NEWS

On 15 January 2026, Sweden’s new Cybersecurity Act, “cybersäkerhetslagen”, came into force, implementing the EU’s NIS2 Directive – a framework designed to enhance cybersecurity across the EU. This entails significant changes for both public sector bodies and private organisations across many sectors.

The aim of the new Act is to establish a uniform and high level of protection for network and information systems, through clear requirements for risk management, security measures and incident reporting. The Act replaces the previous NIS legislation and will cover a significantly larger number of organisations.

Who will be covered by cybersäkerhetslagen?

Cybersäkerhetslagen will apply to organisations within 18 sectors deemed to be of critical importance to society – such as energy, transport, finance, digital infrastructure, healthcare and public administration. Organisations providing essential ICT services, cloud services, domain name registration and other critical functions may also be covered.

The exact scope of application and which organisations are required to register with the Swedish Civil Contingencies Agency (MSB) will be specified in regulations and specific criteria to be established by the authorities shortly.

The key requirements

Although the details of the Act and the regulations are still being finalised, several key requirements are already clear:

1. Risk-based cybersecurity work

Organisations must establish a systematic, risk-based approach to protecting their network and information systems. This involves identifying, assessing and managing cyber security risks on an ongoing basis.

2. Security measures and governance

There will be a requirement for appropriate technical and organisational measures, such as security controls, update procedures and log management. Cybersecurity work must also be firmly established at management level.

3. Incident reporting

Significant incidents must be reported within 24 hours to the Swedish Civil Contingencies Agency (MSB) or the relevant supervisory authority. Follow-up information may be required at a later date. See the article on the new Cyber Security Act for further details.

4. Supply chains and third-party risks

Organisations need to monitor security within their supply and partner chains. This may involve requiring suppliers to meet certain security requirements.

5. Supervision and sanctions

Regulatory authorities are granted expanded powers of supervision. Non-compliance may lead to sanctions, including, in some cases, substantial fines.

How should organisations prepare?

Cybersäkerhetslagen is based on a risk-based and business-specific approach. This means that the legislator largely refrains from imposing detailed requirements on how security work should be carried out, and instead focuses on the capabilities and structures that must be in place. Preparatory work must therefore be based on the organisation’s own operations, risk profile and technical environment.

A key initial question for many organisations is the scope of application. There is already good reason to analyse whether the organisation’s activities are likely to fall within the scope of the Act, either as a directly regulated entity or through its role in a supply chain. This assessment will influence both the level of ambition and the priorities for the work ahead.

Furthermore, the Act requires systematic and documented risk management. In practice, this means that organisations need to have a structured understanding of which network and information systems are critical to their operations, what threats these are exposed to, and what consequences an incident could have. For many, this involves the further development of existing risk and security processes rather than starting from scratch.

A recurring theme in both legislation and the MSB’s guidance is governance and accountability. Cybersecurity should not be regarded as an isolated IT issue, but as part of the organisation’s overall management and control structure. This requires clear lines of accountability, management involvement and a link between security work and the organisation’s strategic objectives.

Cybersäkerhetslagen also imposes increased requirements for incident management and reporting. Organisations therefore need to reflect on their ability to detect, assess and manage incidents within the timeframes specified by the Act. This encompasses technical solutions as well as organisational processes and internal communication.

Finally, the Act raises issues concerning supplier and third-party risks. Many organisations rely on external IT services, cloud solutions and service providers. Preparatory work should therefore also include a review of how cybersecurity risks are managed in contractual relationships and partnerships.

All in all, there is strong evidence to suggest that organisations which commence a structured analysis and preparation process in good time will be better equipped when the Act comes into force – not least as the regulatory authorities’ guidelines and practices gradually become clearer.

In conclusion

The new cybersäkerhetslagen represents a major shift for Swedish organisations. It involves more than just technical safeguards – it is a matter of management and governance, where risk management, rapid incident reporting and a culture of cybersecurity will be crucial. Preparing now will put organisations in a better position to meet the requirements when the Act comes into force.

