NIS2 is implemented in Sweden through the cyber security act (2025:1506), in force since 15 January 2026. It reaches an estimated 8,000 organisations across eighteen essential sectors — energy, transport, health, water, waste, food, manufacturing and digital infrastructure among them. The act puts the responsibility on management, and it says in as many words that management is to be trained.
11 September 2026: CRA reporting duties
From that date manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents — an early warning within 24 hours and a full notification within 72. It applies to products already on the market, well before the full requirements in December 2027.
What management is responsible for
- Approving and following up the risk management measures — the responsibility cannot be delegated to IT.
- Undergoing training themselves, and offering equivalent training to staff.
- Making sure incidents are reported to the supervisory authority in time.
- Carrying the requirements into the supply chain, not just the organisation itself.
- Fines reach 2% of global turnover or EUR 10 million.
NIS2 and the CRA are two different questions
The cyber security act is about how you run the business: governance, risk management, continuity and reporting. The Cyber Resilience Act is about what you sell: products with digital elements have to be secure in themselves, stay updated and have a managed vulnerability process. If you manufacture something connected and run essential services, both apply — and they land on different parts of the organisation.
Common questions about the cyber security act
What decides whether the act reaches you, and what it demands if it does.
- Are we covered by the cyber security act?
- It depends on sector and size. Organisations in one of the eighteen sectors with at least 50 employees or EUR 10 million in turnover are normally covered, and some smaller ones are covered anyway because of their role. Registration is with the supervisory authority.
- What does the act require of management?
- That it approves the risk management measures, follows up that they are carried out, and is itself trained in cyber security. Management can be held accountable when it fails.
- What is the difference between NIS2 and the Cyber Resilience Act?
- NIS2, meaning the cyber security act, sets requirements for the business. The CRA sets requirements for products with digital elements placed on the EU market. One governs how you work, the other what you sell.
- When does an incident have to be reported?
- Under the CRA, an early warning within 24 hours and a full notification within 72 hours for actively exploited vulnerabilities and severe incidents, from 11 September 2026. The cyber security act has its own deadlines on the same logic: an alert first, an account afterwards.
Train management before the regulator asks
Online courses with a test and a course certificate — the documentation that the training requirement is met comes with it.
See all courses