things: staff need to understand the AI support they use, customers must be told when they interact with AI, and you need to know whether any of your AI systems is high-risk. AI support in sales, quotes and customer service is rarely high-risk. AI for recruitment and staff assessment can be.
Why does regulation hold back so many AI initiatives?
“We don't dare, think of GDPR.”
That is often the real reason AI projects stall in mid-sized companies. Not the technology. Not the budget. The worry. What happens to our data? Who sees it? What do the lawyers say?
It is a reasonable worry, and it should be taken seriously. But the answer is rarely to wait. The answer is a clear game plan: which data may be used, where, by whom and how.
When people know where the boundaries are, they dare to use the tools.
What is the AI Act?
The AI Act is the EU's Regulation (EU) 2024/1689 on artificial intelligence. It applies directly in all EU countries and regulates AI systems by the risk they pose to people's health, safety and fundamental rights.
It complements GDPR, it does not replace it. If the AI support processes personal data, both apply.
What is your company's role: provider or deployer?
The regulation distinguishes two main roles:
| Role | What it means | Typical example |
|---|---|---|
| Provider | Whoever develops an AI system and places it on the market or puts it into service under its own name | A software company selling an AI service |
| Deployer | Whoever uses an AI system in its business | A company using AI support in its quoting process |
Most mid-sized companies are deployers. If you develop your own AI system and use it under your own name, you also become a provider, with more obligations. The same can apply if you change the purpose of an AI system so that it becomes high-risk, for example by starting to use a general AI assistant to sort job applications (Article 25).
What risk categories are there?
| Risk category | Examples | What applies |
|---|---|---|
| Prohibited | Social scoring, manipulation exploiting vulnerabilities, emotion recognition in the workplace | May not be used |
| High risk | AI for recruitment and selection, employee assessment, credit scoring of individuals, assessment of students, critical infrastructure | Extensive requirements: risk management, documentation, human oversight, logging |
| Limited risk (transparency) | Chatbots, AI-generated content, deepfakes | People must be told they are interacting with AI or that content is AI-generated |
| Minimal risk | Most AI support in sales, quotes, reporting and internal administration | No specific requirements beyond AI literacy |
The trap for B2B companies is people decisions. AI support that filters job applications or evaluates candidates is high-risk, even in a small company. The same goes for AI that decides on promotion or termination, allocates tasks based on personal traits or evaluates employee performance (Annex III, point 4).
Which dates apply?
| Date | What applies |
|---|---|
| 1 August 2024 | The regulation enters into force |
| 2 February 2025 | The prohibitions. AI literacy requirements for those using AI systems. |
| 2 August 2025 | Rules for general-purpose AI models (GPAI) and penalties |
| 2 August 2026 | Most of the regulation, including the transparency requirements in Article 50 |
| 2 December 2026 | Deadline for systems on the market before 2 August 2026 to mark AI-generated content in a machine-readable way (Article 50(2)) |
| 2 December 2027 | Requirements for standalone high-risk systems (Annex III), such as recruitment and employee assessment |
| 2 August 2028 | Requirements for high-risk systems embedded in products (Annex I) |
The high-risk dates were postponed in 2026 by the EU simplification package often called the Digital Omnibus. The transparency requirements were not. Source for the dates: the Swedish Post and Telecom Authority (PTS).
What does a mid-sized company need to do now?
- Take stock of your AI systems. Which AI support is used, by whom and for what? Remember AI features built into systems you already have.
- Classify them. Most fall into minimal or limited risk. Look especially for AI used in recruitment and staff assessment.
- Secure AI literacy. Since 2 February 2025, companies using AI systems must take measures for their staff's AI literacy (Article 4). In practice: everyone using the AI support understands what it does, where its limits are and when a person should review.
- Be open with customers. If customers meet a chatbot or AI-generated content, it must be made clear.
- Write a simple AI policy. Which data may be used, in which tools, by whom and how. One page is enough to start.
- Connect it with GDPR. Map the data flows. Where processing may involve high risk, carry out a data protection impact assessment.
That is how we work: regulation as a design requirement from day one, not paperwork afterwards. Then the service can go into production, and stay there. Read more in From AI pilot to production and see our service ladder.
Who supervises the AI Act in Sweden?
Several authorities share the responsibility. The Swedish Post and Telecom Authority (PTS) is a national competent authority and point of contact, and is responsible for the regulatory sandbox for AI. The Swedish Authority for Privacy Protection (IMY) is the market surveillance authority for several types of AI, including law enforcement and credit assessment. Finansinspektionen is responsible within the financial sector.
Supplementary Swedish legislation is on its way. PTS is tasked with being a competent authority until 31 December 2026. Sources: PTS, IMY.
What happens if you break the rules?
Fines are up to EUR 35 million or 7 percent of global annual turnover for prohibited AI practices, and EUR 15 million or 3 percent for most other obligations. For small and medium-sized enterprises, the lower of the two amounts applies (Article 99).
More important day to day: AI support that does not meet the regulations never reaches production. Legal stops it, often late.
This guide is general information about the AI Act, not legal advice. Always check the current text and the situation for your business.
Sources: Regulation (EU) 2024/1689, EUR-Lex · PTS on the AI Act (Swedish) · IMY on its market surveillance role (Swedish)
FAQ
Common questions about the AI Act
Does the AI Act apply to us if we only use ChatGPT or Copilot?
Yes, as a deployer. For general AI assistants in daily work, it is mainly about AI literacy among staff and a clear policy on which data may be used.
Is AI in the sales process high-risk?
Rarely. AI support for quotes, leads, follow-up and reporting is normally minimal risk. What can become high-risk in a B2B company is AI for recruitment and staff assessment.
Do we have to tell customers we use AI?
If the customer interacts directly with an AI system, such as a chatbot, it must be made clear. Internal AI support where a person reviews before anything is sent is normally not covered by that requirement.
Have the high-risk requirements been postponed?
Yes. Requirements for standalone high-risk systems apply from 2 December 2027 and for high-risk systems in products from 2 August 2028. The prohibitions, the AI literacy requirement and the transparency requirements already apply.
Who can help us classify our AI systems?
We classify AI systems and map data flows as part of every engagement. Book 30 minutes, free of charge. For legal assessments in individual cases, we recommend a lawyer specialising in AI and data protection.
Which AI systems do you already use?
Bring the list to a conversation. Together we will see how they are classified and what needs doing.
Book 30 minutes