The new Swedish cybersecurity act is here
Jan 16th, 2026 by Jesper Kråkhede
On the 15th of January the new Swedish cybersecurity act, cybersäkerhetslagen, entered into force. It is Sweden´s implementation of the NIS2 directive and replaces the old NIS act from 2018. For many organisations, it is the biggest change in security regulation in years.
A few things management needs to know.
More organisations are covered. Municipalities and regions are in scope regardless of size, along with central government agencies and medium sized and larger companies in a long list of sectors. Many suppliers will also feel it through contract requirements from customers who are covered.
Incidents must be reported fast. An early warning within 24 hours, a notification within 72 hours and a final report within a month. That requires processes that work on a Saturday night.
The fines are real. Up to 10 million euro or 2 % of global turnover for essential entities, 7 million euro or 1.4 % for important ones and up to 10 million kronor for the public sector.
And management is responsible. The board must approve and oversee the security measures, and in serious cases individuals can be banned from management positions.
Now, the compliance challenge. I have seen this before: a law arrives, a spreadsheet is created and the organisation tries to be compliant by default. As I wrote in 2021, that path is slow and expensive. Start with real security measures that you can show actually work, and map the law´s requirements to them.
Compliance follows good security. It rarely works the other way around.