The Swedish Cybersecurity Act Autumn 2026 – Supervision So Far And New Requirements From 1 October

The Swedish Cybersecurity Act has now been in force for just over eight months. Regulatory work is continuing, the first supervisory cases have been initiated, and from 1 October 2026 new regulations will apply concerning, amongst other things, security measures, management training, security audits and security scanning.

Over the summer, Vinge has assessed how supervision has been conducted so far through contacts with the supervisory authorities and by requesting copies of decisions taken. The assessment demonstrates that supervision has commenced but is still at an early stage, with the focus on the duty to notify and incident reporting. Meanwhile, the new regulations, which apply from 1 October, mean that more detailed requirements will be imposed on operators’ cybersecurity work and supplier relationships - requirements that may also have implications for agreements already in place.