NIS2 has gone from EU directive to Swedish law. On 15 January 2026 the Cybersecurity Act (2025:1506) came into force, bringing concrete requirements, heavy sanctions and a deadline that many Swedish companies still do not have on the radar. If you carry IT, security or management responsibility and are not sure whether the law applies to you, this guide is written to give you an answer you can act on rather than a legal treatise.
We cover who is caught, what the law actually requires, the dates that matter during 2026 and, perhaps most importantly, why the requirements reach thousands of smaller companies that are not on the list themselves.
What the Act is, briefly
The Cybersecurity Act is Sweden’s implementation of the EU’s NIS2 directive. Compared with the old NIS regime it sets clearer requirements on risk management, incident reporting and supply chain security, and it covers considerably more organisations across more sectors. It also moves responsibility upward: management carries direct responsibility for cybersecurity and is expected to have enough competence to approve and follow up the security measures.
In practice, cybersecurity can no longer be parked with a lone IT manager. It is a management matter, with personal responsibility and real sanctions behind it.
Are you covered?
This is the question most people want answered first. Three things decide it.
Size. As a rule of thumb, medium-sized companies and larger are caught directly: operations with at least 50 employees, or turnover or a balance sheet total above 10 million euro. Smaller companies normally fall outside the direct scope, with some exceptions for operators of particular importance to society.
Sector. NIS2 covers 18 sectors, split into “essential” and “important” entities: energy, transport, health, drinking and waste water, digital infrastructure, large-scale food production, manufacturing and certain digital services among them. If your core operation falls into one of those and you meet the size thresholds, you are probably required to register.
The supply chain. This is the point that catches most people out. Even where you are not covered directly, your customers may be, which affects you indirectly. More on that below.
If you are still unsure after those three questions, that is a sign the question needs a formal assessment rather than a shrug. We have a separate guide that walks through it step by step, does NIS2 apply to your company?, and our Compliance Health Check gives you a quick first indication of where you stand.
What the law requires in practice
The requirements can look overwhelming, but they come down to a few concrete building blocks.
Risk management and security measures
You need a systematic way of identifying and managing cyber risk: risk analysis, technical and organisational security measures, access control, encryption where it is warranted, and continuity planning. This is not about buying a product. It is about being able to show that you work methodically and can stand behind your choices.
Incident reporting
One of the sharpest changes is the duty to report serious incidents within tight time limits: an early warning very quickly, followed by more detailed reporting. That assumes an incident routine is in place before anything happens. We have written a practical walkthrough of the first few hours in incident response in 72 hours.
Supply chain security
You are responsible for security across your whole supply chain. In concrete terms that means setting requirements for your own suppliers, and being ready to answer your customers’ requirements.
Management responsibility
Management has to approve the security measures and can be held responsible where the work is neglected. That makes cybersecurity a standing item for the board and the management team rather than a delegated technical question.
The dates that matter in 2026
The timeline is tight, and several dates have already passed.
- 15 January 2026: the Cybersecurity Act came into force.
- 2 February 2026: the regulations on notification and identification of essential and important entities started to apply.
- 1 October 2026: the regulations on security measures and on training for management come into force, together with those on security audits and security scanning.
1 October is the date that belongs in the calendar of every affected company right now. Notification to the authority, on the other hand, should have been made back in February 2026. If you have not made it, see our walkthrough of the NIS2 notification. The message either way: do not put off finding out whether you are covered.
What inaction costs
The sanctions are deliberately heavy. For essential entities, administrative fines can reach the higher of 10 million euro or 2 per cent of global annual turnover. For important entities the ceiling is 7 million euro or 1.4 per cent of turnover. On top of that comes the commercial price: customers who pass over suppliers that cannot show they meet the requirements.
The hidden effect: customer requirements
Here is the point that makes NIS2 relevant far below the size thresholds. Companies that are covered are responsible for their supply chain, and they will demand evidence of security from their suppliers, through tenders, security clauses in contracts and recurring reviews. How those requirements look and are answered in public procurement specifically is covered in security requirements in public procurement.
The result: thousands of Swedish smaller companies not covered by the law will still have to show an equivalent level of security to keep doing business with larger customers. We describe that shift in more detail in supplier security requirements. For many smaller companies it is this, rather than the statute, that becomes the real reason to act.
It also means compliance is not only a cost. The company that can answer customers’ security requirements quickly and credibly wins business its competitors lose. We develop that case in compliance as a competitive advantage.
Getting started: a pragmatic order
Starting from zero, take it in this order:
- Decide whether you are covered: directly (size and sector) or indirectly (through customer requirements). Document the assessment.
- Map where you stand: which security measures already exist, and where are the gaps?
- Establish an incident routine: who does what in the first hours, and how do you report in time?
- Set requirements in your supply chain, and prepare answers to your customers’.
- Anchor it in management: make cybersecurity a standing item with clear ownership.
None of this needs a large, expensive project to begin. It needs a structured first step.
Where Polaris comes in
Polaris is building an AI-driven compliance platform for Swedish SMEs that makes exactly this manageable, so that NIS2, the GDPR and customer requirements become something you can show rather than something you worry about. The platform launches during the second half of 2026.
Want to know where you stand today? Take our Health Check for a position per area and a first picture of your gaps.
This article is general guidance, not legal advice. How the Cybersecurity Act applies depends on your particular operation. Check your own situation with your lawyer or with the competent authority.
