The Swedish Cybersecurity Act – Where Do We Stand, and What Lies Ahead?

Nearly a year has passed since the Swedish cybersecurity act entered into force at the start of 2026. While fundamental legal provisions are now in place and supplementary regulations are being progressively implemented, some key questions are yet to be made clear – not least the interpretation of certain definitions, supervision and enforcement. This article aims to provide an overview of the act’s core framework, examine where implementation and registration stands today, and looks at the challenges and developments that lie ahead.

General regarding the swedish cybersecurity act

The Swedish Cybersecurity Act (Sw. cybersäkerhetslagen), hereinafter the “CSL”, is Sweden’s implementation of the Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (the NIS2 Directive). The NIS2 Directive (and the CSL) aims toward raising the bar for cyber resilience across the EU, ensuring organisations manage security risks, reports incidents, and that authorities have proper tools when it comes to supervision and enforcement. The CSL has been in force since the start of 2026 and is supplemented by the Swedish Cybersecurity Ordinance (Sw. cybersäkerhetsförordningen) and various Swedish national regulations.

As a rule of thumb, entities are in scope of the CSL if they carry out an activity in any sector covered by the NIS2 annexes[1], are established in Sweden[2], and qualify as at least a medium-sized entity – roughly meaning 50+ employees or a turnover/balance sheet above EUR 10 million. The assessment of whether an entity is in scope is made on a per-legal-entity basis.

There are some exceptions to the above-mentioned size and establishment requirements. This is for example the case for government agencies, providers of public electronic communications networks or providers of certain digital services. Entities subject equivalent sector-specific requirements, e.g. regarding security measures and incident reporting, are governed by those rules instead – notably financial entities subject to DORA (Regulation (EU) 2022/2554).[3] Notwithstanding the above, DORA-regulated entities must still register their operations with the National Cybersecurity Center under the CSL. This registration requirement applies also to credit institutions[4] that fall within the Banking sector listed in Annex 1 of the NIS2 Directive.

Core obligations for entities within scope of the CSL primarily include:

• Register with the National Cybersecurity Center (NCSC);
• Report incidents that cause or could cause essential disruptions; and
• establish and maintain a systematic approach to cybersecurity, implement appropriate security measures, and provide training for both management and staff.

Something about the division of Important and essential entities

Entities subject to the CSL are classified as either an important entity or as an essential entity. Generally, municipalities, regions, and entities that are larger than medium-sized enterprises[5] and fall within the sectors listed in Annex 1 of the NIS2 Directive, are classified as essential entities.[6] The remaining entities covered by the CSL are classified as important entities.

Essential entities are subject to proactive supervision. Supervision of important entities, by contrast, is reactive and is generally triggered where there is evidence of non-compliance with the CSL. The two categories also differ in terms of sanctions. Administrative fines that may be imposed on essential entities are subject to higher caps than those applicable to important entities.[7]

Almost a year in – Where do we stand, and what lies ahead?

Registration with the NCSC

Entities that fall within scope of the CSL shall register their operations with the NCSC as soon as possible. An entity that later commences an activity bringing it within the CSL’s scope must file when that activity begins. Accordingly, entities that operate within any of the relevant sectors set out in the NIS2 Directive – but that do not currently meet the size threshold or other qualifying criteria – should periodically reassess their status, as changes in revenue or headcount may cause them to fall within the scope of the CSL.

Setterwalls has conducted research and consulted the relevant authorities regarding the status of the registration process, obtaining the following information. As of September 21, 2026, a total of 3297 entities has registered its operation with the NCSC. The three sectors with the highest number of registrations are: (i) Energy, with 671 registrations; (ii) Digital Infrastructure, with 654 registrations; and (iii) Health, with 598 registrations. The three sectors having the least registrations are (i) Space, with 4 registrations, (ii) Financial market infrastructure, with 7 registrations, and (iii) Manufacture of other transportation equipment (SNI C30), with 12 registrations.

It should be noted, however, that a single entity may operate across multiple sectors and may therefore have registered in more than one category. As of September 21, 2026, the aggregate sector-level registrations amount to 5073, thus exceeding total number of unique registered entities. It is also likely that there remains a certain degree of unreported cases, with further registrations expected as entities mature and become aware of the applicable requirements, whether as a result of proactive supervision, contact with the authorities, or otherwise.

Scope and some definitions remain a point of topic

Since the CSL entered into force, there has been an absence of clear guidance on a number of its key terms and definitions. The definition of cloud computing services[8] has for example prompted questions from organisations that find its scope broad and difficult to apply in practice. Although SaaS services are listed as a type of cloud computing service model potentially in scope under the NIS2 Directive[9], there is still room for interpretation whether a SaaS offering will meet all of the criteria set out for a cloud computing service under NIS2 (defined as a “digital service that enables on-demand administration and broad remote access to a scalable and elastic pool of shareable computing resources, including where such resources are distributed across several locations”). In particular, questions have been raised as to whether all SaaS offerings would be in scope of NIS2, including those bordering ordinary services but with application layer components hosted on hyperscalers’ cloud services, or if any such offerings may be excluded from the scope. Despite recent guidelines from the Swedish Post and Telecom Authority (Sw. Post- och telestyrelsen, PTS) clarifying the definition of cloud computing services, these questions are yet to be fully answered.

Supplementary national regulations being progressively implemented

As regards the CSL’s general requirements to implement appropriate security measures, provide training for management and staff etc., it should be noted that MSB have issued regulations and guidelines regarding (i) the registration procedures, (ii) incident reporting, and (iii) security measures (organizational, technical, and physical), including information on the content of contractual arrangements with, for example, partners within the supply chain.[10] Furthermore, the PTS is currently preparing supplementary sector-specific regulations on security measures for providers of public electronic communications networks, with a target of having them in place by spring 2027.

