The Swedish Cybersecurity Act (2025:1506)

The Swedish Cybersecurity Act (2025:1506) transposes the NIS2 Directive into Swedish law. Its purpose (Chapter 1, Section 1) is to achieve a high level of cybersecurity in society. It entered into force on 15 January 2026, repealing the old act (2018:1174) at the same time. The responsible ministry is the Ministry of Defence.

Note: this is a Swedish national law — not to be confused with the EU Cybersecurity Act (Regulation (EU) 2019/881), which deals with ENISA and European cybersecurity certification.

The Act applies to, among others, Swedish central government agencies, regions, municipalities and municipal associations, as well as operators that fall under Annex I or II of NIS2, are established in Sweden and are at least the size of a medium-sized enterprise (Chapter 1, Section 4). Providers of public electronic communications networks, cloud, data centre, DNS and top-level domain registry services and others are also in scope.

Operators are classified as essential or important entities (Chapter 1, Section 9). Some are exempt — including activities covered by the DORA regulation and predominantly security-sensitive or law-enforcement activities.

• Register with the competent authority, and report changes within 14 days (Section 2).
• Security measures (Section 3) taking an all-hazards approach — at minimum: risk analysis, incident handling, business continuity and crisis management, supply chain security, secure development, cryptography/encryption, cyber hygiene and training, access control and, where appropriate, multi-factor authentication.
• Management must be trained in security measures (Section 4).
• Incident reporting: an early warning within 24 hours (Section 5), an incident notification within 72 hours (24 h for trust services, Section 6), an interim report on request (Section 7) and a final report within one month (Section 8).
• Inform recipients of significant incidents and cyber threats (Sections 9–10).

The supervisory authority may request information, gain access to premises, carry out security audits and security scans, and attach financial penalties to its orders. Interventions range from formal notices and orders to bans on holding a managerial position, and administrative penalty fees.

The penalty fee (Chapter 4, Section 10) is set at no less than SEK 5,000 and at most:

• Essential private entities: the higher of 2% of global annual turnover or the equivalent of EUR 10,000,000.
• Important private entities: the higher of 1.4% or the equivalent of EUR 7,000,000.
• Public-sector entities: SEK 10,000,000.

In serious cases, an individual in management can be banned from exercising a managerial function for 1–3 years (Chapter 4, Sections 6–8).

We help you determine whether you are in scope, build the security measures into your systems and put incident-reporting routines in place that meet the deadlines. Talk to us about your compliance →

This page is informational and fact-checked against the primary source, but it does not constitute legal advice. For a binding assessment of your specific organisation — talk to us or your legal counsel.