Checklist: procure AI tools in municipality and region

This checklist is intended as support, not a template to follow slavishly. Every operation is different, and requirements should be proportionate to how sensitive the information is. You decide what weighs heaviest; we help you ask the right questions.

1. Classify the information first

Before looking at tools: what type of data will be handled? Open data, personal data, sensitive personal data, or classified information? The requirements below should be scaled to the answer.

2. Where is data stored and processed?

• In which country and region is the data stored?
• Does processing (not just storage) also take place within the EU/EEA?
• Can an EU region be chosen, and does it apply to your contract level, or only Enterprise?

3. Who owns the supplier? (CLOUD Act)

• Is the supplier or its parent company American? Then the CLOUD Act may give US authorities access even with EU storage.
• For sensitive or classified data: consider a Swedish or European supplier. Our origin marking is a first filter.

4. Sub-processors and AI flows

• Is there an up-to-date list of sub-processors?
• Is entered data forwarded to external AI models (e.g. American ones)?
• Is the supplier allowed to use your data to train its models? (Should be possible to turn off.)

5. Contracts and security

• Is a data processing agreement (DPA) offered with EU standard contractual clauses?
• Encryption at rest and in transit? Strong authentication and logging?
• Incident handling and reporting procedures?

6. AI Regulation and exit

• How does the use relate to the AI Act? Most office tools are low risk, but recruitment and decisions about individuals can be high-risk.
• How can you extract and delete your data if you switch supplier?

7. Weigh together: you decide

No supplier ticks every box. A Swedish cloud platform such as Berget, Elastx, or GleSYS gives strong data control but requires more own work; a large international service is smoother but may involve data protection trade-offs. Weight the questions above against your information classification and your mission.

This does not replace your own data protection and procurement function, but it gives you a common starting point.