Act 2025
Cybersäkerhetslag (2025:1506) (Cybersecurity Act)
Effective: 15 Jan 2026
Plain-English summary
Applies to essential and important entities under the NIS 2 Directive and to certain public bodies, and sets incident reporting and sanction fees. It replaces the Act (2018:1174) on information security for societally important and digital services. Issued 11 December 2025; supervisory authorities are to be designated by the government.
Who it applies to
All industries
Topics
Cybersecurity & IT Risk
Obligations arising from this law or regulation
| Obligation | Timing | Regulator | Source | Detail |
|---|---|---|---|---|
| Cyber incident reporting by essential and important entities | Deadline Early warning within 24 hours; notification within 24 hours (trust services) or 72 hours (others); final report within one month | FRA | source | |
Ch. 2 ss. 5-8 require an early warning of a significant incident as soon as possible and no later than 24 hours after becoming aware. The incident notification follows within 24 hours for trust service providers and 72 hours for other operators; a final report is due within one month of the notification. Under the Cybersecurity Ordinance (2025:1507) ss. 6 and 31, incident reports go to the CSIRT unit, which is Försvarets radioanstalt; the CSIRT passes the information to the supervisory authority (s. 33). |
||||
| No obligations match these filters. | ||||
Latest news
No related news yet. We publish updates as regulators act.