What security-sensitive activity means, the duties it triggers, what changed in 2026, and the first steps for operators and their suppliers.
In short
Säkerhetsskyddslagen (SFS 2018:585) applies to any public or private organisation that, in any part, conducts activities of importance to Sweden's security. Covered operators must analyse their protective security needs, notify their supervisory authority, protect information, premises and staff, and sign security agreements with suppliers. Fines reach SEK 50 million.
The Swedish Protective Security Act, säkerhetsskyddslagen, protects activities that matter for national security against espionage, sabotage, terrorist offences and other serious threats. It is often mixed up with the Cybersecurity Act that implements NIS2, but it serves a different purpose and has its own duties. This guide is written by Devies, a Gothenburg-based product and engineering consultancy, for leaders in companies, municipalities and agencies who need to know whether the law applies to them, and for IT and product suppliers whose customers do.
Who does säkerhetsskyddslagen cover?
The law covers anyone who, in any part of their organisation, conducts security-sensitive activity, whether it is a government agency, a municipality or a private company.
According to chapter 1, section 1 of the law text, security-sensitive activity (säkerhetskänslig verksamhet) is activity of importance to Sweden's security or covered by an international protective security commitment binding on Sweden. Security-classified information is information about such activity that is, or would have been, secret under the Public Access to Information and Secrecy Act. It is graded in four classes, from begränsat hemlig (restricted) through konfidentiell and hemlig to kvalificerat hemlig (top secret), by the damage disclosure could cause.
No list says which organisations are covered. Säkerhetspolisen states that each operator must make the assessment itself, and it publishes indicators to help. Typical candidates include energy, telecoms, transport, water, defence industry, finance, healthcare, and suppliers of critical IT systems or data centres to these sectors. Only one part of the business needs to be security-sensitive for the law to apply to that part.
What does the law require?
The law requires covered operators to analyse their needs, plan and take protective measures, check their own protection and report to the authorities.
Duty
What it means in practice
Where in the law
Protective security analysis (säkerhetsskyddsanalys)
What it means in practice
Identify classified information and security-sensitive activity, the threats against them and the vulnerabilities; document it
Where in the law
Ch. 2, s. 1
Information security
What it means in practice
Protect classified information and security-sensitive IT systems against disclosure, alteration, unavailability and destruction
Where in the law
Ch. 2, s. 2
Physical security
What it means in practice
Prevent unauthorised access to areas, buildings and objects
Where in the law
Ch. 2, s. 3
Personnel security
What it means in practice
Ensure only security-reliable people take part, with security vetting (säkerhetsprövning) and training
Where in the law
Ch. 2, s. 4
Notification
What it means in practice
Notify the supervisory authority without delay when security-sensitive activity starts or stops
Where in the law
Ch. 2, s. 6
Security manager
What it means in practice
Appoint a säkerhetsskyddschef unless clearly unnecessary
Where in the law
Ch. 2, s. 7
Security agreement (säkerhetsskyddsavtal)
What it means in practice
Required before a supplier gets access to information at konfidentiell or higher, or equivalent activity
Where in the law
Ch. 4, s. 1
Special assessment and consultation
What it means in practice
Assess and document suitability before procedures and transfers; consult the authority at hemlig or higher
Where in the law
Ch. 4
Security-threatening events must also be reported promptly to Säkerhetspolisen, even when another authority supervises the operator. The protective security ordinance (SFS 2021:955) and the supervisory authorities' regulations set out the details.
Many controls overlap with an information security management system. Our explainer on ISO 27001 shows how such a system is structured, but certification does not replace the analysis and duties above.
What changed in 2026, and what are the deadlines?
As of October 2026, the law has applied since 1 April 2019, was significantly tightened on 1 December 2021, and was amended again on 1 July 2026, with a new notification duty from 1 January 2027.
Date
Change
1 April 2019
Change
Säkerhetsskyddslagen (SFS 2018:585) enters into force, replacing the 1996 act
1 December 2021
Change
Duty to notify the supervisory authority, special assessments before transfers and security agreements, sanction fees up to SEK 50 million
1 July 2026
Change
Amendment SFS 2026:764: supervisory authorities can intervene in procedures that expose security-sensitive activity even when no security agreement is required, and can supervise actors other than the operator; property transfer rules also tightened
1 January 2027
Change
The new duty to notify certain such procedures must be met
The 2026 amendment follows the government's bill Prop. 2025/26:182, which argued that agreements and partnerships outside the old security-agreement rules could still expose sensitive activity. A further bill presented in July 2026 proposes higher sanction fees for private operators from 1 January 2027; as of October 2026 it is a proposal, not law.
