Where we work · Finland
ISO and GRC certification consulting in Finland
Achieve ISO and GRC certification in Finland with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 22 standards, one team
- Accredited certification route
- Enschede office team
- Effivity and Academy included
Sectors that ask for certification in Finland
Clients include
ISO and GRC certification in Finland at a glance
Finnish demand for ISO and GRC work comes from a cybersecurity regime that is already in force and from exporters whose buyers ask for evidence. The Cybersecurity Act, Kyberturvallisuuslaki 124/2025, implements NIS2 and entered into force on 8 April 2025, with seven sector authorities supervising and Traficom's National Cyber Security Centre as the single point of contact. The Data Protection Ombudsman supervises the GDPR under the Data Protection Act. Fimea oversees medical devices, the Finnish Food Authority expects HACCP-based own-check, the Energy Authority enforces energy audits for large enterprises, and the Act on Public Procurement and Concession Contracts sets rules for asking tenderers for quality and environmental certificates. FINAS, part of Tukes, is the national accreditation body and an EA MLA signatory, and only accredited certification bodies issue certificates. Demand is strongest in machinery and metals, forest and paper, shipbuilding, ICT, food, energy and life sciences. Sterling serves Finnish clients from its Enschede office, drawing on 8,100+ client engagements in 60+ countries and 20+ years of experience, with Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in Finland
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Finland (10)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| General Data Protection Regulation (GDPR) and the Data Protection Act (tietosuojalaki, 1050/2018) The Data Protection Ombudsman (tietosuojavaltuutettu) — the Act names the Ombudsman as the national supervisory authority under the GDPR, working in the administrative branch of the Ministry of Justice | The Act sets the age limit for consent to information society services offered directly to a child at the age of 13, lists national derogations for special categories of data in areas such as healthcare, social welfare, insurance and research, and sends workplace data questions to the Act on the Protection of Privacy in Working Life (759/2004). The Data Protection Ombudsman exercises the tasks and powers in Articles 55-59 of the GDPR, represents Finland in the European Data Protection Board. Administrative fines under Article 83 are imposed by a collegial body made up of the Ombudsman and the Deputy Ombudsmen. | |
| Accreditation of GDPR certification bodies The Data Protection Ombudsman | The Ombudsman's own duties page lists encouraging the adoption of certificates, accrediting certification bodies and revoking issued certificates. A GDPR certificate is a separate thing from an ISO management system certificate and does not replace the controller's or processor's responsibility. | |
| Seven supervisory authorities named in the Cybersecurity Act, split by sector: the Finnish Transport and Communications Agency Traficom (digital infrastructure, ICT service management and several other sectors), the Energy Authority (Energiavirasto), the Finnish Safety and Chemicals Agency Tukes, the Social and Health Services licensing and supervisory authority (Sosiaali- ja terveysalan lupa- ja valvontavirasto), the South Savo Centre for Economic Development, Transport and the Environment, the Finnish Food Authority (Ruokavirasto) and the Finnish Medicines Agency Fimea (Lääkealan turvallisuus- ja kehittämiskeskus). Traficom's National Cyber Security Centre Finland acts as the single point of contact. Essential and important entities under the national cybersecurity regime (the NIS2 transposition), and public administration | Kyberturvallisuuslaki (124/2025), the Cybersecurity Act, published in the Statute Book of Finland on 7 April 2025, which implements Directive (EU) 2022/2555 and entered into force on 8 April 2025 under its final section. It requires entities to identify, assess and manage risks to their networks and information systems, keep a cybersecurity risk management procedure and apply proportionate measures that cover, among other things, supply-chain security, business continuity and crisis management, access control, cryptography, incident handling and staff training. Supervisors may issue technical regulations in their sectors. Public administration is covered through the Act on Information Management in Public Administration (906/2019) as amended by Act 125/2025. Traficom's recommendation to supervisors, issued on 8 April 2025, names ISO/IEC 27001 among the standards and assessment tools it draws on, and states that following it or the standards it mentions does not by itself guarantee compliance; the standards serve as examples and there is no obligation to use them. | ISO/IEC 27001 |
