Sweden NIS2 Implementation: Cybersecurity Act 2025:1506, authorities and reporting

Sweden's NIS2 rules have applied since 15 January 2026 through the Cybersecurity Act (cybersäkerhetslag, SFS 2025:1506), but the obligations arrived in stages, and the authority that receives your registration and incident reports is not the one that supervises you. This guide covers the Swedish layer only: who is in scope, including municipalities and regions, which of the sector supervisors you answer to, how registration works through NCSC Sweden, the incident clocks and the Swedish significance tests, the security measures regulation in force since 1 October 2026, and the sanctions. It is for CISOs, compliance leads and auditors in organisations with Swedish entities. The Directive itself is in the NIS2 Directive Guide, and the cross-country status table is in the NIS2 Transposition Tracker.

Status checked 14 November 2026: the Cybersecurity Act (2025:1506) and the Cybersecurity Ordinance (cybersäkerhetsförordning, SFS 2025:1507) entered into force on 15 January 2026 and repealed the 2018 NIS Act (2018:1174). Ordinance amendment SFS 2026:623 made the National Defence Radio Establishment (FRA) the single point of contact and CSIRT from 1 July 2026. Section references below are to the Act and Ordinance as published by the Riksdag; the regulations (föreskrifter) were issued by the Swedish Civil Contingencies Agency (MCF) and further guidance is still being published, so check the current texts before relying on detail. This page is not legal advice.

Key takeaways

• Staged start: the Act applied from 15 January 2026, registration opened on 2 February 2026, incident reporting rules applied from 1 July 2026, and the security measures and management training regulation applied from 1 October 2026.
• One front door, many supervisors: registrations and incident reports go to NCSC Sweden at FRA, which forwards them to one of nine named supervisors or one of six county administrative boards.
• Public sector is deep in scope: state authorities, regions, municipalities and municipal associations are covered, and larger municipalities and regions are essential entities with a separate fine ceiling of SEK 10 million.
• Sweden's own significance tests: the incident reporting regulation adds Swedish criteria, such as a loss of 5% of the previous year's turnover and exfiltration of information needing enhanced protection, on top of the Directive's general test.
• Machine identities are in the measures: the Act's access control, asset management and authentication requirements reach service accounts, API keys, certificates and AI agents, and the registration form asks for your IP addresses and domain names.

Timeline: what applied when

Sweden missed the 18 October 2024 transposition date and was among the Member States that received a Commission reasoned opinion in May 2025 (see the tracker). The milestones below are from NCSC Sweden's implementation timeline and the regulations pages of the supervisors.

Scope: who is covered in Sweden

Chapter 1 of the Act sets scope. The private sector test follows the Directive: entities established in Sweden in an Annex I or II sector that are at least medium sized (1 kap. 4 §), plus smaller entities that are sole providers of an essential service, have significant societal impact or special national importance, or provide trust services (1 kap. 5 §). Electronic communications providers are in regardless of size (1 kap. 6 §), and cloud, data centre, CDN, managed service, marketplace, search, social network, TLD registry, DNS and domain registration providers are covered by main establishment (1 kap. 7 §). Swedish specifics:

• Public administration goes wide: state authorities whose decisions affect cross-border movement of people, goods, services or capital, and all regions, municipalities and municipal associations, are in scope (1 kap. 3 §). The government can add further state authorities (1 kap. 8 §).
• Essential status: under 1 kap. 9 § essential entities include state authorities, municipalities and regions larger than medium sized, larger Annex I entities, certain private education providers with degree-awarding permits, qualified trust service providers and entities named by regulation. Everyone else in scope is important.
• Exclusions: the government, the Government Offices, courts, Riksdag agencies, adjudicating boards and municipal and regional councils are excluded (1 kap. 14 §), but the administrations of municipalities and regions are not. Authorities mainly doing security-sensitive or law enforcement work are outside the Act (1 kap. 12 §).
• DORA carve-out: entities covered by DORA are excluded from the measures and reporting provisions in 2 kap. 3 to 10 §§ (1 kap. 11 §). See the DORA and NIS2 Overlap Mapping Guide.
• Sector rules first: where another law sets equivalent security or reporting duties, that law can apply instead (1 kap. 10 §), and classified information under the Protective Security Act (2018:585) is outside the reporting duties (1 kap. 13 §).
• Self-assessment: NCSC states that operators assess for themselves whether they are covered; neither NCSC nor the supervisors make the assessment for you.

Size: Transportstyrelsen's guidance gives the familiar thresholds: essential from 250 employees, or turnover above EUR 50 million and a balance sheet above EUR 43 million; important from 50 employees, or turnover and balance sheet above EUR 10 million. MCF's impact assessment for MCFFS 2026:1 adds sector tests that do not depend on size, for example drinking water suppliers serving at least 20,000 people or an acute hospital are essential.

