EU AI Act AI Literacy in Finland: What Changed After the 2026 Omnibus

Finland switched on AI Act supervision in January

A lot of EU countries spent 2025 arguing about who should police the AI Act. Finland put its answer on the statute book. The Act on the Supervision of Certain Artificial Intelligence Systems (1377/2025) was approved by the President on 22 December 2025 and took effect on 1 January 2026. That was late against the government's own plan (Government Proposal 46/2025 had aimed for 2 August 2025), and still well ahead of Norway, which is only now heading back to consultation.

The model is decentralised. Supervision is spread across 15 authorities: nine market surveillance authorities and eight fundamental-rights supervisors, with some, like the Data Protection Ombudsman, wearing both hats. Traficom, the transport and communications agency, is the single point of contact and does the coordinating. Fines, though, are centralised. The government's bill would have let each authority impose fines of up to €100,000 itself, but Parliament's Constitutional Law Committee worried about uneven practice. So the final Act sends every fine, whatever the amount, to a new Sanctions Board that sits alongside Traficom and acts on the supervising authority's proposal.

Why should a training buyer care about the plumbing? Because it hints at who might one day ask about your AI literacy records. Probably not one central AI regulator reading training logs. More likely a supervisor that already knows your sector: the Act puts high-risk recruitment tools under the Data Protection Ombudsman and life and health insurance pricing under FIN-FSA. And the tone so far is advisory. When the Article 50 transparency duties started applying on 2 August 2026, Traficom published guidance and said its first aim is to guide, advise and let companies put things right. As of mid-August, no AI Act fines or formal investigations had been reported in Finland.

There's plenty to supervise, though. Eurostat's 2025 survey found 37.8% of Finnish enterprises with ten or more staff using AI, close to double the EU figure of 20.0%.

Related reading: Continuous Learning Funding in Finland 2026: JOTPA After the Allowance Cut · Norway Public Sector AI Training in 2026: A Vendor's Guide to the Money · How to Choose an EdTech Vendor for Nordic Enterprise Upskilling in 2026

What the Omnibus did to Article 4

Then Brussels moved the goalposts, mostly in the buyer's favour. Regulation (EU) 2026/1744, the Digital Omnibus on AI, cleared the European Parliament on 16 June and the Council on 29 June, was published in the Official Journal on 24 July and entered into force on 27 July 2026. Most coverage went to the delayed high-risk dates: Annex III systems now apply from 2 December 2027, and Annex I systems (AI built into already-regulated products) from 2 August 2028. The Article 4 rewrite got less airtime. For anyone who sells or buys training, it's the bigger story.

The original text, applicable since 2 February 2025, told providers and deployers to take measures to "ensure, to their best extent, a sufficient level of AI literacy". The new text asks them to "take measures to support the development of AI literacy" among staff and other people who operate and use the systems. Then it adds the sentence lawyers will be quoting for years: the obligation "does not require providers or deployers to guarantee any specific level of AI literacy of any individual".

Lawyers call it a move from an obligation of result to an obligation of means. In plain terms, you're now judged on what you did, not on what your people know.

Effort, not outcome: what 'support the development' means in practice

Here's our opinion, stated plainly. The Omnibus did Finnish training buyers a favour. It ended the certify-everyone-by-Friday panic market that ran through 2025, when a lot of generic AI literacy content was sold on fear of a legal standard nobody could define. If your AI literacy programme only exists because of Article 4, retire it at renewal. The programmes worth keeping are the ones tied to how specific roles use specific systems.

Article 4 hasn't gone away. You still have to take measures, and a regulator can still ask what they were. The Commission's AI literacy Q&A, updated after the Omnibus, promises continuity, so its original checklist is still the best guide to what a proportionate measure covers:

• a general understanding of AI inside the organisation
• clarity on whether you're the provider or the deployer of each system
• a view of the risks of the systems you actually run
• actions matched to your staff's knowledge, experience and working context

The same Q&A is blunt about paperwork. There's no need for a certificate, and an internal record of training and other initiatives will do. That line alone should change how you procure. Certificates were always a vendor's product feature, never a legal requirement.

Two things haven't changed. First, enforcement. The AI Act never attached a dedicated fine to Article 4 and still doesn't, and Finland's Act leaves Article 4 off its list of breaches that can draw a sanction fee. Still, the Commission's Q&A notes that national authorities could sanction infringements, case by case and proportionately. Second, the high-risk track. Article 26(2) still requires deployers of high-risk systems to assign human oversight to people with "the necessary competence, training and authority", and the Commission's updated guidance says that duty stands. Annex III (recruitment screening, credit scoring, life and health insurance pricing, among others) applies from 2 December 2027. About fourteen months.

That's where the durable training budget sits. Not in teaching 4,000 people what a language model is, but in making sure the 40 who approve or override an AI-assisted pricing decision know when they should.

Is a 60-minute course still enough?

