Rehearsing a scenario before it happens

Preparedness is tested by rehearsing it, and a rehearsal requires material showing where people, buildings and dependencies actually are. That material exists today for every Swedish municipality, and it needs neither construction nor procurement.

What applies since this summer. A new Swedish law on shelters and protected spaces entered into force on 1 June 2026. It changes obligations primarily for municipalities and property owners, and it introduces a system for protected spaces alongside the shelters. The Swedish Civil Defence Agency has been tasked by the government with measures that strengthen the protection of the civilian population, with shelters as the focus. (Government press releases, February and July 2026, retrieved 24 August 2026.)

What is already known about the stock. Sweden has approximately 64,000 shelters with room for around seven million people, and they are to be made ready within 48 hours at heightened alert. The shelter map is public and updated daily. These figures come from the authority's own pages, retrieved 24 August 2026.

What is established. In July 2026 three people were killed at a petrol station in Zaporizhzhia when a drone struck. Experts, the military and police investigators agree that the drone was controlled by an experimental AI system: human pilots brought it to an area, after which the system selected the target itself. The account comes from The New York Times, reproduced by Omni on 24 August 2026. The head of air defence in Zaporizhzhia, Colonel Serhij Minajev, describes weapons controlled entirely by AI as a threat to the whole world.

The difference lies in where target selection happens. A remotely piloted system requires a person at the moment of effect, and that person is a bottleneck that can be jammed, disrupted and exhausted. A system that selects its own target inside an area needs no link at that moment. For the receiving side the consequence is a shorter warning time, and a number of simultaneous events that can rise without the opposing organisation growing.

The raw material exists. The operating picture does not. Municipal boundaries exist, facilities have addresses, shelters have coordinates in a public map and the population is counted every year. At the same time the records sit in separate systems, with separate people, in separate departments. Which decisions are to be made, by whom, and which benefit is to be achieved by when, follows from none of them. The distance between holding material and holding an operating picture is the work itself.

What is built is a shared operating picture that updates continuously. It is carried by the municipality itself, and it serves as a working surface for three parties at once: the people who decide, the systems that supply the facts, and the AI support that watches, alerts and proposes. A picture that updates when reality changes is the only material that holds during an event; a picture produced for an audit begins ageing the day it is approved.

Control stays with the municipality. The operating picture holds where residents are, which operations are sensitive and where protection is weakest. It belongs under the organisation's own control, with both supplier and components replaceable, and it has to work when the link to an external service is broken.

The order is roles and decisions first, data last. A scenario exercise starts from which decision is to be made, by whom, within what time, and what follows if the decision is not made. Only then is it useful to ask which fact is required to make it. The reverse order — collect everything first and hope the decision emerges — is the most common reason preparedness work stops inside a document.

Five questions that carry a first exercise. Where do the people with the longest distance to a shelter live, and how far is it? Which operations must continue when power is out for twelve hours, and who decides the priority? Who alerts the care homes where staff cannot leave their residents? How does a message reach those without domestic mobile coverage or without Swedish as a first language? And who takes over when the person who normally decides cannot be reached?

Every question has an address. That is why the work belongs on a map rather than in minutes of a meeting. A plan stating that prioritisation is made by the crisis management group describes an order of business. A map showing which four care homes lack backup power, who is named for each, and when that was last confirmed, can be rehearsed against.

The link to IT governance is direct. The same node carries several requirements at once: board-level accountability under the cybersecurity act since 15 January 2026, continuity requirements in the operation itself, and now the duties in the shelter legislation. A requirement without a named node can be described. A requirement with a node, an owner and a status can be followed up, rehearsed against, and presented at supervision.

The benefit belongs in the same sentence as the requirement. A budget defended with a threat description is a hard sell. The same budget defended by naming which four care homes lose alarm reception, and how long it takes before anyone notices, is a short meeting. The principle is the same one that governs all IT governance: the requirement is attached to the benefit, and the benefit is expressed in the operation's own terms.

The technical part is the easy part now. Open data, maps, geocoding and loss-of-service simulation cost a fraction of what they did five years ago and require no platform of your own to begin. What decides the outcome is whether the organisation has settled which decision it is rehearsing.

You are already there, and that applies to the raw material. A municipality that can point out its care homes, its water works and its server halls has everything required for a first exercise in an afternoon. What is built after that afternoon is the shared picture: the same one for every role, updated continuously, and in the municipality's own hands. The training programme of that name sets out how the work is arranged, and the fifty benefits list what it returns beyond the exercise.

Training: winniio.io/utbildning. Benefits: winniio.io/nyttor. Papers on the regulations: winniio.io/whitepapers.

Denna text finns på svenska: [Att repetera ett scenario innan det inträffar](/insights/att-repetera-ett-scenario-innan-det-intraffar).