# L_2023039EN.01004101.xml

| 9.2.2023 | EN | Official Journal of the European Union | L 39/41 |
| --- | --- | --- | --- |

9.2.2023

EN

Official Journal of the European Union

L 39/41

---

COUNCIL DECISION (EU) 2023/271

of 30 January 2023

on the position to be adopted, on behalf of the European Union, within the EEA Joint Committee concerning an amendment to Annex XI (Electronic communication, audiovisual services and information society) and Protocol 37 (containing the list provided for in Article 101) to the EEA Agreement (NIS)

(Text with EEA relevance)

THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 114 in conjunction with Article 218(9) thereof,

Having regard to Council Regulation (EC) No 2894/94 of 28 November 1994 concerning arrangements for implementing the Agreement on the European Economic Area (1), and in particular Article 1(3) thereof,

Having regard to the proposal from the European Commission,

Whereas:

| (1) | The Agreement on the European Economic Area (2) (‘the EEA Agreement’) entered into force on 1 January 1994. |
| --- | --- |

(1)

The Agreement on the European Economic Area (2) (‘the EEA Agreement’) entered into force on 1 January 1994.

| (2) | Pursuant to Article 98 of the EEA Agreement, the EEA Joint Committee may decide to amend, inter alia, Annex XI (Electronic communication, audiovisual services and information society) and Protocol 37 (containing the list provided for in Article 101) to the EEA Agreement. |
| --- | --- |

(2)

Pursuant to Article 98 of the EEA Agreement, the EEA Joint Committee may decide to amend, inter alia, Annex XI (Electronic communication, audiovisual services and information society) and Protocol 37 (containing the list provided for in Article 101) to the EEA Agreement.

| (3) | Directive (EU) 2016/1148 of the European Parliament and of the Council (3) is to be incorporated into the EEA Agreement. |
| --- | --- |

(3)

Directive (EU) 2016/1148 of the European Parliament and of the Council (3) is to be incorporated into the EEA Agreement.

| (4) | For the EEA Agreement to function well, Protocol 37 to the EEA Agreement is to be extended to include the Cooperation Group set up by Directive (EU) 2016/1148. |
| --- | --- |

(4)

For the EEA Agreement to function well, Protocol 37 to the EEA Agreement is to be extended to include the Cooperation Group set up by Directive (EU) 2016/1148.

| (5) | Annex XI and Protocol 37 to the EEA Agreement should therefore be amended accordingly. |
| --- | --- |

(5)

Annex XI and Protocol 37 to the EEA Agreement should therefore be amended accordingly.

| (6) | The position of the Union within the EEA Joint Committee should therefore be based on the attached draft decision, |
| --- | --- |

(6)

The position of the Union within the EEA Joint Committee should therefore be based on the attached draft decision,

HAS ADOPTED THIS DECISION:

Article 1

The position to be adopted, on the Union’s behalf, within the EEA Joint Committee on the proposed amendment to Annex XI (Electronic communication, audiovisual services and information society) and Protocol 37 (containing the list provided for in Article 101) to the EEA Agreement, shall be based on the draft decision of the EEA Joint Committee attached to this Decision.

Article 2

This Decision shall enter into force on the date of its adoption.

Done at Brussels, 30 January 2023.

For the Council

The President

P. KULLGREN

---

(1)  
  OJ L 305, 30.11.1994, p. 6.

1

(2)  
  OJ L 1, 3.1.1994, p. 3.

2

(3)  Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union (OJ L 194, 19.7.2016, p. 1).

