Finland NIS2 Guide: Cybersecurity Act 124/2025

Finland applied its NIS2 rules from 8 April 2025 through the Cybersecurity Act (124/2025), and the practical surprise for most groups is that there is no single regulator: eight sector authorities supervise, while Traficom's National Cyber Security Centre Finland (NCSC-FI) receives every incident report. This guide covers the Finnish layer: which authority you answer to, what goes into registration, the 12 risk management areas the supervisors list, reporting through the Traficom e-service, sanctions, and what the measures mean for service accounts, API keys and AI agents. It is for CISOs, compliance leads and auditors in organisations with Finnish entities. The Directive itself is in the NIS2 Directive Guide, and the cross-country status table is in the NIS2 Transposition Tracker.

Status checked 9 November 2026: the Cybersecurity Act (Kyberturvallisuuslaki 124/2025) has applied since 8 April 2025, as announced by Traficom when Parliament passed it. The facts on supervisors, registration content, measures, reporting and fines below come from NCSC-FI pages (last updated 25 February 2026). The Finlex text could not be retrieved during research, so check section numbers against the Act on Finlex. This page is not legal advice.

Key takeaways

Eight supervisors, one CSIRT: the Energy Authority, Tukes, Traficom, FIN-FSA, the Finnish Supervisory Agency, Fimea, the Economic Development Centre and the Finnish Food Authority each supervise their sectors; all incident notifications also reach the CSIRT at NCSC-FI.
Registration includes IP ranges: entities give their supervisor contact details, sector, Member States served, essential status and IP ranges, and must report changes without delay and within two weeks at the latest.
Twelve measure areas, not ten: NCSC-FI lists 12 areas, adding asset management and physical security as separate headings next to the Article 21 list.
Fines follow the Directive ceilings: up to EUR 10 million or 2% of worldwide turnover for essential entities and EUR 7 million or 1.4% for others, imposed by a sanctions board on the supervisor's proposal.
Access control covers machines too: the "access control and authentication" area reaches service accounts, API keys, workload identities and AI agents, not only staff log-ins.

Scope: who and what is covered

The Act follows the NIS2 sectors and the essential and important split, based on size, sector and criticality. NCSC-FI publishes the full entity table as a Finnish-language annex. Two Finnish specifics matter when you scope:

Public administration under a separate Act: Traficom's registration page tells public bodies to check section 3 of the Act on Information Management in Public Administration (906/2019) as well as section 3 of the Cybersecurity Act, so central and local government entities have a second scope test.
Telecoms and trust services stay in: PwC's March 2026 summary notes that the Finnish scope also names public electronic communications providers, trust service providers, and domain name registries and DNS service providers.
Digital providers: for DNS, cloud, data centre, managed service and similar providers, Implementing Regulation (EU) 2024/2690 sets the measure content and incident thresholds. See the NIS2 Implementing Regulation 2024/2690 Guide.
Financial sector: banking and financial market infrastructures sit with FIN-FSA, and DORA applies to financial entities. See the DORA and NIS2 Overlap Mapping Guide.

Who supervises you

Finland spreads supervision across existing sector regulators. The list below is from NCSC-FI's NIS2 information page.

Authority	Sectors (summary)
Energy Authority	Electricity, district heating and cooling, natural gas supply, gas distribution and transmission, hydrogen transmission
Tukes (Finnish Safety and Chemicals Agency)	Oil, gas storage, LNG, refining, hydrogen production and storage, chemicals, manufacture of electronics, electrical equipment and machinery
Traficom	Air, rail, water and road transport; digital infrastructure (DNS, cloud, data centres, trust services, telecoms); ICT service management; public administration; space; postal and courier; digital providers; research; manufacture of vehicles and transport equipment; domain registrars
FIN-FSA (Financial Supervisory Authority)	Banking and financial market infrastructures
Finnish Supervisory Agency	Healthcare providers, EU reference laboratories, waste management
Fimea (Finnish Medicines Agency)	Medicinal product research and development, pharmaceutical and medical device manufacturing, blood establishments, pharmacies
Economic Development Centre	Drinking water and wastewater
Finnish Food Authority	Food production, processing and distribution

NCSC-FI, part of Traficom, is the national single point of contact. It coordinates the supervisors and exchanges information with other Member States. A group with Finnish entities in several sectors can therefore face two or three supervisors with the same law behind them, so agree one internal owner for each.

