NIS 2 Status in Finland
What the directive requires, how Finland implements it, and where Traficom and NCSC-FI sit in the picture.
Overview
The NIS 2 directive is the EU layer. It binds every Member State, including Finland, to a single minimum bar for essential and important entities. Finland has to carry that bar into Finnish law and run supervision underneath it.
Finland transposes NIS 2 through the Cybersecurity Act (Kyberturvallisuuslaki, Act 124/2025). Parliament adopted it on 11 March 2025 and it entered into force on 8 April 2025. That is after the EU deadline of 17 October 2024. On 7 May 2025 the European Commission sent a reasoned opinion to Finland and eighteen other Member States for not notifying full transposition in time.
Supervision is split sector by sector. The Finnish Transport and Communications Agency, Traficom, supervises the largest group of sectors and houses the National Cyber Security Centre Finland (NCSC-FI), which is the national CSIRT and the single point of contact under Article 8(3) of the directive. Alongside Traficom, the Energy Authority (Energiavirasto), the Finnish Safety and Chemicals Agency (Tukes) and other sector authorities supervise their own sectors. Banking and financial market infrastructure fall under DORA, not the Finnish Cybersecurity Act.
EU directive
Directive (EU) 2022/2555 (NIS 2)
The EU-wide cybersecurity directive. It sets the obligations every Member State has to transpose, including the size and sector test for essential and important entities.
EU implementing act
Implementing Regulation (EU) 2024/2690
Technical and methodological requirements for DNS providers, TLD registries, cloud, data centre and CDN providers, managed (security) service providers, online marketplaces, search engines, social networks and trust service providers. Directly applicable in Finland, no national transposition needed.
Finnish transposition
Cybersecurity Act 124/2025, in force since 8 April 2025
The Finnish NIS 2 transposition. A horizontal cybersecurity act that consolidates obligations previously spread across several sector-specific laws. Regulations and Traficom guidance fill in the operational detail.
Cybersecurity Act 124/2025
Brings the NIS 2 obligations into Finnish law. Defines essential and important entities, supervisory powers, incident notification duties and penalties. Operational detail follows via regulations and Traficom guidance.
Traficom and NCSC-FI
Traficom supervises transport, digital infrastructure, ICT service management, space, postal and courier services, digital providers, research and vehicle manufacturing, and houses NCSC-FI as national CSIRT and single point of contact. Other sectors sit with their own authorities, notably Energiavirasto for electricity, district heating and gas networks, and Tukes for oil, gas storage and refining, hydrogen production, chemicals and parts of manufacturing. Banking and financial market infrastructure are covered by DORA.
Registration and reporting
Finnish entities had to register with their sector supervisor by 8 May 2025. Changes to the registered data have to be reported within two weeks. Significant incidents follow the directive: early warning within 24 hours, notification within 72 hours, final report within one month. All notifications are forwarded to the CSIRT at NCSC-FI.
Finnish law applies in Finland
Activity on Finnish territory follows the Finnish transposition. A German managing director with a Finnish subsidiary reads the Cybersecurity Act 124/2025 for that subsidiary, not the BSIG. The directive obligations are identical. The procedure, the supervisor and the penalties live in Finnish law.
Finland cannot drop below the EU floor
The directive is a minimum-harmonisation instrument. Finland may go stricter. Finland may not fall below the directive, neither on the duties for essential and important entities, nor on reporting deadlines, nor on management body liability.
Traficom
The Finnish Transport and Communications Agency directly supervises transport, digital infrastructure, ICT service management, space, postal and courier services, digital providers, research and the manufacture of vehicles and transport equipment, and under separate law public administration. Like every Finnish supervisor, it keeps the entity list for its own sectors.
NCSC-FI (Kyberturvallisuuskeskus)
The National Cyber Security Centre inside Traficom is the national CSIRT and the single point of contact under Article 8(3) of the directive. A significant incident is legally notified to the competent sector supervisor, which forwards it to NCSC-FI immediately; in practice one shared Traficom form reaches the supervisor, the CSIRT and the single point of contact at once.
ENISA
The EU cybersecurity agency. Publishes guidance, runs the European vulnerability database and coordinates across borders. Not a supervisor for Finnish entities. That sits with Traficom and the sector authorities.
Finland implements NIS 2 the same way as Germany, so we can read the BSIG.
The directive duties are identical, the supervisory architecture is not. Finland uses a single horizontal statute, the Cybersecurity Act 124/2025, instead of layering on top of a federal BSI structure. Supervision is split across sector regulators with Traficom and NCSC-FI coordinating. Mapping the BSIG onto Finland gets the supervisor and the reporting path wrong.
There is no official list yet, so we can wait.
Registration has been mandatory since 8 April 2025, and the initial deadline was 8 May 2025. Each sector supervisor keeps the list of NIS 2 entities in its sectors. Not being registered does not mean compliant, it means invisible to the supervisor. Changes to the registered data have to be reported within two weeks (Art. 3(4) NIS 2, § 41 of the Finnish Act).
My sector regulator handles everything, NCSC-FI is just advisory.
The sector authority does supervision and audits, and it is also where a significant incident is legally notified. The supervisor forwards every notification to the CSIRT at NCSC-FI immediately, and in practice one shared Traficom form delivers the report to the supervisor, the CSIRT and the single point of contact at once. Use that form rather than writing to one authority by hand.
Most Finnish mid-market operators we meet still treat NIS 2 as an IT topic. That is only half right. Supervision and the reporting channel sit at the sector level, scope is wider than under the old Finnish cybersecurity regime, and the management body (toimitusjohtaja, hallitus) carries heavier responsibility. The management body approves and oversees the risk management procedure and must have adequate familiarity with cybersecurity risk management; at essential entities, repeated serious breaches can lead to a temporary ban from the board.
The practical step is the same as everywhere in the EU: run the applicability check against the directive, register with the sector supervisor and show up on its entity list, set up the four continuous duties (keep registration data current, incident reporting, supply-chain risk, supervision by the management body) and document the minimum. Using the shared Traficom notification form keeps the reporting path clean.
- Directive (EU) 2022/2555 (NIS 2): EUR-Lex
- Implementing Regulation (EU) 2024/2690
- Cybersecurity Act 124/2025 (Kyberturvallisuuslaki): Finlex
- Traficom: Finnish Transport and Communications Agency, official NIS 2 transposition page
- Kyberturvallisuuskeskus (NCSC-FI): national CSIRT and single point of contact
- Energiavirasto: sector supervisor for electricity, district heating and gas
- Tukes (Finnish Safety and Chemicals Agency): sector supervisor for oil, gas storage, hydrogen production, chemicals and parts of manufacturing
- European Commission reasoned opinion of 7 May 2025 on NIS 2 transposition
In practice
What the national law changes, and what it doesn't
The national law decides, among other things, where you register and whom you report incidents to. The measures themselves start from the same minimum list in every member state (Art. 21 NIS 2). The walkthrough takes you through them one step at a time:
Risk Management
Write down what your company has
A list of the processes, software and devices you work with.
Incident Handling
Plan what happens in an incident
Who decides, whom you call, how you reach each other.
Effectiveness Assessment
Record the management review
Management checks whether the measures work and approves your documents.
Been asked to handle NIS2?
In the end you have everything in one document: what is done, what is still open, and your management's approval with name and date. The app writes the texts.
