What NIS2 means for Swedish companies

On 15 January 2026 the Cybersecurity Act (cybersäkerhetslagen, SFS 2025:1506) entered into force, and with it Sweden’s version of the EU’s NIS2 directive. A covered organisation has to register with the Swedish National Cyber Security Centre (NCSC) and manage cybersecurity risks in a documented way. Its management must be trained and involved, and significant incidents reported within set deadlines.

This article is general information. Check your own case against the act and NCSC’s guidance for covered organisations (in Swedish).

Who is covered?

Eighteen sectors. They include energy, transport, banking and financial market infrastructure, health care, drinking water, digital infrastructure and public administration. Several sat outside the old NIS rules, such as parts of manufacturing, food production and distribution, waste management and postal services.

Size matters too. As a rule, it applies to medium-sized and large organisations in those sectors, sized by the EU definition of company size. That means at least 50 employees, or both an annual turnover and a balance sheet total above EUR 10 million. Some services are covered whatever their size. Among them are DNS service providers, providers of public electronic communications and organisations identified as critical.

Covered organisations fall into two groups. Essential entities face active supervision and higher maximum fines. Important entities are mainly supervised after the fact, when there are signs that something is wrong. Decide for yourselves which group you belong to before you register, and write down how you got there.

Being a supplier to a covered organisation does not by itself bring you under the act. You will still feel it. Your customers are responsible for security risks in their supply chain, so expect questions about how you handle access, incidents and backups.

What does the act require?

A covered organisation has to:

• register with NCSC (organisations registered under the old NIS Act have to register again)
• take appropriate technical and organisational measures based on a risk analysis
• make sure management approves those measures, follows up on them and takes part in training
• report significant incidents

The requirements stay close to the directive. Its measures are deliberately broad. They include risk analysis, incident handling, business continuity and backups, and supply chain security. Secure development and maintenance of systems, access control, multi-factor authentication, encryption and basic security training for staff are among them too. Anyone who has worked with information security will recognise the list, which is now a legal obligation. A supervisor can ask to see the evidence.

Incident reporting deadlines

In Sweden, significant incidents are reported to NCSC through CERT-SE, under detailed rules that have applied since 1 July 2026 (MCFFS 2026:8). The directive sets three deadlines:

1. An early warning within 24 hours of becoming aware of the incident, saying whether it looks malicious and whether it could affect other countries.
2. An incident notification within 72 hours of becoming aware of it, with a first assessment of severity and impact.
3. A final report no later than one month after the incident notification, covering the cause, what you did about it and any cross-border effects.

The gap we find most often is the 24-hour early warning: there is a plan, but nobody has been named to send the warning. Twenty-four hours is short, so decide in advance who reports, through which channel and on what basis. Test it before the first real incident.

Who supervises?

Since 1 July 2026, NCSC has been the central point. Part of the National Defence Radio Establishment (FRA), it receives registrations and incident reports and passes incident reports on to your sector’s supervisor. The Swedish Civil Defence and Resilience Agency (MCF) held that role in the first half of 2026. Supervision is split by sector. Energy companies answer to the Swedish Energy Agency, for example, and transport companies to the Swedish Transport Agency. The Cybersecurity Ordinance (SFS 2025:1507) says which authority supervises which sector.

Supervisors can order an organisation to take measures, carry out security audits and impose administrative fines. As a last resort they can seek a temporary ban on a person holding a management position.

For essential entities, member states must allow fines of at least EUR 10 million or 2 percent of global annual turnover, whichever is higher. The directive’s level for important entities is EUR 7 million or 1.4 percent.

Where to start

If you are unsure where you stand, work through this:

1. Work out whether you are covered and, if so, as an essential or important entity. Write down the reasoning.
2. If you are covered and have not registered, register with NCSC now. Supervisors may act if a registration has not arrived within 14 days.
3. Map what your services depend on: systems, data, suppliers and the people who run them. For cloud providers, a cloud strategy sets which information may run where.
4. Run a risk analysis and compare your current measures with the act. Keep the result to a short gap list, with an owner and a date on each line.
5. Decide how you will detect, assess and report an incident within 24 hours. Then run an exercise.
6. Give management the training, and a short regular report on cyber risk that they can act on.

How we help

We work out with organisations whether they are covered, run gap analyses against the act and set up incident handling that holds under time pressure. Our background is in the defence industry and in regulated SaaS, where requirements like these are daily work. See our cyber security services, or get in touch for a confidential first conversation.