Action brought on 8 October 2025 by the EFTA Surveillance Authority against Iceland (Case E-21/25)
Date: 2025-10-08
Institutions: EFTA Court
Subjects: European Economic Area, European Union Agency for Cybersecurity, Iceland, computer crime, information security, information technology, national implementing measure, operation of the Institutions, transmission network








C_202506336EN.000101.fmx.xml












Official Journal of the European Union


EN
C series













C/2025/6336


20.11.2025






Action brought on 8 October 2025 by the EFTA Surveillance Authority against Iceland
(Case E-21/25)
(C/2025/6336)

An action against Iceland was brought before the EFTA Court on 8 October 2025 by the EFTA Surveillance Authority, represented by Sigurbjörn Bernharð Edvardsson, Hildur Hjörvar, Sigrún Ingibjörg Gísladóttir and Melpo-Menie Joséphidès, acting as Agents of the EFTA Surveillance Authority, Avenue de Arts 19H, 1000 Bruxelles/Brussel, Belgique/België.
The EFTA Surveillance Authority requests the EFTA Court to:






(1)


Declare that Iceland has failed to fulfil its obligations under Article 7 of the EEA Agreement by failing to make the Act referred to at point 5cp of Annex XI and point 48 of Protocol 37 to the EEA Agreement (Regulation (EU) 2019/881 of the European Parliament and of the Council of 17 April 2019 on ENISA (the European Union Agency for Cybersecurity) and on information and communications technology cybersecurity certification and repealing Regulation (EU) No 526/2013 (Cybersecurity Act)), as adapted by Protocol 1 to the EEA Agreement, part of its internal legal order, and










(2)


Order Iceland to bear the costs of these proceedings.





Legal and factual background and pleas in law adduced in support:







—


By this application, the EFTA Surveillance Authority (‘ESA’) seeks a declaration from the Court that Iceland has failed to adopt the measures necessary to make the Act referred to at point 5cp of Annex XI and point 48 of Protocol 37 to the EEA Agreement (Regulation (EU) 2019/881 of the European Parliament and of the Council of 17 April 2019 on ENISA (the European Union Agency for Cybersecurity) and on information and communications technology cybersecurity certification and repealing Regulation (EU) No 526/2013 (Cybersecurity Act)), as adapted by Protocol 1 to that Agreement, part of its internal legal order, as required by Article 7 EEA.










—


ESA sent a letter of formal notice to Iceland on 4 November 2024, requesting Iceland to submit its observations within two months of its receipt.










—


Iceland did not respond to the letter of formal notice.










—


ESA delivered a reasoned opinion on 26 March 2025 maintaining its conclusions set out in the letter of formal notice and giving Iceland two months to take the measures necessary to comply with the reasoned opinion, i.e. no later than 26 May 2025.










—


Iceland did not reply to the reasoned opinion.










—


Since Iceland had not complied with the reasoned opinion by the deadline set therein, ESA on 8 October 2025, decided to bring the matter before the Court, pursuant to Article 31 SCA.










—


ESA notes that at the point of lodging the present application, Iceland has neither made the Act part of its internal legal order, nor has it informed ESA of having done so.






ELI: http://data.europa.eu/eli/C/2025/6336/oj
ISSN 1977-091X (electronic edition)