Finland
EU AI Act implementation, 2026
Finland's Act on the Supervision of Certain AI Systems (1377/2025), signed 22 December 2025 and in force since 1 January 2026, establishes a decentralised model with roughly ten sectoral market surveillance authorities, Traficom as single point of contact and host of a sanctions board, four notifying authorities and national fines mirroring Article 99; the second-phase law on the Traficom-run regulatory sandbox and a high-risk register for critical infrastructure is still pending.
- Implementing law
- EnactedDec 2025
- Penalty regime (Art. 99)
- Adopted
- Regulatory sandbox
- Planned
- Readiness rank
- 2 of 27score 88 / 100
Key findings
- Finland has a fully enacted framework: Act 1377/2025 in force since 1 January 2026 names about ten sectoral market surveillance authorities, four notifying authorities and Traficom as single point of contact.
- National penalties track Article 99 maxima; fines above EUR 100,000 are decided by a sanctions board hosted at Traficom with members from the supervisory authorities.
- The Commission lists Traficom as Finland's single point of contact without a 'pending' flag; the artificialintelligenceact.eu tracker rates Finland 'clear'.
- The Article 57 sandbox is in a Traficom pilot phase (September 2026 to April 2027) with full service announced for 3 May 2027; enactment of the second-phase bill giving it a statutory basis and creating the critical-infrastructure register could not be confirmed.
- Finland has no current standalone national AI strategy document; AI policy is carried by the government programme, the digital compass and sectoral programmes.
National authorities
Liikenne- ja viestintävirasto Traficom (Finnish Transport and Communications Agency)
Single point of contact (Art. 70(2)); market surveillance for Annex I vehicle/aviation-type product rules, road-traffic and critical digital infrastructure (Annex III), and lead supervisor of Article 50 transparency obligations; hosts the sanctions board
finlex.fi (opens in new tab)Turvallisuus- ja kemikaalivirasto Tukes (Finnish Safety and Chemicals Agency)
Market surveillance for machinery, lifts, pressure equipment, ATEX, consumer products (Annex I) and gas/water critical infrastructure (Annex III)
finlex.fi (opens in new tab)Energiavirasto (Energy Authority)
Market surveillance for AI safety components in heating, electricity and gas network operation (Annex III critical infrastructure)
finlex.fi (opens in new tab)Tietosuojavaltuutettu (Data Protection Ombudsman)
Market surveillance for Annex III areas 1, 3, 4, 6-8 (biometrics, education, employment, law enforcement, migration, justice) and area 5(b) outside Finanssivalvonta's remit; also supervises the Article 5 prohibited practices (§ 4)
finlex.fi (opens in new tab)Finanssivalvonta (Financial Supervisory Authority)
Market surveillance for creditworthiness and insurance use cases by supervised financial entities; reporting authority to the ECB
finlex.fi (opens in new tab)Lupa- ja valvontavirasto (Licensing and Supervisory Agency, as occupational safety authority)
Market surveillance for PPE and workplace-equipment product rules (Annex I) and for essential public services and benefits use cases (Annex III area 5)
finlex.fi (opens in new tab)Lääkealan turvallisuus- ja kehittämiskeskus Fimea (Finnish Medicines Agency)
Market surveillance for medical devices and in-vitro diagnostics (Annex I)
finlex.fi (opens in new tab)Tulli (Finnish Customs)
Market surveillance for toy safety at the border (Annex I)
finlex.fi (opens in new tab)Ministry of Economic Affairs and Employment (lead), with Traficom, Fimea and the Ministry of Social Affairs and Health for their product sectors
finlex.fi (opens in new tab)Traficom (Finnish Transport and Communications Agency) – listed by the Commission without reservation
Implementing law, penalties and sandbox
Laki eräiden tekoälyjärjestelmien valvonnasta (1377/2025) – Act on the Supervision of Certain Artificial Intelligence Systems
Dec 2025
finlex.fi (opens in new tab)National rules on penalties under Article 99 have been laid down.
