AI disclosure requirements in Finland: what applies since 2 August 2026
The EU AI Act's transparency obligations are a Union-wide regulation, so the substance is the same in Finland as everywhere in the EU: from 2 August 2026, AI systems that interact with people must disclose they're AI, synthetic media must carry machine-readable marking, and deepfakes and certain AI-generated public-interest text must be labeled. What differs country by country is who enforces it, in what language your users encounter it, and how quickly complaints turn into questions.
Enforcement in Finland
Finland has chosen a decentralised model: the laws governing national authorities' AI Act powers entered into force on 1 January 2026, naming the Finnish Transport and Communications Agency (Traficom) as the single point of contact while spreading market-surveillance duties across ten-plus sector regulators, including the Safety and Chemicals Agency, Customs, the Occupational Safety and Health Authority, the Finnish Medicines Agency, the Energy Authority, the Data Protection Ombudsman, and the Financial Supervisory Authority, each within its own field. A new Sanctions Board operating alongside Traficom can impose fines above €300,000. The full framework, including remaining provisions, is expected in force by 2 August 2026 at the latest, the same date Article 50 itself starts applying, with the EU's overall penalty ceiling of €15 million or 3% of worldwide turnover.
The four duties, as they show up on your site
- Article 50(1): chatbot disclosure
- Any AI system interacting with visitors must make that clear no later than the first interaction, in a clear and distinguishable way.A line in your terms doesn't satisfy it.
- Article 50(2): machine-readable marking
- AI-generated audio, images, video, and text must be marked in a machine-readable, detectable format.For generative systems already on the market before 2 Aug 2026, this specific duty has a transition until 2 Dec 2026; the rest does not.
- Article 50(3): emotion recognition & biometric categorisation
- People exposed must be informed the system is operating.
- Article 50(4): deepfake and AI-text labels
- Visible disclosure for deepfakes, and for AI-generated or manipulated text published to inform the public on matters of public interest.
Finland-specific practicalities
- Finland's decentralised model means your sector decides your regulator, a generic consumer-facing chatbot most plausibly routes through Traficom as the single point of contact, but AI touching health, energy, or financial services answers to that field's specialist authority instead
- The dedicated Sanctions Board signals Finland is building real enforcement teeth (fines above €300,000) rather than treating this as a paperwork exercise
- The Data Protection Ombudsman is already competent for the personal-data dimension of any AI feature, independent of how the wider framework finishes rolling out
- Finnish users are broadly comfortable in English, but a .fi storefront served in Finnish should still disclose in Finnish, match the language of the interface, not just the market
Disclosure language should match your user-facing language. For a site serving Finland in Finnish, a first-message line such as "Keskustelet tekoälyavustajan kanssa" (you're chatting with an AI assistant) is the pattern to aim for, at first interaction, not tucked into käyttöehdot.
Common questions
Finland spreads supervision across many agencies, who do we contact?
Traficom is the designated single point of contact, so it's the right default entry point even though day-to-day supervision for your sector may sit with a specialist regulator. You don't need to pre-identify the exact agency to take the disclosure duty seriously.
Does the new Sanctions Board change the underlying rules?
No, it changes who can impose the fine and confirms Finland is resourcing enforcement, not what Article 50 requires. The substantive duties (chatbot disclosure, AI-content marking, deepfake labels) are the same EU-wide text.