SWEDEN Trends and Developments Contributed by: Niclas Rockborn, Astrid Svensson and Ivan Sivik, Gernandt & Danielsson
the automated processing of their personal data, and to inform them of the data sources used to personalise such offers. Secondly, similar to Article 22 of the GDPR, the CCD 2 grants consumers the right to request and obtain human intervention from the creditor where an auto - mated credit assessment decision is based on per - sonal data. Additionally, the CCD 2 provides individu - als with a broader right to human intervention as it applies to the entire credit assessment process and not just to the final decision. Thirdly, the CCD 2 prohibits the collection and pro - cessing of sensitive personal data contained in data - bases for the purpose of assessing the consumer’s creditworthiness. Finally, the CCD 2 stipulates that consumers must be informed within 30 days of registration in a database of any outstanding credit claims about the registra - tion itself and about their rights under the GDPR. As no corresponding right to information exists in Swed - ish law, the government intends to introduce such a provision. AI and Data Protection The AI Act and data protection The AI Act came into effect in August 2024, and its provisions are being implemented gradually. It aims to promote the use of human-centred and trustwor - thy AI, and to protect users against harmful effects. The AI Act governs the development, provision, and use of AI systems in the EU. It employs a risk-based approach, where AI systems are divided into the fol - lowing categories of risk: • unacceptable; • high; • limited; and • minimal. Different requirements apply based on the risk cat - egory. General-purpose AI models are an additional category posing specific transparency requirements. The AI Act applies in parallel with the GDPR. A nation - al review of the need for national adaptions because of
the AI Act has been published and the supplementary provisions are proposed to enter into force in August 2026. With regard to market surveillance, the govern - ment has proposed that supervisory responsibilities will be delegated to different authorities, each respon - sible for supervising AI systems in their respective areas. Additionally, the Swedish Authority for Privacy Protection (IMY) ( Integritetsskyddsmyndigheten ) will be responsible for the supervision of several high-risk AI systems and prohibited AI uses. The Swedish Post and Telecom Authority (PTS) ( Post- och telestyrelsen ), as the single contact point, will be responsible for co- ordinating market surveillance, supervision, and for leading activities in AI regulatory sandboxes. Finally, IMY, PTS and SFSA are also tasked with authorising real-world testing outside regulatory sandboxes. IMY’s regulatory sandboxes The use and integration of AI in various sectors raise significant concerns from a data protection perspec - tive, which need to be evaluated on a case-by-case basis. One of the foremost challenges is understand - ing the impact of the GDPR on AI and vice versa. IMY has been actively involved in addressing the emerging challenges of new AI technology through regulatory sandboxes. Uncertainty generally stifles innovation; therefore, IMY offers guidance through its regulatory sandboxes, which emphasise the use of AI in relation to data protection regulations. Throughout 2025, IMY launched and concluded sev - eral sandbox projects. One notable regulatory sand - box project concluded in 2025 focused on data pro - tection issues arising from the further processing of personal data for the purpose of training AI models. The project examined whether further processing of actual personal data and synthetically generated data for AI model training would be compatible with the purpose limitation principle under the GDPR. IMY concluded that the training of AI models with per - sonal data or with synthetically generated data can - not be considered to be for statistical purposes. IMY further assessed that neither the training of AI models with personal data nor with synthetically generated data can be considered to be further processing that is compatible with the original purposes. However, IMY considered that further processing could be per -
472 CHAMBERS.COM
Powered by FlippingBook