Government proposes new act to guide improvement of resilience and protection of infrastructure critical to functioning of society

On 19 December, the Government submitted to Parliament a proposal for an act on the protection of infrastructure critical to society and on the improvement of resilience. The new act will strengthen society's resilience and national security in accordance with the Government Programme.

The act will transpose the Directive of the European Parliament and of the Council on the resilience of critical entities into national law. The Directive introduces new requirements for Finland, including new official duties related to the identification and supervision of entities that provide vital services to society, known as critical entities.

The Critical Entities Resilience Directive (CER Directive) will improve the resilience and reliability of critical services in the EU's internal market. The aim is to harmonise the identification of critical entities, the resilience procedures and assessment criteria in the EU, and to establish clear procedures for cooperation between Member States.

“Cooperation between the EU Member States in protecting critical infrastructure also supports Finland’s own preparedness and complements the national work on security of supply. The dramatic changes in the security environment have further increased the need to improve the resilience of society in general,” says Minister of the Interior Mari Rantanen.

The scope of the act and Directive covers eleven sectors: energy, transport, banking, financial market infrastructure, health, food, drinking water, waste water, digital infrastructure, public administration, and space.

New obligations for companies and other entities providing vital services

The proposed act, prepared under the leadership of the Ministry of the Interior, defines the arrangements for official activities, and common requirements, criteria and key obligations concerning all entities. According to the proposal, the Ministry of the Interior would function as the coordinating ministry. New tasks are proposed for ministries responsible for the relevant sectors, other authorities, and companies identified as critical during 2026. The ministries would be responsible for identifying and defining the critical entities under the Directive.

Critical entities, such as companies providing vital services, would be supervised by supervisory authorities appointed from the administrative branches of the ministries. In due course, new obligations on the protection of critical infrastructure will be imposed on entities identified as critical entities. The Directive provides a more specific schedule for imposing the obligations. These obligations relate to risk assessment, a resilience plan, ensuring resilience and procedures for incidents.

Inquiries:
Eero Kytömaa, Ministerial Adviser, Ministry of the Interior, tel. +358 295 488 280, [email protected] 
Johanna Hakala, Senior Ministerial Adviser, Ministry of the Interior, tel. +358 295 488 452, [email protected]