NIS2 in Sweden

Key facts at a glance

Is your company in scope? Common Sweden scenarios

Two worked examples of how NIS2 scoping plays out in Sweden. Not sure where you land? Run the free NIS2 scope checker.

What Sweden businesses need to know

• Sweden transposed NIS2 with a new Cybersecurity Act, the Cybersäkerhetslag (SFS 2025:1506), and its ordinance, the Cybersäkerhetsförordning (SFS 2025:1507), both in force since 15 January 2026. The act repealed the 2018 NIS1 act (lagen 2018:1174), which still applies to breaches committed before that date. The European Commission's infringement case INFR(2024)0296, at the reasoned-opinion stage since 7 May 2025, was still open on 29 October 2026.

• Since 1 July 2026 Försvarets radioanstalt (FRA) is the single point of contact, the CSIRT and the cyber-crisis management authority (ordinance 23, 31 and 35 §§, as worded by SFS 2026:623), roles Myndigheten för civilt försvar (MCF) held until 30 June 2026. FRA's Nationellt cybersäkerhetscenter (NCSC) receives the registrations and, through CERT-SE, the incident reports, and the four MCF föreskrifter under the ordinance stay in force unchanged under FRA's responsibility.

• Scope follows the directive's annexes, as originally worded, for operators established in Sweden that are at least medium-sized under Recommendation 2003/361/EC, without its rule on enterprises controlled by public bodies (1 kap. 2 § and 4 §). Public electronic communications provided in Sweden, trust services, TLD registries, DNS services and domain name registration services are in at any size (1 kap. 5 to 7 §§), and the whole organisation is covered, not only the service that brings it in (PTS, NCSC).

• Essential operators (väsentliga verksamhetsutövare) are every state agency in scope; municipalities, regions, Annex 1 entities and degree-awarding private education providers larger than a medium-sized enterprise; public electronic communications providers from medium size; every TLD registry and DNS provider; and every qualified trust service provider (1 kap. 9 §). Every other operator is important (viktig). The requirements are largely the same for both classes; the rules on supervision and sanctions differ (NCSC).

• Public administration reaches the local level: every municipality, region and kommunalförbund is in at any size (1 kap. 3 §), a municipality registers as one operator, and municipal companies are assessed under the other routes, not as public administration. The agencies listed in Annex 1 of the preparedness ordinance (2022:524) are in by name (1 kap. 8 §).

• There is no designation decision: each operator assesses itself and registers (anmälan) with FRA, the single point of contact, as soon as possible, and reports a change at the latest 14 days after it (2 kap. 2 §). Since 1 July 2026 NCSC's registration form goes by e-mail to [email protected], one registration per legal person, and NCSC confirms receipt within two working days. Operators covered by the 2018 act register again.

• Significant incidents go to the CSIRT at FRA, in practice its NCSC through CERT-SE, which forwards them to the supervisors, and are filed in the Cyberportal with Swedish e-identification (ordinance 6 § and 31 §). From becoming aware of the significant incident ('har fått kännedom om incidenten', the words of the directive's Swedish text): the upplysning, the early warning, within 24 hours (2 kap. 5 §); the incidentanmälan within 72 hours, 24 for trust service providers (2 kap. 6 §); a delrapport on request (2 kap. 7 §); and the slutrapport one month after the incidentanmälan or, for an incident still ongoing then, a lägesrapport and the slutrapport within one month after the incident has been handled (2 kap. 8 §).

• What counts as significant is set nationally: MCFFS 2026:8 for most sectors, for example sector activity possible only to a limited extent for more than 12 hours, or financial damage above 5 % of the previous year's turnover; PTSFS 2026:5 for public electronic communications since 15 October 2026; and Implementing Regulation (EU) 2024/2690 for the digital types. A personal data breach is also reported to the Integritetsskyddsmyndigheten (IMY).

