Starting today, Sweden's Government Offices - the administrative machine behind the prime minister and cabinet - is blocking ChatGPT and Claude on staff computers. Civil servants are being directed to Microsoft Copilot, the only AI tool that passed the government's security review. The Swedish Tax Agency and the National Board of Institutional Care have already imposed similar bans, and the Enforcement Authority is preparing its own.
This is not a story about Sweden. It is a story about what happens inside every organisation - including yours - when employees use AI tools that nobody has reviewed, on data nobody is tracking.
What actually happened
The decision was announced internally by Mikael Wettercrantz, the Government Offices' director of digitalisation, and reported by Sveriges Radio. His reasoning is worth reading carefully, because it applies to a 10-person business in Noida exactly as much as to a European government:
"We have seen several examples of problematic use of open AI services. The examples concern both the sensitivity of the information that has been entered and how the AI-generated responses have been handled."
Notice what the concern is. Not that AI is unreliable, or that staff waste time with it. The concern is what goes in: sensitive information typed into consumer AI tools, which then travels to servers run by external companies, under foreign laws, with no contract governing what happens to it. An internal audit at Sweden's Transport Administration separately found roughly 10 different AI services being used in what it called a "widespread and risky way."
That pattern has a name: shadow AI - employees using unapproved AI tools to get work done faster, usually with good intentions, and usually pasting in whatever data is at hand.
Why this matters more in India, not less
Indian small businesses run on exactly the kind of information that should never leave the building uncontrolled: customer lists, GST filings, quotations, employee records, contracts, source code. And unlike a government, most small businesses have no IT department watching which tools staff use.
There is also a legal angle. India's Digital Personal Data Protection Act puts obligations on businesses that handle personal data. If an employee pastes a customer's personal details into a free AI chatbot and that data leaks or is used for training, "the employee did it on their own phone" is not a defence that will comfort the customer - or a regulator.
Sweden's answer was not to ban AI. It was to pick one tool, review it, tighten its settings, and say: use this, not the open internet's free-for-all. That is a model any business can copy.
A one-page AI use policy for a small business
You do not need a legal team. You need clarity on four points:
1. Approved tools, named explicitly
Decide which AI tools staff may use for work, and say so in writing. Enterprise versions of the major tools come with commitments the free versions do not - notably, that your inputs are not used to train models. Treat the free tier of any AI service like a public noticeboard: fine for public information, wrong for anything internal.
2. A short "never paste" list
Customer personal data, financial records, passwords, unpublished designs or code, and anything covered by an NDA. If staff remember only one rule, make it this one.
3. Human review before anything leaves the building
AI output that reaches a customer - a proposal, a price, a support answer - gets read by a person first. Sweden's officials flagged not just what went into AI tools, but how casually the answers were being trusted.
4. Someone owns it
One person (in a small business, usually the founder) is responsible for the tool list, the rules, and revisiting them every few months. AI services change their data policies; your policy should keep up.
The honest catch
A policy on paper does nothing by itself. Sweden's experience shows why: the Transport Administration's "widespread and risky" usage was discovered by audit, not prevented by rules. The moves that make a policy real are boring but effective - install the approved tool for your team, walk them through the never-paste list once, and ask occasionally what people are actually using.
One messy detail in Sweden's own decision: Copilot has Claude models built into it since early 2026. Blocking the front door while a side door exists is a reminder that "approved" needs periodic re-checking.
The bottom line
Governments are drawing lines around AI use because the risks of uncontrolled use are now documented, not theoretical. A small business cannot afford Sweden's audit teams - but it doesn't need them. Four rules, one owner, and an hour of setup will put you ahead of most organisations your size.
If you want help setting up a practical AI and data policy for your team - or choosing tools that fit how your business actually works - talk to us for a free consultation.
