Does NIS2 apply to you in Sweden? How to tell

The test has two steps. Sector comes first. NIS2 lists eleven sectors of high criticality in Annex I, among them energy, transport, banking, health, drinking water, digital infrastructure and public administration, and seven other critical sectors in Annex II, such as postal and courier services, waste management, food, manufacturing and research. Under 1 kap. 4 § (Chapter 1, Section 4), your sector is decided by what your organization itself does.

Then size. The act uses the EU definition of small and medium-sized enterprises in Recommendation 2003/361/EC. Medium-sized starts at 50 employees or turnover above €10 million, large at 250 employees or turnover above €50 million. The definition also has a balance-sheet test that can move a borderline case one step down, so if you sit close to a line, run that number too.

Micro and small enterprises in the named sectors are therefore normally outside the law. Normally, because a supervisory authority can designate a smaller organization individually.

For some activities, size plays no part in whether the law applies (1 kap. 5 §): top-level domain registries and DNS service providers, trust service providers, and providers of public electronic communications networks or services. Size can still decide which class they end up in, as the section on essential and important entities below explains.

There is also a rule for an organization that is the only provider in Sweden of a service that critical societal or economic activity depends on. It removes the size threshold, but only for organizations in a sector the law already names, and it is normally the supervisory authority that decides whether it applies. A company can't assess itself into scope.

This is the rule a simplified reading misses. Size isn't tested on the legal entity alone. Article 6 of the EU recommendation adds a controlling parent's headcount and turnover to the subsidiary's before the thresholds are applied, and article 6(3) also adds the companies linked to that parent. Sister companies count too.

Two examples. A subsidiary with 20 employees in a group with 4,000 employees is a large enterprise for the purposes of the law, and if it operates in an Annex I sector it is a väsentlig verksamhetsutövare, an essential entity. A holding company with three employees that owns several large operating companies takes the whole group over the line in the same way, even though the parent looks small on its own.

Holdings between 25% and 50% count pro rata (article 6(2)). An owner with a 40% stake and a thousand employees adds four hundred to your total. Some owners don't count at all: under article 3(2), venture capital funds, universities and small local authorities leave a company autonomous even when they hold up to 50%.

Sector works differently, and it never passes from one group company to another. A service company in an energy group doesn't become an energy company because its parent is one, and if your own activity falls outside the eighteen sectors, you are not covered however large the group is. The requirements can still reach you. A covered company in the group has to secure its suppliers under 2 kap. 3 § (Chapter 2, Section 3), and a shared service company for IT or finance is the first supplier it looks at. The requirements then arrive as a contract clause and a security questionnaire. No registration duty comes with them.

A note for companies owned by municipalities or regions: the EU recommendation says that a company in which public bodies control 25% or more is not a small or medium-sized enterprise (article 3(4)). Cybersäkerhetslagen expressly sets that rule aside in its own definition of a medium-sized enterprise (1 kap. 2 §), so public ownership doesn't change the size class.

Public bodies come within the law by a route of their own, 1 kap. 3 §, and it has no size requirement. It covers every kommun (municipality), every region (the elected county-level bodies that run public healthcare) and every kommunalförbund, a joint body set up by municipalities or regions. It also covers state agencies with the power to decide on cross-border movement of people, goods, services or capital, for example in migration, customs and company registration.

So a small municipality is covered. Read the law as if the main rule's size threshold applied here too and you'll conclude that the municipality falls below it, which is wrong. The class it lands in does follow size. Under 1 kap. 9 § (Chapter 1, Section 9), a municipality or region is an essential entity only when it is larger than a medium-sized enterprise. A smaller one is an important entity, a viktig verksamhetsutövare, with the same security requirements but reactive supervision. A state agency covered through 3 § is always essential.

The rule turns on what the organization is. A municipality that runs its own waterworks is covered through 3 § whichever sector it considers itself part of. A municipally owned company is a separate legal person and is assessed under the main rule, on sector and size.

Some public bodies are outside the law altogether. Under 1 kap. 14 §, that applies to the government, Regeringskansliet (the Government Offices), the courts and the authorities under the Riksdag, the Swedish parliament. It also applies to state agencies that mainly carry out security-sensitive or law-enforcement work (1 kap. 12 §). Cybersäkerhetsförordningen, the government ordinance that goes with the act, can also designate further bodies. If you are an agency that doesn't fit any of these categories, check with your supervisory authority.

The security requirements are the same in both classes. Supervision and fines differ. An essential entity is under proactive supervision, where the authority can inspect without waiting for an incident, and can be fined up to 2% of global annual turnover or €10 million. An important entity gets reactive supervision and fines of up to 1.4% or €7 million. In both cases the higher amount applies.

The class is decided by 1 kap. 9 §. Essential entities are:

• large enterprises (250 employees or more, or turnover above €50 million) in an Annex I sector
• state agencies covered through 3 §, whatever their size
• municipalities and regions larger than a medium-sized enterprise
• top-level domain registries, DNS service providers and qualified trust service providers, whatever their size
• providers of public electronic communications networks or services that are at least medium-sized

Some organizations that sector and size bring in are then taken back out, wholly or in part. Financial entities covered by DORA, the EU's Digital Operational Resilience Act, are still within cybersäkerhetslagen and still have to register. Their security measures, management training and incident reporting come from DORA instead, with reports going to Finansinspektionen, Sweden's financial supervisory authority (1 kap. 11 §). An entity exempted from DORA under article 2(4) of that regulation is not covered at all.

Under 1 kap. 10 §, another law with at least equivalent requirements can also apply in its place. Deciding that means comparing two sets of rules side by side, which no short check can do for you.

If you are covered, register with Nationellt cybersäkerhetscenter (NCSC), Sweden's national cybersecurity center, as soon as possible (2 kap. 2 §). The duty to register has applied since 2 February 2026, and since 1 July 2026 registrations go to NCSC. Forms and instructions are on ncsc.se. If you haven't registered yet, you are behind.

Supervision is the job of the authority for your sector, for example PTS (the Swedish Post and Telecom Authority) for digital infrastructure and Transportstyrelsen (the Swedish Transport Agency) for transport. Check with that authority if you're unsure about your assessment, and with NCSC if you don't know who supervises you.

The law's other duties apply in full: risk-management measures under 2 kap. 3 §, management approval and training under 2 kap. 4 §, and reporting of significant incidents within 24 hours, 72 hours and one month. Our checklist for cybersäkerhetslagen (in Swedish) walks through the work step by step, and our comparison of NIS2 and ISO 27001 shows how much of it an ISO 27001 management system already covers.

A no is worth documenting too. Write down the assessment with the sector and size you based it on, and include the group. A supervisory authority can ask, and an organization that grows, or is bought by a larger group, can cross the threshold without anyone noticing.

Think about your customers as well. A covered entity has to secure its supply chain, so if you sell to one, questions about risk assessment, access rights and incident procedures will reach you anyway, through the contract. Aquil's free plan includes the full NIS2 assessment with all 57 requirements, and it works as well for answering a customer as for getting ready for your supervisory authority.

Everything above follows cybersäkerhetslagen (2025:1506) and the NIS2 directive as they stand in October 2026, and these are the rules the NIS2 check applies. Each EU country transposes NIS2 into a law of its own, so check before you carry this answer over to a group company outside Sweden. Treat the article as guidance for a first assessment. In borderline cases the text of the law and your supervisory authority's view decide, and that is when it can be worth bringing in a lawyer.