Cybersäkerhetslagen is the Swedish law implementing the EU's NIS2 directive, setting cybersecurity and incident reporting requirements for essential and important entities operating in Sweden. It has applied since 15 January 2026, replaced the 2018 law on information security for essential and digital services (SFS 2018:1174), and is supplemented by the cybersäkerhetsförordning (SFS 2025:1507).
Key facts
- Cybersäkerhetslagen transposes NIS2 into Swedish law and covers the NIS2 sectors as applied to Sweden.
- Since 1 July 2026, Försvarets radioanstalt (FRA) is Sweden's single point of contact, CSIRT and cyber crisis authority (SFS 2026:623), roles first assigned to Myndigheten för civilt försvar (MCF, formerly MSB). Supervision is by sector, for example Finansinspektionen for banking and financial market infrastructure and PTS for digital infrastructure.
- Incident reporting follows NIS2's structure: notify the CSIRT as soon as possible and no later than 24 hours, file an incident report within 72 hours (24 hours for trust service providers) and a final report no later than one month after the incident report. Since 1 July 2026 the CSIRT is FRA.
Who is covered in Sweden
Cybersäkerhetslagen covers the same NIS2 sectors other member states apply: energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, public administration, space, postal and courier services, waste management, chemicals, food, manufacturing, digital services, research and other critical activities. Essential entities are covered in the larger sectors, important ones in the rest. Sweden also covers state authorities, regions, municipalities and kommunalförbund, as well as private providers of degree-awarding education. Suppliers are reached indirectly via the supply-chain security requirement.
What the law requires
Cybersäkerhetslagen mirrors NIS2 Article 21: risk management, incident handling, continuity, supply-chain security, secure development and maintenance, cyber-hygiene measures such as MFA and encryption, security awareness, and management accountability. Management must complete training on security measures, and for essential entities serious breaches can lead to a ban from management roles. Significant incidents must be reported to the CSIRT (FRA since 1 July 2026) on the 24/72-hour pattern, plus a final report within one month of the incident report. Fines run from SEK 5,000 up to the higher of 2% of global annual turnover or the SEK equivalent of EUR 10 million for essential entities, and the higher of 1.4% or EUR 7 million for important entities; for public-sector entities the ceiling is SEK 10 million.
Cybersäkerhetslagen, NIS2 and DORA
NIS2 is the directive at EU level; cybersäkerhetslagen is the Swedish law that makes the directive applicable. DORA is a regulation for the financial sector, directly applicable, and generally takes precedence for financial entities where the rules overlap. See also GDPR for the parallel data protection reporting duty.
Where email security fits, honestly
No product makes an organization cybersäkerhetslagen-compliant. What Sentaro contributes, just as for NIS2: protection of the channel where most incidents begin (phishing, business email compromise), visibility of OAuth-connected third-party applications for supply-chain measures, and detection that starts the incident reporting clock with facts: who was targeted, what was blocked or delivered, when, and how far it spread. Compliance in full remains organizational: governance, testing, contracts and documentation.
The incident reporting chain
Detection starts the clock with facts. Without detection you do not know an incident happened; without facts you have nothing to report. Sentaro's email-layer detection delivers both automatically, so the 24-hour early warning and 72-hour notification arrive with evidence rather than an empty page.
This page is general guidance, not legal advice.