Service providers’ obligations

Scope of application of the act and the definition of a service provider

The Consumer Safety Act (920/2011) applies to all consumer services and consumer goods unless special provisions concerning their safety are laid down elsewhere in law. The Consumer Safety Act is applied side by side with certain special acts, such as the Rescue Act, the Assembly Act and the Land Use and Building Act.

Consumer services’ are services intended for or, to an essential degree, actually used for private consumption by consumers or persons comparable to consumers. Persons comparable to consumers include, for example, schoolchildren where the activity is not part of regular teaching.  If, for example, a school buys a rock climbing session for the school’s physical education lessons from an external climbing service provider, the climbing service is a service covered by the Consumer Safety Act regardless of the fact that the invoice is paid by the school rather than the individual pupils.

Under the Consumer Safety Act, the ’service provider’ means a natural person or private or public legal entity who performs, supplies, markets, sells or otherwise provides or acts as an intermediary in the provision of consumer services. The service provider can, for example, be an enterprise, municipality or association. Consumer services also include events open to the public organised by associations and agency services where packages consisting of several different services are offered. The Consumer Safety Act does not, however, apply to services provided by:  

  • natural persons when the activity is not commercial; for example, a beach on land owned by a private person that is used by others on the basis of the Finnish everyman's right is not a consumer service;
  • associations or other institutions exclusively to their own members in the course of an activity other than commercial operations; examples include the activities of Scout groups or sports clubs as long as these can only be participated in by members and the participation fees are not intended to generate a profit.

The service provider’s obligations also include:

 Duty to take care

 Providing information about the service

 Risk assessment and self-control

 Incident logging

 Notifications concerning dangerous services

 The safety document

Duty to take care

The general duty to take care laid down under section 5 of the Consumer Safety Act applies to all service providers. Operators must, by observing the care and skills required by the circumstances, ensure that consumer services do not involve any risk to the health or property of any person.  This duty to take care includes the duty to have sufficient and correct information and knowledge about the consumer service and to duly evaluate the risks involved in it. Operators must know their services and have sufficient training, experience and other competence required for safe service provision.

Will and fancy words alone are not, however, enough to prevent accidents. It is also not enough that only the entrepreneur or the person in charge is an experienced and seasoned professional in their field and knows what to do in various emergency situations. Instead, everyone participating in service provision must be able to act in the appropriate manner if something goes wrong. Even the swimming pool cafe sales staff are needed in case of an emergency, and every single programme service employee must know what to do if there is a safety incident.

The duty to take care also includes the duty to make sure the equipment used in service provision is safe and that consumers using the service are provided with all the information necessary from the safety perspective. Operators cannot release themselves from the duty to take care on the basis of any disclaimer statements included in agreements or any statements whereby those participating in the service do so on their own responsibility. The duty to take care also applies to service agents (intermediaries), and they are obliged to make sure the consumer services supplied by them as agents are safe and that subcontractors comply with their duty to take care.

Proving information about the service

The Consumer Safety Act places operators under the obligation to provide, in a clear and comprehensible manner, those participating in a service with the information necessary for the assessment of possible risks involved in the consumer service. They must also provide any necessary instructions, warnings and other information necessary for the prevention or avoidance of risks involved in the service. More detailed provisions on the supply of information are laid down in a Government Decree concerning the provision of information (613/2004 in the Finnish Statute Book).

There is a great deal of variety in the types of consumer service available. The information necessary to prevent any risks to health or property varies from one service to another. The duty to take care obliges operators to ensure they know their service and are capable of assessing which information is necessary for consumer safety. Before service provision, service providers must ensure that those participating in the service have received and understood the information necessary for their safety. This means that consumers must have both heard and understood the instructions and also be able to remember them. Providing information and warnings about the risks related to the service does not, however, release the operator from responsibility for service safety.

For some services it is necessary to provide consumers with advance information on the basis of which they can decide whether and under which conditions they can participate safely in the service. Such information includes any special requirements concerning the health or other personal qualities, such as previous experience, of service participants set for physically demanding programme services.

