Free 2-minute check
NIS2 Applicability Checker
Finland 124/2025Sweden 2025:1506No registration
Tool not loading? Open the checker in a new tab. Switch language with EN, FI or SV at the top of the tool.
Who Does NIS2 Apply To? A Finnish and Swedish Applicability Guide
Who does NIS2 apply to? In Finland and Sweden the answer comes from three tests: whether your organisation works in one of the 18 sectors the directive lists, whether it is at least medium-sized, and where it is established.
Finland put the NIS2 Directive into law with the Cybersecurity Act (kyberturvallisuuslaki 124/2025), whose obligations took effect on 8 April 2025. Sweden followed with the Cybersecurity Act (cybersäkerhetslag 2025:1506), in force since 15 January 2026. Both laws make organisations assess their own status, so “we haven’t heard from the authority” is not an answer.
Who does NIS2 apply to: the three tests
As a main rule, a private company falls under NIS2 when all three of these are true:
Sector. It carries out an activity listed in Annex I or Annex II of the directive.
Size. It is a medium-sized enterprise or larger, counted under the EU definition of SMEs.
Establishment. It is established in Finland or Sweden (or, for certain digital services, has its main establishment there).
There are important exceptions where size does not matter, covered below. Sweden’s national cyber security centre is explicit that organisations must make this assessment themselves, working through type of activity, size and jurisdiction in turn.
Test 1: Are you in a NIS2 sector?
NIS2 lists 18 sectors in two annexes. Annex I contains sectors of high criticality and Annex II other critical sectors. The annex matters later, because it affects whether you are an essential or an important entity.
Annex I, sectors of high criticality. Energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management (business to business), public administration and space.
Annex II, other critical sectors. Postal and courier services, waste management, chemicals, food production, processing and distribution, manufacturing (including medical devices, electronics, electrical equipment, machinery and vehicles), digital providers (online marketplaces, search engines and social networks) and research.
Read the annexes at the level of the activity, not the industry label. A manufacturer of machinery is in scope; a company that only uses machinery is not, unless it is caught by another activity.
Test 2: Are you medium-sized or larger?
NIS2 applies, as a main rule, to medium-sized and large enterprises. Both Finland and Sweden use the EU definition in Commission Recommendation 2003/361/EC:
Small (generally out of scope). Fewer than 50 employees, and annual turnover or balance sheet total of no more than EUR 10 million.
Medium-sized (in scope). 50 to 249 employees, or more than EUR 10 million in both turnover and balance sheet total, while staying under the large-enterprise limits.
Large. 250 employees or more, or turnover above EUR 50 million and a balance sheet total above EUR 43 million.
Do not count only your own company. Swedish guidance states that partner and linked enterprises must be taken into account, so a small subsidiary of a large group can be medium-sized or large for NIS2 purposes.
Some organisations are covered regardless of size. Traficom lists providers of public electronic communications networks or services, trust service providers and entities designated as critical under the CER Directive. Sweden’s law also covers regions and municipalities whatever their size, and top-level domain registries and DNS service providers are treated as essential.
Test 3: Where are you established?
The main rule is that you are subject to the law of the country where you are established. A Finnish company follows the Finnish act; a Swedish company follows the Swedish act. Certain digital services, such as cloud providers and online marketplaces, are instead handled where they have their main establishment.
For Nordic groups this has a practical consequence: each subsidiary is assessed in its own country, under its own law and supervisor. A group with entities in Helsinki and Stockholm may have two registrations, two supervisors and two sets of deadlines.
Essential or important entity?
Every organisation in scope is either an essential or an important entity. Sweden’s act defines the essential group and then states that operators that are not essential are important. In practice, according to Sweden’s national cyber security centre:
Essential. Large enterprises in Annex I sectors, plus specific cases such as qualified trust service providers, TLD registries and DNS service providers, and certain public bodies.
Important. Medium-sized enterprises in Annex I sectors, and medium-sized or large enterprises in Annex II sectors.
The obligations are largely the same. The differences are supervision and penalties. Essential entities are supervised proactively on a planned basis; important entities are supervised mainly after an event such as an incident. Under the Swedish act, administrative fines can reach the higher of EUR 10 million or 2% of global annual turnover for essential entities, and EUR 7 million or 1.4% for important entities. Finland’s act sets the same maximums.
Finland and Sweden side by side
Finland: kyberturvallisuuslaki 124/2025. Obligations in force from 8 April 2025. Register in the list of operators kept by your sector’s supervisory authority; for organisations in scope from the start, the deadline was 8 May 2025, and the cyber security risk management model was due by 8 July 2025. Supervisors are sector-based, for example Traficom, Finanssivalvonta, Energiavirasto, Valvira, Fimea, Tukes and Ruokavirasto.
Sweden: cybersäkerhetslag 2025:1506. In force from 15 January 2026. Operators must register “as soon as possible”, and report changes within 14 days. Registration goes to the joint point of contact, which the Cybersecurity Ordinance (2025:1507) names as the National Defence Radio Establishment (FRA). Supervisors are sector-based, for example Finansinspektionen, Energimyndigheten, Transportstyrelsen, IVO, Läkemedelsverket, Livsmedelsverket, PTS and six county administrative boards.
