Do NIS2 and the Finnish Cybersecurity Act apply to us?

In brief

The Network and Information Security Directive (NIS2 Directive) and the Finnish Cybersecurity Act 124/2025 do not apply just because an organisation handles information systems. They apply when the organisation carries out an activity listed in Annex I or Annex II, meets the size rule, or falls under a size-independent critical service rule. A municipality is in scope only for the activities covered by those annexes. If the law applies, management must arrange and supervise cybersecurity risk management and must understand it well enough to do that work.

Scope starts from what you do, not from your organisation’s name

The practical question is not whether the organisation calls itself public, private, municipal, industrial or digital. The question is what service it provides and whether that service is covered by the legal scope.

The Cybersecurity Act 124/2025, section 1 says that the Act lays down rules on the management of cybersecurity risks. It also states that the Act implements the NIS2 Directive in Finland. For public administration in the sector referred to in Annex I, point 10 of the NIS2 Directive, the same section points to separate rules in the Act on Information Management in Public Administration.

The Cybersecurity Act 124/2025, section 3 gives the main scope test. An organisation is in scope when both conditions are met:

• it carries out an activity referred to in Annex I or Annex II, or is an entity referred to in those annexes;
• it meets or exceeds the conditions for medium-sized enterprises in the Commission recommendation referred to in the Act and provides services or carries out activities in a Member State of the European Union.

This means that the first check is the activity. The second check is size. A small supplier that does not fall under a special rule may be outside the Act, even if cybersecurity is still important for contracts and continuity.

Section 3 also contains size-independent rules. The Act applies regardless of size to providers of public electronic communications networks or publicly available electronic communications services, trust service providers, top-level domain registries and domain name system service providers. It can also apply regardless of size where the organisation carries out an Annex I or Annex II activity and its service is critical under the criteria in section 3.

Essential and important entities do not mean the same thing

The NIS2 Directive uses two categories: essential entities and important entities. The difference matters because it affects how the organisation is treated under the Directive. The basic cybersecurity duties are still serious for both categories.

A simple way to read the categories is this:

Category	Where the rule comes from	What it means in work
Essential entity	NIS2 Directive, Article 3	The organisation falls into a category that the Directive treats as more critical, such as certain Annex I entities above the relevant size threshold or certain digital trust and domain infrastructure actors.
Important entity	NIS2 Directive, Article 3	The organisation is an Annex I or Annex II entity in scope, but it is not classified as essential under Article 3.
Size-independent entity	Cybersecurity Act 124/2025, section 3 and NIS2 Directive, Article 2	The organisation may be in scope even below the size threshold because the law treats the service or role as critical.

The NIS2 Directive, Article 3 treats certain Annex I entities that exceed the medium-sized thresholds as essential entities. It also treats qualified trust service providers, top-level domain registries and domain name system service providers as essential regardless of size. Public administration bodies defined by national law as central government are also essential under Article 3.

Important entities are the remaining Annex I or Annex II entity types that are in scope but are not essential under Article 3. In practice, the label is not a reason to delay. Both categories need governance, risk management, incident handling and training.

A municipality is covered only in a limited way

A municipality should not read the Cybersecurity Act as applying automatically to everything the municipality does. The rule is narrower.

The Cybersecurity Act 124/2025, section 4 says that the Act applies to a municipality referred to in the Local Government Act only for activities referred to in Annex I or Annex II. In work terms, this means the municipality needs an activity-by-activity view. One activity may be in scope while another municipal function is outside this Act.

The NIS2 Directive, Article 2 also deals with public administration. It covers central public administration bodies defined by national law. It also covers regional public administration bodies defined by national law where a risk-based assessment shows that disruption of their services could have a significant impact on critical societal or economic activities. The same article allows Member States to apply the Directive to local public administration bodies.

For a Finnish municipality, the key point in the Cybersecurity Act is the limited wording in section 4. The legal analysis should therefore start from the concrete activity and the annexes, not from the word municipality.

If the law applies, management cannot outsource its responsibility

Cybersecurity is often delivered by information technology, suppliers and specialist teams. Responsibility under the law is broader than delivery.

The Cybersecurity Act 124/2025, section 10 says management is responsible for arranging the implementation and supervision of cybersecurity risk management. It also says management approves the cybersecurity risk management operating model and supervises its implementation. In everyday terms, the board, chief executive or comparable actual management cannot treat cybersecurity as only a technical task.

The same section says management must have sufficient familiarity with cybersecurity risk management. That does not mean every manager must configure systems. It means management must understand the risks, the controls and the consequences well enough to approve priorities and ask informed questions.

The NIS2 Directive, Article 20 adds two points. Management bodies approve cybersecurity risk management measures and supervise their implementation. Members of management bodies must also take part in training, and entities are encouraged to provide similar training regularly to employees so that they can identify risks and assess risk management practices and their effect on services.

