On 13 April 2026, Sweden's Data Protection Authority Integritetsskyddsmyndigheten (IMY) published the final report of an innovation-sandbox project (case number IMY-2026-6527) conducted with Kalmar municipality (Kalmar kommun) on the use of an AI-based transcription service in social-services casework. IMY's sandbox is a structured guidance instrument under which public and private actors test specific data-protection questions through workshops with IMY's legal, technical and information-security specialists; participation does not exempt projects from data-protection rules.
The use case examined: a social worker meets with an individual; an AI service automatically generates a preliminary memorandum, which the social worker then reviews and finalises before it can be used as the basis for a decision. IMY assessed whether the GDPR provides a lawful basis for the processing of personal data, including special-category data.
IMY concludes that lawful bases can be available, including for the processing of sensitive personal data, but emphasises that processing must be necessary and proportionate. The report identifies human review of AI-generated transcripts and summaries as a non-negotiable safeguard: social workers must be able to inspect and correct outputs, which in turn requires training, time and dedicated support. Risks identified by IMY include inadequate AI literacy, over-reliance on the system, and organisational shortcomings.
IMY sets out organisational and technical measures Kalmar must implement:
- periodic deletion (gallring) of personal data no longer needed;
- encryption in transit and at rest;
- robust access management with logging and regular checks;
- access limited to the minimum necessary.
IMY frames the sandbox finding as guidance for other Swedish municipalities considering similar AI-transcription deployments in social services.