Sweden's government blocks ChatGPT and Claude, keeps Copilot

From Monday 26 October, Sweden's Government Offices (Regeringskansliet) made the browser interfaces of ChatGPT and Claude unreachable on staff computers. Sveriges Radio's Ekot broke the news and the office confirmed it to SVT. Staff are directed to Microsoft Copilot, whose security settings were also tightened after a review.

The block targets personal and individual subscriptions. The office's framework agreement with Microsoft sets where Copilot data is stored and how it is protected; individual ChatGPT and Claude accounts carry no such contract on the organisation's behalf. A spokesperson declined to say which Copilot settings changed, citing security.

Digitalisation director Mikael Wettercrantz wrote that using AI services without an agreement could have consequences for information security. Generative AI is not banned outright: some staff keep access through an internal AI assistant platform. Reports differ slightly on whether only browser versions are blocked.

The Swedish Tax Agency and the National Board of Institutional Care have similar blocks, and the Enforcement Authority is preparing one. The worry is staff pasting personal or confidential data into public tools without contractual safeguards.

The pattern is familiar: organisations first let staff use AI freely, then start asking where the data goes once usage becomes widespread.

A data processing agreement sets where data is stored, whether it trains models and how long it is kept. Personal accounts on free tools carry no such guarantee for the organisation, which matters under GDPR and Turkey's KVKK.

Public bodies are moving AI into contracted, auditable channels rather than banning it, which favours providers with enterprise agreements.

The Swedish case suggests that guidelines written as an approved-tools list are easier to enforce than outright bans, since staff already rely on these tools daily.

• Write a one-page AI policy naming approved tools and banned data.
• Move teams to business plans that exclude training on your data.
• Remember cross-border transfer rules for personal data.