Distributes a software product, in Finland

Tuotevastuulaki (694/1990) · Read the law's page

• Treat standalone software as an open question under this Act: section 1 defines a product as a movable thing (irtain esine) and extends the product rules to electricity, and the Government's bill HE 190/2026 vp would add software to the definition (Sec. 1).
• If you manufacture or produce a product, import it into the European Economic Area to put it into circulation there, or market it as your own under your name, trade mark or other distinguishing mark, you answer for the damage it causes (Sec. 5(1)).
• If a product does not show its manufacturer, tell the injured person within a reasonable time of a claim or request who is liable under section 5 or who offered the product to you, or you answer as the manufacturer; for an imported product the same applies unless the product shows an importer (Sec. 6).
• Make the product as safe as there is reason to expect, judged on when you put it into circulation, its foreseeable use, its marketing and instructions for use and other circumstances (Sec. 3).
• Be ready to show an exemption: that you did not put the product into circulation in the course of business, that the lack of safety results from mandatory rules issued by an authority, or that the product probably had no lack of safety causing the damage when you put it into circulation; the Act has no development risk exemption (Sec. 7(1) and (2)).
• If you made only a component, be ready to show that the lack of safety results from the design of the product it was connected to or from the instructions of the manufacturer who ordered the product (Sec. 7(3)).
• Do not rely on a contract term made before the damage appears to limit the injured person's compensation under the Act, because it is void (Sec. 10).
• If you import a product into Finland, help the injured person translate the claim into a foreign language or pay the necessary translation costs; a later distributor must name the importer on request within a reasonable time (Sec. 13).
• A claim must be brought within three years of the injured person learning, or having reason to learn, of the damage, the lack of safety and the liable person, and within ten years of the liable person putting the product into circulation (Sec. 9).

79-90 §, Laki sosiaali- ja terveydenhuollon asiakastietojen käsittelystä (703/2023) · Read the law's page

• If you manufacture or supply a social or health care information system, or a wellbeing application, used to process client data in Finland, make it meet the essential requirements on interoperability, information security and data protection, and functionality, whether it is used alone or with the systems connected to it (Act 703/2023, section 84).
• For a Class A system or application, certify it before production use: give the statement that it meets its functionality requirements, pass the approved interoperability test, and obtain the information-security assessment certificate from an information-security assessment body (sections 85, 86 and 87).
• Do not put a Class A system or application into production use until it is certified and registered, or after its information-security assessment certificate has expired (section 81).
• For a Class B system, give a written statement that, properly installed, maintained and used, it meets the essential requirements for its purpose (section 85).

90 §, Laki sosiaali- ja terveydenhuollon asiakastietojen käsittelystä (703/2023) · Read the law's page

• It reaches you if you are a social or health care service provider, a pharmacy, the Social Insurance Institution (Kela), the provider or manufacturer of an information system used to process client data, an intermediary, or the manufacturer of a wellbeing application (section 90).
• If you are a service provider or a pharmacy and detect a significant deviation in how an information system meets the essential requirements, notify the information system service provider (section 90).
• If a deviation in an information system or wellbeing application may cause a significant risk to client or patient safety or to information security, notify the Licensing and Supervisory Authority (Lupa- ja valvontavirasto); if you are a pharmacy and the deviation may put your operations at significant risk, also notify the Finnish Medicines Agency (section 90).
• Notify the Licensing and Supervisory Authority without delay of a significant information-security disturbance in the operating environments and networks you use that may significantly endanger the use of information systems or the provision of social and health care services; a pharmacy whose operations may be significantly endangered also notifies the Finnish Medicines Agency without delay (section 90).

