Skip to main content

    AI by country · Northern Europe

    AI in Finland: the rules, the readiness and where to start

    Last checked: 29 October 2026

    What should a company in Finland know before starting with AI?

    Finland is one of the first EU countries with a law that names who enforces the EU AI Act: Act 1377/2025, in force since 1 January 2026. Personal data in AI falls under the GDPR and the Data Protection Act (1050/2018), and the Data Protection Ombudsman also polices banned AI practices and most high-risk uses. A company should check which authority covers its AI use before it builds.

    At a glance

    Finland at a glance

    Key facts about Finland
    Data protection lawGDPR plus the Data Protection Act (1050/2018), in force since 1 January 2019
    RegulatorData Protection Ombudsman (Tietosuojavaltuutettu); Traficom is the AI Act single point of contact
    AI policyEU AI Act (Regulation (EU) 2024/1689), phased, plus the Act on the Supervision of Certain AI Systems (1377/2025), in force since 1 January 2026
    Time zoneEET, UTC+2 in winter and EEST, UTC+3 in summer (India is 3.5 or 2.5 hours ahead)
    CurrencyEUR (euro)
    Business languageFinnish and Swedish, with English widely used in business

    Why now

    Why Finland is worth watching

    Each point links to the document it comes from.

    • Eurostat reports that 37.82% of Finnish enterprises with 10 or more staff used at least one AI technology in 2025, up from 24.37% in 2024. The EU figure was 19.95%.[7]

    • Finland's Act on the Supervision of Certain AI Systems (1377/2025) was published on 29 December 2025 and came into force on 1 January 2026.[3]

    • On 31 August 2026 the EuroHPC Joint Undertaking signed a EUR 387.8 million contract for the LUMI-AI supercomputer in Kajaani, expected to be available to users in 2027.[6]

    • The EU's Digital Omnibus on AI entered into force on 27 July 2026 and moved high-risk duties for Annex III uses to 2 December 2027.[5]

    The rules

    The rules that matter for AI

    What each law or policy means when you build or buy an AI system.

    General Data Protection Regulation (EU) 2016/679

    In force2016People can object to decisions based solely on automated processing with legal or similarly significant effects, except under listed conditions (Article 22). High-risk processing needs a data protection impact assessment (Article 35). Breaches must be reported within 72 hours where feasible (Article 33), and fines can reach EUR 20 million or 4% of worldwide turnover (Article 83).[1]

    Data Protection Act (Tietosuojalaki, 1050/2018)

    In force2018The Finnish law that completes the GDPR. A child must be at least 13 to consent to online services (section 5). GDPR fines are set by a sanctions board of the Ombudsman and deputy ombudsmen, and cannot be imposed on state or municipal authorities (section 24).[2]

    Act on the Supervision of Certain AI Systems (Laki eräiden tekoälyjärjestelmien valvonnasta, 1377/2025)

    In force2025The Data Protection Ombudsman supervises banned AI practices (section 4) and most Annex III high-risk uses, including hiring and education. Traficom supervises the Article 50 transparency duties (section 5) and is the single point of contact (section 6). The Financial Supervisory Authority covers life and health insurance pricing and credit scoring by supervised firms.[3]

    EU Artificial Intelligence Act, Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744

    Phased2024Bans and AI literacy apply from 2 February 2025, general-purpose AI rules from 2 August 2025, and most other rules from 2 August 2026. High-risk duties apply from 2 December 2027 (Annex III) and 2 August 2028 (AI in regulated products). Fines for banned practices can reach EUR 35 million or 7% of worldwide turnover.[4]

    Where AI fits first

    Where AI fits first

    Insurance and banking

    Claims triage, document reading and customer service in Finnish, Swedish and English.

    Under Act 1377/2025 the Financial Supervisory Authority supervises AI used for life and health insurance pricing, and credit scoring by the firms it supervises.[3]

    Recruitment and HR

    Screening applications and scheduling interviews, with a person deciding.

    The Data Protection Ombudsman is the market surveillance authority for Annex III employment uses. High-risk duties apply from 2 December 2027.[3]

    Manufacturing and machinery

    Visual inspection, predictive maintenance and safety monitoring in factories.

    For AI in regulated products, Act 1377/2025 splits supervision among authorities such as Tukes, Traficom and the occupational safety authority. These duties apply from 2 August 2028.[3]

    Public services

    Drafting decisions and answering citizen questions, with officials signing off.

    AI used to assess eligibility for public benefits is an Annex III use supervised by the Permit and Supervision Agency under Act 1377/2025. GDPR fines cannot be imposed on Finnish public authorities.[3]

    Your first steps

    Your first steps

    1. List each AI system you build or use and find its supervising authority in sections 3 to 5 of Act 1377/2025.
    2. Train staff on the AI tools they use, since the AI literacy duty has applied since 2 February 2025.
    3. Check that your chatbots and AI-generated content meet the transparency rules that Traficom supervises.
    4. Run a data protection impact assessment before using personal data to train or run AI, and keep a person reviewing significant decisions.
    5. If you are a bank or insurer, map AI used in pricing or credit scoring for the Financial Supervisory Authority.
    6. Check where your AI vendor processes data and use a GDPR transfer mechanism for countries without an adequacy decision.
    7. Plan high-risk compliance work for 2 December 2027, and for 2 August 2028 if your AI sits in a regulated product.

    AI services for Finland

    AI consulting and development for teams in Finland

    We work remotely with companies in Finland, in your time zone, and keep your data under the rules described above.

