Finland AI Act
Act on the Supervision of Certain AI Systems (Laki eräiden tekoälyjärjestelmien valvonnasta)
Finland's EU AI Act implementation using decentralized supervision model. Traficom serves as single point of contact and coordination authority. Ten market surveillance authorities share enforcement across sectors. New Sanctions Board handles fines over EUR 100,000.
Jurisdiction
Finland
Enacted
Dec 22, 2025
Effective
Jan 1, 2026
Enforcement
Traficom (coordination); Data Protection Ombudsman; Safety and Chemicals Agency; Financial Supervisory Authority; and 7 other sector authorities
Approved December 22, 2025; effective January 1, 2026. Sandbox rules effective February 1, 2026.
FinlexWhy It Matters
Model for decentralized EU AI Act enforcement. Shows how member states can distribute oversight across existing sector regulators rather than creating new AI authority.
Recent Developments
First EU member state to activate full AI Act enforcement powers. Established novel Sanctions Board structure for high-value fines.
At a Glance
Applies to
Harms addressed
Who Must Comply
- AI system providers operating in Finland
- AI system deployers in Finland
- High-risk AI in critical infrastructure and law enforcement
Safety Provisions
- Implements all EU AI Act prohibited practices
- Decentralized supervision across 10 specialized authorities
- Traficom as single point of contact and sandbox operator
- Data Protection Ombudsman monitors prohibited AI systems
- Sanctions Board for administrative fines over EUR 100,000
- Inspection, documentation, and halt-use powers
Compliance & Enforcement
Key Dates
Jan 1, 2026
Main provisions take effect
Feb 1, 2026
AI regulatory sandbox rules effective
Penalties
€35M or 7% revenue (whichever higher)
Primary Source
Finlex
https://www.finlex.fi/en/government-proposals/2025/46
View on map
Finland
Focus Areas
Cite This
APA
Finland. (2025). Act on the Supervision of Certain AI Systems (Laki eräiden tekoälyjärjestelmien valvonnasta).
Related Regulations
Hungary AI Act
Hungary's comprehensive AI law implementing the EU AI Act. Designates the National Media and Infocommunications Authority (NMHH) as the primary supervisory authority, with sectoral regulators for specific domains.
Denmark AI Act
First EU member state to fully implement the EU AI Act. Designates three competent authorities, establishes penalty framework aligned with EU maximums, and grants inspection/enforcement powers. Does not add material requirements beyond EU AI Act.
Norway AI Act
Norway implementing full EU AI Act through EEA Agreement. Most comprehensively regulated non-EU jurisdiction for AI. Also implementing Digital Services Act with some Norwegian additions.
CA AB 2246
Repeals and replaces the California Age-Appropriate Design Code Act. Requires a business providing an online service, product or feature likely to be accessed by children to estimate the age of child users with a reasonable level of certainty or extend child protections to all users, to configure high-privacy defaults, and to take reasonable steps to prevent specified harms including severe psychological harm. Removes the exceptions to the data-collection prohibitions, lets children void contracts entered through manipulative design features, and states that it creates no private right of action.
EU DSA Minors Guidelines
Commission guidelines under DSA Article 28(1) establishing measures for online platforms to protect minors, including age assurance, default privacy settings, anti-addictive design restrictions, recommender system safeguards, and protections against grooming and exploitation.
EU Kids Act (Proposed)
Commission proposal for an EU regulation on minors' online safety that would set a harmonised minimum age of 15 for autonomous accounts on risky social networking and video-sharing services, impose safety-by-design duties on those services, online games, app stores, AI companions and general conversational chatbots, and lay down EU-wide rules for privacy-preserving age assurance. Providers of AI companions and general conversational chatbots would have to avoid designs and behaviours that simulate interpersonal relationships likely to create emotional dependency in minors, disable use of a minor's prior interactions by default, gate access for under-13s behind guardian tools, and test and monitor their systems for risks to minors' health, safety and wellbeing.
Last updated January 23, 2026. Verify against primary sources before relying on this information.