The AI Act and FIN-FSA supervision for Finnish banks, insurers and pension institutions

Finland put the supervision of AI in finance with the authority that already supervises finance. The Act on the Supervision of Certain AI Systems (1377/2025), in force since 1 January 2026, makes the Financial Supervisory Authority (Finanssivalvonta, FIN-FSA) the market surveillance authority for the high-risk AI that Finnish banks, insurers, pension institutions and funds are most likely to run. This guide covers what falls to FIN-FSA, what a deployer has to do, and how to prepare. The full allocation of authorities is on the framework page for the Act.

What FIN-FSA supervises

Section 3 of the Act gives FIN-FSA three areas of Annex III of the EU AI Act.

• Life and health insurance. AI intended for risk assessment and pricing in relation to natural persons for life and health insurance (Annex III point 5(c)), whoever deploys it.
• Credit scoring. AI used to evaluate the creditworthiness of natural persons or establish their credit score (point 5(b)), where the deployer is an entity FIN-FSA supervises, another financial market participant under the Act on the Financial Supervisory Authority, or a foreign supervised entity. Credit scoring by others, such as retailers offering credit, goes to the Data Protection Ombudsman.
• Public benefits. AI used to evaluate eligibility for essential public assistance benefits and services (point 5(a)) when it is used by unemployment funds, insurance funds, non-life insurers or pension institutions. The same use by other bodies goes to the Finnish Supervisory Agency.

FIN-FSA is also the authority that reports relevant AI Act information to the European Central Bank under Article 74(7) (section 7).

Other AI at a financial firm answers to other authorities. The Data Protection Ombudsman supervises the prohibited practices in Article 5 and high-risk AI used in employment, such as CV screening and performance monitoring. Traficom supervises the Article 50 transparency duties for chatbots and generated content.

Where the sector stands

FIN-FSA prepared for the role with a thematic review of AI use, published on 27 June 2025. It surveyed 83 financial sector companies. All the large and medium-sized respondents either already used AI or planned to within two years, and use was highest in banking and insurance. Most AI was in internal processes, with customer-facing use expected to grow. About half had an AI strategy, 63% had ethical standards for AI and 82% had rules for AI use. Respondents named data quality, data protection and a lack of AI expertise as the main risks.

Respondents also reported that high-risk AI systems under the AI Act were already in use in the sector. FIN-FSA held a briefing for supervised entities on the start of AI supervision on 5 March 2026.

What a deployer must do

Most Finnish financial firms deploy high-risk systems built by others. Article 26 of the AI Act sets the deployer’s duties, and section 18 of the Finnish Act lists the breaches the sanctions board can fine. A deployer must make sure the system’s operation is monitored, inform the provider or distributor and the authority if using it as instructed may present a risk, report serious incidents, keep the logs it controls for at least six months, and inform workers’ representatives and affected workers before using a high-risk system on them.

The AI Act adds duties that are not individually listed in section 18 but still apply. A deployer must use the system in line with its instructions, assign human oversight to people with the competence and authority to exercise it, and make sure input data it controls is relevant and representative. Deployers of credit scoring and life and health insurance pricing systems must carry out a fundamental rights impact assessment before first use under Article 27. People subject to a decision based on a high-risk system’s output have a right to an explanation under Article 86.

A firm that substantially modifies a system, or puts its own name on it, becomes a provider, with the full set of provider obligations. That is worth checking for credit and pricing models built in-house on top of a vendor platform.

How to prepare

1. Inventory and classify. List every AI system and model in use, including those inside vendor products, and record its purpose, whether it falls in Annex III point 5, and which Finnish authority supervises it. The high-risk classification guide covers the tests, and a system register holds the result.
2. Get the provider’s paperwork. For each high-risk system, obtain the instructions for use, the EU declaration of conformity and confirmation of registration, and agree how the provider will tell you about changes and incidents. Vendor AI risk management covers the contract terms.
3. Assign oversight and monitoring. Name the people who oversee each system, give them authority to override it, and set up monitoring against the provider’s instructions.
4. Run the impact assessments. Complete a fundamental rights impact assessment for credit scoring and insurance pricing systems before 2 December 2027, building on the data protection impact assessment the GDPR already requires.
5. Set up incident and log handling. Decide how a serious incident is recognised, escalated and reported, and make sure logs are kept for at least six months. The deployer obligations guide covers the detail.

Credit and insurance decisions about people are already subject to GDPR Article 22 where they are solely automated, so much of this work starts now, not in 2027.

How Aicura supports the work

Aicura’s AI register records each system’s purpose, risk tier and owner, and its assessments, oversight assignments, vendor records, monitoring and incident workflow support the deployer duties above. Essentials adds EU AI Act assessments, and Pro adds ISO/IEC 42001 and NIST AI RMF assessments and routes GDPR, NIS2 and AI Act serious-incident notifications. It supports the work, and the decisions stay with you.