Finland's EAA Penalty Has No Ceiling — and No Number Anyone Can Legitimately Quote
Section 14 is the entire penalty provision. It contains one sentence about a conditional fine and a cross-reference to a 1990 act, and no euro amount anywhere. The figures circulating for Finland — €150,000, €5,000–€50,000 — are not in the statute. And the absence is not a gap in the law; it is the mechanism.
Quick answer
Finland's EAA rules sit in Chapter 3a of the Act on the Provision of Digital Services (306/2019), in force for consumer services from 28 June 2025. The only sanction is an uhkasakko — a conditional fine — which Traficom may attach to a compliance order. The Act sets no amount, no ceiling and no schedule; the size is determined case by case under the general Act on Conditional Fines (1113/1990), which weighs the nature of the obligation and the obligor's ability to pay. The fine can be re-imposed until you comply. Physical products are not covered by this Act at all — they go to Tukes under separate legislation.
The whole penalty provision, in two sentences
« Valvontaviranomainen voi asettaa uhkasakon 12 §:n 3 momentissa tarkoitetun saavutettavuusvaatimusten noudattamista koskevan määräyksen sekä 13 §:n 1 ja 2 momentissa säädetyn tiedonsaanti- ja tarkastusoikeuden toteuttamisen tehosteeksi. Uhkasakosta säädetään uhkasakkolaissa (1113/1990). »
("The supervisory authority may impose a conditional fine to reinforce an order under section 12(3) concerning compliance with accessibility requirements, and to enforce the rights of access to information and inspection under section 13(1) and (2). The conditional fine is governed by the Act on Conditional Fines (1113/1990).")
— Act 306/2019, § 14 (Finlex)
That is it. No figure, no tier, no per-violation rate. And the order it reinforces is equally plain:
« Valvontaviranomainen voi määrätä: 1) …palveluntarjoajan saattamaan kohtuullisessa määräajassa digitaalisen palvelun vastaamaan 3 ja 3 a luvussa säädettyjä vaatimuksia »
("The supervisory authority may order: 1) …the service provider to bring the digital service into compliance with the requirements of Chapters 3 and 3a within a reasonable deadline")
— § 12(3)
The circulating figures aren't in the law
Two numbers appear in comparison tables for Finland. Neither is in Act 306/2019.
| Figure you'll see | Where it comes from | In the statute? |
|---|---|---|
| "Up to €150,000" | Compliance-vendor and legal-summary content | No |
| "€5,000–€50,000 per violation" | Comparison tables | No — no per-violation schedule exists |
There is a structural reason these keep appearing. A conditional fine has to be given an amount when it is imposed, so once Finnish cases start producing figures, real numbers will exist — they simply won't be statutory maximums, they'll be case outcomes. A Finnish "maximum" quoted today has no source in the law.
Why no ceiling is worse than a high one
The instinct is to read "no fixed fine" as leniency. For Finland it is the opposite, for three reasons.
It scales to you. The size is set under the general Act on Conditional Fines, which requires the authority to weigh the nature and extent of the obligation and — critically — the obligor's ability to pay. A ceiling that would be punishing for a small retailer would be a rounding error for a large bank, so the mechanism doesn't set one. A large company cannot look up its worst case; the worst case is calibrated to the company.
It repeats. An uhkasakko is a compliance-forcing instrument, not a punishment for a past act. If the deadline passes, the fine is imposed and enforced — and a further one can be set. There is no point at which you have "paid for" the breach and can carry on.
There is no number to risk-price. A jurisdiction with a €10,000 ceiling invites a calculation: what does compliance cost against the maximum exposure? Finland removes that calculation entirely. That is a more credible deterrent than many of the fixed-ceiling regimes in this series, despite having no headline figure at all — and it is why grouping Finland with Denmark, Greece, Malta and Spain as "no fixed fine" countries obscures more than it explains.
The regulator changed in January 2025
Traficom — the Finnish Transport and Communications Agency, through its Digital Accessibility Supervision unit — became the supervisory authority for both the public-sector track and the Chapter 3a consumer-services track on 1 January 2025. Before that, supervision sat with a Regional State Administrative Agency (AVI).
A number of guides and vendor pages still name AVI. They are out of date. If your Finnish compliance documentation names the wrong regulator, so does your escalation plan.
Traficom's powers under § 13 are substantial: notwithstanding confidentiality rules and free of charge, it can obtain the information and clarifications it needs, set the deadline and format for delivery, and order an inspection at the provider's premises — excluding permanent dwellings. Providers must, on request, grant the access rights needed to extend an inspection to network-restricted services. Traficom may bring in outside experts, who become subject to civil-service conduct and criminal-liability rules.
Products are not in this Act
This trips people up. Act 306/2019 covers digital services only.
| Area | Authority | Law |
|---|---|---|
| Digital services (Chapter 3a) | Traficom | Act 306/2019 |
| Physical products — consumer hardware, self-service and payment terminals, e-readers | Tukes (Finnish Safety and Chemicals Agency) | Act 102/2023 on accessibility requirements for certain products, with market surveillance under Act 1137/2016 |
| 112 emergency number | Ministry of the Interior | — |
So "the Finnish EAA penalty" is not a single thing: a business selling both a device and an online service answers to two authorities under two statutes with two different enforcement toolkits. Any single figure quoted for Finland is, at best, describing one of them.
