Every entity within the scope of Sweden’s Cybersecurity Act (2025:1506) must register its operations. The Act has applied since 15 January 2026 and registration has been open since 2 February 2026; it must be made as soon as it can be done, and since 1 July 2026 it is the National Cyber Security Centre (NCSC) at FRA that receives it. No authority designates you first. The assessment is yours, and it is you who must get in touch.
This guide walks through registration from assessment to acknowledgement. The details come from the NCSC’s current registration form, updated on 9 September 2026, and from the authority’s guidance. If you have already established that you are in scope, the registration itself takes a morning. If you have not, it is the assessment that takes time, not the form.
Three things have changed since the spring. The recipient is the NCSC at FRA, no longer the Swedish Civil Defence Agency (MCF); the cyber functions moved on 1 July 2026. The e-service with BankID login has been replaced by a form sent by email, so the guidance’s section on the e-service portal no longer applies. And the form was updated on 9 September 2026, so download a fresh copy rather than reusing a saved one.
First: is there a deadline?
No, not in the sense of a date after which registration closes. The Act says as soon as it can be done, and the NCSC states that the supervisory authorities may take action if a registration has not arrived within 14 days. So this is not a deadline ahead of you; it is one most organisations have already passed. That changes nothing about what you should do, only how to think about it: a late registration is a far better starting point in a supervisory review than none at all. Whether a registration was made in time is for the supervisory authority, and ultimately the courts, to decide, and the NCSC stresses that overrunning does not automatically lead to supervision or sanctions.
There is, however, a date that makes registration urgent. On 1 October 2026 the regulations on security measures and management training (MCFFS 2026:11) and the regulations on security audits and security scanning enter into force. The Act’s duties have applied since 15 January; from that day the regulations spell out what is expected, and the question is no longer only whether you are registered, but whether you can show what you are doing. Registration is the first thing a supervisory authority looks at, because it is what tells the authority you exist.
Step 1. Decide whether you are in scope, and write down why
Three criteria must be met at the same time: type of activity, size, and establishment in Sweden.
Type of activity. The activity must fall within one of the 18 sectors in Annex 1 or 2 of the NIS2 Directive: energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management, public administration, space, postal and courier services, waste management, chemicals, food, manufacturing, digital providers and research. It is the actual activity that counts, not the industry code.
Size. The main rule is that medium-sized and large enterprises are covered: at least 50 employees, or turnover and balance sheet total above ten million euro. Linked and partner enterprises must be counted in, so a subsidiary with 30 employees in a group of 400 is not small. The figures are normally taken from the most recently adopted annual accounts.
One nuance. The NCSC’s guidance words the financial test as turnover or balance sheet total above ten million euro, and gives a company with 49 employees and 11 million euro in turnover as an example of a medium-sized one. The EU recommendation behind the definition (2003/361) is read as requiring both figures to exceed the limit. If you fall between the two readings, the safer course is to register and document how you assessed it.
Exceptions in both directions. Municipalities, regions and municipal associations are covered regardless of size under the public administration sector. So are trust service providers, top-level domain registries and DNS service providers, as well as the operators designated in chapter 4 of MCFFS 2026:1, currently within transport and drinking water. Government agencies are covered on their own terms. Conversely, some organisations are large and still fall outside, because the activity they carry out is not the one described in the annexes.
Document the assessment, whichever way it lands. If you conclude that you are not in scope, that documentation is all you have to show if a supervisory authority asks, and the guidance recommends it explicitly. If you conclude that you are, the same note becomes the basis for the “how did you identify yourselves” question in the form.
Step 2. Decide who registers
The rule is one registration per legal entity. A subsidiary with its own registration number registers itself, even if the group has a shared security organisation. A single legal entity active in several sectors lists them in one and the same registration. A municipality registers as one entity for its entire administration, while a municipally owned company is a separate legal entity and is assessed on its own. A foreign organisation registers through its representative in Sweden.
It is the entity that is obliged to register and that is responsible for the accuracy of the information. You may commission someone else, such as a consultant, to fill in and submit the form, but there must then be documentation showing that it is done on your behalf. The form also asks for the contact details of the person submitting it, since the NCSC or the supervisory authority may need to reach that person with questions.
Step 3. Gather the information before you open the form
The form has eight sections. All fields are mandatory unless stated otherwise. This is what is asked for, in the order it appears.
| Section | What is asked for | Worth knowing |
|---|---|---|
| 1. Organisation | Name and registration number as held by the Companies Registration Office, establishment (organisation in Sweden, representative in Sweden, or foreign organisation without a representative), official postal address, email and telephone. Type of registration (new or update) and date. | Use the official address, not an individual’s. Contact details for technical and operational matters can be given voluntarily further on. |
| 2. Sector | Three choices in sequence: sector, vital societal function, and type of activity. Up to ten sectors can be listed, one per row. | Chapter 4 of the guidance is sorted in exactly that order. Look up your sector there before choosing from the drop-downs. |
| 3. Digital services in the EU/EEA | Answered only by providers of DNS services, top-level domains, domain name registration, cloud computing, data centres, CDNs, managed services and managed security services, plus online marketplaces, search engines and social platforms. State the EU/EEA countries where you offer the services or have a legal establishment, with addresses. | Everyone else answers no. Offering services means actively targeting the market in another country, not merely having a customer there. |
| 4. Identification | By law (the main rule on sector and size), by regulation (designated in MCFFS 2026:1 regardless of size), or by both. | This is the conclusion from step 1. If you wrote the assessment down, this field is already answered. |
| 5. DORA | Whether you are subject to the DORA regulation. | Banking and financial market infrastructure answer yes. You still register under the Cybersecurity Act, but security measures and incident reporting follow DORA. |
| 6. Category | Your own assessment of category. | Main rule: large enterprises in Annex 1 are essential, the rest are important, with exceptions in section 2.6 of the guidance. If you belong to both categories, state essential. The category determines whether supervision is planned or event-driven. |
| 7. Internet | Static IP addresses in CIDR notation, domain names without subdomains, AS number if you have your own (optional) and a functional mailbox. First you choose how to provide the details: you are already connected to ANTS, you provide them here and want to connect, or you provide them here and do not want to connect. | ANTS is CERT-SE’s free service for automatic notifications of technical vulnerabilities. Connecting exempts you from the duty to report changed IP addresses within 14 days, and you get the alerts into the bargain. It is the simplest choice for most. |
| 8. Submitter | Name, role (optional), telephone and email of the person submitting, plus a backup address (optional). | The person providing the details certifies that they are correct. Choose someone who will still be around in six months. |
What takes longest is producing IP addresses and domain names in an organisation that has never inventoried them. Ask IT for the list today, and ask for the AS number at the same time if you run your own autonomous system.
