A Swedish act for an EU directive
The Swedish Act on the Resilience of Critical Entities (LOM) implements the EU CER Directive (2022/2557). It covers physical and organizational resilience from an all-hazards perspective – and complements the Swedish Cybersecurity Act, which governs networks and information systems.
Who can be identified as critical?
- Essential serviceThe organization provides one or more essential services.
- Listed sectorIt is covered by a category in the annex to the directive – or is an authority that the Government designates.
- Infrastructure in SwedenIt operates and has critical infrastructure here.
- Significant disruptionAn incident would have a significant disruptive effect on the service or on services that depend on it.
The supervisory authority decides on identification case by case. An organization that is identified also becomes an essential entity under the Cybersecurity Act.
Timeline
- 14 July 2026The Government submits Bill 2025/26:303 to the Riksdag.
- 13 October 2026The period for parliamentary motions ends.
- 1 January 2027The Act is proposed to enter into force.
- Identification decisionThe supervisory authority decides that the organization is critical. The deadlines run from here.
- + 9 monthsThe risk assessment must be done and documented.
- + 10 monthsResilience measures must be in place – including the position analysis and background checks.
The Riksdag has not yet decided. Dates and details may change, and the authorities are expected to issue regulations that specify the requirements.
Sectors, supervision and penalties
Where the Act’s obligations apply
- Energyelectricity, district heating and cooling, oil, gas, hydrogen
- Transportair, rail, water, road, public transport
- Health care
- Drinking water
- Waste water
- Foodproduction, processing, distribution
- Public administration
- Space
Identified – but without obligations
- Banking
- Financial market infrastructure
- Digital infrastructure
According to the Bill, the Act’s obligations, including background checks, do not apply to the part of the business identified in these sectors (Chapter 1, Section 4) – for example operations relating to data center services. Identification in other sectors, the Protective Security Act or customer requirements may still impose requirements.
Other exemptions
Security-sensitive activities
Exempted wholly or partly, depending on how much of it is security-sensitive (Chapter 1, Section 5).
Equivalent requirements in other rules
Where other rules set requirements at least as far-reaching, for example for port security, those apply.
Supervision
The Swedish Civil Defence Agency (MCF) is proposed as the single point of contact. The Government appoints supervisory authorities per sector. They may request information, carry out site visits and issue orders subject to fines.
Proposed administrative fines
2% or EUR 10mFor companies, at most the higher of 2 per cent of global annual turnover and EUR 10 million. At least SEK 5,000. Public entities: at most SEK 10 million.
European significance: If you provide an essential service in at least six EU countries, you must notify the authority.
What the Act requires
Personnel security is one of the resilience measures the Act requires (Chapter 3, Section 3). At its core are four steps – and a clear limit on what may be documented.
- Position analysisCh. 3, Sec. 4
Analyse and document the positions in which taking part in the business makes it possible to cause more than minor disruption to the essential service. Update as needed and at least once a year.
- Background checkCh. 3, Sec. 5
Make sure that anyone who takes part or is to take part in the business in such a position has undergone a background check: verified identity and a criminal-record check.
- Criminal-record checkCh. 3, Sec. 6
On request, the person shows an extract from the criminal records register. The extract may not be older than six months. The Government decides what information it contains.
- RecordCh. 3, Sec. 7
Note that the identity was verified and that the extract was shown. The record is kept for two years.
Renewed check
When there is reason to, and no later than two years after the most recent check (Chapter 3, Section 5).
Knowledge and awarenessCh. 3, Sec. 3
Staff concerned must be given knowledge of the organization’s resilience measures.
Point of contactCh. 3, Sec. 8
The organization must appoint a point of contact for the supervisory authority.
Who must be checked – and what may be kept?
Not just employees
The Act refers to people who take part or are to take part in the business. The CER Directive also states that the staff of external service providers are to be taken into account. Consultants, contractors and subcontractors’ staff may therefore be covered when they hold a position identified in the position analysis. The exact scope of the requirement may be clarified through regulations and supervisory practice.