Laki eräiden tuotteiden esteettömyysvaatimuksista (102/2023) ja valtioneuvoston asetus eräiden tuotteiden esteettömyysvaatimuksista (181/2023) · Read the law's page

• If you manufacture, import or distribute a consumer general purpose computer or its operating system, a self-service payment terminal, a self-service teller, ticketing or check-in machine or interactive information terminal for the services in section 2, consumer terminal equipment with interactive computing capability used for electronic communications services or for audiovisual media services, or an e-reader, place it on the market from 28 June 2025 only if it meets the accessibility requirements, an EU declaration of conformity has been drawn up and it bears the CE marking (ss. 2 and 6(1)).
• Design and produce the product so that disabled persons can foreseeably use it as widely as possible, with usage instructions and accessibility information easily available and a user interface that is easily usable, controllable, understandable and operable by disabled persons (s. 6(1)).
• Make the markings, instructions and warnings on the product available through more than one sensory channel, in an understandable form and in a suitable typeface with sufficient contrast, and provide the further measures of Decree 181/2023 section 2 for the interface and functionality (Decree 181/2023 ss. 1 and 2).
• If the product is a self-service terminal, provide text-to-speech, allow the user's own headphones, alert through more than one sensory channel when a timely response is required, allow the response time to be extended, provide tactilely distinguishable keys with sufficient contrast, do not require the accessibility features to be activated separately, and make audio features compatible with assistive technology available in the European Union (Decree 181/2023 s. 3).
• If the product is an e-reader, provide text-to-speech (Decree 181/2023 s. 4).
• If the product is consumer terminal equipment used for electronic communications services, provide real-time text and high-quality audio support, full interactivity with synchronized audio, real-time text and sign language video where it uses video, wireless connection to hearing technology and operation without disturbing assistive devices (Decree 181/2023 s. 5).
• If the product is consumer terminal equipment used to access audiovisual media services, make available to disabled persons the accessibility features of the media service provider's offering for use, selection, control, personalization and transmission to assistive devices (Decree 181/2023 s. 6).
• Have support services give information on the accessibility of the product and its compatibility with assistive technology, and, unless the product is a self-service terminal, design the packaging and make the instructions for use, installation, maintenance, storage and disposal accessible and public when the product is placed on the market (s. 6(1); Decree 181/2023 ss. 7 and 8).
• Where you rely on an alternative, equally accessible way of using the product instead of the requirements, meet the eleven functional performance requirements of the Decree (s. 6(1); Decree 181/2023 s. 9).
• As a manufacturer, ensure the product is designed and made to meet the requirements, draw up the EU declaration of conformity in Finnish and Swedish on the model of Annex III to Decision No 768/2008/EC with a general description of the product, a description of how it meets the requirements and the harmonized standards applied, keep it up to date, affix the CE marking visibly, legibly and indelibly before placing the product on the market, keep the technical documents and the declaration for five years from placing the product on the market, mark the product with a type, batch or serial number and with your name and address, and supply instructions and safety information in Finnish and Swedish (ss. 9 to 11).
• As an importer, before placing the product on the market ensure the manufacturer has complied with section 11, second and fourth paragraphs, ensure storage or transport conditions do not jeopardize compliance, indicate on the product your name, registered trade name or registered trademark and a contact address, do not place a product you consider non-compliant on the market until it is brought into conformity, inform the manufacturer and the authority of non-compliance, keep a copy of the declaration for five years and make the technical documents available to the authority (s. 13).
• As a distributor, check that the product carries the EU declaration of conformity, the CE marking and the manufacturer's and importer's identifying information, and make sure storage or transport conditions do not jeopardize compliance (s. 14).
• If you place a product on the market under your own name or trademark, or modify a product already on the market in a way that may affect compliance, meet the manufacturer's duties of section 11 as an importer or distributor (ss. 13 and 14).
• If you are an authorised representative, keep the declaration and the technical documents available to the authority for five years, supply information and documents on a reasoned request and cooperate in remedying non-conformity; you cannot take over the manufacturer's duty to design and make compliant products (s. 12).
• As any economic operator, give the authority on request the identity of every operator that supplied you with the product or to which you supplied it over the last five years, and all the information and documents needed to show conformity in a language it easily understands, cooperate with it in assessing accessibility or correcting non-compliance, bring a product you consider non-compliant into conformity or withdraw it immediately and notify the authority, and, as a manufacturer or importer, keep records of non-compliant products and complaints (s. 15).
• Depart from the requirements only if your assessment shows that compliance would fundamentally alter the basic nature of the product or impose a disproportionate burden on you, do not rely on the burden if you receive funding from outside your own funds granted for improving accessibility, notify the authority, document the assessment, submit it on request and keep the documents for five years from when you last made the product available, and identify in the EU declaration of conformity the requirements from which you depart (ss. 7 to 9).
• When you carry out public procurement, take the accessibility requirements of products within the Act into account as section 71(1) of the Public Procurement Act (1397/2016) and section 75(1) of the Special Sectors Procurement Act (1398/2016) provide (s. 6(5)).
• Correct a non-conformity when the market surveillance authority, Traficom, orders it, and report how you carried out an order or ban; the authority may require information, inspect premises other than permanent residences, take products and acquire them under a false identity for examination, charge you the costs of examining a significantly non-compliant product, ban a product, also as an interim measure, order it removed from the market, recalled or destroyed, order you to inform the public, and back an order with a conditional fine or a threat of performance at your cost; its decision can be enforced notwithstanding an appeal (Market Surveillance Act ss. 8 to 10 a and 17 to 29).
• Follow the harmonized standards or technical specifications that the Directive's Article 15 refers to if you want the product treated as meeting the requirements those standards or specifications cover (s. 6(3)).
• If you are a microenterprise, an undertaking that employs fewer than 10 employees and has an annual turnover of at most EUR 2 million or an annual balance sheet total of at most EUR 2 million, you need not notify or document a departure from the requirements, but you must give the authority on request the information corresponding to the assessment if you rely on section 7 (ss. 4(2) and 8(2)).
• If you are a service provider, bring the products you use to provide your services into conformity with the Act by 28 June 2030, and self-service terminals put into use before 28 June 2025 within 20 years of the start of their use (s. 20(2) and (3)).

