What is NIS2?
NIS2 is the EU directive on cybersecurity, implemented in Sweden through the Cybersecurity Act that entered into force on 15 January 2026.
The act replaces the earlier NIS Act and covers organisations in a wide range of sectors. They include energy, transport, health care, digital infrastructure, manufacturing and public administration.
Those covered must register with their supervisory authority and take risk-based security measures. Management must be trained, and significant incidents must be reported.
An AI tool becomes part of the same security work. That covers where data is processed, which suppliers are involved and how access is controlled.
How it works
Security measures must rest on a risk analysis covering the whole organisation. The law names areas that must be included, among them incident handling, continuity, access control and supply chain security. Measures must be proportionate to the risks and to the size of the organisation.
The law distinguishes between essential and important entities. The required measures are largely the same, but supervision is more active for essential ones.
Why it matters
Responsibility lies explicitly with management. It must approve the measures, follow them up and know enough to judge the risks. Shortcomings can lead to administrative fines. The law therefore makes AI security a matter for the board.
What to keep in mind
The supply chain is often the hardest part. An AI service may rely on several subcontractors, each affecting security. Ask for a clear picture of who they are.
Even organisations outside the scope can be affected. Customers that are covered often pass the same requirements on to their suppliers.
What it means for you
Include your AI tools in your risk analysis and ask the AI supplier the same questions as other important suppliers.
Common questions
Are we covered by Sweden's Cybersecurity Act?
It depends on your sector and size. The Act covers organisations in designated sectors and large parts of the public sector. Those covered must register with their supervisory authority themselves.
What does NIS2 mean for our AI tools?
AI tools are part of security work like any other system. Your risk analysis should include them, and the AI supplier becomes part of the supply chain you are required to manage.
What applies when an incident occurs?
Significant incidents must be reported to the supervisory authority. An early warning must be submitted within 24 hours of becoming aware of the incident.
Are NIS2 and the Cybersecurity Act the same thing?
NIS2 is the EU directive. The Cybersecurity Act is the Swedish law that implements it, in force since 15 January 2026.
Sources: Directive (EU) 2022/2555 on EUR-LexSwedish Cybersecurity Act (2025:1506) on riksdagen.se
Related terms
Read more
All terms Updated