Do we have to negotiate with the union before running a simulation?

If you are bound by a collective agreement, yes, and you must start it yourself before you decide rather than waiting to be asked. It is a duty to negotiate, not a veto: the employer may proceed after negotiating. Engaging the supplier is a separate conversation with a genuine veto attached.

Can we record the simulated calls in Sweden?

The eavesdropping offence covers speech in solitude, conversations between others, and meetings the recorder does not take part in. A party recording its own call is outside all three limbs on the face of the statute. The data protection analysis is separate and the regulator publishes nothing on it.

Which Swedish rule restricts automated calling?

Not the one you would expect. The Electronic Communications Act contains no automatic calling provision at all. The rule is in the Marketing Act and applies only when marketing, defined as measures intended to promote the supply of products. An internal security test is outside it.

Why do our Swedish test calls fail to connect?

Swedish numbers may not be used outside Sweden except by roaming mobiles, and calls arriving over an international interconnect with a Swedish fixed number may not be connected. Originate inside Sweden. A newer rule also lets operators withhold traffic they believe forms part of a fraud.

Compliance

Voice phishing simulations in Sweden

Phone numbers in SwedenProvisioned by Callstrike after approval

Sweden permits an authorised voice phishing simulation against your own workforce, and Callstrike places the Swedish number order for you once a single clearance is through. What shapes the project is industrial relations and call routing rather than data protection: there is a negotiation you have to open yourself, and a second and sharper union right that attaches to engaging us at all.

Phone numbers

Supplied by Callstrike

Local numbers in Sweden, after a one-time approval.

Running a simulation

Permitted, after two conversations

One about the exercise, one about the supplier, and only the second carries a veto.

Consent

Evidence of notice, not permission

The supervisory authority has closed off employee agreement for monitoring purposes.

Getting a phone number in Sweden

One approval per country, completed in the console.

Provisioned by Callstrike after approval

Your company files its regulatory details once for this country. Local rules require the order to be placed by the provider of record, so Callstrike provisions the number on your behalf once the filing is approved. Approval is a one-time, per-country step and usually takes 3 to 5 business days. We only ask for what the regulator requires.

Callstrike places the Swedish order, so the work on your side is one filing in the console rather than a procurement project of its own. What the carrier looks for is matching rather than volume: the address you claim has to be the address the evidence you file actually shows, and it has to sit inside the area that the number's own prefix covers. A head office in one city does not evidence a number in another, and that is the single thing that sends a Swedish filing back.

The part worth planning around is not the paperwork, it is where the call originates. Sweden runs among the hardest number-blocking rules in Europe: a Swedish number may not be used outside the country except by a roaming mobile, a call arriving over an international interconnect while presenting a Swedish fixed number may not be connected at all, and since August 2026 an operator must withhold traffic it believes forms part of a fraud, which is exactly what a well-built simulation is designed to resemble. We originate Swedish traffic inside Sweden for that reason. Carry the consequence into your own planning anyway, because the failure mode here is silence rather than an argument, and silence is hard to diagnose from a campaign report.

01Complete the regulatory clearance formYour administrator, in the Callstrike console. The form asks only for what the regulator requires.
02Approval is granted against your workspaceTypically three to five business days, and once only for as long as you operate here.
03A dedicated number in Sweden is assigned to youCallstrike
04Build and launch the campaignYour team

What you provide	Accepted evidence, any one of
Business addressMust be within locality or region covered by the phone number's prefix; a PO Box is not acceptable where a local address is required.	Certificate of registration, Utility bill, Tax notice, Rent receipt, Title deed
Proof of business registration numberA valid Certificate of Registration (Registreringsbevis) issued by Swedish Companies Registration Office (Bolagsverket), which displays the company’s official organization number (Organisationsnummer).	Certificate of registration

These requirements are set by the carrier and can change. The form in the console is generated from their current rules, so treat it as authoritative and this table as a summary of what to have ready. Checked 2026-09-07.

Is it lawful to run a simulation in Sweden?

The position in short, before your counsel reads the detail below.

