← Back to feed

Sweden’s government offices blocked ChatGPT and Claude on work computers this week, directing staff toward Microsoft Copilot as the sole approved AI tool. The restriction was reported by Sveriges Radio Ekot on Friday.

Digitalisation Director Mikael Wettercrantz wrote on the government offices’ intranet that using AI services without formal agreements can have “consequences for our information security.” The block is hardware-level: the two services are unreachable from staff devices as of Monday.

Not Isolated

Ekot’s reporting shows this is a coordinated shift across the Swedish public sector, not a single agency decision:

• Skatteverket (Tax Agency) has introduced similar blocks
• Statens institutionsstyrelse (SIS) (National Government Service Centre) has also restricted access
• Kronofogden (Debt Enforcement Authority) is actively preparing its position
• Trafikverket (Transport Administration) flagged the problem earlier this year after an internal audit found widespread and risky use of roughly ten AI services, with staff inputting sensitive data into consumer products

Regeringskansliet had already restricted DeepSeek before this week’s action. The pattern points to a broader procurement discipline push: agencies want staff on platforms covered by enterprise contracts and data processing agreements, not on consumer-tier accounts.

Copilot Gets the Keys

Microsoft Copilot is the designated alternative, and Ekot’s internal sources confirm Regeringskansliet has simultaneously hardened its Copilot configuration — though the government’s press office declined to elaborate on the specifics, citing security concerns.

Importantly, the ban does not completely cut off Claude or ChatGPT access. Some staff retain access to both through a separately built internal AI agent platform, which the government offices developed themselves. That platform routes through the approved services under controlled conditions.

The Procurement Reading

The stated rationale is information security, not an AI Act ruling or a GDPR enforcement action. The underlying issue is simpler: when staff use consumer AI accounts to process work material, there is no data processing agreement, no retention controls, and no audit trail. Approved enterprise contracts address all three.

Swedish public sector organisations have guidance from Digg (the Agency for Digital Government) and IMY (the Swedish Privacy Authority) on using generative AI under GDPR. The 2025 Digg guidelines require a secrecy assessment, an AI policy, and documentation before deployment. ChatGPT Plus and Claude’s consumer tiers do not satisfy those requirements by default.

Anthropic has not announced EU data residency for Claude inference. Without an explicit DPA covering Swedish government data, procurement teams have no contractual basis to approve the service — making the block a natural outcome once agencies get serious about compliance rather than convenience.

For OpenAI, the situation is more nuanced: ChatGPT Enterprise and Business plans offer EU data residency since early 2026, and include a data processing addendum. The consumer Plus tier that most government staff were likely using does not.

What It Signals

Europe’s public sector AI landscape is consolidating toward a two-tier structure: approved enterprise contracts (Microsoft, Google Workspace, Claude Enterprise via Bedrock) on one side, and consumer AI products on the other. Sweden’s action follows similar moves in Germany and Italy, where government bodies have restricted specific AI services citing data processing concerns.

The distinctive element in Sweden’s case is the intranet-to-workplace nature of the ban — this is not a policy guidance document. It is a network block. Staff cannot reach the services even if they want to. That enforcement posture suggests the agencies have moved past persuasion toward structural controls.