Sistec’s examples of positions that may be identified:
- Operations managers
- Control room staff
- System administrators
- Security managers
- Maintenance technicians
- Contractors with access to critical infrastructure
The documentation ban
Must be recorded
- That the person has verified their identity
- That the extract from the criminal records register was shown
The record must be traceable to the right person and date, for follow-up and deletion.
May not be kept
- A copy of the extract
- Information from the extract, such as convictions
- Any documentation of the check other than the required record
The record is kept for two years from the day the check was completed (Chapter 3, Section 7) and then deleted. Identity documents the employer keeps for other reasons, for example under the Aliens Ordinance, are not affected.
Identity is the foundation
The Act requires the person to verify their identity and show an extract from the criminal records register – but does not say how the identity is to be checked. At the same time, false and forged identity documents occur on the labor market.
A records extract only tells you something about the person in front of you – if the identity is right.
How to make the check reliable
RecommendationThe Act does not prescribe a method for the identity check – it only requires the identity to be verified. The points below are Sistec’s advice for a reliable check.
- Check the identity document at an in-person meeting.
- Have trained staff carry out an authenticity analysis – a visual inspection alone makes it more likely that forgeries are missed.
- As a rule, accept only valid identity documents.
- Make sure the records extract concerns the same person as the identity document.
What is at stake
- Sabotage
- Espionage
- Infiltration by criminals
- Money mules as employees
- Enablers
- Labor market crime
Step by step
Step 1 – Prepare the organization
- Find out whether you may be coveredGo through the sectors and criteria. Follow the supervisory authority’s decisions and forthcoming regulations.Recommendation
- Appoint a lead and a point of contactOne person responsible for personnel security, ideally the same person who is the point of contact for the supervisory authority.Legal requirementCh. 3, Sec. 8
- Plan for the deadlinesRisk assessment within 9 months and background checks within 10 months of the identification decision.Recommendation
- Carry out the risk assessmentDocument all relevant risks. Update as needed and at least every four years. It is the basis for the position analysis.Legal requirementCh. 3, Sec. 2
- Draw up a resilience planDescribe the measures taken and planned, including personnel security – and follow the plan.Legal requirementCh. 3, Sec. 3
- Write internal proceduresWho carries out the checks, how often, how records are kept and when they are deleted.Recommendation
- Train the staff concernedGive knowledge of the resilience measures, and teach managers and HR the procedures.Legal requirementCh. 3, Sec. 3
Step 2 – Carry out and follow up
- Carry out the position analysisIdentify positions that could cause more than minor disruption, external ones included. Update at least once a year.Legal requirementCh. 3, Sec. 4
- Set requirements for suppliersConsider stating in supplier contracts that external people in identified positions are checked before they start.Recommendation
- Check before accessAnyone who will work in an identified position must have completed the required check. In practice: on hiring, on reassignment and before an external person starts.Legal requirementCh. 3, Sec. 5
- Verify the identity, receive the extractCheck the identity document. The extract from the criminal records register may be no more than six months old.Legal requirementCh. 3, Secs. 5–6
- Record – nothing moreNote that the identity was verified and that the extract was shown. Keep the record for two years.Legal requirementCh. 3, Sec. 7
- Renew on timeNo later than 24 months after the previous check, earlier if there is reason to. Set reminders well in advance.Legal requirementCh. 3, Sec. 5
- Follow up internallyMake sure no one is missed. The supervisory authority may request information and carry out site visits.Recommendation
Checklist
Prepare
Carry out
Follow up
Support for the whole check process
Background checks need structure: the right person, the right document, the right record – on time. Right to Work is Sistec’s digital platform with automated processes for identity checks, documentation and follow-up.
- Authenticity analysis of identity documents
- Verification of identity and nationality
- Check of the records extract together with the identity check
- Records of completed checks in line with the Act
- Automated follow-up reminders
- Integration with HR systems
- Customer portal where clients can verify that a supplier’s staff have been checked
Ready when the Act applies?
We help you get started.
This checklist is based on Government Bill 2025/26:303 (July 2026) and is not legal advice. The content may need to be updated after the Riksdag’s decision and when the authorities issue regulations and guidance.