• Since 1 October 2026 a national catalogue, MCFFS 2026:11, details the measures of 2 kap. 3 § and binds essential and important operators alike: systematic, risk-based work integrated with how the organisation is run; a coordinator, information owners and system owners; risk-acceptance criteria and an action plan; a yearly follow-up of sector-critical systems; multi-factor authentication; CERT-SE's automatic vulnerability notifications (ANTS); and DNSSEC. An operator active solely in the five sectors PTS supervises applies only its chapter on management training. Reglyze assesses Swedish operators on the NIS2 substrate and does not yet carry MCFFS 2026:11 as a checklist.

• The members of the management (ledningen) undergo training on security measures (2 kap. 4 §), with no interval set by the act, the ordinance or the föreskrift; under MCFFS 2026:11 the management approves and oversees the measures and is informed at least once a year (3 kap. 4 §). A manager of a private essential operator can be banned from a management function for one to three years by the administrative court, on a supervisor's application, after an unheeded order and a serious breach caused intentionally or by gross negligence (4 kap. 6 to 8 §§).

NIS2 in Sweden: frequently asked questions

Is NIS2 in force in Sweden?

Yes. The Cybersäkerhetslag (SFS 2025:1506) and the Cybersäkerhetsförordning (SFS 2025:1507) have applied since 15 January 2026, after the Riksdag adopted the act on 10 December 2025. The föreskrifter followed: registration from 2 February 2026 (MCFFS 2026:1), incident reporting from 1 July 2026 (MCFFS 2026:8), and security measures, management training and security audits from 1 October 2026 (MCFFS 2026:11 and 2026:12). The European Commission's infringement case for late transposition was still open on 29 October 2026.

Who receives a Swedish operator's registration and incident reports?

Försvarets radioanstalt (FRA), since 1 July 2026: it is the single point of contact that receives the registrations (ordinance 5 § and 23 §) and the CSIRT that receives every incident report (6 § and 31 §), in practice through its Nationellt cybersäkerhetscenter (NCSC) and CERT-SE, which forward the reports to the supervisors. Operators report only to NCSC, not to their supervisor. Reports are filed in the Cyberportal with Swedish e-identification and may be written in English; when it cannot be used, NCSC's fallback procedure applies and the deadlines still run. Myndigheten för civilt försvar held these roles until 30 June 2026.

When does the Swedish incident clock start?

When the operator becomes aware of the significant incident: the act counts the 24 hours of the upplysning and the 72 hours of the incidentanmälan from the moment the operator 'har fått kännedom om incidenten', the words of the directive's Swedish text (2 kap. 5 § and 6 §). MCFFS 2026:8 and NCSC describe that moment as the incident being identified as significant, and the government's bill rules out waiting for a more thorough assessment. Trust service providers file the incidentanmälan within 24 hours; the Cyberportal's own page counts those 24 hours from the occurrence, but the act counts them from awareness.

Does MCFFS 2026:11 apply to every Swedish operator?

To every essential and important operator since 1 October 2026, with binding provisions and non-binding general advice, except an operator active solely in digital infrastructure, digital providers, ICT service management, postal and courier services or space, which applies only its chapter on management training (1 kap. 2 §). The digital types among them apply Implementing Regulation (EU) 2024/2690; for telecoms, space and postal services PTS has not yet issued its measures föreskrifter, and until it does, PTS treats the repealed PTSFS 2022:11 as the floor for telecoms. Contracts made before 1 October 2026 are to be supplemented with cybersecurity requirements where possible (4 kap. 1 §).

How does a Swedish operator register under the Cybersäkerhetslag?

It assesses itself, since there is no designation decision, and registers with FRA, the single point of contact, as soon as possible (2 kap. 2 §): an established operator immediately after the act entered into force, a new one when its activity starts (government bill). Since 1 July 2026 NCSC's registration form is sent by e-mail, encrypted in transit (TLS), to [email protected], one registration per legal person, and NCSC sends a receipt within two working days; changes go to the same address within 14 days. NCSC's page asks for a registration within 14 days, but the act sets 'as soon as possible' for the first registration and 14 days for changes only.