Operates a social platform, in Sweden

Lag (1998:112) om ansvar för elektroniska anslagstavlor, 3-7 §§ · Read the law's page

• Tell everyone who joins your electronic bulletin board who you are and to what extent the messages they post become available to other users (section 3).
• Oversee the service to the extent reasonably required given the scope and focus of the activity, so that you can meet the removal duty; if your bulletin board is an intermediary service under the Digital Services Act, this oversight duty does not apply and the removal duty applies once the message has come to your knowledge (sections 4 and 4 a).
• Remove a message a user posts, or otherwise prevent its further dissemination, if its content is manifestly unlawful threat, unlawful invasion of privacy, incitement to rebellion, agitation against a population group, a child pornography offence, unlawful depiction of violence or public provocation to terrorism or especially serious crime, or if it is manifest that the user has infringed copyright or a right protected by Chapter 5 of the Copyright Act by posting it (section 5).

Lag (2002:562) om elektronisk handel och andra informationssamhällets tjänster, 19 § · Read the law's page

• A provider that transmits or stores information for another can be held criminally liable for a crime concerning the content of that information only if the crime was committed intentionally (section 19).

Upphovsrättslagen (1960:729), 52 i-52 u §§ · Read the law's page

• Treat each work a user uploads as one you yourself transmit to the public (section 52 j). To keep the exemption in section 52 l, block access to the content promptly after a well-founded notice from the rightholder, do what can reasonably be required to obtain authorization for the transmissions you make, and do what can reasonably be required to keep out content that infringes copyright in works for which rightholders have given you relevant and necessary information.
• Do not let your blocking measures prevent lawful transmissions to the public to any appreciable extent, use automatic blocking only for content that can with a high degree of probability be assumed to infringe copyright, and tell the user promptly when you block access to their content (section 52 o).
• Tell users in your terms of use about their right to make works available for quotation, criticism, review, caricature, parody or pastiche, and to make non-infringing content available despite your measures (section 52 p).
• Run a complaint procedure for users whose uploads you have blocked: let the rightholder comment, decide promptly, restore the content if the rightholder's request is not duly justified, and review manually before deciding not to restore it (section 52 q).
• Give a rightholder or a user, on request, information about the measures you take under section 52 l, and inform a rightholder with whom you have an agreement about the use made under that agreement (section 52 n).

Lag (2023:319) med kompletterande bestämmelser till EU:s förordning om åtgärder mot spridning av terrorisminnehåll online · Read the law's page

• As a hosting service provider, meet the obligations of Articles 5(1) to (3), 5(5), 7, 10, 15(1) and 17 of Regulation (EU) 2021/784, the articles for which section 4 lets the competent authority order the measures needed to meet the obligation, and of Articles 3(3), 3(6), 4(2), 4(7), 6, 11 and 14(5), the articles for which section 6 provides a sanction fee, each as originally worded.
• Take the measures a competent authority orders under section 4 to meet an obligation under the Regulation.

Lag (2024:954) med kompletterande bestämmelser till EU:s förordning om digitala tjänster · Read the law's page

• Comply with Articles 11(1) and (3), 12(1), 13(1), 14(6), 16(4), 18(1), 24(1), (2) and (3), 26(2) and (3), 30(1) and (6), 31(1) and 32(1) and (2) of the Digital Services Act as originally worded, the articles for which Chapter 3, section 23 of the Lag (2024:954) provides a sanction fee, and with any commitment you have made binding with a supervisory authority.
• Send a notification of a suspected criminal offence under Article 18(1) of the Digital Services Act, where it is made in Sweden, to the Polismyndigheten (Chapter 2, section 3).
• Follow a supervisory authority's order to end an infringement or to take remedial measures, and a court's order for an inspection or for a temporary restriction of recipients' access to your service (Chapter 3, sections 2 and 3).

Lag (2025:1242) med kompletterande bestämmelser till EU:s mediefrihetsförordning · Read the law's page

• If you have made information accessible under Article 6(1) or published information under Article 25(2) of Regulation (EU) 2024/1083, give the supervisory authority that information and a note of where it is available as soon as possible (section 4).
• Notify the supervisory authority, the same day you notify the Competition Authority or the Commission, of a media market concentration where the undertakings concerned together had a turnover in Sweden above SEK 1 billion in the preceding financial year and at least one of them is a provider of media services or of an online platform giving access to media content (section 5).
• On the supervisory authority's request, give it the information and documents it needs if you have obligations under Articles 6(1), 18(1) to (6), 18(8), 24(1), 24(2), 25(1) or 25(2) of the Regulation or under section 5 (section 8).
• Follow an order the supervisory authority issues under section 9 to make you meet those articles or sections 4, 5 or 8.

Lag (2025:1408) med kompletterande bestämmelser till EU:s förordning om politisk reklam · Read the law's page

• As a provider of political advertising services, meet the obligations of Articles 7(1) (first sentence), 7(2), 9(1), 9(3), 11(1), 11(3), 12(1), 12(3), 12(4), 13(2) to (4), 14(1) and 21(1) of Regulation (EU) 2024/900 as originally worded, the articles for which section 11 of the Lag (2025:1408) provides a sanction fee, and any commitment you have made binding with the competent authority.
• Follow the competent authority's orders to end an infringement and its remedial measures under sections 5 and 6, and keep premises available for an inspection the authority orders under section 7.

Cybersäkerhetsförordning (2025:1507), 4-8 §§ och 18 § · Read the law's page

• If you are an operator within a sector that the Cybersäkerhetslag (2025:1506) covers, send your registration notification under chapter 2, section 2 of the Act to the single point of contact (section 5 of the ordinance).
• Report incidents under chapter 2, sections 5 to 8 of the Act to the CSIRT unit (section 6 of the ordinance).

