The Cybersecurity Act, in short.

Status as of 17 October 2026. The Swedish Cybersecurity Act (SFS 2025:1506) has applied since 15 January 2026. It implements the NIS2 Directive (EU) 2022/2555 in Sweden. So it is one and the same set of rules. Below is what concerns training, management and incidents. Every statement has a source.*

The free consultation gives you the full summary. It contains six appendices with the legal text, our interpretation and the questions to work through for your organisation.

What has changed in 2026

  • The Act has not changed since it entered into force. The Cybersecurity Ordinance (SFS 2025:1507) has been amended once, by SFS 2026:623.
  • Since 1 July 2026, FRA, the National Defence Radio Establishment, has been the single point of contact and the CSIRT through its National Cyber Security Centre, NCSC. FRA also writes the regulations. Before that, this was the responsibility of MCF, the Swedish Agency for Civil Preparedness.
  • Four regulations apply. MCFFS 2026:1 covers registration, 2026:8 incident reporting, 2026:11 security measures and management training, and 2026:12 security audits and scanning. MCFFS 2026:11 applies from 1 October 2026.
SFS 2026:623 · FRA, Regulations

Who is covered

  • Entities in the sectors listed in Annex I and Annex II of the NIS2 Directive, if they are at least medium-sized, and certain entities regardless of size.
  • All municipalities, regions and local government federations, with no size requirement. The whole municipality registers as one entity. The elected council is exempt.
  • A municipality or region is an essential entity if it is larger than a medium-sized enterprise, otherwise an important entity.
  • A municipally owned company is covered if it meets the sector and size requirements itself. It then counts as a private entity, not a public one.
  • Register with NCSC at FRA as soon as possible. Since 1 July 2026 this is done by encrypted email, as NCSC instructs.
Ch. 1 Sec. 3–9 and 14, Ch. 2 Sec. 2 · NCSC, Registering an entity

The management body's responsibility

The Act says that the management body must undergo training on security measures. The requirement that the management body approves and oversees the measures is in the regulation MCFFS 2026:11, which has applied since 1 October 2026.

  • In a limited company, the management body is the board of directors and the CEO. In a municipality or region, it is the municipal executive board or the regional executive board.
  • No rule sets a number of hours or how often the training must take place.
  • Administrative fines are charged to the entity, not to individuals. A ban on exercising management functions can only be directed at private essential entities, never at municipalities, regions or government agencies.
Ch. 2 Sec. 4, Ch. 4 Sec. 6 · MCFFS 2026:11 Ch. 3 Sec. 4 · Government Bill 2025/26:28

Staff training

No law requires every employee to be trained in a particular way. Since 1 October 2026, the entity must decide which training staff must complete, before and during employment. Internal rules must be communicated to the staff they concern.

Training plans, logs and knowledge tests are guidance, not requirements. In our assessment, a supervisory authority will still ask for them.

Ch. 2 Sec. 3 point 7 · MCFFS 2026:11 Ch. 3 Sec. 3 and 9

Incident reporting

WhenWhat
Within 24 hoursEarly warning
Within 72 hoursIncident notification
One month after the notificationFinal report

Reports go to NCSC through the cyber portal. The Act counts the time from when the entity became aware of the incident. The regulation counts from when it was identified as significant. For public administration, the thresholds for what is significant are low.

Ch. 2 Sec. 5–8 · MCFFS 2026:8 · NCSC, Reporting a significant incident

Administrative fines

EntityMaximum fine
Private, essentialThe SEK equivalent of EUR 10 million or 2% of global annual turnover, whichever is higher
Private, importantThe SEK equivalent of EUR 7 million or 1.4% of global annual turnover, whichever is higher
Public: government agency, municipality, region, local government federationSEK 10 million

The minimum fine is SEK 5,000. The fine is not automatic. As of 17 October 2026, no supervisory decision and no administrative fine has been published.

Ch. 4 Sec. 9–10

Sources

This is not legal advice. Always check the current wording at the source.