Sweden: technology regulation at a glance

Framework: EU Markets in Crypto-Assets Regulation (MiCA, Regulation (EU) 2023/1114) with Swedish supplementary act Lag (2024:1159) med kompletterande bestämmelser till EU:s förordning om marknader för kryptotillgångar; supervised by Finansinspektionen (SFSA). AML rules under the Swedish AML Act and EU TFR (Regulation (EU) 2023/1113). Taxation administered by Skatteverket under the Swedish Income Tax Act.

Crypto-assets and crypto-asset services in Sweden are legal and comprehensively regulated under the directly applicable EU MiCA Regulation, supplemented by Sweden's national Act (2024:1159) which entered into force on 30 December 2024 and grants Finansinspektionen supervisory, investigative and intervention powers. CASPs must obtain Finansinspektionen authorisation; existing providers that previously held registration under the Certain Financial Operations Act had to file complete MiCA applications by 30 September 2025 and may operate transitionally until a decision is made or 30 June 2026 at the latest. Crypto is taxed by Skatteverket as 'other assets' under Chapter 52 of the Income Tax Act at a flat 30% on capital gains, with mining and salary-in-kind treated as income.

Framework: EU AI Act (Regulation 2024/1689), directly applicable in Sweden; national implementation via SOU 2025:101 inquiry; lead market surveillance authority proposed as PTS (Swedish Post and Telecom Authority), with IMY and Finansinspektionen (FI) as co-authorities; DIGG and IMY provide public-sector guidelines

Sweden is subject to the directly applicable EU AI Act, which entered into force on 1 August 2024 with phased application: prohibited practices since February 2025, GPAI model rules since August 2025, and full high-risk AI system obligations from August 2026. Sweden published its first comprehensive national AI Strategy in February 2026, targeting a top-10 global AI ranking, and an official government inquiry (SOU 2025:101) has proposed how to designate domestic market surveillance authorities and establish a national AI regulatory sandbox under the Act.

Framework: EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679), implemented nationally by the Act (2018:218) with supplementary provisions to the EU GDPR (Dataskyddslagen) and Ordinance (2018:219); supervised by Integritetsskyddsmyndigheten (IMY, Swedish Authority for Privacy Protection).

As an EU member state, Sweden applies the directly-effective GDPR as its comprehensive data-protection regime, in force since 25 May 2018. It is supplemented nationally by the Data Protection Act (2018:218), which fills areas where the GDPR permits or requires national rules, and is enforced by the supervisory authority IMY. Sector-specific statutes (e.g. Patient Data Act, Criminal Data Act, Camera Surveillance Act) layer on top for particular fields.

Framework: Payment Services Act (SFS 2010:751, last amended SFS 2025:253), Electronic Money Act (SFS 2011:755), Consumer Credit Act (2010:1846) implementing EU PSD2/EMD2; competent authority: Finansinspektionen (FI); Riksbank oversees payments infrastructure and statistics

Sweden operates a mature, fully articulated licensing regime for payment institutions and e-money institutions supervised by Finansinspektionen, implementing EU PSD2 and EMD2 through national statute. Open banking is live under PSD2, but instant payment coverage remains limited, the Riksbank publicly criticised Swedish banks in March 2026 for failing to offer interoperable instant payments and set a March 2027 compliance target. The EU PSD3/PSR package reached provisional political agreement in November 2025, with direct application of the PSR expected approximately 18 months after entry into force, requiring Sweden to update its Payment Services Act accordingly.

Framework: Swedish Aliens Act (Utlänningslagen 2005:716) administered by Migrationsverket (Swedish Migration Agency); EU free-movement rules apply to EU/EEA/Swiss nationals

Sweden offers no dedicated digital-nomad or remote-work visa. Non-EU/EEA remote workers who wish to stay beyond the 90-day Schengen limit must qualify under an existing permit category, most relevantly the self-employment residence permit for those running their own business, or a standard work permit tied to a Swedish employer. Sweden has no golden-visa or residency-by-investment programme.

Framework: EU Digital Services Act (Regulation 2022/2065, directly applicable) supplemented by Swedish Act Supplementing the Digital Services Act (SFS 2024:954) and Swedish Regulation Supplementing the Digital Services Act (SFS 2024:958), both in force 1 December 2024; supervised by Post- och telestyrelsen (PTS) as Digital Services Coordinator

Sweden operates under the EU Digital Services Act as its primary online content-moderation and platform-safety regime, reinforced by national supplementing legislation (SFS 2024:954/958) that entered into force on 1 December 2024. PTS (Swedish Post and Telecom Authority) is designated as the national Digital Services Coordinator with enforcement, inspection, and trusted-flagger certification powers. Sweden additionally applies GDPR via IMY (Swedish Authority for Privacy Protection), which has a dedicated 2026 supervisory focus on children and young people on digital platforms.

Framework: Cybersecurity Act (Cybersäkerhetslagen, SFS 2025:1506), implementing EU NIS2 Directive (2022/2555), in force 15 January 2026; national coordinator and EU single point of contact: MCF (Myndigheten för civilt försvar, formerly MSB); sector-specific supervisory authorities for respective sectors; NCSC coordinated under FRA (Försvarets radioanstalt)

Sweden enacted the Cybersäkerhetslagen (SFS 2025:1506) on 10 December 2025, with effect from 15 January 2026, transposing EU NIS2 and replacing the 2018 Information Security Act. The law extends mandatory risk-management and incident-reporting obligations across 18 sectors to both essential and important entities, with 24-hour initial breach notification duties. A National Cybersecurity Strategy 2025-2029, published February 2026, underpins a whole-of-society 'total defense' approach.

Framework: Aktiebolagslagen (Companies Act, SFS 2005:551); competent authority: Bolagsverket (Swedish Companies Registration Office) and Skatteverket (Swedish Tax Agency)

Sweden imposes no foreign-ownership caps on company formation: any natural person or legal entity, regardless of nationality, may found a private limited company (aktiebolag, AB). The registration process is largely digital, fast (5-15 business days at Bolagsverket), and requires only SEK 25,000 minimum capital. EU/EEA nationals operate on identical terms to Swedish citizens; non-EU/EEA nationals who wish to reside in Sweden while running the business must additionally obtain a residence permit and demonstrate ≥51% ownership, language ability, and financial viability.