The new cyber security act, cybersäkerhetslagen (2025:1506) came into force on 15 January 2026 and constitutes Sweden’s implementation of the EU’s NIS2 Directive. The Act aims to strengthen the protection of critical infrastructure and digital operations against cyber-attacks, in light of the increased vulnerability resulting from the challenges posed by digitalisation.

This article outlines the purpose and scope of the Act, the key requirements imposed on operators, and the practical and legal challenges that the regulation may entail.

The purpose of the new cybersäkerhetslagen is to achieve a higher level of cybersecurity as a measure against the increased cyber threat to critical infrastructure and the vulnerability resulting from digitalisation. Against this background, cybersäkerhetslagen aims to address shortcomings in the previous regulatory framework and to achieve a common level of cybersecurity within the EU.

The scope of the Act covers significantly more sectors than before and includes both public and private entities, as well as certain digital services. This is justified by their systemic importance and the serious societal consequences that may arise from cyber incidents. Rather than prescribing a general technical framework, the regulation is based on a risk-based approach. This means that security measures must be proportionate to the organisation’s risk profile.

One of the key elements of the Act’s framework is incident reporting, which is characterised by short deadlines. The aim is to enable early action and effective damage control in the event of cyber threats. The supervisory and sanctioning system under the Act aims to ensure compliance with the regulations. This is achieved through national supervisory authorities, powers to intervene, sanctions for non-compliance, and coordination between authorities, with the CSIRT acting as the national point of contact.

The legislator emphasises that cybersecurity is not merely an IT issue and that responsibility cannot be delegated. Management is assigned a central role in approving security measures, monitoring their implementation and undertaking relevant training. By clarifying management’s responsibilities, a more strategic approach to cybersecurity is promoted.

However, legal certainty challenges may arise as a result of the Act’s broad scope of application and relatively open wording. This may be particularly problematic for smaller organisations with limited resources.

In conclusion, the new cybersäkerhetslagen, represents a significant step towards a more secure and sustainable digital society. However, the effectiveness of the Act depends to a large extent on how it is applied in practice.

On 19 November 2025, the European Commission presented its ‘Digital Omnibus’ proposal, a comprehensive initiative to modernise and streamline the EU’s digital regulatory framework. The proposal involves amendments to several key legal acts, including the GDPR, the EU AI Act and the Data Act, as well as measures to simplify the rules on data sharing and incident reporting. Below is a brief summary of the key points of the proposal.

Proposed amendments to the General Data Protection Regulation (GDPR)^[1]

• The scope of what constitutes personal data is narrowed:^[2] Under the current definition, it is sufficient for data to be capable of identifying an individual ‘directly or indirectly’ for it to constitute personal data.^[3] The proposal amends the definition of personal data so that it covers only data that enables the identification of an individual by means that are ‘reasonably likely to be used’. However, the existence of means that “can reasonably be expected to be used” to determine to whom the data relates does not in itself mean that the information should be regarded as personal data. The aim is to simplify compliance and clarify the concept. As a result of the proposal, smaller businesses and organisations with limited processing of personal data may, in certain cases, fall outside the scope of the GDPR.

Furthermore, indicative assessment criteria are introduced to determine whether pseudonymised data constitutes personal data under the GDPR.

• Simplified requirements for reporting personal data breaches:^[4] It is proposed that the deadline for reporting be extended from 72 to 96 hours from the time the data controller becomes aware of the incident. ^[5]Under current regulations, organisations are obliged to report to the supervisory authority (IMY) unless it is ‘unlikely that the personal data breach will pose a risk to the rights and freedoms of natural persons’.^[6] The proposal limits this obligation to cases where the incident ‘is likely to result in a high risk’. The European Data Protection Board (EDPB) is also to draw up a common template for reporting personal data breaches. Overall, the changes are expected to lead to companies reporting incidents to a greater extent and to reduce difficulties in interpretation.

• Reduced scope of consent requirements for cookies:^[7] Currently, consent is required for the use of so-called cookies unless such use is strictly necessary for technical storage, the transmission of communications, or to provide a service that the user has explicitly requested.^[8] Consent is usually obtained via pop-up messages on websites or in apps. To reduce the extensive consent requirements that entail significant costs for online service providers, exemptions from the consent requirements for the use of cookies are proposed. Exemptions apply where the use poses a low risk to the data subject’s rights and freedoms or is necessary to provide a requested service.

