What NIS2 means for Swedish companies

Sweden implemented the EU’s NIS2 directive through the Cybersecurity Act (cybersäkerhetslagen, SFS 2025:1506), which entered into force on 15 January 2026. If your organisation is covered, you have to register with the Swedish National Cyber Security Centre (NCSC), manage cybersecurity risks in a documented way, make sure management is trained and involved, and report significant incidents within set deadlines.

This article is general information. Check your own case against the act and NCSC’s guidance.

Who is covered?

The act lists 18 sectors. They include energy, transport, banking and financial market infrastructure, health care, drinking water, digital infrastructure and public administration. Several sectors were outside the old NIS rules, such as parts of manufacturing, food production and distribution, waste management and postal services.

Size matters too. As a rule, the act applies to medium-sized and large organisations in those sectors, using the EU definition of company size: at least 50 employees, or both an annual turnover and a balance sheet total above EUR 10 million. Some services are covered whatever their size, for example DNS service providers, providers of public electronic communications and organisations that have been identified as critical.

Covered organisations fall into two groups. Essential entities face active supervision and higher maximum fines. Important entities are mainly supervised after the fact, when there are signs that something is wrong. You assess for yourself which group you belong to before you register, and it is worth writing down how you reached that conclusion.

A supplier to a covered organisation is not covered just by being a supplier. You will still notice the act, since your customers are responsible for security risks in their supply chain. Expect questions about how you handle access, incidents and backups.

What does the act require?

The requirements follow the directive closely. A covered organisation has to:

• register with NCSC (organisations registered under the old NIS Act have to register again)
• take appropriate technical and organisational measures based on a risk analysis
• make sure management approves those measures, follows up on them and takes part in training
• report significant incidents

The measures are described in broad terms on purpose. They cover areas such as risk analysis, incident handling, business continuity and backups, security in the supply chain, secure development and maintenance of systems, access control, multi-factor authentication, encryption and basic security training for staff. Little on that list will surprise anyone who has worked with information security. What changes is that it is now a legal obligation, with a supervisor who can ask to see the evidence.

How quickly do incidents have to be reported?

In Sweden, significant incidents are reported to NCSC through CERT-SE, under detailed rules that apply from 1 July 2026 (MCFFS 2026:8). The directive sets three deadlines:

1. An early warning within 24 hours of becoming aware of the incident, saying whether it looks malicious and whether it could affect other countries.
2. An incident notification within 72 hours of becoming aware of it, with a first assessment of severity and impact.
3. A final report no later than one month after the incident notification, covering the cause, what you did about it and any cross-border effects.

Twenty-four hours goes quickly if nobody has decided in advance who reports, through which channel and on what basis. Make that decision, and test it, before the first real incident.

Who supervises?

NCSC, part of the National Defence Radio Establishment (FRA), has been the central point since 1 July 2026. It receives registrations and incident reports, and passes incident reports on to the authority that supervises your sector. That role belonged to the Swedish Civil Defence and Resilience Agency (MCF) for the first half of 2026. Supervision is split by sector: energy companies are supervised by the Swedish Energy Agency and transport companies by the Swedish Transport Agency, for example. The Cybersecurity Ordinance (SFS 2025:1507) sets out which authority supervises which sector. Supervisors can order an organisation to take measures, carry out security audits and impose administrative fines. As a last resort they can seek a temporary ban on a person holding a management position.

The directive requires member states to allow fines of at least EUR 10 million or 2 percent of global annual turnover, whichever is higher, for essential entities. For important entities the corresponding level is EUR 7 million or 1.4 percent.

Where to start

If you are unsure where you stand, this order of work gives results quickly:

1. Work out whether you are covered and, if so, as an essential or important entity. Write down the reasoning.
2. If you are covered and have not registered, register with NCSC now. Supervisors may act if a registration has not arrived within 14 days.
3. Map what your services depend on: systems, data, suppliers and the people who run them.
4. Run a risk analysis and compare your current measures with the act. A short gap list with owners and dates is more useful than a long policy document.
5. Decide how you will detect, assess and report an incident within 24 hours, and run an exercise.
6. Give management the training, and a short regular report on cyber risk that they can act on.

How we help

We help organisations work out whether they are covered, run gap analyses against the act and set up incident handling that works under time pressure. Our background is in the defence industry and in regulated SaaS, where requirements like these are part of daily work. Read more about our cyber security services, or get in touch for a confidential first conversation.