The EU AI Act in Finland

Per Finland - AI Regulation Implementation (HE 46/2025)

• Liikenne- ja viestintävirasto (Traficom) — Central contact point and sectoral supervisor for transport/telecom safety components; national coordinator for market-surveillance authorities under the AI Act.
• Tietosuojavaltuutetun toimisto (Office of the Data Protection Ombudsman) — Market-surveillance authority for specified Annex III domains (biometrics; education; employment; law enforcement-support; migration and border-control related uses; credit scoring in certain cases).

Per Finland - AI Deployment Strategy

• Ministry of Economic Affairs and Employment (TEM) — Lead policy coordinator and publisher of the AI 4.0 programme reports and action plan
• Business Finland — National innovation agency — implementer of funding measures, RDI instruments and pilot programmes
• Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto) — Data protection oversight and guidance for AI data governance and privacy compliance

Per Finland - AI in Health Sector

• Ministry of Social Affairs and Health (STM) — Policy owner and programme sponsor; political stewardship of Hyteairo and coordination across ministries.
• Finnish Institute for Health and Welfare (THL) — Operational coordination, technical expertise, dissemination of guidance and aggregation of lessons learned.

Per Finland - Helsinki - AI Register

• City Executive Office, City of Helsinki — Operator and coordinator of the AI Register; responsible for site maintenance, policy coordination and public contact ([email protected]).
• Office of the Data Protection Ombudsman (Finland) — National authority responsible for data protection supervision and enforcement under GDPR; may investigate data-processing practices of public bodies.

Per Finland - Human-Centric AI Programme

• Ministry of Finance (Valtiovarainministeriö) — Programme owner and national coordinator for AuroraAI
• DigiFinland — Implementation partner coordinating reference implementations and pilots
• Office of the Data Protection Ombudsman (Finland) — Data protection supervisory authority; oversight of GDPR compliance for pilots and deployments

Per Finland - AI Business Programme (2018)

• Business Finland — Programme administrator, funder and operational manager responsible for calls, evaluations, contracting and monitoring.
• Ministry of Economic Affairs and Employment (Finland) — Policy oversight and strategic coordination for national AI programmes; publisher of the final programme report and broader AI strategy documents.

Per Finland - AI Impact on Work (21/2018)

• Ministry of Economic Affairs and Employment (TEM) — Lead author and programme coordinator for Finland’s Artificial Intelligence Programme and publisher of the report
• Finnish Government Publications Repository (Valtioneuvoston julkaisut) — Official publisher and archive for government reports
• Finnish Institute of Occupational Health (Työterveyslaitos) — Practical guidance and occupational research partner for workplace AI impacts and health and safety aspects

Per Finland - National AI Programme

• Ministry of Economic Affairs and Employment — Commissioning ministry and lead coordinator for the Programme and its steering group
• Prime Minister's Office / Government — Strategic oversight and cross-ministerial coordination
• Finnish Centre for Artificial Intelligence (FCAI) — Research coordination and recipient of flagship funding recommended by the Programme
• Data Protection Ombudsman (Office of the Data Protection Ombudsman) — Oversight on personal data protection and advice on privacy considerations for public projects

Per Finland - National AI Strategy (2017)

• Ministry of Economic Affairs and Employment (Finland) — Lead ministry responsible for the AI Programme and publication of the strategy
• Business Finland — Public agency supporting commercialisation, accelerators and funding for AI-related business projects
• Data Protection Ombudsman (Office of the Data Protection Ombudsman, Finland) — Supervises compliance with data protection laws (GDPR) relevant where AI systems process personal data
• Finnish Transport and Communications Agency (Traficom) — Sectoral oversight and guidance for AI in transport and communications where applicable

Per Finland - AI Deployment Strategy

• The AI 4.0 Programme is primarily a strategy and does not impose statutory penalties.
• Non-compliance with programme recommendations may affect eligibility for public funding or participation in public pilots and procurement.
• Sectoral statutory penalties and liabilities continue to apply under existing law (e.g., product safety, data protection).
• Reputational and commercial consequences for organisations that ignore recommended ethical and governance practices.

Per Finland - AI in Health Sector

• Hyteairo itself is a strategic programme and does not impose direct statutory penalties; instead, non‑compliance with binding laws (e.g., GDPR, MDR, national health and patient safety regulations) may trigger enforcement by the competent authorities under those laws.
• Potential penalties for breaches of GDPR (fines and corrective measures) remain applicable to data controllers/processors involved in AiRo projects.
• Medical Devices Regulation non‑compliance (where applicable) can lead to market withdrawal, corrective action and sanctions under EU and national frameworks.
• Professional or administrative sanctions may apply under Finnish healthcare regulations where clinical governance or patient safety requirements are breached.
• Civil and product liability claims remain available to injured parties under Finnish law and EU product liability regimes.

Per Finland - Helsinki - AI Register

• The AI Register is a municipal transparency policy and does not itself prescribe statutory fines; non-compliance is addressed through internal administrative and procurement remedies.
• Failure to observe data protection requirements in systems documented in the register may trigger investigations and sanctions under GDPR enforced by national data-protection authorities. ([eur-lex.europa.eu](https://eur-lex.europa.eu/eli/reg/2016/679/art_26/oj/eng?utm_source=openai))
• Contractual or procurement breaches identified via register documentation may result in supplier-level contractual remedies or procurement sanctions in accordance with City procurement rules.

Per Finland - Human-Centric AI Programme

• No new statutory penalties were established by AuroraAI itself (it is a strategy/programme).
• Existing sanctions under GDPR and Finnish administrative law apply to implementers that breach data protection or legal obligations.
• Non‑compliance with procurement rules or misuse of public funds could trigger administrative or financial consequences under existing public sector oversight regimes.

Per Finland - AI Business Programme (2018)

• Repayment (clawback) of disbursed funds where misuse or material misrepresentation is proven.
• Suspension of payments and project activities pending remediation or audit.
• Termination of funding contract and immediate cessation of programme support.
• Exclusion from future Business Finland funding opportunities for a defined period.
• Administrative audit and potential reporting to other competent authorities if legal breaches (e.g., GDPR violations) are discovered.

Per Finland - AI Impact on Work (21/2018)

• The strategy itself does not establish statutory penalties; it recommends follow-on regulatory review where legal gaps emerge (e.g., data protection or discrimination), which would be enforced under existing legislation.
• Administrative or contractual remedies may apply in later instrument-specific regulations or procurement rules implementing the strategy.
• If subsequent binding measures are developed (e.g., procurement rules), non-compliance would be subject to the penalties specified in those instruments.

Per Finland - National AI Programme

• The Strategy is non-legislative and does not itself prescribe penalties. Existing sectoral laws (data protection, health, safety, procurement) govern enforcement and penalties where applicable.

Per Finland - National AI Strategy (2017)

• The 2017 strategy itself imposes no new statutory penalties — it is a non-binding policy roadmap.
• Enforcement of legal obligations (e.g., GDPR breaches) remains subject to existing regulatory sanctions under Finnish and EU law.
• Potential indirect consequences for non-compliance with programme funding terms (e.g., withdrawal of public funding or contractual remedies).
• Sectoral regulators may apply sector-specific enforcement for breaches of existing sector laws (healthcare, finance, safety).