| Finanssivalvonta (the Financial Supervisory Authority, FIN-FSA), the supervisor of the Finnish financial sector Financial entities (banks, insurers, investment and payment firms in DORA's scope) | Regulation (EU) 2022/2554 (DORA), which applies from 17 January 2025 according to its final article. FIN-FSA's 2024 annual report describes DORA as harmonising requirements for the digital resilience of the financial sector across the EU. DORA covers ICT risk management, incident reporting, resilience testing and ICT third-party risk. It does not name ISO/IEC 27001 or ISO 22301. | |
| Fimea, the Finnish Medicines Agency Medical device manufacturers, authorised representatives, importers and distributors | Regulations (EU) 2017/745 and 2017/746, the Medical Devices Act (719/2021) and Fimea's Administrative Regulation 2/2021. Fimea says an operator liable to submit a notification must notify it before supplying devices to the market, through either the CERE or the EUDAMED register, and that importers link themselves to the manufacturer whose devices they import. Fimea is also Finland's designating and supervising authority for notified bodies. The pages do not name ISO 13485. | |
| The Finnish Food Authority (Ruokavirasto) Food business operators | Own-check (omavalvonta). The Authority describes own-check as a permanent system based on the HACCP principles, built from good hygiene practices with a support system, sector best practices or all seven HACCP principles, or a combination. A written plan is required, kept up to date and backed by records, although very small businesses may present it verbally. The Authority assesses sector instructions and operators' own-check plans. The page does not mention third-party certificates. From 1 January 2026 the Authority has also taken over the Regional State Administrative Agencies' tasks on animal health and welfare and food. | HACCP |
| The Energy Authority (Energiavirasto) Large enterprises (energy audits) | Energy Efficiency Act (energiatehokkuuslaki, 1429/2014). The Authority says the Act obligates large enterprises to carry out an energy audit and that it manages and enforces the mandatory audits. Its audits page does not mention ISO 50001 or ISO 14001. | |
| The occupational safety and health authorities (Tyosuojelu.fi, the Occupational Safety and Health Administration) Employers (occupational safety and health) | Occupational Safety and Health Act (738/2002; amendments up to 222/2023 in the Ministry translation). Section 8 sets the employer's general duty to take care of employees' safety and health, with principles for choosing measures, and section 10 refers to the assessment of hazards at work. The Administration's employer page says employers are responsible for all occupational safety and health activities of the workplace. Neither source names ISO 45001. | |
| The Office of the Chancellor of Justice, which runs the centralised external reporting channel under the Whistleblower Act Organisations with whistleblowing channels and compliance programmes | The national Whistleblower Act, based on the EU whistleblower directive. The Chancellor of Justice's page says reports received by the central channel are passed to the competent authority, and that a breach found in an organisation should primarily be reported through the organisation's internal reporting channel. The page does not name ISO 37001, ISO 37301 or ISO 37002. | |
| National market surveillance authorities and authorities overseeing fundamental rights, with powers set by national acts under the EU Artificial Intelligence Act Providers and deployers of AI systems | The Finnish Government reports that the acts regulating the powers of the national authorities supervising the EU Artificial Intelligence Act were approved by the President on 22 December 2025 and enter into force on 1 January 2026. The announcement does not name ISO/IEC 42001. |
Accreditation and recognition
- FINAS (Finnish Accreditation Service): National accreditation body — FINAS describes itself as the national accreditation body in Finland and says it is the Accreditation Department within the Finnish Safety and Chemicals Agency (Tukes); it accredits laboratories, certification bodies, inspection bodies, providers of proficiency testing and environmental and greenhouse gas verifiers.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Act on Public Procurement and Concession Contracts (1397/2016) (Contracting entities; the Ministry of Economic Affairs and Employment is named in the Act for the e-Certis certificate directory): The Act lets a contracting entity ask tenderers for certificates from conformity assessment bodies as proof of requirements, and equivalent certificates must be accepted. When it asks for certificates from independent bodies on environmental management, it must refer to the EU eco-management and audit scheme (EMAS), recognised environmental management systems or environmental management standards certified by recognised institutions. When it asks for quality assurance certificates, it must refer to quality assurance systems based on the relevant European standards series and certified by conforming bodies. It must accept corresponding certificates from other EU Member States and other evidence where a tenderer could not obtain a certificate in time for reasons beyond its control. Mandatory exclusion grounds include final convictions for bribery and bribery in business. Each tender sets its own criteria.
