If you have heard that NIS2 registration has to be in by 30 September 2026, you have heard wrong. That date does not appear in the Swedish Cybersecurity Act, nor in the ordinance, nor in any regulation. It circulates widely all the same, often in texts that also name the wrong authority.
Here is what actually applies to notification under the Cybersecurity Act, what happens on 1 October, and what to do if you have not notified yet.
Is there a 30 September deadline?
No. We have been through the Cybersecurity Act (2025:1506), the Cybersecurity Ordinance (2025:1507), the regulations and the authorities’ own timetables. The date appears in none of them.
The claim circulates in automatically generated content that spread during the spring, often paired with the claim that notification goes to MSB, the Swedish Civil Contingencies Agency. That is wrong too, as we come back to below.
What the law says
The Cybersecurity Act came into force on 15 January 2026. The notification service opened on 2 February 2026, the same day the regulation on notification and identification started to apply.
The law sets no calendar date. The wording is that an entity shall notify as soon as it can. The authority has said that supervisory authorities may act where a notification has not arrived within fourteen days, which in practice pointed to the middle of February 2026.
That point has long passed. If you have not notified, you are not late for a deadline ahead of you, you are late against one that expired last winter.
For changes the law does set a clear limit: where the circumstances in a notification you have already made have changed, you have to report that as soon as you can, and at the latest fourteen days after the change took place.
Who receives the notification
This has moved during the year, which explains some of the confusion.
- Until 30 June 2026 notifications were received by MCF, the Swedish Agency for Civil Defence.
- From 1 July 2026 they are received by the National Cybersecurity Centre (NCSC) at FRA, where the cyber function moved.
So MSB is not the receiving authority for a NIS2 notification. Supervision itself is then exercised by the supervisory authority for your sector, the Swedish Energy Agency or the Post and Telecom Authority, for example, depending on what you do.
What to do if you have not notified
- Work out whether you are covered. Two conditions have to be met at once: the operation sits in one of the eighteen listed sectors, and it is at least the size of a medium-sized company. Our guide does NIS2 apply to your company walks through the assessment.
- Count the size correctly. At least 50 people employed, or both turnover and balance sheet total above 10 million euro. Partner companies and group companies count, so a subsidiary with 30 employees can be covered through its group.
- Notify NCSC. Notification goes through their online service or form. You will need details of the operation, contact people and the sector you belong to.
- Do not wait to be asked. A late notification is a great deal better than none. Coming forward after the deadline is not the same thing as being found during an inspection.
- Report changes as they happen. Change a contact person or change the operation, and the fourteen-day limit applies.
What actually happens on 1 October 2026
Here is the date that belongs in the calendar, and it is not about notification.
On 1 October 2026 the regulations on security measures and on training for management come into force, together with the regulations on security audits and security scanning.
Two consequences are worth drawing out.
The duty to train management becomes real. The Cybersecurity Act places responsibility on the people in management, not on the IT department. That means the CEO and the board.
The requirements travel into contracts. For contracts in force or signed after 1 October, the requirements have to be passed on to suppliers. Which means companies not covered themselves will meet them anyway, through customers who are. That is the same pattern we describe in supplier security requirements.
If you are not covered
Most Swedish smaller companies are not. The sector list is broad but not universal, and an ordinary consulting or services company falls outside it.
Make the assessment once anyway, and write it down. Two reasons: so you can answer when a customer asks in a questionnaire, and because the assessment can change as you grow or as the group structure changes. A note with a date and a reason is enough.
And the Cybersecurity Act is only one of several frameworks that arrive as a company grows. Falling outside NIS2 does not mean nothing applies.
Common questions
We missed the February deadline. What now? Notify as soon as you can. The law attaches no sanction specifically to a late notification, and the supervisory authority decides independently on any action. Putting it right yourself weighs more than waiting.
Where do we notify? To NCSC at FRA, since 1 July 2026. Not to MSB, which is often given incorrectly.
We are a small company in a listed sector. Are we covered? The size criterion has to be met as well, but count partner and group companies before you conclude. Some smaller operators are also covered whatever their size, a sole supplier of an essential service, for instance.
What does non-compliance cost? The fines are meant to hurt: up to two per cent of global annual turnover or ten million euro for essential entities, and 1.4 per cent or seven million euro for important ones. Those figures target failure to meet the requirements, not a late notification as such.
Does management have to take a course? Yes, for entities that are covered. The requirement becomes real on 1 October 2026 and it is aimed at the people in management.
What are the deadlines in an incident? An early warning within 24 hours, an incident notification within 72 hours and a final report within a month. Our walkthrough of incident response in 72 hours sets out the flow.
Where Polaris comes in
Polaris keeps track of which rules apply to you, what you need to be able to show, and when something changes. The assessment of whether NIS2 covers you is documented with a date and a reason, so it can be answered when a customer asks.
This article is general guidance, not legal advice. The details were checked against the Cybersecurity Act, the Cybersecurity Ordinance and the authorities’ published timetables on 9 September 2026. The framework keeps developing; check the current position with NCSC and with the supervisory authority for your sector.