The individual right that doesn't need a regulator
Section 10 gives users a direct, individually enforceable route that operates independently of Traficom:
« Jos digitaalisen palvelun käyttäjä tarvitsee etujensa, oikeuksiensa tai velvollisuuksiensa selvittämiseksi tai toteuttamiseksi digitaalisesta palvelusta sellaista sisältöä, joka ei täytä saavutettavuusvaatimuksia, käyttäjällä on oikeus saada nämä sisällöt perustellusta syystä yksittäistapauksessa saavutettavuusvaatimukset täyttävässä muodossa »
("If a user of a digital service needs, in order to establish or exercise their interests, rights or obligations, content from the service that does not meet the accessibility requirements, the user has the right to receive that content, for a justified reason in an individual case, in a form meeting the accessibility requirements.")
— § 10(2)
And the clock is short:
« Palveluntarjoajan on vastattava palautteisiin ja pyyntöihin viipymättä, mutta viimeistään kahden viikon kuluessa yhteydenotosta. »
("The service provider must respond to feedback and requests without delay, and at the latest within two weeks of being contacted.")
— § 10(3)
Two weeks, extendable by two more with notice. A refusal must come as a written, reasoned certificate — and Traficom can be asked to review it, with a formal decision and a right of appeal. Compare Poland, where an unanswered complaint is deemed granted after 30 days: Finland's version is shorter, requires reasons, and routes to a regulator.
Micro-enterprises are out entirely
« Tätä lukua ei sovelleta digitaalisiin palveluihin, joita tuottavat eräiden tuotteiden esteettömyysvaatimuksista annetun lain (102/2023) 4 §:n 2 kohdassa tarkoitetut mikroyritykset. »
("This Chapter does not apply to digital services produced by micro-enterprises as referred to in section 4(2) of the Act on Accessibility Requirements for Certain Products (102/2023).")
— § 10b
A clean, complete exclusion from Chapter 3a — no documentation duty, no notification duty, nothing.
Has it been enforced yet?
No conditional fines have been reported under Chapter 3a. But Finland has more enforcement machinery already running than most member states, because its public-sector track has been operating since 2019.
Traficom's published monitoring programme runs at roughly 20 websites and 12 mobile applications reviewed comprehensively each year, plus around 240 sites by simplified review, with samples weighted by input from disability organisations and required to carry over at least 10% of previously monitored services. The escalation path is administrative guidance first, then formal supervision, with the conditional fine as a last resort.
Since 28 June 2025, Traficom has also been accepting operators' own non-compliance notifications: where a provider can't meet a requirement and isn't invoking a documented exemption, it must self-report with a corrective timetable.
What this means for your business
Stop looking for the number — it doesn't exist, and the ones you'll find aren't in the law. Plan instead around three things:
- The order is the event. Nothing costs money until Traficom orders compliance and you miss the deadline. Everything before that is guidance and correspondence.
- Two weeks is the real deadline. The § 10 individual request runs on a two-week clock, needs a reasoned written refusal, and is appealable — and it doesn't wait for a regulator to take an interest.
- Check which authority you're dealing with. Digital services: Traficom, since January 2025, not AVI. Products: Tukes, under a different act. Emergency communications: the Ministry of the Interior.
And if you took outside funding — public or private, beyond your own resources — specifically to improve accessibility, the disproportionate-burden exemption is closed to you, the same funding trap that appears in Poland, Luxembourg and Denmark.
Frequently asked questions
What is the EAA fine in Finland?
There is no stated amount. Section 14 allows only a conditional fine (uhkasakko) to reinforce a compliance order, sized case by case under the Act on Conditional Fines (1113/1990).
Is the €150,000 figure real?
No. It appears in secondary compliance content and has no basis in Act 306/2019. Nor does the €5,000–€50,000 per-violation range.
So is Finland low-risk?
Not in the way "no fine" suggests. The amount is set with regard to your ability to pay, and the fine can be re-imposed until you comply — so there is no maximum and no point at which the breach is paid off.
Who is the regulator?
Traficom, for digital services, since 1 January 2025 — not AVI, which older sources still name. Products go to Tukes; the 112 number goes to the Ministry of the Interior.
What must I do if a user asks for content in an accessible format?
Respond within two weeks (extendable by two more with notice), and if you refuse, issue a written reasoned certificate. Section 10.
Related
- ← Back to EAA Fines by Country — the full 27-state comparison
- Official text: Laki digitaalisten palvelujen tarjoamisesta 306/2019 and Laki eräiden tuotteiden esteettömyysvaatimuksista 102/2023 (Finlex)
- Estonia's EAA penalty — the other coercive-fine regime, but capped at €10,000
- Sweden's EAA fines — the neighbouring market that has both a sanction fee and a vite
- Denmark's EAA fine — a different kind of "no figure": a criminal fine set by the courts
