NIS2 in Sweden

The law

Sweden passed a new act for NIS2. It replaces the earlier NIS act (2018:1174). The Cybersecurity Ordinance (2025:1507) took effect on the same date and names the authorities.

Name

Cybersäkerhetslag (2025:1506)Cybersecurity Act (2025:1506)

Published

2025-12-11

In force

2026-01-15

Text

Read the Cybersäkerhetslagen

Who is in scope

Annex I and II activities are in scope from 50 staff, or when turnover and balance sheet both pass EUR 10 million. Large Annex I companies are essential. Most others are important.

Where Sweden differs

• 1 kap. 9 § 3 Cybersäkerhetslagen Medium-sized public electronic communications network providers are essential. Under the Directive they would be important.
• 1 kap. 9 § 3 Cybersäkerhetslagen Medium-sized public electronic communications service providers are essential. Under the Directive they would be important.
• MCFFS 2026:1, 3 kap. 1 § A partner or linked enterprise that meets the size test only through its group is out of scope. This needs an independent production environment and a high degree of independence from the group.
• 1 kap. 5 § Cybersäkerhetslagen An entity of special national or regional importance for a sector is in scope at any size. This applies to entities the rules name.
• 1 kap. 9 § Cybersäkerhetslagen Qualified trust service providers are essential at any size. Larger municipalities and regions are essential.
• 1 kap. 11 § Cybersäkerhetslagen Entities under DORA do not follow the security and reporting duties of chapter 2, sections 3-10.

Also note

• Sweden has no single supervisor. Each sector has its own authority, for example PTS for digital infrastructure and Transportstyrelsen for transport.
• The NCSC at FRA is the single point of contact and the CSIRT.
• Every entity registers with NCSC, whatever its sector. Municipalities and regions register too.

Registration

Register as soon as you know that you are in scope. The Act sets no fixed period. It says to register as soon as possible. Since 2026-02-02 the authorities can act when no registration arrives within 14 days. Send the form by email to nis2anmalan@ncsc.se. NCSC sends a receipt within 2 working days. Report a change within 14 days. You decide yourself if you are in scope. No authority decides this for you.

Portal

NCSC notification form

Rule

The law sets no fixed period

You need

The NCSC notification form (organisation number, sector, essential or important class, internet identifiers such as IP addresses and domains). Your mail server must support TLS.

Changes

Report changes to your data within 14 days

Incident reporting

1. 24 hEarly warning
2. 72 hIncident notification
3. 1 monthFinal reportafter the incident notification

Send the reports to NCSC (FRA), through the NCSC cyber portal.

Trust service providers send the notification within 24 hours. The 24 and 72 hours run from the moment you learn of the incident. The reporting rules in MCFFS 2026:8 apply from 2026-07-01.

Measures and proof

Essential

The supervisory authority supervises continuously under a plan. It can run regular security audits, or let an independent body run them. Prove your measures with your risk analysis and records.

Important

The supervisory authority acts only when it has reason to think you break the rules. It has no set audit cycle for these entities.

The dates, in order

1. 2026-01-15 Act in force
2. 2026-02-02 MCFFS 2026:1 in force. Registration has applied as soon as possible since this date.
3. 2026-07-01 Incident reporting rules (MCFFS 2026:8) in force

Duties of management

Management members must complete training on security measures. A court can ban a manager of an essential entity from a management role for 1-3 years. This needs a prior order that the entity ignored, a serious breach, and intent or gross negligence.

Fines

The ceiling is the higher of a fixed amount and a share of the worldwide annual turnover of the group.

The minimum is SEK 5,000. The % applies to total worldwide annual turnover. A public entity pays at most SEK 10,000,000.