Sweden

(a) What is the NIS2 implementation status?

The Swedish Cyber Security Act (Swe: Cybersäkerhetslagen) was adopted on 11 December 2025, and the Cyber Security Ordinance (Swe: Cybersäkerhetsförordningen) was issued on the same date.

(b) What is the envisaged NIS2 implementation timeline?

The Cyber Security Act and the Cyber Security Ordinance will enter into force on 15 January 2026. Additional regulations will be issued by supervisory authorities, likely on or after that date. The Swedish Civil Contingencies Agency (Swe: Myndigheten för samhällsskydd och beredskap, “MSB”), will be renamed as of 1 January 2026 to the Swedish Civil Defence and Resilience Agency (Swe: Myndigheten för civilt försvar). MSB will act as CSIRT for Sweden. Entities subject to the Cyber Security Act shall give notification thereof to MSB from the date of the legislation taking effect, i.e. 15 January 2026. However, MSB has stated that a website for notification will be published in connection with the entering into force of the Act and that notification shall be made as soon as possible when the website is in place (tentatively in January or February of 2026). The envisaged regulations are expected to clarify certain aspects of the Cyber Security Act (e.g., notification requirements, cyber security measures, and the classification of incidents).

(c) What does the NIS2 mean for other national cybersecurity legislation?

The Cyber Security Act will replace the Information Security Act (2018:1174), which is the current implementation of the NIS Directive in Sweden. The new Cyber Security Act has a much wider scope that will encompass operators within a larger set of sectors than the current legislation, mirroring the difference between NIS and NIS 2. According to the still applicable Information Security Act, businesses and operations, or parts thereof, that are subject to the Swedish Protective Security Act (2018:585) (“PSA”) are completely exempted from the application of the Information Security Act. In the new upcoming legislation, entities that are completely exempted include (i) governmental authorities that primarily carry out activities under the PSA or law enforcement activities, (ii) entities that solely provide services to such government authorities, and (iii) entities that solely carries out activities under the PSA. In cases where only a part of the business or operations consists of activities as described in (i)-(iii), that part is exempted only from some of the main obligations under NIS2 and the Cyber Security Act (e.g., relating to cyber security measures, cyber security training for management, and incident reporting) while remaining subject to the notification requirement and, where relevant, the obligation to appoint a representative. For other parts of the business or operations, the Cyber Security Act will apply in full, provided that no other exemption applies (e.g., financial institutions that are already covered by equivalent cybersecurity obligations in the Digital Operational Resilience Act (Regulation (EU) 2022/2554)). It should also be noted that the CER Directive (Directive 2022/2557 on the resilience of critical entities) will be implemented in Sweden through upcoming legislation.

(e) What should you be doing/on the lookout for?

Clients are advised to identify as soon as possible whether they are within scope of the Cyber Security Act. In this regard, it should be noted that the scope of relevant sectors is expanded compared to the soon to be obsolete Information Security Act. Clients are further recommended to document the assessment, and if the legislation is applicable, prepare for notification on 15 January 2026 (or as soon as technically possible thereafter, subject to the notification website which is under way). Clients who are subject to the Cyber Security Act should actively prepare for upcoming enforcement by reviewing their existing information- and cybersecurity practices and policies to determine requirements set forth in the Cyber Security Act. In addition, we recommend clients are updated on new information on the website of their respective supervisory authority/authorities.