Detailed overview
Finland is regulated by the EU AI Act. The EU AI Act applies directly in Finland and creates duties for AI providers, deployers, importers, distributors and other operators depending on the AI system's classification. AI systems that are prohibited may not be used. High-risk AI systems may be used only if they meet strict requirements, including risk management, data governance, technical documentation, logging, transparency, human oversight, accuracy, robustness, cybersecurity and conformity assessment.
Finland has adopted national legislation on the powers of authorities supervising the EU AI Act. The Finnish Government announced that the acts regulating the powers of national authorities supervising the AI Act entered into force on 1 January 2026, after presidential approval on 22 December 2025.
Finnish supervision focuses on AI systems and the protection of fundamental rights. Market surveillance authorities monitor product safety and enforce compliance with AI Act provisions. Authorities responsible for fundamental rights supervise whether AI systems covered by the Act negatively affect citizens' rights.
A business operating in Finland must first classify its AI system under the EU AI Act. High-risk AI includes AI used in areas such as employment, education, critical infrastructure, access to essential services, creditworthiness, certain insurance assessments, biometric identification, law enforcement, migration, border control and justice. Providers of high-risk systems must build compliance into the system before market placement or service launch, while deployers must use the system properly, monitor it, maintain human oversight and keep logs where required.
Penalties follow the EU AI Act. Breaches of prohibited AI rules may lead to fines up to EUR 35 million or 7% of worldwide annual turnover. Breaches of many other AI Act obligations may lead to fines up to EUR 15 million or 3% of worldwide annual turnover. Supplying incorrect, incomplete or misleading information to authorities may lead to fines up to EUR 7.5 million or 1% of worldwide annual turnover.
Practical requirements & details
Sourced from Regulation (EU) 2024/1689 (the AI Act) as implemented in Finland through national authority-supervision legislation in force from 1 January 2026.
EU AI Act core duties (in Finland)
- Prohibited AI — may not be placed on the market or used.
- High-risk AI — risk management, data governance, technical documentation, logs, transparency, human oversight, accuracy, robustness, cybersecurity and conformity assessment before market placement.
- Transparency-risk AI — disclosure duties (e.g. chatbots, deepfakes).
- GPAI models — documentation, transparency and copyright policy duties at EU level.
- Deployers must use systems properly, monitor, maintain human oversight and keep logs where required.
Finnish national implementation
- National authority-supervision acts in force from 1 January 2026 (presidential approval 22 December 2025).
- Market-surveillance authorities — product safety and AI Act compliance.
- Fundamental-rights authorities — impact of AI on citizens' rights.
High-risk areas (Finland)
- Employment, education, critical infrastructure, access to essential services, creditworthiness, certain insurance assessments, biometric identification, law enforcement, migration, border control and justice.
Penalties
- EUR 35m / 7% of worldwide annual turnover — prohibited AI.
- EUR 15m / 3% — many other AI Act operator obligations.
- EUR 7.5m / 1% — incorrect, incomplete or misleading information to authorities.
Related entries
See also the European Union entry, which covers the EU AI Act (Regulation (EU) 2024/1689) — the substantive framework that this jurisdiction implements and supervises domestically.