AI governance for Finnish public sector organisations

Finland has more public sector AI law than most countries, because it legislated for automated decisions before the EU AI Act arrived. A Finnish authority using AI today works within three layers. The first is national rules on automated decision-making, the second is national guidance on generative AI, and the third is the EU AI Act with its Finnish supervision structure. This guide sets out how the layers fit together and what a public body needs in place.

The first layer, automated decisions

Since 1 May 2023, Chapter 8 b of the Administrative Procedure Act and Chapter 6 a of the Act on Information Management in Public Administration have given Finnish authorities a general legal basis to decide matters automatically. The conditions are strict and procedural. They are covered in full on the framework page.

The short version is that an automated decision must involve no case-by-case judgment, or an official must already have made that judgment, and it must follow documented processing rules drawn from the applicable law. Before deployment the authority documents who is responsible for what, assures quality and makes a formal deployment decision. During use it monitors quality, handles errors and publishes information about the procedure on its website. Every automated decision says it was automated and where the deployment decision can be read, and the person can ask for a free rectification by a human.

These rules were written for rule-based automation such as benefit calculations, registrations and payment arrangements. Kela, the Tax Administration, the Finnish Patent and Registration Office and Traficom all publish deployment decisions for procedures of that kind. A machine learning model that weighs a case on its own does not fit the condition that the decision involves no case-by-case judgment, which is a strong reason to keep AI in a supporting role where discretion is involved.

The second layer, generative AI at work

The Ministry of Finance’s Guidelines on using generative artificial intelligence to support and assist work in public administration, published on 20 March 2025, apply across public administration. Officials remain responsible for every document they draft. GenAI output must be reviewed and approved before it goes into a final document, and non-public information and personal data must not go into a GenAI service the organisation has not approved for it. The closer the work is to decisions on people’s rights, and the more independently the AI acts, the tighter the restrictions.

For a public body, those principles turn into concrete governance work. It needs a list of approved GenAI services and what each is approved for, organisation-specific rules that build on the Ministry’s, and a way to see whether staff are using tools outside that list, including AI note-takers that external participants bring to meetings. An acceptable use policy is the usual home for the rules, and finding shadow AI is how a body checks them.

The third layer, the EU AI Act

Public bodies are deployers under the EU AI Act like anyone else, and some Annex III high-risk categories are mainly public sector uses. They include eligibility for public assistance benefits and services, emergency call triage, education, migration and asylum, law enforcement and the administration of justice. Obligations for those systems apply from 2 December 2027. The prohibited practices and AI literacy duties have applied since February 2025, and the Article 50 transparency duties, such as telling people they are talking to a chatbot, since 2 August 2026.

Finland’s Act on the Supervision of Certain AI Systems decides who supervises a public body’s AI. The Finnish Supervisory Agency covers AI for public benefits and emergency calls. The Data Protection Ombudsman covers prohibited practices, education, employment, law enforcement, migration and justice, and acts as the notified body when law enforcement, migration or asylum authorities plan to use high-risk biometric systems. Traficom supervises transparency duties. Section 24 of the Act means public bodies cannot be fined, but supervision, corrective orders and public scrutiny still apply.

Two AI Act duties fall with particular weight on public bodies. Bodies governed by public law must carry out a fundamental rights impact assessment before first using most Annex III high-risk systems (Article 27), and public authority deployers must register their use of high-risk systems in the EU database (Article 49).

What a Finnish public body needs in place

• One register for both regimes. Record every automated procedure and every AI system, with its owner, whether it decides automatically under Chapter 8 b, and whether it is high-risk under Annex III. The two regimes overlap for AI used in benefit decisions. A system register serves both.
• Deployment decisions and public descriptions. For automated procedures, the documentation, quality assurance record and deployment decision the Information Management Act requires, and the public information on the website.
• Impact assessments. A data protection impact assessment where the GDPR requires one, and from December 2027 a fundamental rights impact assessment for high-risk systems. The impact assessment guide covers both.
• GenAI rules and approved tools. Organisation rules built on the Ministry of Finance’s guidelines, a list of approved services, and controls that keep non-public information out of the rest.
• Monitoring and human review. Quality monitoring of automated procedures and AI systems in use, a working route for people to request human review, and human oversight for high-risk AI.

How Aicura supports the work

Aicura’s register, discovery, assessments, policies, guardrails and monitoring support each item on that list, framed around the system rather than the regime, so one record serves the automated decision rules, the Ministry’s guidelines and the AI Act. It supports the work, and the decisions stay with you.