NIS 2 status in Sweden
What the directive requires, how Sweden transposed it late, and where FRA's NCSC and CERT-SE sit inside the picture.
Overview
The NIS 2 directive is the EU layer. It binds every member state, including Sweden, with one cybersecurity floor for essential and important entities. Sweden must put that floor into Swedish law and run a supervision regime under it.
Sweden missed the EU transposition deadline of 17 October 2024. The European Commission issued a reasoned opinion on 7 May 2025 for failure to notify full transposition. Only the Cybersäkerhetslagen (SFS 2025:1506), issued on 11 December 2025 and in force since 15 January 2026, finally carried the directive into Swedish statute.
Since 1 July 2026 the National Defence Radio Establishment (Försvarets radioanstalt, FRA), through its National Cyber Security Centre (NCSC), is the single point of contact and CSIRT for NIS 2. MCF (Myndigheten för civilt försvar, formerly MSB) held these roles from 15 January to 30 June 2026. CERT-SE remains the name of the national CSIRT and is now part of NCSC. Supervision is decentralised: PTS for digital infrastructure, digital providers, ICT service management, postal and space; Energimyndigheten for energy; Transportstyrelsen for transport and vehicle manufacturing; Finansinspektionen for banking and financial market infrastructure; IVO for healthcare providers and Läkemedelsverket for the rest of health; Livsmedelsverket for drinking water, wastewater and food; and six county administrative boards for waste, research, public administration, chemicals and manufacturing.
EU directive
Directive (EU) 2022/2555 (NIS 2)
The EU-wide cybersecurity directive. Sets the obligations every member state must transpose, including the size and sector tests for essential and important entities. The transposition deadline was 17 October 2024.
EU implementation
Commission Implementing Regulation (EU) 2024/2690
Technical and methodological requirements for DNS providers, TLD registries, cloud, data centre and CDN providers, managed (security) service providers, online marketplaces, search engines, social networks and trust service providers. Directly applicable in Sweden without national transposition.
Swedish transposition
Cybersäkerhetslagen (SFS 2025:1506), in force since 15 January 2026
The Swedish NIS 2 transposition. Issued on 11 December 2025 on the basis of Proposition 2025/26:28 'Ett starkt skydd för nätverks- och informationssystem'. Accompanied by the Cybersäkerhetsförordning (SFS 2025:1507) and rules issued by the authorities. Repeals the 2018 NIS 1 act (2018:1174), which still applies to violations committed before 15 January 2026.
Cybersäkerhetslagen (SFS 2025:1506)
Carries the NIS 2 obligations into Swedish law. The Commission had opened an infringement procedure with a reasoned opinion on 7 May 2025. With the Cybersäkerhetslagen, in force since 15 January 2026, Sweden is formally transposed. The accompanying Cybersäkerhetsförordning and sector-regulator rules fill in the operational detail.
NCSC at FRA as SPOC and CSIRT, sector regulators as supervisors
Sweden runs a decentralised supervision model. Since 1 July 2026 FRA, through its National Cyber Security Centre (NCSC), is the single point of contact and the CSIRT (CERT-SE). Before that, from 15 January 2026, MCF held both roles. Supervision sits with the sector authorities listed in the Cybersäkerhetsförordning: PTS, Energimyndigheten, Transportstyrelsen, Finansinspektionen, IVO, Läkemedelsverket, Livsmedelsverket and six county administrative boards.
Registration and reporting
In-scope entities must register with the single point of contact as soon as possible. Registration opened on 2 February 2026. Since 1 July 2026 the address is the NCSC at FRA, by email to nis2anmalan@ncsc.se. Changes are due within 14 days. Significant incidents are reported to NCSC through CERT-SE via cyberportal.ncsc.se on the directive's cadence: 24-hour early warning, 72-hour notification, one-month final report. For trust service providers the incident notification is due within 24 hours.
Local law applies inside Sweden
Operations on Swedish territory follow the Swedish transposition. A German Geschäftsführer running a Swedish subsidiary reads Cybersäkerhetslagen (SFS 2025:1506) for that subsidiary, not the German BSIG. The directive obligations are the same; the procedure, the registration address and the sanctions live in Swedish law.
