Currently, there is no established definition of artificial intelligence within Finnish law. It is anticipated that Finland will adopt the definition provided by the EU AI Act for future legislation. During the debate on the AI Act and its definition of AI, Finland’s approach was to advocate for a restrictive definition. The aim was to exclude specific types of automated decision-making systems and solutions from being categorized under this definition.

Yes, Finland was one of the first EU countries to develop a strategy for the use of artificial intelligence launching Artificial Intelligence 4.0 program in 2020. According to the Artificial Intelligence 4.0 program’s objectives, in 2030 Finnish industry will be clean, efficient and digital. The main objective of the program is to create sustainable employment by accelerating the growth of enterprise productivity, structural change of the economy and the digital investments required for these developments. The aim of the program is to increase productivity and sustainability in the form of digital investments; the diversification of the industry and service ecosystems with regenerated value creation and partnerships. In addition to Artificial Intelligence 4.0, Finland has several different programs and policies touching on AI among other technologies. Among these are Finland’s National Digital Compass and Quantum Technology Strategy.

There are no comprehensive laws or regulations for AI use in Finland, although the use of automated decision making in public administration has been regulated since 2023. Some governmental organizations have published voluntary standards and guidelines, mostly for the public sector. One example of these guidelines is the general rules and checklists for the use of AI published by the VAHTI network, which is a steering group for digital security in public administration, run by the Finnish Digital and Population Data Services Agency.

In the absence of specific AI laws, existing regulation related to protection of personal data (especially GDPR) likely affects any use of AI in connection with personal data. Deployment of AI in professional setting can trigger some employment law obligations defined in the Co-operation Act. The Act on the Protection of Privacy in Working Life also governs employer obligations related to processing of employee personal data, technical supervision, use of e-mail and computer networks.

However, there is no precedence available for determining exactly how the current legislation will be applied to AI related situations. Most existing legislation is created for a very different technical landscape and processes related to updating the legislation are long.

Work is underway for dividing the governance tasks to responsible organizations and implementing the changes to existing laws necessitated by the coming Artificial Intelligence Act, but there are no details of this available yet.

In terms of liability for damages caused by AI, the existing pieces of legislation such as product liability law, data protection laws, and general tort law are applied. However, there is a pressing need for a clear delineation of liability for damages resulting from the use of AI, as highlighted by the recent proliferation of large language models. The coming AI Liability Directive will solve many practical problems related to claimant’s access to information and the overhauled burden of proof rules will simplify tying safety shortcomings in AI systems to damages caused by the systems.

AI systems may be considered products under Finnish Product Liability Act, corresponding to the EU’s Product Liability Directive. If an AI system is defective and causes damage, the producer could be held liable. The definition of ‘defective’ in this context is crucial and may include not just malfunctions but also inadequate instructions or warnings about the use of the product. In addition to product liability, the GDPR imposes liability for non-material harm, which can result from AI systems’ processing of personal data. This includes harm such as bias in decision-making processes that affect individuals, where the AI system’s data processing is not compliant with GDPR principles. In the absence of specific rules in the Product Liability Act or GDPR, Tort Liability Act may apply. This means that if an AI system causes harm, the injured party may seek compensation under the general principles of negligence or strict liability, depending on the case.

Criminal liability for damages caused by AI systems could be possible for persons in leading roles in companies deemed to violate the Product Liability Act or the GDPR. In general, the criminal liability of management requires intent or gross negligence. Directors who have tried to act with due care but from whom the true state of affairs has been concealed may be shielded from criminal liability. On the other hand, the board must prove that it has acted with due care.

The developer of the AI system could be held liable if the harm was due to a defect in the development of the AI system. The deployer would be responsible for the implementation of the AI system and any defects in the implementation. The user of the AI system could be liable if the harm resulted from misuse or a failure to follow the operating instructions or warnings provided by the developer or deployer. The victim may seek compensation under product liability laws if the AI system is considered a product. If the AI system is not considered a product, the victim may still seek compensation under general civil liability laws, such as tort law.

Currently the victim, under general tort law, needs to establish harm, fault on the part of the defendant, and a causal link between the behavior of the defendant and the harm suffered by the victim. If the proposed AI Liability Directive is approved and adopted into national law as currently proposed, the burden of proof is eased for the victims. The directive includes presumption of causality. A causal link between the defendant’s fault and the output produced by the AI system or the failure of the AI system to produce an output should be presumed when three conditions are met: (1) the claimant can demonstrate that the defendant has failed to comply with its duty of care, (2) the fault is likely to have affected the output of the AI system or the failure of the AI system to produce an output, and (3) the claimant shows that the output produced by the AI system or the failure of the AI system to produce an output has given rise to harm.

