Sweden blocked ChatGPT and Claude on government computers starting October 26th.

Sweden's decision comes as government agencies and businesses use artificial intelligence (AI) more and more. Instead of letting employees choose popular AI tools freely, the Swedish government is moving to a system where the use of these tools is controlled. The goal is to reduce the risk of sensitive information being leaked and make sure people are responsible for content created by AI.

According to information released on October 26, 2026, the Swedish Government Office (Regeringskansliet) officially began blocking direct access to OpenAI's ChatGPT and Anthropic's Claude on official computers. Employees were told to use Microsoft Copilot instead. The agency had reviewed this tool and added stronger security measures as required.

Why did Sweden block ChatGPT and Claude?

The Swedish government made this decision because it was concerned about information security. Civil servants were using external AI services without formal agreements explaining how their data would be handled and processed.

Mikael Wettercrantz, the official responsible for digitalization at the Swedish Government Office, said that using AI services without proper rules could put the information security of government agencies at risk.

One major concern is the information that civil servants enter into AI tools to help them with their daily work.

For example, when employees need to summarize a report, analyze a document, or write a draft, they might copy the whole task into a chatbot. This simple action can send data to an outside company's computer systems, which the organization does not directly control.

If a document contains information that has not been published, personal data, internal plans, or restricted information, a risk of information loss begins as soon as the data is sent. This can happen even when the user has no intention of sharing it with others.

The risks are not limited to the possible misuse of data. They also include how long the data is stored, where it is processed, who can access it, what data protection rules apply, and what legal duties the service provider must follow.

In many countries, technology companies may be legally required to give information to government authorities when the law allows it. Therefore, organizations that handle sensitive data need clear contracts and safeguards before allowing employees to use outside platforms.

According to information from Sweden, several government agencies have found cases of AI being used in inappropriate ways. These include putting sensitive information into public services and using AI-generated answers without checking whether they were correct.

This shows that there are two kinds of risk: information entered into AI may not be properly protected, and AI may produce incorrect information that people still use for official work.

Rather than banning AI completely, the Swedish government has chosen to limit which tools employees can use directly in the workplace.

Microsoft Copilot was approved after the agency reviewed its security measures and changed its security settings. However, approval of a tool does not mean that employees can enter any kind of data without first classifying it and applying the right controls.

Notably, some employees can still access ChatGPT or Claude through an internal AI platform developed by the Swedish Government Office. This allows the organization to manage how the tools are used and apply its own safeguards.

Therefore, these measures are not a nationwide ban on ChatGPT and Claude in Sweden. They also do not mean that the two products are considered unsafe in every situation.

The main change is in how AI use is managed. Civil servants cannot independently use AI services at work unless their agency has assessed, approved, and put controls in place for those services.

The Swedish government had already restricted the use of DeepSeek. Similar measures have also been seen at the Tax Agency and several other public agencies in the country, while other agencies are considering what rules to adopt.

Risks when civil servants and employees upload internal documents to AI

Sweden's experience reflects a problem facing many organizations: AI tools are developing faster than the rules used to control them.

In a short time, ChatGPT, Claude, Copilot, and similar platforms have become common tools for writing reports, working with spreadsheets, translating text, summarizing documents, writing code, and analyzing data.

AI can now complete tasks much faster than before, sometimes saving hours of work. But this convenience also makes it easier for people to overlook the difference between information they can share and information they must protect.

For example, a government employee might use AI to summarize legal documents that are already public. This carries a different level of risk from sending an entire work file, citizens' identification data, or documents that have not been approved for publication to an AI service designed for general users.

Similarly, a business employee might ask AI to analyze published financial reports. But the task needs careful controls if the information entered includes private customer lists, business contracts, or investment plans that have not been disclosed.

The important questions are not just which tool is being used, but also what data is sent, how the platform handles it, and whether the user can monitor what happens to it.

AI services designed for businesses often provide different controls from personal versions. These may include central account management, controls over who can access the system, records of how it is used, and specific agreements about how data is processed.

However, the actual level of protection depends on the product, service plan, contract, and system settings. A platform used by a business cannot automatically be assumed to be suitable for handling every level of sensitive data.

Besides the risk of data leaks, AI can also produce information that is wrong or lacks evidence.

An AI system may explain ideas clearly and present data and arguments that seem logical, yet still get the meaning of a text, the background of an event, or the law wrong.