Economic zones
- Finland's export manufacturing base: transport equipment and ships, industrial and electrical machinery, metal products, forest industry, paper and pulp, chemicals, pharmaceuticals
- Business Finland and Invest in Finland: investment promotion, export and innovation funding, advisory and networking services
Sterling in Finland
Sterling delivers in Finland from its Enschede office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Finland clients ask
Are certification audits in Finland conducted in Finnish or English?
Both are possible; the certification body agrees the language with you when you apply. Finnish and Swedish are the national languages, with English common in commercial settings. Decide early what language the audit team and the controlled documents will use, bearing in mind any rule in a client contract or an official procedure, so the right auditors can be assigned.
Who supervises the GDPR in Finland?
Finland's national supervisory authority for the GDPR is the Data Protection Ombudsman, as the Data Protection Act provides. The Ombudsman sits in the Ministry of Justice's administrative branch, represents Finland in the European Data Protection Board and, together with the Deputy Ombudsmen, decides administrative fines. For a concrete case, contact the Office or consult counsel.
Has Finland transposed the NIS2 Directive?
Yes. The Cybersecurity Act (Kyberturvallisuuslaki, 124/2025) implements Directive (EU) 2022/2555 and entered into force on 8 April 2025. Supervision is split between seven sector authorities, with Traficom's National Cyber Security Centre as the single point of contact. Confirm which authority covers your sector with that authority or your counsel.
Which body accredits certification bodies in Finland?
FINAS, the Finnish Accreditation Service, is the national accreditation body and sits within the Finnish Safety and Chemicals Agency Tukes. It states that it signed the EA MLA for management system certification and other scopes. Accreditation is granted by scope, so check your certification body's FINAS scope for your standard and sector before you apply.
Does a Finnish food business need a HACCP certificate?
The Finnish Food Authority asks food businesses for own-check, a permanent system based on the HACCP principles with a written plan and records. Its guidance does not mention third-party certificates, so a certificate becomes relevant when a customer or retailer asks for one. Confirm requirements for your activity with the Authority or the municipal food control.
Can Finnish public tenders require ISO certificates?
