Sweden's cyber fee starts at exactly SEK 30 million

At Exactly SEK 30 Million, Sweden's Cyber Fee Switches On

Why it matters

Sweden moved SEK 12 million of telecom oversight funding into its cybersecurity-law fee. The regulator calls the overall transfer neutral. The binding rule is sharper than its announcement: a covered operator with turnover of exactly SEK 30 million is inside the charge, and a missing revenue return lets PTS write the estimate.

Daniel Kade3 November 2026 at 17:05 UTCReading Time 3 minLast update: 3 November 2026

PTS moved SEK 12 million of supervision funding between fee regimes while setting an inclusive SEK 30 million turnover threshold. Conceptual illustration.

Summary

Sweden's PTS says its 2026 cybersecurity-law supervision fee will raise SEK 12 million, matched by a SEK 12 million reduction in the older electronic-communications notification fee. The legal account changes while PTS says the aggregate fee take from affected operators stays level.
PTSFS 2026:4 charges a covered, notified operator once the previous financial year's relevant turnover reaches SEK 30 million, with a rate capped at 0.0166%. It requires a turnover return and allows PTS to estimate the figure when the return is absent or deficient.

At SEK 29,999,999 in relevant annual turnover, the new fee is zero. At exactly SEK 30 million, the amended PTS regulation, §22, opens the bill. Its wording is “30 million kronor or more.” PTS's 28 September announcement describes the target group as having turnover over SEK 30 million. The line an operator must use is the one in the signed rule. At the threshold, 0.0166% would put the annual fee ceiling at SEK 4,980; individual bills may be lower.

The larger move is an accounting transfer with an operational handle. PTS says the new cybersecurity-law fees total SEK 12 million in 2026 to fund its supervision. It lowered the old fee for operators notified under the Electronic Communications Act by the same SEK 12 million because part of the supervisory work moved to the Cybersecurity Act. PTS says the total fee take for the affected group therefore stays at the 2025 level. That statement is about the group total. The new rule decides which operator supplies the revenue number and crosses the new charge threshold.

Section 21 defines the input precisely. A covered operator notified under the Cybersecurity Act must give PTS its turnover from the preceding financial year, counting the activity within that Act. Revenue from number-independent interpersonal communications services is left out of the calculation. An operation consisting only of those services pays no fee under §22. A company's headline sales figure may therefore be a poor substitute for its chargeable activity figure.

The regulation also gives PTS a way to finish the calculation without a cooperative return. If the operator sends no turnover information, or sends deficient information, PTS can estimate it using the latest annual accounts, its own review of submitted information or previous turnover reports. That turns an absent spreadsheet into an authority decision. For a firm close to SEK 30 million, the classification of revenue and the quality of the return can determine whether the fee starts at all.

PTS decided the amendment on 16 September; it took effect on 1 October 2026. The agency said it planned a separate set of 2027 fee rules in December 2026. Individual 2026 bills and the final 2027 tariff require later records.