Your responsibility /The whole company
The question comes to you, whoever owns the document.
The board on Tuesday, the large customer before signing, the tender that wants the annex by Friday.
For the CEO, the owners and the board. Included at every level, from the smallest upwards.
Some of the areas that usually sit with you
- Discrimination and active measures 3 documents
- HR and employment law 3 documents
- Information security 4 documents
10 documents written for your company, each with its statute on it.
You own the whole picture without owning the detail. What makes the question uncomfortable is not that you have no answer. It is not knowing whether the answer you are handed is current.
Four people look in four different folders, and somebody sends whichever version was on top. That is how a tender is lost on an annex.
What you are missing is a single view that is true on the day you look at it.
Four situations you meet
- The board asks whether we have this under control
- Where each area stands, with dates
- A large customer sends a security questionnaire
- Information security policy, access routine, data processing agreement
- A tender wants annexes
- Policies in the right version, often a code of conduct
- Someone leaves and takes the knowledge with them
- Written allocation of duties, documented routines
Examples of the documents you get
| DISCRIMINATION AND ACTIVE MEASURES | STATUTE |
|---|---|
| Documentation of active measures | Discrimination Act chapter 3 section 13 |
| Pay survey with analysis | Discrimination Act chapter 3 sections 8 and 14 |
| Guidelines and routines against harassment | Discrimination Act chapter 3 section 6 |
| HR AND EMPLOYMENT LAW | STATUTE |
|---|---|
| Written information on employment terms | Employment Protection Act (1982:80) section 6 c |
| Employee Handbook | Not required by law. The document people actually read |
| Policies every employee is covered by | Follows from each area |
| INFORMATION SECURITY | STATUTE |
|---|---|
| Information security policy | GDPR Article 32 |
| Routine for access and permissions | GDPR Article 32 |
| Supplier requirements | Customer requirements and GDPR Article 28(3) |
| Material for security questionnaires | Customer requirements |
A code of conduct against corruption is not a legal requirement in Sweden. Most public tenders ask for one anyway, so it is worth having even though no authority demands it.
Checked against the Discrimination Act chapter 3, the Employment Protection Act section 6 c and GDPR Article 32 · Updated 10 October 2026
How it starts
The Health Check gives you a list of gaps for the whole company, area by area. You do not have to hand over any personal data to see it.
How it continues
The documents are written for your company and hold together with one another. Change one and you see what it means for the others.