Agent WranglersCMP-84Required SE law
Register with MCF when the Swedish cybersecurity law covers you
If the cybersäkerhetslag (2025:1506) covers you, register with the Swedish Civil Defence Agency, MCF, as soon as you can. Report any change to the registered facts within 14 days.
Region
Sweden (SE). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds.
How to do it
Sweden's NIS2 law has applied since 15 January 2026. It covers firms with a main establishment or a representative in Sweden. Cloud, data centre, content delivery, managed service, managed security service, marketplace, search and social network providers count when they pass the size or criticality tests. DNS providers, top-level domain registries and domain registrars count at any size. Decide scope as Decide whether NIS2 covers you says. MCF's rules on registration, MCFFS 2026:1, apply from 2 February 2026, and the form is in its reporting service. Report significant incidents within 72 hours, on the reporting clocks.
How to check
When the facts file marks Sweden as covered, the obligations register holds the MCF registration date and reference. A job fails when the facts file changed more than 14 days ago and no later registration update is recorded.
Sources
Related rules
- CMP-83 Name your lead supervisory authority and its channels in Compliance and governance
- CMP-46 Decide whether NIS2 covers you in Compliance and governance
- CMP-21 Start every reporting clock from one moment in Compliance and governance
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/compliance/security-laws/swedish-nis2-registration">Agent Wranglers compliance and governance playbook</a>. In code you write, add a comment next to it with the same link.