For more on this training duty, see NIS2 and the Finnish Cybersecurity Act: management training and staff cyber hygiene.

Risk management is technical, operational and organisational

A risk is not only a hacker in a network. A risk can also be a missing backup, a supplier weakness, a weak access right, or a staff habit that makes an incident more likely.

The NIS2 Directive, Article 21 says essential and important entities must take appropriate and proportionate technical, operational and organisational measures. That wording matters. It means the organisation needs more than tools. It needs operating practices and responsibilities.

Article 21 lists the minimum areas that the measures must cover. They include:

• risk analysis and information system security policies;
• incident handling;
• business continuity, such as backup management, disaster recovery and crisis management;
• supply chain security;
• security in the acquisition, development and maintenance of network and information systems;
• policies and procedures for assessing the effectiveness of cybersecurity risk management measures;
• basic cyber hygiene practices and cybersecurity training;
• policies and procedures on cryptography and, where appropriate, encryption;
• human resources security, access control and asset management;
• where appropriate, multi-factor authentication, continuous authentication and secure communications.

This list is useful for management because it turns cybersecurity into a governance checklist. It also shows why staff behaviour matters. For staff-level basics, see What does the Cybersecurity Act require for staff training?.

A significant incident starts a reporting chain

An outage or attack becomes legally urgent when it seriously disrupts services, may cause financial loss, or may harm other people or organisations. The NIS2 Directive calls this a significant incident.

The NIS2 Directive, Article 23 says an incident is significant if it has caused or can cause serious operational disruption of services or financial losses for the entity. It is also significant if it has affected or can affect other natural or legal persons by causing considerable material or non-material damage.

The reporting timetable in Article 23 is strict:

• an early warning without undue delay and in any event within 24 hours after becoming aware of the incident;
• an incident notification without undue delay and in any event within 72 hours after becoming aware of the significant incident;
• an interim report if requested by the computer security incident response team or competent authority;
• a final report no later than one month after the incident notification;
• if the incident is still ongoing when the final report is due, a progress report at that time and a final report within one month after the incident has been handled.

Article 23 also says service recipients may need to be informed without undue delay when a significant incident is likely to adversely affect the provision of services to them. For a deeper look at the timetable, see What must be reported after a cybersecurity incident, and when?.

The limits of scope are as important as the duties

A credible scope review must also identify what the Act does not require. Otherwise the organisation may overstate duties in one area and miss the real duties in another.

The Cybersecurity Act 124/2025, section 4 sets several limits. Chapter 2 of the Act does not apply to activities or services provided for national defence, national security, public order and safety, or the prevention, investigation and prosecution of crimes. The Act does not apply to an entity that provides only those activities or services. The exception does not remove the Act from a trust service provider.

Section 4 also says the Act does not apply where the Annex I or Annex II activity is incidental and minor. It also says duties to provide information do not apply if disclosure would endanger national defence or national security or would be contrary to an important related interest.

The NIS2 Directive, Article 2 contains similar boundaries. It says the Directive does not apply to public administration bodies carrying out activities in national security, public security, defence or law enforcement. It also says the Directive does not affect the application of the General Data Protection Regulation.

The open point for many organisations is the match between their actual activities and Annex I or Annex II. That assessment should be documented. The law’s labels are not a substitute for the organisation’s own scope reasoning.

Cybersecurity also connects to data protection and artificial intelligence

Cybersecurity incidents often involve personal data. A personal data item is anything that identifies a person, such as a name in a customer register or an employee identifier in an access log. When cybersecurity work includes personal data, the General Data Protection Regulation still applies.

The NIS2 Directive, Article 2 says its application does not limit the General Data Protection Regulation. It also says personal data processed for the purposes of the Directive must be handled in accordance with the General Data Protection Regulation.

The General Data Protection Regulation, Article 39 gives the data protection officer tasks that include informing and advising the controller or processor and employees, monitoring compliance, awareness-raising and staff training connected to personal data protection. Article 83 sets administrative fine rules and thresholds, including up to 10,000,000 euros or two percent of annual worldwide turnover for certain obligations, and up to 20,000,000 euros or four percent for certain other infringements.

Artificial intelligence adds another layer. The Artificial Intelligence Act, Article 4 requires providers and deployers of artificial intelligence systems to take measures, to the best of their ability, to ensure sufficient artificial intelligence literacy for staff and others responsible for operation and use on their behalf. Article 99 sets penalty rules and includes thresholds of 35,000,000 euros or seven percent, 15,000,000 euros or three percent, and 7,500,000 euros or one percent, depending on the infringement category.

For related staff obligations, see What data protection skills does every employee need? and Article 4 of the AI Act: what your staff must know about AI.