 The manner in which information is provided also affects service safety. Information necessary for safety must be clearly distinguishable from marketing material. Operators must ensure that those participating in the service have understood the instructions necessary for service safety. For some services it is enough to provide the warnings using signs or other written warning notices placed in conjunction with the service, for others the best method is to provide the information orally, while for some the instructions should also be provided in writing. Operators must also take into consideration the consumers' familiarity with the service in question, their capability of understanding and following instructions and the needs of any special groups participating in the service. Operators must not provide the service to such consumers who cannot understand the necessary safety instructions for reasons including insufficient language skills.

More detailed information about the instructions to be provided for customers can be found in Finnish in the Tukes guidelines on the information to be provided concerning consumer goods and consumer services.

Risk assessment and self-control

Safety planning must begin with risk assessment. This is a key element in safety planning and the operators’ duty to take care. Written risk assessments must also be included in safety documents. Risk assessments and risk management help take systematic measures to prevent the occurrence of accidents and other incidents.

Risk assessment and risk management consist of:

  • identifying the risks involved in the activity, the situations in which risks may occur and the types of accident or other incident that may take place in the activity
  • considering the measures to be taken to eliminate or reduce the risks and to prevent accidents and other incidents;
  • making preparations and creating preparedness for action in response to any accidents and other incidents.

Risk assessment must involve considering which risks may result in the most serious injuries and which risks are highly likely to result in an accident. When considering the measures to be taken, the main focus of attention should be on those risks with the most serious consequences (such as death or permanent injury) or the highest likelihood to occur, even if the consequences of individual incidents might be minor (such as injuries resulting from customers repeatedly falling over due to iciness of the operator’s grounds).

The service provider’s incident log is a good tool for risk assessment.

Self-control is also included in the operator’s duty to take care. The self-control system can be included in, for example, the operator's quality system if such a system is already in place as this is often a very natural context for it.

A consumer service provider’s self-control system can consist of components including the following:

  • a safety document, i.e. a safety plan produced in writing;
  • incident logging and the procedure followed to utilise it;
  • the procedure followed to inform surveillance authorities of risks and incidents detected;
  • instructions given to service users in writing, orally or some other format.

Self-control is in many ways beneficial for service providers:

  • Accidents can be prevented efficiently.
  • If accidents do occur, the damage can be minimised.
  • Awareness of potential risks reduces the occurrence of incidents by surprise.
  • Improvements in safety level s also often result in improvements in customer service quality.
  • Customers perceive the service as safe and therefore also as attractive.

Incident logging

Operators must inform the surveillance authority of accidents or hazardous situations occurring in conjunction with their services (section 8 of the Consumer Safety Act). Such notifications are usually the tip of the iceberg and only represent the most serious accidents and hazardous situations. Under the duty to take care laid down in section 5 of the Act, operators must also monitor even the smallest of incidents and hazardous situations taking place in their activities – even if these do not need to be reported to the authorities as described above.

Incidents and hazardous situations must be recorded in the operator’s own incident log. The threshold for making entries in the log should be kept low, and the management should, for example, encourage employees to make incident log entries without the fear of consequences. Positive experiences from the introduction and utilisation of incident logging have been gained in fields including aviation safety.

The incident log is a safety development tool for operators. Managerial staff must constantly monitor the safety situation on the basis of the log entries/forms and take immediate measures if necessary. It is crucial to set up a regular monitoring system for log entries (as appropriate considering the volume of operations) and pay attention to any specific risk areas in which, for instance, similar incidents often take place. It is also important to address any problems that have emerged and that might otherwise be disregarded over time as isolated cases.

The simplest way for small enterprises to maintain an incident log is to use a basic notebook. For larger enterprises it is more appropriate to use a tool such as a specific standard incident log form that employees (such as instructors and activity leaders) can use to report incidents. The forms should be archived for further use or the actual log system can be computerised. The surveillance authority may request to see the incident log in conjunction with inspections or other measures.

Any information obtained for the incident log from customers or describing their health status must be treated as a personal data file. The requirements laid down in provisions including the Personal Data Act (523/1999) must be taken into consideration with such files. The information (forms) must be stored and disposed of in the appropriate manner.

