Decision of the EEA Joint Committee No 137/2025 of 13 June 2025 amending Annex IX (Financial services) to the EEA Agreement [2025/1843]
Date: 2025-06-13
Institutions: EEA Joint Committee
Subjects: European Economic Area, exchange of information, financial services, information security, information technology, information warfare, market supervision, revision of an agreement, risk management, technical standard




L_202501843EN.000101.fmx.xml












Official Journal of the European Union


EN
L series













2025/1843


2.10.2025







            DECISION OF THE EEA JOINT COMMITTEE No 137/2025
of 13 June 2025
         
amending Annex IX (Financial services) to the EEA Agreement [2025/1843]


THE EEA JOINT COMMITTEE,

Having regard to the Agreement on the European Economic Area (“the EEA Agreement”), and in particular Article 98 thereof,

Whereas:







(1)


Commission Delegated Regulation (EU) 2025/295 of 24 October 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards on harmonisation of conditions enabling the conduct of the oversight activities (1) is to be incorporated into the EEA Agreement.












(2)


Commission Delegated Regulation (EU) 2025/301 of 23 October 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying the content and time limits for the initial notification of, and intermediate and final report on, major ICT-related incidents, and the content of the voluntary notification for significant cyber threats (2) is to be incorporated into the EEA Agreement.












(3)


Annex IX to the EEA Agreement should therefore be amended accordingly,





HAS ADOPTED THIS DECISION:



Article 1
The following points are inserted after point 31qc (Commission Delegated Regulation (EU) 2024/1774) of Annex IX to the EEA Agreement:






‘31qg.



32025 R 0295: Commission Delegated Regulation (EU) 2025/295 of 24 October 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards on harmonisation of conditions enabling the conduct of the oversight activities (OJ L, 2025/295, 13.2.2025).










31qh.



32025 R 0301: Commission Delegated Regulation (EU) 2025/301 of 23 October 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying the content and time limits for the initial notification of, and intermediate and final report on, major ICT-related incidents, and the content of the voluntary notification for significant cyber threats (OJ L, 2025/301, 20.2.2025).’






Article 2
The texts of Delegated Regulations (EU) 2025/295 and (EU) 2025/301 in the Icelandic and Norwegian languages, to be published in the EEA Supplement to the Official Journal of the European Union, shall be authentic.


Article 3
This Decision shall enter into force on 14 June 2025, provided that all the notifications under Article 103(1) of the EEA Agreement have been made (*1), or on the day of the entry into force of Decision of the EEA Joint Committee No 40/2025 of 20 February 2025 (3), whichever is the later.


Article 4
This Decision shall be published in the EEA Section of, and in the EEA Supplement to, the Official Journal of the European Union.




Done at Brussels, 13 June 2025.


For the EEA Joint Committee


The President

Nicolas VON LINGEN
            





(1)  
            OJ L, 2025/295, 13.2.2025, ELI: http://data.europa.eu/eli/reg_del/2025/295/oj.

(2)  
            OJ L, 2025/301, 20.2.2025, ELI: http://data.europa.eu/eli/reg_del/2025/301/oj.

(*1)  No constitutional requirements indicated.

(3)  
            OJ L, 2025/770, 8.5.2025, ELI: http://data.europa.eu/eli/dec/2025/770/oj.


ELI: http://data.europa.eu/eli/dec/2025/1843/oj
ISSN 1977-0677 (electronic edition)