AI analysis: the rules, the technology, the practice

A signed document lies still on a floor of stone tiles. One tile beneath it has shifted, and a gold crack runs through the paper along its edge.

The practice19 October 20266 min read

Why an AI policy stops being true without anyone changing it

An AI acceptable use policy describes the tools as they were when it was adopted. Vendors keep changing them, and the policy stays true only if someone reads the changes against it.

An unmarked envelope casts a long shadow across rows of documents, and the documents that fall inside the shadow are printed in gold.

The technology12 October 20269 min read

Can one email make your AI assistant hand over internal data

Microsoft 365 Copilot reaches what the user has permission to see, including when it reads an email written by someone outside the organisation. Copilot prompt injection can turn that text into instructions, and then permissions set the ceiling on what a single email can extract.

A railway track splitting into several branches, where one branch ends at a gold buffer stop.

Decision support5 October 20269 min read

Agentic AI governance: limits belong in the system, not the prompt

When an AI agent is to run without anyone watching each step, agentic AI governance is no longer a technical question. An instruction in the prompt steers what the agent usually does. A block in the system decides what it can do.

Photomontage of an open budget binder on a dark boardroom table, with a slim server unit lying across a single row and that one row gilded.

Decision support30 September 20269 min read

Who owns the AI line in the leadership team's budget

When AI moves from an experiment budget to a standing line, the line decides who owns the question. A business case for AI therefore has to name a workflow and its owner, not just the licence.

Photomontage of a closed wooden shipping crate with steel banding, alone on a concrete floor, with a single gilded cable running from the side of the crate and out of the frame.

The rules18 September 202613 min read

Who is liable when the software is the product

The EU product liability directive does not name AI in the articles that carry the liability. It says software, and its recitals put a software developer, AI system providers included, in the manufacturer's chair.

Photomontage of a row of closed server cabinets with identical latch hardware, where a single latch carries a gilded seal.

The rules4 September 202610 min read

Who is bound by the EU's cloud and AI proposal

The EU's cloud and AI development proposal contains no general duty for private users. The obligation in Article 29 falls on Member States and Union entities, and for a supplier the requirements arrive instead through the customer's procurement and through the recognition the supplier applies for itself.

Photomontage of a cairn of flat weathered stones stacked on open ground, the joints between the stones gilded all the way from base to crown.

The rules29 August 202610 min read

Do you have to prove your staff are AI literate

EU AI Act Article 4 contains no documentation duty, and the Commission writes "can keep" rather than "must keep". There is no prescribed record, but there is still someone who can ask, and the level is set by someone other than the law.

Photomontage of a pair of spectacles with one lens lifted out of its rim, hovering just above the frame, which otherwise lies undisturbed.

The practice26 August 20267 min read

Who decides when your AI agent has to be rebuilt

OpenAI promises at least six months' notice before a generally available model is retired, Anthropic at least sixty days for publicly released ones, and Google no fixed period at all. An AI agent in production inherits that calendar, and the calendar sets the cost.

A dark card register opened at one point to reveal a hidden inner layer of more cards behind the visible row, with a gold tone on the concealed part.

The practice14 August 20266 min read

Shadow AI is not a security threat to lock out

Shadow AI is described as a security threat, but 57 per cent of employees hide their AI use and almost half breach policy. A ban does not move the behaviour, it makes it invisible, and the duty already sits with the employer.

Screen print of a row of identical sheets of paper in which a single one carries a gold band along its top edge.

The practice6 August 202611 min read

AI Act Article 50: what actually has to be labelled

Article 50 has applied since 2 August 2026, and most people read AI labelling as meaning that anything AI touched has to be marked. The regulation is narrower: two of the five disclosure duties are the provider's, and the exemption for ordinary editing applies to that one. Three are left that are yours.

A data centre hall built as two tiers of server racks, where the upper tier stands in grey and the tier beneath it glows in gold.

The rules4 August 20268 min read

What the DORA regulation requires of your provider's providers

The register of information under the DORA regulation tells you who your providers are. Since the summer of 2025 knowing is not enough, because an answer from your provider does not move the responsibility for what sits underneath.

Screen-printed illustration in warm paper white and charcoal: a large office rubber stamp with a wooden handle lies on a sheet of paper, with three impressions in a vertical column printed in gold beneath it. The stamp itself is matte grey and the only gold in the image is in the impressions.

Decision support3 August 20266 min read

A chief AI officer is countable. Who decides is not

76 per cent of organisations report having a chief AI officer. The appointment is the countable part, but it is the last three AI decisions that show who actually decides.

