2025-12-102025/26:FöU2 · p.3FöUDefence

Leadership responsibility

Management's personal responsibility under the new cybersecurity law

What's at stake: The law covers the management of both public and private entities classed as critical to society. The decision affects how strong an incentive management has to actually prioritise cybersecurity work, and whether the possibility of barring an office-holder from a management position for violations is a sufficient substitute for clear personal responsibility.

Case texts and AI reasoning are AI-translated from the Swedish originals; the Swedish text is authoritative.

What the vote decides

The question is whether the cybersecurity law should specifically regulate a personal responsibility for the management of an entity that fails to meet its security-measure requirements, or whether it is enough that management's responsibility follows from existing legislation, supplemented by a training requirement.

Yes Yes — the committee proposal

The committee endorses the government's cybersecurity law proposal and shares the government's assessment that management's responsibility for organising and managing an entity's affairs, including its security measures, already follows from other legislation and therefore does not need separate regulation in the cybersecurity law. The committee notes that the law instead allows, for certain violations, an office-holder to be barred from holding a management position, and rejects the motion for clearer personal responsibility.

No No — the reservations

Reservation 2 (C)

The reservation (C) welcomes the law but calls for greater clarity on management's responsibility. Under the underlying EU directive, management should be able to be held personally liable for violations of the security-measure requirements, but this is absent from the Swedish law and has in practice been replaced by a requirement that management be trained. The reservation's author argues that this represents a significant reduction in the requirements placed on management in organisations designated as critical to society, and wants parliament to call on the government to review the matter.

Summarised from the committee report. Party labels in the summary come from the report, not from the vote.

VSMPCLKDMSD
YesNoAbstainAbsent

What do the votes mean here?

Yes The committee proposal: rejecting the motions (keeping things as they are).

No Backing the counter-proposal: reservation 2 by C.

Abstain The party marks a position of its own that is not one of the two final alternatives.

What each plan points to — and how the party voted

For each party: the vote its own election manifesto and party programme point to in this case, next to how the party actually voted. A plan can only point to Yes or No; a party can also abstain.

PlanVoteConfidenceEvidence
VNoYes 18/0/0/4departs from the planconfidence: mediumnot addressed
SNoYes 92/0/0/14departs from the planconfidence: mediumnot addressed
MPNoYes 14/0/0/4departs from the planconfidence: lownot addressed
Cown reservationYesNo 0/19/0/5departs from the planconfidence: lownot addressed
LNoYes 13/0/0/3departs from the planconfidence: lownot addressed
KDNoYes 15/0/0/4departs from the planconfidence: mediumnot addressed
MYesYes 59/0/0/9follows the planconfidence: lownot addressed
SDNoYes 60/0/0/12departs from the planconfidence: mediumnot addressed

Committee proposal

The Riksdag rejects motion 2025/26:3838 by Mikael Larsson and Niels Paarup-Petersen (both C) demand 1.

Original (Swedish)

Riksdagen avslår motion 2025/26:3838 av Mikael Larsson och Niels Paarup-Petersen (båda C) yrkande 1.

Riksdag decision: To achieve a high level of cybersecurity in society, the government proposes a new cybersecurity law aimed at implementing the so-called NIS 2 directive. The Riksdag approved the government's proposal. The proposal means that public and private operators within certain designated sectors shall, among other things, take measures to protect their networks and information systems and report significant incidents. The proposal also means that a supervisory authority shall intervene if an operator violates the provisions of the law. The NIS 2 directive was adopted by the EU in 2022 and aims to achieve a high level of cybersecurity throughout the union. The Riksdag also approved the government's proposal to amend other laws concerning electronic communications, top-level domains, and secrecy. The new rules enter into force on 15 January 2026.

Counter-proposals

Plan vs actual vote

Every party, in chamber order: what its own plan pointed to, how it voted, and the reasoning behind both. Highlighted rows are where the two differ — but a vote that follows the plan is a result too, so the reasoning is there for every party.

