Makes education decisions, in Finland

Regulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22 · Read the law's page

• Where a decision based solely on automated processing about a person in Finland rests on a contract with them or on their explicit consent, put suitable safeguards in place, at least the right to obtain human intervention, to express their point of view and to contest the decision, under GDPR Article 22(3).
• Do not subject a person in Finland to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, unless the decision is necessary for entering into or performing a contract with them, is authorised by Union or Member State law that also lays down suitable measures to safeguard their rights, or rests on their explicit consent, under GDPR Article 22(1) and (2).
• Do not base a solely automated decision with legal or similarly significant effects on a person in Finland on the special categories of personal data in GDPR Article 9(1), unless they gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, and suitable measures to safeguard their rights are in place, under GDPR Article 22(4).
• If you make solely automated decisions about a person in Finland of the kind GDPR Article 22(1) and (4) describe, including profiling, tell them so and give them meaningful information about the logic involved and the significance and envisaged consequences for them: when you collect their data, within the Article 14(3) period where you obtained it from someone else, and in answering their access request, under GDPR Articles 13(2)(f), 14(2)(g) and 15(1)(h).

Laki eraiden tekoalyjarjestelmien valvonnasta (1377/2025) · Read the law's page

• If you are a provider or a representative established in Finland, keep the documents referred to in Article 18(1) of the AI Act available to the market surveillance authorities and the notifying authorities for ten years after a high-risk AI system is placed on the market or put into service, even through liquidation, bankruptcy, or the business ceasing or being transferred (Section 26).

Regulation (EU) 2026/1744 (Digital Omnibus on AI), amending Regulation (EU) 2024/1689; published in the Official Journal 24 July 2026; entered into force 27 July 2026 — directly applicable in Finland

Regulation (EU) 2024/1689, Arts. 5, 50 — directly applicable in Finland as EU Member State; national enforcement via Act 1377/2025

• Tell users at the outset that they are interacting with an AI when deploying a chatbot or voice-based interaction system.
• Mark AI-generated synthetic audio, image, video and text output in a machine-readable format.

Hallituksen esitys HE 190/2026 vp, laki tuotevastuulain muuttamisesta · Read the law's page

• If you develop, make or produce software, including software supplied through a cloud or as a service, you answer as its manufacturer; free and open-source software developed or supplied outside commercial activity is outside the Act (Secs. 1 a and 2 point 5).
• Keep supplying the software updates and upgrades needed to keep the product safe while it is under your control: a lack of safety caused by software, an update or upgrade, a related service, a missing necessary update or a substantial modification is not excused because it arose after you put the product on the market (Sec. 7).
• Meet the mandatory product-safety requirements that apply to your product, because a product that fails them is presumed to lack safety (Sec. 4 b).
• Be ready to produce the evidence a court orders disclosed and to present it, on a party's request, in an easily accessible and understandable form, because failing to comply with a disclosure order presumes the product defective (Secs. 4 b and 13 b).
• If you are established outside the European Union, your importer, your authorized representative or, if there is neither, your fulfilment service provider answers beside you (Sec. 5).
• If you distribute a product or run an online platform that lets consumers conclude distance contracts, you answer when no liable operator can be identified or established in the Union, unless you name one within a month of the request (Sec. 6).
• Be ready to show that the objective state of scientific and technical knowledge when you placed the product on the market, or while it was under your control, did not allow the lack of safety to be detected (Sec. 7).
• Count the destruction or corruption of data used exclusively for personal purposes as compensable economic loss, with no lower limit for property damage (Sec. 8).
• A claim must be brought within three years of the injured person learning, or having reason to learn, of the damage, the lack of safety and the liable person, and within ten years of the product being placed on the market or put into use, or 25 years for latent personal injury (Sec. 9).