A checklist for leadership and IT: who is covered, which requirements apply and where to start.
In short
NIS2 is the EU directive behind the Swedish Cybersecurity Act (cybersäkerhetslagen), which has applied since 15 January 2026. If your organisation is covered, you must register with the supervisory authority, run risk-based security measures, report significant incidents within 24 hours, and make sure management is trained and accountable.
Many Swedish companies discovered in 2026 that they fall under a cybersecurity law they had never read. This guide is written by Devies, a Gothenburg-based product and engineering consultancy, for CTOs, IT leaders and compliance owners who need a practical view: whether you are covered, what the law asks for, what it means for the board and management, and what to do in the first 90 days.
Who is covered by NIS2 and the Swedish Cybersecurity Act?
You are covered if your organisation operates in one of the sectors the law lists and meets the size threshold, or if it belongs to a category that is covered regardless of size.
The NIS2 directive (EU) 2022/2555 is the EU law that sets common cybersecurity rules for essential and important entities. Sweden implemented it through the Cybersecurity Act (SFS 2025:1506), which replaced the earlier NIS law. As of October 2026, the number of covered sectors has grown from 7 to 18, according to the County Administrative Boards (länsstyrelserna).
In practice, three questions decide scope:
- Sector. Energy, transport, banking, health, drinking water, digital infrastructure and ICT service management are obvious ones. Less obvious ones include waste management, research, public administration and several manufacturing categories, such as electronics, machinery and vehicles.
- Size. As a rule, medium-sized and large organisations are covered. Under the directive, medium-sized means at least 50 employees or an annual turnover above EUR 10 million.
- Exceptions to the size rule. Some providers, such as DNS services, trust service providers and certain public bodies, are covered regardless of size.
Covered organisations are classed as either essential or important entities. The class matters for supervision and for the maximum fine, not for whether you must comply.
Question
Essential entity
Important entity
Typical profile
Essential entity
Large organisations in high-criticality sectors
Important entity
Medium-sized organisations, or other listed sectors
Supervision
Essential entity
Proactive, can be audited without an incident
Important entity
Mainly reactive, after indications of non-compliance
Maximum fine
Essential entity
EUR 10 million or 2% of global turnover, whichever is higher
Important entity
EUR 7 million or 1.4% of global turnover, whichever is higher
Management ban possible
Essential entity
Yes, 1 to 3 years
Important entity
No
Group structures make this harder. A subsidiary that runs IT operations for the rest of the group can be covered even if the parent company's main business is not. Map each legal entity separately.
What do the NIS2 requirements mean in practice?
The requirements boil down to four obligations: register, manage risk, report incidents and train management.
Register. Covered organisations must register with the authority the government designates "as soon as possible", and report changes within 14 days (chapter 2, section 2). As of October 2026, registration goes to the Swedish Civil Defence Agency (Myndigheten för civilt försvar, MCF), formerly MSB.
Manage risk. The law requires appropriate and proportionate technical, operational and organisational measures based on a risk analysis. Article 21 of the directive lists the minimum areas, and MCF's regulations add detail. Expect to show work in:
- risk analysis and information security policies
- incident handling, business continuity, backups and crisis management
- supply chain security, including your suppliers and service providers
- security in acquisition, development and maintenance, including vulnerability handling
- access control, asset management, multi-factor authentication and encryption
- cyber hygiene, training and regular checks that the measures work
Report incidents. A significant incident is one that causes, or can cause, serious disruption to your services or harm to others. The timeline is strict: an early warning within 24 hours of becoming aware, an incident report within 72 hours, and a final report within one month. As of October 2026, reports go to the National Cyber Security Centre (NCSC) at FRA, according to the Swedish Transport Agency's guidance.
Train management. People in the management of a covered organisation must take training in security measures (chapter 2, section 4).
None of this is new information security thinking. What is new is that it is enforceable, documented and time-bound.
What is management liable for?
Management is personally accountable: the law requires managers to be trained, and serious failures at an essential entity can lead to a temporary ban from holding a management role.
The directive (Article 20) says management bodies must approve the cybersecurity risk measures, oversee how they are implemented and can be held liable for breaches. The Swedish Act makes management training mandatory and adds two strong tools for the supervisory authority:
- Sanction fees. Up to the higher of EUR 10 million or 2% of global annual turnover for essential entities, and EUR 7 million or 1.4% for important entities (chapter 4, section 10).