VVänsterpartietNoYesdeparts from the plannot addressed

The plan demands effective accountability and greater public insight into companies to combat fraud, and sees economic crime in companies as a serious social issue.

Plan documents: party programme

Reasoning and quotes

The plan demands effective accountability and greater public insight into companies to combat fraud, and sees economic crime in companies as a serious social issue. That management in socially critical operations can be held personally responsible for deficiencies in security measures is in line with that stance. The plan does not address the cybersecurity law as such, but the principle of responsibility among those who make decisions is clear.

Original (Swedish)

Planen kräver ett fungerande ansvarsutkrävande och större samhällelig insyn i företag för att stävja fusk, och ser ekonomisk brottslighet i företag som en allvarlig samhällsfråga. Att ledningen i samhällskritiska verksamheter kan hållas personligt ansvarig för brister i säkerhetsåtgärder ligger i linje med den hållningen. Planen behandlar inte cybersäkerhetslagen som sådan, men principen om ansvar hos dem som fattar besluten är tydlig.

  • accountability for legal violationsdecisive»höga krav på fungerande ansvarsutkrävande vid lagbrott.« (party programme ↗)“high requirements for effective accountability in the case of legal violations.”
  • insight into companies»Vi vill gå mot en större samhällelig insyn« (party programme ↗)“We want to move towards greater public insight”
  • combat crime in companies»Ekonomisk brottslighet i företag leder till allvarliga konsekvenser,« (party programme ↗)“Economic crime in companies leads to serious consequences,”

The plan takes no explicit position on what the committee actually decided — often because the committee's reason was procedural. The stance is derived and fully cited, but it does not show the party broke a commitment.

SSocialdemokraternaNoYesdeparts from the plannot addressed

The plan establishes that the capacity to resist cyber attacks shall be strengthened and that society needs strong resilience and readiness against hybrid attacks.

Plan documents: 2022 manifesto · party programme

Reasoning and quotes

The plan establishes that the capacity to resist cyber attacks shall be strengthened and that society needs strong resilience and readiness against hybrid attacks. It also sees as a problem that control systems have been weakened rather than strengthened when activities of societal importance are run privately. A clearer personal responsibility for management in society-critical activities therefore lies in line with the plan's requirement for sharper governance and responsibility.

Original (Swedish)

Planen slår fast att förmågan att stå emot cyberattacker ska stärkas och att samhället behöver stark motståndskraft och beredskap mot hybridangrepp. Den ser också som ett problem att kontrollsystemen försvagats i stället för att förstärkas när verksamheter av samhällsvikt drivs privat. Ett tydligare personligt ansvar för ledningen i samhällskritiska verksamheter ligger därför i linje med planens krav på skarpare styrning och ansvar.

  • strengthened cyber resiliencedecisive»Arbetet för att stärka förmågan att stå emot cyberattacker och desinformation ska stärkas.« (2022 manifesto ↗)“Work to strengthen the capacity to resist cyber attacks and disinformation shall be strengthened.”
  • readiness against hybrid threats»Beredskap mot hybridattacker.« (party programme ↗)“Readiness against hybrid attacks.”
  • strong national resilience»Det försämrade säkerhetspolitiska läget ställer stora krav på en stark motståndskraft för vårt land.« (party programme ↗)“The deteriorated security policy situation places great demands on a strong resilience for our country.”

The plan takes no explicit position on what the committee actually decided — often because the committee's reason was procedural. The stance is derived and fully cited, but it does not show the party broke a commitment.

MPMiljöpartietNoYesdeparts from the plannot addressed

The plan demands that society secures control over critical infrastructure and that civil defense and crisis preparedness are strengthened, which presupposes that demands on socially vital activities are effective.

