Requirements by headcount: 10, 25 and 50 employees

Fifty employees is the line every growing company has heard about. It is real, but less dramatic than its reputation, and it is not the most important line you cross. Working through what actually applies at fifty, it turns out that only four things are triggered by that number. Considerably more arrived at 3, 5, 10 and 25 employees, and that is where most companies have missed at least one.

This article is a map. First the four thresholds at 50 that genuinely matter, then what you should already have in place, and finally the common misconceptions. We also take one thing that is rarely mentioned: the laws count your employees in three different ways.

The four requirements triggered at 50

1. An internal whistleblowing channel

The clearest one. The Whistleblowing Act requires an organisation that at the start of the calendar year had 50 or more employees to have internal reporting channels and routines for following up.

The measuring point is decisive and often missed. Pass 50 in March 2026 and the duty starts on 1 January 2027, not immediately. That gives you planning time, but only if somebody is watching the number.

The channel has to take reports in writing and verbally, and allow a face-to-face meeting on request. You have to acknowledge a report within seven days of receiving it and give feedback on action within three months of that acknowledgement.

One practical relief: private companies with 50 to 249 employees may share a reporting channel and investigation resources with others. Responsibility for feedback and action stays with you. It still lowers the cost considerably for a company that has just crossed the line. Our walkthrough of the Whistleblowing Act covers the requirements in detail.

Supervision works through injunctions that can be backed by a penalty payment. There is no administrative fine attached to this particular duty.

2. A health and safety committee

The Work Environment Act requires a safety committee at a workplace where at least fifty employees are regularly engaged.

The key word is workplace. A company with 60 employees spread across three offices of 20 does not trigger the requirement. A single office with 50 does. This is a common error in articles about the 50 line, and the difference decides whether you need a formal forum at all.

The committee takes part in planning the work environment effort and deals with occupational health services, action plans, the planning of new premises and new ways of working, and training and rehabilitation. A committee also has to be set up at smaller workplaces if the employees ask for one.

3. The Cybersecurity Act, but only in some sectors

The Swedish Cybersecurity Act came into force on 15 January 2026 and implements NIS2. The size criterion is that the operation is at least the equivalent of a medium-sized company: at least 50 people employed, or both turnover and a balance sheet total above 10 million euro.

But size only matters if you operate in one of the listed sectors: energy, transport, banking, health, water, digital infrastructure, managed IT services, food, manufacturing, chemicals, waste, post, space, research and a few more. An ordinary consulting or services company with 50 employees is not covered.

Two things surprise people. First, partner companies and group companies count in the size calculation, so a subsidiary with 30 employees can be covered through its group. Second, there is a personal duty: the people in management have to undergo training on security measures. That means the CEO and the board, not the IT department.

The fines are of a different order from everything else in this article: up to two per cent of global annual turnover or ten million euro, whichever is higher, for essential entities. For important entities the ceiling is 1.4 per cent or seven million euro. Our walkthrough of the Cybersecurity Act sorts out who is covered.

4. Becoming a “larger company” in your accounts

The Annual Accounts Act classes a company as larger where more than one of three conditions is met in each of the two most recent financial years: an average of more than 50 employees, a balance sheet total above 40 million kronor, or net turnover above 80 million kronor.

Become a larger company and you can no longer use the K2 framework. The annual report has to be prepared under K3, a cash flow statement becomes mandatory and the notes expand. If you are a parent company and the group as a whole passes the same thresholds, the exemption for smaller groups falls away and consolidated accounts are required.

This is the threshold that costs the most work. Your auditor normally flags it in good time.

Three laws, three ways of counting

Here is the trap. The laws say “50” and mean different things.

Note the difference between “50 or more” and “more than 50”. In one case the fiftieth person counts, in the other you need 51. Note also that an annual average and a headcount on a given day can differ substantially in a company that hires during the year.

One caveat: the Whistleblowing Act does not say how the number is calculated for part-time staff, agency workers or groups. A common reading is headcount per legal entity, but the question has not been tested. If you are right on the line it is worth a question to your lawyer rather than a guess.

What applies at 10 employees

Ten is the threshold that triggers the most documentation. It usually slips by unnoticed.

• The work environment has to go on paper. The work environment policy, routines, allocation of duties and the annual follow-up have to be in writing from ten employees in the operation. Our guide to the most important compliance documents covers what is needed.
• The pay survey has to be documented in writing. The survey itself has to be carried out annually by every employer, whatever their size.
• The micro exemption in the accessibility act ends. The exemption only covers companies with fewer than ten employees and at most 2 million euro in turnover or balance sheet total, and only for services. If you sell products you are covered whatever your size. If you sell e-commerce, tickets, e-books or certain digital services to consumers, the requirements already apply.

What applies at 25 employees

Two things, both formalities rather than systems.

• The whole effort on active measures against discrimination has to be documented in writing, not just the pay survey. The measuring point is the number at the start of the calendar year.
• Employees gain the right to board representation, two members and two deputies, calculated on the average during the most recent financial year. The right is exercised by a trade union bound by a collective agreement. Without a collective agreement there is no organisation able to appoint them.