Yes, and the rule you would expect to bite is somewhere you would not think to look. Sweden did not put the European restriction on automatic calling systems into its telecoms act; the whole privacy chapter of that act contains no such provision. It is in the marketing act, and it is scoped three layers deep: the prohibition operates only when marketing, the act reaches traders marketing or seeking products in business, and marketing is defined as measures intended to promote the supply of products. An authorised test of your own staff supplies nothing and promotes nothing, so it is outside all three.

What does apply is co-determination, and the two rights involved are routinely run together. The first is a duty to negotiate with the union you hold a collective agreement with before you decide on an important change to operations or to working conditions. Three things follow from the wording. You open it, so waiting to be asked is not compliance. It bites before the decision rather than before the rollout. And it is a duty to negotiate and nothing further: the provision does not require agreement, and its own second paragraph lets you decide and act first where there are exceptional reasons. It is not a veto and should not be planned for as one.

The second right is a veto, the statute's own heading calls it one, and it attaches to us rather than to the test. Before you decide to let someone perform work for you without becoming your employee, you negotiate with the union holding an agreement for that kind of work, and if the central union declares the measure would set aside law or the agreement, or is otherwise contrary to what the sector generally accepts, the measure may not be carried out. Engaging a specialist testing supplier is the shape that provision was drafted for. There is an exception for work that is short-term and temporary or requires special expertise, which a specialist assessment plausibly is, and the veto is limited where the union has no reasonable grounds. Whether it reaches your engagement turns on your own agreements, so put it on the table early rather than discovering it at signature.

Underneath, the basis is the balancing test with a written assessment, and an impact assessment is effectively unavoidable because systematic monitoring of employees sits on the supervisory authority's own list of processing that requires one. Recording is the comfortable part: the Swedish eavesdropping offence has three limbs, covering speech in solitude, a conversation between others, and a meeting the recorder does not take part in, and there is no fourth limb for a conversation the recorder is a party to. That is the scope of the offence as drafted rather than a practice or a gloss. Being outside a crime is not the same as lawful processing, though, and the authority publishes nothing at all on an employer recording an employee's call.

What your company needs to do

6 items, in the order you will need them.

Open the negotiation yourself, before you decideSweden-specificThe duty runs on your own initiative and it bites at the decision, not at the rollout, so a programme that books the negotiation for the week before launch has already missed it. Bring the purpose, the scope, what is collected, who sees it and how long it is kept. Where you are bound by no collective agreement at all, the primary duty narrows to redundancy and transfer questions and does not reach this.
Treat engaging us as its own conversationSweden-specificThis is the one with a veto attached, and it is about letting an outsider perform work rather than about the exercise. Raise it with the union that holds the agreement for that kind of work, and take a view early on whether the exception for short-term work requiring special expertise covers the engagement, because that is a question your own agreements answer and ours cannot.
Write the balancing assessment and treat the impact assessment as owedSystematic monitoring of employees is on the supervisory authority's own list, so the impact assessment is not a judgement call here. Record the purpose, why a less intrusive method would not achieve it, and what you will and will not do with the result. Employee agreement is not the ground you are relying on, and the authority has said so specifically for monitoring.
Decide whether the programme needs audio at allBeing outside the eavesdropping offence settles the criminal question and leaves the processing question entirely open, and the authority has published nothing on an employer recording an employee's telephone call. Whether the call was answered, whether a credential was disclosed and where the person disengaged are all capturable without the audio, which removes the argument rather than winning it.
Plan for the origination path, not just the numberSweden-specificSwedish numbers may not be used outside Sweden except by roaming mobiles, calls arriving over an international interconnect with a Swedish fixed number may not be connected, and a forwarded Swedish number must be hidden before the call reaches the recipient. An offshore Swedish campaign does not produce a suspicious call, it produces no call, and the campaign report will not tell you which.
Tell your workforce the programme existsGive the notice at the programme level and in advance: that exercises of this kind take place, what they measure, who sees the result and how long it is kept. That is what the balancing assessment rests on, and it is the same document the union will ask to see in the negotiation, so writing it once serves both.

The controls that do the work

How Callstrike is configured, and which provision in Sweden each choice answers.

