nyheter

The Nordic Network Is One. Your Response Plan Shouldn’t Stop at the Border.

Dela artikel

Nordic Network

On 26 February 2026, every Nordic state coordinated within hours. The companies that operate the actual infrastructure had to answer a harder question, alone.

On that Thursday, Sweden’s Defence Radio Establishment (FRA) issued a warning to the Nordic energy sector about a concrete threat to infrastructure. Within hours, authorities and police forces across Norway, Sweden, Finland, and Denmark raised preparedness levels in coordination. Svenska Kraftnät increased vigilance at its facilities. Statnett confirmed it was monitoring. Fingrid and Energinet either acknowledged the reports or declined to comment.

The state agencies did their part inside a few hours. They passed the warning. But a warning is not a response. Somebody still had to be ready to send a certified technician, with the right equipment, to the right site, if an incident actually landed. That somebody was not the state. It was the operator.

That split is the story of 2026. It is why the pressure has moved to private companies, whether they were planning for it or not.

Why the pressure is now on operators, not the state

Across all four Nordic countries, the state is doing more, not less. Sweden’s June 2025 eight-party agreement authorises up to 300 billion SEK in defence investment over 2026-2034. Norway’s DSB has been mandated to lead Totalforsvarsåret 2026 with a national exercise programme. Finland and Denmark have transposed NIS2 into binding national law. The state is investing at scale.

None of that reaches the moment when a substation alarms at 2am.

The state builds the infrastructure. The state writes the rules. The state supervises compliance. What the state does not do is mobilise your technician, with your certification, at the site that belongs to your company. That operational moment is yours, and the new rules are explicit about it. Operators are expected to demonstrate, not just describe, how they would respond.

Here is what that looks like in each of the four markets.

What this looks like in each market

Norway: coordinated-event response becomes a legal baseline.

  • The change: NVE’s revised kraftberedskapsforskriften takes effect 1 July 2026. The baseline planning scenario is no longer a single fault. It is a coordinated event affecting at least two installations simultaneously. Operators must demonstrate rapid repair capacity, deployable personnel, and spare parts stockpiles.
  • What it means for you: A response plan sized for the crew a single company can deploy is no longer enough. You need live visibility of your own people, and a way to coordinate with peers, inside the same working day.

Sweden: record state investment, operational load stays with operators.

  • The change: The June 2025 eight-party agreement authorises up to 300 billion SEK in defence investment, with up to 50 billion SEK earmarked for civilian infrastructure. Myndigheten för civilt försvar (which replaced MSB on 1 January 2026) allocated more than 1.5 billion SEK to municipal preparedness in March 2026. The National Strategy for Resilience in Critical Activities 2026-2030 was published 27 February 2026.
  • What it means for you: The state is funding infrastructure, stockpiles, and municipal capacity. What it is not funding is the operational response inside your company. The resilience load that used to be shared with the state now sits with you.

Finland: NIS2 in force, and a shared Nordic alert architecture.

  • The change: Finland transposed NIS2 through the Cybersecurity Act (124/2025), in force from 8 April 2025. Essential entities in energy face risk management and incident reporting duties, supervisory powers held by Traficom and the Energy Authority, and fines up to 10 million euros or 2% of global turnover.
  • What it means for you: During the February 2026 FRA advisory, Finnish and Swedish authorities coordinated inside the same working day. The alert architecture between states is already operating across borders. Your operational response has to match that pace.

Denmark: cyber and physical resilience in a single energy-sector law.

  • The change: Rather than fold energy under the general NIS2 law, the Folketing passed Lov om styrket beredskab i energisektoren, in force 7 March 2025. It implements both NIS2 and the Critical Entities Resilience Directive in one framework, supervised by Energistyrelsen, with national requirements on preparedness plans, physical protection of critical installations, and real-time monitoring.
  • What it means for you: The Danish structure is the clearest signal of where Nordic regulation is heading. Cyber and physical resilience treated as one operational question, supervised against one preparedness record. You will be asked to document how a response was coordinated as it unfolded, not reconstruct it afterwards.

The common operational pattern

Four countries. Four legal instruments. One consistent direction. Across all of them, the operational capability the new rules ask operators to demonstrate is the same.

  • Live availability of field personnel, not roster data
  • Certification and competence visible at the moment of dispatch
  • Incident coordination documented as it happens, not reconstructed afterwards
  • A response picture that works inside your company and alongside peer operators during coordinated events

This is not a compliance checklist. It is an operational capability that pays back in faster response times, better crew utilisation, and a cleaner audit trail the next time a regulator or an insurer asks how a specific decision was made.

How Response was built for this

GSFleet’s Response is a new solution that turns these four expectations into one operational picture inside the dispatch room:

  • Live availability: Field workers update their own status from the field. The control centre sees who is free, now.
  • Certification on the map: Dispatchers filter by competence and proximity in one view. The right person is findable in seconds.
  • Ad-hoc communication groups: Spin up an incident-specific group in a single click. Decisions and confirmations live against the incident, not in private inboxes.
  • Audit trail as a byproduct: Everything a Nordic regulator will increasingly ask for is captured as the incident unfolds, not reconstructed from phone logs.

It works for a crew on your side of the border, and it works when that crew is supporting a peer operator on the other side. See how it works →

Sources