CRA Compliance in Finland

Traficom's NCSC-FI is designated as Finland's national competent authority for the CRA, building on its existing mandate as the national authority for the NIS2 Directive and network equipment certification. Finnish Customs and Tukes (Finnish Safety and Chemicals Agency) coordinate on market surveillance for products entering the Finnish market. Finland has a significant technology manufacturing base, including Nokia and its supply chain, as well as industrial automation manufacturers — all within the CRA's product scope. NCSC-FI participates actively in ENISA's CRA technical working groups and publishes implementation guidance in Finnish and English.

Finnish manufacturers submit Article 14 notifications to NCSC-FI through Traficom's secure incident reporting portal. NCSC-FI maintains a 24/7 duty function for critical cybersecurity incidents. The CRA Article 14 obligation requires an early warning within 24 hours of discovering active exploitation and a full notification within 72 hours. Finland's existing NIS2 incident reporting infrastructure — one of the most developed in the Nordics — provides the operational backbone for CRA Article 14 notifications. NCSC-FI coordinates with ENISA and the EU CSIRTs network and publishes anonymised incident data in its annual reports.

Traficom coordinates market surveillance with Tukes (chemicals and product safety) and Finnish Customs for imported products. For CRA violations, Finland will implement the full penalty regime: up to €15 million or 2.5% of global annual turnover for breaches of essential cybersecurity requirements. Finland's regulatory enforcement culture tends toward cooperative compliance, with formal penalties reserved for cases of wilful non-compliance or significant consumer harm. Manufacturers should maintain comprehensive technical documentation as Traficom may request this as a first step in any surveillance inquiry.

NCSC-FI publishes free cybersecurity guidance in Finnish and English, including sector-specific implementation guides for manufacturing industries. Traficom operates the Cyber Security Label scheme for consumer IoT products, providing a market-recognised certification that maps to CRA Annex I requirements. Business Finland supports R&D and cybersecurity capability development for manufacturers through innovation grants. The VTT Technical Research Centre of Finland provides accredited conformity assessment and testing services for CRA product evaluations. The Finnish Standards Association (SFS) publishes national adoptions of IEC and ETSI standards relevant to CRA compliance.