Plan documents: party programme · 2022 manifesto

Reasoning and quotes

The plan demands that society secures control over critical infrastructure and that civil defense and crisis preparedness are strengthened, which presupposes that demands on socially vital activities are effective. That leadership can be held personally responsible, in line with the EU directive, is one way to make responsibility real rather than formal. The plan says nothing about leadership responsibility in cybersecurity legislation, so the assessment is weak.

Original (Swedish)

Planen kräver att samhället säkrar kontroll över kritisk infrastruktur och att det civila försvaret och krisberedskapen stärks, vilket förutsätter att kraven på samhällsviktiga verksamheter är verkningsfulla. Att ledningen kan hållas personligt ansvarig, i linje med EU-direktivet, är ett sätt att göra ansvaret verkligt snarare än formellt. Planen säger inget om ledningsansvar i cybersäkerhetslagstiftning, varför bedömningen är svag.

  • control over critical infrastructuredecisive»läkemedel, kritiska råmaterial och viktig teknologi. Samhället måste säkra kontroll över« (party programme ↗)“medicine, critical raw materials and important technology. Society must secure control over”
  • strengthened civil preparedness»satsa en större andel av försvarets pengar på det civila försvaret, och öka anslagen till krisberedskap« (2022 manifesto ↗)“invest a larger share of defense spending on civil defense, and increase appropriations for crisis preparedness”
  • accountability for power»Överdriven maktkoncentration är odemokratiskt och korrumperar.« (party programme ↗)“Excessive concentration of power is undemocratic and corrupts.”

The plan takes no explicit position on what the committee actually decided — often because the committee's reason was procedural. The stance is derived and fully cited, but it does not show the party broke a commitment.

CCenterpartietYesNodeparts from the plannot addressed

The plan says nothing about personal responsibility for management in cybersecurity regulation.

Plan documents: 2022 manifesto · party programme

Reasoning and quotes

The plan says nothing about personal responsibility for management in cybersecurity regulation. The closest principle is instead that the regulatory burden on companies and organisations shall be cleaned up and not made heavier than necessary. From that principle, the documents do not support sharpening the law with special personal responsibility for office holders.

Original (Swedish)

Planen säger ingenting om personligt ansvar för ledningen i cybersäkerhetsregleringen. Den närmast liggande principen är i stället att regelbördan för företag och organisationer ska rensas upp och inte göras tyngre än nödvändigt. Utifrån den principen ger dokumenten inte stöd för att skärpa lagen med ett särskilt personligt ansvar för befattningshavare.

  • reduced regulatory burden on businessdecisive»Rensa upp i regelträsket för entreprenörer, stora som små. Vi vill införa en ny och förenklad företagsform för mikroföretag, så att fler ska våga testa att driva företag.« (2022 manifesto ↗)“Clean up the regulatory thicket for entrepreneurs, large and small. We want to introduce a new and simplified business form for micro-enterprises, so that more dare to try running a business.”
  • good conditions for enterprise»Goda villkor för entreprenörer, egenföretagare och små företag är därför avgörande för att skapa nya jobb.« (party programme ↗)“Good conditions for entrepreneurs, self-employed and small businesses are therefore crucial for creating new jobs.”
  • strengthened civil preparedness»Även det civila försvaret är livsviktigt. Vi måste rusta civilförsvaret och samhällets beredskap inför krig och kris.« (2022 manifesto ↗)“Civil defence is also vital. We must strengthen civil defence and society's preparedness for war and crisis.”

The plan takes no explicit position on what the committee actually decided — often because the committee's reason was procedural. The stance is derived and fully cited, but it does not show the party broke a commitment.

LLiberalernaNoYesdeparts from the plannot addressed

The plan does not address personal responsibility of leadership in cybersecurity law.

Plan documents: 2022 manifesto · party programme

Reasoning and quotes

The plan does not address personal responsibility of leadership in cybersecurity law. The nearest-lying principle is that civil defence shall be strengthened at the same pace as military defence and that total defence needs to be greatly strengthened in the difficult security situation, which speaks for clear requirements on those who lead societally important activities. From that principle the question of clearer responsibility should be reviewed, but the conclusion is weakly grounded.

