Personal responsibility for the board
Feb 18th, 2026 by Jesper Kråkhede
In my previous business post I wrote about the new Swedish cybersecurity act. The part that worries many board members most is personal responsibility. So let me spend a post on it.
The law says that management must approve the security measures and oversee their implementation. In serious cases, the supervisory authority can ban a person from holding a management position for a period. This isn´t meant to scare people. It is meant to make sure cybersecurity gets real attention at the top.
What does that mean in practice? You need to be able to show that management has actually done its job. That means documented decisions on risk and security measures, regular reporting to the board on the state of security, training for management, so they understand what they approve, and follow up on whether the measures are implemented and working.
Here comes the compliance trap. It is tempting to answer with a thick binder of policies, signed once a year. That proves very little. A supervisory authority will be more interested in whether you know your risks, whether your measures actually work and what you did after the last incident.
So keep it real. A short quarterly security report with a few honest metrics. A risk register that management actually discusses. Decisions recorded with the reasoning behind them. And a test once a year, where you check that the incident reporting works within 24 hours.
Registration with the authority opened at the beginning of February. Have you registered?
Responsibility can´t be delegated. But it can be documented.