Does Sweden have a post-quantum cryptography (PQC) law?

No. Nothing published for Sweden carries statutory force for post-quantum cryptography as of this page's last review. What exists is non-binding guidance, set out with its primary sources below. The lead body is NCSC Sweden (Nationellt cybersäkerhetscenter, hosted at Försvarets radioanstalt/FRA).

What is Sweden's PQC migration deadline?

2035. See the sources below for what this deadline actually covers, since it may apply only to specific sectors or system types. The deadline came from NCSC Sweden (Nationellt cybersäkerhetscenter, hosted at Försvarets radioanstalt/FRA).

Does Sweden require a Cryptographic Bill of Materials (CBOM)?

No. No CBOM or cryptographic inventory requirement appears in any of the primary sources listed on this page.

SEGuidance

Sweden

Sweden's NCSC (FRA-hosted) issued 2026 national guidance, not binding law, setting concrete, economy-wide target dates of end-2030 for long-sensitivity data (e.g. health data) and end-2035 for the full transition to quantum-safe cryptography, using mandatory "ska" phrasing within an otherwise recommendations-only document.

Sweden's post-quantum cryptography posture is classified as guidance, led by NCSC Sweden (Nationellt cybersäkerhetscenter, hosted at Försvarets radioanstalt/FRA), with a migration target of 2035. It scores 50/100 on this tracker's rubric, a moderately binding rule, with real gaps in scope or enforcement, and that is not a measure of how secure or advanced the country actually is.

What's verified

Sweden's NCSC (Nationellt cybersäkerhetscenter, hosted at FRA, the National Defence Radio Establishment) published "Nationella rekommendationer för övergången till kvantsäker kryptografi" (2026), a national guidance document (not binding law) that recommends two deadlines using mandatory ("ska") phrasing: the full transition to quantum-safe cryptography should be complete by the end of 2035, and for information that remains sensitive more than ten years into the future (e.g., individuals' health data), the transition should be complete by the end of 2030. These are recommended target dates within official guidance, not legally binding statutory deadlines: the document itself is titled and framed throughout as "recommendations" (rekommendationer), even though the specific deadline sentences use "ska vara klar" (shall/must be complete) rather than softer language.

Score rationale

Each axis is scored 0–20 against the primary sources listed on this page. See the methodology for what each axis measures and how scores are derived.

Axis	Score	Why
Mandate strength	0/20	The source is explicitly titled and framed throughout as 'rekommendationer' (recommendations) from NCSC Sweden, a non-binding national guidance document with no stated penalties. Despite the two deadline sentences using 'ska' (shall/must) phrasing, the instrument itself is guidance, not statute or regulation, so this scores at the guidance/non-binding floor.
Deadline concreteness	20/20	The source publishes two specific hard years: 'Hela övergången till kvantsäker kryptografi ska vara klar till slutet av år 2035' (full transition by end of 2035) and an earlier 2030 deadline for long-sensitivity data such as health data, meeting the 20-point bar for specific published year(s).
Scope of coverage	20/20	The 2035 deadline applies to 'Hela övergången' (the entire/whole transition) with no sectoral limitation stated, and the 2030 deadline is defined by a data-sensitivity criterion (information sensitive more than ten years out, e.g. health data) rather than by sector; both read as economy-wide/general scope rather than confined to government or one regulated sector.
Inventory/CBOM requirement	0/20	The evidence provided contains no explicit mention of a cryptographic inventory or CBOM requirement, nor any general risk-assessment obligation language in the quoted/cited text, so there is nothing in the source to justify inventory credit; scored at 0 per the rubric's 'not addressed at all' tier, though verifier notes suggest the wider document may touch adjacent recommendations not quoted here.
Regulatory activity	10/20	NCSC Sweden (hosted at FRA) is clearly named as the issuing authority, but the source as provided describes only a recommendations document with no mention of fines, audits, or a certification/enforcement mechanism, matching the 'named authority, no visible enforcement teeth yet' tier.
Total	50/100	A blunt sum of the five columns to its left.

Related regulators

Sector bodies checked independently, not assumed from the primary source above.

Finansinspektionen (Swedish FSA)
Not yet addressed, a gap to watch
Not yet addressed directly. No FFFS regulation, report, or guidance from FI addresses post-quantum cryptography or cryptographic inventory.
Sveriges Riksbank
In progress, no guidance yet
Riksbank's Financial Stability Report 2026:1 (29 May 2026) states that the development of quantum computers able to break today's advanced encryption algorithms is changing the threat picture, and recommends a coordinated transition to quantum-safe encryption in line with given timelines. This is a real, dated risk statement in an official policy report, not yet a binding migration mandate or cryptographic inventory requirement of its own.
Financial Stability Report 2026:1 →Read the full breakdown →

FAQ: Sweden and PQC

Does Sweden have a post-quantum cryptography (PQC) law?: No. Nothing published for Sweden carries statutory force for post-quantum cryptography as of this page's last review. What exists is non-binding guidance, set out with its primary sources below. The lead body is NCSC Sweden (Nationellt cybersäkerhetscenter, hosted at Försvarets radioanstalt/FRA).
What is Sweden's PQC migration deadline?: 2035. See the sources below for what this deadline actually covers, since it may apply only to specific sectors or system types. The deadline came from NCSC Sweden (Nationellt cybersäkerhetscenter, hosted at Försvarets radioanstalt/FRA).
Does Sweden require a Cryptographic Bill of Materials (CBOM)?: No. No CBOM or cryptographic inventory requirement appears in any of the primary sources listed on this page.