NIS2 obligations in Sweden (Cybersäkerhetslag (2025:1506))

Competent authority & CSIRT Legal ref: Chapter 3

• Since 1 Jul 2026 the cyber functions of the former MSB (renamed Myndigheten för civilt försvar) moved to the National Cyber Security Centre (NCSC) at FRA, which now receives registrations; sectoral supervisory authorities supervise. ncsc.se · 28 Oct 2026 · source-checked
• Swedish Civil Contingencies Agency (MSB) is the assigned CSIRT, but oversight is split per sector/region. ecs-org.eu · 28 Oct 2026 · secondary source
• MSB will have the responsibility to coordinate all sectoral/regional authority work, and to ‘hastily’ develop supporting guidance for the sectoral/regional authorities. ecs-org.eu · 28 Oct 2026 · secondary source

Who's in scope (national deviations) Legal ref: Chapter 1, Section 4

• Sectors correspond to NIS2 ecs-org.eu · 28 Oct 2026 · secondary source
• Providers of public electronic communications networks or publicly available electronic communications services are recognised as trusted services. ecs-org.eu · 28 Oct 2026 · secondary source

Registration

• Every in-scope operator must register "as soon as possible" (from 2 Feb); if registration is not received within 14 days supervisory authorities may act. From 1 Jul 2026 the form is sent by TLS-encrypted email to NCSC ([email protected]). Rules in MCFFS 2026:1. ncsc.se · 28 Oct 2026 · source-checked
• Each competent oversight authority will be required to establish their own registry of important and essential entities within their respective authority scope ecs-org.eu · 28 Oct 2026 · secondary source
• Requested details: ecs-org.eu · 28 Oct 2026 · secondary source
• Name of the organisation. ecs-org.eu · 28 Oct 2026 · secondary source
• Address and up-to-date contact details. ecs-org.eu · 28 Oct 2026 · secondary source
• IP address. ecs-org.eu · 28 Oct 2026 · secondary source
• List of member states where the entity provides services. ecs-org.eu · 28 Oct 2026 · secondary source
• The information was submitted by 17 January 2025. ecs-org.eu · 28 Oct 2026 · secondary source
• The first register will be established and functional by 1 March 2025 and updated every two years after. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 3(4), Art. 27): Member States draw up a list of essential and important entities; entities provide name, contact details, IP ranges, sector and Member States served. EUR-Lex

Incident reporting Legal ref: Chapter 1 , Section 5

• Operators shall inform the authority designated by the government of a significant incident as soon as possible. ecs-org.eu · 28 Oct 2026 · secondary source
• Reporting requirements: ecs-org.eu · 28 Oct 2026 · secondary source
• Early warning within 24 hours. ecs-org.eu · 28 Oct 2026 · secondary source
• Incident report within 72 hours (within 24 hours for operators offering trust services). ecs-org.eu · 28 Oct 2026 · secondary source
• Final report no later than 1 month after sending the incident report. ecs-org.eu · 28 Oct 2026 · secondary source
• Progress report (if the incident is still ongoing) no later than 1 month after sending the incident report and a final report within another month after the end of the incident. ecs-org.eu · 28 Oct 2026 · secondary source
• Corresponds to NIS2. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 23): early warning within 24 hours, incident notification within 72 hours, final report within one month (progress report if still ongoing). EUR-Lex

Management liability & training

Not yet published / needs verification We have not found a published, sourced national rule for this yet.

NIS2 baseline (Art. 20): management bodies must approve and oversee cybersecurity risk-management measures, can be held liable for infringements, and must follow training. EUR-Lex

Penalties Legal ref: Chapter 3, Section 10

• Up to 10,000,000 EUR or 2% of the total worldwide annual turnover (essential entities). ecs-org.eu · 28 Oct 2026 · secondary source
• Up to 7,000,000 EUR or 1.4% of the total worldwide annual turnover(important entities). ecs-org.eu · 28 Oct 2026 · secondary source
• From 5,000 to 10,000,00 SEK (public sector operators). ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 34): maximum fines of at least EUR 10m or 2% of worldwide turnover (essential) and EUR 7m or 1.4% (important), whichever is higher. EUR-Lex

Security measures, standards & deadlines

Not yet published / needs verification We have not found a published, sourced national rule for this yet.

Supervisory guidance

• NCSC – registration under the Cybersecurity Act ncsc.se
• NCSC – Q&A on the Cybersecurity Act ncsc.se

What changed recently

1. 1 Jul 2026
   NCSC (FRA) takes over NIS2 registration from MSB/MCF ncsc.se source-checked
2. 15 Jan 2026
   National NIS2 law enters into force (per tracker) ecs-org.eu secondary source