DECISION OF THE EEA JOINT COMMITTEE No 22/2023

of 3 February 2023

amending Annex XI (Electronic communication, audiovisual services and information society) and Protocol 37 (containing the list provided for in Article 101) to the EEA Agreement [2023/2306]

THE EEA JOINT COMMITTEE,

Having regard to the Agreement on the European Economic Area (‘the EEA Agreement’), and in particular Article 98 thereof,

Whereas:

(1) Regulation (EU) 2019/881 of the European Parliament and of the Council of 17 April 2019 on ENISA (the European Union Agency for Cybersecurity) and on information and communications technology cybersecurity certification and repealing Regulation (EU) No 526/2013 (Cybersecurity Act) ( 1 ) is to be incorporated into the EEA Agreement.

(2) Regulation (EU) 2019/881 repeals Regulation (EU) No 526/2013 of the European Parliament and of the Council ( 2 ) , which is incorporated into the EEA Agreement and which is consequently to be repealed under the EEA Agreement.

(3) Annex XI and Protocol 37 to the EEA Agreement should therefore be amended accordingly,

HAS ADOPTED THIS DECISION:

Article 1

The text of point 5cp (Regulation (EU) No 526/2013 of the European Parliament and of the Council) of Annex XI to the EEA Agreement is replaced by the following:

‘ 32019 R 0881 : Regulation (EU) 2019/881 of the European Parliament and of the Council of 17 April 2019 on ENISA (the European Union Agency for Cybersecurity) and on information and communications technology cybersecurity certification and repealing Regulation (EU) No 526/2013 (Cybersecurity Act) ( OJ L 151, 7.6.2019, p. 15 ).

The text of the Regulation shall, for the purposes of this Agreement, be read with the following adaptations:

(a) Unless otherwise stipulated below, and notwithstanding the provisions of Protocol 1 to the Agreement, the term ‘Member State(s)’ and other terms referring to their authorities contained in the Regulation shall be understood to include, in addition to their meaning in the Regulation, the EFTA States and their authorities.

(b) As regards the EFTA States, the Agency shall, as and when appropriate, assist the EFTA Surveillance Authority or the Standing Committee, as the case may be, in the performance of their respective tasks.

(d) The following paragraph shall be added in Article 14:

“5. The EFTA States shall participate fully in the Management Board and shall within it have the same rights and obligations as EU Member States, except for the right to vote.”

(e) The following paragraph shall be added in Article 28:

“4. Regulation (EC) No 1049/2001 shall, for the application of this Regulation, apply to any documents of the Agency regarding the EFTA States as well.”

(f) The following paragraph shall be added in Article 30:

“3. The EFTA States shall participate in the contribution from the Union referred to in paragraph 1 point (a). For this purpose, the procedures laid down in Article 82(1)(a) of and Protocol 32 to the EEA Agreement shall apply mutatis mutandis .”

(g) The following paragraph shall be added in Article 34:

“By way of derogation from Article 12(2)(a) and 82(3)(a) of the Conditions of employment of Other Servants of the European Union, nationals of the EFTA States enjoying their full rights as citizens may be engaged under contract by the Executive Director of the Agency.”

(h) The following paragraph shall be added in Article 35:

“The EFTA States shall grant privileges and immunities to the Agency and its staff equivalent to those contained in the Protocol on Privileges and Immunities of the European Union.”

(i) The following paragraph shall be added in Article 40:

“3. By way of derogation from Articles 12(2)(e), 82(3)(e) and 85(3) of the Conditions of Employment of Other Servants of the European Union, the languages referred to in Article 129(1) of the EEA Agreement shall be considered by the Agency, in respect of its staff, as languages of the Union referred to in Article 55(1) of the Treaty on European Union.”

(j) The following paragraph shall be added in Article 62:

“6. The EFTA States shall participate fully in the European Cybersecurity Certification Group, except for the right to vote.”’

Article 2

The following point is added in Protocol 37 to the EEA Agreement:

‘48.

European Cybersecurity Certification Group (Regulation (EU) 2019/881 of the European Parliament and of the Council).’

Article 3

The text of Regulation (EU) 2019/881 in the Icelandic and Norwegian languages, to be published in the EEA Supplement to the Official Journal of the European Union , shall be authentic.

Article 4

This Decision shall enter into force on 4 February 2023, provided that all the notifications under Article 103(1) of the EEA Agreement have been made ( *1 ) , or on the day of the entry into force of Decision of the EEA Joint Committee No 21/2023 of 3 February 2023 ( 3 ) , whichever is the later.

Article 5

This Decision shall be published in the EEA Section of, and in the EEA Supplement to, the Official Journal of the European Union .

Done at Brussels, 3 February 2023.

For the EEA Joint Committee

The President

Nicolas VON LINGEN

( 1 ) OJ L 151, 7.6.2019, p. 15 .

( 2 ) OJ L 165, 18.6.2013, p. 41 .

( *1 ) Constitutional requirements indicated.

( 3 ) OJ L, 2023/2310, 19.10.2023, ELI: http://data.europa.eu/eli/dec/2023/2310/oj .

Joint Declaration by the Contracting Parties

to Decision No 22/2023 incorporating Regulation (EU) 2019/881 of the European Parliament and of the Council into the Agreement

The parties acknowledge that the incorporation of this act is without prejudice to the direct application of Protocol 7 on the privileges and immunities of the European Union to the nationals of EFTA States in the territory of each Member State of the European Union, pursuant to Article 11 of that Protocol.

ELI: http://data.europa.eu/eli/dec/2023/2306/oj

ISSN 1977-0677 (electronic edition)