Registration

Each entity registers with its own supervisor. For Traficom's sectors, registration runs through a free e-service, signed in with Suomi.fi credentials and the mandate "Reporting details of cyber security operators". The information Traficom asks for is:

Entity name, sector, subsector and type of entity.
Establishment address in Finland, or the Finnish main establishment plus other EU establishments.
Current contact details, including email addresses and telephone numbers.
Member States where services are provided.
Entity IP ranges: the ranges the entity uses, which lets the CSIRT match threat information to you.
Whether the entity is essential under the Cybersecurity Act or the Act 906/2019, and whether it takes part in voluntary information sharing.

Keep it current: NCSC-FI says changes must be reported without delay and within two weeks at the latest. New cloud tenants, a merged subsidiary or a new public IP block are all changes. Tie the registration record to your asset inventory so a change in one prompts a check of the other.

Mandates are identities too: the Suomi.fi mandate that lets a person file for the company is a privileged authorisation. Record who holds it, review it when people move role, and keep at least two holders so a report is never blocked by one absence.

Risk management measures

NCSC-FI lists 12 areas that the risk management procedure must cover and keep up to date. Measures must be proportionate to risk, impact, likelihood and severity of incidents, and cost. Traficom also publishes a recommendation on the measures.

#	Area (NCSC-FI)	What to evidence for machine identities
1	Risk management policies and effectiveness assessment	NHI and AI agent risks in the risk register, with an owner
2	Information security policies	A policy that covers service accounts, keys, tokens and agents
3	Security in acquisition, development and maintenance, including vulnerability handling	Secrets kept out of code and pipelines; scanning results
4	Supply chain security	Register of supplier-held credentials and OAuth grants
5	Asset management	Inventory of non-human identities with owner and purpose
6	HR security and cybersecurity training	Joiner, mover and leaver steps that reassign owned credentials
7	Access control and authentication	Least privilege, rotation and review for service accounts and agents
8	Cryptography and secure communications	Certificate and key inventory with expiry tracking
9	Incident handling	Runbook to revoke and rotate credentials during an incident
10	Backup, disaster recovery, crisis management and continuity	Recovery of secrets stores and identity providers tested
11	Basic security practices	Logging of machine identity use
12	Physical environment and facility security	Protection of hardware security modules and key material

The right-hand column is NHI Mgmt Group's suggestion of evidence, not a Finnish requirement. Supervisors will look at whether the procedure is current and proportionate, and machine identities are where proportionality is easiest to question: they often outnumber staff accounts and rarely have owners.

Certification as support: some secondary summaries suggest ISO/IEC 27001 helps show compliance. The Act does not point to one standard according to PwC's summary, so treat certification as supporting evidence and map it to the 12 areas. See the ISO 27001 Certification Guide.

Incident reporting

NCSC-FI gives these stages for significant incidents:

Stage	Timing	Channel
Early warning	Within 24 hours of detection	Traficom "Incident notification under the NIS 2 Directive" e-service, routed to the sector supervisor
Incident notification	Within 72 hours of detection	Same e-service
Final report	After the incident is over (the Directive sets one month after the notification)	Same e-service
Notice to service users	Without delay, if the incident is likely to disrupt services	Your own channels

CSIRT copy: all notifications are forwarded to the CSIRT at NCSC-FI. When you notify you can ask it for help and share detail in confidence.
Voluntary reports: the e-service also takes reports of incidents that are not significant. A leaked API key that you revoked before misuse is a good candidate.
Thresholds: for digital providers, Implementing Regulation 2024/2690 defines when an incident is significant. Others apply the Directive test.