Supervision is shared. Säkerhetspolisen and the Swedish Armed Forces coordinate, and sector authorities such as the Swedish Post and Telecom Authority and the Swedish Transport Agency, as well as some county administrative boards, supervise their areas. Under chapter 7, sanction fees range from SEK 25,000 to SEK 50 million, with a ceiling of SEK 10 million for state agencies, municipalities and regions. The Post and Telecom Authority has issued fees of SEK 12.5 million and SEK 15 million to telecom operators.
How does it relate to NIS2 and the Cybersecurity Act?
The Cybersecurity Act protects the continuity of essential and important services, while the Protective Security Act protects national security, so an organisation can be covered by both.
A regional energy company, for example, can fall under the Swedish Cybersecurity Act and NIS2 for its electricity distribution, and under säkerhetsskyddslagen for a control system whose sabotage would affect national security. The duties differ: NIS2 focuses on risk management and incident reporting to the national authorities, while säkerhetsskydd adds classification, vetting of people, security agreements with suppliers and consultation before outsourcing. Plan the two together, using one risk process and one incident process with two reporting routes.
First steps: a checklist for operators
The first steps are to find out whether any part of the business is security-sensitive, document the analysis, and bring suppliers inside the protection.
- Assess whether you are covered. Use Säkerhetspolisen's indicators and document the reasoning, also when the answer is no.
- Notify the supervisory authority if you conduct security-sensitive activity, and record the date.
- Write the protective security analysis. Identify what must be protected, the threats and vulnerabilities, and the classification of information.
- Appoint a security manager with a mandate and direct access to management.
- Plan measures for information security, physical security and personnel security, including which roles need vetting.
- Review suppliers and cloud services. Identify every supplier with access to sensitive information or systems, decide where a security agreement is needed, and run the special assessment before signing.
- Map ongoing procedures that could fall under the notification duty from 1 January 2027.
- Prepare for incidents. Link security-threatening events to your incident response plan, with the report to Säkerhetspolisen as a defined step.
- Check your own protection regularly and keep evidence, since failing to check is itself a sanctionable breach.
Keep reading
From our work
Client Case: ZenseactHow Devies helped Zenseact make cybersecurity a natural part of developing safety-critical software for driver assistance and autonomous driving.Read the caseDevies
Want a second opinion?
Devies, a Gothenburg-based product and engineering consultancy, works on questions like this with Nordic product and IT teams. Tell us where you are and we will suggest a sensible first step.
Frequently asked questions
Does säkerhetsskyddslagen apply to private companies?
Yes. The law applies to anyone who conducts security-sensitive activity, regardless of ownership. Private companies in energy, telecoms, transport, defence industry and other critical sectors can be covered, as can suppliers that handle sensitive systems or information for them. The company must make the assessment itself, using Säkerhetspolisen's indicators, and notify its supervisory authority if it conducts such activity.
What is a säkerhetsskyddsavtal?
A säkerhetsskyddsavtal is a protective security agreement between an operator and a supplier or partner. It is required before the counterparty gets access to security-classified information at konfidentiell level or higher, or to equivalent security-sensitive activity. The agreement sets the protective security requirements the supplier must meet, and the operator must follow up compliance and act if the supplier falls short.
How large can sanction fees be under the Protective Security Act?
As of October 2026, the supervisory authority can impose sanction fees from SEK 25,000 up to SEK 50 million, with a ceiling of SEK 10 million for state agencies, municipalities and regions. The size depends on the damage or vulnerability caused, intent or negligence, and corrective steps. A government bill from July 2026 proposes higher fees for private operators from 2027.
Is säkerhetsskyddslagen the same as the Cybersecurity Act?
No. The Cybersecurity Act implements the EU NIS2 directive and aims at secure, continuous essential services, with duties such as risk management and incident reporting. The Protective Security Act is national law that protects Sweden's security against espionage, sabotage and terrorism, with duties such as classification, staff vetting and security agreements. An organisation can be covered by both and should plan them together.
Sources
- Säkerhetsskyddslag (2018:585), riksdagen.se
- Säkerhetsskyddsförordning (2021:955)
- Säkerhetspolisen: Om säkerhetsskydd
- Säkerhetspolisen: Anmälningsplikt
- Regeringen: Prop. 2025/26:182 Utökade möjligheter att ingripa i säkerhetskänslig verksamhet
- Regeringen: Ny lag stärker samhällsviktiga tjänsters motståndskraft (14 July 2026)
- Transportstyrelsen: Ändringar i säkerhetsskyddslagstiftningen
- PTS: decision on sanction fee under the Protective Security Act (TeliaSonera)
