Finland AI Regulation Overview

Overview

Finland's AI regulatory landscape combines European Union harmonized mandates with a national digital strategy emphasizing innovation, human-centric design, and decentralised market surveillance. The primary statutory backbone is established by the Act on the Implementation of the Artificial Intelligence Act (Laki tekoälyasetuksen toimeenpanosta, 2024) and Government Proposal HE 46/2025, which integrate the EU AI Act (Regulation (EU) 2024/1689) into Finnish national law. This statutory framework is complemented by a series of high-level strategic programs, including the Artificial Intelligence Programme (2017), the AI Business Programme (2018–2021), the Artificial Intelligence 4.0 Programme (2020–2022), and sectoral initiatives such as AuroraAI and Hyteairo.

Finland's administrative philosophy prioritizes leveraging existing sectoral regulatory authorities rather than constructing a single standalone inspectorate. The Finnish Transport and Communications Agency (Traficom) serves as the primary Market Surveillance Authority (MSA) and designated central contact point (keskitetty yhteyspiste), coordinating with specialized entities including the Office of the Data Protection Ombudsman (Tietosuojavaltuutettu), the Financial Supervisory Authority (Finanssivalvonta), Energiavirasto, and Turvallisuus- ja kemikaalivirasto (Tukes). This structure maintains alignment between product safety, data privacy, and sectoral governance while fostering innovation through measures such as national regulatory sandboxes and public-private partnerships.

Regulatory Approach

Finland employs a hybrid regulatory approach that integrates binding EU-level horizontal rules with national policy initiatives, soft law guidelines, and decentralised market surveillance. Rather than establishing an isolated AI agency, Finland embeds AI oversight into the broader national market surveillance system under the Market Surveillance Act framework. Binding statutory duties apply across high-risk AI applications, prohibited practices, and general-purpose AI models, while national strategy programs like the AI 4.0 Programme and the earlier national AI strategies use non-binding recommendations, RDI funding priorities, and public procurement signals to drive adoption.

The framework is risk-based, directly adopting the risk tiers of the EU AI Act. Unacceptable-risk AI practices—such as subliminal behavior distortion, social scoring, and unauthorized real-time remote biometric identification in public spaces—are strictly prohibited. High-risk systems in critical infrastructure, education, employment, and law enforcement are subject to conformity assessments, source code inspection powers, and post-market monitoring. To mitigate compliance burdens and support SMEs, the approach explicitly embeds innovation support mechanisms, mandating operational regulatory sandboxes supervised by Traficom and cross-agency coordination groups.

Key AI Legislation

• Act on the Implementation of the Artificial Intelligence Act (Laki tekoälyasetuksen toimeenpanosta, 2024): Enacted to integrate Regulation (EU) 2024/1689 into national law, designating Traficom as the primary Market Surveillance Authority and establishing the framework for regulatory sandboxes, post-market monitoring, and national coordination.
• Government Proposal HE 46/2025 (Hallituksen esitys eduskunnalle EU:n tekoälyasetusta täydentäväksi lainsäädännöksi): Complementary implementing legislation proposing a decentralised market-surveillance model, assigning central contact point duties to Traficom, mapping sectoral mandates, and creating a multi-member Sanctions Board (seuraamusmaksulautakunta).
• Artificial Intelligence 4.0 Programme (2020–2022): National strategic framework focused on accelerating AI adoption in SMEs and manufacturing, advancing Finland's twin transition (digitalization and green transformation), and proposing a permanent high-level roundtable.
• AuroraAI Programme (2019–2023): National public-sector AI program coordinated by the Ministry of Finance to develop a human-centric, life-event-based service network architecture across public administration.
• Hyteairo Programme (2018–2021): Sectoral strategy led by the Ministry of Social Affairs and Health (STM) and THL to promote AI and robotics in healthcare and home care (KATI model) and integrate the Digi-HTA health technology assessment framework.
• AI Business Programme (2018–2021): Business Finland initiative providing funding, Proof-of-Concept grants, and CSC computing resource access to boost commercialization and international scaling of Finnish AI firms.
• Finland's Artificial Intelligence Programme & Work in the Age of AI (2017–2019): Foundational policy strategy setting eight priority actions for national AI readiness, workforce adaptation, lifelong learning, and ethical public deployment.

Governance & Enforcement Bodies

National AI governance in Finland relies on a coordinated multi-agency network led by the Ministry of Economic Affairs and Employment (Työ- ja elinkeinoministeriö - TEM), which acts as the Notifying Authority responsible for conformity assessment procedures. The Finnish Transport and Communications Agency (Traficom) functions as the primary Market Surveillance Authority (MSA) and central contact point (keskitetty yhteyspiste). Traficom coordinates market surveillance, maintains powers to inspect technical documentation and source code of high-risk systems under confidentiality protections, and oversees the national AI regulatory sandbox.

