NIS2 and the Cybersecurity Act: does it apply to you?

The EU NIS2 Directive became Swedish law through the Cybersecurity Act (2025:1506). The Act has applied since 15 January 2026. It sets requirements for risk management, incident reporting and management responsibility. But only certain entities are covered.

Who is covered?

The Act applies to essential and important entities in designated sectors. This includes energy, transport, banking, healthcare, drinking water, digital infrastructure, post, waste, food, certain manufacturing of equipment, and digital services such as cloud providers.

As a rule, the company must be at least medium-sized. That is roughly 50 employees or EUR 10 million in turnover. A small agency, shop or consultancy is therefore usually not directly covered. Certain providers of digital infrastructure are exempt from the size requirement.

Supervision is handled sector by sector by several authorities. Myndigheten för civilt försvar (MCF), formerly MSB – the Swedish Civil Contingencies Agency – has a coordinating role.

How small businesses are still affected

One detail is easy to miss: NIS2 requires affected organisations to have control over security in their supply chain. If you sell IT services, operations or software to a municipality, an energy company or a healthcare provider, you may get questions about your own security. This can involve incident routines, updates and where data is stored.

Answering those questions well becomes a competitive advantage. Here is what a reasonable minimum can look like for a small supplier:

• Use a proper password manager such as 1Password or Bitwarden so that no passwords live in spreadsheets or emails.
• Choose subcontractors with clear EU data storage and documented security. Our provenance labels and certificates are a shortcut.
• Document how you handle updates, passwords and access rights.
• Have a simple incident routine: who does what if something happens?
• For sensitive documents and collaboration: try self-hosted storage with Nextcloud.

In short

Are you directly affected? Probably not, if you are small and outside the sectors. Are you indirectly affected? More and more often, through your customers. Read more in our overview.