Incident reporting follows the directive’s rhythm. The Swedish act requires a first notice of a significant incident within 24 hours, an incident notification within 72 hours and a final report within one month.
What NIS2 requires of management
NIS2 puts cyber security on the board’s and management’s desk. Sweden’s act states directly that the people in an operator’s management must undergo training on security measures. Finland’s act requires management to approve the cyber security risk management model, oversee its implementation and keep sufficient knowledge of cyber risk management.
NIS2 does not require a training course for every employee. It requires management training, and it lists basic cyber hygiene and cyber security training among the risk-management measures an organisation must take, which leaves the scope and form of staff training to a risk-based decision.
That distinction matters when you plan. Management training is a personal duty that starts with appointment. Staff awareness is part of your risk-management measures and should be sized to your risks. Our guide to security awareness training in the Nordics covers both in more detail.
If you are in scope: first steps
Document the assessment. Write down which annex activity applies, your size calculation including linked and partner enterprises, and whether you are essential or important. Keep it with your board papers.
Register. In Finland with your sector supervisor; in Sweden with the joint point of contact. If you are late, register now rather than wait.
Train management. Plan and record training for everyone in the management body, and repeat it when members change.
Put the risk-management measures in place. Including incident handling, business continuity, supply-chain security, access control, and cyber hygiene and training.
Prepare incident reporting. Decide who can file a 24-hour notice on a Sunday night, and test it.
If you are out of scope: the supply chain
Being outside NIS2 does not mean being untouched by it. Organisations in scope must manage security in their supply chain, so their requirements flow down to suppliers through contracts and questionnaires. Sweden’s national cyber security centre notes that suppliers to covered entities may want to review the law’s requirements even if they are not covered themselves.
Re-check your status when anything changes: a new business line, an acquisition, crossing 50 employees or EUR 10 million in turnover and balance sheet total. Scope is not a one-time decision.
Check your organisation now: the NIS2 Applicability Checker takes about two minutes, needs no registration and covers both the Finnish and the Swedish act.
Frequently asked questions
Who does NIS2 apply to?
Medium-sized and large organisations that carry out an activity listed in Annex I or II of the directive and are established in an EU country, plus some organisations covered regardless of size, such as trust service providers, DNS providers and public administration bodies.
Does NIS2 apply to small companies?
As a main rule, no. Companies with fewer than 50 employees and turnover or balance sheet total of no more than EUR 10 million are outside scope, unless they fall into a size-independent category. Count linked and partner enterprises before you conclude you are small.
What is the difference between essential and important entities?
Mostly supervision and fines. Essential entities face planned, proactive supervision and fines of up to EUR 10 million or 2% of global turnover; important entities face supervision mainly after an event and fines of up to EUR 7 million or 1.4%.
When did NIS2 take effect in Finland and Sweden?
In Finland, the Cybersecurity Act’s obligations took effect on 8 April 2025. In Sweden, the Cybersecurity Act entered into force on 15 January 2026.
Do we have to register under NIS2?
Yes, if you are in scope. In Finland you register with your sector’s supervisory authority; in Sweden with the joint point of contact at FRA, as soon as possible, with changes reported within 14 days.
Does NIS2 require cyber security training for all employees?
No. It requires training for the management body and lists cyber hygiene and cyber security training among the risk-management measures, without prescribing a course for every employee. Most organisations still choose broad awareness training as part of their risk-based measures.
How does NIS2 apply to a group with companies in Finland and Sweden?
Each company is assessed and registered in the country where it is established, under that country’s law and supervisor. The group’s size counts when you assess each company, because linked enterprises are included.
What are the NIS2 fines in Finland and Sweden?
Up to the higher of EUR 10 million or 2% of global annual turnover for essential entities, and EUR 7 million or 1.4% for important entities. Sweden can also, in serious cases, bar a person from a management role at an essential entity.
Sources and further reading
- Directive (EU) 2022/2555 (NIS2) – EUR-Lex: scope, Annexes I and II, management duties
- Commission Recommendation 2003/361/EC – EUR-Lex: definition of micro, small and medium-sized enterprises
- Kyberturvallisuuslaki 124/2025 – Finlex: Finland’s Cybersecurity Act
- Kyberturvallisuuslain keskeiset velvoitteet – Traficom: size limits, registration deadline and supervisors
- NIS 2 – Euroopan unionin kyberturvallisuusdirektiivi – Traficom’s National Cyber Security Centre: obligations in force from 8 April 2025
- Cybersäkerhetslag (2025:1506) – Sveriges riksdag: Sweden’s Cybersecurity Act
- Cybersäkerhetsförordning (2025:1507) – Sveriges riksdag: registration and supervisory authorities
- Omfattas verksamheten av cybersäkerhetslagen? – NCSC Sweden: self-assessment, size and essential versus important
- Security awareness training in the Nordics: what the law now requires – Datafisher