Finland

Is there a specific enacted legislation regulating AI in your jurisdiction?

Besides the EU AI Act, there is no specific national regulation of AI in Finland. 

Is there a proposed legislation regulating AI in your jurisdiction?

Yes, the AI Act will be implemented into national law in two stages, correspondingly wit the AI Act's entry into force. In the first stage, the Government will be giving supplementing rules on the supervisory authorities and their powers to impose penalties. The Government will be proposing a new act on the supervision of AI systems, and changes to existing acts on market surveillance of certain products, the Financial Supervisory Authority, the Energy Authority and enforcement of a fine. The Government Proposal will be given on April 2025 and the proposed acts are expected to enter into force on 2 August 2025. 

In the second stage, the Government will be giving supplementing rules on the regulatory sandboxes, establishing a national register for high-risk AI systems related to critical infrastructure and other necessary provisions to implement the AI Act. The proposed acts are expected to enter into force by 2 August 2026 the latest. 

Are there any guidelines/ codes of conduct/ recommendations / reports / policies in connection with AI in your jurisdiction?

There is guidance based on automate decision making which might overlap from the Data Protection Ombudsman. 

The Finnish Financial Supervisory Authority ("FSA") has issued comprehensive guidance on AI use in the financial sector through its thematic assessment report on AI usage. This guidance addresses the regulatory framework under the EU AI Act and provides practical insights for financial institutions. 

Any additional relevant news regarding AI / or anticipated future changes (e.g. white papers, policy statements about AI regulation)?

AI is mentioned multiple times in the Petteri Orpo's Government Programme (in connection with social and health services, education, investments and innovations, automated decisions of authorities), also the Programme highlights the importance of utilising modern technology. The Government Programme further specifically states that the Government will take a proactive role in EU regulation and minimise the need for additional national regulation. 

Finland has also published a new Cyber Security Strategy for 2025-2035, which mentions the risks and possibilities of artificial intelligence.

Many Government and Ministry reports relating to AI have been published, but they are not binding in nature. Most of the reports have also been conducted as reviews of the current situation or possibilities to utilise AI in certain settings, so they do not provide for broader guidance. The same applies to Government and Ministry level development projects that mention AI (projects can be searched on https://valtioneuvosto.fi/en/projects-and-legislation). 

Is AI specifically addressed in IP laws? Are there any guidelines / soft laws relating to AI? 

No. However, the Ministry of Education and Culture currently has a task force related to AI and copyright, which is part of a wider development project for the Copyright Infrastructure on national, EU and global level. It supports industry-specific initiatives to promote the proper functioning of the copyright system in particular to form an open rights data framework ("ORDF") for new technologies. The Finnish project webpage is dedicated for the national level AI- subgroups and on EU-level the Copyright Infrastructure Task Force ("CITF").

Is AI specifically addressed in data protection laws? Are there any guidelines / soft laws relating to AI?

The Finnish Data Protection Ombudsman has published guidelines regarding data protection in the development and use of AI systems.

Who are the competent AI supervisory authorities in your jurisdiction? 

Currently, this is under discussion. The Government is proposing a model where several authorities will be responsible for the supervision of AI on their respective fields. The Finnish Transport and Communications Agency ("Traficom") will act as the single point of contact. A new Sanctions Board that will have powers to impose fines higher than EUR 300 000 will also act in conncection with Traficom. Supervisory authorities listed in the draft proposal include Traficom, the Office of the Data Protection Ombudsman, Finnish Safety and Chemicals Agency ("Tukes"), the Customs, the Medicines Agency ("Fimea"), The Occupational Safety and Health authorities, i.e. the Ministry of Social Affairs and Health and Regional State Administrative Agencies’ Divisions of Occupational Safety and Health, the Centre for Economic Development, Transport and the Environment in North Savo, the Energy Authority, the National Supervisory Authority for Welfare and Health ("Valvira"), the Finnish Financial Supervisory Authority ("FSA") and Parliamentary Trustees nominated by the Parliament (the supervision of Kela's administration and operations).

Are there any publicly known enforcement actions in relation to AI?

N/A

Are there any other sector specific laws or guideline / soft laws (e.g. finance, healthcare etc.) where AI is specifically addressed?

AI is mentioned in some Government and Ministry level decrees, but in these cases it is only mentioned as a noteworthy technology instead of giving specific rules or guidelines on the matter. We are not aware of any relevant sector specific laws or guidelines.

The Finnish Financial Supervisory Authority ("FSA") has issued comprehensive guidance on AI use in the financial sector through its thematic assessment report on AI usage. This guidance addresses the regulatory framework under the EU AI Act and provides practical insights for financial institutions.

The Finnish Tax Administration has addressed AI in the context of research and development tax deductions. The guidance clarifies that developing AI solutions for business use can qualify as research and development activity eligible for tax benefits, provided the development aims at substantially new solutions from the taxpayer's perspective in an example provided in the guidance.

*Information is accurate up to 30 June 2025