How to build a cloud strategy in Sweden

A cloud strategy decides which information and systems may run in which kind of cloud, and how much control each part needs. It also plans how you would leave a provider. In May 2026 the Swedish government published a cloud policy for the public sector with six principles for these choices. Government agencies, municipalities and regions are its intended readers. It is still the closest thing to an official Swedish answer, and any organisation that holds sensitive information can use it as a framework.

This article is general information. Check your own case against the sources we link to.

What does Sweden’s cloud policy say?

The Ministry of Finance published the policy on 29 May 2026. It is non-binding support. Each organisation makes its own assessment and answers for its own use of cloud services. State agencies under the government, municipalities and regions are its audience, and private organisations that run publicly funded services can use it as well.

The policy lists six principles.

• Work risk-based before you use the cloud.
• Choose efficient cloud solutions.
• Increase the value to the organisation.
• Promote portability and a well-functioning market.
• Keep relevant control over data, operations and technology.
• Set clear requirements for suppliers.

Providers outside the EU stay on the table. With a risk-based approach, the policy says, the public sector can keep using market-leading services from such companies. The choice should be governed by the organisation’s own requirements on function, security, control, sovereignty, robustness and cost. The policy also notes that cloud solutions give economies of scale and can often give a higher level of security than local IT.

Where should a cloud strategy start?

With your information. The policy asks organisations to assess the protection value of information before they put it in a cloud service. Information with a high protection value, and critical functions with high availability requirements, should be handled in solutions with a high degree of control.

Public web content, internal collaboration, personal data, confidential case files and security-classified information can each need a different solution. In the cloud strategies we have written, roughly four in five systems could run in a public cloud. The exceptions were mostly identity, key management and anything security-classified.

What does digital sovereignty mean in practice?

Digital sovereignty is control over your data and systems. The policy defines it as making sure that no outside party can affect, access or deny access to data or necessary functions. It treats sovereignty as a scale. Higher requirements should apply where the risks are greatest, such as critical data and essential public services.

Encryption that keeps the provider from reading stored data counts as a technical measure, and so does separation between customers. Non-technical measures often mean data centres in the EU, staff who are EU citizens and meet the security requirements, and Swedish or EU jurisdiction.

Why jurisdiction? Some countries can require their companies to hand over data, even data stored abroad, and the American CLOUD Act is the example most people know. A European provider can have the same problem, the policy adds, if its home country gives authorities access to data.

For comparing providers, the policy points to the European Commission’s Cloud Sovereignty Framework, which scores a cloud service against eight sovereignty objectives. The levels run from SEAL-0 (no sovereignty) to SEAL-4 (full EU control, from chips to software). When the Commission bought cloud services itself, it required at least SEAL-2, the data sovereignty level.

When is a hybrid cloud the right choice?

A hybrid cloud fits organisations whose information has very different protection values. NIST defines it as two or more separate cloud infrastructures (private, community or public) bound together by technology. That technology lets data and applications move between them.

Mixing is already common in the Swedish state. According to the policy, agencies combine their own IT operations, outsourcing to private suppliers and shared operations with other agencies. The government’s planned AI workshop for the public sector may be built as a hybrid, a community cloud with a high degree of control. That cloud can interact with private providers’ infrastructure.

Hybrid costs you a second environment. Both need securing, monitoring and staff, and that cost pays off when the split follows a real difference in protection value. Data and applications only move between the two if the systems were built for it.

How do you plan to leave a cloud provider?

Plan the exit before you sign the contract. The policy calls it important that public organisations can, when needed, move data and systems quickly to another provider or back in-house. Contracts should contain exit terms. Proprietary services may need a replacement plan decided in advance.

Since 12 September 2025 the EU Data Act has required cloud contracts to let the customer switch provider, or move to its own infrastructure.

• The notice period is at most two months.
• The transition takes at most 30 days. During it, the provider must help and keep the service running.
• After the transition, the customer has at least 30 days to retrieve data.

The provider may stretch the transition to at most seven months, and only if 30 days is technically unfeasible. The customer can also extend it once.

Switching charges end on 12 January 2027. Until then, a switching charge may not exceed the provider’s costs that are directly linked to the switch. Services built mostly for one customer, and not offered at broad commercial scale, are exempt from the charge rules.

Exit terms only help when the systems can move. Containers, infrastructure as code and open data formats make that possible. In one platform consolidation we led, a SaaS company went from three hyperscalers to one.

Can confidential information be stored in the cloud?

For authorities, yes, under conditions. Security-classified information needs its own assessment.

The rule for authorities is Chapter 10, Section 2 a of the Public Access to Information and Secrecy Act. It has applied since 1 July 2023. An authority may give confidential information to a company that only processes or stores it technically for it, unless that is inappropriate in the circumstances.

Security-classified information falls under the Protective Security Act (2018:585), and the policy says its requirements must be checked case by case. Personal data brings in the GDPR rules on transfers outside the EU. The policy notes that the EU-US Data Privacy Framework and its 2023 adequacy decision allow transfers to American companies that have joined it.

Where should you start?

If you have no cloud strategy yet, start here:

1. List your systems and the information each one holds.
2. Classify that information by protection value.
3. Decide for each class how much control it needs and which types of cloud are acceptable.
4. Check each class against the law with legal advice. That covers confidentiality, protective security, personal data transfers and, where it applies, the Swedish NIS2 law.
5. Write exit terms into every cloud contract and compare them with the Data Act.
6. Test an export, so you know how long a move would take.
7. Put the Cloud Sovereignty Framework’s questions to your providers, and set requirements for their supply chains.
8. Plan how work continues if a cloud service stops. The policy calls this important.
9. Review the strategy every year, and whenever the threat level or a provider’s ownership changes.

How we help

We write cloud strategies that hold up against security and regulatory requirements, then build and operate the platforms behind them. The work runs from classifying information and choosing between a hyperscaler, a European provider, on-premises and hybrid, to planning the exit. Our background is in the defence industry and regulated SaaS. Our cloud infrastructure services page describes the work in more detail, or contact us for a first, confidential conversation.