NIS2 obligations in Finland

Competent authority & CSIRT Legal ref: Art. 18, 26

• National Cyber Security Centre. ecs-org.eu · 28 Oct 2026 · secondary source
• The National Cyber Security Centre under the Finnish Transport and Communications Agency is identified as CSIRT unit and a centralised contact point. ecs-org.eu · 28 Oct 2026 · secondary source
• Sector-specific supervisory authorities are listed under Art. 26 and include, the Finnish Transport and Communications Agency, Energy Authority, Finnish Safety and Chemicals Agency, Valvira (National Supervisory Authority for Welfare and Health), Centre for Economic Development, Transport and the Environment of South Savo, Finnish Food Authority, and Finnish Medicines Agency. ecs-org.eu · 28 Oct 2026 · secondary source
• Supervisory authorities are required to cooperate in the implementation of supervision measures. ecs-org.eu · 28 Oct 2026 · secondary source

Who's in scope (national deviations) Legal ref: Art. 4

• NIS2 (the finance sector is out of scope and covered by DORA). The law introduces the same security obligations for both essential and important entities, with differences regarding ex-ante (essential) and ex-post (important) supervision as well as maximum sanctions (in alignment with NIS2). ecs-org.eu · 28 Oct 2026 · secondary source
• The law does not apply to entities whose activities under sectors of high criticality and other critical sectors are sporadic and minor. ecs-org.eu · 28 Oct 2026 · secondary source
• The law applies to local authorities under the scope of the Local Government Act (410/2015) only with respect to activities listed under the sectors of high criticality and other critical sectors. ecs-org.eu · 28 Oct 2026 · secondary source
• The Cybersecurity Law required updates in a significant number of sectoral national laws. ecs-org.eu · 28 Oct 2026 · secondary source

Registration Legal ref: Art. 41, 47

• The supervisory authority is tasked with keeping a list of entities in its supervisory area. Entities are required to provide the supervisory authority with the following information: ecs-org.eu · 28 Oct 2026 · secondary source
• Name of the entity. ecs-org.eu · 28 Oct 2026 · secondary source
• Address, email address, telephone number and other relevant contact details. ecs-org.eu · 28 Oct 2026 · secondary source
• IP addresses. ecs-org.eu · 28 Oct 2026 · secondary source
• Sector and subsector classification. ecs-org.eu · 28 Oct 2026 · secondary source
• Entity classification. ecs-org.eu · 28 Oct 2026 · secondary source
• List of member states where the entity provides services in the scope of NIS2. ecs-org.eu · 28 Oct 2026 · secondary source
• Information on participation in voluntary cybersecurity information exchange arrangements. ecs-org.eu · 28 Oct 2026 · secondary source
• The information must be submitted no later than one month after the law enters into force or the fulfilment of the criteria for entities specified in Art. 3. ecs-org.eu · 28 Oct 2026 · secondary source
• Entities under the scope of NIS2 must register with the national authority corresponding to their sector. Each authority will provide different instructions for registration, as well as links to the registration platforms once they are available. If the entity’s activities are supervised by more than one competent authority, it must register with all relevant sectoral authorities. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 3(4), Art. 27): Member States draw up a list of essential and important entities; entities provide name, contact details, IP ranges, sector and Member States served. EUR-Lex

Incident reporting Legal ref: Art. 11,12,13

• Entities must notify the supervisory authority of a significant incident without delay. Reporting requirements : ecs-org.eu · 28 Oct 2026 · secondary source
• Initial notification within 24 hours of the detection of a significant incident. ecs-org.eu · 28 Oct 2026 · secondary source
• Follow-up notification within 72 hours of the detection of a significant incident. ecs-org.eu · 28 Oct 2026 · secondary source
• Interim report with up-to-date information at the request of the supervisory authority (if necessary). ecs-org.eu · 28 Oct 2026 · secondary source
• Final report no later than 1 month after sending the follow-up notification. ecs-org.eu · 28 Oct 2026 · secondary source
• Progress report (if the incident is still ongoing), no later than 1 month after the follow-up notification has been submitted, and a final report within another month after the end of the incident. ecs-org.eu · 28 Oct 2026 · secondary source
• Significant incident definition: an incident that has caused or may cause serious operational disruption to the services or significant financial losses to the operator concerned, as well as an incident that has affected or may affect other natural or legal persons by causing significant material or non-material damage. ecs-org.eu · 28 Oct 2026 · secondary source
• Reference to NIS2 definition of a significant incident (EU 2022/2555, Art. 23). ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 23): early warning within 24 hours, incident notification within 72 hours, final report within one month (progress report if still ongoing). EUR-Lex

Management liability & training

Not yet published / needs verification We have not found a published, sourced national rule for this yet.

NIS2 baseline (Art. 20): management bodies must approve and oversee cybersecurity risk-management measures, can be held liable for infringements, and must follow training. EUR-Lex

Penalties Legal ref: Art. 38

• Up to 10,000,000 EUR or 2% of the total worldwide annual turnover (essential entities). ecs-org.eu · 28 Oct 2026 · secondary source
• Up to 7,000,000 EUR or 1.4% of the total worldwide annual turnover (important entities). ecs-org.eu · 28 Oct 2026 · secondary source
• Fines would not be applicable to public sector entities. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 34): maximum fines of at least EUR 10m or 2% of worldwide turnover (essential) and EUR 7m or 1.4% (important), whichever is higher. EUR-Lex

Security measures, standards & deadlines

• ISO 27001 ecs-org.eu · 28 Oct 2026 · secondary source
• In Finland, the transposition of NIS2 provided a simplified approach to risk management. There is no recommended methodology, nor is it required to be periodically audited. The scope can be limited to IT networks and services; however, it introduces an obligation for management to understand risk analysis and its results, considering at least 12 different areas. ecs-org.eu · 28 Oct 2026 · secondary source

Supervisory guidance

Not yet published / needs verification No regulator guidance links recorded yet. Official text: Final Text

What changed recently

1. 8 Apr 2025
   National NIS2 law enters into force (per tracker) ecs-org.eu secondary source