Photomontage of a stainless steel conveyor belt in a food factory carrying printed sheets of paper in gold instead of product.

The practice3 August 20266 min read

Food manufacturing bought AI for language, not for production

The share of Swedish food producers using at least one AI technology went from 4.71 to 21.39 percent in two years. The share using AI for production processes fell over the same period, and that decides what the sector figure is worth to you.

Decision support3 August 20268 min read

What an AI readiness assessment measures, and what it must never claim

More than half of employees say they conceal their AI use. That turns every figure built on asking into a floor rather than a level, and it is the whole difference between a diagnosis and a score.

Screen print in which a school, a water tower, an office block and a radio mast are linked by lines that meet at a single gold point.

The rules2 August 202610 min read

Which authority supervises the AI Act in Sweden

Sweden has divided the AI Act between five authorities. The split follows the point numbers in Annex III rather than industry, which is why schools and waterworks got the same regulator.

A wall letter box with its hatch open and nothing inside, the inner edge of the empty opening the only gold in the picture.

The rules31 July 20269 min read

Who NIS2 covers in Sweden, and who decides it

NIS2 scope in Sweden is settled by six provisions, and the assessment rests on the operator itself. The size threshold moves in both directions, and essential or important answers another question.

Photographic montage: a round brass instrument dial where a new scale has been laid, torn, over the old one, so the two sets of graduations disagree while the needle stays put.

The technology31 July 20269 min read

Why last year's benchmark figure cannot be compared with this year's

The model releases got the attention. Meanwhile almost every serious measurer published a correction to its own instrument, and one withdrew its measure entirely. That decides how a vendor's figure should be read.

Photomontage: a heavy industrial rotary selector switch, cut out with a hard edge and mounted flat on a printed surface. It has exactly two detent positions and nothing between them, with the lever seated firmly in one of them. The occupied position is the only gold in the image.

The rules30 July 20267 min read

Who reports what when NIS2, DORA and the AI Act overlap

Sweden's Cybersecurity Act exempts firms covered by DORA from incident reporting altogether. The two cyber clocks therefore never start together, and what remains is the deadline nobody gave an outer limit.

A photographic montage: a heavy bound archive ledger lying open and seen from above, its ruled columns filling the frame, with one single row across the page rendered in gold leaf and raised proud of the paper.

The rules30 July 20265 min read

The DORA register lists your AI without calling it AI

The DORA register covers every contractual arrangement for an ICT service and never asks whether the service uses AI. That is why it holds more of your AI than an inventory that goes looking for AI.

A screen print: a completely blank round dial with two pointers of equal thickness running from the same centre. One reaches only a short way around the face, the other far. The short pointer is the only gold in the image.

The practice29 July 20267 min read

Two reporting clocks start when an AI system fails in critical infrastructure

The AI Act allows two days rather than fifteen when a serious incident disrupts critical infrastructure. The obligation is the provider's, but the clock can start running the moment your control room understood what had happened.

A line of identical stone columns receding from the viewer. The nearest are whole, each one after it is more eroded, and the farthest are only stumps.

The technology29 July 20269 min read

When an AI agent is ready for production, and when a rule is enough

A benchmark saying an AI agent can do the task answers the wrong question. The question that decides the cost is how often it does, and there is a measure for that.

A screenprinted machine in clean outline with one rectangular panel of its body left entirely unprinted, bare paper showing where the ink layer should be.

The rules28 July 20267 min read

The Machinery Directive is going. What governs the AI inside

A machine with AI inside looked as though it carried two sets of requirements. Since late July the Machinery Directive and its successor decide alone, and the rules replacing the others are not written yet.

A wall of empty square recesses cut into stone. One block has come loose and sits one step to the side of where it belongs, leaving an empty recess behind it.

The practice28 July 20268 min read

What actually stops AI in healthcare, and which deadline now applies

The guidance the medtech sector cites most often gives 2 August 2027. That date no longer holds. And the obstacle healthcare regions actually report is neither the regulator nor the technology.

Two identical cabinets of dark panelling set in grey stone, the left with two drawers pulled open and the right with most of them open.

Decision support27 July 20269 min read

Europe has caught up on adoption. It has not caught up on use

The share of firms that have adopted generative AI is now effectively the same in the EU as in the US. The share using it in more than two activities is not. The difference is not the technology but how many people can use it, and that is also what is left of Article 4 after this summer's amendment.

