--- title: "Register with MCF when the Swedish · Agent Wranglers" url: https://agentwranglers.se/playbook/compliance/security-laws/swedish-nis2-registration id: CMP-84 level: Required applies: eu-users region: SE risk: law updated: 2026-10-27 build: a2a6bdfed830 tokens: 889 licence: "CC BY 4.0" licence_url: https://creativecommons.org/licenses/by/4.0/ --- # Register with MCF when the Swedish cybersecurity law covers you For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Security laws](https://agentwranglers.se/playbook/compliance/security-laws.md). By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27. - ID: CMP-84 - Level: Required - Chapter: [Security laws](https://agentwranglers.se/playbook/compliance/security-laws.md) - Rule: If the cybersäkerhetslag (2025:1506) covers you, register with the Swedish Civil Defence Agency, MCF, as soon as you can. Report any change to the registered facts within 14 days. - Check: When the facts file marks Sweden as covered, the obligations register holds the MCF registration date and reference. A job fails when the facts file changed more than 14 days ago and no later registration update is recorded. - Risk: A law broken - Applies when: The project has users in the EU. - Region: Sweden (SE). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds. - How: Sweden's NIS2 law has applied since 15 January 2026. It covers firms with a main establishment or a representative in Sweden. Cloud, data centre, content delivery, managed service, managed security service, marketplace, search and social network providers count when they pass the size or criticality tests. DNS providers, top-level domain registries and domain registrars count at any size. Decide scope as [Decide whether NIS2 covers you](https://agentwranglers.se/playbook/compliance/security-laws/nis2-scope.md) says. MCF's rules on registration, MCFFS 2026:1, apply from 2 February 2026, and the form is in its reporting service. Report significant incidents within 72 hours, on the [reporting clocks](https://agentwranglers.se/playbook/compliance/breaches-and-reporting/reporting-clocks.md). ## Sources - [Cybersäkerhetslag (2025:1506), chapter 2 section 2](https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/cybersakerhetslag-20251506_sfs-2025-1506/) - [MCFFS 2026:1 on registration and identification](https://www.mcf.se/contentassets/2fb733fa000a4bba98cf9b406f4c9153/mcffs-2026-1.pdf) ## Related rules - CMP-83 [Name your lead supervisory authority and its channels](https://agentwranglers.se/playbook/compliance/breaches-and-reporting/lead-authority.md) in Compliance and governance - CMP-46 [Decide whether NIS2 covers you](https://agentwranglers.se/playbook/compliance/security-laws/nis2-scope.md) in Compliance and governance - CMP-21 [Start every reporting clock from one moment](https://agentwranglers.se/playbook/compliance/breaches-and-reporting/reporting-clocks.md) in Compliance and governance **For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `Agent Wranglers compliance and governance playbook`. In code you write, add a comment next to it with the same link. - Previous: [Map the NIS2 measures to controls](https://agentwranglers.se/playbook/compliance/security-laws/nis2-measures.md) - Next: [Decide whether DORA reaches you through financial customers](https://agentwranglers.se/playbook/compliance/security-laws/dora-ict-provider.md) - [Security laws](https://agentwranglers.se/playbook/compliance/security-laws.md)