Auto-hangup before disclosure

The bot ends the call at the moment an employee starts to give up a credential or a piece of personal data, so the thing the pretext asked for is never spoken into the system and never stored.

Sweden makes you answer proportionality in writing before the campaign runs, because systematic monitoring of employees is on the supervisory authority's own list of processing requiring an impact assessment. The call ends the instant an employee begins to give up a credential, so the credential is never spoken into the system and the assessment is written about an exercise that measures susceptibility without ever acquiring the thing the pretext asked for. That is the shortest route to a proportionate answer, and it is also the answer to a union asking what you will actually be holding afterwards.

In-call debrief and follow-up

A second voice breaks character as soon as the call ends, explains what just happened and why it worked, and a follow-up email repeats it in writing while the moment is still sharp.

The negotiation puts you across a table from a union before you decide, and what that conversation is really about is what the exercise does to the people inside it. A second voice that breaks character the moment the call ends, with vishing training in writing the same day, is a concrete commitment you can carry into that room, alongside an undertaking that results are never individualised into anybody's performance record.

Consent Management

Two modes: collect consent now, over email, Slack or Teams with a full audit trail per employee; or record that your organisation already has this covered, by uploading the policy, handbook clause or agreement and confirming the scope it applies to. The document is hashed, the attestation is signed and timestamped, and an audit email is issued. Included on every plan.

Sweden's employee instrument is collective, and the supervisory authority has closed off employee agreement for monitoring purposes, so this is not what unlocks the programme and it does not stand in for the negotiation. What it produces is the transparency layer the balancing assessment depends on: a dated record of what staff were told, or a hashed copy of the policy or collective agreement you already rely on with a signed attestation of the scope it covers.

SCORM module

An interactive web presentation on voice-phishing risk, delivered through your own LMS, which then invites the learner to opt into a web call with the bot. A call the person starts themselves in a browser is not a telephone call, so telephony rules do not reach it.

This is the route that keeps teaching while the union conversations run, and in Sweden it also answers the delivery problem. Callstrike's vishing simulator can deliver the same deepfake voice through a web call the learner starts themselves after working through the module, and a call opened in a browser is never carried over the Swedish telephone network at all, so the origination and blocking rules that decide whether a Swedish campaign connects have nothing to attach to.

Consent Management is included on every plan. See AI voice phishing simulation and human-in-the-loop voice phishing for how each is delivered.

The sourced position

Everything above, with the instruments behind it. Every claim cites the statute or the regulator it comes from, so your counsel can verify it rather than rely on our summary.

The basis, and the two different union rights people confuse

Sweden adds no employment-specific processing rule of its own, so the basis is legitimate interests under Article 6(1)(f), documented as an assessment. The supervisory authority has been clear that consent is not available to an employer for monitoring purposes, for the reason that recurs across this cluster: it cannot be freely given by someone who depends on you for their job. An impact assessment is effectively unavoidable, because systematic monitoring of employees sits on the authority's own list of processing that requires one.

Co-determination is where Sweden differs, and it is worth separating two rights that get run together.

The first is the primary duty to negotiate. Before an employer decides on an important change to its operations, or to the working or employment conditions of employees belonging to a union it holds a collective agreement with, it must negotiate with that union on its own initiative. Three things follow from the words. The employer starts it, so waiting to be asked is not compliance. The duty bites before the decision rather than before implementation. And it is a duty to negotiate and nothing more: the provision does not require agreement, does not let the union stop the measure, and its own second paragraph allows the employer to decide and act first where there are exceptional reasons. Do not call it a veto. Where the employer is bound by no collective agreement at all, the duty narrows to redundancy and transfer questions, so such an employer has no primary duty here.

The second right is a genuine veto, and the statute's own heading calls it one. Before an employer decides to let someone perform work for it without becoming its employee, it must negotiate on its own initiative with the union it holds an agreement with for that kind of work, and if the central union then declares that the measure would set aside law or the collective agreement, or is otherwise contrary to what is generally accepted in the sector, the measure may not be decided or carried out. Engaging a specialist testing supplier is exactly the shape that provision is written for. There is an exception where the work is of a short-term and temporary nature or requires special expertise, which a specialist assessment plausibly is, but the union can still require negotiation in a particular case, and a veto is limited where the union has no reasonable grounds for its position. We are setting out the rule and its exception rather than resolving which applies to your engagement, because that turns on your agreements.

