Is NIS2 in force in Finland?

Yes. Kyberturvallisuuslaki 124/2025 was published on 7 April 2025 and has applied since 8 April 2025 (§ 47(1)). Entities had to notify their information for the register within one month of the entry into force or of meeting the criteria (§ 47(2)), and to draw up their risk-management model within three months of the entry into force (§ 47(3)). The European Commission's infringement case INFR(2024)0272 was still open on 28 October 2026.

When does the incident clock start in Finland?

At detection. The first notice is due within 24 hours and the follow-up notice within 72 hours of the detection of the significant incident ('havaitsemisesta', § 11(2)), where the directive's Finnish text counts from becoming aware ('kun ne ovat tulleet tietoisiksi'); the Polish and Slovenian acts depart in the same way. A trust service provider files its follow-up notice within 24 hours of detection (§ 11(6)). Reglyze counts the Finnish deadlines from the detection time recorded on the incident, so none falls after the law's.

Who receives a Finnish entity's incident notification?

The supervising authority of its sector (§ 11(1)): Traficom for the annex points of § 26(1)(1), otherwise Energiavirasto, Tukes, Lupa- ja valvontavirasto, Elinvoimakeskus, Ruokavirasto or Fimea (§ 26(1)). The authority forwards every notification and report to the CSIRT within Traficom at once (§ 17(1), § 19(1)), so the entity does not notify the CSIRT itself. The act sets no channel, and the authorities' technical rules on the form and content of notifications (§ 11(5)) are not on Reglyze's record, so this page names no portal.

Does Finnish law use the important entity class?

Not by that name. The act names one class, the essential entity (keskeinen toimija), on which supervision is focused (§ 27(1)); every other entity in scope is an entity other than essential (muu kuin keskeinen toimija). Each entity states in its register notification whether it is an essential entity (§ 41(2)).

Must the management of a Finnish entity follow cybersecurity training?

The act words it differently from the directive: the management (the board, the supervisory board and the managing director, § 10(2)) must have sufficient familiarity with cybersecurity risk management (§ 10(1)); the act words no duty to follow training, as Article 20(2) of the directive does. Training is a way to reach that familiarity.

← Back to Reglyze

Transposed & Enforced

NIS2 in Finland

Everything you need to know about the NIS2 directive in Suomi: transposition law, competent authority, incident reporting, deadlines, and how Reglyze helps SMEs become compliant.

Finland transposed NIS2 with a new Cybersecurity Act, Kyberturvallisuuslaki 124/2025, in force since 8 April 2025. Supervision is split by sector among Traficom and six other authorities, and an entity notifies a significant incident to its own supervising authority, which forwards it to the CSIRT within Traficom. The decisive national difference is the clock: the 24-hour first notice and the 72-hour follow-up notice run from the detection of the significant incident, not from becoming aware of it.

Key facts at a glance

Transposition Law

Kyberturvallisuuslaki 124/2025, the Cybersecurity Act (in Swedish, Cybersäkerhetslag)

In force since: 2025-04-08

Competent Authority

Liikenne- ja viestintävirasto (Traficom), whose Kyberturvallisuuskeskus is the single point of contact and within which the CSIRT operates, and the other supervising authorities of § 26 (Traficom and the sector supervising authorities)

https://www.finlex.fi/fi/lainsaadanto/saadoskokoelma/2025/124

Start now in Finland: nothing to redo later

Reglyze runs your Finland NIS2 compliance on the EU baseline today: scoping, the AI-guided assessment, AI-drafted documents and incident notification to the supervising authority of the entity's sector, which forwards every notification at once to the CSIRT within Traficom.

Your national rules (Kyberturvallisuuslaki 124/2025, the Cybersecurity Act (in Swedish, Cybersäkerhetslag)) layer national specifics on top of NIS2. When they apply to you, what you have built carries straight over: your scores, your documents and your evidence are kept, not reset. You simply add the national layer (registration with the supervising authority of your sector and local incident notification) onto your existing work. You never start from scratch.

Priority sectors for NIS2 in Finland

NIS2 covers 18 sectors across Annex I (highly critical) and Annex II (other critical); the class depends on the annex and the size together, and an Annex II entity is never essential by its size alone. These are the sectors where Finland's transposition and Traficom and the sector supervising authorities supervision focus most.

Electronic communications, trust services, DNS and TLD

Electronic communications providers, trust service providers, TLD registries and DNS service providers are in scope at any size (§ 3(2)); qualified trust service providers, TLD registries and DNS service providers are essential entities whatever their size, and medium-sized electronic communications providers are essential too (§ 27(2)). A trust service provider files its follow-up notice within 24 hours of detecting a significant incident (§ 11(6)), and every entity notifies its supervising authority, which forwards to the CSIRT within Traficom (§ 17(1)).

