NIS2by country

NIS2 in Finland

Kyberturvallisuuslaki (124/2025)

Law in force since

Law
Kyberturvallisuuslaki
Authority
Traficom Cybersecurity Centre
Classes
keskeinen toimija (essential), muu kuin keskeinen toimija (important)
Register
Traficom NIS2 entity list (e-service)
ISO 27001
Not named in the law

Check your company for Finland

Know when Finland changes its NIS2 rules

  • One email when the law, the deadlines or the portal change.

This site stores your email and emails you when the NIS2 rules in Finland change. Unsubscribe at any time.

The law

The Act took effect on 2025-04-08. It applies to medium-sized and large entities in the NIS2 sectors, and to some entities of any size.

Name
Kyberturvallisuuslaki (124/2025)Cybersecurity Act
Published
2025-04-07
In force
2025-04-08
Text
Read the Kyberturvallisuuslaki

Who is in scope

Annex I and II activities are in scope from 50 staff, or when turnover and balance sheet both pass EUR 10 million. Large Annex I companies are essential. Most others are important.

Where Finland differs

  • Section 3 Kyberturvallisuuslaki The Act does not apply Article 3(4) of the Annex to Recommendation 2003/361/EC. The size test differs from the Directive for entities with public owners.

Also note

  • Traficom supervises digital infrastructure, digital providers and telecom entities. Other sectors have their own supervisors.
  • The Act names other supervisors by sector. The Energy Authority supervises the energy sector.
  • The Traficom CSIRT unit runs inside Traficom and works separately from supervision.

Registration

Register with your supervisor within 1 month after the Act applies to you. Entities in scope at the start had to register by 2025-05-08. Report changes to contact data within 2 weeks. A company with several sectors registers with each supervisor.

Portal
Traficom NIS2 entity list (e-service)
Rule
Deadline counts from the day you come into scope
Deadline
2025-05-08
Later entrants
1 month after you come into scope
You need
Suomi.fi identification with the mandate "Kyberturvallisuuteen liittyvien toimijatietojen ilmoittaminen" for the organisation.
Changes
Report changes to your data within 14 days

Incident reporting

  1. 24 hEarly warning
  2. 72 hIncident notification
  3. 1 monthFinal reportafter the follow-up notification

Send the reports to your supervising authority (Traficom for its sectors).

Traficom runs a central NIS2 incident application. The application sends the report to the supervisor and to the CSIRT.

Measures and proof

Essential
Supervision targets essential entities first. The supervisor can order a security audit after a serious incident or a serious breach of the Act.
Important
The supervisor acts on important entities when it has a reasoned suspicion of a breach. The same audit power applies.

The dates, in order

  1. Act in force
  2. Registration deadline for entities in scope at the start
  3. Cybersecurity risk management policy dueDerived from a rule in the law

Duties of management

Management approves the risk management policy and oversees it. Management needs enough knowledge of cybersecurity risk management. The supervisor can ban a person from a management role in an essential entity after repeated serious breaches of these duties.

Fines

The ceiling is the higher of a fixed amount and a share of the worldwide annual turnover of the group.

Fine ceilings, Section 38 Kyberturvallisuuslaki. The higher amount applies. Each "At EUR" figure is the ceiling at that worldwide turnover.
Class Ceiling At EUR 20mAt EUR 500mAt EUR 2bn
Essential EUR 10m or 2% EUR 10mEUR 10mEUR 40m
Important EUR 7m or 1.4% EUR 7mEUR 7mEUR 28m

A fine needs intent or gross negligence. The Act bars fines on state authorities.