Sweden's *24-hour clock* for cybersecurity incidents

When the clock starts

Sweden's Cybersecurity Act works like losing your bank card: the clock starts ticking the moment you notice, not when it's convenient. From July 2026, essential and important entities in 18 sectors have to report significant cybersecurity incidents on a strict schedule. Early warning goes out within 24 hours of awareness, a full incident notification within 72 hours, and a final report within one month ^[1].

That 24-hour window is tight, and the question it raises for anyone affected is simple: can you show when you first knew? The law doesn't care when you decided to escalate, or when IT finished investigating, or when legal approved the wording. It cares when you became aware.

Who it applies to

The Cybersecurity Act (2025:1506) implements the EU's NIS2 Directive and came into force on 15 January 2026 ^[1]. It covers essential and important entities in 18 sectors, among them energy, transport, healthcare, banking, digital infrastructure, waste management and public administration ^[1]. The Swedish Civil Contingencies Agency (MSB) supervises most sectors, with the Swedish Authority for Privacy Protection (IMY), the Swedish Financial Supervisory Authority (FI) and the Swedish Post and Telecom Authority (PTS) handling specific areas ^[2].

New regulations on incident reporting and information duties (MCFFS 2026:8) came into effect on 1 July 2026, and additional requirements followed on 1 October ^[2]. From that date, entities must also report significant incidents affecting the supply chains of digital services and IT systems ^[2].

What counts as significant

Not every glitch needs reporting. The regulations set out what makes an incident significant: disruption of essential services, serious financial or reputational impact, or a compromise of personal data or sensitive information ^[1]. Say a hospital's patient records go offline for an hour during a ransomware attack. That's significant. A brief slowdown on a website that sells socks probably isn't.

The point is to give authorities early warning of anything that could ripple outwards, so they can coordinate responses and warn others in the same sector. The 24-hour early warning is deliberately brief: what happened, what you know so far, and whether it might affect others ^[2]. The 72-hour notification adds detail, and the final report within a month covers the full picture, including what was done and what was learned ^[1].

The evidence question

Here's where it gets interesting. When a supervisor or an auditor asks why the early warning went out after 30 hours instead of 24, what do you show them? An email thread? A Slack message? Someone's recollection of when they first saw the alert?

The Cybersecurity Act requires risk management and incident reporting, but it doesn't specify how you prove the timeline ^[1]. That's for you to sort out. The question is whether you can show when the first detection note was written, when the decision to escalate was made, and when each report was actually sent, in a way that nobody can quietly rewrite afterwards.

Sealing the timeline as it happens

This is where a digital witness fits neatly. The thing to seal is each step of the incident as it happens: the first detection note, the decision to escalate, and each report as it is sent. Sealing takes a fingerprint of the record, not the record itself, so the content never leaves your systems.

If a supervisor later asks about the timing, you share the sealed record and the witness ID. They can check that the fingerprint matches, which shows that the record hasn't changed since it was sealed. That includes changes made by someone with administrator rights, or by the person who wrote the report in the first place.

WitniumChain makes this straightforward: your system sends a fingerprint of each timestep through the REST API, the SDK or the MCP server, gets a witness ID back, and stores both. To check, anyone calculates the fingerprint again and compares it with the sealed one. The first 2,000 witnesses a month are free.

What it doesn't do is show that the report was complete, that the response was adequate, or that the incident was handled well. It just shows when each step was recorded, which is exactly what you need when the question is whether the clock was met.

What this means for you

If you're an essential or important entity under the Cybersecurity Act, here are a few questions worth asking now:

• Do you have a clear definition of when awareness begins, and who decides that?
• Can you show, six months later, when the first detection note was written and when you sent the early warning?
• If someone with the right access edited a log or a report after the fact, would it show?
• Have you tested the reporting process with a realistic scenario, including the timelines?

The penalties for non-compliance are set out in the Act, and MSB has already begun supervision across sectors ^[2]. Getting this right before an incident happens is easier than fixing it during one.

What to watch

From 1 October 2026, the reporting duty extends to significant incidents affecting supply chains of digital services and IT systems ^[2]. That means vendors and service providers in your chain could trigger a reporting obligation for you.

MSB, IMY, FI and PTS are building out their supervisory frameworks, and the first round of guidance on what counts as significant is being refined sector by sector ^[2]. Worth keeping an eye on your sector's regulator, and on how they interpret the early warning timeline in practice.