Original (Swedish)

Planen behandlar inte ledningens personliga ansvar i cybersäkerhetslagstiftning. Närmast liggande princip är att det civila försvaret ska stärkas i samma takt som det militära och att totalförsvaret behöver stärkas kraftigt i det svåra säkerhetsläget, vilket talar för tydliga krav på dem som leder samhällsviktig verksamhet. Utifrån den principen bör frågan om ett tydligare ansvar ses över, men slutsatsen är svagt underbyggd.

  • strengthened civil defencedecisive»det civila försvaret stärkas i samma takt som det militära« (2022 manifesto ↗)“civil defence is strengthened at the same pace as military defence”
  • greatly strengthened total defence»I ett säkerhetspolitiskt läge som är det svåraste sedan andra världskrigets slut behöver Sveriges totalförsvar stärkas kraftigt.« (party programme ↗)“In a security policy situation that is the most difficult since the end of the Second World War, Sweden's total defence needs to be greatly strengthened.”
  • clear digital rules»Vi vill ha spelregler som gör det lätt att göra rätt och säkerställer konkurrens på rättvisa villkor även i digitaliseringens och delningsekonomins tid.« (party programme ↗)“We want rules that make it easy to do the right thing and ensure competition on fair terms even in the age of digitalisation and the sharing economy.”

The plan takes no explicit position on what the committee actually decided — often because the committee's reason was procedural. The stance is derived and fully cited, but it does not show the party broke a commitment.

KDKristdemokraternaNoYesdeparts from the plannot addressed

The plan is based on the premise that all people have personal responsibility for their conscious actions and that honesty and personal responsibility are important foundations in business, where good governance requires participation in accountability.

Plan documents: party programme

Reasoning and quotes

The plan is based on the premise that all people have personal responsibility for their conscious actions and that honesty and personal responsibility are important foundations in business, where good governance requires participation in accountability. The plan also requires that Sweden can meet attacks including cyber warfare. The counter-proposal's demand for clearer personal responsibility for leadership in society-critical activities follows from these commitments.

Original (Swedish)

Planen bygger på att alla människor har ett personligt ansvar för sina medvetna handlingar och att hederlighet och personligt ansvarstagande är viktiga fundament i näringslivet, där god förvaltning förutsätter delaktighet i ansvar. Planen kräver också att Sverige kan möta angrepp i form av bland annat cyberkrigföring. Motförslagets krav på tydligare personligt ansvar för ledningen i samhällskritiska verksamheter följer av dessa åtaganden.

  • personal responsibility for actionsdecisive»Alla människor har ett personligt ansvar för sina medvetna handlingar.« (party programme ↗)“All people have personal responsibility for their conscious actions.”
  • personal responsibility in business»Hederlighet och personligt ansvarstagande är viktiga fundament.« (party programme ↗)“Honesty and personal responsibility are important foundations.”
  • responsibility follows governance»God förvaltning förutsätter närhet till beslut och delaktighet i ansvar.« (party programme ↗)“Good governance requires proximity to decision-making and participation in accountability.”
  • capability against cyber threats»Sverige måste kunna möta angrepp från internationell kriminalitet, terrorism,« (party programme ↗)“Sweden must be able to meet attacks from international crime, terrorism,”

The plan takes no explicit position on what the committee actually decided — often because the committee's reason was procedural. The stance is derived and fully cited, but it does not show the party broke a commitment.

MModeraternaYesYesfollows the plannot addressed

The plan meets cyber threats against companies with government support rather than with stricter personal responsibility for management, and states that EU rules as a general rule shall be implemented at minimum level without over-implementation.