3

---

DRAFT

DECISION OF THE EEA JOINT COMMITTEE No ...

of ...

amending Annex XI (Electronic communication, audiovisual services and information society) and Protocol 37 (containing the list provided for in Article 101) to the EEA Agreement

THE EEA JOINT COMMITTEE,

Having regard to the Agreement on the European Economic Area (‘the EEA Agreement’), and in particular Article 98 thereof,

Whereas:

| (1) | Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union (1) is to be incorporated into the EEA Agreement. |
| --- | --- |

(1)

Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union (1) is to be incorporated into the EEA Agreement.

| (2) | Commission Implementing Regulation (EU) 2018/151 of 30 January 2018 laying down rules for application of Directive (EU) 2016/1148 of the European Parliament and of the Council as regards further specification of the elements to be taken into account by digital service providers for managing the risks posed to the security of network and information systems and of the parameters for determining whether an incident has a substantial impact (2) is to be incorporated into the EEA Agreement. |
| --- | --- |

(2)

Commission Implementing Regulation (EU) 2018/151 of 30 January 2018 laying down rules for application of Directive (EU) 2016/1148 of the European Parliament and of the Council as regards further specification of the elements to be taken into account by digital service providers for managing the risks posed to the security of network and information systems and of the parameters for determining whether an incident has a substantial impact (2) is to be incorporated into the EEA Agreement.

| (3) | For the EEA Agreement to function well, Protocol 37 to the EEA Agreement is to be extended to include the Cooperation Group set up by Directive (EU) 2016/1148. |
| --- | --- |

(3)

For the EEA Agreement to function well, Protocol 37 to the EEA Agreement is to be extended to include the Cooperation Group set up by Directive (EU) 2016/1148.

| (4) | Annex XI and Protocol 37 to the EEA Agreement should therefore be amended accordingly, |
| --- | --- |

(4)

Annex XI and Protocol 37 to the EEA Agreement should therefore be amended accordingly,

HAS ADOPTED THIS DECISION:

Article 1

The following is inserted after point 5cp (Regulation (EU) No 526/2013 of the European Parliament and of the Council) of Annex XI to the EEA Agreement:

| ‘5cpa. | 32016 L 1148: Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union (OJ L 194, 19.7.2016, p. 1).
  Modalities for association of the EFTA States in accordance with Article 101 of the Agreement:
  The EFTA States shall participate fully in the Cooperation Group and shall within it have the same rights and obligations as EU Member States, except for the right to vote. |
| --- | --- |

‘5cpa.

32016 L 1148: Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union (OJ L 194, 19.7.2016, p. 1).

Modalities for association of the EFTA States in accordance with Article 101 of the Agreement:

The EFTA States shall participate fully in the Cooperation Group and shall within it have the same rights and obligations as EU Member States, except for the right to vote.

| 5cpaa. | 32018 R 0151: Commission Implementing Regulation (EU) 2018/151 of 30 January 2018 laying down rules for application of Directive (EU) 2016/1148 of the European Parliament and of the Council as regards further specification of the elements to be taken into account by digital service providers for managing the risks posed to the security of network and information systems and of the parameters for determining whether an incident has a substantial impact (OJ L 26, 31.1.2018, p. 48).’. |
| --- | --- |

5cpaa.

32018 R 0151: Commission Implementing Regulation (EU) 2018/151 of 30 January 2018 laying down rules for application of Directive (EU) 2016/1148 of the European Parliament and of the Council as regards further specification of the elements to be taken into account by digital service providers for managing the risks posed to the security of network and information systems and of the parameters for determining whether an incident has a substantial impact (OJ L 26, 31.1.2018, p. 48).’.

Article 2

The following point is added in Protocol 37 to the EEA Agreement:

| ‘43. | The Cooperation Group (Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union).’. |
| --- | --- |

‘43.

The Cooperation Group (Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union).’.

Article 3

The texts of Directive (EU) 2016/1148 and Implementing Regulation (EU) 2018/151 in the Icelandic and Norwegian languages, to be published in the EEA Supplement to the Official Journal of the European Union, shall be authentic.

Article 4

This Decision shall enter into force on [...], provided that all the notifications under Article 103(1) of the EEA Agreement have been made (*1).

Article 5

This Decision shall be published in the EEA Section of, and in the EEA Supplement to, the Official Journal of the European Union.

Done at Brussels,

For the EEA Joint Committee

The President

The Secretaries

To the EEA Joint Committee

---

(1)  
  OJ L 194, 19.7.2016, p. 1.

1

(2)  
  OJ L 26, 31.1.2018, p. 48.

2

(*1)  [No constitutional requirements indicated.] [Constitutional requirements indicated.]

*1

---