The practical sequence for a Swedish employer is therefore: negotiate before you decide, and expect the supplier engagement to be its own conversation rather than an implementation detail of the first one.

Recording your own call, and the layer the criminal code does not answer

The Swedish eavesdropping offence is drafted in a way that answers the participant question without needing a gloss. It punishes someone who secretly listens to or records, by technical means, speech made in solitude, a conversation between others, or the proceedings of a meeting the public may not attend and in which he himself does not take part.

Read the objects. A conversation between others is one the recorder is not party to. The meeting limb says in terms that he himself does not take part in it. There is no fourth limb covering a conversation the recorder is party to. So the participant exception in Sweden is not case law or policy or practice: it is the scope of the offence as drafted, and a party to a call who records it falls outside it on the face of the provision.

Two adjacent provisions are worth knowing without being alarmed by. A separate offence covers unlawfully obtaining access to a message that a communications operator is conveying, which is intercepting somebody else's traffic in the network and is a different act. Another criminalises placing equipment with intent to commit either offence. Neither reaches a participant recording their own call.

Now the honest limit, and it is the same shape as elsewhere in this cluster. Not being a crime is not the same as being lawful processing. Recording an identifiable employee under pressure is personal data processing that has to survive the basis, necessity, proportionality and transparency analysis in its own right. The supervisory authority publishes nothing at all on an employer recording an employee's telephone call, and we are not going to stretch its guidance about sound capture in camera surveillance into a telephony rule it does not make. So the criminal answer is clean and the processing answer is yours to build and to take advice on. The conservative design is the one that keeps working: notice at the programme level that calls may be recorded, retention only as long as the training purpose needs, and tight access.

Where the automated calling rule actually lives

A reader looking for Sweden's automated calling rule will look in the Electronic Communications Act and will not find it. We read the whole of its privacy chapter: it covers traffic and location data, itemised bills, calling line identification, call forwarding, directories, data retention, terminal storage and confidentiality, and it contains no provision on automatic calling systems and none on unsolicited communications at all.

Sweden transposed that part of the European rules into its Marketing Act instead. The provision permits a trader, when marketing to a natural person, to use electronic mail, fax, or automatic calling machines and similar automated systems for individual communication that are not attended by a person, only where that person has agreed in advance. The scope words are layered three deep: the prohibition itself operates only when marketing; the Act applies where traders market or themselves seek products in their business; and marketing is defined as advertising and other measures in business intended to promote the supply of and access to products. An authorised internal security test promotes nothing and supplies nothing, so it is outside all three layers. That is a statement about where the rule reaches, not a permission and not an exemption.

The rule that does reach an AI voice here is European. Article 50 of the EU AI Act has applied since 2 August 2026, and it carries two duties: a system built to interact directly with people must be designed so the person is informed they are interacting with an AI system, and whoever deploys a system that generates or manipulates audio constituting a deep fake must disclose that the content is artificially generated. Both are owed at the latest at the time of the first interaction or exposure. The exceptions on the face of the text are use authorised by law to detect, prevent, investigate or prosecute criminal offence, and evidently artistic or fictional works, where the duty is narrowed rather than removed. Neither reaches an employer testing its own staff, and an employer's own authorisation is not authorisation by law.

One element the text leaves genuinely open, which we are not going to resolve: whether a synthetic voice resembling no identifiable person satisfies a definition requiring resemblance to existing persons, objects, places, entities or events. Where the voice imitates a specific real person, it is inside on any reading. Note also that using a live operator does not take you outside, because the definition covers content that is generated or manipulated, and transforming a real voice in real time is manipulation.

A second article of that Regulation is a constraint on the product rather than on the call, and it is worth locating precisely for that reason. Nothing in it stops an employer running an exercise or recording one. What it prohibits, since 2 February 2025 and at up to thirty-five million euros or seven per cent of worldwide turnover, is using an AI system to infer emotions of a natural person in the workplace, excepted only for medical or safety reasons. So the article is triggered by an analytics feature, not by the campaign. If a platform offers stress scoring, sentiment tracking or a confidence reading drawn from a called employee's voice, that feature is where the question lives, and the gate it turns on is whether the inference comes from biometric data.

Two rules that will drop your call before anyone hears it

Sweden has among the most aggressive anti-spoofing rules in Europe, and they are a delivery constraint rather than a caveat.

Since late 2024 the regulator has required that before a call within Sweden is established from a Swedish number, a check is made that the number is allocated to some provider for use, and if it is not, the call may not be connected. A call entering Sweden over an international interconnect may not be connected where the calling number is a Swedish number intended for fixed telephony. A Swedish number may not be used outside Sweden at all, except by a roaming mobile end user with a Swedish subscription, or where the traffic can be brought to Sweden without arriving over an international interconnect. And where a Swedish calling number has passed a forwarding outside Sweden, the number must be hidden from the called person before the call is connected.

The consequence is the same as in Ireland and Italy but reached by a different route: a Swedish simulation has to originate in Sweden. Presenting a Swedish fixed number from a platform hosted elsewhere does not produce a suspicious call, it produces no call.

There is a second and newer reason a message may not arrive. Since August 2026 operators must withhold a message where the traffic data give reason to believe it forms part of a fraud or is intended to mislead a wider circle of people. That is a judgement made by your carrier about traffic that looks like an attack, which is what a well-designed simulation deliberately resembles. Worth discussing with the originating provider before a campaign rather than after it.

One thing Sweden does not have: there is no dedicated Swedish offence of presenting a false calling number. The enforcement route is the blocking obligation on operators rather than prosecution of the caller.

What the country matrix holds for Sweden

Number types:: Local
Restricted for automated outbound:: None recorded

Generated from the same country matrix the platform enforces at dispatch, so it cannot drift from what you can actually buy.

What the regulator asks of a number holder, which is less than you expect

The Swedish number licence rules are short, and reading them end to end produces a clear negative. A licence to use numbers may be granted to a provider of a public electronic communications network or of publicly available services requiring numbers, and to legal persons or traders where the number is for services of societal importance, directory enquiries, or as a national company number. The application must be accompanied by material showing the applicant's need for numbers. That is the whole documentary requirement. The assessment criteria are competition, efficient number planning, expected demand, the applicant's need and the consequences for others, plus having no overdue licence fees.

So the regulator imposes no Swedish address, no Swedish establishment, no company registration and no end-user identification as a condition of a number licence. We read the whole instrument and the regulator's own application guidance to establish that, rather than inferring it. If your supplier asks for a Swedish presence, that is its own onboarding rather than a rule you can be shown.

The two halves of this page are answering different questions, and it is worth saying which is which. The panel above the seam is the carrier deciding whether it will hand a number to you, generated from its own current rules and asking for the evidence its onboarding needs. The paragraph above is the regulator deciding whether it will grant a number licence at all, and that is where the conditions people expect to find are genuinely absent. Neither one contradicts the other, and reading the carrier's list as a Swedish legal condition is how the local-presence claim ends up in circulation.

The constraint that does exist is about who holds the licence, and it is worth checking in the chain you buy through. The regulator's published position is that the party with the end-customer relationship is the one that needs the licence for the numbers used, that leased numbers feature commonly in fraud and have made it harder for law enforcement to obtain subscriber and traffic data, and that providing number-based services without a licence does not meet the Act's requirements. Ask your supplier who holds the licence for the numbers you will be presenting.

The new cybersecurity act, and who actually supervises it

Sweden's NIS2 transposition is in force. The Cybersecurity Act entered into force on 15 January 2026 and repealed the 2018 information security act, which is worth knowing if your programme documentation still cites the old one.

The obligation that bears on this work sits among the required security measures: entities must take appropriate and proportionate technical, operational and organisational measures on an all-hazards basis covering at least ten listed areas, including basic cyber hygiene practices and cybersecurity training, and personnel security together with access control and asset management. Separately, and unusually directly, the Act provides that the persons forming part of an entity's management must undergo training on security measures. That is a freestanding statutory duty rather than a recommendation, and it is one of the clearer hooks in Europe for exercising the people layer rather than only documenting it.

