Sweden’s Cybersecurity Act is already in force. Is your software supplier continuity plan ready to show it?

On 15 January 2026, Sweden’s Cybersecurity Act (Cybersäkerhetslagen, SFS 2025:1506) entered into force, transposing the EU’s NIS2 Directive into Swedish law. For organisations now inside its scope, the question has shifted from “will this apply to us” to “can we prove we’re compliant today.”

The scope just got much bigger

Under Sweden’s previous information security law, obligations applied only to the specific branch of an organisation that triggered the regulation. The Cybersecurity Act applies entity-wide. If any part of your operations falls within one of the 18 designated sectors, every network and information system across the organisation is in scope, including the software your teams depend on that has nothing to do with the regulated activity itself.

Supply chain risk is now a named legal obligation

The Act requires in-scope organisations to analyse risk across their supply chains and take security measures to protect their relationships with suppliers and service providers, whether or not those suppliers are directly regulated. That includes assessing what happens if a critical software supplier can no longer support what you depend on.

This is now a board-level exposure

The Act carries fines of up to €10 million or 2% of global annual turnover for essential entities, and it introduces explicit management accountability. Boards and executives are now personally implicated in whether the organisation’s cybersecurity and continuity obligations are met, not just IT.

Escrow as documented, auditable proof

An independently held, verified copy of a critical vendor’s source code and documentation is concrete evidence that supply chain continuity risk has been assessed and mitigated, not merely discussed in a policy document. It’s the kind of artefact a board can point to when asked how a specific supplier dependency is covered.

Set it up in the time it takes to read the Act’s summary

Escrow365 lets Swedish organisations and their software suppliers put a fully compliant, independently verified escrow arrangement in place in as little as 30 minutes, across multiple international legal jurisdictions. Self-service. No legal resource required.

Prove it before you’re asked to

Cybersäkerhetslagen didn’t give organisations a grace period to figure this out later. Set up your Escrow365 arrangement today, while the answer is still yours to prepare rather than explain under pressure.

Sources: Advokatfirman Lindahl, “New Cybersecurity Act – implementation of the NIS2 directive in Swedish law,” January 2026. Innovaiden, “Sweden’s Cybersecurity Act (2025:1506): NIS2 Is Now Law,” February 2026. RISMA, “Cybersäkerhetslagen | What does the law require?,” October 2025.

Escrow365 — Just, done