- Status
- Transposed
- In force from
- 2025-04-08
- Implementing law
- Kyberturvallisuuslaki 124/2025 (Cybersecurity Act)
- EU infringement procedure
- Reasoned opinion
- Competent authority
- Sector-specific authorities (Traficom, Energy Authority, Tukes, Valvira, Fimea, etc.); Traficom's NCSC-FI is the single point of contact Competent authority NIS2 page →
- National CSIRT
- NCSC-FI / Kyberturvallisuuskeskus (within Traficom) CSIRT website →
Notable national choices
- First Finnish horizontal cybersecurity framework — consolidates obligations previously fragmented across multiple sectoral laws.
- Multi-regulator sectoral supervision model rather than a single national authority.
- Registration deadline only one month after entry into force (8 May 2025); risk-management operating model required by 8 July 2025.
Sources
Last verified: