NIS2 in Sweden: What MCF Requires, How to Register, and What Swedish Law Adds Beyond the EU Directive

Sweden enacted its NIS2 transposition — the Cybersäkerhetslag (SFS 2025:1506) — on 11 December 2025, with an in-force date of 15 January 2026, about fifteen months after the EU transposition deadline of 18 October 2024. Registration opened on 2 February 2026. Status checked against Swedish official sources on 29 October 2026.

The authority picture changed during 2026. Until 30 June 2026 the lead NIS2 authority was MCF (Myndigheten för civilt försvar), which MSB (Myndigheten för samhällsskydd och beredskap) became on 1 January 2026. On 1 July 2026, MCF’s information and cybersecurity operations moved to the National Cyber Security Centre (NCSC), part of FRA (Försvarets radioanstalt). NCSC now receives registrations and incident reports and holds the power to issue the NIS2 regulations.

This guide covers scope, the authorities involved (NCSC, CERT-SE, MCF and the sector supervisors), how registration worked and works now, Swedish-specific provisions, and the compliance dates. For the EU-level framework, see our NIS2 Directive guide.

Does the Cybersäkerhetslag Apply to Your Organisation?

The law applies if your organisation operates in one of the 18 sectors listed in NIS2 Annexes I and II and is medium-sized or larger, assessed on number of employees or turnover (in practice, 50 or more employees or annual turnover above €10 million). Linked and partner companies count toward the size test. This follows NIS2’s scope definition.

Classification	Criteria	Maximum penalty
Essential entity	Large enterprise (≥250 employees OR ≥€50M turnover) in Annex I sectors	Higher of €10M or 2% of global annual turnover
Important entity	Medium enterprise (50–249 employees, €10M–€50M turnover) in Annex I or II sectors	Higher of €7M or 1.4% of global annual turnover
Public entity	Municipalities, regions, government authorities in scope	Up to SEK 10 million (fixed)
Micro / small enterprise	Under 50 employees AND under €10M turnover	Generally not covered — exceptions apply (see below)

Three categories are in scope regardless of size:

• Certain digital infrastructure and trust services — providers of public electronic communications networks or services in Sweden, TLD registries, DNS service providers, domain name registration services and trust service providers
• Local and regional public administration — regions (regioner), municipalities (kommuner) and municipal associations (kommunalförbund); state agencies are covered when they meet the law’s criteria or the government designates them
• Operators of special significance to society — certain Annex I operators are covered regardless of size because of their importance to society

Sweden applies a whole-entity approach. Organisations are covered as legal persons, and NCSC confirms that the law covers the whole organisation — not just the business unit that triggered coverage. A company that qualifies through its food production operations applies the requirements across that legal entity. Parts of an operator’s business that are security-sensitive or law-enforcement activities are excluded from the security-measure and reporting duties.

Sweden’s Cybersecurity Governance Structure (Updated for 1 July 2026)

Sweden splits NIS2 governance between a central authority, the national CSIRT and sector supervisors. Knowing which body does what tells you where you register, where you report incidents, and who supervises compliance. The central role moved from MCF to NCSC on 1 July 2026.

NCSC at FRA — Central Authority Since 1 July 2026 (Previously MCF)

MSB became MCF (in English, the Swedish Civil Defence and Resilience Agency) on 1 January 2026. MCF prepared the NIS2 roll-out with PTS, opened registration on 2 February 2026 and issued the first NIS2 regulations. On 1 July 2026, by government decision, MCF’s information and cybersecurity operations moved to NCSC at FRA. MCF’s NIS2 web pages now redirect to ncsc.se.

NCSC holds these roles under the Cybersäkerhetslag:

Role	What it means in practice
National coordinator and regulator	Coordinates NIS2 implementation nationally and issues the regulations on the common requirements
EU contact point	Sweden’s contact point towards the EU on NIS2
Central notification intake	Receives registrations and, through CERT-SE, incident reports, and forwards reports to the relevant sector supervisor

MCF issued four NIS2 regulations: MCFFS 2026:1 on registration and identification (in force 2 February 2026), MCFFS 2026:8 on incident reporting and information obligations (in force 1 July 2026), MCFFS 2026:11 on security measures and management training (in force 1 October 2026) and MCFFS 2026:12 on security audits and security scanning (in force 1 October 2026). FRA took over responsibility for them on 1 July 2026; they apply unchanged and may still carry MCF’s name. The Swedish Post and Telecom Authority (PTS) issues its own regulations on security measures and incident reporting for the sectors it supervises.