Yes, within limits. The public procurement Act lets contracting entities request quality assurance or environmental management certificates from independent bodies, but they must refer to recognised systems, accept corresponding certificates from other EU Member States and accept other evidence if a tenderer could not obtain one in time. Each tender sets its own criteria, so read the tender documents.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- General Data Protection Regulation (GDPR) and the Data Protection Act (tietosuojalaki, 1050/2018) — finlex.fi; tietosuoja.fi (accessed 18 Oct 2026)
- Accreditation of GDPR certification bodies — finlex.fi; tietosuoja.fi (accessed 18 Oct 2026)
- Kyberturvallisuuslaki (124/2025), the Cybersecurity Act, published in the Statute Book of Finland on 7 April 2025, which implements Directive (EU) 2022/2555 and entered into force on 8 April 2025 under its final section. It requires entities to identify, assess and manage risks to their networks and information systems, keep a cybersecurity risk management procedure and apply proportionate measures that cover, among other things, supply-chain security, business continuity and crisis management, access control, cryptography, incident handling and staff training. Supervisors may issue technical regulations in their sectors. Public administration is covered through the Act on Information Management in Public Administration (906/2019) as amended by Act 125/2025. Traficom's recommendation to supervisors, issued on 8 April 2025, names ISO/IEC 27001 among the standards and assessment tools it draws on, and states that following it or the standards it mentions does not by itself guarantee compliance; the standards serve as examples and there is no obligation to use them. — finlex.fi; traficom.fi; kyberturvallisuuskeskus.fi (accessed 18 Oct 2026)
- Regulation (EU) 2022/2554 (DORA), which applies from 17 January 2025 according to its final article. FIN-FSA's 2024 annual report describes DORA as harmonising requirements for the digital resilience of the financial sector across the EU. DORA covers ICT risk management, incident reporting, resilience testing and ICT third-party risk. It does not name ISO/IEC 27001 or ISO 22301. — eur-lex.europa.eu; finanssivalvonta.fi (accessed 18 Oct 2026)
- Regulations (EU) 2017/745 and 2017/746, the Medical Devices Act (719/2021) and Fimea's Administrative Regulation 2/2021. Fimea says an operator liable to submit a notification must notify it before supplying devices to the market, through either the CERE or the EUDAMED register, and that importers link themselves to the manufacturer whose devices they import. Fimea is also Finland's designating and supervising authority for notified bodies. The pages do not name ISO 13485. — fimea.fi (accessed 18 Oct 2026)
- Own-check (omavalvonta). The Authority describes own-check as a permanent system based on the HACCP principles, built from good hygiene practices with a support system, sector best practices or all seven HACCP principles, or a combination. A written plan is required, kept up to date and backed by records, although very small businesses may present it verbally. The Authority assesses sector instructions and operators' own-check plans. The page does not mention third-party certificates. From 1 January 2026 the Authority has also taken over the Regional State Administrative Agencies' tasks on animal health and welfare and food. — ruokavirasto.fi (accessed 18 Oct 2026)
- Energy Efficiency Act (energiatehokkuuslaki, 1429/2014). The Authority says the Act obligates large enterprises to carry out an energy audit and that it manages and enforces the mandatory audits. Its audits page does not mention ISO 50001 or ISO 14001. — energiavirasto.fi (accessed 18 Oct 2026)
- Occupational Safety and Health Act (738/2002; amendments up to 222/2023 in the Ministry translation). Section 8 sets the employer's general duty to take care of employees' safety and health, with principles for choosing measures, and section 10 refers to the assessment of hazards at work. The Administration's employer page says employers are responsible for all occupational safety and health activities of the workplace. Neither source names ISO 45001. — finlex.fi; tyosuojelu.fi (accessed 18 Oct 2026)
- The national Whistleblower Act, based on the EU whistleblower directive. The Chancellor of Justice's page says reports received by the central channel are passed to the competent authority, and that a breach found in an organisation should primarily be reported through the organisation's internal reporting channel. The page does not name ISO 37001, ISO 37301 or ISO 37002. — oikeuskansleri.fi (accessed 18 Oct 2026)
- The Finnish Government reports that the acts regulating the powers of the national authorities supervising the EU Artificial Intelligence Act were approved by the President on 22 December 2025 and enter into force on 1 January 2026. The announcement does not name ISO/IEC 42001. — valtioneuvosto.fi (accessed 18 Oct 2026)
- FINAS (Finnish Accreditation Service) — finas.fi; european-accreditation.org; sfs.fi (accessed 18 Oct 2026)
- Act on Public Procurement and Concession Contracts (1397/2016) — finlex.fi (accessed 18 Oct 2026)
- Finland's export manufacturing base — tilastot.tulli.fi (accessed 18 Oct 2026)
- Business Finland and Invest in Finland — businessfinland.fi (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the Enschede team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
netherlands@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice