Sweden makes lost cross-border network redundancy reportable

The Backup Is Gone. Sweden Wants the Incident Report Before the Outage.

Why it matters

A cross-border service can look healthy on the customer screen while the path that would save it has vanished. Sweden's new telecom incident rules make that loss of redundancy a reportable event for central international infrastructure. The regulator is asking operators to measure the protection behind a working connection.

Daniel Kade3 November 2026 at 09:49 UTCReading Time 3 minLast update: 3 November 2026

Sweden treats reduced redundancy in central cross-border network infrastructure as a significant incident. Conceptual illustration.

Summary

Under PTSFS 2026:5, reduced redundancy in an operator's central infrastructure important to networks or services between Sweden and another country is always a significant incident. The rule has applied since 15 October 2026.
That trigger does not require a customer outage or the one-, two-, six- or 24-hour thresholds used for other availability failures. PTS defines the classification; significant incidents are reported to the National Cybersecurity Centre at FRA.

The main cross-border route is still carrying traffic. Its spare route has disappeared. Customers may see a normal service, but under Sweden's new telecom incident regulation, that loss of protection can already cross the reporting line. Chapter 4, section 5(4) says reduced redundancy in central infrastructure important for networks or services between Sweden and another country must always be assessed as a significant incident. The rule took effect on 15 October.

The wording matters. It concerns an operator's central infrastructure with a role in international service, not every spare cable in a building. The regulation separately defines central infrastructure as links, nodes and other components whose function is decisive for regional, national or cross-border networks or services. Nothing in section 5(4) requires traffic to stop first. The operator has lost its second chance while the first path still works.

That differs from the regulation's ordinary availability table. A one-hour incident can qualify at 150,000 affected users or connections, at least 50% capacity loss, or 15,000 square kilometres of contiguous affected area; a 24-hour incident can qualify at 2,000 users or connections, 10% capacity loss, or 1,000 square kilometres. The cross-border central-redundancy clause has no stated duration or user-count threshold. PTS has made the state of the backup a regulatory fact in its own right.

An operator cannot decide that the dashboard is green and close the file. Chapter 3 requires it to use information it has, knows or can reasonably obtain, and to estimate scope when exact impact is unknown. PTS's consultation response says each affected provider in a supply chain makes an independent assessment; one event can be significant for several providers. A wholesale link owner and a service provider therefore cannot assume the other party has made the classification for them.

The authority chain is also split. PTS wrote the criteria for public network and publicly available service providers. Its 2 October explanation says the National Cybersecurity Centre at FRA receives significant-incident reports. The same law now covers harm to accuracy, authenticity and confidentiality as well as availability. A traffic counter alone cannot tell the entire incident story.