Sweden's data protection authority (IMY) has imposed a fine of approximately EUR 160,000 on Miljödata i Karlskrona, finding that the organisation had insufficient technical and organisational measures in place to ensure the security of personal data it processed.
The case, reported by the European Data Protection Board, centres on information security obligations under the General Data Protection Regulation rather than the EU AI Act directly. However, it is a useful reminder of how national supervisory authorities approach enforcement in this area.
Organisations that process personal data as part of AI systems, including training data, inference logs, or outputs, remain subject to GDPR obligations alongside any requirements under the EU AI Act. Security failings of the kind identified in this case can expose an organisation to parallel scrutiny from both data protection and AI regulators, particularly where an AI system relies on personal data pipelines.
The decision does not specify which technical or organisational safeguards were found lacking, so organisations should not assume any particular control was at issue. What is clear is that the fine reflects a finding of inadequate security measures rather than a finding about a specific breach cause.
As a compliance matter, this enforcement action underscores the continuing relevance of data protection impact assessments and security governance for any organisation building or deploying AI systems that touch personal data. Many obligations under the EU AI Act, including those for providers of high-risk AI systems under Annex III, assume a baseline of data governance and security that overlaps with GDPR requirements.
For organisations preparing for EU AI Act compliance, this case is a signal that regulators continue to treat information security as a foundational obligation, and that gaps identified under data protection law can carry financial consequences that are independent of, but relevant to, AI-specific compliance programmes.