Does Finland have a post-quantum cryptography (PQC) law?

No. Nothing published for Finland carries statutory force for post-quantum cryptography as of this page's last review. What exists is non-binding guidance, set out with its primary sources below. The lead body is National Cyber Security Centre Finland (Kyberturvallisuuskeskus), under Traficom.

What is Finland's PQC migration deadline?

2030. See the sources below for what this deadline actually covers, since it may apply only to specific sectors or system types. The deadline came from National Cyber Security Centre Finland (Kyberturvallisuuskeskus), under Traficom.

Does Finland require a Cryptographic Bill of Materials (CBOM)?

Implicitly. The sources imply organizations will need a cryptographic inventory to comply, without naming CBOM as a formal requirement.

FIGuidance

Finland

Finland's National Cyber Security Centre (Kyberturvallisuuskeskus, under Traficom) publishes a PQC transition guide reproducing the EU NIS Cooperation Group's roadmap -- high-risk systems migrated by end-2030, medium/low-risk systems by end-2035 -- and recommends organizations build a cryptographic inventory as an immediate first step, but the guide is explicitly advisory, not a Finnish regulatory mandate.

Finland's post-quantum cryptography posture is classified as guidance, led by National Cyber Security Centre Finland (Kyberturvallisuuskeskus), under Traficom, with a migration target of 2030. It scores 41/100 on this tracker's rubric, a moderately binding rule, with real gaps in scope or enforcement, and that is not a measure of how secure or advanced the country actually is.

What's verified

Finland's National Cyber Security Centre (Kyberturvallisuuskeskus), part of the transport and communications regulator Traficom, publishes a dedicated guide, "Siirtymä kvanttiturvallisiin salausmenetelmiin" (Transition to quantum-safe encryption methods), under its guides-and-instructions section for organizations and companies. The guide explains that the timeline it presents comes from the EU's NIS Cooperation Group roadmap, not a Finland-specific mandate:

"Tällä sivulla kuvataan EU:n NIS-yhteistyöryhmän hahmottelema siirtymän tiekartta (EU PQC Roadmap)." ("This page describes the transition roadmap outlined by the EU's NIS Cooperation Group (EU PQC Roadmap).")

That roadmap sets concrete years: preparations "heti" (immediately) to build visibility into current cryptography and identify key risks and dependencies; foundational actions (PQC plans, high-risk-system pilots, supplier engagement) by end of 2026; high-risk systems' PQC transition complete and medium-risk system piloting begun by end of 2030; and by end of 2035, "kaikki keskitason ja mahdollisuuksien mukaan myös matalan riskin järjestelmät on päivitetty PQC-aikaan" (all medium-risk and, where possible, low-risk systems updated to the PQC era). The guide's first recommended immediate step is to build a cryptographic inventory:

"Tee kryptoinventaario: muodosta luettelo kaikista sovelluksista, järjestelmistä ja laitteista, joissa käytetään kryptografiaa." ("Create a crypto inventory: compile a list of all applications, systems, and devices that use cryptography.")

The guide also frames the transition as a multi-year process rather than a single event: "Varautumisen ajoitus on keskeinen tekijä siirtymän onnistumisessa. Aikainen valmistautuminen mahdollistaa hallitun etenemisen ja riskien priorisoinnin." ("The timing of preparation is a key factor in the transition's success. Early preparation enables managed progress and prioritization of risks.")

What we checked and did not find

The guide is explicitly advisory -- it sits under Traficom's "Ohjeet ja oppaat" (Guides and instructions) heading and imposes no obligation on any organization, financial or otherwise. FIN-FSA (Finanssivalvonta), the financial supervisor that could make cryptographic migration binding for Finnish banks and insurers, has published no PQC-specific circular or supervisory letter of its own. No penalty, reporting requirement, or audit mechanism attaches to any of the dates in the roadmap.

Score rationale

Each axis is scored 0–20 against the primary sources listed on this page. See the methodology for what each axis measures and how scores are derived.

Axis	Score	Why
Mandate strength	3/20	The guide is published under Traficom's 'Ohjeet ja oppaat' (Guides and instructions) section for organizations and companies -- explicitly advisory, with no binding force and no named regulated population subject to enforcement.
Deadline concreteness	12/20	The page reproduces a specific phased timeline with named years: preparations start immediately, foundational steps (PQC plans, high-risk pilots) by end-2026, high-risk systems fully migrated and medium-risk piloting by end-2030, and medium/low-risk systems migrated by end-2035. These are concrete years, but the page itself attributes them to the EU NIS Cooperation Group's roadmap rather than presenting them as a Finland-specific deadline.
Scope of coverage	10/20	The guide is addressed broadly to 'organizations and companies' rather than a single regulated sector, giving it wide intended reach, though as guidance it does not bind any of them.
Inventory/CBOM requirement	8/20	The page's first recommended immediate step is explicitly to build a 'kryptoinventaario' (crypto inventory) -- 'a list of all applications, systems, and devices using cryptography' -- a named, specific inventory recommendation, though advisory rather than a reporting obligation to any authority.
Regulatory activity	8/20	NCSC-FI/Traficom is a real, named national authority that has published a detailed, dated technical guide with concrete migration phases, but it is guidance rather than supervisory action, and FIN-FSA -- the regulator that could make this binding for financial institutions -- has published nothing of its own.
Total	41/100	A blunt sum of the five columns to its left.

Related regulators

Sector bodies checked independently, not assumed from the primary source above.

Finanssivalvonta (FIN-FSA)
Not yet addressed, a gap to watch
No FIN-FSA circular or supervisory guidance specifically addressing post-quantum cryptography or cryptographic inventory was located.

FAQ: Finland and PQC

Does Finland have a post-quantum cryptography (PQC) law?: No. Nothing published for Finland carries statutory force for post-quantum cryptography as of this page's last review. What exists is non-binding guidance, set out with its primary sources below. The lead body is National Cyber Security Centre Finland (Kyberturvallisuuskeskus), under Traficom.
What is Finland's PQC migration deadline?: 2030. See the sources below for what this deadline actually covers, since it may apply only to specific sectors or system types. The deadline came from National Cyber Security Centre Finland (Kyberturvallisuuskeskus), under Traficom.
Does Finland require a Cryptographic Bill of Materials (CBOM)?: Implicitly. The sources imply organizations will need a cryptographic inventory to comply, without naming CBOM as a formal requirement.