If the AI system is a product and the damage caused by such system falls under the product liability regime, it is insurable under product liability insurance. General third party liability insurance may apply to damage liability according to tort law. Information on insurance policies pertaining specifically to damages caused by and AI system is not publicly available on a wider scale. Different insurance companies may have add-on policies that address AI damages, similar to the somewhat established cyber security insurance policies, but there are no general practices in place for now. Until the insurance industry’s understanding of the level of risk and probability of incidents related to AI increases, AI liability insurance protection policies will likely remain high-premium additional components to general liability policies with somewhat low policy sub-limits for payouts.

No, current case practice of the European Patent Office has confirmed that an AI cannot be named as the inventor in a patent application (see EPO Enlarged Board of Appeal decision on 21 December 2021 J8/20). On the national level, though there are no explicit guidelines, the Finnish Patents Act requires that Finnish patent applications include the inventor’s name and address, which makes it impossible to name an AI as the inventor.

There are currently no rulings from Finnish courts regarding copyright protection for AI-created works. It is uncertain whether an AI-created image could meet the requirements for copyright protection, being that the work in question would need to be an original and independent creation of its author. Images created purely by AI with little to no human contribution will likely not benefit from copyright protection.

In the event that a work created with the assistance of AI benefits from copyright protection, the Finnish Copyright Act (404/1961) states that the authorship of works subject to copyright protection can only be attributed to a person.

When implementing AI in the workplace, several key issues need to be addressed. Legal and regulatory compliance is crucial, particularly in adhering to data protection laws and addressing intellectual property rights. Ethical concerns are also important, as AI can perpetuate biases and raise privacy issues, making transparency and accountability essential. The impact on the workforce is significant, as AI may transform roles, necessitating retraining and upskilling. Especially if employees’ roles and responsibilities change as a result of implementation of AI or such implementation has a substantial impact on the employee’s position, the ongoing dialogue obligations of the Co-operation Act must be adhered. Any reduction in the workforce or unilateral changes to essential terms of employment contracts require more extensive change negotiations.

Technical challenges, such as ensuring data quality and system reliability, are vital for effective AI implementation. Building trust and providing adequate training to employees are necessary for successful human-AI interaction. Security is another critical issue, as AI systems must be protected from cyber and adversarial attacks. Additionally, aligning AI with strategic goals and managing workflow changes is key to organizational impact. Finally, addressing economic inequality and broader societal impacts requires a multidisciplinary approach. By considering these issues, organizations can responsibly integrate AI into the workplace.

There are several issues relating to data protection and privacy concerning AI and many of them are related to the core principles of the GDPR; fairness, transparency, accuracy, data minimization, integrity and confidentiality. AI needs data to be able to provide results and the collection, use and retention of personal data in AI systems in compliance with the GDPR may be a challenge. The unauthorized use of personal data to train AI models poses a significant threat as it jeopardizes the privacy of the data subjects, and the deletion of that data may be impossible. AI may be also used to create deep fakes and cyber attacks which may be used for criminal purposes.

Web scraping could infringe on someone’s copyrights if the scraping involves reproducing copyrighted literary or artistic works without the consent of the rights holder. However, the Finnish Copyright Act provides for an exemption for the use of copyrighted works for text and data mining. According to Section 13 (b) of the Act, anyone with lawful access to a copyrighted work may reproduce it in order to carry out text and data mining and retain the copies solely for that purpose, unless this right has been expressly reserved by the author in an appropriate manner.

In addition, the EU GDPR sets down limitations for the use of data scraping techniques involving processing of personal data. Controllers carrying out web scraping must comply with the general data processing principles of the GDPR (fairness, transparency, accuracy, data minimization, integrity and confidentiality), including having a legal basis and legitimate purpose for the processing, limiting the collection and storage of personal data and ensuring the fulfillment of data subject rights in relation to the processing.

The use of data scraping could also have implications for competition, for example if scraping of user data affects a company’s position in the market. However, Finnish courts or the Finnish Competition Authority have not as of yet issued any rulings on the relation of data scarping and competition law.

