Skip to content
Nisenta
Log in

Sweden's Cybersecurity Act (NIS2): what it requires

What the EU's NIS2 directive actually means in Sweden - and what the Swedish Cybersecurity Act requires of you.

Updated:
On this page
  1. The NIS2 directive vs. the Cybersecurity Act
  2. Who is covered?
  3. What does the law require?
  4. Municipalities and regions
  5. Management responsibility
  6. Supervision by sector
  7. Administrative fines
  8. The Cybersecurity Act and GDPR

The NIS2 directive vs. the Cybersecurity Act

NIS2 (EU 2022/2555) is the EU's revised cybersecurity directive. An EU directive doesn't automatically become national law - each member state has to implement it through its own legislation. In Sweden that law is the Cybersecurity Act (SFS 2025:1506). It is supplemented by the Cybersecurity Ordinance (SFS 2025:1507) and has applied since 15 January 2026.

See the full timeline for the Cybersecurity Act

Who is covered?

The law applies to medium and large organisations in 18 sectors, divided into essential and important entities, and some entities are covered regardless of size. It is up to each organisation to assess whether the law applies and to register with its supervisory authority.

All 18 sectors with examples

What does the law require?

The requirements fall into five areas:

  • Systematic, risk-based information security work, with risk-management measures proportionate to the risks.
  • Incident reporting in three steps: early warning within 24 hours, incident notification within 72 hours and a final report within one month.
  • Supply-chain security, i.e. requirements on and follow-up of suppliers.
  • Business continuity planning, so operations can continue or be restored after an incident.
  • Training: management must be trained and other staff must be offered training.
The NIS2 checklist step by step

Municipalities and regions

Public administration is one of the sectors, and in Sweden it covers not only central government agencies but also municipalities and regions. Exemptions include the Government, the courts, the Riksbank and municipal and regional assemblies. A few things differ from private entities:

  • The law applies to the municipality or region as a whole, not department by department. Municipal companies, such as water or energy companies, can also be in scope in their own right within their sector.
  • What the law calls management is, in a municipality, the municipal executive board (in a region, the regional executive board). It must approve the risk-management measures and undergo training.
  • Supervision of municipalities and regions sits with six county administrative boards, each covering a geographical area.
  • The maximum administrative fine for public entities is SEK 10 million.

Management responsibility

The Cybersecurity Act explicitly places responsibility on management - in a company usually the board and CEO. Management must approve the risk-management measures, ensure they are implemented and undergo training in risk management itself. The practical work can be delegated, but not the responsibility. In essential entities, a member of management can, in serious cases, be temporarily prohibited from exercising managerial functions. Document management decisions and completed training - that is what you show in an inspection.

Supervision by sector

Since 1 July 2026, national responsibility lies with the National Cybersecurity Center (NCSC) at the National Defence Radio Establishment (previously MSB, then the Swedish Agency for Civil Defence), and incident reports are received by CERT-SE. Supervision itself is split between sector authorities under the Cybersecurity Ordinance:

  • Swedish Energy Agency - energy.
  • Swedish Transport Agency - transport and manufacturing of motor vehicles and other transport equipment.
  • Finansinspektionen (Financial Supervisory Authority) - banking and financial market infrastructure.
  • Health and Social Care Inspectorate (IVO) - healthcare providers.
  • Swedish Medical Products Agency - other healthcare and medical devices.
  • Swedish Food Agency - drinking water, waste water and food.
  • Swedish Post and Telecom Authority (PTS) - digital infrastructure, ICT service management, digital providers, postal and courier services, and space.
  • County administrative boards of Norrbotten, Stockholm, Skåne, Västra Götaland, Örebro and Östergötland - including municipalities and regions.
Read the Cybersecurity Ordinance (2025:1507, Swedish)

Administrative fines

The supervisory authority can order an organisation to remedy deficiencies and impose administrative fines for infringements. The fine is at least SEK 5,000 and at most:

  • Essential private entities: the higher of 2 percent of global annual turnover and €10 million.
  • Important private entities: the higher of 1.4 percent of global annual turnover and €7 million.
  • Public entities, such as municipalities and regions: SEK 10 million.

The Cybersecurity Act and GDPR

Many incidents that must be reported under the Cybersecurity Act are also personal data breaches under GDPR. Two reporting chains then run in parallel: to CERT-SE under the Cybersecurity Act and to the Swedish Authority for Privacy Protection (IMY) under GDPR. The risk work, however, can often be done once for both.

NIS2 and GDPR - how to coordinate