Executive Summary
The global market for GRC solutions (Governance, Risk & Compliance) is in a strong growth phase driven by increasing regulatory requirements such as NIS2, DORA, AI Act and GDPR. Independent analyst firms project the market will reach $75 billion by 2028 with an annual growth rate of approximately 14%.
In the Nordics, additional growth opportunities are created by the implementation of the EU's NIS2 directive, which in Sweden comes into force through the Cybersecurity Act on January 15, 2026. Over 160,000 organizations in the EU are covered by the new requirements, including thousands in Sweden.
Market Data – Verification
Global GRC Market 2028: $75 billion
Fortune Business Insights published this forecast in 2022, projecting the market to grow from $27 billion (2020) to $75.24 billion (2028). Later analyses from Grand View Research (2024) show a somewhat higher projection of $134.96 billion by 2030, indicating the market is growing faster than previously expected.
Annual Growth (CAGR): 14%
The claim of 14% compound annual growth rate (CAGR) is supported by Fortune Business Insights and Technavio, which reports 14.2% CAGR for GRC platforms specifically (2025-2029). MarketsandMarkets reports 14.2% CAGR from 2025-2030.
Organizations in EU covered by NIS2: 160,000+
The claim of 160,000+ organizations in the EU is well documented in multiple sources. These organizations are classified as either "essential entities" (with at least 50 employees or €10M turnover) or "important entities" within defined sectors.
NIS2 Implementation in Sweden
Implementation Date: January 15, 2026
The Swedish Cybersecurity Act (2025:1506) and the Cybersecurity Ordinance (2025:1507) came into force on January 15, 2026. This means the NIS2 directive is now implemented in Swedish law, and all affected organizations must register with relevant authorities and begin meeting the requirements.
Market Dynamics
Demand Drivers
According to research, GRC demand is driven by:
- Increasing regulatory compliance requirements (GDPR, NIS2, DORA, CSRD)
- Digitalization of compliance processes
- Increased focus on cybersecurity and data protection
- Need for automation to handle manual workload
Nordic Cybersecurity Market
The Nordic cybersecurity market shows strong growth with Norway leading (10.1% CAGR). Denmark has earmarked €100 million for cyber resilience and Finland offers vouchers up to €15,000 for SMBs.
Source: Mordor Intelligence [11]
Competitive Landscape
Global Market Players
The GRC market is consolidated with large established players:
Nordic Market
The market for compliance tools is growing rapidly in the Nordics. Michael Rasmussen reported in October 2025 about "12+ active RFPs for third-party risk management solutions (TPRM) in the Nordics" and described the activity as "unprecedented in scope".<sup><a href="#ref-15">[15]</a></sup>
Risk Factors
When assessing the investment opportunity, the following risk factors should be considered:
Strong Competition
Established players like Microsoft, ServiceNow and Oracle have already integrated compliance features into their platforms, giving them competitive advantages in distribution and integration.
Implementation Challenges
A major cause of failed GRC implementations is "lack of ERM competence on the customer side", not the technology. Even user-friendly solutions can be hindered by organizational factors.
Pricing & Positioning
The SME segment is saturated where several startups compete. Differentiation and clear value proposition become critical for success.
Regulatory Uncertainty
Although NIS2 is implemented in Sweden, implementation varies between EU member states, which may complicate a European expansion strategy.
Conclusions
Verified Claims
- GRC market size ($75B 2028) – confirmed by Fortune Business Insights
- Growth rate (14% CAGR) – confirmed by multiple analyst firms
- NIS2 impact (160,000+ organizations) – confirmed by EU Commission
- Implementation date in Sweden (January 15, 2026) – confirmed by Swedish authorities
Sources
All sources are from established market research firms, official EU publications and recognized industry experts. Links lead to original reports and articles.
- (2022) "Enterprise Governance, Risk, and Compliance (eGRC) Market" globenewswire.com
- (2024) "Governance, Risk and Compliance (GRC) Platform Market" prnewswire.com
- (2024) "Enterprise Governance, Risk And Compliance Market" grandviewresearch.com
- (2024) "Enterprise GRC Market" marketsandmarkets.com
- (2024) "NIS2 Directive" digital-strategy.ec.europa.eu
- (2024) "What is the size threshold for NIS2?" opsiocloud.com
- (2024) "NIS2 - Who is affected?" advisense.com
- (2026) "New Cybersecurity Act enters into force in Sweden" energimyndigheten.se
- (2026) "New Cybersecurity Act - NIS2 implementation" lindahl.se
- (2026) "The new Cybersecurity Act comes into force" mannheimerswartling.se
- (2025) "Nordics Cybersecurity Market" mordorintelligence.com
- (2025) "GRC Market Update - Inside the Nordic Surge" linkedin.com