Cybersäkerhetslagen (SFS 2025:1506) entered into force on January 15, 2026. The MCF self-registration window closed February 16, 2026. This hub collects every Vakteye article anchored to NIS2 Article 21(2) measures, Article 23 incident reporting, MCF supervisory practice, and what audit-ready evidence looks like for essential and important entities under Swedish law.
Sweden's Cybersecurity Act (SFS 2025:1506) has been in force since January 15, 2026. When MCF or PTS comes knocking, they don't audit your policy — they audit your evidence. The audit playbook: what they ask for, what you can test yourself today, and where documentation takes over.
Sweden's NIS2 implementation (Cybersäkerhetslagen) is live since January 15, 2026. No grace period. Here's what it requires and what happens if you ignore it.