If employees copy AI answers directly into reports without checking them, these mistakes can end up in official documents.

The risks are even greater when AI is used for work that affects citizens' rights, the review of applications, explanations of government policies, or the handling of sensitive information.

Therefore, AI use must be controlled at every stage: the information entered, the way it is processed, and the answers produced. Blocking certain websites or applications is only one part of the solution. It cannot replace proper data management or make users less responsible for their actions.

What should Vietnamese government agencies and news outlets learn from Sweden?

In Vietnam, the use of AI in government agencies, businesses, and newsrooms is growing quickly. It is being used for administrative tasks as well as creating, sharing, and analyzing content.

As AI creates opportunities to work more efficiently, the need to protect data is also becoming clearer in the legal system.

The Law on Personal Data Protection No. 91/2025/QH15, which took effect on January 1, 2026, sets out the responsibilities of organizations and people who control or process personal data, along with related parties.

Law No. 117/2025/QH15 on the Protection of State Secrets and Law No. 134/2025/QH15 on Artificial Intelligence, both of which took effect on March 1, 2026, provide further legal support for protecting information and developing and using AI safely and responsibly.

More specifically, the Artificial Intelligence Law sets out rules for managing AI according to its level of risk. It requires human control and prohibits collecting, processing, or using data for AI in ways that violate data protection rules or other relevant laws.

These laws do not mean that Vietnam has introduced a general ban on ChatGPT, Claude, or other foreign AI platforms in government agencies. However, they set clear requirements for the organizations that put this technology into use.

Based on Sweden's experience, agencies and organizations in Vietnam can create rules for AI use by classifying data before choosing which tools to use.

Employees can use AI to search for, summarize, or edit publicly available information within the permitted limits. For internal documents, personal data, or highly confidential information, the information security team should assess the risks and set suitable procedures for handling the data.

Documents classified as state secrets must be handled according to the rules for protecting state secrets. They must not be sent to external AI services without authorization.

This issue is especially important for news organizations because newsroom data has its own special features.

During their work, reporters and editors may handle people's personal information, sources' phone numbers, documents used to verify facts, unpublished investigation drafts, or information provided by readers.

If newsrooms upload all this material to a chatbot to summarize, rewrite, or analyze it, they may put sources' identities and people's privacy at risk, even if they only intend to make routine work easier.

Therefore, a newsroom's AI policy must clearly state which information can be used with public AI tools and which information must be handled in an approved and protected environment.

For example, editors can use AI to suggest search engine optimization (SEO) headlines based on published content, study search trends, or organize an explanation of a policy. However, sending entire investigation files, source information, or reader data to outside services must be controlled according to how sensitive the information is and what the law requires.

When analyzing data, newsrooms also need to distinguish between combined reports about website visits, article counts, and growth rates, and information that identifies individual users or reveals business details that have not been made public.

A summary of approved results that can be shared may be suitable for AI analysis. By contrast, detailed data containing login details, reader information, or restricted material must be removed, made anonymous, or processed in an environment with suitable safeguards.

Along with classifying data, agencies and newsrooms should set out which types of AI tools employees may use, who can access them, what tasks they can perform, and who is responsible for checking the results.

The rules should include clear instructions so employees know when they can use AI, when they need permission, and which department to tell if they send data by mistake.

Importantly, rules should not rely only on unclear or general bans. If employees have a genuine need to use AI but are not given suitable tools, they may turn to personal accounts or outside services to get their work done. This would make the controls less effective.

A practical approach is to combine an approved AI platform, internal tools for specific tasks, and a security review process for new service providers.

In journalism, checking facts must also remain a priority. AI can help generate ideas, bring information together, process text, and suggest ways to present content. But it cannot replace reporters' and editors' duties to check facts, compare sources, and decide what to publish.

AI-generated content, especially material about law, health, finance, and other subjects that can have a major effect on the public, must be carefully checked for accuracy, context, and the risk of being misunderstood.

More broadly, Sweden's decision shows that the main question for organizations is no longer simply whether to use AI. The more important questions are which tools to choose, how much data they should be allowed to use, and who is responsible for the results.

As AI becomes a bigger part of public services and content production, organizations that create clear, secure, and well-controlled ways to use it will be better placed to benefit from the technology while reducing the risks of information leaks and decisions based on incorrect content.