Traficom is running a pilot/development phase of the national AI regulatory sandbox from September 2026 to end-April 2027 (applications via Suomi.fi), with the full service announced for 3 May 2027. The second-phase government proposal amending Act 1377/2025 to give Traficom the sandbox mandate and create a national register of high-risk AI in critical infrastructure was consulted in April-June 2025 and, per FIN-FSA (March 2026), expected in Parliament in August 2026; we could not confirm its enactment.
traficom.fi (opens in new tab)No national AI strategy identified.
Notable developments
-
Government proposal HE 46/2025 submitted to Parliament
The Ministry of Economic Affairs and Employment's first-phase bill (submitted 8 May 2025) proposed a decentralised supervisory model, Traficom as single point of contact and a sanctions board for fines above EUR 100,000 (reduced from EUR 300,000 in the draft); a separate draft on the sandbox and critical-infrastructure register was consulted from 25 April to 2 June 2025 with an intended start of 1 February 2026.
hannessnellman.com (opens in new tab) -
Act 1377/2025 signed and published
Parliament's reply EV 162/2025 on committee report TaVM 18/2025 led to signature on 22 December 2025 and publication in the Statute Book on 29 December 2025; entry into force 1 January 2026, later than the originally intended 2 August 2025.
finlex.fi (opens in new tab) -
Supervisory powers take effect
From 1 January 2026 the designated authorities can investigate, issue binding orders and impose administrative fines up to EUR 35m/7% (prohibited practices), EUR 15m/3% (operator obligations) and EUR 7.5m/1% (misleading information), with the Traficom-hosted sanctions board deciding larger fines.
finlex.fi (opens in new tab) -
Finanssivalvonta briefs supervised entities on AI supervision and 'HE2'
FIN-FSA's supervisory briefing of 5 March 2026 set out its role under Act 1377/2025, noted that the second government proposal ('HE2') on the Traficom-led sandbox was expected in Parliament in August 2026 and that sandbox services would be free for all until end-2026.
finanssivalvonta.fi (opens in new tab) -
Traficom publishes transparency guidance and opens an AI Act service channel
On 20 August 2026 Traficom issued guidance on the Article 50 obligations applying since 2 August 2026, confirmed it is the main supervisor of transparency duties, and opened a customer-service form for questions and reports of deficiencies, prioritising guidance over sanctions.
traficom.fi (opens in new tab)
Analysis
Finland chose the most decentralised design in this group and wrote it into law in detail. Rather than a single AI regulator, Act 1377/2025 maps each Annex I product regime and each Annex III use case to an existing authority, from Tukes for machinery to the Data Protection Ombudsman for biometrics, education, employment and migration systems, and Finanssivalvonta for credit scoring and insurance. Traficom's coordinating role, the shared sanctions board and the ministry-level notifying authorities keep the system coherent. The result scores highly on completeness even though the law arrived five months after the EU deadline.
The enforcement posture in 2026 is deliberately soft. Traficom's August guidance stresses case-by-case assessment of Article 50 breaches and giving operators the chance to fix practices before fines; the sanctions board threshold means only serious cases escalate. Public-sector automated decision-making remains constrained by national administrative law, a point the Chancellor of Justice raised during the bill's passage.
The unfinished piece is phase two. The sandbox and critical-infrastructure register were split off into a separate amendment to keep the main act on schedule; the draft was consulted in 2025 with an intended start of 1 February 2026 that slipped, and the Digital Omnibus has since moved the EU sandbox deadline to 2 August 2027. Traficom nevertheless opened a pilot sandbox in September 2026 with full service promised for May 2027, so Finnish start-ups can already apply, while the statutory basis and the register were still unconfirmed in October 2026.
EU AI Act 2026 Q3 Report
All 27 member-state profiles including Finland, the readiness ranking, the Omnibus timeline and every source, as one print-ready PDF.
Sources
- Liikenne- ja viestintävirasto Traficom (Finnish Transport and Communications Agency) (opens in new tab) finlex.fi
- Regulatory sandbox (opens in new tab) traficom.fi
- Government proposal HE 46/2025 submitted to Parliament (opens in new tab) hannessnellman.com
- Act 1377/2025 signed and published (opens in new tab) finlex.fi
- Finanssivalvonta briefs supervised entities on AI supervision and 'HE2' (opens in new tab) finanssivalvonta.fi
- Traficom publishes transparency guidance and opens an AI Act service channel (opens in new tab) traficom.fi