Who does NIS2 cover in Sweden?
Sweden implements NIS2 through the Cybersecurity Act, Cybersäkerhetslag (2025:1506), in force since 15 January 2026. Here is how to tell whether your organisation is covered, and what follows if it is.
By the TrustSek editorial team · Last reviewed
- Law
- SFS 2025:1506
- In force
- 15 January 2026
- Sectors
- 18
Three questions decide it.
Whether your organisation is covered depends on three things: what kind of activity it carries out, how large it is, and where it is established. The organisation makes the assessment itself. No authority sends a notice saying you are in scope, so finding out is your responsibility.
Sector: eighteen sectors in two annexes.
The law names 18 sectors in two annexes. Annex 1 lists sectors of high criticality, Annex 2 other critical sectors.
| Annex 1 | Annex 2 | |
|---|---|---|
| 1 | Energy | Postal and courier services |
| 2 | Transport | Waste management |
| 3 | Banking | Manufacture, production and distribution of chemicals |
| 4 | Financial market infrastructure | Production, processing and distribution of food |
| 5 | Health | Manufacturing (including medical devices, electronics, electrical equipment, machinery and vehicles) |
| 6 | Drinking water | Digital providers (online marketplaces, search engines and social networks) |
| 7 | Waste water | Research |
| 8 | Digital infrastructure | |
| 9 | ICT service management (business to business) | |
| 10 | Public administration | |
| 11 | Space |
Each sector is divided into subsectors and types of entity. The exact type is what counts, not the industry you would describe yourself as part of, so read the annexes of the law or the guidance from NCSC for your activity.
Size: medium-sized or larger.
Within those sectors, the law generally covers organisations that are medium-sized or larger. The threshold follows the EU definition of small and medium-sized enterprises: an enterprise is medium-sized or larger if it has at least 50 employees, or if both its annual turnover and its balance sheet total exceed EUR 10 million.
Size is not assessed on the single company alone. Linked and partner enterprises count, so a small Swedish subsidiary of a large group can be in scope although the subsidiary itself is small.
Some are covered regardless of size.
A few kinds of organisation are covered even when small, because a disruption there has wide effects. They include:
- providers of public electronic communications networks and services;
- trust service providers;
- top-level domain name registries and DNS service providers;
- the sole provider in Sweden of a service essential to society.
Public administration is covered too. Regions, municipalities and associations of local authorities are covered regardless of size, and central government agencies as the law defines them.
Essential or important.
An organisation in scope is either an essential or an important entity. Essential entities are mainly large organisations in Annex 1, plus some covered regardless of size. Important entities are the rest of those in scope, such as medium-sized organisations in Annex 1 and medium-sized and large ones in Annex 2.
The security requirements are the same. The difference is supervision: essential entities are supervised proactively, important entities mainly after the fact when there is reason to. Essential entities can also face higher administrative fines.
If you are covered.
- Register. Every organisation in scope must register, whatever its sector, including municipalities and regions. Since 1 July 2026 registrations are received by NCSC, the National Cyber Security Centre at FRA.
- Put the risk-management measures in place. NIS2 Article 21 lists ten, from risk analysis and incident handling to supply chain security and encryption. NIS2 and outside-in evidence goes through them and which ones show from the outside.
- Report significant incidents. An early warning is due within 24 hours of becoming aware of a significant incident.
- Make management accountable. Management must approve the measures, oversee them and take part in training.
If you are not covered, it can still reach you.
Organisations in scope must manage the security of their supply chain. If you supply a municipality, a healthcare provider or an energy company, the requirements often reach you through contracts and supplier assessments, even when you are too small to be in scope yourself. NIS2 supplier security explains how, and the supplier assessment checklist shows what a customer may ask about.
Questions
Does the Swedish Cybersecurity Act apply to small companies?
Generally not. Small companies are only in scope if they belong to the kinds covered regardless of size, such as DNS service providers, or if they are part of a group that is medium-sized or larger. The requirements can still reach them as suppliers, through their customers' contracts.
Who supervises compliance in Sweden?
Supervision is divided by sector. The supervisory authorities include the Swedish Energy Agency, the Swedish Transport Agency, Finansinspektionen, the Health and Social Care Inspectorate, the Medical Products Agency, the Swedish Food Agency, the Swedish Post and Telecom Authority and the county administrative boards.
How does it relate to DORA?
For financial entities covered by DORA, DORA's rules on ICT risk management and incident reporting apply instead of the equivalent NIS2 rules. The DORA guide covers its requirements on ICT providers.
See what shows from the outside
Some of the Article 21 measures leave traces on the internet. See what a check of your domain shows, without access to your systems.