The Finnish Transport and Communications Agency Traficom has revised its regulation on critical parts of communications networks. The revised regulation extends the scope of regulation so that, in certain respects, it also covers 5G network base stations. In the future, telecommunications operators must identify the critical parts of 5G net-works, such as base stations, assess their centrality and significance, and document the assessments. The new regulation enters into force on 19 December 2026 and replaces the previous regulation issued in May 2021.
The critical parts of a communications network are those key functions and measures of a network that are used to control and manage network access and network traffic in a significant manner. Pursuant to the Act on Electronic Communications Services (917/2014), communications network equipment may not be used in the critical parts of a network if there are weighty grounds to suspect that the use of the equipment would endanger national security or national defence. If such grounds arise, Traficom, together with other security authorities, will assess the matter, and the Agency may, by decision, oblige the operator to discontinue the use of the equipment and remove it from the network, unless the potential threat can be eliminated by other means.
The regulation itself does not remove equipment or categorically prohibit the use of any specific equipment vendor. It defines the parts of the network to which a removal order referred to in the Act on Electronic Communications Services may at least be directed.
In the regulation, the critical parts of communications networks are defined in a technology-neutral manner, meaning that the regulation applies to all different communications network technologies. This is complemented by a more precise definition of the critical parts of 4G and 5G networks. For example, a 5G base station is considered a critical part of the network if it implements functionalities that materially control or direct access to the network and the traffic conveyed within the network. Such functionalities include, in particular, those that increase the autonomy of the radio access network or utilise artificial intelligence or machine learning in the management of base station traffic or network access.
The regulation imposes obligations to identify and document the critical parts of communications networks and the components used in them. The obligations apply not only to telecommunications operators’ public communications networks but also to critical separate networks, such as networks connected to the public communications network at nuclear power plants, ports, airports, and other actors vital to society.
The regulation guides telecommunications operators and local network operators within the scope of application of the regulation in the planning of current and future network generations, in the procurement of network equipment, in the construction of networks, in the maintenance of networks, and in the management of network.
The revision of the regulation has been prepared in cooperation with the sector and various security authorities during the year 2025.