FinlandKyberturvallisuuslaki, Significant-Incident Reporting Obligations
Kyberturvallisuuslaki (124/2025), 11-14 ja 22 §
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting, Security
What it requires
- This binds you on the same scope as this jurisdiction's companion risk-management row: an Annex I or Annex II activity at medium-enterprise size or above, or, regardless of size, if you are a public electronic communications provider, a trust service provider, a top-level-domain registry operator, a DNS service provider, or a certain critical entity; the online marketplace, online search engine and online social-networking-platform digital-service-providers named in Annex II are flagged here.
- Notify your supervisory authority without delay of a significant incident, one that has caused or could cause a serious service disruption or considerable financial loss to you, or that has affected or could affect another person with considerable material or immaterial damage.NIST CSF 2.0RS.CO-02
- File an early notification within 24 hours of detecting the significant incident, stating whether it is suspected to result from an unlawful or hostile act and the likelihood of cross-border effects, and a follow-up notification within 72 hours of detection, both clocks running from detection rather than from each other; if you are a trust service provider whose trust services are affected, file your follow-up notification within 24 hours instead of 72.NIST CSF 2.0RS.CO-02
- Provide an interim report on the authority's request, or within one month of your follow-up notification if the incident is long-running, and a final report within one month of the follow-up notification, or within one month of the incident's resolution if it is still ongoing at that point, describing the incident, its likely root cause, mitigation measures taken, and any cross-border effects.NIST CSF 2.0RS.CO-03
- Notify the recipients of your services without delay of a significant incident likely to adversely affect your service to them, and of a significant cyberthreat that may affect them together with the measures available to counter it.NIST CSF 2.0RS.CO-02
These lines are LexLint's reading of the law's text. Also read by: Kyberturvallisuuskeskus (NCSC-FI), Liikenne- ja viestintävirasto Traficom (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
The Act's own sanction for a Section 11, 12 or 13 breach is the administrative penalty in Sections 35 to 40; the Act creates no criminal offence for it.
Penalty structure
The same penalty provision that governs the Section 7 to 9 breach on this jurisdiction's companion risk-management row governs a Section 11, 12 or 13 breach: up to EUR 10,000,000 or 2 percent of worldwide annual turnover for an essential entity, and up to EUR 7,000,000 or 1.4 percent for any other bound entity, mirroring NIS2 Article 34(4) and (5). The same Section 35 exclusion for state and church bodies applies.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 10,000,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
Liikenne- ja viestintävirasto (Traficom), the Act's Section 26 supervisory authority for Annex I items 1 to 7 (transport, space ground infrastructure, digital infrastructure and ICT service management) and Annex II items 1 to 5 (postal and courier services, digital service providers including the online marketplace, search engine and social-networking-platform providers flagged here, motor-vehicle and other transport-equipment manufacturing, and research organizations that pursue applied research for commercial use); reports reach the CSIRT unit immediately under Section 17.
Settledness
- As of
- Guidance link
- https://kyberturvallisuuskeskus.fi/fi/toimintamme/saantely-ja-valvonta/nis-2-euroopan-unionin-kyberturvallisuusdirektiivi
- Guidance body
- Kyberturvallisuuskeskus (NCSC-FI), Liikenne- ja viestintävirasto Traficom
- Open questions
- What situations does the European Commission implementing act adopted under NIS2 Directive Article 23(11) specify as automatically significant, beyond the general definition Kyberturvallisuuslaki Section 11 states in its own right?
What this law does
Sections 11 to 14 of the Kyberturvallisuuslaki require a bound entity to notify its supervisory authority without delay of a significant incident, defined as one that has caused or could cause a serious service disruption or considerable financial loss to the entity, or that has affected or could affect another natural or legal person with considerable material or immaterial damage.
An early notification is due within 24 hours of detecting the significant incident and a follow-up notification within 72 hours of detection, both clocks running from the moment of detection rather than from each other (Section 11). A trust service provider whose trust services are affected must instead file its follow-up notification within 24 hours rather than 72 (Section 11).
An interim report is due on the supervisory authority's request, or within one month of the follow-up notification if the incident is long-running (Section 12), and a final report is due within one month of the follow-up notification, or within one month of the incident's resolution if it is still ongoing at that point, describing the incident, its likely root cause, mitigation measures taken and any cross-border effects (Section 13).
Where a significant incident is likely to adversely affect an entity's service, or a significant cyberthreat may affect the recipients of that service, the entity must notify them without delay of the incident, the threat, and available countermeasures (Section 14).
Separately, Section 22 makes the Act's computer security incident response team (CSIRT) unit, not the affected manufacturer or provider, the NIS2 Article 12 coordinator for coordinated vulnerability disclosure: it receives reports of vulnerabilities, which may be submitted anonymously, and handles the necessary follow-up. The same penalty bands and exemptions described on this jurisdiction's companion risk-management row apply to a failure of the Section 11, 12 or 13 reporting duties.
When LexLint raises it
When your app profile says your app runs an essential service, operates a social platform or provides telecom services.
Back to the example · Lint your app
Page updated .