    AI agents and automation

    Agents that finish multi-step work across your tools, with people approving what matters.
    Learn more

    Document Q&A (RAG)

    Answers from your own documents, with the source shown for every answer.
    Learn more

    AI governance and data protection

    Policies, review steps and audit trails that fit your local data law.
    Learn more

    Software and cloud engineering

    Web apps, integrations and cloud platforms built around your AI use case.
    Learn more

    How we work with you

    How we work with you

    We work remotely with clients worldwide, in the client's time zone. India (UTC+5:30) is 3.5 hours ahead of Finland in winter (UTC+2) and 2.5 hours ahead in summer (UTC+3). Taking a 9:00 to 17:00 day in Finland and 9:30 to 18:30 in India, the overlap is about 6 hours in winter (09:00 to 15:00 Finnish time) and 7 hours in summer (09:00 to 16:00). India has no EU adequacy decision, so any personal data we handle needs a GDPR transfer mechanism such as standard contractual clauses.

    Questions

    Common questions about AI in Finland

    Does Finland have its own AI law?

    Finland has a supervision law, Act 1377/2025, in force since 1 January 2026. Its main job is to name the authorities that enforce the EU AI Act and to set up a board for AI penalty payments. The duties on companies come from the AI Act itself.

    Who do I talk to about AI rules in Finland?

    Traficom is the single point of contact under section 6 of Act 1377/2025. For personal data, and for banned practices and most high-risk uses, the Data Protection Ombudsman is responsible.

    When do high-risk rules start?

    After the Digital Omnibus on AI, high-risk duties for Annex III uses such as hiring, education and credit apply from 2 December 2027. For AI built into products covered by EU product law, they apply from 2 August 2028.

    Can the Data Protection Ombudsman fine my company?

    Yes. GDPR fines are decided by a sanctions board made up of the Ombudsman and deputy ombudsmen, and can reach EUR 20 million or 4% of worldwide turnover. State and municipal authorities cannot be fined under section 24 of the Data Protection Act.

    Complimentary tools

    Try these first

    Three complimentary tools from our AI Toolkit that suit a team starting out.

    AI readiness score

    Answer a few questions and see where your team stands, in about five minutes.
    Open the tool

    AI use case triage

    Test an idea against data, risk and effort before you spend on it.
    Open the tool

    AI project cost estimator

    Get a rough build and run cost range for a first AI project.
    Open the tool

    Read next

    Sources

    Sources

    Facts checked on 29 October 2026. Numbers in square brackets above match this list.
    1. [1] Publications Office of the European Union, 2016-04-27. Regulation (EU) 2016/679 (General Data Protection Regulation), Official…(publications.europa.eu)
      Full title and what we used it for

      Regulation (EU) 2016/679 (General Data Protection Regulation), Official Journal L 119, 4.5.2016. Primary. Official Journal text. Used for Articles 22, 33, 35 and 83.

    2. [2] Finlex (Ministry of Justice, Finland), 2018-12-05. Tietosuojalaki 1050/2018, consolidated text (open data)(opendata.finlex.fi)
      Full title and what we used it for

      Tietosuojalaki 1050/2018, consolidated text (open data). Primary. Used for sections 5, 8, 24 and 37 (entry into force on 1 January 2019). The Finlex page for the act is https://finlex.fi/en/legislation/collection/2018/1050.

    3. [3] Finlex (Suomen säädöskokoelma), 2025-12-29. Laki eräiden tekoälyjärjestelmien valvonnasta 1377/2025(finlex.fi)
      Full title and what we used it for

      Laki eräiden tekoälyjärjestelmien valvonnasta 1377/2025. Primary. Statute Book text. Used for sections 3 to 6 (authorities), the sanctions board and section 29 (in force 1 January 2026). Our reading of the Finnish text is our own translation.

    4. [4] European Commission, AI Act Service Desk, 2026-10-29. AI Act, Article 113 (Entry into force and application)(ai-act-service-desk.ec.europa.eu)
      Full title and what we used it for

      AI Act, Article 113 (Entry into force and application). Primary text as consolidated after the Digital Omnibus on AI. Used for the application dates. Article 99 (https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-99) was used for fines and Annex III (https://ai-act-service-desk.ec.europa.eu/en/ai-act/annex-3) for high-risk areas.

    5. [5] European Commission, 2026-10-19. AI Act: regulatory framework for AI(digital-strategy.ec.europa.eu)
      Full title and what we used it for

      AI Act: regulatory framework for AI. Primary. Used for the timeline and the Digital Omnibus on AI (Regulation (EU) 2026/1744 of 8 July 2026) entering into force on 27 July 2026.

    6. [6] EuroHPC Joint Undertaking, 2026-08-31. EuroHPC JU signs contract to deploy LUMI-AI supercomputer(eurohpc-ju.europa.eu)
      Full title and what we used it for

      EuroHPC JU signs contract to deploy LUMI-AI supercomputer. Primary. Used for the contract value, location and expected availability in 2027.

    7. [7] Eurostat, 2026-06-15. Artificial intelligence by size class of enterprise (isoc_eb_ai)(ec.europa.eu)
      Full title and what we used it for

      Artificial intelligence by size class of enterprise (isoc_eb_ai). Primary statistics. Enterprises with 10 or more staff, excluding the financial sector, using at least one AI technology.

    8. [8] European Commission, 2026-10-29. Adequacy decisions(commission.europa.eu)
      Full title and what we used it for

      Adequacy decisions. Primary. Used to confirm that India has no EU adequacy decision.

    This is general information, not legal advice. The AI Act dates changed in 2026, and our reading of Finnish statutes is our own translation. Check with a qualified Finnish lawyer before you act. Facts checked on 29 October 2026.

    Other country guides

    Starting with AI in Finland?

    Talk to an engineer. The first call is free, and we start with a readiness assessment before any budget is committed.

    Talk to our team Get your AI score