Example of a small programme service company’s incident log






Date and time





Incident: Description of what happened and where





Measures taken  
a) first aid measures
b) reports submitted regarding the incident
c) measures to improve the safety level





Instructor’s (staff member’s) name and signature













12.45 pm







Customer fell over near the equipment box and hurt his hand slightly. The pain disappeared during the afternoon.





  • Customer’s condition was checked and fitting of equipment continued.
  • The soles of his shoes appeared to be slippery.
  • The incident location was gritted.

Artturi B.













09.05 am







Customer hit a tree on snowmobile around 150 m from the starting point (first bend to the right). Customer unconscious for a moment, snowmobile likely to be beyond repair.





  • Customer was placed on his side, kept warm and under observation. Ambulance called and customer taken to health care centre for observation. The rest of the group continued on the safari once the incident was over (route shortened).
  • Leena informed immediately.
  • Report made to Tukes under section 8 of the Consumer Safety Act (copy of the report enclosed).
  • Leena will contact the insurance company.
  • In the future riding instruction will be intensified for insecure customers and opportunity to ride with someone else will be offered.

Pertti A.






Notifications concerning dangerous services 

If a serious accident takes place during the provision of a consumer service, the operator must immediately take rescue action and call for help (phone 112: the rescue services, police).

The operator is also obliged to:

  •  suspend the provision of the dangerous service until it can be resumed safely;
  • report the dangerous service and the measures taken by the operator concerning it to the surveillance authority;
  • if necessary, inform customers about the risk involved in the service and about consumers’ rights.


If the operator discovers that a service provided by the operator poses a risk (for example, if there has been an accident or a serious near-miss situation) to the health or property of consumers or people in the impact area of the service, the operator must immediately report the situation to the surveillance authority. In this context the operator must also inform the authority of the measures taken by the operator to eliminate the risk. The operator must cooperate with the authority in risk elimination. (Section 8 of the Consumer Safety Act)

The fact that the operator takes the initiative to cooperate with the authorities as soon as a risk has been detected and takes efficient measures to eliminate the risk helps create an image among consumers of a responsible enterprise. This can be taken into consideration by Tukes in its own communications.  In risk assessment, consumer safety must be prioritised over any costs arising from rectifying measures.

The safety document

Compliance with the operator's duty to take care includes safety planning. Safety planning carried out in writing – the safety document – is the service provider’s tool for the arrangement and recording of safety activity. According to the Tukes surveillance practice, providers of consumer services that may involve a risk that is higher than insignificant to the safety of participants or others within the sphere of influence of the service should draw up a written plan concerning risk management and preparedness for emergencies.

Section 7 of the Consumer Safety Act (920/2011) lays down the service provider obligation to draw up a written safety document. Further provisions on the contents of the safety document are issued under a Government Decree on the safety document concerning certain consumer services (1110/2011). Under the Act, the safety document must be produced for the following services:

  • amusement parks, family parks, zoos, domestic animal zoos, funfairs and circuses;
  • gyms;
  • downhill skiing centres and other ski slope centres;
  • playgrounds and comparable indoor playgrounds;
  • skateboarding venues and comparable cycling venues;
  • adventure, experience and nature services and other programme services comparable to them, unless the risk involved can be considered insignificant;
  • climbing centres;
  • horse riding stables and other horse riding services;
  • karting tracks;
  • indoor and outdoor swimming pools, spas and entertainment spas;
  • beaches intended for swimming, and winter bathing and swimming sites;
  • tattoo parlours, piercing studios  and other body modification or alteration services;
  • safety phone services and other similar services;
  • events involving a significant risk that could, should it materialise, endanger someone’s safety due to the large number of persons participating in the service or for some other specific reason.

The safety document must be completed before the service provision begins. The safety document only needs to be submitted to the surveillance authority on request. The Consumer Safety Act does not include an authorisation procedure for service safety arrangements or the safety document.

Under the Consumer Safety Act, the service provider is always responsible for the safety of its operations. Responsibility for safety does not pass from the service provider (to any other party such as the surveillance authority or customer) following any measure such as the drawing up of the safety document or its submission to the authority, any inspections conducted by the surveillance authority or declarations/commitments signed by a customer.

