Sweden's cybersecurity law is in force. *The 24-hour clock* starts when you know.

When the clock starts

The Cybersecurity Act works like when you lose your bank card. The clock starts ticking the moment you notice it is gone, not when you get around to calling the bank. For essential and important entities in Sweden, a significant incident triggers three reporting deadlines, and the first one – an early warning within 24 hours – counts from when you became aware of it ^[1][2].

That has been the law since 15 January 2026 ^[3]. From 1 July 2026, the detailed incident reporting rules in MSB's regulation MCFFS 2026:8 have applied ^[1]. From 1 October 2026, more requirements come into force ^[4].

Who it covers

The law covers essential and important entities in 18 sectors, including energy, transport, healthcare, digital infrastructure, public administration, banking, insurance and water supply ^[3]. If you are an essential or important entity, you know it: authorities have been notifying organisations since the law came into force.

Three reports, three deadlines

When a significant incident happens, you report it in three steps ^[1][2]:

1. Early warning within 24 hours: a short notice that an incident has occurred. The 24 hours count from when you became aware of it.
2. Incident notification within 72 hours: more detail, including what happened, how many people are affected, the suspected cause and the measures taken.
3. Final report within one month: what the incident was, how it was handled, what measures have been put in place to prevent it happening again, and any cross-border impact.

If the incident affects another EU member state, or if a service to another member state is disrupted, you report that in the incident notification ^[2].

What 'became aware' means

The law does not say what counts as becoming aware. The question will turn on facts: when did someone in the organisation with responsibility for incidents learn enough to recognise that something significant had happened?

It is the same logic as when a bank card goes missing. If you notice at breakfast that your wallet is gone, the fact that you were busy all morning does not push the deadline back. The clock started at breakfast.

Why the timeline matters

Supervisors, auditors and insurers will ask when you knew and when you reported. If an early warning goes out 30 hours after the first detection, the question is not whether you were busy; it is whether you can show when you actually became aware that the incident met the threshold for reporting.

That is a question of records. Detection logs, escalation decisions, the first incident note and each report as it was sent are the timeline. If they can be rewritten quietly afterwards, they are harder to rely on when someone asks.

Sealing the incident timeline as it happens

This is where a digital witness fits. The thing to seal is the record of each step: the first detection note, the decision to escalate and each report as it is sent. Sealing takes a fingerprint, not the content, so the incident details never leave your systems. If a supervisor asks six months later when you knew, anyone you share the timeline with can check that the records are exactly what was written at each step, unchanged since ^[5].

You seal each step when it happens. Internal audit, supervisors and incident responders can later check the sealed timeline. What it shows is when each record was created, in a way nobody can quietly rewrite afterwards, even someone with administrator rights. What it doesn't do is show that the report was complete, that the response was adequate or that the threshold was correctly judged.

Sealing is done through WitniumChain, using the REST API, the SDK or the MCP server. The first 2,000 witnesses a month are free. Read the documentation to get started.

How it would work

1. Your incident management system seals the first detection note when it is written, and seals the escalation decision and each report as they are sent.
2. Each sealing returns a witness ID, which you keep with the record.
3. When asked, you share the timeline and the witness IDs. Anyone can check that each record matches what was sealed.

What this means for you

If you are an essential or important entity:

• Check when your incident detection logs are written, and who can edit them afterwards.
• Decide what counts as becoming aware, so the people on call know when the 24-hour clock starts.
• Keep the timeline: detection, escalation, each report. Those records will be asked for.
• Consider sealing key steps as they happen, so you have a timeline that holds up when it is questioned.

If you sell to essential or important entities, expect procurement teams to ask how your solution helps them meet the reporting deadlines, and how it records when an incident was first detected.

What to watch

From 1 October 2026, further requirements under the Cybersecurity Act come into force ^[4]. Watch for guidance from MSB and sector-specific supervisory authorities on what counts as a significant incident and how the thresholds apply in practice.

The European Commission and ENISA publish guidance on NIS2 implementation, which Sweden's Cybersecurity Act is based on. Cross-border incident reporting will matter more as other member states' rules align.

Sources

1. Myndigheten för samhällsskydd och beredskap (MSB), "Myndigheten för samhällsskydd och beredskaps föreskrifter om incidentrapportering enligt cybersäkerhetslagen", MCFFS 2026:8, 1 July 2026, https://www.msb.se/sv/regler/gallande-regler/krisberedskap-och-informationssakerhet/mcffs-20268/
2. Myndigheten för samhällsskydd och beredskap (MSB), "Vägledning till Myndigheten för samhällsskydd och beredskaps föreskrifter om incidentrapportering enligt cybersäkerhetslagen", 2026, https://www.msb.se/sv/amnesomraden/informationssakerhet-cybersakerhet-och-sakra-kommunikationer/nis-direktivet/vagledning-incidentrapportering-cybersakerhetslagen/
3. Svensk författningssamling, "Cybersäkerhetslag (2025:1506)", SFS 2025:1506, https://data.riksdagen.se/dokument/sfs-2025-1506.html
4. The Legal 500, "The Swedish Cybersecurity Act Autumn 2026 – Supervision So Far and New Requirements from 1 October", October 2026, https://www.legal500.com/intelligence/sweden/privacy/the-swedish-cybersecurity-act-autumn-2026-supervision-so-far-and-new-requirements-from-1-october
5. WitniumChain documentation, "How a digital witness works", https://witniumchain.com/docs