Sectoral enforcement is distributed among existing regulatory authorities. The Office of the Data Protection Ombudsman (Tietosuojavaltuutettu) inspects AI systems that process personal data or impact fundamental rights, particularly under Annex III high-risk use cases. Other mapped sectoral supervisors include the Financial Supervisory Authority (Finanssivalvonta) for financial sector use cases, Energiavirasto for energy critical infrastructure, and Turvallisuus- ja kemikaalivirasto (Tukes) for industrial and water safety. Additionally, Government Proposal HE 46/2025 establishes a multi-member Sanctions Board (seuraamusmaksulautakunta) to decide on higher-value administrative fines.

Penalties & Enforcement

Enforcement of AI statutory obligations is conducted through Finland's market surveillance framework, with sanctions derived from the EU AI Act (Regulation (EU) 2024/1689). Under HE 46/2025 and national implementing provisions, administrative fines (seuraamusmaksut) are categorized by severity. The maximum penalties reach up to €35,000,000 or 7% of total worldwide annual turnover for prohibited AI practices, up to €15,000,000 or 3% for breaches of high-risk AI obligations, and up to €7,500,000 or 1% for supplying incorrect, incomplete, or misleading information to supervisory authorities.

To manage the administration of larger penalties, HE 46/2025 introduces a specialized multi-member Sanctions Board (seuraamusmaksulautakunta) empowered to determine administrative fines exceeding specified statutory thresholds. Authorities can require providers or deployers to bring non-compliant systems into conformity, withdraw them from the market, or execute recalls. Non-compliance with non-binding policy programs (such as the AI Business Programme) carries administrative and contractual remedies, including funding termination, disqualification, or clawback of public grants.

Data Protection Framework

Data protection in Finnish AI governance is governed by the EU General Data Protection Regulation (GDPR) alongside national supplementary legislation, with primary oversight held by the Office of the Data Protection Ombudsman (Tietosuojavaltuutettu). The Act on the Implementation of the Artificial Intelligence Act establishes formal statutory cooperation mechanisms between Traficom and the Data Protection Ombudsman to ensure that AI market surveillance does not conflict with data privacy enforcement. The Data Protection Ombudsman is specifically designated to supervise several sensitive high-risk AI domains listed in Annex III of the EU AI Act.

National AI programs consistently embed data protection impact assessments (DPIAs), privacy-by-design, and minimal data-sharing protocols. For example, the public sector AuroraAI initiative required rigorous privacy impact assessments prior to cross-organizational metadata exchange. Similarly, health-sector applications under the Hyteairo program mandate strict adherence to data protection laws and secondary health data processing rules when deploying AI analytics or conversational triage tools.

Sector-Specific Rules

In the health and social care sector, AI deployment is guided by the Hyteairo program, led by the Ministry of Social Affairs and Health (STM) and the Finnish Institute for Health and Welfare (THL). Hyteairo established the KATI operating model for tech-assisted home living and integrated the Digi-HTA (digital health technology assessment) framework into public procurement to evaluate clinical value, cybersecurity, and data protection before deployment.

In the financial sector, Government Proposal HE 46/2025 provides targeted amendments to the legislation governing the Financial Supervisory Authority (Finanssivalvonta), granting it enhanced information-sharing powers and oversight tools for AI applications within financial institutions. In critical infrastructure, Energiavirasto oversees AI applications in energy systems, while Turvallisuus- ja kemikaalivirasto (Tukes) supervises specific industrial and water safety uses. In the public sector, AI decision-support tools must comply with the Finnish Administrative Procedure Act and the Act on the Openness of Government Activities, maintaining good governance and mandatory citizen notifications when AI is utilized in administrative processes.

International Alignment

Finland's AI legal framework is directly aligned with European Union regulatory initiatives, centered on implementing the EU Artificial Intelligence Act (Regulation (EU) 2024/1689). The national implementation timeline reflects EU transitional milestones, including the prohibition of unacceptable-risk AI by February 2025, designation of national authorities by August 2025, and full application for high-risk AI systems by August 2026. Finland participates in the European Artificial Intelligence Board (EAI Board) and coordinates general-purpose AI oversight with the European AI Office.

Beyond EU legislative alignment, Finland actively incorporates international benchmarks such as OECD principles into its policy frameworks. National strategic initiatives like AI 4.0, AuroraAI, and the Artificial Intelligence Programme emphasize international positioning, international standardization, and cross-border data spaces, aligning Finnish innovation with broader European industrial and twin transition objectives.

Future Developments

The future trajectory of Finnish AI regulation focuses on completing the legislative passage and operationalization of Government Proposal HE 46/2025 ahead of its proposed national entry into force date on 2 August 2025. This includes formalizing sectoral supervisor responsibilities, establishing the multi-member Sanctions Board (seuraamusmaksulautakunta), and embedding amendments across sectoral market surveillance statutes.

Key upcoming statutory milestones include making the national AI regulatory sandbox fully operational by late 2025 and preparing for full enforcement of high-risk AI requirements by 2 August 2026. Pursuant to the Act on the Implementation of the Artificial Intelligence Act, the Ministry of Economic Affairs and Employment will conduct regular reviews of national AI oversight every two years, leading up to a formal national review of the Act by 31 December 2027.

Enforcement Bodies