CERT-SE — Sweden’s National CSIRT

CERT-SE is Sweden’s national computer security incident response team, located at NCSC. Since 1 July 2026, essential and important entities report significant incidents to NCSC through CERT-SE, using the incident reporting tool in Cyberportalen (cyberportal.ncsc.se). NCSC then forwards each report to the relevant supervisory authority or authorities.

Contact CERT-SE: cert@cert.se | +46 10 382 80 00 (available 24/7)

NCSC — From Collaboration Hub to Lead Authority

The Nationellt cybersäkerhetscenter started in December 2020 as a cross-agency centre and became part of FRA on 1 November 2024. The Swedish Armed Forces, FMV, MCF, the Police, PTS and SÄPO (the Security Service) participate in it. Since 1 July 2026 NCSC has an expanded national mandate that includes the NIS2 tasks MCF used to hold.

In practice: registrations and incident notifications go to NCSC (incidents through CERT-SE). Compliance supervision comes from your sector authority.

Sector-Specific Supervisory Authorities

Sector	Supervisory authority
Energy	Swedish Energy Agency (Energimyndigheten)
Transport	Swedish Transport Agency (Transportstyrelsen)
Banking and financial market infrastructure	Swedish Financial Supervisory Authority (Finansinspektionen)
Digital infrastructure, ICT services (B2B), space, postal/courier, digital providers	Swedish Post and Telecom Authority (PTS)
Healthcare (care providers)	Health and Social Care Inspectorate (IVO)
Healthcare (medical products)	Swedish Medical Products Agency (Läkemedelsverket)
Drinking water, wastewater, food production	Swedish Food Agency (Livsmedelsverket)
Public administration, waste, chemicals, manufacturing, research	County Administrative Boards (six designated counties)

The six County Administrative Boards are those of Norrbotten, Skåne, Stockholm, Västra Götaland, Örebro and Östergötland. They also cover higher education institutions and the manufacture of computers, electronics, electrical equipment and machinery, while Transportstyrelsen covers motor vehicle manufacturing. As of 29 October 2026, NCSC still listed the Energy Agency and the County Administrative Boards as proposed supervisors. Organisations spanning multiple sectors may face oversight from more than one supervisory authority.

Swedish Specifics Compared With the EU NIS2 Baseline

Three features of the Swedish law affect organisations with EU-wide compliance programmes built around the directive baseline.

1. Size Is Not the Only Test

Swedish guidance stresses that size alone does not decide coverage. Regions, municipalities and municipal associations are covered whatever their size, and so are certain Annex I operators of special significance to society. Some digital infrastructure and trust service providers are covered without any size threshold. A small organisation in one of these groups cannot rely on headcount to stay out of scope.

2. Whole-Entity Compliance Scope

The Cybersäkerhetslag covers organisations as legal persons, and NCSC confirms that it covers the whole organisation once it is in scope. An international group with a Swedish subsidiary providing B2B ICT services cannot isolate obligations to that division — the Swedish entity carries full Cybersäkerhetslag duties. Sector-based supervision does not narrow this: the sector decides who supervises you, not which parts of the entity must comply. This has direct implications for group-level security governance, supply chain assessments, and board accountability reporting.

3. Phased Secondary Regulation Timeline

Rather than activating all detailed requirements at once, Sweden phased in its regulations:

• 15 January 2026: Cybersäkerhetslag (SFS 2025:1506) and Cybersäkerhetsförordning (SFS 2025:1507) entered into force
• 2 February 2026: MCFFS 2026:1 on registration entered into force and the registration service opened
• 1 July 2026: MCFFS 2026:8 on incident reporting entered into force; MCF’s cybersecurity role, including registration, incident intake and the power to issue regulations, moved to NCSC at FRA
• 1 October 2026: MCFFS 2026:11 on security measures and management training and MCFFS 2026:12 on security audits and security scanning entered into force

Registration did not complete compliance. Organisations that registered in February 2026 have since had to implement the incident reporting rules (from 1 July 2026) and the security-measure, training, audit and scanning rules (from 1 October 2026). For operators active only in digital infrastructure, digital providers, ICT service management (B2B), postal and courier services or space, MCFFS 2026:11 applies only to management training; their security requirements come from the EU implementing regulation and PTS rules.

