Negotiating Control over Artificial Intelligence: A Case Study of Swedish Municipalities’ Governance of Confidentiality, Integrity, and Availability in Externally Provided AI Systems

Sammanfattning

Artificial intelligence is increasingly adopted in Swedish municipalities through external providers and cloud-based systems. This creates a governance problem, as municipalities remain responsible for protecting confidentiality, integrity, and availability while important technical conditions are controlled outside the organisation. This thesis examines how Swedish municipalities negotiate and exercise such control when adopting and using artificial intelligence through external providers. The study uses a qualitative case study design based on semi-structured interviews with eight participants from seven Swedish municipalities. The material was analysed through reflexive thematic analysis. The findings show that control was negotiated through legal uncertainty, data sensitivity, provider transparency, organisational capacity, and pressure to adopt artificial intelligence. When direct control over systems was limited, municipalities exercised control through provider evaluation, restrictions on data and use cases, information classification, user responsibility, training, fallback routines, and collaboration. The study concludes that municipal control over externally provided artificial intelligence is partial, situated, and continuously negotiated. Formal responsibility remains with municipalities, but practical control depends on what they can understand, restrict, verify, delegate, and keep operational.