Sweden cannot go below the EU floor
The directive is a minimum harmonisation instrument. Sweden can go stricter and has used some of that headroom, in particular through a 'whole-entity' approach that captures the full organisation rather than only the service-providing part. Sweden cannot drop below the directive on essential and important entity duties, incident reporting deadlines or management body accountability.
NCSC at FRA (until 30 June 2026: MCF)
The National Cyber Security Centre at Försvarets radioanstalt (FRA). Single point of contact and CSIRT for NIS 2 since 1 July 2026, and the address for registrations and incident reports. From 15 January to 30 June 2026 these roles sat with MCF (Myndigheten för civilt försvar, called MSB until 31 December 2025). Sector supervision does not sit here; it sits with the sector authorities.
CERT-SE
The national CSIRT for Sweden, part of the National Cyber Security Centre at FRA since 1 July 2026 (before that at MCF). Receives significant-incident reports under NIS 2 via cyberportal.ncsc.se, supports entities 24/7, and exchanges information inside the EU CSIRTs Network. Reachable at cert@cert.se.
ENISA
The EU cybersecurity agency. Publishes guidance, manages the European vulnerability database, and supports cross-border coordination. Not a supervisor for Swedish entities; the sector authorities are.
Sweden and Germany regulate this the same way.
The directive obligations are identical, the structures are not. Germany centralises supervision through BSI under the BSIG. Sweden splits the roles: the NCSC at FRA is the single point of contact and runs CERT-SE, while supervision sits with a set of sector authorities. A German parent with a Swedish subsidiary needs the sector authority as the supervision address for that subsidiary, not the NCSC.
As long as nobody contacts me, I am out of scope.
Like most member states, Sweden runs a self-classification model. An entity that meets the directive's size and sector test is an obligated entity, whether or not any authority publishes a list. Entities had to register as soon as possible from 2 February 2026, since 1 July 2026 with the NCSC at FRA. A missing letter from the authorities is not a defence against sanctions.
We only deal with our sector regulator.
The sector authority is the supervisor, and the NCSC at FRA is both the registration address and, through CERT-SE, the incident channel. In practice NIS 2 work touches both: registration and incident reports to the NCSC, ongoing supervision by PTS, Energimyndigheten, Finansinspektionen or another sector authority. Treating either as the only counterparty misreads the Swedish architecture.
Most Swedish operators we see spent the whole of 2025 in limbo. Until mid-December 2025 the Cybersäkerhetslagen sat at the Riksdag as Proposition 2025/26:28 and nothing more. The consequence: many managing directors paused their NIS 2 work, then had to compress notification and first documentation into the window shortly after 15 January 2026.
The practical move is the same as everywhere else in the EU: confirm scope under the directive, register with the NCSC at FRA, set up the four continuous obligations (registration upkeep, incident reporting, supply chain risk, management body oversight), and document the minimum. The sector regulator remains the supervision address; the NCSC and CERT-SE are the operational channels.
- Directive (EU) 2022/2555 (NIS 2): EUR-Lex
- Commission Implementing Regulation (EU) 2024/2690
- Cybersäkerhetslagen (SFS 2025:1506): Sveriges riksdag
- Proposition 2025/26:28 'Ett starkt skydd för nätverks- och informationssystem': Sveriges riksdag
- National Cyber Security Centre (NCSC) at FRA: ncsc.se (registration and incident reporting under Cybersäkerhetslagen)
- CERT-SE: Swedish national CSIRT (part of NCSC at FRA since 1 July 2026)
- European Commission: NIS2 Directive implementation in Sweden (digital-strategy.ec.europa.eu)
- PTS, Energimyndigheten, Transportstyrelsen, Finansinspektionen, IVO, Livsmedelsverket: sector regulators
- SFS 2026:623, amendment to the Cybersäkerhetsförordning (2025:1507)
In practice
What the national law changes, and what it doesn't
The national law decides, among other things, where you register and whom you report incidents to. The measures themselves start from the same minimum list in every member state (Art. 21 NIS 2). The walkthrough takes you through them one step at a time:
Risk Management
Write down what your company has
A list of the processes, software and devices you work with.
Incident Handling
Plan what happens in an incident
Who decides, whom you call, how you reach each other.
Effectiveness Assessment
Record the management review
Management checks whether the measures work and approves your documents.
Been asked to handle NIS2?
In the end you have everything in one document: what is done, what is still open, and your management's approval with name and date. The app writes the texts.