Municipalities and occasional activities

A municipality within the meaning of the Local Government Act (410/2015) is in scope only for the Annex I or II activities it carries out, and insofar as it is a critical entity (§ 4(6)), not for its whole administration. More generally, an entity whose Annex I or II activity is occasional and minor is outside the act (§ 4(5)), a departure from the directive's lists.

Critical entities

Entities identified as critical entities are in scope at any size (§ 3(2)) and are essential entities (§ 27(2)); Act 369/2025 amended the Cybersecurity Act for them from 1 July 2025. As essential entities they are the focus of supervision (§ 27(1)), and their supervising authority can ban a person for a fixed period from sitting on the board of an essential entity (§ 32), never in public administration.

Key deadlines

2025-04-07

Kyberturvallisuuslaki 124/2025, signed on 4 April 2025, was published in the Suomen säädöskokoelma, with companion acts 125 to 140/2025 amending the sector acts.

2025-04-08

The act entered into force (§ 47(1)).

In force + 1 month

Entities had to notify their information for the register within one month of the act's entry into force; an entity that meets the § 3 criteria later notifies within one month of meeting them (§ 47(2)).

In force + 3 months

The risk-management model (riskienhallinnan toimintamalli) of § 8 had to be drawn up within three months of the act's entry into force (§ 47(3)).

2026-01-01

Act 698/2025 amended § 26, the list of supervising authorities.

2027-01-01

Act 785/2026 amends § 26 and Annex I: Säteilyturvakeskus joins the supervising authorities.

Is your company in scope? Common Finland scenarios

Two worked examples of how NIS2 scoping plays out in Finland. Not sure where you land? Run the free NIS2 scope checker.

A 5-person Finnish DNS provider

Essential entity, whatever its size

DNS service providers are in scope at any size (§ 3(2)) and are essential entities (§ 27(2)). It notifies its information for the register within one month of meeting the criteria, stating that it is an essential entity (§ 47(2), § 41(2)), keeps a risk-management model (§ 8) and, for a significant incident, sends its supervising authority the first notice within 24 hours and the follow-up notice within 72 hours of detecting it (§ 11(2)), not of becoming aware of it.

A Finnish MSP with 30 employees and EUR 5 million turnover

Out of scope as a small enterprise

Managed service providers are size-tested as in the directive: as a small enterprise under Recommendation 2003/361/EC it does not reach the medium-sized thresholds of § 3(1), and the any-size cases of § 3(2), electronic communications, trust services, TLD registries, DNS service providers and critical entities, do not cover it. Once it meets the criteria, it notifies its information for the register within one month (§ 47(2)).

What Finland businesses need to know

Finland transposed NIS2 with a new Cybersecurity Act, Kyberturvallisuuslaki 124/2025 (Cybersäkerhetslag in Swedish, equally official), published on 7 April 2025 and in force since 8 April 2025 (§ 47(1)); companion acts 125 to 140/2025 amended the sector acts. The European Commission's infringement case INFR(2024)0272, at the reasoned-opinion stage since 7 May 2025, was still open on 28 October 2026.
Traficom's Kyberturvallisuuskeskus is the single point of contact (§ 18(1)), and the CSIRT operates within Traficom (§ 19(1)). Supervision is split by sector among seven authorities: Traficom, Energiavirasto, Tukes, Lupa- ja valvontavirasto, Elinvoimakeskus, Ruokavirasto and Fimea (§ 26(1)), and Säteilyturvakeskus joins them on 1 January 2027 (Act 785/2026).
The incident clocks run from detection, not from awareness: the first notice (ensi-ilmoitus) is due within 24 hours and the follow-up notice (jatkoilmoitus) within 72 hours of the detection of the significant incident ('havaitsemisesta', § 11(2)), where the directive's Finnish text counts from becoming aware ('kun ne ovat tulleet tietoisiksi'). A trust service provider files the follow-up notice within 24 hours of detection (§ 11(6)).
Notifications go without delay to the supervising authority of the entity's sector, not to the CSIRT (§ 11(1)); the authority forwards every notification and report to the CSIRT within Traficom at once (§ 17(1)). An interim report (väliraportti) is due on the authority's request and, for a long-lasting incident, at the latest one month after the follow-up notice (§ 12); the final report (loppuraportti) within one month of the follow-up notice or, for a long-lasting incident, within one month after its handling ends (§ 13(1)). The act sets no channel, and the authorities' technical rules on the form of notifications (§ 11(5)) are not on Reglyze's record, so this page names no portal.
Scope follows the directive: Annex I and II entities that meet or exceed the medium-sized thresholds of Recommendation 2003/361/EC (§ 3(1)) and, at any size, electronic communications providers, trust service providers, TLD registries, DNS service providers and critical entities (§ 3(2)). Two national departures: an entity whose Annex activity is occasional and minor is out (§ 4(5)), and a municipality is in only for its Annex I or II activities and as a critical entity (§ 4(6)).
Public administration is not in this act: its § 1 sends the sector to the act on information management in public administration (906/2019), whose chapter 4 a, added by act 125/2025, holds the duties. A state body in that chapter's scope is an essential entity, and a wellbeing services county an important entity, with no size test, and Traficom supervises them (§§ 18 a and 18 h). Municipal authorities are outside the chapter (§ 3(3)), and the Cybersecurity Act reaches a municipality only for its Annex activities and as a critical entity (§ 4(6)).
The act names one class, the essential entity (keskeinen toimija), on which supervision is focused (§ 27(1) and (2)): large Annex I types, qualified trust service providers, TLD registries, DNS service providers, medium-sized electronic communications providers, national-importance cases and critical entities. The directive's important entities are, in the act, entities other than essential (muu kuin keskeinen toimija).
Each entity notifies its information for the register (§ 41), including whether it is an essential entity (§ 41(2)), within one month of the act's entry into force or of meeting the § 3 criteria (§ 47(2)), and reports a change to the supervising authority within two weeks, or within three months for the digital types' § 41(3) information (§ 41(4)). Traficom keeps the register for its sectors and takes registrations electronically.
Each entity has a risk-management model (riskienhallinnan toimintamalli, § 8), which § 47(3) required within three months of the act's entry into force. Reglyze assesses Finnish entities on the NIS2 substrate and does not claim a measure-by-measure assessment against a Finnish text.
The management (johto: the board, the supervisory board and the managing director, § 10(2)) approves and oversees the cybersecurity risk management and must have sufficient familiarity with it (§ 10(1)). The act words no training duty for the management as Article 20(2) of the directive does: training is a way to reach the familiarity § 10(1) requires.

