Summary

  • In Sweden's response to the proposed EU Cloud and AI Development Act, PTS objects to draft Article 29(6): a public authority told by a risk assessment to change cloud service would have 12 months from the assessment's conclusion to finish the migration.
  • PTS says a critical-system move usually includes ending the old contract, feasibility work, procurement and implementation. A compressed deadline can threaten service continuity and information security.

The clock begins after the risk assessment. The first job on the agency's desk may still be the old contract. That is the collision Sweden's Post and Telecom Authority, PTS, identified in its 2 October submission to the Finance Ministry on the proposed Cloud and AI Development Act. Draft Article 29(6), as PTS describes it, gives a public body twelve months to migrate to another cloud service when its risk assessment requires such a move. PTS says critical-system replacement generally needs substantially more than a year.

Its list is practical rather than rhetorical: terminate the existing agreement, study what can replace the system, run a procurement, then implement the new system. Those are gates with different owners and review periods. Shoving them all behind the same one-year finish line can make the most hurried stage the one that carries the data and the service. PTS warns that a short transition may increase both operational-continuity and information-security risks. It asks for a longer period or authority to extend one for complex, critical or high-impact systems.

There is another proposed lever in the same response, but it pulls at procurement rather than at the Article 29 risk-review clock. PTS says draft Article 30(2) would require public bodies buying cloud and AI services to use providers recognised at least at Union Assurance Level 1. If an incumbent lacks recognition, a body may need a new contract and supplier. Recognition itself needs a national decision process: PTS warns that Sweden's providers could lose public tenders if that process starts late. A legal label on a service can therefore affect the buyer's shortlist before anyone unplugs a server.

PTS supports the proposal's aim of reducing dependence on a small set of non-European cloud providers, as its public summary states. Its objection is to a timetable that treats a government migration as one administrative step. The submission gives no count of Swedish agencies that would face an Article 29 move or a measured cost of doing one in twelve months.