The proposed amendment also entails a restructuring of the legal framework for cookies and comparable technologies. The use of cookies has so far been regulated through the interplay between the ePrivacy Directive^[9]and the GDPR.

The ePrivacy Directive has required consent for access to the user’s terminal equipment, whilst the GDPR has regulated the subsequent processing of personal data. With a view to simplifying the regulatory framework, it is proposed that the regulation of so-called cookies and similar technologies should instead be dealt with within the framework of the GDPR.

• A clearer framework for the use of personal data in AI training: ^[10] The proposal means that the training of AI models and AI systems which, during the development and operational phases, contain residual personal data may, in certain cases, be excluded from the definition of personal data. This is, however, subject to appropriate technical and organisational measures being taken, including to ensure that special categories of personal data are not collected and that such data are removed.

Proposed amendments to the EU Artificial Intelligence Act (EU AI Act)^[11]

• Deferred application of requirements for high-risk AI systems:^[12] A new and more flexible model has been proposed regarding when the requirements for high-risk AI systems are to take effect. Instead of these requirements coming into force on 2 August 2026^[13], their entry into force is linked to whether there is, in fact, sufficient support for compliance, such as harmonised standards, common technical specifications and guidance from the European Commission. Once the Commission has formally determined that this support is in place, a transition period will begin before the rules take effect, which could result in a delay of up to around 16 months.

• Extended transition period for generative AI:^[14] The proposal means that AI systems already on the market which generate artificial audio, images, video or text will be given additional time to adapt to the new labelling requirements for AI-generated content. To prevent the introduction of the rules from leading to sudden changes that could negatively impact the market, a special transition period is being introduced. Providers who have made their systems available before 2 August 2026 will therefore be given six months to adjust their procedures and technical solutions before the labelling requirements become fully applicable.

• Responsibility for AI literacy is shifted to the public sector: ^[15] Responsibility for enhancing AI literacy is shifted from individual providers and users of AI systems to the European Commission and the Member States. Instead of imposing general and difficult-to-interpret training requirements on all stakeholders, public initiatives will promote knowledge and understanding of AI in a more coordinated and sector-specific manner. At the same time, specific training obligations remain for stakeholders providing high-risk AI systems.

Simplified rules also for small mid-cap companies: ^[16] The exemptions in the EU AI Act for small and medium-sized enterprises (SMEs) have been extended to also cover small mid-cap companies (SMID-caps). The proposal includes, amongst other things, simplified requirements for technical documentation and adapted rules on penalties.

Other amendments to data legislation^[17]

• The Data Act^[18]: The Regulation on the free movement of data^[19], the Data Governance Act^[20] and the Open Data Directive^[21] are consolidated into the Data Act. In addition, data controllers are given the option to refuse to disclose information where there is a high risk of unauthorised access to or disclosure of trade secrets. At the same time, a more restrictive framework is proposed for public sector bodies’ right to demand access to data.

• Reporting of cybersecurity incidents^[22]: The proposal introduces a coordinated reporting solution for cybersecurity incidents, enabling organisations to fulfil their reporting obligations under multiple regulatory frameworks via a single point of contact. The solution covers, amongst other things, incident reporting under NIS2^[23], the GDPR, DORA^[24], eIDAS^[25] and CER^[26], and aims to streamline compliance without altering the underlying security requirements.

[1] Regulation (EU) 2016/679.

[2] Retrieved from document 52025PC0837 on EUR-lex.

[3] Article 4(1).

[4] Retrieved from document 52025PC0837 in EUR-lex.

[5] Article 33(1).

[6] Article 33(1).

[7] Retrieved from document 52025PC0837 in EUR-lex.

[8] Article 5(3) of Directive (EU) 2002/58/EC.

[9] Directive (EU) 2002/58/EC.

[10] Retrieved from document 52025PC0837 on EUR-lex.