Following the basic principle of freedom of contract, a prohibition of data scraping is as a general rule enforceable against a website user if it is appropriately incorporated into a contract between the website operator and the user.

However, according to the Finnish Copyright Act, a prohibition of reproducing copyrighted works for text and data mining must be stated explicitly in order for it to be enforceable. Additionally, the Act provides for further exemptions for research organizations and cultural heritage institutions to reproduce copyrighted works for data mining, which cannot be derogated from in contracts and agreements.

At the time of writing, the Finnish Office of Data Protection Ombudsman has not published any guidelines concerning artificial intelligence.

Currently, there has been one case, decided on 20 September 2021 concerning the Finnish Security and Intelligence Service “FSIS” (3394/171/21) in which the Finnish Deputy Data Protection Ombudsman took a stand. A group in the FSIS had tested Clearview AI to assess its suitability to use in protecting children against sexual exploitation and the distribution of pornographic material of children. The services could be used to search a potential victim’s public social media profile by entering his or her picture into Clearview’s service. The FSIS filed a data breach notification to the Finnish data protection authority after its investigation that started from an inquiry from an US online publication.

The Finnish Deputy Data Protection Ombudsman deemed the processing unlawful as the FSIS had used facial recognition technologies without conducting any appropriate controls or safeguards, especially taken into concern the high risk posed to data subjects from the processing. No fine was imposed on the police authority, but the Deputy Data Protection Ombudsman ordered the FSIS to bring the processing into compliance and to notify the identified data subjects about the breach.

At the time of writing, no national courts have taken a stand in cases involving AI.

At the time of writing, no regulator or authority responsible for supervising the use and development of AI has been appointed. However, the working group preparing the national implementation of the EU’s Artifical Intelligence Regulation has begun its work. The working group is expected to nominate the responsible government organizations responsible for the governance and oversight of the different aspects of the AI Act, as well as to provide a high-level overview of the changes needed in the existing legislation to accommodate the AI Act provisions. Based on the working group’s memo, preparation of the legislative changes will continue in the form of an official government proposal.

At the time of writing, the use of artificial intelligence by businesses is still limited. A study conducted in the end of 2023 states that only 17 percent of big Finnish corporations are using AI in a goal-oriented way. At the time of writing, there is no newer data, but it is safe to say that this number has come up because some generative AI tools have become available to a larger audience. A lot of companies are moving from proof-of-concept and piloting into implementation of AI. In general, interest in AI is high, and most Finnish companies will likely formulate some sort of a strategy or opinion on the use of AI in the near future.

Artificial Intelligence is being used in the legal sector in Finland still quite moderately. There are a few pioneering law firms and lawyers in the fore front promoting the use of AI. Generative AI is being tested in the legal processes and some of the use might be unconscious since some widely used legal technology uses AI. Commercial training is being offered for lawyers to lower the bar to start using AI in the legal work. However, we are expecting to see a rise of AI in the legal work because of legal specific generative AI tools appearing in the market.

The biggest challenge is the potential underuse of artificial intelligence. Also, implementing AI solutions can be expensive and require significant resources. There may be resistance from lawyers who are accustomed to traditional methods and skeptical about the reliability and benefits of AI technology.

In addition, lawyers often handle sensitive and confidential information, and using AI tools can raise significant ethical and privacy issues. AI systems can inadvertently perpetuate or amplify biases present in training data, leading to unfair or discriminatory outcomes in legal decision-making.

Some legal tech solutions have been out of reach in the Finnish market because of their pricing. AI will bring more opportunities, for example in document review and analysis, in lower license fees. Just like in all jurisdictions, AI will increase efficiency and streamline work. Cross-border legal research and legal work will also be more efficient because AI can help in translations even with the smaller languages. AI will also bring more work to lawyers. Now that generative AI is easily accessible to many, it means that many contracts and legal documents will be drafted without legal help, but professional lawyers will be needed when problems arise from those documents to solve the matters and resolve disputes.

The landmark EU Artificial Intelligence Act will be in force starting from 1 August 2024. It will be fully applicable 24 months after its entry into force, with a few exceptions: Bans on prohibited practices will apply six months after the entry into force date, codes of practice nine months after entry into force and general-purpose AI rules including governance requirements 12 months after entry into force. High-risk systems will have 36 months to comply with the requirements after the entry into force.