Current position
Overview
AI legislation has been enacted.
Key legislation & sources
EU AI Act (Regulation 2024/1689)
Finnish Transport and Communications Agency (Traficom)
EU AI Act National Implementation Tracker
Finnish AI Programme AuroraAI
Council of Europe Framework Convention on AI (CETS 225)
EU AI ACT
The EU AI Act (Regulation 2024/1689) applies directly across all member states. Prohibitions on unacceptable-risk AI systems have been in force since 2 February 2025; GPAI model rules since 2 August 2025. High-risk AI obligations are due from 2 August 2026, subject to the Digital Omnibus proposal which may defer enforcement. For the full implementation timeline, governance structure, and current status, see the European Union overview.
The Ministry of Economic Affairs and Employment (TEM) leads coordination; Traficom has been designated for market surveillance. A public consultation on the national implementation plan was concluded in 2024.
Regulatory developments
Latest updates
Latest event import:
Updates sourced from Digital Policy Alert ↗. The latest available entries for this jurisdiction.
adoption
Governments of United States and Finland signed memorandum of understanding regarding Technology Prosperity Deal
Source: Digital Policy Alert · View update ↗
investigation
Data Protection Ombudsman's Office issued a ruling with penalty of EUR 1.8 million against S-Banken over information security negligence in online banking
Source: Digital Policy Alert · View update ↗
On 8 September 2025, the Data Protection Ombudsman's Office imposed a penalty of EUR 1.8 million against S-Banken over information security negligence in online banking. The negligence stemmed from a programming error in the S-mobil login function, implemented in April 2022, which created a vulnerability allowing login with other customers' codes for over three months until August 2022. The investigation found that S-Banken did not use sufficient safeguards, failed to adequately test the new software before use, and did not react sufficiently to customer reports of login discrepancies. The Data Protection Ombudsman considered these operations a violation of the European Union's General Data Protection Regulation requirements for secure personal data processing.
Showing 2 of 2 available API entries. Dates and summaries are supplied by Digital Policy Alert.