Checks for staff in sensitive roles
Build a clear process for identity and background checks based on your roles and business requirements.
Discuss your checking needsThe CER directive is proposed to become Swedish law through the act on the resilience of critical entities (LOM). Bill 2025/26:303 was submitted on 14 July 2026, with a proposed entry into force on 1 January 2027.
Under the proposal, staff in sensitive roles at critical entities are to be background-screened. The hard part is rarely the screening itself — it is deciding which roles count, and being able to show how you reached that conclusion.
Criminal record checks by a third party are also regulated. The extract is ordered by the individual, presented in the original, and may not be copied or stored. An arrangement built on emailed PDFs does not meet the requirement.
Sistec AB holds a permit from the Swedish Authority for Privacy Protection (IMY) to process personal data about criminal offences in background checks, reference number IMY-2026-3140. The permit comes with conditions: only positions where such data could significantly affect the organisation’s security, reputation or finances may be checked, and every record is preceded by a balancing of interests.
The questions that decide
Are you a critical entity? The directive names eleven sectors. Being covered by NIS2 does not automatically mean you are covered by CER — they regulate different things.
Which roles are sensitive? The assessment is yours to make, but it must be documented and defensible after the fact.
Does it cover contractors too? Staff with access to your facilities are rarely only your own employees.
How often must it be repeated? A check at hiring says nothing about the situation three years later.
Without you handling criminal record extracts
You identify the roles
We help with the scoping and document the assessment so it can be shown.
The individual orders the extract
The person offered employment or an assignment orders their own extract from the Swedish Police.
Presented at a physical meeting
The extract is presented in the original and examined by trained staff — authenticity features such as security paper are checked.
A note, never a copy
Sistec never stores the extract. Only a note that it was presented and examined, and when.
Automatic reminders before the next check
The platform tracks when it is due again and reminds you in advance.
Experience of identity checks in large industrial projects
The steelworks project in Boden
Stegra, described in 2024
- Challenge
- Before the steelworks project, contractor personnel needed to be identified.
- What Sistec did
- Subcontractor contact, permit guidance and in-person identity checks connected to ID06.
- Completed assignment
- One coordinated check process for contractor personnel, described by Boden municipality in February 2024.
Discuss your checking needs
Build a clear process for identity and background checks based on your roles and business requirements.