Cybersecurity Act

Summary

The act transposes the NIS 2 Directive in Finland. It requires essential and important entities to register, to maintain a documented cybersecurity risk-management procedure and to report significant incidents. The central authority is Traficom, alongside sectoral supervisory authorities.

Information

Jurisdiction

Finland

Issuing body

Eduskunta (Parliament of Finland (Eduskunta))

Type

Law

Available languages

Finnish, Swedish

Topics

• Critical infrastructure
• Governance and coordination
• Incident management / CSIRT
• Incident reporting
• Supply chain

Notes

The central authority is Traficom, alongside sectoral supervisory authorities. Entities had to notify their details within one month of entry into force and draw up their risk-management model within three months. The act has been amended by Acts 369/2025, 494/2025, 698/2025, 997/2025, 441/2026 (linked to the implementation of the CRA, in force from 1 June 2026) and 785/2026, which from 1 January 2027 adds holders of nuclear facility operating licences to Annex I, supervised by the Radiation and Nuclear Safety Authority (STUK).

Eduskunta (Parliament of Finland (Eduskunta)). (2025). Kyberturvallisuuslaki (124/2025). https://www.finlex.fi/fi/lainsaadanto/2025/124

Eduskunta (Parliament of Finland (Eduskunta)). "Kyberturvallisuuslaki." 7 April 2025. https://www.finlex.fi/fi/lainsaadanto/2025/124.

@misc{fi_kyberturvallisuuslaki_124_2025,
  author       = {{Eduskunta (Parliament of Finland (Eduskunta))}},
  title        = {{Kyberturvallisuuslaki}},
  year         = {2025},
  note         = {124/2025},
  url          = {https://www.finlex.fi/fi/lainsaadanto/2025/124},
  urldate      = {2026-10-29}
}