The Swedish Cybersecurity Act
Sweden’s implementation of the NIS2 Directive. What the law requires, when each requirement starts to apply, and how to tell whether your organisation is in scope. Operating in another EU country? Compeas carries the national NIS2 version for nine more countries.
Every requirement now applies
The Cybersecurity Act (2025:1506) and its ordinance (2025:1507) took effect on 15 January 2026. The Act’s obligations have applied since then, and since 1 October 2026 every regulation that spells them out applies too.
Registration has been open since 2 February 2026. The duty follows from the Act, and there is no date on which it closes. Since 1 July 2026 the NCSC at FRA receives registrations. Registering is the operator’s own responsibility — no authority identifies you first, and failing to register is a demonstrable deficiency once supervision begins. Since 1 October 2026 the regulations on security measures, management training and security audits apply as well. How to register, step by step.
How the regulations have been phased in
These dates follow the official implementation timeline published by Sweden’s National Cyber Security Centre.
Act and ordinance take effect
The Cybersecurity Act (2025:1506) and the Cybersecurity Ordinance (2025:1507) came into force, replacing the earlier NIS regulation.
Registration opens
The regulation on registration and identification of essential and important entities took effect. The registration service opened at the Swedish Civil Defence Agency (MCF), which took over the Swedish Civil Contingencies Agency’s role in this area on 1 January 2026 — older guidance referring to MSB now means MCF. Since 1 July 2026 the NCSC at FRA receives registrations. Entities are expected to register as soon as possible.
Incident reporting begins to apply
The regulations on incident reporting and information obligations took effect. From this date reports are received by the NCSC at FRA.
Security measures, management training and security audits
Two regulations took effect the same day. One governs security measures and management training — risk management, technical and organisational measures, and the competence and accountability of the management body. The other governs security audits and security scanning: how compliance is to be verified and documented on an ongoing basis.
Is your organisation in scope?
The general rule turns on sector and size — but there are significant exceptions in both directions.
- Sector
- You are in scope if your activity falls within one of the 18 sectors in Annex I or Annex II to NIS2 — among them energy, transport, banking and finance, health, drinking water, waste, digital infrastructure, digital providers and research.
- Size
- Medium and large enterprises are covered. Small and micro enterprises are, as a general rule, not.
- Regardless of size
- Some entity types are covered irrespective of size, for example trust service providers, DNS service providers, top-level domain registries and providers of public electronic communications networks or services, and sole providers of a service essential to society or entities of particular national or regional importance (chapter 1, section 5 of the Act).
- Public sector
- Swedish municipalities and regions are covered through the public administration sector.
- Essential or important
- The classification follows mainly from the size of the organisation and from which annex the entity type appears in. Essential entities are subject to planned supervision and higher sanction ceilings; important entities are supervised on an event-driven basis.
- Registration
- Registration should be made as soon as possible, and there is no date on which it closes. Since 1 July 2026, registrations are received by the National Cyber Security Centre (NCSC) at FRA using a form sent by email. How to register, step by step.
Who supervises you?
Supervision is split. One agency coordinates; six exercise operational supervision by sector.
- Coordinating
- The Swedish Civil Defence Agency (MCF) is responsible for overall coordination and common regulations, including the regulation on registration. The registration itself has been received by the NCSC at FRA since 1 July 2026. MCF complements the sector authorities rather than replacing them.
- Sector supervision
- The Swedish Energy Agency for energy, the Transport Agency for transport, the Financial Supervisory Authority for banking and finance, the Health and Social Care Inspectorate for healthcare providers, the Medical Products Agency for the rest of the health sector, the Food Agency for food and drinking water, the Post and Telecom Authority for digital infrastructure, digital providers, B2B ICT services, postal services and space, and six county administrative boards for public administration, waste, research, chemicals and parts of manufacturing.
- Incident reporting
- Since 1 July 2026 incidents are reported to the National Cyber Security Centre at FRA — not to MCF, and not to the sector authority. Registering the organisation has gone to the NCSC since the same date, but in a separate process with different time limits.
What the requirements mean day to day
The law describes what must be achieved. This is the work that follows from it.
Risk management
Identify, assess and treat risk systematically, and be able to show how you got there. Inherent risk, the treatment chosen and the residual that remains all need to be traceable.
Measures, with evidence
Technical and organisational measures must be implemented, documented and demonstrable — not described in a policy nobody has followed up on.
Incident reporting
Report incidents that cause, or could cause, significant disruption. That assumes someone owns the process and the underlying record exists when it is needed.
Management accountability
Responsibility sits with the management body, which must also undergo training. The duty follows from the Act itself; since 1 October 2026 the regulations have set out what it requires in detail.
Supply chain
The security of suppliers and service providers is in scope. That requires a current supplier register and an assessment that is maintained over time.
Continuous, not once
Supervision of essential entities is planned rather than reactive. The record needs to be current when the question arrives, not assembled afterwards.
A record that holds up when supervision asks
Compeas is a European GRC platform that keeps the risk register, policies, controls and evidence in one place — with data that stays inside the EU.
Read further at the authorities
This page is a summary and does not replace the legislation or the authorities’ own guidance. Always check against the source.
- NCSC — Det här är cybersäkerhetslagen
- NCSC — Tidsplan för införandet av cybersäkerhetslagen i Sverige
- NCSC — Omfattas verksamheten av cybersäkerhetslagen
- NCSC — Att anmäla en verksamhet enligt cybersäkerhetslagen
- Sveriges riksdag — Cybersäkerhetslag (2025:1506)
- Sveriges riksdag — Cybersäkerhetsförordning (2025:1507)
Every requirement now applies. Are you ready?
Book a walkthrough and we will go through where you stand against the Cybersecurity Act, and what is left to do.