NIS2 in Sweden
What binds you in Sweden is the national law transposing NIS2 — not the directive itself. Here is who supervises you, where you register, and where you report.
Reviewed . Verify against the national official journal before relying on this for a filing.
National transposition
Cybersäkerhetslagen (2025:1506)
Entities had to meet all obligations from entry into force on 15 January 2026 — no phase-in.
This is not the article you read in the directive
The ten measures of article 21(2) are carried by 2 kap. 3 § of the Cybersäkerhetslagen, one for one and in the directive's order; management training follows at 2 kap. 4 §. Cite the Swedish section in your documentation — the supervisor reads the Swedish act. Incident reporting, at 2 kap. 5–8 §§, keeps the directive's deadlines: 24 hours for the early warning, 72 for the incident notification, and 24 for trust service providers — a derogation that article 23(4) itself makes, not a Swedish addition. The one difference is of wording: the directive confines those 24 hours to incidents affecting the trust services, while 2 kap. 6 § attaches them to the operator. An operator that provides trust services alongside others should plan on 24 hours for every significant incident.
NCSC / FRA inspections
The supervising body changed twice in 2026, so older guidance names the wrong one: MSB was renamed Myndigheten för civilt försvar (MCF), and on 1 July 2026 cyber responsibilities moved to the Nationellt cybersäkerhetscenter (NCSC) at Försvarets radioanstalt (FRA). Regulations issued earlier may still carry the former agency's name; CERT-SE remains the CSIRT.
Who supervises you
NCSC at FRA (Försvarets radioanstalt) is the competent authority designated by Sweden. It holds the article 32 and 33 supervisory powers: inspections and audits, requests for information and evidence, binding instructions, orders to remedy deficiencies, and administrative fines. For essential entities those powers are exercised ex ante — without needing any indication of non-compliance.
Incident notifications under article 23 normally go to CERT-SE, though some member states route them through the competent authority instead. Confirm the channel before you need it: the 24-hour clock is not the moment to discover which portal applies.
What differs from the directive
Because NIS2 is a directive, Sweden legislated its own version of it. The minimum measures of article 21(2) are common across the Union (“shall include at least”), and a member state may go further (article 5). What does differ:
- Registration. The portal, the information required and the deadline are national.
- Scope. Several member states extended coverage below the directive's size thresholds, or added sectors of national importance.
- Penalty calibration. Article 34 sets common floors for the maximum fine; the national maximum can be higher, and how the authority calibrates a fine is national.
- Reporting format. Deadlines are fixed by the directive; the form and the language are national.
If you operate in several member states
You have one security programme and several compliance relationships. Registration, supervision and reporting are per-jurisdiction, and a cross-border incident can require filings in each affected member state. Article 26 sets jurisdiction rules — generally the member state of establishment, with specific rules for digital providers.