One correction worth making, because the obvious assumption is wrong. The civil contingencies agency is not the authority under the current ordinance. The national defence radio establishment is the single point of contact, the incident response team and the cyber crisis authority, and sector supervision is allocated separately, with the financial supervisory authority covering banking and financial market infrastructure and the post and telecom authority covering digital infrastructure and providers. Address your notifications accordingly.

For financial entities DORA applies directly, with compulsory awareness and resilience training for all staff and senior management, a testing programme, and threat-led penetration testing for entities in scope. As everywhere in this cluster, social engineering is a standard technique within that testing and is not named in the Regulation, so do not let it be sold to you as a named requirement.

Take this further

Research prompt for your own AI assistant

Paste into Claude, Harvey or your firm's tool to pressure-test the position above.

You are advising on an authorised internal security exercise in SWEDEN. Our own employees receive a simulated voice-phishing call, placed by our vendor on our instruction, to measure susceptibility. No credential is captured or stored. The workforce is informed in advance at the programme level.

Verify or correct each proposition below against primary Swedish sources, and tell me in what order we must do things:

1. LEK ch.9 contains NO automatic-calling and no unsolicited-communications provision; the rule is MFL 19 s, scoped 'vid marknadsforing', with MFL 1 to 3 ss narrowing it further. Confirm an internal test is outside all three layers.
2. MBL 11 s is a duty to negotiate on the employer's own initiative before deciding, and its second paragraph permits deciding first for exceptional reasons. It is not a veto.
3. ⚠ MBL 38 to 40 ss ('Facklig vetoratt i vissa fall') IS a veto and is triggered by engaging a contractor. Assess whether our engagement of a testing supplier falls inside it, and whether the short-term or special-expertise exception applies.
4. The basis is GDPR Art 6(1)(f) with a documented LIA; IMY says consent is unavailable to an employer for monitoring; systematic employee monitoring is on IMY's Art 35(4) list, so a DPIA is owed.
5. BrB 4 kap. 9 a s has three limbs and no limb covering a conversation the recorder is party to, so a participant recording is outside the offence on the face of the text. The processing analysis is separate and IMY has published nothing on it.
6. PTSFS 2024:2 requires allocation checking before connection, bars Swedish numbers from use outside Sweden save for roaming, bars international-interconnect delivery of Swedish fixed numbers, and requires hiding a number forwarded abroad.
7. PTSFS 2023:1 imposes no Swedish address, establishment, company registration or end-user identification as a condition of a number licence, and PTS's position is that the party with the end-customer relationship holds the licence.
8. Cybersakerhetslagen (2025:1506) requires management training as a freestanding duty, and FRA rather than MSB is the single point of contact under the 2025 ordinance.

Flag anything that has changed since September 2026, and identify any obligation in our own collective agreements that this analysis omits.

Common questions

Do we have to negotiate with the union before running a simulation?: If you are bound by a collective agreement, yes, and you must start it yourself before you decide rather than waiting to be asked. It is a duty to negotiate, not a veto: the employer may proceed after negotiating. Engaging the supplier is a separate conversation with a genuine veto attached.
Can we record the simulated calls in Sweden?: The eavesdropping offence covers speech in solitude, conversations between others, and meetings the recorder does not take part in. A party recording its own call is outside all three limbs on the face of the statute. The data protection analysis is separate and the regulator publishes nothing on it.
Which Swedish rule restricts automated calling?: Not the one you would expect. The Electronic Communications Act contains no automatic calling provision at all. The rule is in the Marketing Act and applies only when marketing, defined as measures intended to promote the supply of products. An internal security test is outside it.
Why do our Swedish test calls fail to connect?: Swedish numbers may not be used outside Sweden except by roaming mobiles, and calls arriving over an international interconnect with a Swedish fixed number may not be connected. Originate inside Sweden. A newer rule also lets operators withhold traffic they believe forms part of a fraud.

Elsewhere in Northern Europe

The rules differ by country even inside one region. These are the nearest guides to this one, each showing how phone numbers are obtained there.