Automated decision-making in Finnish public administration

What it is

Finland gave its public administration a general legal framework for automated decision-making in 2023. Two acts, signed on 23 March 2023 and in force since 1 May 2023, did it together.

• Act 487/2023 added Chapter 8 b, “Deciding a matter automatically”, to the Administrative Procedure Act (hallintolaki, 434/2003). It sets the conditions under which an authority may decide a matter automatically and what the person must be told.
• Act 488/2023 added Chapter 6 a, on deploying and using automated decision procedures, to the Act on Information Management in Public Administration (tiedonhallintalaki, 906/2019). It sets what the authority must document, check and publish.

Chapter 8 b covers decisions that conclude the handling of a matter and are made by automatic data processing without a natural person reviewing and approving them. It applies on top of any other law that already governs the matter.

What it requires

When automation is allowed (section 53 e). An authority may decide automatically a matter that involves no circumstances requiring case-by-case judgment, or where an official or other handler has already assessed those circumstances. The decision must be based on processing rules drawn up from the applicable law and from judgment exercised in advance. A request for rectification, or a comparable remedy, can never be decided automatically.

A human review route (section 53 f). Automated decision-making is allowed only if the natural person the decision concerns can request rectification of every part of it free of charge, under Chapter 7 a of the Act, from the deciding authority or an authority under the same data controller. This does not apply where the automated decision grants a party’s claim that does not concern any other party.

Telling the person (section 53 g). The decision must state that the matter was decided automatically, and where the deployment decision under section 28 d of the Information Management Act is available. Where no formal administrative decision is given, that information and the information the automated decision was based on must be given to the person in some other way, at the latest when processing ends. The usual requirement to name the person who gives further information does not apply.

Before and during use (Information Management Act, Chapter 6 a). The authority must document the division of tasks and the processing rules (section 28 a), assure quality before deployment and when the procedure changes (section 28 b), monitor quality and handle errors during use (section 28 c), make a formal decision to deploy the procedure (section 28 d), publish information about the procedure on its website (section 28 e), and observe rules on the use of data (section 28 f). Section 28 g extends official liability to public sector employees involved.

Who it applies to

The rules apply to Finnish authorities and to other bodies that perform public administrative tasks under the Administrative Procedure Act. In practice they shape automated decisions by agencies such as Kela, the Tax Administration, the Finnish Patent and Registration Office and Traficom, which publish their deployment decisions and describe their automated procedures on their websites.

Suppliers building or running decision systems for Finnish public bodies work inside these rules too. The authority remains responsible, but it needs its supplier’s help to document processing rules, assure quality and monitor results.

Key dates

• 23 March 2023. Acts 487/2023 and 488/2023 signed.
• 1 May 2023. Both acts enter into force.
• 31 October 2024. End of the 18-month transition, by which automated procedures already in use had to meet the review, notification and documentation requirements.

How it relates to other frameworks

These provisions sit alongside GDPR Article 22, which covers solely automated decisions with legal or similarly significant effects. The Finnish rules are narrower in method, built for rule-based decisions without discretion, and add administrative law duties of documentation, quality monitoring and publication that the GDPR does not.

Where an authority uses an AI system to decide eligibility for public benefits or services, the EU AI Act may also treat it as high-risk under Annex III, with obligations from 2 December 2027. Finland’s AI Act supervision law gives that supervision to the Finnish Supervisory Agency, or to the Financial Supervisory Authority for unemployment funds, insurers and pension institutions. For generative AI used to help officials draft and prepare matters, the Ministry of Finance’s guidelines apply.

A note on this page

This is Aicura’s reading of Chapter 8 b of the Administrative Procedure Act and Chapter 6 a of the Act on Information Management in Public Administration. It is not legal advice and it is not the legislation itself. Read the primary sources on Finlex and take advice on how they apply to your organisation.