How Traficom and the sector supervising authorities enforces NIS2 in Finland

Seven supervising authorities share the act by sector (§ 26(1)): Traficom for the annex points listed in § 26(1)(1), and Energiavirasto, Tukes, Lupa- ja valvontavirasto, Elinvoimakeskus, Ruokavirasto and Fimea for the others, with Säteilyturvakeskus joining them on 1 January 2027 (Act 785/2026). Supervision is focused on essential entities (§ 27(1)). Each authority receives its sector's incident notifications and forwards them at once to the CSIRT within Traficom (§ 11(1), § 17(1)), and can ban a person for a fixed period from sitting on the board of an essential entity, never in public administration (§ 32).

NIS2 in Finland: frequently asked questions

Is NIS2 in force in Finland?: Yes. Kyberturvallisuuslaki 124/2025 was published on 7 April 2025 and has applied since 8 April 2025 (§ 47(1)). Entities had to notify their information for the register within one month of the entry into force or of meeting the criteria (§ 47(2)), and to draw up their risk-management model within three months of the entry into force (§ 47(3)). The European Commission's infringement case INFR(2024)0272 was still open on 28 October 2026.
When does the incident clock start in Finland?: At detection. The first notice is due within 24 hours and the follow-up notice within 72 hours of the detection of the significant incident ('havaitsemisesta', § 11(2)), where the directive's Finnish text counts from becoming aware ('kun ne ovat tulleet tietoisiksi'); the Polish and Slovenian acts depart in the same way. A trust service provider files its follow-up notice within 24 hours of detection (§ 11(6)). Reglyze counts the Finnish deadlines from the detection time recorded on the incident, so none falls after the law's.
Who receives a Finnish entity's incident notification?: The supervising authority of its sector (§ 11(1)): Traficom for the annex points of § 26(1)(1), otherwise Energiavirasto, Tukes, Lupa- ja valvontavirasto, Elinvoimakeskus, Ruokavirasto or Fimea (§ 26(1)). The authority forwards every notification and report to the CSIRT within Traficom at once (§ 17(1), § 19(1)), so the entity does not notify the CSIRT itself. The act sets no channel, and the authorities' technical rules on the form and content of notifications (§ 11(5)) are not on Reglyze's record, so this page names no portal.
Does Finnish law use the important entity class?: Not by that name. The act names one class, the essential entity (keskeinen toimija), on which supervision is focused (§ 27(1)); every other entity in scope is an entity other than essential (muu kuin keskeinen toimija). Each entity states in its register notification whether it is an essential entity (§ 41(2)).
Must the management of a Finnish entity follow cybersecurity training?: The act words it differently from the directive: the management (the board, the supervisory board and the managing director, § 10(2)) must have sufficient familiarity with cybersecurity risk management (§ 10(1)); the act words no duty to follow training, as Article 20(2) of the directive does. Training is a way to reach that familiarity.

Official sources

Primary references for NIS2 in Finland. Verify the latest text and deadlines directly with the authority.

Ready to become NIS2 compliant in Finland?

Reglyze is the AI-powered NIS2 compliance platform built for European SMEs. Start free: scoping, gap assessment, and policy generation tailored to Traficom and the sector supervising authorities requirements.