On 2 February 2025, the first phase of the EU AI Act. The Article 5 prohibitions and AI literacy obligations. Entered into force. On 2 August 2025, obligations for general-purpose AI models and governance structures followed. One year into the regulation's phased rollout, the picture for Swedish B2B teams is mixed: some over-reacted with blanket bans; others under-reacted and will spend 2026 catching up. Here is what the pattern tells us.
The Timeline, Reduced to What Matters
- 2 February 2025. In force. Article 5 prohibitions (social scoring, untargeted face-scraping, emotion recognition in workplaces and schools, real-time remote biometric identification in public spaces with narrow exceptions) plus Article 4 AI literacy obligations for providers and deployers.
- 2 August 2025. In force. General-Purpose AI Model obligations, Member State competent-authority designations, governance and penalties framework.
- 2 August 2026. In force. Article 50 transparency duties for AI systems that interact with people or generate synthetic content. These were not deferred.
- 2 December 2026. Entering force. Two additional Article 5 prohibitions added by the Digital Omnibus.
- 2 December 2027. Entering force. Annex III stand-alone high-risk obligations, including conformity assessments, technical documentation, data governance, logging, human oversight, and CE marking. The Digital Omnibus, in force since 27 July 2026, moved these from the original 2 August 2026 date.
- 2 August 2028. Entering force. Annex I high-risk, meaning AI embedded as safety components in products already covered by sectoral legislation. Also deferred by the Digital Omnibus, from 2 August 2027.
Where Swedish B2B Teams Over-Reacted
Blanket bans on LLM use
Several mid-sized Swedish firms interpreted the Act as reason to forbid all LLM use. This was both legally unnecessary and operationally costly. The Act is risk-based: minimal-risk uses (most internal productivity workflows) carry almost no obligations. The right answer was classification, not prohibition.
Re-classifying every internal tool as "high-risk"
The high-risk tier requires specific use-case criteria from Annex III. Biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, justice. A chatbot that helps sales reps draft emails is not high-risk. The cost of mis-classification is real: unnecessary conformity assessments, paused deployments, lost quarters.
Where Swedish B2B Teams Under-Reacted
AI literacy training (Article 4)
The Article 4 obligation on AI literacy applies to providers and deployers. It means the people in your organization using AI systems must have sufficient understanding to use them responsibly. Many firms treated this as a soft recommendation. It is a legal obligation, and a documented training program is what an auditor will look for.
Transparency notices for chatbots (Article 50)
If a user is interacting with an AI system, they must know. Article 50 has applied since 2 August 2026 and the Digital Omnibus did not defer it, so this is a live obligation rather than a future one. The implementation is trivial (a disclosed UI element) but the number of production chatbots lacking it is still surprising.
Pipeline for Annex III readiness
The Annex III obligations now fall due on 2 December 2027. Conformity assessment, technical documentation, logging and human oversight are still six to twelve engineering months of work if started cold, so the deferral buys scheduling room rather than a reprieve. Firms with Annex III exposure that treat the new date as permission to stop are the ones who will repeat the 2026 scramble a year later.
The Swedish Enforcement Landscape
Sweden's Integritetsskyddsmyndigheten (IMY) is the expected lead competent authority for AI Act enforcement, with sector-specific authorities (Finansinspektionen for financial services, for example) participating on their domains. The Swedish AI Sandbox. A regulatory sandbox providing a controlled environment to develop and test AI systems. Is live and is the right venue for Annex III systems still in design.
What to Ship Before the Annex III Deadline
- An AI system inventory with risk classification. Every internal and external AI use case, mapped to tier.
- Annex IV technical documentation for every high-risk system. This is the single heaviest artifact.
- Event logging (Article 12) for every high-risk system. Input hashes, output references, human-in-loop flags, override records, retention policy.
- Human-oversight design and documentation. What a human can intervene on, how, and with what latency.
- Post-market monitoring plan and incident-reporting runbook (Article 73). Fifteen-day clock for serious incidents.
- Data governance evidence (Article 10). Training-data representativeness, bias mitigation, quality management.
- CE marking and EU database registration. For high-risk systems prior to placement on the market.
The Honest One-Year Takeaway
The EU AI Act is not the GDPR remake it is sometimes painted as. The risk-based structure means the vast majority of B2B AI use is low-burden. What matters is knowing which tier each system falls into, and shipping the paperwork and controls for the systems that are genuinely high-risk. Swedish teams that started this classification work in 2025 are comfortably placed for the December 2027 date. Teams still debating whether to start have been handed extra time, not an exemption.