Action brought on 8 October 2025 by the EFTA Surveillance Authority against Norway (Case E-22/25)
Date: 2025-10-08
Institutions: EFTA Court
Subjects: European Economic Area, European Union Agency for Cybersecurity, Norway, computer crime, information security, information technology, national implementing measure, operation of the Institutions, transmission network








C_202506335EN.000101.fmx.xml












Official Journal of the European Union


EN
C series













C/2025/6335


20.11.2025






Action brought on 8 October 2025 by the EFTA Surveillance Authority against Norway
(Case E-22/25)
(C/2025/6335)

An action against the Kingdom of Norway was brought before the EFTA Court on 8 October 2025 by the EFTA Surveillance Authority, represented by Sigurbjörn Bernharð Edvardsson, Hildur Hjörvar, Sigrún Ingibjörg Gísladóttir and Melpo-Menie Joséphidès, acting as Agents of the EFTA Surveillance Authority, Avenue de Arts 19H, 1000 Bruxelles/Brussel, Belgique/België.
The EFTA Surveillance Authority requests the EFTA Court to:






(1)


Declare that Norway has failed to fulfil its obligations under Article 7 of the EEA Agreement by failing to make the Act referred to at point 5cp of Annex XI and point 48 of Protocol 37 to the EEA Agreement (Regulation (EU) 2019/881 of the European Parliament and of the Council of 17 April 2019 on ENISA (the European Union Agency for Cybersecurity) and on information and communications technology cybersecurity certification and repealing Regulation (EU) No 526/2013 (Cybersecurity Act)), as adapted by Protocol 1 to the EEA Agreement, part of its internal legal order, and










(2)


Order Norway to bear the costs of these proceedings.





Legal and factual background and pleas in law adduced in support:







—


By this application, the EFTA Surveillance Authority (‘ESA’) seeks a declaration from the Court that Norway has failed to adopt the measures necessary to make the Act referred to at point 5cp of Annex XI and point 48 of Protocol 37 to the EEA Agreement (Regulation (EU) 2019/881 of the European Parliament and of the Council of 17 April 2019 on ENISA (the European Union Agency for Cybersecurity) and on information and communications technology cybersecurity certification and repealing Regulation (EU) No 526/2013 (Cybersecurity Act)), as adapted by Protocol 1 to that Agreement, part of its internal legal order, as required by Article 7 EEA.










—


ESA sent a letter of formal notice to Norway on 4 November 2024, requesting Norway to submit its observations within two months of its receipt.










—


Norway responded to the letter of formal notice on 6 January 2025, explaining that the Act had only been partially incorporated into Norwegian law. Norway clarified that while provisions concerning ENISA had already been incorporated, provisions concerning the cybersecurity certification framework required the adoption of supplementary legislation. Norway also explained that it had launched a public consultation on a proposal for such legislation and that it could enter into force by end of 2025.










—


ESA delivered a reasoned opinion on 26 March 2025 maintaining its conclusions set out in the letter of formal notice and giving Norway two months to take the necessary measures to comply with the reasoned opinion, i.e. no later than 26 May 2025.










—


In its reply on 28 May 2025, Norway referred to its answer to the letter of formal notice and acknowledged that the preparation of the legislation was delayed compared to the timeline set out in its earlier reply.










—


Since Norway had not complied with the reasoned opinion by the deadline set therein, ESA on 8 October 2025, decided to bring the matter before the Court, pursuant to Article 31 SCA.










—


ESA notes that at the point of lodging the present application, Norway has neither made the Act part of its internal legal order, nor has it informed ESA of having done so.






ELI: http://data.europa.eu/eli/C/2025/6335/oj
ISSN 1977-091X (electronic edition)