And what you passed even earlier

Three requirements arrived long before ten employees. They tend to be discovered after the fact, when a customer or an authority asks.

• Above 3 employees: the audit requirement for limited companies. That line was passed long ago in a company of your size.
• From 5 employees per workplace: a safety representative has to be appointed.
• From 5 or 20 people affected: notice to the Swedish Public Employment Service in a redundancy situation, with notice periods of two to six months depending on scale.

Add to that what never had a threshold at all: the record of processing activities under the GDPR, data processing agreements with your suppliers, systematic work environment management and an Employee Handbook that is actually used.

Four myths about the 50 line

“The audit requirement starts at 50.” No. A limited company must have an auditor where the same two of three values are exceeded for two financial years running: more than 3 employees on average, a balance sheet total above 1.5 million kronor and net turnover above 3 million kronor. You have had an auditor for a long time.

“Everyone with 50 employees is covered by NIS2.” No. Only operations in the listed sectors. And conversely, a smaller company can be covered through a group calculation or as the sole supplier of an essential service.

“Occupational health services become mandatory at 50.” No. The employer has to provide the occupational health services that working conditions require. That is driven by need, not by size. The safety committee does have to deal with the question once it exists, which in practice forces a decision.

“We have to produce an equality plan.” No. The requirement for an equality plan was abolished in 2017 and replaced by the documentation requirements at 10 and 25 employees. Many people still believe the plan is required.

Add a fourth half-truth: the GDPR exemption from the record of processing for organisations under 250 employees. It only applies where the processing is at the same time low-risk, occasional and free of special category data. Every employer processes employee data continuously and handles sick leave, which is health data. For an employer the exemption has been meaningless since the first hire.

What is coming

The pay transparency directive. The EU requires reporting on pay gaps from 100 employees, with different intervals for 100 to 149, 150 to 249 and 250 upwards. Sweden has not legislated yet. A referral to the Council on Legislation was submitted in January 2026, but in March the government pushed the planned entry into force to 1 January 2027, with first reporting to DO by 20 May 2028, and at the same time asked the Commission to renegotiate. No bill has been presented. Follow it, but wait for the detail until there is Swedish law.

Sustainability reporting. The EU’s omnibus amendment moved the CSRD threshold to companies exceeding both 1,000 employees and 450 million euro in turnover. A company of 50 is not affected, and is not affected under the thresholds now proposed in Swedish law either.

There is also a protection on the way. The omnibus introduces a value chain cap: companies with an average of at most 1,000 employees are to have the right to refuse to provide sustainability information beyond the voluntary standard. Sweden has not implemented the change yet. An inquiry delivered an interim report in April 2026 and the rules are proposed to enter into force on 1 January 2027. Until then the cap is something on its way, not something you can invoke against a large customer or a bank today.

What to do in practice

1. Count, and write down when. Note the number of employees on 1 January, the average over the year, and the number per workplace. Three figures, three different laws.
2. Look a year ahead. Sitting at 46 and recruiting? Then you already know what applies on 1 January.
3. Clear the backlog first. Most companies have a gap among the requirements at 10 and 25 employees. They are cheaper to fix than the ones at 50, and they are more often what a customer actually asks about.
4. Appoint an owner. One person who holds the documents together and knows when the next threshold is approaching. Without an owner, the lines are noticed afterwards.
5. Check the sector question once. If you are in a NIS2 sector that is by far the heaviest item on the list. If you are not, you can set it aside entirely.

Common questions

Do part-time employees count as whole people? The laws are not consistent about it. The Whistleblowing Act is silent, the Work Environment Act talks about those regularly engaged, and the Annual Accounts Act uses an average, which is a calculated annual figure. If you are near a line, take a written position and check it with your adviser.

We have 55 employees across four offices. Do we need a safety committee? Only if one individual workplace regularly engages at least 50. Four offices of around 14 each do not trigger it, though the employees can ask for a committee anyway.

What happens if we drop back below 50? It depends on the requirement. The whistleblowing duty is assessed at the start of each calendar year. The classification as a larger company requires the conditions to be met two years running, in both directions. Board representation continues through the current term.

Do we have to have a collective agreement when we reach 50? No. There is no size threshold that triggers a collective agreement. Agreements are signed after negotiation. Board representation does assume one in practice, though, since the right is exercised by a union bound by an agreement.

What does a whistleblowing channel cost for a company of 50? It varies, but remember the right to share a channel with other companies in the 50 to 249 range. That is the single largest cost reduction for a company that has just crossed the line.

Which of the lines should we take first? If you are in a NIS2 sector, that one. Otherwise most companies do best to start with the backlog at 10 and 25 employees, because it is cheap to fix and usually already overdue.

Where Polaris comes in

Polaris keeps track of which requirements apply at your size, in your industry, and shows what is missing before anyone else finds the gap. You also see which threshold is next, rather than discovering it once it has passed.

Want to know where you stand today? Take our Compliance Health Check: a position per area, no login.

This article is general guidance, not legal advice. Thresholds and methods of calculation differ between the laws, and several questions are untested. If your company is near a line, take legal advice before drawing conclusions.