The cyber security act and the entities it covers: timeline and cost turn on classification, not industry label. Entities fall into essential or important categories by sector, size and service criticality, and each category carries a distinct registration deadline, a distinct set of required measures and a materially different compliance cost.
Who this concerns
The question of coverage usually reaches a legal or compliance desk at one of three moments: a corporate restructuring that creates a new Swedish entity in a regulated sector, a letter from the supervisory authority requesting a self-assessment, or a customer contract that makes proof of classification a condition of the tender. Any entity established in Sweden and active in energy, transport, banking, financial market infrastructure, health, drinking water, digital infrastructure, public electronic communications, space, waste water, manufacturing of certain products, or public administration sits inside the sector list the regime works from. A fuller mapping of how this classification sits inside the wider compliance, sanctions and cyber practice is available separately; managed service providers, data centre operators and cloud providers have been folded into that sector list in recent revisions, which is why organisations that never thought of themselves as critical infrastructure now receive registration letters.
Group structure changes the analysis more than most legal teams expect going in. A Swedish subsidiary of a foreign parent is assessed on its own footprint inside Sweden, not on the group's combined headcount or turnover, unless the group has centralised the relevant service delivery in a way that makes the Swedish entity a shared services hub for other jurisdictions. That distinction has to be settled before any timeline can be built, because it determines whether one filing covers the group or several separate filings are needed, and it usually surfaces only once someone tries to draft the registration itself.
What the law says
Under Swedish law as it currently stands, entities are placed into one of two supervisory categories, essential or important, and the category determines both the intensity of supervision and the point at which a shortfall becomes enforceable. The classification test combines the sector list with a size threshold, and for a defined group of activities a criticality override pulls an otherwise small provider into the essential category regardless of headcount. Essential entities face proactive supervision, meaning the authority can audit without waiting for an incident to trigger the visit. Important entities are supervised reactively, meaning oversight is typically triggered by an incident, a complaint, or a sector-wide inspection sweep following trouble elsewhere in the same sector.
The specific figures that populate the size threshold, the notification windows and the penalty bands are not reproduced in this material, because the norms register available at the time of writing does not carry a verified extract for this page. The structure described above is stable; the numbers that sit inside it should be confirmed directly against the current implementing regulation before a classification decision is finalised or a filing is made on the strength of a figure remembered from an earlier engagement.
How it works in practice
Step one: confirm the sector and the service actually provided
Classification starts from the service delivered, not the company's registered business description. A logistics group that also operates a data centre for its own fleet management may be assessed on the data centre activity rather than on haulage. Write down the actual service provided to third parties before running any threshold test, because the wrong starting point produces a wrong classification even when every later step is done correctly.
Step two: run the size and criticality test
Once the sector is confirmed, the size test applies unless a criticality override removes the size question entirely. Entities providing a small number of highly sensitive services, such as domain name resolution or certain financial market infrastructure functions, can be classified as essential irrespective of staff count or turnover.
Step three: register with the competent authority
Registration is a discrete filing, separate from any sector licence the entity already holds. It typically requires the entity's legal name and organisation number, a description of the service in scope, the contact point responsible for reporting, and a statement of the group structure if the entity sits inside a foreign-owned group. Entities that already hold a sector licence sometimes assume the licence covers this filing; it does not.
Step four: appoint a responsible contact and reporting line
The regime expects a named contact who can receive supervisory correspondence and who can be reached outside office hours if an incident requires early notification. Many entities route this through the same function that already handles data protection incident response, which reduces duplication but only works if the two reporting lines are formally reconciled, not merely assumed to overlap because they sit in the same team.
Step five: build the technical and organisational measures file
Supervision does not stop at registration. The entity needs a documented set of technical and organisational measures covering risk analysis, incident handling, business continuity, supply chain security and, for essential entities, more frequent internal review. This file is the evidence base an auditor will ask for, and building it after an inspection notice arrives is materially more expensive than building it during onboarding, because it forces retrospective documentation of decisions no one wrote down at the time.
Step six: prepare for supervision before it happens
Essential entities should assume an audit can arrive without any incident preceding it. Important entities should assume the trigger will usually be an incident, a complaint from a counterparty, or a sector sweep following trouble elsewhere in the industry. Either way, the file from step five needs to be current at the moment of inspection, not archived from the year of registration.
