Finland's Act on the Supervision of Certain AI Systems (1377/2025)

What it is

The Act on the Supervision of Certain AI Systems (laki eräiden tekoälyjärjestelmien valvonnasta, 1377/2025) is the Finnish law that supplements the EU AI Act. It was passed on Government proposal HE 46/2025, signed on 22 December 2025, published on 29 December 2025, and has been in force since 1 January 2026.

The EU AI Act applies directly in Finland. What it leaves to each member state is who supervises it, how penalties are imposed and a handful of procedural matters. The Finnish Act fills those in. It applies within the scope of Article 2 of the AI Act, and does not apply to Parliament’s own activities, the Parliamentary Ombudsman or the Chancellor of Justice.

Finland chose a decentralised model. Rather than create a new AI regulator, the Act gives AI Act tasks to authorities that already supervise the sectors where AI is used. Market surveillance procedure and appeals run through the existing Act on the Market Surveillance of Certain Products (1137/2016).

Who supervises what

Prohibited practices. The Data Protection Ombudsman (tietosuojavaltuutettu) is the market surveillance authority for the prohibited AI practices in Article 5 (section 4).

Transparency. Traficom, the Finnish Transport and Communications Agency, supervises the Article 50 transparency obligations (section 5), such as telling people they are dealing with a chatbot and labelling deepfakes. Where the system is high-risk, the authority that supervises that high-risk system also supervises its transparency duties. Traficom published guidance on these duties in August 2026, after they began to apply on 2 August 2026.

High-risk systems listed in Annex III (section 3(2)).

• The Data Protection Ombudsman for biometrics, education, employment, law enforcement, migration and the administration of justice and democratic processes, and for creditworthiness and credit scoring outside the financial supervision perimeter.
• The Financial Supervisory Authority (Finanssivalvonta) for risk assessment and pricing in life and health insurance, for creditworthiness and credit scoring deployed by firms it supervises, and for decisions on public benefits made by unemployment funds, insurance funds, non-life insurers and pension institutions.
• The Finnish Supervisory Agency (Lupa- ja valvontavirasto) for other AI used to decide eligibility for public assistance benefits and services, and for AI that dispatches or prioritises emergency calls.
• The Energy Authority, the Finnish Safety and Chemicals Agency (Tukes) and Traficom for AI used as a safety component in critical infrastructure, divided by energy, gas, water, road traffic and digital infrastructure.

High-risk systems in regulated products (section 3(1)). AI that is, or is a safety component of, a product under the EU legislation in Annex I is supervised by the authority for that product, such as Tukes, Customs, Traficom, the Finnish Supervisory Agency as the occupational safety authority, and Fimea, the Finnish Medicines Agency, for medical devices.

Coordination. Traficom is the single point of contact under Article 70(2) (section 6). It coordinates the authorities, liaises with the EU and other member states, gives expert support to the supervisors and reports to the Commission. The Financial Supervisory Authority reports relevant information to the European Central Bank under Article 74(7) (section 7).

Sanction fees

Fines are imposed by a sanctions board for the supervision of AI systems, set up alongside Traficom (section 13). Its members are officials nominated by Traficom, the Data Protection Ombudsman, the Finnish Supervisory Agency and the other market surveillance authorities. The supervising authority proposes a fee, and the board decides.

The Act lists the specific breaches that can attract a fee, by role. A deployer of a high-risk system can be fined, for example, for failing to monitor its operation, to inform the provider and authority of a risk or a serious incident, to keep automatically generated logs for at least six months, or to inform workers’ representatives and affected workers before using the system on them (section 18). Providers, authorised representatives, importers, distributors and notified bodies have their own lists.

The maximum fees in section 23 mirror the AI Act. They are €35 million or 7% of worldwide annual turnover for prohibited practices, €15 million or 3% for most operator obligations and the transparency duties, and €7.5 million or 1% for supplying incorrect or misleading information. For small and medium-sized enterprises the cap is the lower of the two figures. No fee is imposed for minor breaches or where it would be manifestly unreasonable, none can be imposed more than five years after the breach, and public bodies are excluded (section 24).

What it means for organisations in Finland

The practical question for a Finnish organisation is which of its AI systems fall into which tier, because that decides both the obligations and the supervisor. A system register that records each system’s purpose, whether it is high-risk under Annex III, and whether it faces people directly is the starting point, and the EU AI Act high-risk classification guide covers how to sort them.

The prohibitions and AI literacy duties have applied since February 2025, and the transparency duties since 2 August 2026. Following the EU’s Digital Omnibus on AI, obligations for Annex III high-risk systems apply from 2 December 2027, and for product-embedded high-risk systems from 2 August 2028. Deployer duties under Article 26 are covered in the deployer obligations guide.

How it relates to other frameworks

The Data Protection Ombudsman’s AI Act role sits beside its role under the GDPR, so a high-risk system that uses personal data answers to the same office on both. The GDPR rules on solely automated decisions apply alongside the AI Act. Finnish authorities that decide matters automatically also follow the national rules in the Administrative Procedure Act and the Act on Information Management in Public Administration.

A note on this page

This is Aicura’s reading of Act 1377/2025. It is not legal advice and it is not the Act itself, which is published in Finnish and Swedish on Finlex. Read the primary source and take advice on how it applies to your organisation.