Supervision and enforcement

Each category of entity falls under the supervision of a designated supervisory authority as the allocation of supervisory responsibility is determined by the sector in which the entity operates. For example, the PTS serves as the supervisory authority for entities operating within the digital infrastructure sector. Each authority has the mandate to monitor compliance and take enforcement action within its designated area, including, for example, ensuring that entities have duly registered with the NCSC, that they have implemented security measures and established functioning procedures for the reporting of incidents.

To carry out the supervisory mandate effectively, authorities have access to a range of tools, including security scans (allowing authorities to proactively identify vulnerabilities in IT systems) and on-site and off-site inspections (enabling observation and review of an entity’s operations and documentation). In addition, the authorities may conduct security audits to obtain an assessment of an entity’s overall security posture. If supervision reveals that an entity is non-compliant, the supervisory authority may take enforcement actions such as issuing an order (Sw. föreläggande), applying for a prohibition on holding a management position (Sw. förbud att inneha ledningsfunktion), imposing an administrative fine (Sw. sanktionsavgift), or — where there are no grounds to take action against a violation in any other way — issuing a warning (Sw. varning).

Supervision will, according to the NSCS, be phased in gradually and will vary depending on the circumstances within each sector and the particular focus of each supervisory authority. Representatives of FRA have indicated that supervision will initially concentrate on verifying the registrations made by entities subject to the CSL, including identifying instances where such registration is absent. As the supervisory framework develops, the focus can be expected to shift from registration compliance toward more substantive assessments of whether entities have implemented adequate security measures and incident reporting procedures.

For the Banking and Financial market infrastructures sectors under the CSL, the Swedish Financial Supervisory Authority (Sw. Finansinspektionen, “FI”) serves as the designated supervisory authority. FI is also responsible for supervising financial entities subject to DORA. In this capacity, FI has initiated reviews concerning cyber threats and cybersecurity in general, with a particular focus on risks arising from advanced AI models. However, the FI has so far not initiated any NIS2 specific supervision. Against this background, it is likely that FI will continue to prioritise its supervision of cybersecurity matters, potentially also including registrations under the CSL, and how entities work to strengthen their resilience.

As of summer 2026, some authorities have initiated their work with supervision and issued decisions under the CSL. The cases reviewed primarily concerned registration obligations and incident reporting, with public sector entities accounting for the majority of supervised entities. Notably, no supervisory authority has yet conducted a security audit or security scan, and no administrative fines were imposed.

Summary

Going forward, entities subject to the CSL should continue to monitor regulatory developments closely and maintain a proactive approach to compliance. The following should also be specifically considered:

• File your notification. Document your scoping assessment and submit the required notification to the NCSC as soon as possible. Any changes must be reported within 14 days.
• Establish and test your incident response procedure. The first notification is due within 24 hours, with further stages on tight deadlines. Hence, it is recommended that these incident reporting procedures are regularly tested so that routines are in place in case an incident occurs.
• Review and prepare relevant agreements. Cybersecurity risks must be assessed before acquiring IT systems or entering into an outsourcing arrangement. Each supplier agreement must address the relevant cybersecurity requirements under applicable guidelines and regulations. Existing agreements should also be reviewed and, where necessary, updated to ensure compliance.
• Keep your documentation ready. Supervisors would typically review cybersecurity compliance by requesting written documentation. Hence, up-to-date, quality-assured documentation allows organisations to respond in a more swift and accurate manner.
• Specifically regarding the Banking sector. Despite DORA taking precedence over the CSL, it should be specifically noted that credit institutions falling within the Banking sector listed in NIS2 Annex 1 must still register with the NCSC under the CSL.

[1] The CSL covers the NIS2 Annex I “Sector of high criticality” (Energy, Transport, Banking, Financial market infrastructure, Health, Drinking water, Waste water, Digital infrastructure, ICT service management B2B, Public administration, and Space) and Annex II “Other Critical Sectors” (Postal and courier services, Waste management, Manufacture, production and distribution of chemicals, Production, processing and distribution of food,  Manufacturing (various subsectors), Digital providers, and Research organisations).

[2] An entity that has a Swedish organization number is generally considered to be established in Sweden.

[3] See Chapter 1 Section 11 of the CSL. DORA is sector-specific legislation for the financial sector and takes precedence over the CSL.

[4] As defined in Article 4, point (1), of Regulation (EU) No 575/2013 of the European Parliament and of the Council.

[5] See the Commission’s recommendation of 6 May 2003 concerning the definition of micro, small and medium-sized enterprises (2003/361/EC).

[6] Some entities are deemed essential regardless of size, for example government agencies and entities that are qualified providers of trusted services (Sw. kvalificerade tillhandahållare av betrodda tjänster). Entities identified as critical under the CER (Directive (EU) 2022/2557) will also be deemed as essential entities under the CSL.

[7] The maximum fine is: (i) for essential entities, the greater of 2 percent of total global annual turnover or an amount in Swedish kronor equivalent to EUR 10,000,000; and (ii) for important entities, the greater of 1.4 percent of total global annual turnover or an amount in Swedish kronor equivalent to EUR 7,000,000. For public entities, the maximum fine is SEK 10,000,000.

[8] A “cloud computing service” means a digital service that enables on- demand administration and broad remote access to a scalable and elastic pool of shareable computing resources, including where such resources are distributed across several locations.

[9] Preamble 33: “The service models of cloud computing include, inter alia, Infrastructure as a Service (IaaS), Platform as a Service (PaaS), Software as a Service (SaaS) and Network as a Service (NaaS).”

[10] See MCFFS 2026:1, MCFFS 2026:7, MCFFS 2026:8, and MCFFS 2026:11.