What changes when the parent company sits outside Sweden
A foreign parent does not file on behalf of its Swedish subsidiary, and a compliance programme built for the parent's home jurisdiction rarely transfers without adjustment. The contact point required by Swedish supervision has to be reachable inside Sweden or on Swedish office hours, formal incident filings are made in Swedish, and any shared IT infrastructure operated from outside Sweden needs its own risk documentation showing how the Swedish entity retains effective control over the service. Supervision follows the entity providing the service inside Sweden, not the group's global security policy, and groups that rely on a single, centrally drafted policy document for every jurisdiction are the ones most often asked to resubmit with entity-specific evidence.
What to check before you file
- The organisation number and legal name match exactly what is registered with the Swedish Companies Registration Office.
- The service description in the filing matches the service actually delivered to customers, not the group's marketing description of the business.
- The named contact point has authority to receive and act on supervisory correspondence, not merely to forward it internally.
- The technical and organisational measures file references the entity's own infrastructure, not a group-level document describing infrastructure the Swedish entity does not control.
- Any existing sector licence or authorisation has been checked against this registration for overlapping or conflicting reporting obligations.
- The group's data protection incident procedure has been reconciled with the cyber security incident procedure so the same event does not generate two inconsistent reports to two different authorities.
Does a Swedish subsidiary need to register separately from its foreign parent?
Yes, in most structures. Classification is assessed on the entity providing the service inside Sweden, and a Swedish subsidiary is treated as its own filing unit unless it has been formally designated as a shared services hub for the wider group. A parent's registration in its home state does not extend to cover the subsidiary's Swedish activity, and assuming otherwise is one of the more expensive mistakes to unwind later.
What happens if an entity misses the initial notification deadline after an incident?
The consequence depends on how late the notification is and whether the delay affected the authority's ability to respond, so this material does not attach a fixed penalty figure to a missed deadline without a verified source. What is consistent across the procedure is that a late report is treated more severely than a report that is early but incomplete, which is why entities are generally advised to notify on time with partial information rather than wait for a complete picture before filing anything at all.
Does outsourcing IT infrastructure to a third-party provider transfer the compliance obligation to that provider?
No. The regulated entity remains responsible for the service it delivers to its own customers, even where the underlying infrastructure is operated by a vendor. The entity needs contractual and technical assurance from the vendor, but the filing, the incident reporting and the supervisory relationship stay with the entity that provides the regulated service, regardless of how the underlying technology stack is sourced.
The numbers
This page does not attach specific figures to the staff and turnover bands, the tiered incident-notification windows, or the penalty ranges that sit inside the current regime, because no verified extract of the implementing regulation was available in the material used to write it. What is stable is the shape of those figures rather than their value: entities are sorted by size bands that separate micro and small providers from the rest, incident notification runs on a staged basis rather than a single deadline, meaning an early warning is expected before a full report is due, and penalties scale with turnover for the largest entities rather than sitting at a flat amount regardless of size. Before building an internal timeline against these categories, confirm the current bands and windows directly with the competent authority or against the current text of the implementing regulation, because inserting a remembered figure into a client-facing timeline without a verified source is exactly the kind of error that undermines an otherwise sound classification.
Where it usually goes wrong
The most common error is treating the group's global information security certification as sufficient evidence for the Swedish filing. A certification demonstrates that a management system exists; it does not demonstrate that the specific Swedish entity's infrastructure, contacts and incident procedure meet the local registration's factual requirements, and an auditor will ask for local evidence regardless of the certificate on file.
The second common error is assuming that a small headcount removes an entity from the essential category by default. The criticality override exists precisely to catch small providers of highly sensitive services, and headcount is not a defence once the override applies to the service in question.
The third error appears in groups with a shared incident response function: the Swedish entity assumes the group's central security team will handle Swedish notification, but the reporting obligation sits with the Swedish entity's named contact, and a report filed late because a central team in another jurisdiction did not prioritise it is still a late report against the Swedish entity's own record.
Finally, entities that registered once and treated the file as closed tend to be the ones caught out at renewal or at first inspection. The technical and organisational measures file needs to reflect current infrastructure, not the infrastructure that existed at the point of first registration, and supervisory authorities do check for drift between the two before accepting that the documentation is still accurate.
What to do next
Classification and the steps above can be worked through internally up to the point where the entity's actual infrastructure and group structure need to be tested against the current thresholds, because that test depends on figures this material deliberately does not reproduce without a verified source. That is the point where a structured assessment, rather than further reading, becomes the efficient next step: book an assessment call to have the classification and the filing checked against your entity's actual documents before a deadline is set on the basis of an assumption.
Entities building the incident reporting line described in step four often need to solve the adjacent obligation to run an internal whistleblowing channel at the same time, since both obligations tend to route through the same contact point once a structure is in place.