Plan documents: 2022 manifesto

Reasoning and quotes

The plan meets cyber threats against companies with government support rather than with stricter personal responsibility for management, and states that EU rules as a general rule shall be implemented at minimum level without over-implementation. The demand for clearer personal management responsibility beyond what the bill contains therefore lacks support in the plan, which instead wants to remove a third of companies' regulatory burden. The plan simultaneously wants to develop cyber defence.

Original (Swedish)

Planen möter cyberhoten mot företag med statligt stöd snarare än med skärpt personligt ansvar för ledningen, och slår fast att EU-regler som huvudregel ska genomföras på miniminivå utan överimplementering. Kravet på tydligare personligt ledningsansvar utöver vad lagförslaget innehåller saknar därför stöd i planen, som i stället vill ta bort en tredjedel av företagens regelbörda. Planen vill samtidigt utveckla cyberförsvaret.

  • government support against cyber threatsdecisive»Ge företag som är engagerade i säkerhetskänslig verksamhet bättre stöd från staten att kunna möta cyberattacker, spionage och stöldförsök från främmande makt« (2022 manifesto ↗)“Provide companies engaged in security-sensitive operations with better government support to meet cyberattacks, espionage, and theft attempts from foreign powers”
  • no over-implementation»Minska regelkrånglet och onödig byråkrati, bland annat genom att motverka överimplementering i Sverige av EU-beslut – som huvudregel ska EU-direktiv genomföras på miniminivå« (2022 manifesto ↗)“Reduce regulatory red tape and unnecessary bureaucracy, including by counteracting over-implementation in Sweden of EU decisions - as a general rule, EU directives shall be implemented at minimum level”
  • reduced regulatory burden»Ta bort en tredjedel av företagens administrationskostnader och en tredjedel av regelkrånglet« (2022 manifesto ↗)“Remove a third of companies' administrative costs and a third of regulatory red tape”
  • strengthened cyber defence»Utveckla cyberförsvaret« (2022 manifesto ↗)“Develop cyber defence”

flags: citat_migrerat

SDSverigedemokraternaNoYesdeparts from the plannot addressed

The plan requires re-established official responsibility and strengthened possibilities for accountability when management of public resources falls short.

Plan documents: 2022 manifesto

Reasoning and quotes

The plan requires re-established official responsibility and strengthened possibilities for accountability when management of public resources falls short. The counter-proposal's demand for clearer personal responsibility for leadership in societally critical activities follows from the same principle, in line with the plan's requirement for better evaluation of society's digital vulnerability. The plan however does not address the cyber security law as such.

Original (Swedish)

Planen kräver återinfört tjänstemannaansvar och stärkta möjligheter till ansvarsutkrävande när hanteringen av offentliga resurser brister. Motförslagets krav på ett tydligare personligt ansvar för ledningen i samhällskritiska verksamheter följer av samma princip, i linje med planens krav på att samhällets digitala sårbarhet utvärderas bättre. Planen behandlar dock inte cybersäkerhetslagen som sådan.

  • re-established official responsibilitydecisive»Återinför tjänstemannaansvaret« (2022 manifesto ↗)“Re-establish official responsibility”
  • accountability for shortfalls»Sverigedemokraterna vill stärka möjligheter för ansvarsutkrävande när hanteringen av de offentliga resurserna brister.« (2022 manifesto ↗)“Sweden Democrats want to strengthen possibilities for accountability when management of public resources falls short.”
  • evaluate digital vulnerability»Samhällets sårbarhet behöver bättre utvärderas, inkluderat hur ett allt mer elektrifierat och digitalt samhälle påverkar utsattheten vid en kris eller störning.« (2022 manifesto ↗)“Society's vulnerability needs to be better evaluated, including how an increasingly electrified and digital society affects vulnerability in a crisis or disruption.”

The plan takes no explicit position on what the committee actually decided — often because the committee's reason was procedural. The stance is derived and fully cited, but it does not show the party broke a commitment.

Share and embed

Embed as a widget (iframe): previewSizeLanguage

Sources and documents

Documents under consideration

Source: The Swedish Parliament