EU AI Act One Year On: Lessons for Swedish B2B Teams
On 2 February 2025, the first phase of the EU AI Act. The Article 5 prohibitions and AI literacy obligations. Entered into force. On 2 August 2025, obligations for general-purpose AI models and governance structures followed. One year into the regulation's phased rollout, the picture for Swedish B2B teams is mixed: some over-reacted with blanket bans; others under-reacted and will spend 2026 catching up. Here is what the pattern tells us.
The Timeline, Reduced to What Matters
- 2 February 2025. In force. Article 5 prohibitions (social scoring, untargeted face-scraping, emotion recognition in workplaces and schools, real-time remote biometric identification in public spaces with narrow exceptions) plus Article 4 AI literacy obligations for providers and deployers.
- 2 August 2025. In force. General-Purpose AI Model obligations, Member State competent-authority designations, governance and penalties framework.
- 2 August 2026. Entering force. The big one: Annex III high-risk obligations, including conformity assessments, technical documentation, data governance, logging, human oversight, and CE marking.
- 2 August 2027. Entering force. Annex I high-risk (safety components in regulated sectoral legislation).
Where Swedish B2B Teams Over-Reacted
Blanket bans on LLM use
Several mid-sized Swedish firms interpreted the Act as reason to forbid all LLM use. This was both legally unnecessary and operationally costly. The Act is risk-based: minimal-risk uses (most internal productivity workflows) carry almost no obligations. The right answer was classification, not prohibition.
Re-classifying every internal tool as "high-risk"
The high-risk tier requires specific use-case criteria from Annex III. Biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, justice. A chatbot that helps sales reps draft emails is not high-risk. The cost of mis-classification is real: unnecessary conformity assessments, paused deployments, lost quarters.
Where Swedish B2B Teams Under-Reacted
AI literacy training (Article 4)
The Article 4 obligation on AI literacy applies to providers and deployers. It means the people in your organization using AI systems must have sufficient understanding to use them responsibly. Many firms treated this as a soft recommendation. It is a legal obligation, and a documented training program is what an auditor will look for.
Transparency notices for chatbots (Article 50)
If a user is interacting with an AI system, they must know. This applies today. Not in August 2026. The implementation is trivial (a disclosed UI element) but the number of production chatbots lacking it is still surprising.
Pipeline for Annex III readiness
The August 2026 obligations. Conformity assessment, technical documentation, logging, human oversight. Are six to twelve engineering months if started cold. Firms with any Annex III exposure that have not started by end of Q1 2026 are running out of runway.
The Swedish Enforcement Landscape
Sweden's Integritetsskyddsmyndigheten (IMY) is the expected lead competent authority for AI Act enforcement, with sector-specific authorities (Finansinspektionen for financial services, for example) participating on their domains. The Swedish AI Sandbox. A regulatory sandbox providing a controlled environment to develop and test AI systems. Is live and is the right venue for Annex III systems still in design.
What to Ship Before August 2026
- An AI system inventory with risk classification. Every internal and external AI use case, mapped to tier.
- Annex IV technical documentation for every high-risk system. This is the single heaviest artifact.
- Event logging (Article 12) for every high-risk system. Input hashes, output references, human-in-loop flags, override records, retention policy.
- Human-oversight design and documentation. What a human can intervene on, how, and with what latency.
- Post-market monitoring plan and incident-reporting runbook (Article 73). Fifteen-day clock for serious incidents.
- Data governance evidence (Article 10). Training-data representativeness, bias mitigation, quality management.
- CE marking and EU database registration. For high-risk systems prior to placement on the market.
The Honest One-Year Takeaway
The EU AI Act is not the GDPR remake it is sometimes painted as. The risk-based structure means the vast majority of B2B AI use is low-burden. What matters is knowing which tier each system falls into, and shipping the paperwork and controls for the systems that are genuinely high-risk. Swedish teams that started this classification work in 2025 are on track for August 2026. Teams that are still debating whether to start are the ones running out of time.