Government proposes amendments to Cybersecurity Act regarding critical entities  

On 10 April 2025, the Government submitted a legislative proposal to Parliament on complementing the national implementation of the Directive on the resilience of critical entities (CER) and the Directive on measures for a high common level of cybersecurity across the Union (NIS 2).

As a result of the amendments, the Cybersecurity Act would also apply to entities that will in future be identified as critical entities under the proposed act on the protection of infrastructure critical to society and on the improvement of resilience. With regard to public administration, similar amendments are proposed to the Act on Information Management in Public Administration. 

With the amendments, companies identified as critical entities would be subject to the obligations laid down in the Cybersecurity Act even if they were not included in the scope of application of the Act before they were identified as critical entities.  These companies could include small or micro enterprises in all sectors as well as public transport operators and pharmaceutical wholesalers.

Parliament will also discuss a proposal for an act on the protection of infrastructure critical to society and on the improvement of resilience. The act would lay down provisions on the identification of critical entities and on the obligations provided for them in the CER Directive. Critical entities under the CER Directive should be identified for the first time by July 2026.

The Cybersecurity Act entered into force on 8 April 2025. Due to technical reasons related to the legislation process, the Government submitted a separate proposal on supplementing the implementation of the Directives. It is proposed that the amendments to the Cybersecurity Act enter into force at the same time as other legislation on the implementation of the CER Directive.

What’s next?

A referral debate on the Government proposal now submitted to Parliament will be held in a Parliament plenary session. The date of the session will be announced on the Parliament website (upcoming plenary sessions). 

After the referral debate, a parliamentary committee will discuss the proposal and draft a report. Parliament will then debate the matter again in a plenary session.

Inquiries:

Veikko Vauhkonen, Senior Specialist, tel. +358 29 534 2168, veikko.vauhkonen@gov.fi