For most of your staff, probably yes, as long as it's paired with a record and a usage policy. MinnaLearn, which built Elements of AI with the University of Helsinki, now offers Get AI Ready, a 60-minute AI literacy programme mapped to the EU AI Act, both as an individual certification and as an organisational programme. Under the old wording you could argue about whether an hour gets anyone to a sufficient level. Under the new wording most of that argument disappears, because nobody has to prove a level.

What an hour can't do is the specifics. A claims handler with a fraud-scoring tool, a recruiter reading rankings from a screening model, a developer shipping a chatbot: each needs something different, and a generic module speaks to none of them. So the sensible structure is a thin, cheap baseline for everyone and a thicker, system-specific layer for roles that touch consequential outputs.

If you sell training, the pitch changes more than the product. The compliance-fear angle is gone. What's left to sell is evidence (buyers still need a clean record) and relevance (nobody will pay for a second generic hour). Vendors who can take a client's system inventory and build role paths from it will win the renewals. Vendors selling seats on a universal course are up against a free Finnish one that two million people have already signed up for.

EdTech vendors and universities have one more thing to check. Education and vocational training is itself an Annex III area, so if your platform decides admission, evaluates learning outcomes or monitors students during tests, you may be a high-risk provider from December 2027. Expect it in procurement questionnaires well before then.

Elements of AI and the Finnish head start

The Finnish starting point is unusual. Elements of AI launched in spring 2018, built by the University of Helsinki and MinnaLearn, with a goal that sounded slightly mad at the time: teach the basics of AI to 1% of Finns. The course takes around 30 hours, needs no programming or heavy maths, and costs nothing. In December 2019, during its EU Council presidency, Finland offered it free to every member state. By May 2023 it had passed a million participants in 26 languages, and 250 Finnish companies had used it to train staff. The site now counts over two million sign-ups and graduates in more than 170 countries, with women making up about 40%.

It travelled west too: Norway's DFØ lists the Norwegian version on the shared learning platform for state agencies. So the same Finnish ecosystem sits on both sides of the compliance shift, with a free public-good course that set the baseline and a commercial one-hour product aimed squarely at Article 4.

Picture the HR lead at a mid-sized Helsinki insurer. Say 600 staff, a pricing model on the life and health book, a customer chatbot, and Microsoft 365 Copilot rolled out last year. Plenty of her colleagues did Elements of AI on their own at some point. What should she document now? Not a certificate count. A record of which systems the company runs, which roles use each, what measure each role got, and when it was last reviewed.

She also has a ready-made place to put it. Finland's Co-operation Act (1333/2021) requires employers with at least 20 staff to prepare a work community development plan, in continuous dialogue with personnel, covering competence development. That's the obvious home for the AI literacy record, and HR already owns it. For vendors it's a quiet warning: your buyers have a free baseline and a statutory plan to hang the record on. What they'll pay for is the mapping between their systems and their roles.

How does Finland compare with Denmark and Norway?

Plenty of Finnish buyers are really Nordic buyers, with Copenhagen and Oslo staff on the same learning platform. The three countries sit in different places.

Denmark moved first and leads the EU on business AI use, at 42.0% of enterprises in the same Eurostat survey, though the Danish guidance we could find is about Article 5 bans, not literacy. Norway is the odd one out. The AI Act can't apply there until it's taken into the EEA Agreement, and those negotiations still weren't finished in late August. The government said on 4 August that its implementing law would go back to consultation this autumn because of the EU changes. Norwegian advisers are telling clients to start on an ISO 42001-based AI management system meanwhile.

For a group L&D team, the practical answer is one programme and one record format across all three countries, written to the new Article 4 wording. Including Norwegian staff now costs very little, and the amended text is the likelier version for Norway to land on.

What to document before Traficom ever asks

No AI Act fine has been reported in Finland yet, and Article 4 is an unlikely place for the first case. So keep the paperwork short and real. A workable file looks like this:

1. An AI system inventory, with your role (provider or deployer) noted against each system.
2. A role map showing who uses which system and how much their decisions lean on it.
3. Measures per role. The baseline course for everyone, system-specific training for the rest, all dated.
4. For anything that becomes high-risk in December 2027, named human-oversight owners and the training behind each Article 26(2) assignment.
5. A review date, plus the entry in your co-operation development plan that points to all of the above.

On procurement, three things follow. Stop paying for certificates as a line item. Ask vendors to map content to the frameworks the AI Board is likely to lean on: the Commission and OECD's AILit Framework, with four domains and 22 competences (it was built for schools, so expect adaptation), and DigComp 3.0, which adds more than 500 learning outcomes and works AI into every competence area. And put the serious money where the Omnibus left the hard obligation, in human oversight for high-risk systems.

One thing to watch. The new Article 4 asks the Commission and Member States to support AI literacy, particularly for SMEs. Finland's 2027 education budget proposal, published on 21 September, finds €75 million for the LUMI AI factory. Whether national money follows for workplace AI literacy is still open, and for vendors selling into Finnish SMEs that may matter more than anything a regulator says. Our guess is that the free baseline gets freer and the paid market shrinks to the role-specific layer. A smaller market, then, and a far more honest one.