[11] Regulation (EU) 2024/1689.

[12] Retrieved from document 52025PC0836 in EUR-lex.

[13] Article 113 of Regulation (EU) 2024/1689.

[14] Retrieved from document 52025PC0836 in EUR-lex.

[15] Retrieved from document 52025PC0836 in EUR-Lex.

[16] Retrieved from document 52025PC0836 in EUR-Lex.

[17] Retrieved from document 52025PC0837 in EUR-Lex.

[18] Regulation (EU) 2023/2854.

[19] Regulation (EU) 2018/1807.

[20] Regulation (EU) 2022/868.

[21] Regulation (EU) 2019/1024.

[22] Regulation (EU) 2023/2854.

[23] Directive (EU) 2022/2555.

[24] Regulation (EU) 2022/2554.

[25] Regulation (EU) No 910/2014.

[26] Directive (EU) 2022/2557.

Judgment of the General Court in Case T-553/23 | Latombe v Commission

The General Court has recently heard a case in which French national Philippe Latombe sought to have the European Commission’s decision of July 2023 on a new framework for the transfer of personal data between the EU and the US annulled. He argued, amongst other things, that the US Data Protection Review Court (DPRC) is not independent and that the extensive collection of personal data by US intelligence services contravenes EU law. The background to this is that the EU had previously rejected two similar agreements (Schrems I and II), but after the US introduced new rules on data protection and oversight, including through a dedicated review court (the DPRC), the Commission adopted a new adequacy decision in the summer of 2023.

However, the Court dismissed Latombe’s action in its entirety. It emphasised that the DPRC’s judges are subject to several safeguards ensuring their independence, including specific rules on appointment and dismissal, and that neither the Minister of Justice nor the intelligence services may influence their work. Furthermore, it was noted that the Commission is obliged to continuously monitor how the US system functions and has the option to amend or revoke its decision should the circumstances change.

With regard to data collection by the intelligence services, the Court held that the Schrems II judgment does not require prior review by an independent authority, but that ex post facto scrutiny is sufficient. Under US law, such oversight is provided by the DPRC. The Court therefore considered that the US system meets the requirements of EU law for a substantially equivalent level of protection.

The conclusion was therefore that the EU’s new data protection framework with the US is valid and that Latombe’s objections are unfounded.

The Latombe ruling confirms that the adequacy decision regarding the US stands!

What does this ruling mean for organisations such as businesses and public authorities?

The ruling means that the framework, the EU–US Data Privacy Framework, remains in force. Organisations in the EU can therefore continue to transfer personal data to the US without having to use additional safeguards (such as standard contractual clauses or binding corporate rules), provided that the recipient in the US is a signatory to the framework. Following the Schrems I and II rulings, transferring data to the US was uncertain and risky, as the previous frameworks (Safe Harbour and Privacy Shield) had been declared invalid. Since July 2023, we have had an adequacy decision between the US and the EU, and this now stands until further notice. This decision therefore provides greater stability for organisations.

The Commission must continuously monitor whether the US is maintaining the promised level of protection. If the level of protection deteriorates, the Commission may amend or revoke the decision, which means organisations need to keep themselves updated. Although the General Court dismissed LaTombe’s action, there is a risk that the matter may be brought before the Court of Justice of the European Union (an appeal is pending or may be lodged). Organisations should therefore be aware that the legal situation may change again, as it did following Schrems I and II.

In summary, the decision means that it is currently lawful for organisations within the EU to transfer personal data to the US under the new framework, provided that the recipients are participants in the framework. At the same time, developments should be monitored closely as future legal proceedings may alter the situation.

NOTE! Please note, however, that all organisations need to carry out their own risk assessment in each individual case.

Article 4 of the EU AI Act came into force on 2 February 2025, which means that the requirement to ensure staff have AI competence is already in force. The rules on supervision and enforcement came into force on 2 August 2025.

Under the new EU AI Act, it is mandatory for suppliers and users of AI systems to take the necessary steps to ensure that their staff and others responsible for the operation and use of AI have sufficient competence in AI. This must be tailored to the technical background, experience and training of the individuals concerned, and must take into account the specific context in which the AI systems are used, as well as the persons or groups affected by these systems.