Registration — How to Notify NCSC (Formerly MCF)

MCF opened registration on 2 February 2026, when MCFFS 2026:1 entered into force. Operators were told to register as soon as possible from that date, and that supervisory authorities may take action if a registration is not received within 14 days. NCSC adds that missing the 14 days does not automatically lead to supervision or sanctions. Since 1 July 2026, registrations go to NCSC: the registration form is sent by e-mail to nis2anmalan@ncsc.se, over a TLS-encrypted connection. If your organisation is in scope and has not registered, do so as soon as possible.

The registration form asks for:

• Organisation name, organisation number, and whether it is established in Sweden or has a representative there
• Address, e-mail and phone number, plus contact details for the person registering
• Sectors and subsectors of operation, and sectors in other EU/EEA countries
• How the organisation identified itself as covered, and whether it is essential or important
• Internet identifiers such as IP addresses and domain names

Self-classification burden: Sweden places the scope and classification assessment on the organisation itself. NCSC does not make that assessment, including the essential-vs-important call. An incorrect downward classification carries material penalty exposure: the difference between essential (€10M/2%) and important (€7M/1.4%) fine ceilings is substantial.

Multinational organisations should note: the Swedish subsidiary registers its own operations with NCSC, independent of any group-level registration in another member state. Sweden follows the NIS2 place-of-establishment rule.

Incident Reporting Timelines

Cybersäkerhetslag follows the three-stage NIS2 model exactly. A significant incident is one that causes material disruption to service provision, financial loss, or harm to other organisations or individuals.

Stage	Deadline	Required content
Early warning	Within 24 hours of awareness	Notification that a significant incident has occurred; note any suspected cross-border impact
Incident notification	Within 72 hours (24 hours for trust service providers)	Classification, severity assessment, initial indicators of compromise
Final report	Within one month of the incident notification	Full incident analysis, root cause, remediation taken, measures to prevent recurrence

Report through the incident reporting tool in Cyberportalen (cyberportal.ncsc.se), which NCSC opened on 1 July 2026; NCSC describes a fallback procedure for reporters without a Swedish e-ID. The detailed rules are in MCFFS 2026:8. Confirm your incident response team can log in and has tested a Cyberportalen submission before an actual incident occurs — the 24-hour early warning window leaves no time for platform familiarisation under pressure.

Penalties and Management Accountability

Penalty exposure follows the NIS2 structure. The amounts below are set in chapter 4, section 10 of the Cybersäkerhetslag.

Entity type	Maximum administrative fine	Minimum fine
Essential entity	Higher of €10M or 2% of global annual turnover	SEK 5,000
Important entity	Higher of €7M or 1.4% of global annual turnover	SEK 5,000
Public operator	SEK 10 million (fixed ceiling)	SEK 5,000

Non-compliance can lead to both orders (förelägganden) and sanction fees. Public operators face a fixed ceiling of SEK 10 million rather than a turnover-based cap.

Management disqualification is the Cybersäkerhetslag’s sharpest personal sanction. A person in a management position at an essential operator can be prohibited from holding a management function there for one to three years. The conditions are that an earlier order was not complied with, the breach is serious, and the person acted intentionally or with gross negligence. The ban cannot be issued in public administration. NIS2’s Article 20 requires management bodies to approve and oversee cybersecurity risk management, and since 1 October 2026 MCFFS 2026:11 also makes management training mandatory.