- Management ban. At an essential entity, a person in management can be banned from a management role for one to three years. This requires that an earlier order was ignored, that the breach was serious and that the person acted intentionally or with gross negligence. A general administrative court decides (chapter 4, sections 6 to 8).
For a board, this changes the conversation. Cybersecurity can no longer be an IT line item that is reviewed once a year. Leaders need a recurring view of the main risks, the status of measures and the incident readiness, and they need evidence that they asked for it.
A practical test: could your CEO explain, in five minutes, who decides whether an incident must be reported within 24 hours, and who sends the report on a Saturday night? If not, that is your first gap.
What should you do in the first 90 days?
Start with scope and ownership, then risk and incident readiness, then the evidence that ties it together.
Days 1 to 30: scope and ownership
- Map every legal entity against the sectors and size thresholds, and write down the conclusion and reasoning.
- Register with MCF if you are covered, or document why you are not.
- Appoint one accountable owner in management and one operational lead.
- Book management training and put cybersecurity on the board agenda.
Days 31 to 60: risk and incidents
- Run a risk analysis of the systems and services that matter most for your deliveries.
- Write a short incident procedure with roles, thresholds for a significant incident and the 24-hour, 72-hour and one-month steps.
- List critical suppliers and check what your contracts say about security and incident notification.
Days 61 to 90: measures and evidence
- Compare current controls with the minimum areas above and build a prioritised gap list.
- Close the quick wins: multi-factor authentication, backups that are tested, and access reviews.
- Run a tabletop exercise of one realistic incident and record what failed.
Keep the documentation light but real. Supervisors look for decisions, owners and dates, not thick policy binders. If you also build connected products or software, the separate EU Cyber Resilience Act applies to the products themselves; see our upcoming guide on how to prepare your product for the Cyber Resilience Act.
Keep reading
From our work
Consilium and Devies Cybersecurity+Consilium Safety Group and Devies Cybersecurity+: a partnership for future-proof cybersecurity in fire, flame and gas safety systems.Read the caseDevies
Want a second opinion?
Devies, a Gothenburg-based product and engineering consultancy, works on questions like this with Nordic product and IT teams. Tell us where you are and we will suggest a sensible first step.
Frequently asked questions
When did the Swedish Cybersecurity Act come into force?
The Swedish Cybersecurity Act (cybersäkerhetslagen, SFS 2025:1506) came into force on 15 January 2026. It implements the EU NIS2 directive and replaced the earlier Swedish NIS law. Covered organisations must register with the Swedish Civil Defence Agency (MCF), take risk-based security measures, report significant incidents and train their management. Registration should happen as soon as possible, and changes must be reported within 14 days.
How do I know if my company is covered by NIS2?
Check three things. First, whether your organisation operates in one of the 18 sectors listed in the Swedish Act, such as energy, transport, health, digital infrastructure or manufacturing. Second, whether it is at least medium-sized: 50 employees or more, or turnover above EUR 10 million. Third, whether it belongs to a category covered regardless of size, such as DNS or trust service providers. Assess each legal entity in a group separately.
What are the deadlines for reporting an incident?
For a significant incident, you must send an early warning within 24 hours of becoming aware of it, an incident report within 72 hours, and a final report within one month of the incident report. As of October 2026, reports go to the National Cyber Security Centre (NCSC) at FRA. The 24-hour clock starts when you become aware, so the procedure must work outside office hours.
Can managers be personally liable under the Swedish Cybersecurity Act?
Yes. Managers must take training in security measures. At an essential entity, a person in management can be banned from holding a management role for one to three years if an earlier order was ignored, the breach was serious and the person acted intentionally or with gross negligence. A general administrative court decides on the ban after an application from the supervisory authority.
Sources
- Cybersäkerhetslag (2025:1506), Sveriges riksdag
- Directive (EU) 2022/2555 (NIS2), EUR-Lex
- Skärpta krav på verksamhetsutövare när ny cybersäkerhetslag börjar gälla, Länsstyrelsen Kalmar län, 15 January 2026
- Incidentrapportering enligt cybersäkerhetslagen, Transportstyrelsen
- Devies cybersecurity services
- Devies CRA Alignment Workshop
