FinlandKyberkestävyyslaki, National Enforcement and Market Surveillance for the Cyber Resilience Act
In force since .
A product security requirements rule binding private bodies.
- Obligation class
- Security, Reporting
What it requires
- This does not create a new substantive product-security duty of its own: the essential cybersecurity requirements, vulnerability-handling and support-period duties for a product with digital elements are the Cyber Resilience Act's (Regulation (EU) 2024/2847), documented at the European Union level; this Act supplies Finland's market-surveillance authority and its own administrative-penalty amounts for a breach of that Regulation.
- Report an actively exploited vulnerability in your product with digital elements, or a severe incident affecting its security, under the Regulation's own Article 14 clock; this Act does not restate the duty or its deadline.
- You may voluntarily report a vulnerability, cyberthreat, security incident or near miss affecting your product to Finland's computer security incident response team (CSIRT) unit under the Regulation's Article 15; information reported this way cannot be used against you in a criminal investigation or an administrative decision without your consent.
These lines are LexLint's reading of the law's text. Also read by: Kyberturvallisuuskeskus (NCSC-FI), Liikenne- ja viestintävirasto Traficom (guidance, recorded ).
In the frameworks
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
The Act's own sanction for a breach of the duties it enforces is the administrative penalty in Sections 31 to 41; the Act creates no criminal offence for it.
Penalty structure
Section 38 sets four separate bands within Regulation Article 64's own limits. A manufacturer's breach of any duty Section 31(1) lists, which includes the essential cybersecurity requirements (Article 13 and Annex I Part I), carries the headline cap this structure records: EUR 15,000,000 or 2.5 percent of worldwide turnover, whichever is higher. A person other than the manufacturer who answers for a manufacturer's duty (Section 31(2)), an authorised representative, importer, distributor or notified body (Sections 32 to 35), and an economic operator's breach under Section 36(1) to (3) cap at EUR 10,000,000 or 2 percent. Supplying incorrect, incomplete or misleading information to a notified body or the market surveillance authority (Section 36(4)) caps at EUR 5,000,000 or 1 percent. A cybersecurity-certification breach under Section 37 carries a flat EUR 100,000 cap, which this structure's fields cannot represent alongside the turnover-based bands. Under Section 45 the bands for Section 31(1) items 1 to 22 and for Sections 32 to 34 and 36 apply from .
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 15,000,000
- Turnover percentage cap
- 2.5
Who enforces it
Enforcement body
Liikenne- ja viestintävirasto (Traficom), designated as the Regulation's Article 52 market surveillance authority by Section 15, except for a high-risk AI system within the Regulation's scope, which the Act on the Supervision of Certain Artificial Intelligence Systems' own designated authority supervises instead (Section 16).
Settledness
- As of
- Guidance link
- https://kyberturvallisuuskeskus.fi/en
- Guidance body
- Kyberturvallisuuskeskus (NCSC-FI), Liikenne- ja viestintävirasto Traficom
- Open questions
- Will Traficom publish sector guidance illustrating how the four Kyberkestävyyslaki penalty tiers apply to specific manufacturer conduct once the Cyber Resilience Act's own Article 14 reporting duty applies from ?
What this law does
The Laki eräiden tuotteiden kyberkestävyydestä sekä kyberturvallisuussertifioinnista (439/2026), known colloquially as the Kyberkestävyyslaki, specifies and supplements the directly applicable Cyber Resilience Act (Regulation (EU) 2024/2847) and its national application, rather than restating the Regulation's own essential cybersecurity requirements, which are documented at the European Union level and are not repeated here.
Section 7 leaves a manufacturer's duty to report an actively exploited vulnerability or a severe security-affecting incident entirely to Article 14 of the Regulation, adding only that the computer security incident response team (CSIRT) unit's duty to notify the market surveillance authority of a reported event is set by the Regulation's Article 16(3); Section 8 lets a manufacturer or other party voluntarily report a vulnerability, cyberthreat, incident or near miss to the CSIRT unit under Article 15, and information reported this way cannot be used against the reporter in a criminal investigation or an administrative decision without consent.
Section 15 names Liikenne- ja viestintävirasto (Traficom) as the Regulation's Article 52 market surveillance authority, except that Section 16 assigns a high-risk AI system within the Regulation's scope to the market surveillance authority the Act on the Supervision of Certain Artificial Intelligence Systems designates instead.
Chapter 6 sets Finland's own administrative penalty amounts within the bands Regulation Article 64 allows a Member State to set (Section 38): up to EUR 15,000,000 or 2.5 percent of worldwide turnover for a manufacturer's breach of any duty Section 31(1) lists, which covers the Article 13 essential cybersecurity requirements and support duties, the technical documentation, conformity assessment and CE marking duties, and the Article 14 reporting duties; up to EUR 10,000,000 or 2 percent for a person other than the manufacturer who answers for a manufacturer's duty under Regulation Article 21 or 22 (Section 31(2)), for an authorised representative's, importer's, distributor's or notified body's own obligations (Sections 32 to 35), and for an economic operator's failure to provide information on request, misuse of the CE marking or refusal of access under Section 36(1) to (3); up to EUR 5,000,000 or 1 percent for supplying incorrect, incomplete or misleading information to a notified body or the market surveillance authority (Section 36(4)); and a flat EUR 100,000 cap for a cybersecurity-certification breach (Section 37).
Finland's Act entered into force on , but Section 45 delays parts of it: Chapter 3 and Section 35 apply from , Sections 7 to 9 and Section 31(1) items 23 to 26 from , the date the Regulation's Article 14 reporting duty starts, and Sections 4 to 6, Section 31(1) items 1 to 22, Sections 32 to 34 and Section 36 from .
When LexLint raises it
When your app profile says your app distributes a software product.
Back to the example · Lint your app
Page updated .