Posts tagged with "Sweden"

Commission Implementing Decision (EU) 2026/2274 put EN 18286:2026 in the Official Journal on 14 October 2026, making it the first harmonised standard under the AI Act and giving providers a presumption of conformity for the Article 17 quality management system. We cover what the presumption does and does not include, how the standard differs from ISO/IEC 42001, the status of the nine standards still pending, and how to map Article 17 evidence to Azure.

Sweden's AI Act enforcement map is now set: the SOU 2025:101 inquiry designates Post- och telestyrelsen (PTS) as coordinating market surveillance authority, with eleven surveillance bodies, two notifying authorities, and a PTS-run regulatory sandbox. The supplementary law was written to take effect on 2 August 2026 but awaits formal adoption, so PTS and its peers operate on interim government assignments while EU transparency rules already apply.

Regulation (EU) 2026/1744, the Digital Omnibus on AI, entered into force on 27 July 2026 and moves the AI Act deadline for Annex III high-risk systems from August 2026 to 2 December 2027, with Annex I embedded systems following in August 2028. Article 50 transparency still applies from 2 August 2026, a new prohibition arrives with a December 2026 marking deadline, and a phased 16-month plan turns the reprieve into a workable compliance programme.

On 16 June 2026 the European Parliament approved the Digital Omnibus amendments 423-57, moving Annex III high-risk AI Act obligations to 2 December 2027 and product-embedded obligations to 2 August 2028. Article 50 transparency duties and the Commission's GPAI enforcement powers were not delayed, which leaves Swedish enterprises six weeks to ship chatbot disclosure, content marking and a documented GPAI position before 2 August 2026.

On 15 June 2026 IMY confirmed its role as market surveillance authority for the EU AI Act, with responsibility covering AI systems in areas such as law enforcement and credit assessment, alongside PTS and Finansinspektionen. For Swedish enterprises this puts GDPR and AI Act supervision under one regulator, and IMY's sandbox role offers a way to get data protection guidance before enforcement reaches full strength in 2027.

On 3 June 2026 the European Commission proposed the Cloud and AI Development Act, a regulation that introduces four Union assurance levels for cloud sovereignty and aims to at least triple EU data centre capacity within five to seven years. For Swedish public-sector and regulated teams on Azure, the framework will decide which workloads can stay on a US hyperscaler and which need an EU-controlled alternative, so the classification work should start now.

Sweden's first national cloud policy (Fi2026/01233) bans no provider but makes jurisdictional exposure, portability and exit capability the questions every public-sector cloud decision must now answer in writing. For Azure estates, a defensible position means classified workloads, enforced Swedish and EU residency, customer-managed keys for sensitive data and a tested export path.

A working-engineer walk-through of the EU AI Act beyond the risk-tier summary. Covers legal structure, Annex III classification decisions, GPAI rules, the full timeline to 2027, Article 12 logging, Article 50 transparency, conformity assessment artifacts, CE marking, penalties, and the Swedish implementation.

The Digital Omnibus on AI moved the Annex III high-risk deadline from 2 August 2026 to 2 December 2027, and Annex I embedded systems to 2 August 2028. Article 50 transparency, the Article 5 prohibitions and the general-purpose AI duties did not move, so this is the Swedish prep list rewritten around what is already enforceable and how to spend the runway that is left.

Sweden's cybersäkerhetslag (2025:1506) took effect on 15 January 2026, and the engineering detail sits in the ordinance and the MCFFS regulations rather than the headlines. This checklist covers scope and the essential versus important split, registration with FRA, the eight supervisory authorities, the three incident reports and their deadlines, supplier contract clauses, and the Azure and Microsoft 365 controls behind each of the ten measure areas.

Swish decommissioned the v1 create endpoints on 1 January 2026, so a current integration PUTs to /api/v2/paymentrequests while still using v1 to retrieve and cancel. The engineering work sits around that call: five-year client certificates rotated out of Azure Key Vault, callbackIdentifier verification, the documented callback retry schedule, refunds that need a fresh UUID on every attempt, and a sweeper for callbacks that never arrive.

One year after the Digital Operational Resilience Act entered into force for financial-sector firms on 17 January 2025, this is what Swedish fintech engineering teams actually learned about ICT risk, incident reporting, TLPT, and the third-party register.

A practical review, one year after the EU AI Act Article 5 prohibitions entered into force on 2 February 2025 — where Swedish B2B teams over-reacted, where they under-reacted, and what must ship before the August 2026 high-risk deadline.

A practical allocation framework for Swedish CTOs planning 2026 IT spend — from EU AI Act governance infrastructure and Entra Agent ID, to Azure Sweden Central residency work, NIS2 gap closure, and the investments worth deferring.