Compliance Checklist

• Confirm sector, size threshold, and essential vs. important classification
• Register with NCSC if you have not done so — since 1 July 2026 by e-mailing the registration form to nis2anmalan@ncsc.se
• Implement Article 21 security measures across all ten control areas — the law’s duty has applied since 15 January 2026
• Maintain 24-hour early warning capability for significant incidents, reported to NCSC through CERT-SE via Cyberportalen (MCFFS 2026:8, in force since 1 July 2026)
• Assess supply chain risks at direct suppliers and key sub-suppliers
• Obtain board-level approval and documentation of cybersecurity governance
• Align with MCFFS 2026:11 on security measures and management training, in force since 1 October 2026 (PTS sectors: the EU implementing regulation and PTS rules)
• Meet MCFFS 2026:12 on security audits and security scanning, in force since 1 October 2026
• Identify your sector supervisor — for example PTS, Finansinspektionen, IVO or a County Administrative Board
• Check DORA overlap if in financial sector — confirm whether partial exemption from Cybersäkerhetslag applies

Frequently Asked Questions

Is MSB still the NIS2 competent authority in Sweden?

No. MSB (Myndigheten för samhällsskydd och beredskap) became MCF (Myndigheten för civilt försvar) on 1 January 2026, and MCF ran NIS2 registration until 30 June 2026. On 1 July 2026 MCF’s information and cybersecurity operations moved to NCSC at FRA, which now receives registrations and incident reports and is responsible for the NIS2 regulations. MCF’s NIS2 pages now redirect to ncsc.se.

What is the difference between CERT-SE and NCSC?

CERT-SE is Sweden’s national CSIRT, located at NCSC. NCSC, part of FRA, is the central NIS2 authority since 1 July 2026. Incident reports go to NCSC through CERT-SE, using the reporting tool in Cyberportalen; NCSC forwards them to the relevant supervisory authority.

Does Cybersäkerhetslag apply enterprise-wide if only one division is in scope?

Yes. NCSC confirms that the law covers the whole organisation, because organisations are covered as legal persons — not just the triggering division. Map compliance obligations at the legal entity level, not unit by unit.

Can a company below 50 employees be in scope?

Yes. Providers of public electronic communications networks or services, TLD registries, DNS service providers, domain name registration services and trust service providers are covered regardless of size, as are certain Annex I operators of special significance to society. Size thresholds are a default rule, not an absolute exemption.

What if we missed the 14-day registration window?

Register as soon as possible — since 1 July 2026 by e-mailing the form to nis2anmalan@ncsc.se. NCSC states that missing the 14 days does not automatically lead to supervision or sanctions, but supervisory authorities may take action. Substantive compliance obligations — security measures, incident reporting — apply regardless of registration status.

Do Swedish municipalities fall under Cybersäkerhetslag?

Yes. Regions, municipalities and municipal associations are covered regardless of size. Public operators face a fixed maximum fine of SEK 10 million rather than revenue-based percentage caps, and the management ban cannot be issued in public administration.

This article provides general information only and does not constitute legal or regulatory advice. Requirements may vary by jurisdiction and organisation type. Consult a qualified legal professional or compliance specialist for advice specific to your situation.

Related guides

• Sweden NIS2 Energy Compliance: What Svenska Kraftnät’s Ransomware Breach Means for Your NCSC-SE Reporting Clock
• Sweden NIS2 Healthcare Compliance: What the 1177 Data Breach Reveals About Inera Risk and Your Region’s NCSC Reporting Clock
• Sweden NIS2 Telecom Compliance: What PTS Requires From Telia, Tele2, Telenor, and Tre for 5G Security

Sources

1. Riksdagen — Cybersäkerhetslag (SFS 2025:1506)
2. NCSC — Det här är cybersäkerhetslagen, timeline, laws and regulations (checked 29 October 2026)
3. NCSC — Registration, incident reporting, security measures
4. NCSC — Scope and supervisory authorities, FAQ, guidance for management, about NCSC
5. MCF — Swedish Civil Defence and Resilience Agency (MSB renamed 1 January 2026)
6. EUR-Lex — Directive (EU) 2022/2555 (NIS2), Articles 2, 20, 21, 23, 34
7. CERT-SE — Sweden’s National CSIRT
8. Deloitte Sweden — NIS2 Now in Force: Sweden’s Registration Portal Opens
9. Advokatfirman Lindahl — New Cybersecurity Act: implementation of NIS2 in Swedish law
10. Advisense — The Swedish NIS2 Implementation — Cybersäkerhetslagen
11. Eversheds Sutherland — Sweden — EU NIS2 Directive overview
12. Chambers and Partners — Cybersecurity 2026 — Sweden
13. Copla — NIS2 regulations and implementation in Sweden