- ChatGPT and Claude are now banned for government work in Sweden
- The AI platforms join DeepSeek on a list of non-approved AI tools over data security fears
- Microsoft CoPilot is still approved for use, but with much tighter security controls
Swedish officials are no longer allowed to use OpenAI’s ChatGPT and Anthropic’s Claude for government work due to concerns over security.
The government will allow workers to continue using platforms that are regulated and approved, such as Microsoft CoPilot, but concerns that sensitive information could be fed into unregulated platforms have been cited as a reason for the ban.
Unregulated platforms used by employees, also known as Shadow IT, could have “consequences for Sweden’s information security,” Mikael Wettercrantz, Chief Information Officer (CIO) and Director of Digitization explained.
Only use approved AI platforms for government work
A review of AI tools used by workers at the Swedish Transport Administration earlier this year revealed “problematic” uses of AI platforms for government work.
AI services used for official purposes without the correct enterprise contract and associated regulation can lead to sensitive information entered into an AI chatbot being fed back to the developer, and then stored to be used for training.
The lack of an enterprise agreement can also bring up problems when auditing the use of AI tools within an organization, and can lead to further data protection issues if data that should be protected under European regulations moves beyond the digital borders of Europe - such as when the information is processed in a data center in the US.
Government workers will continue to have access to Microsoft CoPilot for official work, but with tighter security controls following an internal review. A limited number of employees will continue to have access to ChatGPT and Claude through a “special platform for AI assistants,” the government said.
This isn’t the first time AI platforms have been restricted for government work in Sweden. The country followed many others in banning the use of DeepSeek for government work over privacy violation concerns related to GDPR.
Similarly, the United States has banned all products and services related to DeepSeek due to fears that Chinese data laws could allow authorities access to the company’s servers.
The US Department of Homeland Security also warned that the DeepSeek platform could contain “malware and other security vulnerabilities.”
Benedict provides detailed analysis on state-sponsored threat actors, APT groups, and the protection of critical national infrastructure, with his reporting bridging the gap between technical threat intelligence and B2B security strategy.
Benedict holds an MA (Distinction) in Security, Intelligence, and Diplomacy from the University of Buckingham Centre for Security and Intelligence Studies (BUCSIS), with his specialization providing him with a robust academic framework for deconstructing complex international conflicts and intelligence operations, and the ability to translate intricate security data into actionable insights.