Sweden NIS2: the Cybersecurity Act applies from 15 January 2026
Sweden's Cybersecurity Act (SFS 2025:1506) has applied since 15 January 2026. Who registers where, the incident deadlines, the supervisors and the fines.
Sweden transposes NIS2 with the Cybersecurity Act (SFS 2025:1506), issued by the government on 11 December 2025. The act and its ordinance (SFS 2025:1507) have applied since 15 January 2026. They replace the 2018 act on information security for essential and digital services.
What the act requires
- Registration: covered organisations must notify themselves "as soon as possible". Under the ordinance, the notification goes to the single point of contact, Försvarets radioanstalt (FRA). Changes must be reported within 14 days.
- Security measures: appropriate and proportionate measures based on an all-hazards approach, covering at least ten areas, from risk analysis, incident handling and business continuity to supply chain security, cryptography, access control and cyber hygiene training.
- Management training: the people in an organisation's management must undergo training on the security measures.
- Incident reporting: a first alert within 24 hours of becoming aware of a significant incident; an incident notification within 72 hours (24 hours for trust service providers); a final report within one month. Reports go to the CSIRT, which is also FRA.
Who supervises
Supervision is split by sector. The ordinance names, among others, the Swedish Energy Agency (energy), the Swedish Transport Agency (transport), Finansinspektionen (banking and financial market infrastructure), the Swedish Post and Telecom Authority, PTS (digital infrastructure, digital providers and managed ICT services), and six county administrative boards, which supervise public administration, research, waste management and several manufacturing sectors.
Administrative fines reach the higher of 2% of global annual turnover or the equivalent of EUR 10 million for an essential entity, and 1.4% or EUR 7 million for an important entity. For a public body the maximum is SEK 10 million.
For the state of NIS2 laws across the EU, see NIS2 in October 2026.
What to do now
If you are covered and have not notified FRA, do it now. Then document the ten areas of measures, plan the training for your management and make sure your team can meet the 24-hour, 72-hour and one-month reporting deadlines.
Dazr Compliance turns the NIS2 measures into recurring tasks with owners and evidence, and its incident register counts down the 24-hour, 72-hour and one-month milestones. The interface is available in Swedish.
Sources
- Sveriges riksdag: Cybersäkerhetslag (2025:1506)
- Sveriges riksdag: Cybersäkerhetsförordning (2025:1507)
For information only, not legal advice. Last updated 8 November 2026.
Also available in: Svenska