Laki eräiden tuotteiden kyberkestävyydestä sekä kyberturvallisuussertifioinnista (439/2026), 1, 7-9, 15-16 ja 31-38 § · Read the law's page

• This does not create a new substantive product-security duty of its own: the essential cybersecurity requirements, vulnerability-handling and support-period duties for a product with digital elements are the Cyber Resilience Act's (Regulation (EU) 2024/2847), documented at the European Union level; this Act supplies Finland's market-surveillance authority and its own administrative-penalty amounts for a breach of that Regulation.
• Report an actively exploited vulnerability in your product with digital elements, or a severe incident affecting its security, under the Regulation's own Article 14 clock; this Act does not restate the duty or its deadline.
• You may voluntarily report a vulnerability, cyberthreat, security incident or near miss affecting your product to Finland's CSIRT unit under the Regulation's Article 15; information reported this way cannot be used against you in a criminal investigation or an administrative decision without your consent.

Hallituksen esitys HE 190/2026 vp, laki tuotevastuulain muuttamisesta · Read the law's page

• If you develop, make or produce software, including software supplied through a cloud or as a service, you answer as its manufacturer; free and open-source software developed or supplied outside commercial activity is outside the Act (Secs. 1 a and 2 point 5).
• Keep supplying the software updates and upgrades needed to keep the product safe while it is under your control: a lack of safety caused by software, an update or upgrade, a related service, a missing necessary update or a substantial modification is not excused because it arose after you put the product on the market (Sec. 7).
• Meet the mandatory product-safety requirements that apply to your product, because a product that fails them is presumed to lack safety (Sec. 4 b).
• Be ready to produce the evidence a court orders disclosed and to present it, on a party's request, in an easily accessible and understandable form, because failing to comply with a disclosure order presumes the product defective (Secs. 4 b and 13 b).
• If you are established outside the European Union, your importer, your authorized representative or, if there is neither, your fulfilment service provider answers beside you (Sec. 5).
• If you distribute a product or run an online platform that lets consumers conclude distance contracts, you answer when no liable operator can be identified or established in the Union, unless you name one within a month of the request (Sec. 6).
• Be ready to show that the objective state of scientific and technical knowledge when you placed the product on the market, or while it was under your control, did not allow the lack of safety to be detected (Sec. 7).
• Count the destruction or corruption of data used exclusively for personal purposes as compensable economic loss, with no lower limit for property damage (Sec. 8).
• A claim must be brought within three years of the injured person learning, or having reason to learn, of the damage, the lack of safety and the liable person, and within ten years of the product being placed on the market or put into use, or 25 years for latent personal injury (Sec. 9).