Cybersäkerhetslag (2025:1506), 2 kap. 3-4 §§ · Read the law's page

• Take appropriate and proportionate technical, operational and organisational measures, on an all-hazards basis, to protect the network and information systems you use for your operations or to provide your services, and their physical environment, against an incident, at minimum covering risk-analysis strategy, incident handling, business continuity and crisis management, supply-chain security, security in system acquisition/development/maintenance, effectiveness-assessment procedures, basic cyber hygiene and staff training, cryptography and encryption policies, personnel security, access control and asset management, and, where relevant, authentication, secure communications and secure emergency-communication systems.
• Have the individuals in your management undergo training on these security measures.
• Register with the authority the government designates as soon as you can, per Cybersäkerhetsförordning (2025:1507) 5 §, and notify a change in what you registered within 14 days of the change.
• This binds a väsentlig (essential) or viktig (important) verksamhetsutövare under a medium-or-large size gate; Chapter 1 §7(1) names a provider of cloud services, data-centre services, content-delivery networks, outsourced operational or security services, an online marketplace, a search engine or a social-networking-platform service among the digital providers the Act reaches, essential where the operator is larger than a medium-sized enterprise in an NIS 2 Annex 1 sector and important otherwise (§9); the Act also reaches an operator in an NIS 2 Annex 1 or 2 sector (for example energy, transport, banking, health, drinking water or wastewater) that is established in Sweden and is at least a medium-sized enterprise (§4), an operator meeting a criticality test in §5, a provider of public electronic communications networks or services (§6), a TLD registry, DNS provider or domain-name registration service (§7), and certain state authorities, regions and municipalities (§§3, 8). Coverage follows from those criteria, not from a declaration, and the registration duty in Chapter 2 §2 falls on an operator already covered.
• Where you are a financial entity already covered by Regulation (EU) 2022/2554 (DORA), expect this duty to give way to that regime's own risk-management rules under Chapter 1 §11.

Cybersäkerhetslag (2025:1506), 2 kap. 5-10 §§ · Read the law's page

• This binds a väsentlig (essential) or viktig (important) verksamhetsutövare under a medium-or-large size gate; Chapter 1 §7(1) names a provider of cloud services, data-centre services, content-delivery networks, outsourced operational or security services, an online marketplace, a search engine or a social-networking-platform service among the digital providers the Act reaches, for the reason given on this jurisdiction's companion risk-management row.
• Inform the authority the government designates (in practice the CSIRT-enhet at Försvarets radioanstalt) of a significant incident as soon as you can, and no later than 24 hours after becoming aware of it.
• Follow with a formal incident notification to the same authority as soon as you can; if you provide a trust service, no later than 24 hours after becoming aware, and otherwise no later than 72 hours after becoming aware.
• On the authority's request, submit an interim report with relevant status updates on the significant incident.
• No later than one month after your incident notification, submit a final report; if the significant incident is still ongoing at that point, submit a progress report instead and a final report within one month after you have resolved it.
• Where appropriate, inform your service recipients, as soon as you can, of a significant incident likely to adversely affect the service you provide to them.
• For a significant cyber threat, inform affected service recipients, as soon as you can, of the protective and remedial measures they can take, and, where appropriate, of the threat itself.

Lag (2026:1235) om avlägsnande av rekryteringsinnehåll online · Read the law's page

• If you are a hosting service provider covered by the Digital Services Act and receive an order from the competent authority, remove the recruitment content or make it inaccessible online as soon as possible and within one hour of receiving the order (section 7).
• Preserve recruitment content and related data you have removed or made inaccessible because of an order for six months from removal, and until a final decision if the order has been appealed (section 8).

Lagrådsremiss En ny produktansvarslag · Read the law's page

• The draft Produktansvarslag excludes free and open-source software that you develop or supply outside a business activity (Ch. 1, Sec. 1).
• If you develop, manufacture or produce a product, software included, or put your name, trade mark or another mark on it to present yourself as its maker, you answer as its manufacturer for damage a safety deficiency in it causes (Ch. 1, Sec. 4; Ch. 3, Sec. 1).
• Keep supplying the software updates and upgrades needed to keep the product safe while it is within your control: a deficiency due to your software or a related service is not excused because it arose after you placed the product on the market (Ch. 1, Sec. 4; Ch. 3, Sec. 5, second paragraph).
• Meet the product safety rules that apply to your product: they count in deciding whether it has a safety deficiency, and failing a rule meant to prevent the damage presumes a deficiency (Ch. 2, Secs. 2 and 4).
• Account for what your product learns or acquires after release: the effect of any ability to keep learning or to acquire new features is weighed in deciding whether it has a safety deficiency (Ch. 2, Sec. 2(4)).
• Be ready to produce a document or an object when a court orders it under the Code of Judicial Procedure; failing to do so presumes the product has a safety deficiency (Ch. 2, Sec. 4(1)).
• If you manufacture outside the European Economic Area, your importer, your representative or, where there is neither, your provider of distribution services answers for the product (Ch. 3, Sec. 1(3) and (4)).
• If you substantially change a product outside its manufacturer's control and then supply it, you answer as its manufacturer (Ch. 3, Sec. 4).
• If you distribute a product, or provide an online platform that lets a consumer conclude a distance contract with a trader, refer the injured person to the liable person established in the European Economic Area or to your own supplier within one month, or you answer for the product (Ch. 3, Secs. 2 and 3).
• Be able to show that you did not put the product on the market, that the deficiency probably did not exist then, that it results from compliance with product safety rules, or that scientific and technical knowledge made it impossible to discover (Ch. 3, Sec. 5).
• Do not rely on a contract term that is worse for the injured person than the Act: it has no effect against that person (Ch. 1, Sec. 5).