A heavy door standing open on a threshold, with a second closed door set further back.

The rules27 July 20269 min read

The EU AI Act high-risk deadline moved. Four things did not

The EU AI Act's high-risk regime moved to 2027 and 2028 in an amendment that took effect this month. A plain reading of what moved, what did not, and which duties still land on 2 August.

Photomontage of a meeting table surrounded by grey chairs, with a single gold chair standing empty and pulled back.

The practice24 July 20266 min read

Who from the union was there when the digital system arrived

In Sweden 88 percent say employees should be involved when new technology is introduced. A Swedish union has measured what actually happens, and the distance between the two is not a matter of opinion.

Photographic montage: a dense stack of blank record cards with a long even row of identical index tabs along the top edge. One card has been pulled out and re-inserted with its tab in a different position, breaking the row. The re-set tab is the only gold in the image.

The technology22 July 20265 min read

Machine logs can be analysed before the integration is built

A language model was run across 16,316 maintenance logs and corrected the maintenance type on one record in four. The logs carried the answer all along; the summaries built from them did not, and that is the difference between owning data and having asked it anything.

A photographic montage: a large hourglass whose lower chamber is divided by a vertical plate, so the falling sand settles into two heaps of unequal size on either side of it. The top edge of the plate is the only gold in the image.

Decision support21 July 20265 min read

Who gets the hour AI saves

71 percent of in-house counsel expect their outside firms to change commercial models. 28 percent of law firms have changed pricing in response to AI, and in that distance it gets decided whether the gain becomes a discount or a margin.

Drawn illustration of a long row of identical desks in an open plan office. Only a few places are in use; the rest stand untouched with their screens dark.

The practice17 July 20268 min read

Which AI tools are actually being used, and where that shows

You do not need to ask which AI tools are being used. The answer is already in the licence data, and it says something uncomfortable: over a third of licences sit unused while AI spend grows faster than anything else.

A screenprinted strongbox whose lock cylinder passes straight through it and continues out beyond the edge of the picture.

Decision support15 July 202610 min read

Who decides whether the data may sit with an American provider

The CLOUD Act follows the provider's control over the data, not the address of the server. What decides the question is not the American statute but which of your own rules is the strictest.

Two identical stone plinths. On the left one a block sits squarely on top, on the right an identical block has spilled over the edge and across the floor.

Decision support13 July 20269 min read

AI is no longer a licence cost. It is a consumption nobody owns

A licence per person is predictable by construction. A consumption cost is unpredictable for the same reason. Most organisations budgeted the second in the mould of the first, and find out once the money is already spent. The question is not which model is cheapest, but what a finished task costs in your organisation and who owns that line.

A railway switch seen close up, where the point blade rests against the stock rail and decides which track applies. The contact edge is marked in gold.

The rules10 July 202611 min read

What the protective security analysis must say about AI tools

The content requirement is not in the Act. The ordinance says what the analysis must identify, the agency regulations list the steps, and which regulation applies depends on who supervises you.

Drawn illustration of a person presenting to a few seated colleagues, pointing at a large presentation board that is completely blank.

The practice9 July 20268 min read

Do you know whether your AI programme worked, and what would show it

Adoption is no longer the question. A third of Nordic organisations have AI in production across the business. But a quarter have no formal metrics, and then nothing can answer whether it got better.

Drawn illustration of a person making a stopping gesture at the front, while row after row of empty workstations with dark screens stretches away behind them.

Decision support7 July 20269 min read

The most expensive AI project is the one that never got a no

The figure that 95 per cent of AI programmes return nothing currently carries half the market's argument. It cannot bear that weight. The conclusion it is used for is still broadly right, for a better reason.

A heavy vault door, shut and locked, standing free on an open floor with neither vault nor wall around it.

Decision support3 July 20269 min read

Is AI banned in security-sensitive work, and what do the rules actually say

The assumption that AI is banned in security-sensitive work is false. Sweden's Security Service writes the opposite: its use will become necessary. What exists are separation requirements, and they follow the classification.

A barrier arm of the kind that blocks a vehicle entrance, raised and standing alone on an empty floor, with no fence or gate around it.

The rules1 July 20268 min read

Does AI have to be procured, and what actually decides it in Sweden

The Public Procurement Act lists six procedures exhaustively, and none of them is tied to a technology. What decides whether a purchase must be advertised is its value. Yet most pilots are stopped by a legal uncertainty that is not there.

What bears on the decision in front of you.

Which AI systems are high-risk, and who decides