NIS2 in Sweden: the Cybersecurity Act timeline

On this page

March 2024
SOU 2024:18 published
The inquiry "New rules on cybersecurity" (SOU 2024:18) proposes how to implement the NIS2 directive in Swedish law.
28 May 2024
Consultation period ends
Deadline for authorities, industry bodies, and companies to submit feedback on the proposal.
9 October 2025
Government adopts the bill
Bill 2025/26:28, "A strong protection for network and information systems - a new Cybersecurity Act", is submitted to parliament.
10 December 2025
Parliament passes the law
The Riksdag votes to adopt the Cybersecurity Act (SFS 2025:1506) and the Cybersecurity Ordinance (SFS 2025:1507).
1 January 2026
MSB becomes the Agency for Civil Defence
The agency is renamed and restructured as part of a broader reorganisation of Sweden's civil defence - not a result of the Cybersecurity Act itself, but it affects who you deal with for supervision.
15 January 2026
The Cybersecurity Act comes into force
The law and ordinance take effect from this date. The registration obligation for covered entities begins "as soon as possible" from 2 February 2026.
1 July 2026
Cyber responsibility moves to NCSC
The Agency for Civil Defence's operational and strategic cyber activities move to the National Cybersecurity Center (NCSC) at the National Defence Radio Establishment (FRA). Registrations are received by NCSC from this date.

More changes may come - we'll update this page when they do, instead of writing a new one.

NIS2 in Sweden - Cybersecurity Act timeline