Scale: MCF's impact assessment for the incident reporting rules records that by mid-April 2026 registrations had arrived from 2,080 companies, 83 state agencies, 19 regions, 264 municipalities and 44 municipal associations, with energy (629) and healthcare (453) the largest sectors.

Who supervises you

The Ordinance names the supervisors in § 7, with regional allocation in §§ 10 to 15. Where two or more authorities supervise the same operator they must agree how supervision is carried out (§ 16). From 1 July 2026 FRA also leads a cooperation forum of the supervisors (§ 40).

The front door: NCSC Sweden is part of FRA, and CERT-SE at NCSC is the national CSIRT. Under the amended Ordinance FRA is the single point of contact (§ 23), the CSIRT (§ 31) and the cyber crisis management authority (§ 35). Registrations go to the single point of contact (§ 5) and incident reports to the CSIRT (§ 6), which forward them to your supervisor. PTS keeps its own power to issue rules for its sectors (§ 37).

Privacy overlap: SFS 2026:623 requires the supervisor to cooperate with the Swedish Authority for Privacy Protection (IMY) on incidents that are also personal data breaches (§ 18). A Swedish significant incident involving personal data still needs its own GDPR Article 33 assessment.

Registration through NCSC

Since 2 February 2026 operators must register as soon as possible (2 kap. 2 §), and report changes as soon as possible and no later than 14 days after the change. Entities without an EEA establishment that offer services in Sweden must appoint a representative. When checked, NCSC's registration page asked for an Excel form sent by TLS-encrypted email to a dedicated address, one email per operator, with a receipt within two working days. Fields requested:

• Organisation name, organisation number, address, email and telephone.
• Establishment in Sweden or Swedish representative.
• Sector and subsector (several can be chosen) and sector activities elsewhere in the EU and EEA.
• How the organisation identified itself as in scope, and whether it is essential or important.
• Internet identifiers: IP addresses and domain names, which CERT-SE uses to match threat information to you.
• Contact details of the person registering.

Keep it current: a new cloud region, a new public IP block, an acquired subsidiary or a retired domain is a change with a 14 day clock. Link the registration record to your asset inventory and certificate inventory so that a change in one triggers a check of the other. See the Asset Inventory and CMDB Security Guide.

Incident reporting clocks and Swedish significance tests

A significant incident is one that has caused or can cause serious operational disruption or financial loss, or significant material or immaterial harm to others (2 kap. 5 §). The clocks run from awareness:

Channel: since 1 July 2026 reports go to NCSC through the cyber portal (cyberportal.ncsc.se), which Transportstyrelsen describes as a first version still in development. MCF's impact assessment noted a fallback solution from 1 July and full system support no earlier than September 2026, so keep the out-of-band contact routes in your playbook.

Swedish criteria in MCFFS 2026:8: MCF's impact assessment for the regulation describes these tests for operators outside the sectors covered by Implementing Regulation (EU) 2024/2690:

• Financial loss of 5% of the previous year's turnover (for public bodies, appropriations or total revenue); the EUR 500,000 fixed sum used in the EU Implementing Regulation was not adopted.
• Exfiltration, alteration or destruction of trade secrets or other information needing enhanced protection, whatever the cause.
• Death or significant harm to health, or significant material or immaterial damage including environmental damage.
• Successful, suspected malicious unauthorised access that could cause serious disruption.
• Recurring incidents, with sector-specific criteria for public administration, energy, transport, drinking water, wastewater and healthcare providers. Planned outages and maintenance are not significant.

Digital providers: DNS, cloud, data centre, managed service and similar providers follow the thresholds in Implementing Regulation 2024/2690 instead. See the NIS2 Implementing Regulation 2024/2690 Guide.

The access test and machine identities: a successful unauthorised access with suspected malicious intent is significant on its own if it could cause serious disruption. A stolen API key or a misused service account that reaches production systems can meet that test before any outage occurs, so your triage must decide quickly whether a credential misuse is malicious. See the Cyber Incident Reporting Requirements Map for other regimes running in parallel.

Security measures and management duties

2 kap. 3 § requires appropriate and proportionate technical, operational and organisational measures based on an all-hazards approach, covering at least the ten Article 21 areas. MCFFS 2026:11, in force since 1 October 2026, adds detail. NCSC's summary groups it as follows:

• Organisational: a systematic, risk-based approach including information classification, risk management, incident and crisis management, follow-up and evaluation, personnel security and management responsibility.
• Technical and operational: security requirements in procurement, development and lifecycle management of IT environments, correct handling and recovery of information and systems, reducing incident risk and impact, and testing to find weaknesses.
• Physical: protection of premises against unauthorised access, protection of equipment and protection against fire and water damage.
• Sector-critical systems: stricter requirements, especially for continuity management and logging.
• Digital sector exception: entities that only operate in digital infrastructure, digital providers, ICT service management, postal services or space are subject only to the management training requirements in chapter 2, because Implementing Regulation 2024/2690 covers their measures.