Step 4. Fill in the form
The form is an Excel file downloaded from the NCSC page Att anmäla en verksamhet enligt cybersäkerhetslagen. Answers go in the yellow cells, most of them chosen from a drop-down list, and the help texts sit in the column to the right of each section. If you answered yes to the cross-border question, you also complete the Tilläggsinformation sheet, one row per country.
Two practical points that stop many people at the last step: the file name may be at most 40 characters and must not contain å, ä, ö or special characters. A name such as registration-csl-companyname.xlsx works. And send the Excel file as it is, not a printout or a PDF.
Step 5. Submit, and wait for the acknowledgement
The registration is sent by email to [email protected], one email per registration. If you are registering several legal entities, that means several emails. The NCSC only accepts email that is encrypted in transit (TLS). Most email services do this automatically; if your mail server lacks support, the message bounces with an error from your own provider, and you then contact [email protected] or the switchboard on 010-382 80 00 for instructions on another secure route. The registration itself must not be sent to [email protected].
Once the registration has been processed, the NCSC sends an acknowledgement within two working days. If you have not received one within that time, assume the registration did not arrive and follow up. If anything needs clarifying or completing, the NCSC contacts the submitter you named.
Keep the submitted form and the acknowledgement wherever you collect evidence of your security work, with the date. It is the first piece of evidence a supervisory authority asks for, and it should be retrievable without searching someone’s inbox.
Step 6. Keep the registration current
If anything you have reported changes, you must report the change as soon as it can be done, and under the Act no later than 14 days after it occurred. That covers contact details, sectors, category and, unless you are connected to ANTS, IP addresses and domain names. Changes, additions and withdrawals go to the same address, [email protected], with the form’s type of registration set to update. If you later conclude that you are not in scope, the registration can be withdrawn.
After registration, it is the supervisory authority for your sector that you deal with: the Swedish Energy Agency, the Transport Agency, the Financial Supervisory Authority, the Health and Social Care Inspectorate, the Medical Products Agency, the Food Agency, the Post and Telecom Authority or one of six county administrative boards, depending on the activity (section 7 of the Cybersecurity Ordinance). The details reach them via the NCSC. Your next step is the regulations that enter into force on 1 October: risk management, security measures, management training and ongoing audits of whether the measures work.
Frequently asked questions
We have not registered yet. Is it too late?
No. Register now. The duty applies until it is fulfilled, and a late registration is a better starting point in a supervisory review than none at all. The supervisory authority decides whether a registration was made in time, and overrunning does not automatically lead to supervision or sanctions.
Does it cost anything?
No. Neither registration nor connecting to ANTS costs anything.
We are a small company in a covered sector. Should we register?
As a main rule, no. First check your size with linked and partner enterprises counted in, then whether you fall under the exceptions: trust services, DNS, top-level domains, providers of public electronic communications networks or services, municipal and regional operations, or the operators designated in chapter 4 of MCFFS 2026:1. Check the list in the Act and the authority's guidance against your activity. If you conclude that you are not in scope, document why.
We are subject to DORA. Does registration apply to us?
Yes. Banking and financial market infrastructure register under the Cybersecurity Act and answer yes to the DORA question. Security measures and incident reporting then follow DORA, not the Cybersecurity Act’s regulations.
Can our consultant or auditor submit the registration?
Yes, on your behalf. There must be documentation showing that the details are provided for you, and the responsibility for their accuracy remains yours.
Is it the same place incidents are reported to?
Incidents have also been reported to the NCSC since 1 July 2026, but in a separate process with different time limits. Registering the entity and reporting incidents are two different obligations. What incident reporting requires is described on our page about the Cybersecurity Act.
Registration is the first item in our Cybersecurity Act checklist, which walks through the requirements in order with the dates each took effect. It is free and made to be printed and worked through. If you want to review where you stand ahead of 1 October, you can book a walkthrough.
Sources
- Cybersecurity Act (2025:1506), chapter 2 section 2, on registration and on reporting changed circumstances within 14 days
- Cybersecurity Ordinance (2025:1507), on registration with the single point of contact and the National Defence Radio Establishment (FRA) as single point of contact
- NCSC, Att anmäla en verksamhet enligt cybersäkerhetslagen, with the registration form updated 2026-09-09, read 17 September 2026
- NCSC, Omfattas verksamheten av cybersäkerhetslagen and Frågor och svar om cybersäkerhetslagen
- MCFFS 2026:1, the Swedish Civil Defence Agency’s regulations on registration and identification of essential and important entities
- Swedish Civil Defence Agency, Vägledning för anmälan och identifiering av verksamhetsutövare som omfattas av cybersäkerhetslagen, chapters 2 and 3
- CERT-SE, ANTS — Automatiska notifieringar om tekniska sårbarheter