Sweden Restricts ChatGPT and Claude Use Over Government Security Risks

The Swedish Civil Contingencies Agency (MSB) has issued a directive to restrict the use of popular generative AI tools, including OpenAI’s ChatGPT and Anthropic’s Claude, across government infrastructure. The decision follows a security assessment that identified significant risks related to data leakage and the handling of sensitive state information.

The restriction specifically targets government employees and devices connected to state-managed networks. According to MSB, the primary concern involves the transmission of sensitive data to servers located outside of Sweden and the European Union, which may not meet national security requirements for data sovereignty and confidentiality.

Data Sovereignty and National Security Concerns

Swedish authorities expressed concern that proprietary information, including internal government documents and sensitive administrative data, could inadvertently be used to train public AI models. This risk of “data poisoning” or accidental exposure is particularly high when employees use personal accounts for work-related tasks, a practice often referred to as “shadow AI.”

The Swedish Civil Contingencies Agency noted that while these tools offer productivity benefits, the current security architecture of many public AI platforms does not provide sufficient guarantees for protecting classified or protected data. The move aligns Sweden with several other European nations that have tightened restrictions on third-party AI services within the public sector to comply with the Swedish Authority for Privacy Protection (IMY) guidelines and broader European data regulations.

Focus on Secure AI Alternatives

The directive does not constitute a national ban on AI for private citizens or the commercial sector but serves as a protective measure for Sweden’s digital sovereignty. Government departments are now being encouraged to seek alternative solutions that offer local hosting or closed-environment processing, ensuring that all data remains within jurisdictions that comply with Swedish security law.

The block highlights a growing tension between the rapid adoption of large language models (LLMs) and the stringent security requirements of national governments. The MSB has indicated it will continue to monitor the security posture of AI vendors, but for now, the risks associated with unauthorised data exfiltration and the lack of transparent processing methods outweigh the operational advantages.

Government agencies have been advised to audit their existing IT environments to ensure that API access to these services is disabled and that employees are educated on the risks of entering sensitive data into public AI prompts. The Swedish government is expected to release further guidance on the development of a sovereign AI framework for the public sector later this year.