Management training: members of the management body must undergo training on the security measures (2 kap. 4 §). Keep attendance records and training content as evidence. See the Board Cyber Security Training Guide.

Where machine identities fit: the Act's areas of access control, asset management, authentication and cryptography have no human-only qualifier. The table maps them to the evidence a Swedish auditor can ask for on non-human identities.

See the NHI Inventory Reconciliation and the Secrets Management Guide for the practice behind these rows.

Supervision and sanctions

• Proactive and reactive supervision: essential entities face regular and targeted audits (3 kap. 5 to 6 §§); important entities are supervised when there is reason to believe they do not comply (3 kap. 2 §). Supervisors can request information, enter premises other than homes, and run security scans in cooperation with the entity (3 kap. 3, 4 and 7 §§).
• Fees: a cost-based fee for handling a registration and an annual fee covering supervision costs (3 kap. 11 §).
• Tools: orders (föreläggande) with a conditional fine (vite), a formal remark, a sanction fee, a ban on holding management positions, and a requirement to publish violations (4 kap. 1 and 4 §§).
• Serious violations: repeated breaches, failure to report, failure to remedy a significant incident, ignoring an order, obstructing supervision and giving false information (4 kap. 3 §).

Management ban: for essential entities only, a district administrative court can, on the supervisor's application, ban a person from management roles for one to three years where the entity ignored an earlier order, the violation was serious and the person acted intentionally or with gross negligence (4 kap. 6 to 8 §§). The entity must be given the chance to respond within two years of the violation, and decisions are appealed to the administrative court (4 kap. 12 §, 5 kap. 1 §).

Implementation steps for a Swedish entity

1. Confirm scope and status: record the 1 kap. section that brings each Swedish legal entity in, its essential or important status and the reason. Check the DORA carve-out and any sector law under 1 kap. 10 §.
2. Register and own the record: file with NCSC, name an owner for the registration, and add a 14 day change check to your change process for IP ranges, domains and legal entities.
3. Map supervisors: list each supervisor per entity and sector; where two apply, ask them which leads under Ordinance § 16.
4. Build the reporting playbook: write the Swedish significance tests into triage, test portal access and a fallback route, and run a tabletop that reaches the 24 hour early warning.
5. Gap analysis against MCFFS 2026:11: map current controls to each chapter, flag sector-critical systems for the stricter continuity and logging rules, and plan a refresh when the March 2027 guidance appears.
6. Train the management body: deliver and record the 2 kap. 4 § training, then repeat when the measures change.
7. Evidence for audit: keep a dated pack per area, including the NHI inventory, access reviews and rotation logs. See the Audit Readiness for AI Agents and NHIs.

Measure it: track days from change to registration update (target under 14), time from detection to early warning in exercises (target under 24 hours), percentage of MCFFS 2026:11 requirements with evidence, percentage of non-human identities with a named owner, and management body training completion.

Common failure patterns

• Treating registration as one-off: new IP ranges and domains are not reported within 14 days, so CERT-SE warnings miss you.
• Waiting for the outage: teams report only on downtime and miss the malicious unauthorised access test, which can apply to a stolen token with no service impact.
• Municipal scope gaps: municipal companies and associations assume the parent municipality's registration covers them.
• Wrong supervisor: groups with energy, healthcare and IT services entities route everything to one authority instead of agreeing a lead.
• Human-only access controls: access reviews cover staff but skip service accounts, API keys and agents, leaving the access control area half evidenced.

Practitioner checklist

• Scope memo per Swedish legal entity citing the 1 kap. section and essential or important status.
• NCSC registration filed, receipt kept, owner named and 14 day change check in place.
• Supervisor list per entity and sector, with the lead agreed where several apply.
• Reporting playbook with the 24 hour, 72 hour and one month clocks and the MCFFS 2026:8 criteria.
• Tested access to the cyber portal and a documented fallback route.
• Gap analysis against MCFFS 2026:11, with sector-critical systems flagged.
• Management body training delivered and recorded under 2 kap. 4 §.
• Non-human identity inventory reconciled, owned and reviewed.
• GDPR Article 33 assessment step for incidents that also involve personal data.

Standards and references

• Sveriges riksdag: Cybersäkerhetslag (2025:1506)
• Sveriges riksdag: Cybersäkerhetsförordning (2025:1507)
• Svensk författningssamling: SFS 2026:623 amending the Cybersecurity Ordinance
• NCSC Sweden: Timeline for the Cybersecurity Act
• NCSC Sweden: Registering an operator
• NCSC Sweden: Security measures under the Cybersecurity Act
• Transportstyrelsen: Incident reporting under the Cybersecurity Act
• MCF: Impact assessment for the incident reporting regulations

Related NHI Mgmt Group resources: NIS2 Transposition Tracker, NIS2 Directive Guide, Finland NIS2 Implementation, Denmark NIS2 Implementation. This guide summarises Sweden's Cybersecurity Act and its regulations and is not legal advice.