AI governance software from Finland

Last reviewed: 28 September 2026

This page explains regulation and good practice as of 28 September 2026. It is not legal advice; have your own counsel review how the rules apply to your company. No software makes a company compliant on its own.

Are there AI governance tools, and which kind do you need?

Yes. AI governance tools fall into a few kinds, and the right one depends on whether you build AI systems or mainly use AI tools such as ChatGPT and Copilot.

Most small and mid-sized Finnish companies are deployers under the EU AI Act: they use AI rather than build it. For them the first questions are practical: which tools are in use, what the rules are, and who has been trained.

Who supervises the EU AI Act in Finland?

Supervision is split across several authorities. Traficom is the single point of contact and supervises the transparency obligations, the Data Protection Ombudsman supervises prohibited AI practices, and sector authorities supervise high-risk AI systems in their own fields.

Finland's national act on the supervision of certain AI systems (Laki eräiden tekoälyjärjestelmien valvonnasta, 1377/2025) entered into force on 1 January 2026. According to the Data Protection Ombudsman's release of 7 January 2026, supervision is shared among 15 authorities.

What is still open. A second implementing bill (TEM091:00/2024) covers AI regulatory sandboxes, a national register of high-risk AI systems in critical infrastructure and other provisions. On 28 September 2026 the Ministry of Economic Affairs and Employment lists it in further drafting, with an estimated presentation to Parliament in week 43 of 2026 and intended entry into force on 1 March 2027. Act 1377/2025 does not name a specific authority for AI literacy (Article 4); the European Commission says national market surveillance authorities supervise it from August 2026. Check the ministry's project page for updates.

What does the AI Act require from a Finnish company that uses AI tools?

For most companies using ChatGPT, Copilot or similar tools, the duties are AI literacy measures, avoiding prohibited practices and, in some cases, transparency. Heavier duties apply only to high-risk uses such as recruitment.

• AI literacy (Article 4), since 2 February 2025. Providers and deployers must take measures to support the AI literacy of their staff. The Digital Omnibus on AI, in force since 27 July 2026, kept the duty but removed the requirement to ensure a specific level. The Commission says an internal record of training is enough and no certificate is needed.
• Prohibited practices (Article 5), since 2 February 2025. They include emotion recognition in the workplace, except for medical or safety reasons. In Finland, the Data Protection Ombudsman supervises these.
• Transparency (Article 50), since 2 August 2026. Deployers must disclose deepfakes and AI-generated text published to inform the public on matters of public interest, unless a person has reviewed it and holds editorial responsibility. Traficom published guidance on 20 August 2026 and advises treating transparency as part of normal AI governance.
• High-risk uses (Article 26). Deployers of high-risk systems must follow the instructions for use, assign human oversight, monitor the system, keep logs for at least six months and inform workers before workplace use. After the Omnibus, most Annex III high-risk obligations apply from 2 December 2027.

What Finnish rules apply when you monitor employees' AI use?

Finnish working-life privacy law applies on top of GDPR. Technical monitoring and the use of email and networks go through the co-operation procedure before you introduce them.

Section 21 of the Act on the Protection of Privacy in Working Life (759/2004) puts the purpose, introduction and methods of technical monitoring, and the use of email and data networks, into the co-operation procedure. Afterwards the employer must define the purpose and methods and inform employees. The Data Protection Ombudsman's guidance on AI and data protection also stresses assessing risks before processing and doing a data protection impact assessment when new technology is used.

Monitoring that records tool names and rule events, rather than full prompts, is easier to justify under GDPR's data minimisation principle. Involve your employee representatives and data protection officer early.

How does VAHTOR differ from Saidot, SAS and EQS?

They solve different problems. Saidot, SAS Viya and EQS Privacy Cockpit govern AI systems, models and privacy risk across an organisation; VAHTOR governs how employees use AI tools in the browser.

When VAHTOR is not the right fit. If you build or buy AI systems that need model risk assessment, bias testing, drift monitoring or fundamental rights impact assessments, a platform such as Saidot, SAS Viya or EQS is designed for that work and VAHTOR is not. VAHTOR also covers only Chrome and Edge on devices with its extension; desktop AI apps, mobile devices and other browsers are outside its reach.

What does VAHTOR do for a Finnish company?

VAHTOR gives you the day-to-day records of workplace AI use: what is used, what is allowed, who accepted the policy and who completed training. Checks run on the device, and prompt and chat text are not sent.

• AI tool inventory and decisions. See which AI tools people use and approve, restrict or block each one; devices pick up the decision on the next sync.
• AI policy and acceptance. Publish a company AI policy from a template and track who accepted the current version.
• AI literacy records. A course with modules and a quiz; the owner sets the pass mark and completions are recorded per person.
• Browser data rules (Business plan). Rules can block PDFs, Excel and office files attached to AI tools; credentials and secrets are flagged on the device.
• Privacy by design. The workspace sees tool name, time, detection type, risk level, and policy and training records. Data is aggregated by default and names appear only if the owner turns identifiers on.
• Language. The website and guides are available in English and Finnish.

What does VAHTOR cost?

Prices are published in euros and exclude VAT. Annual billing is 20% cheaper.

Starter includes discovery and inventory, AI policy setup, EU AI Act basic reporting, approve, restrict or block, and acceptance tracking. Business adds real-time DLP, AI literacy training tracking, high-risk flagging and SAML SSO. VAHTOR does not require Microsoft 365 E5 or a proxy.