For the cross-regime picture, see the Cyber Incident Reporting Requirements Map.

Supervision and sanctions

Fines: NCSC-FI states a maximum of EUR 10,000,000 or 2% of the previous year's worldwide turnover, whichever is higher, for essential entities, and EUR 7,000,000 or 1.4% for other entities.
Who decides: fines are imposed by a sanctions board on the supervisory authority's proposal, not by the supervisor alone.
Public bodies: PwC's summary and a second published summary both say that administrative penalties cannot be imposed on certain public bodies, such as state authorities, wellbeing services counties and municipal authorities. They remain bound by the measures and can still face orders. Confirm against the official text before relying on it.
Management: the NIS2 Directive makes management bodies approve and oversee the measures and take training (Article 20). The NCSC-FI pages we read do not set out Finnish detail on this, so read the Act itself and see the NIS2 Management Liability Executive Briefing.

What it means for AI agents and non-human identities

Finland's list makes asset management and access control separate areas. That suits an NHI programme: first prove you know which machine identities exist, then prove each is controlled.

Inventory first: list service accounts, API keys, OAuth applications, certificates and AI agents per Finnish entity, with an owner. The Non-Human Identity (NHI) Guide sets out the categories.
Agents act with delegated access: an AI agent that reads mail or changes tickets uses tokens that fall under area 7. Give each agent its own identity, scope it narrowly and log what it does.
Supplier credentials: area 4 covers direct suppliers and service providers. Keys and grants you have issued to a managed service provider are part of your supply chain exposure.
Incident clock: a stolen token can start the 24-hour clock. Rehearse finding, revoking and rotating machine credentials inside that window.
Review cadence: NHI Mgmt Group recommends a quarterly review of privileged machine identities and an annual review of the rest. That is our recommendation, not a Finnish rule.

Compliance steps

Map each Finnish entity to its sector and supervisor using the table above, and check public bodies against Act 906/2019.
Confirm registration with each supervisor, including IP ranges, and set a two-week change process.
Record who holds Suomi.fi mandates for registration and incident reporting.
Map current controls to the 12 NCSC-FI areas and to Traficom's recommendation.
Add non-human identities and AI agents to the asset inventory and access reviews.
Test the e-service path for early warning, notification and final report in an exercise.
Brief the management body on duties and on the fine ceilings.

Common failure patterns

Wrong supervisor: registering everything with Traficom when part of the group is supervised by Tukes or the Energy Authority.
Stale IP ranges: cloud egress addresses change and the registration still shows last year's block, so CSIRT alerts do not reach you.
Two-week changes missed: acquisitions and new services are not reported within the deadline.
Human-only access evidence: reviews cover staff accounts but not service accounts, keys or agents.
One mandate holder: the only person who can file for the company is on leave when the 24-hour clock starts.

Practitioner checklist

Name the supervisor for each Finnish entity.
Verify registration data, including IP ranges, with each supervisor.
Set an owner and a two-week deadline for registration changes.
Keep at least two Suomi.fi mandate holders for reporting.
Evidence all 12 NCSC-FI measure areas, including asset management.
Include machine identities and AI agents in access control evidence.
Register supplier-held credentials and OAuth grants.
Rehearse the 24-hour and 72-hour reports through the Traficom e-service.

Standards and references

Related NHI Mgmt Group resources: NIS2 Directive Guide · NIS2 Transposition Tracker · NIS2 Readiness Checklist · Denmark NIS2 Implementation Guide · Non-Human Identity (NHI) Guide. This guide summarises the Finnish Cybersecurity Act as it stood on 9 November 2026 and is not legal advice.

Finland NIS2 Implementation: Cybersecurity Act 124/2025, supervisors and reporting