In addition to information presented in writing, operators must also in practice act in the manner described in the safety document and make sure their employees are familiar with and capable of acting in compliance with the safety document.

In addition to the safety document, service providers must maintain an incident log of any accidents and other incidents. Serious accidents and hazardous situations must be reported to the surveillance authority as laid down in section 8 of the Consumer Safety Act.

How to draw up the safety document

Only issues relevant to the activity in question need to be included in the safety document. The scope and level of detail of the safety document must be appropriate to the scope of the services provided and the risks involved in them. It should be remembered that the safety document is not primarily drawn up for the authorities but for the operator itself.

Each operator must make its safety document suitable for its own activities and operating environment. If a service is produced by several providers, such as subcontractors, it is important to ensure that the entire chain (in terms of issues such as leadership responsibilities) is taken into consideration in safety planning. When the activities take place on a larger scale it may be necessary to include function-specific safety guidelines or plans as appendices to the safety document.

Safety plans must be realistic. Grand statements and complex plans rarely work in practice when there is an emergency.

It is, however, very important to include specifically those issues that are relevant to the activity in question in the safety document. The scope and level of detail of the safety document must be appropriate to the scope of the services provided and the risks involved in them. It may be better to begin with, perhaps, a slightly simpler version and develop it further on the basis of experiences gained.

External experts (consultants) can also be employed in the formulation of the safety document, but it is important for the operator’s representatives to participate closely in the process to make sure the safety document and issues such as risk assessment reflect the real-life activities. This also enables those participating in the day-to-day operations to have their voices heard, learn about the process and become committed to the safety-oriented approach.

The safety document must be kept constantly up-to-date and updated whenever changes take place in circumstances. Changes calling for updates include new locations or premises, equipment or machinery as well as changes in operating methods.

Issues that need to be taken into consideration in the safety document include the ways in which weather or light conditions and sudden changes in these may affect service provision. For example, good snowmobile user training provided orally during low-daylight hours will not work in practice if the location is not properly lit so that the customer can personally see the controls and how they are used.

Service providers that maintain or are responsible for several very similar sites (such as playgrounds maintained by a municipality, which can total hundreds in large municipalities) can produce one common safety document for such sites, with each individual site's special safety aspects also covered in the document, if necessary. This procedure reduces the workload of municipal maintenance organisations in particular as regards the formulation and especially the maintenance of safety documents. It should, however, be remembered that this procedure must not result in lower levels of detail, standards, quality, practical implementation or updates of safety planning in comparison with a system where site-specific safety documents are produced for each individual site.

Ensuring personnel awareness of the safety document

The safety document must be discussed with every member of the personnel (including any substitutes, seasonal workers and volunteers) and they must verify that they have understood the content by their signature. The safety document must be stored in an easy-to-find location, and the personnel must know where this is.

The content of the safety document must be regularly revised with the personnel. The safety document must always be covered in conjunction with the induction of new employees. It is important for the personnel’s safety-related competence to conduct practical exercises to practice the action to be taken in different types of emergency.

The safety document does not need to be presented to customers (but can, of course, be presented if the enterprise finds this appropriate) or published on the enterprise website or other location. It should be noted that this does not release the service provider from the responsibility to provide warnings and instructions that are necessary for safety. It should also be remembered that it is not usually appropriate to make material related to certain aspects of safety (incl. security guard arrangements and other corresponding safety and security arrangements) accessible by outsiders.

Combining the safety document with other safety-related plans

If it is required under legislation that a rescue, preparedness or other corresponding plan must be drawn up for the same service, the safety plan in accordance with the Consumer Safety Act can be incorporated into that document. For example, Finnish rescue legislation requires that operators draw up a rescue plan, and a comprehensive rescue plan covers in many respects the same issues as a safety plan. Therefore it often makes sense to combine these safety-related plans under one document. This way the operator only has one safety-related plan to update and teach to the personnel. Care should, however, be taken to make sure the safety document meets the requirements set for it under the Consumer Safety Act and the Government Decree on safety documents in cases where the document is incorporated into a safety plan formulated under other legislation.