According to the EU AI Act, ‘AI competence’ refers to the knowledge, understanding and ability that enable suppliers, users and other stakeholders to implement AI systems in an informed manner. It also entails an awareness of both the opportunities and risks associated with AI, as well as the potential harm that may arise.

The purpose of the legal requirement for ‘AI literacy’ is to protect fundamental rights, health and safety, and to enable democratic oversight of the use of AI. AI literacy should equip all those involved with the necessary concepts to make informed decisions regarding AI systems. These concepts vary depending on the context and may encompass everything from the correct use of technical components during the development phase, to necessary measures during the operational phase, the interpretation of the AI system’s outputs and – for those affected by AI decisions – an understanding of how these decisions may affect them.

Furthermore, the explanatory memorandum points out that AI competence should provide all stakeholders in the AI ecosystem with the insight required to ensure proper compliance with the EU AI Act. By broadly implementing measures to enhance AI competence and introducing appropriate monitoring, it is also possible to improve the working environment and support the development of trustworthy AI within the EU.

The requirement for AI competence is a key element in ensuring that all those who are suppliers or responsible for the operation of AI systems provide their staff with the right knowledge and understanding of the systems they work with. This applies to everyone in the organisation who is directly involved with AI systems and thereby also reinforces the rules on transparency (Article 13) and human oversight (Article 14) in the EU AI Act. At the same time, this requirement helps to protect the individuals affected, as it enables the effective implementation of the Regulation’s rules.

11 April 2025

It is important that organisations now monitor developments in the US and whether the European Commission decides to revoke the adequacy decision concerning the US.

The transfer of personal data to a country outside the EU/EEA must meet certain conditions. Since 2023, there has been a decision recognising an adequate level of protection for the US. There is an agreement between the EU and the US on how data is to be protected in the US, known as the EU-US Data Privacy Framework. Personal data may be transferred to US organisations that are registered on the Data Privacy Framework List. Other provisions of the General Data Protection Regulation (GDPR) must be complied with.

In the European Commission’s decision on an adequate level of protection, the Commission emphasises the importance of the Privacy and Civil Liberties Oversight Board (PCLOB). The PCLOB is tasked with overseeing the US intelligence services and ensuring that personal data collected is handled correctly.

At present, however, there is only one remaining member of the PCLOB, as the majority have been dismissed by the US President. This means that the PCLOB lacks decision-making powers, which raises the question of how this might affect the European Commission’s assessment of an adequate level of protection. The EU continuously monitors the situation in those countries where a decision on an adequate level of protection has been established. If it transpires that the level of protection is no longer adequate, the Commission may decide to amend, withdraw or annul its previous decision.

A decision on an adequate level of protection remains valid until the European Commission either amends, withdraws or annuls it, or until the Court of Justice of the European Union declares it invalid. This means that changes in the US do not automatically affect the status of the decision. However, the European Commission continuously monitors developments and carries out regular assessments of any changes. Our Swedish supervisory authority, IMY, has no power to revoke a decision on an adequate level of protection or to halt data transfers carried out under such a decision.

10 April 2025

On 1 April 2025, new regulations on CCTV came into force. CCTV is permitted without the need to apply to The Swedish Authority for Privacy Protection (IMY). A documented balancing of interests must be carried out when applying for a licence, in continued consultation with IMY, before sensitive surveillance is introduced. The requirements cover all surveillance within an organisation, not just that requiring a licence. Anyone who has previously been required to apply for a licence for surveillance must themselves balance the interest in surveillance against the individual’s interest in not being monitored. This balancing of interests must be documented, and surveillance operators must maintain a register containing certain information on CCTV surveillance or such surveillance that has ceased within the last five years.

Authorities that carry out CCTV surveillance for law enforcement purposes are granted extended powers to do so. Local authorities, regional authorities and other public authorities must assess whether it is permissible to commence surveillance. For those who already hold a surveillance authorisation from the IMY, the authorisation remains valid provided that circumstances have not changed since approval was granted.